last executing test programs: 4.447598588s ago: executing program 0 (id=4269): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x400, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x40}}}]}, {0xfe6c}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x7, 0x4, 0x20, 0x1}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) socket$netlink(0x10, 0x3, 0x15) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) socket$vsock_stream(0x28, 0x1, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=@newtaction={0xf0, 0x30, 0x1, 0xe501, 0x0, {}, [{0xdc, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x30, 0x1, {0x0, 0x81000000, 0x800, 0x0, 0x0, {0x0, 0x1}, {}, 0x8001}}]]}, {0x4}, {0xc}, {0xc}}}, @m_police={0x6c, 0x2, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x0, 0x0, 0x0, 0x400000, {0x0, 0x0, 0x0, 0x0, 0xffff}, {0x4}}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0xf0}}, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x481, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000300), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r4, 0xc2c45512, 0x0) 4.447465311s ago: executing program 2 (id=4270): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001e40)={0x54, 0x12, 0x101, 0x0, 0x0, {0x0, 0xfe, 0x4, 0x0, {0x0, 0x2000, [0x0, 0x0, 0x1], [0x8, 0x0, 0x0, 0x100]}, 0x400}, [@INET_DIAG_REQ_BYTECODE={0x8, 0x1, "4cbdf778"}]}, 0x54}}, 0x0) 4.388038191s ago: executing program 2 (id=4271): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) futex(&(0x7f0000000040)=0x2, 0x6, 0x1, &(0x7f0000000080)={0x77359400}, 0x0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x46, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000340)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x3, 0x0, 0x7, 0xfa11, 0xffffffff}, 0x0) r3 = openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r3, 0xc0f8565c, &(0x7f0000000000)={0x0, 0x6, 0x0, {0xa, @pix_mp={0x0, 0x0, 0x41414270, 0x0, 0x0, [{}, {}, {0x0, 0xffffffff}, {}, {}, {}, {0x0, 0x7}], 0x7}}, 0xfffffffc}) openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) r4 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r4, 0x4020565a, &(0x7f0000000180)={0x3, 0x980900, 0x1}) ioctl$VIDIOC_DQEVENT(r4, 0x80885659, &(0x7f0000000240)={0x0, @src_change}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) r5 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) ioctl$EVIOCGMASK(r5, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"}) ioctl$EVIOCGLED(r5, 0x80404519, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xf8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x9, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x1}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}, 0x40, 0x80}, [@tmpl={0x44, 0x5, [{{@in6=@mcast2, 0x3, 0x3c}, 0x0, @in6=@empty, 0x0, 0x0, 0x3}]}]}, 0xf8}}, 0x4810) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000100), 0x2, 0x6}}, 0x20) sendmsg$nl_xfrm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="02000000000000005000110000000000000000000000ffff7f000001fc00000000000000000000000000000164010102000000000000000000000000fc0200000000000000000000000000003c00000000000000020008002c"], 0xcc}, 0x1, 0x0, 0x0, 0x800}, 0x42000) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af60, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) syz_usb_connect(0x0, 0x12, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_vlan\x00'}) sendmsg$nl_route_sched(r8, 0x0, 0x0) 2.954035597s ago: executing program 0 (id=4281): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, 0x0, 0x0) 2.899071688s ago: executing program 0 (id=4283): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000300)={0x73622a85, 0x10a}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ppoll(&(0x7f0000000280)=[{r3, 0x2060}], 0x1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) (fail_nth: 3) 2.555905672s ago: executing program 3 (id=4291): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, 0x0, 0x0) 2.488548465s ago: executing program 3 (id=4292): r0 = add_key(&(0x7f0000000080)='trusted\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000100)="cb01558bb6f1d520dc4c8e66aa090f96f8a61655d43b447637be23cae81a168b5487da5f394e3e74277a7d171755f1e80bd78d", 0x33, 0xfffffffffffffffb) add_key(&(0x7f0000000040)='ceph\x00', 0x0, &(0x7f0000000240)="01fe000200373a4541062000a59ea940d2cb0b3692f5020000a0be21c44e00"/44, 0x2c, r0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000001140), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r1, &(0x7f0000000980)={0x2, 0x0, {0x0, 0x4b, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r1, &(0x7f0000002080)={0x2, 0x0, {&(0x7f0000001f80)=""/152, 0x98, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r1, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000540)=""/224, 0xe0, 0x0, 0x2, 0x2}}, 0x48) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_LOOPBACK(r2, 0x65, 0x3, 0x0, 0x0) timer_create(0x1, &(0x7f0000000200)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0xd3283d036ae269b3, 0x8031, 0xffffffffffffffff, 0x99cf0000) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSBRKP(r4, 0x5425, 0x0) write$vhost_msg_v2(r1, &(0x7f0000000340)={0x2, 0x0, {&(0x7f0000000a00)=""/274, 0x112, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r1, &(0x7f00000003c0)={0x2, 0x0, {&(0x7f00000002c0)=""/119, 0xfca2, 0x0, 0x0, 0x3}}, 0x48) 2.42898906s ago: executing program 3 (id=4293): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f0000000040), 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0xd, 0x0, 0xfffffe0000000009, 0xfa11, 0xffffffff}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000002340)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca0200000000000000adcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d070490893616810a121ff4feedd1d176b313b9fc7bf31ddff431a4a50760ce18a76c4b7aa73cec3eec984c76d16f798c436410f3f4a41715e736a132c3cb9421be0b3c2bd40b75896c007fa2d47e3d8392d905d582b8eff689b0f493770c91e8c2e8bd0b08ffa4fd0289b04b0ea024768d196ef721314d68d29988b01871c6ea39f95a0b77744caadd24867acab274e8e4bf3fb44df31e15ffdce52f9f6"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1f) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f00000001c0)={0x1, 0x0, [{0xd, 0x9, 0x83, 0x0, 0xd}]}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f00000000c0)={'rti800\x00', [0x3, 0x10000, 0x2, 0x10000421, 0x5, 0xcc7, 0x7ffffffe, 0xa, 0x5, 0x3ff, 0x0, 0x300, 0x5, 0x1, 0x9, 0x800, 0x40400, 0x8, 0x6, 0x1fe, 0x80000089, 0x7, 0x1400000, 0x20001e54, 0xffffeadb, 0x3, 0x3d, 0x8, 0x4, 0x7fffffe]}) prctl$PR_CAP_AMBIENT(0x2f, 0x1, 0x7) prctl$PR_SET_IO_FLUSHER(0x43, 0x3) r5 = creat(&(0x7f0000000200)='./file1\x00', 0x7b) write$binfmt_script(r5, &(0x7f00000002c0)={'#! ', './file0', [], 0xa, "1f410e2852ad52cb07410969e814977e4f2c4a80522094786c8673fb61cf8b86bd030000005a3c7c04055f1f70e4064d46b2bb9e5100d446bb6afb2c0fc07b58f4a9c1006a0b6c05639e23ec12979ff9b48ca61e6dec58682449c75d86eb4337b8d343ed9c18927289d3d788fa281a5742690ff5a505cfff34fc1503afbfd2d44b50e4ca119f67b2890064"}, 0x96) close(r5) getpgid(0x0) ptrace$ARCH_MAP_VDSO_64(0x1e, 0x0, 0xf, 0x2003) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), 0x0, 0x800}, 0x38) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000640)={[&(0x7f0000000440)='(%+', &(0x7f0000000480)='*3-\x00']}) unshare(0xa000080) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) 2.039565387s ago: executing program 0 (id=4294): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000000feffff720a00fef8ffffff71a400fe0000000071101000000000001d300200000000004704000001ed030407030000020000001d440000000000006b0a20fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) 1.869245788s ago: executing program 0 (id=4295): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000300)={0x73622a85, 0x10a}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ppoll(&(0x7f0000000280)=[{r3, 0x2060}], 0x1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 1.868613595s ago: executing program 1 (id=4297): name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1002) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000000feffff720a00fef8ffffff71a400fe0000000071101000000000001d300200000000004704000001ed030407030000020000001d440000000000006b0a20fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) 1.677845582s ago: executing program 1 (id=4298): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1b, 0x4, &(0x7f0000000240)=ANY=[@ANYRES16=0x0], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0) r3 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc0287c02, &(0x7f0000000100)={0x80000000, 0x0, &(0x7f0000000200)=[{{}, {0x80000000, 0x0}}, {{}, {0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r3, 0xc0347c03, &(0x7f00000001c0)={{r5, r4, 0x1, [0x0, 0xf7df]}, {r5, r6, 0x4, [0x6]}, 0x1, [0x8, 0x3df]}) write(r0, &(0x7f0000000300)="6c9773775ea4eaa0", 0x8) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000004c0)=[0x7], 0x0, 0x0, 0x1}}, 0x3c) r7 = socket(0x400000000010, 0x3, 0x0) r8 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r8, 0x4601, &(0x7f0000000380)={0x3c0, 0x78, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x202, 0x1, 0xc}) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000100)={'ah\x00'}, &(0x7f0000000180)=0x1e) r9 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x40042) write$binfmt_aout(r9, &(0x7f0000001840)=ANY=[@ANYBLOB="0000000000000000000000800080000014000091ff0f00004500f5ff06ff07000000fc5e15f4c3d3fbd80dad000057f2"], 0x125) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0xca, 0xac5) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r7) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000001480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001440)={&(0x7f0000000a40)={0x98c, r10, 0x400, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CSA_IES={0x948, 0xb9, 0x0, 0x1, [@NL80211_ATTR_CSA_C_OFF_PRESP={0xa, 0xbb, [0x401, 0x4, 0xda78]}, @NL80211_ATTR_CSA_C_OFF_BEACON={0xe, 0xba, [0xd, 0xd5, 0x56, 0x8, 0x8]}, @beacon_params=[@NL80211_ATTR_IE_PROBE_RESP={0xc, 0x7f, [@mesh_id={0x72, 0x6}]}], @beacon_params=[@NL80211_ATTR_BEACON_HEAD={0x1dc, 0xe, {{{0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x5}, @device_a, @device_b, @from_mac=@device_b, {0x7, 0x2}}, 0x202000000000000, @random=0x150, 0x828, @void, @void, @void, @val={0x4, 0x6, {0xa8, 0xa5, 0xfba0, 0x3}}, @void, @void, @void, @val={0x2a, 0x1, {0x0, 0x0, 0x1}}, @val={0x3c, 0x4, {0x1, 0x6, 0xb9, 0x7}}, @val={0x2d, 0x1a, {0x8000, 0x1, 0x4, 0x0, {0xffffffffffffffff, 0x17c3, 0x0, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x800, 0x3, 0x5}}, @void, @val={0x71, 0x7, {0xffffffffffffffff, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x8, 0x21}}, @val={0x76, 0x6, {0x1, 0x0, 0x0, 0x7}}, [{0xdd, 0xb6, "75346f43183687dbefe345f689ca62fa76575988ec39fbca631fb3174b9b2b3c6ce4be8fc58903e91a62dd14b5764039963bfd1837ab093deb9e5c20fa6c261a7720122cd0dbb189f2461000bda257d18a512bc1067d512581156f8357517bc17d3a7a266fa624475fa70cb75e774c30ebcd70a5eacbfd771d7d2ed273172cbca84e0c1bf3290a917bf59ef05db3eab2b218bb12a3ec729535107a2589c8bcce5417064fc8d6fe655962dd94d6a66901fdb9ca25a5ee"}, {0xdd, 0xbc, "93056006c8889f2055160a03e74ddd7fca9cc9b2a95d38ae89c612cf0fc557d11a5858bfcf36fca5d40ae3e78f69358cfe9a33c8e7459fb04ab3a0f31193c71786f8cb143e1aebf90a4688911692a7370cbf099999ed07ca1c1feee43630928e28ae545431bcb768bf5417b519e002ebd9f635ae2bcb188092725355a289fdba87d42d36165a11ccd92371140bff663cf3120fb75d28989f6c0bcee56ac742d062da20406d07a0a8eba065a50e5d1d332bcf8b971299aaad6aaad702"}]}}, @NL80211_ATTR_IE_PROBE_RESP={0xdd, 0x7f, [@peer_mgmt={0x75, 0x14, {0x0, 0x5ea, @void, @void, @val="9042c9a2422512f7e0d9b10389b2e8bb"}}, @random={0xf, 0xa7, "d8d41b2d6cbb2a5ef11c919c9ee124cd2b37c5b569b94dd54982e49babacb762648cee55b1012f419c65d89b0044cd354621b68ff25f9d0c4fe2b7baf98c46eb7928fc0837d9bb83c5b1759012d932f8b80965743dc4dfe15d48df30b54298cf270880dcefd00c8c3010b0e1e5ed606023432c2bbbfad60492b2aed09ee1b980390cce7c00cffa1e32516b2ed6330309d44e595fbbe8a27d6e8466999b546fef915be562fac69a"}, @measure_req={0x26, 0x18, {0xa, 0x1, 0x2, "5964eaa3687df702748c9ea1d8c03ce7431a26c24e"}}]}, @NL80211_ATTR_IE={0x128, 0x2a, [@peer_mgmt={0x75, 0x16, {0x1, 0x30e, @val=0x9, @void, @val="9013dcf4511c47ea8389d9a2ffc86ac8"}}, @prep={0x83, 0x25, {{0x0, 0x1}, 0x5, 0x3, @broadcast, 0x0, @value=@broadcast, 0x4, 0x3, @device_b, 0x400}}, @channel_switch={0x25, 0x3, {0x1, 0xb9, 0x4}}, @chsw_timing={0x68, 0x4, {0x101, 0x800}}, @perr={0x84, 0xd0, {0x9, 0xe, [{{}, @device_b, 0x1, @void, 0x19}, {{}, @device_a, 0x29ef41a6, @void, 0x36}, {{0x0, 0x1}, @broadcast, 0xb8bb, @value=@device_b, 0x16}, {{0x0, 0x1}, @device_a, 0x7, @value=@device_b, 0x20}, {{0x0, 0x1}, @device_a, 0x8, @value=@device_b, 0x2}, {{}, @device_b, 0x8, @void, 0x25}, {{}, @broadcast, 0x4, @void, 0x3d}, {{}, @device_a, 0x7, @void, 0x33}, {{0x0, 0x1}, @device_a, 0xfffffffc, @value=@device_b, 0x27}, {{}, @device_a, 0x4, @void, 0x39}, {{}, @device_a, 0x6, @void, 0x16}, {{}, @broadcast, 0x2, @void, 0x32}, {{}, @device_a, 0x4, @void, 0x42}, {{}, @device_b, 0x9}]}}, @mesh_chsw={0x76, 0x6, {0xe, 0x7, 0x6, 0x9}}]}, @NL80211_ATTR_BEACON_TAIL={0x15, 0xf, [@cf={0x4, 0x6, {0x8, 0x4, 0x3, 0x4}}, @chsw_timing={0x68, 0x4, {0x100, 0x6}}, @erp={0x2a, 0x1, {0x0, 0x1}}]}, @NL80211_ATTR_IE_PROBE_RESP={0x21, 0x7f, [@dsss={0x3, 0x1, 0x9d}, @mic={0x8c, 0x10, {0xe87, "970d48148abd", @short="51300e02e39706bd"}}, @channel_switch={0x25, 0x3, {0x1, 0x99, 0x7}}, @erp={0x2a, 0x1, {0x1}}]}], @NL80211_ATTR_CSA_C_OFF_BEACON={0xe, 0xba, [0xb, 0x0, 0x7, 0x9, 0x2]}, @NL80211_ATTR_CSA_C_OFF_BEACON={0xa, 0xba, [0x0, 0x4, 0x7]}, @beacon_params=[@NL80211_ATTR_IE={0x26, 0x2a, [@ht={0x2d, 0x1a, {0x8, 0x1, 0x3, 0x0, {0x88a, 0x977, 0x0, 0x7f}, 0x1, 0xff, 0x1}}, @ext_channel_switch={0x3c, 0x4, {0x1, 0x1, 0x95, 0xed}}]}, @NL80211_ATTR_IE={0x52, 0x2a, [@preq={0x82, 0x41, {{0x1, 0x0, 0x0, 0x0, 0x1}, 0x1, 0x4, 0x29, @device_a, 0x1, @value, 0xfffffffb, 0x6, 0x3, [{{0x1}, @device_a, 0x2}, {{0x0, 0x0, 0x1}, @device_b, 0xfffffffc}, {{0x0, 0x0, 0x1}, @device_a, 0x4}]}}, @sec_chan_ofs={0x3e, 0x1}, @gcr_ga={0xbd, 0x6, @broadcast}]}, @NL80211_ATTR_FTM_RESPONDER={0x1f4, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0xb2, 0x3, "7cd8ccc2d284fe28b9a2993a770ff7fd4e360c3ed3cbe86f6bd82f608d3caf4987d721079683d7ae101d7ef57204471dcf5c21429de546d57a843aec5d8be0a68a4c8df5fe60af3ae8c71919bcac2c9e405fc3969775073a27d7875975afb5c3c79728b5152425e26033af943f20e43c5afebaf63db40fe979ec2fd1e5f7db66f1bbc9b20670ad0a51c22acd202c9fe91d68b067ea33e963ee44fbf234a116def17ff8bcaa963a634223ce5e637d"}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0x2d, 0x3, "39237f75e92de5ae91e58947599d21810da988def2dfeb417f13a188efe385e19535f1fe0b4cae620a"}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0x102, 0x3, "70005c42e6e46dbd3849856b8d3f029ed395942c3daae20e66bb3d2ac880622f2197f4289ec335ce25f4519972ca614b003147bf2381ba0733384f24fbf6714f6f351dfdc216ba018bf44f1c9c75909b68010c15884939b573dbd0cd20d75c0829437aacb275839714a7ef9ffc854eed290c3e06a6dbbc31c13fce4cdc78180d8c0cc9553db40057b41f1ef25ad9c32b628efd8335546008406a3e3f50bfbab8b41457bb45dddabd13aabd7dbe41067838e51eefd4fced65ee3b6bcadca5002d490c3b16bff40a0552b7d73fbae869432c77a08bdad73c550638ae67b707aad8a50d80878078cda10605d80315ef7430807513d2e2f40e598d075517c98b"}]}, @NL80211_ATTR_IE_ASSOC_RESP={0x2d, 0x80, [@prep={0x83, 0x1f, {{}, 0x5, 0x1f, @device_a, 0x8, @void, 0x16, 0x1, @device_a, 0x800}}, @mesh_id={0x72, 0x6}]}, @NL80211_ATTR_IE_PROBE_RESP={0x4e, 0x7f, [@sec_chan_ofs={0x3e, 0x1, 0x2}, @supported_rates, @erp={0x2a, 0x1, {0x1}}, @ssid={0x0, 0x6, @default_ibss_ssid}, @ht={0x2d, 0x1a, {0x300, 0x2, 0x7, 0x0, {0x5, 0x3, 0x0, 0x9, 0x0, 0x1, 0x0, 0x1}, 0x6}}, @cf={0x4, 0x6, {0x1, 0x7, 0xa2, 0x5}}, @supported_rates={0x1, 0x4, [{0x60}, {0x36}, {0x2, 0x1}, {0xa9633ab0a4c0e34d, 0x1}]}, @mesh_chsw={0x76, 0x6, {0xe4, 0xf, 0x37, 0xcd5}}, @cf={0x4, 0x6, {0x1, 0x8, 0x7fff, 0x8}}]}, @NL80211_ATTR_IE={0x33, 0x2a, [@mesh_chsw={0x76, 0x6, {0x6, 0xf, 0x9, 0x8000}}, @challenge={0x10, 0x1, 0x87}, @erp={0x2a, 0x1, {0x1, 0x0, 0x1}}, @ext_channel_switch={0x3c, 0x4, {0x0, 0x0, 0x8c, 0x8}}, @ibss={0x6, 0x2, 0x8}, @challenge={0x10, 0x1, 0x38}, @link_id={0x65, 0x12, {@from_mac=@device_b, @broadcast, @device_b}}]}, @NL80211_ATTR_FTM_RESPONDER={0x1a4, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_LCI={0xdc, 0x2, "1e764360a09429f388867091842faab5e01d6a05f3ab059b68d4f0df3208a87586f695beaa90fd7444ab809fb72902281a6f603eb7bffc4501bfb906ad2d98c07d8b170b8e59c61715ad66406c31065e442deb1b8edaba235d1bab705c72d36c381fbf52aee5673e0fa2b207f20694322bd0fc38264a461ef0cad38deb1d1108945014f9a5d9de3f51d95a36d6e6467ea8d5eeced8283d16618a833d7d0ceaa8ee02454a39c82f4741118a35c713dfea841c9076b0a9664cfb2c4217e37be419343dff633c3254123fb64d4fa84bb1d57b949e79fdc1e3c1"}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0xc2, 0x3, "cb13b7781bf05b47fea73ea1181be0e0f9d34b499841e8e1f1d327699150ce4a9049ea747ce4dfad3789d1b2d2cd490aca50fa4bce98983aeddc3f522479d24978ad3f3a506d080bf20cf7d161c6531dfceec0d8403e2145c3e1c695cbf5e6f0082bbd5d9e97274566c7d82fd37da8154bb2c2f8473d774998c81c19f2934c4d7d8f9c0b76b312c48751e974cc51e9af61d5d959061a81fd35c0243c907abe1aefbcd34606002d3913b5b3fa818ed63c657f22dec8b2be31fa3d89f4cffb"}]}, @NL80211_ATTR_BEACON_TAIL={0xa, 0xf, [@chsw_timing={0x68, 0x4, {0xf, 0x4e93}}]}], @NL80211_ATTR_CSA_C_OFF_PRESP={0xa, 0xbb, [0x9, 0x0, 0x7]}]}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CSA_IES={0xc, 0xb9, 0x0, 0x1, [@NL80211_ATTR_CSA_C_OFF_BEACON={0x6, 0xba, [0x401]}]}, @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xb}]}, 0x98c}, 0x1, 0x0, 0x0, 0x11}, 0x80) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) readv(r11, &(0x7f0000000a00)=[{&(0x7f00000001c0)=""/59, 0x3b}], 0x1) r12 = syz_open_dev$swradio(&(0x7f0000000400), 0x1, 0x2) ioctl$VIDIOC_G_FREQUENCY(r12, 0xc02c5638, &(0x7f0000000080)={0x6, 0x4, 0x5}) 1.609521386s ago: executing program 1 (id=4299): mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x2d) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x0, 0x9, 0x6, 0x40, 0xc725, 0x0, 0x8, 0x800003, 0x3}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, 0x0) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x50) kexec_load(0x0, 0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x7ffdd000}], 0xa0000) unshare(0x62040200) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r3, 0x4018f50b, &(0x7f0000000100)={0xfffffffb, 0x0, 0x40}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, 0x0, 0x4000000) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000140)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000480)='ns\x00') read$FUSE(0xffffffffffffffff, &(0x7f0000004180)={0x2020}, 0x2020) openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x0, 0x0) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000000)=0x14) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x8, 0x7fff0000}]}) close_range(r9, 0xffffffffffffffff, 0x0) 1.557712247s ago: executing program 3 (id=4300): r0 = syz_open_dev$swradio(&(0x7f0000000400), 0x1, 0x2) ioctl$VIDIOC_G_FREQUENCY(r0, 0xc02c5638, &(0x7f0000000080)={0x6, 0x4, 0x5}) (fail_nth: 3) 1.428199189s ago: executing program 3 (id=4301): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000300)={0x73622a85, 0x10a}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)) sendmsg$nl_route(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=@ipv6_getrule={0x1c, 0x22, 0x106, 0x70bd27, 0x25dfdbfe, {0xa, 0x0, 0x20, 0x2, 0x1, 0x0, 0x0, 0x3, 0x10005}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000c1}, 0x2000c850) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ppoll(&(0x7f0000000280)=[{r3, 0x2060}], 0x1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 1.289412435s ago: executing program 2 (id=4302): ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000000)={0x8, 0x0, 0xffffffffffffffff}) (async) r1 = openat$apparmor_task_current(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000080)={0x0, 0x1, r1, 0x6, 0x80000}) getsockopt$SO_J1939_SEND_PRIO(r0, 0x6b, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) setsockopt$MRT_ASSERT(r0, 0x0, 0xcf, &(0x7f0000000140)=0x1, 0x4) (async) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e22, 0x3ff0, @private0, 0x1000}}, 0x7, 0x5, 0x9, 0x7fffffff, 0x1}, &(0x7f0000000240)=0x98) getsockopt$inet_sctp_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000280)={0x0, 0x80, 0x27f7, 0x4, 0x3, 0x1, 0x0, 0x2, {r2, @in={{0x2, 0x4e20, @rand_addr=0x64010102}}, 0x6, 0xf, 0x3, 0x71, 0x9}}, &(0x7f0000000340)=0xb0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000003c0)={r3, 0x10, &(0x7f0000000380)=[@in={0x2, 0x4e24, @broadcast}]}, &(0x7f0000000400)=0xc) (async) r5 = openat$ppp(0xffffff9c, &(0x7f0000000440), 0x290183, 0x0) ioctl$PPPIOCSACTIVE(r5, 0x40087446, &(0x7f00000004c0)={0x8, &(0x7f0000000480)=[{0x1, 0xe9, 0xa0, 0x5}, {0xfff, 0x4, 0x3, 0x1}, {0x7, 0x30, 0x6, 0x101}, {0x6, 0x2, 0x7, 0x5}, {0x2289, 0xd, 0x6, 0xfffffffd}, {0x6, 0x7, 0x7, 0x5}, {0xa7, 0x0, 0x7, 0x10001}, {0x6, 0x0, 0xe}]}) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000500), r0) (async) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000580)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x94, 0x94, 0x194, 0xffffffff, 0xffffffff, 0x2dc, 0x2dc, 0x2dc, 0xffffffff, 0x4, &(0x7f0000000540), {[{{@uncond, 0x0, 0x70, 0x94}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x8}}}, {{@uncond, 0x0, 0xdc, 0x100, 0x0, {}, [@common=@set={{0x40}, {{0x3, [0x7, 0x2, 0x0, 0x1, 0x5, 0x4], 0x5, 0x1}}}, @common=@ah={{0x2c}, {[0x5, 0x1ff]}}]}, @REJECT={0x24}}, {{@ip={@private=0xa010102, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0xff, 'virt_wifi0\x00', 'nicvf0\x00', {0xff}, {0xff}, 0x11, 0x2, 0x11}, 0x0, 0xec, 0x148, 0x0, {}, [@common=@addrtype={{0x2c}, {0xab4, 0x81}}, @common=@osf={{0x50}, {'syz0\x00', 0x0, 0xb, 0x1}}]}, @common=@CLUSTERIP={0x5c, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0xac39, 0xf, [0x25, 0x2e, 0x39, 0x21, 0x38, 0x9, 0x9, 0x2c, 0xd, 0x14, 0x2a, 0x36, 0x20, 0x3, 0xe, 0x28], 0x2, 0x9, 0x5}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x3cc) (async) write$P9_RGETLOCK(r0, &(0x7f0000000980)={0x28, 0x37, 0x2, {0x2, 0x1, 0xb, 0x0, 0xa, 'CLUSTERIP\x00'}}, 0x28) (async) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000009c0)={0x7, 0xa, 0x3, 0xffffffff, r4}, &(0x7f0000000a00)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000a40)={r6, 0x4, 0x7}, &(0x7f0000000a80)=0x8) (async) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000ac0)={0xd, 0x0, 0x2}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000bc0)={'ip_vti0\x00', &(0x7f0000000b40)={'syztnl1\x00', 0x0, 0x10, 0x10, 0x8, 0x270, {{0x17, 0x4, 0x1, 0xd, 0x5c, 0x67, 0x10, 0x0, 0x29, 0x0, @loopback, @dev={0xac, 0x14, 0x14, 0x2b}, {[@lsrr={0x83, 0x27, 0x9, [@local, @dev={0xac, 0x14, 0x14, 0x1c}, @loopback, @private=0xa010101, @multicast1, @remote, @private=0xa010102, @multicast1, @multicast1]}, @ssrr={0x89, 0x1f, 0xbd, [@local, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote, @rand_addr=0x64010100, @rand_addr=0x64010102, @private=0xa010100, @rand_addr=0x64010102]}]}}}}}) sendmsg$nl_route(r0, &(0x7f0000000c80)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)=@ipv6_deladdr={0x2c, 0x15, 0x100, 0x70bd2d, 0x25dfdbfb, {0xa, 0x78, 0x45, 0xfd, r7}, [@IFA_LOCAL={0x14, 0x2, @remote}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40080a0}, 0x4004000) (async) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000cc0)={r6, 0x6}, &(0x7f0000000d00)=0x8) (async) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000d40)) clock_gettime(0x0, &(0x7f0000000dc0)={0x0, 0x0}) futimesat(r0, &(0x7f0000000d80)='./file0\x00', &(0x7f0000000e00)={{0x0, 0xea60}, {r8, r9/1000+60000}}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000e40)={r0}, 0x4) (async) recvmsg$can_j1939(r0, &(0x7f00000033c0)={&(0x7f0000000e80)=@qipcrtr, 0x80, &(0x7f0000003340)=[{&(0x7f0000000f00)=""/132, 0x84}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000001fc0)=""/15, 0xf}, {&(0x7f0000002000)=""/4096, 0x1000}, {&(0x7f0000003000)=""/90, 0x5a}, {&(0x7f0000003080)=""/142, 0x8e}, {&(0x7f0000003140)=""/204, 0xcc}, {&(0x7f0000003240)=""/240, 0xf0}], 0x8, &(0x7f0000003380)=""/62, 0x3e}, 0x0) (async) r10 = syz_genetlink_get_family_id$wireguard(&(0x7f0000003440), r0) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000003500)={&(0x7f0000003400)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000034c0)={&(0x7f0000003480)={0x30, r10, 0x10, 0x70bd2c, 0x25dfdbff, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r7}]}, 0x30}, 0x1, 0x0, 0x0, 0x8024}, 0x20008080) (async) r11 = openat$vmci(0xffffff9c, &(0x7f0000003540), 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r11, 0x7a9, &(0x7f0000003580)={{@host, 0x9}, 0xfd, 0x10, 0x8, 0x7, 0x6, 0x1, 0xffffffff, 0x2}) (async) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f00000035c0)={'ip6_vti0\x00', 0x9}) socket$kcm(0x29, 0x7, 0x0) 1.288922645s ago: executing program 2 (id=4303): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4242, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom0\x00', 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) sendfile(r0, r1, &(0x7f0000000080)=0x2, 0xd) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat$udambuf(0xffffff9c, &(0x7f00000000c0), 0x2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r3, 0x4018aee3, &(0x7f0000000180)) writev(r1, &(0x7f00000005c0), 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)=ANY=[@ANYBLOB="1400000401040300000000000017000007000005"], 0x14}, 0x1, 0x0, 0x0, 0x40001}, 0x40800) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x0, 0x4}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_AGEING_TIME={0x8, 0x8, 0x81}]}}}]}, 0x3c}}, 0x20000004) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x13, r0, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r7 = timerfd_create(0x1, 0x800) timerfd_gettime(r7, &(0x7f0000000040)) dup(r0) ioctl$FITRIM(r1, 0xc0185879, &(0x7f0000000100)={0x2, 0x7, 0x6}) r8 = syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x2) ioctl$CEC_ADAP_S_LOG_ADDRS(r8, 0xc05c6104, &(0x7f0000000080)={"5381d6dc", 0x2, 0x6, 0x1, 0x400, 0x7, "9ad7f18bee5970ebb85649ef55e24c", "1012e304", "6ef1fee9", "a88bb21f", ["5c294bd54bdbcc454ec4fe2a", "1e823e1929dad85f7c58b964", '{\b\x00', "faf2b69f1b22666ad990e013"]}) 1.029641133s ago: executing program 1 (id=4304): pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f00000000c0)=0xfc) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x2201) r2 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) openat$binderfs(0xffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x0, 0x0) (async) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x2) symlinkat(&(0x7f0000000080)='./file0\x00', r3, &(0x7f00000000c0)='./file0\x00') unlinkat(r3, &(0x7f0000000040)='./file0\x00', 0x0) 1.028633988s ago: executing program 1 (id=4305): r0 = socket(0x10, 0x2, 0x0) write(r0, &(0x7f0000000000)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) socket$igmp(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0xb, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video4linux(0x0, 0x9, 0x34f081) r3 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) close(r3) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'bond0\x00', 0x8}, 0x18) sched_setattr(0x0, &(0x7f0000000340)={0x38, 0x0, 0x1000000d, 0x8001, 0x299c0, 0x7, 0x800, 0xfc5, 0xfffffffe, 0x5}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_80211_join_ibss(0x0, &(0x7f00000002c0)=@default_ap_ssid, 0x6, 0x1) setpriority(0x2, 0x0, 0x7fffff7ffffffffb) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000000c0)={0xc}) sendmsg$rds(r4, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) sendmsg$rds(r4, &(0x7f0000000680)={&(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x34}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20040800}, 0x0) recvmmsg(r0, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) socket$nl_netfilter(0x10, 0x3, 0xc) msgctl$IPC_INFO(0x0, 0x3, &(0x7f0000000140)=""/30) r5 = msgget$private(0x0, 0x144) msgctl$IPC_SET(r5, 0x1, &(0x7f00000001c0)={{0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x9}, 0x1ff, 0x14, 0x0, 0x0, 0xffffffffffff75ba, 0xfffffffffffffff9, 0x9, 0x5}) 1.004799027s ago: executing program 0 (id=4306): sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x20ba, &(0x7f0000000540)={0x0, 0x0, 0x2, 0x0, 0x21f}) mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB]) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=@newtfilter={0xfffffffffffffdf5, 0x2c, 0x8, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x7}, {0x7, 0xa}, {0x7, 0x9}}, [@TCA_RATE={0x6, 0x5, {0xf1, 0x3}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$VIDIOC_QUERYCTRL(0xffffffffffffffff, 0xc0445624, &(0x7f00000003c0)={0x2, 0x3, "d1c236566863f1bd3f54e05cc46654796a3b800413745c40579438931fffaa91", 0x8001, 0x4, 0xc, 0x9, 0x1980}) sched_setscheduler(0xffffffffffffffff, 0x3, &(0x7f0000000100)=0x800) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000380)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r3, &(0x7f0000000180)={0x1a, 0x0, 0xf9, 0x8, 0xff, 0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}}, 0x10) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f0000000080)='./file0\x00') mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2000000, &(0x7f0000000000)={[{@upperdir={'upperdir', 0x3d, './file1'}}]}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000000), 0x8) r5 = socket$packet(0x11, 0x3, 0x300) bind$packet(r5, &(0x7f0000000140)={0x11, 0x1b, 0x0, 0x1, 0xf9, 0x6, @remote}, 0x14) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0x1}, 0x4) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 559.777855ms ago: executing program 3 (id=4307): r0 = openat$rtc(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000240)={'xfrm0\x00', &(0x7f00000009c0)=@ethtool_flash={0x26, 0x80, './file0\x00'}}) ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0x7005, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000300)={0x73622a85, 0x10a}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) file_setattr(r4, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)={0x10800, 0x4, 0x6, 0x7}, 0x18, 0x100) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) bind$tipc(r4, &(0x7f0000000100)=@nameseq={0x1e, 0x1, 0x1, {0x41, 0x1}}, 0x10) ppoll(&(0x7f0000000280)=[{r5, 0x2060}], 0x1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000500)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$COMEDI_CMD(r4, 0x80406409, &(0x7f0000000240)={0x7, 0x8, 0x0, 0x800, 0x2, 0xfffffff7, 0x0, 0xfff, 0x100, 0xc, 0x4, 0x80, &(0x7f0000000140)=[0x0], 0x1, &(0x7f00000001c0)="7ec65b4f4c8aa8a0a0b65970d136ec29b94e7bf5f18163d57284b100937fa3b42fbef1382fbb2b7396ddcbdfdee274b0857d0d1dc28d582219f17dd05f30f30c4a78d19d83b05a744f30cb1030369ecef3625ebc0928cde95dae9c4b9f62551e8983d3f0b6dbf5a45180a9de183a4b", 0x6f}) 103.800758ms ago: executing program 2 (id=4308): r0 = syz_open_dev$swradio(&(0x7f0000000400), 0x1, 0x2) ioctl$VIDIOC_G_FREQUENCY(r0, 0xc02c5638, &(0x7f0000000080)={0x6, 0x4, 0x5}) 100.978813ms ago: executing program 1 (id=4309): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) fsopen(0x0, 0x1) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x6000) ioctl$IMADDTIMER(r3, 0x80044940, &(0x7f0000000280)=0x14) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) unshare(0x6a040000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002b40)={r0, 0x0, 0x1000, 0xcd, &(0x7f0000001900)="abc918ef6911eb7819a3c1e112b70148301fffeb92f696d7ab82b29e5fdd8814bd1b004b440ed0c8c9a8f91c6ffe471848d0151cfc7af8d6d121a4bc421425f0780fba6a5e11b4cd414cbef917fa1c97fb6a7324a33dc153208c03d45d9aae6cb436b13e973f7e11736a81d5677e7e94849786ef5a33c8d23920c41750ff87744568b7d007e403197887ad0603fdcca1e389dcc893c64e9ddd69d42f50f6ab6c4c4287c1c91a70d89ccdae15a53641dd905a461085f44a8b08ef0c49cf6724c2ca620e693c3be99c5fa213b7f4e7dab33e5f8e645edf3df17700e9fa132a60f7caec935314e20c7464b3cea10514ab4b8a37411399bc8b6db745b9955ee1cae69c522bb4d284be3ec5cdcdd6c33fdc6d2e8a84d2567ca2807bfd043cbf6870a141b9f6623ca1ae1a1fc67b1965f9c5f2b3dafa9bc37c10c4dfb253f2a9041eeb42177e3e5260f016a735747416e4ee3f7b4d422d8ec4dbf277eb01e58144a7de08c372dd17a9552afb25c1900996f3fe0a2b67a9f8b70434a1fbf4dbe261740e9cd6f077bd6ca817c415051012efb876569e576d69dbd2ef60367eb203f2250798862f43482cee61a66eb797b82a41509415bfdcdc6075d40be2ebb00b06c3de997c6ebcbdf4e727bf2631867cac12118bfbe25931477a789cd330a6318f679d9808690c9c68635937df5f01493abb3c29fe2e24f95677d3104cd87c8bc88cd027206541a514cc301a0718662ebc860d7495d60734593f53d7a71e6490405d6d7261b58a809662d60d24b8fe4d691b7207d981a3dec5fe2ec748ab7bc72806084d574d8ebc3a106c1c971f3a2318d94d7f57ef3d0cae6fd71a5344a502ea409a08943dab3f7a3cf49638cc149c838cd8fe08ae05d4ad8000adaec3206d92aab0190a77abb8c87fcedc9b1764d92979bddeb2f2ecf1b6437a3869d1472437df31851009b57f1da9133b1e2f95ad208a20710baad2810a7f0fedaa4214326797f6874553571c5b71e93e8db7532f899b47761f6bc9ef85c72148833d81860320587a42cce93e3560f2ff4ad933a3fd314a2675d0fdd2ea0541c30c0eb0f7f5a7087fb1bff73f692f14a1be617eb3cda51d2a6d30eb35f0a0d4202751e8ce537e507082ff13431df69ff6eb5e134b6bf49ccd01c61369be88dad7f71fcb29ae60e65f9a2d9585ea3a63e296eab18f737391408f6ae64b47a7c8b2d52d7d1cedff75a0ab0bc1c1cbec34a5e72908e4de576f248d669428e2fab7f19a748c7d0c24ce91f56aeaa682c8a0c628c7281a33845e8a14a53b27c98d5f81308dc168f714bcd45cf1454de1cceab0acdde72c12775a7ec73e97795a1020fe3d03b1da54fe93e3e4e9c27bd6357a34ae3a4cab2565a122eeef4c0e208f12e4336899b5a398381d66972935989d8b364d944f713e7977f6d1b035c51025c0287efcdd26c804cad055b8192ac14cacaf7aa4c7da39463b1d3e8d9b57b43d3bf68d6f6c8476ac3e999929eddf1c175ffa51adcd95e0650a4b52dc305abe969372269190a3b2088da5360d627bcc17c0b936f86906e4eb8ae48dbf26ecfdbe4bafba1376791b439ab1a6d010fb1778c1cfcb3c5c3aa2fb730b77b3401b011ec4dbc34cba48424bcad1da17e62a8bb807dcaa99c2f6987f2ca8129848b0a4b190e872a38f50213cd1b5d7a262753836a9f7a06bb1da41459413c399fdf3bcb9e73ef451e0d16cac7feebb737d11b54ea659cb529f34672dfc9b91e9bd70fcd6e229f8cfa7df56d67fac999aa8158eef6cadfc9741c22e6076ea105389e07812d5f40795b8875070ff8700872f536f2460de5813aafdb0e876d67b273924aad03a56f28fd62e722fce817196aaf7c89e7cc8ade09ef620be235e05621973a63e60e338d333d1b638e04d173c1a66bbb096dd4c5a358dd4fd2e027634e04d810edaccc8e6ef5eadec6a3ba485fe8f1b115f0a1039c6441f396e08e19105019bec99e820b30ab0b9f36bf60a8af75e11a014b03ad697253cdf19cb97ee80a4b3658ffffb76c370567edfc7d5a81e33eb089326d3233302c4b27c6020beeea91c00e87f241e879fd9b7e6401f855bc8e0f05ecf67fc36bf29dcd10c554f9c600b6d4041ce58cfac5936bff1057c9040389c9d0bf020e9da63b4619351d4c171a2ed709c3bbeff39d7eb35d2db56a06bac63c281d2efc1cbfeabeec7c59700896390239ee20aeefffc43cc5abf3da3105a2505e8903e3afc941451bd70bda4ca86db83af314695428e58db89f52e97b1103274ad778745724a2d2fb1fd4d022b8b7cd914da2980fe919ece83bb905fa19a2dbd55708fc128a5e90aa9c93fdcb3cd5707ec797dbd3df05ed20731ce712219fae7eb96ed49eb15c33fbed23be5b5f5a5123b41ca7a4a2dc9844fd8fa6a4dbc731fc6f7647da75ce1636d86fc941bf136b74e3a4a9d4f465e63223030ba0622ddd0b3bc81592a9a4dc25df360a15ce7a4cc221b2145780af3aeac243b7a2719134aebda914e682b86ded28a4d2d34f1c8850fae80710a1735693936b44af9a74be41107ec98417f6cfef86cd94a5d2494a1b7d3b3c12e787e9aa93a43a8b6d80ae9eef0813e552cf8df5e447cada0e63c4efdb7381d90d214c0eb5718d233baf2897f477209c4a20443ecdd7e0e10c4e5277c422f0f95e24ab42f382da07150ec5b3228852631e6087449abf5b40972d483afe446be3458736a7b3f7337a4514920b5cd1773defb13bcd7694a41186079de1fbfc9beff23f51157fbeda1a1668b835f9577574e475bccfa84b848eb5c9640e7ade7c32b94c61c07f2848cb02d5040c887008ebc88b46644b4363255f2bcc6f067c731121e0543cce8ebbfb2fcfc5406f9b247825723be459aa5e02d8da91245619e02a5e70a4db47aa881193d85ef5933e28235bd939689f8255d66fa8fcb09308f8b72f865ad1d7ec7a12a4e836309b40972ea0a4a8beff9d6a3b423184cb847c02d988bebeae4dad4bce53d83473f1ea113814533a712c0188a74202a8fc43e47ace0afd7d61e437ee9bb748667fa6c04fb0e40d1117ac739b70402738a3d3c16842275b36333864e050e2f77bc14ee1f435248aa30db39e43ebd80d4f951fb635a0237d79db20601fc524ad42755a7043c092d53a70fa4fd192d1d409f5d881575e9ed15df878be35ae21819ecb0766e1068149f6fe647ce385907353dba46453d7f1a5abc981325584b50daa85cdeb0b247d65dc41608cea0b4580f3796d173fc744bdc73974005f39ca1ac6f0aaadf455e864a78d4b00ec47250f4d429a3d031c99420b6c7bab22b8044ca43878a8aba26bfbbc3a17e1f2388cf1aa67e2bf9827ddeb8f6af2b73febdc86d0426499529591e6abd74320809adaec293f6bf90ac2ab6ae6ddec60a1231c0043c97b1d6882b4daed042f78ddb0e4f153e3bad2d32738cdb7b4cbd6fef8f0feb627bbf7b6bb11b5411a7b034eeeb4b7d75744d0caf1566089588f30c17f8b0095440c40427fc067ac37b311512c03771516985b79a1f54e283e03c456f69197872c7e3af475cf2625f8a7c40edccb69cc9d0f735a268dc7e1bae597e7389a327ea0ad2b9243893d73226e3553db8c52efa67269db0d63de7b4bf03a96f063fdb6ecc0e28c244d018d7f84f88f04f33e1931cf26e0ada24a3516a593dbef1c391bd5b2a328dba7dfb656bfdec081e3d0bbbaa4ebc9cd82c0288ac8c3dd220852421a031727cdaa19cfe91540ba18b66dbb366c44b3b10646c1e381db32246339e1cc7d942c569be4c38650324700dc18c0e6c273d488191facb4e0a99b72991b31ef2441f183dbd17ca7423602413a85ba4a93cec13f79c0638ec7c6c1a2c6f93bd9416608df5490e1b56a17d80372340ce928770e5d7d4dd9906f91ad086479f6cbd6d80c5dbf0655c4a1af34a71dca4b6aede67d2bc0f5596e5d8814e1d4473b1b7ef3a87eb120d595492973bf35d9c79e56e2cbc5b1031893827dfa7878dec84a16c63a7de29e4f759bd1cd68d46df39f7e28312af59af9f62dca96a09681f920a8b02d71e7a948a98399197c627004b03a168b1a81539937890563858f8e567995b01037336f018907a2cf12a30bcbbf2132de6c8b615333e9647a84237d5e55e450aa9c25bdc40cf46e125723b07c8bf980a0b5a897513f3172fa5b5d8041398f6e263073d549b4a6e2d22874338314aecc79cf6f6b3c7f6e8211eec81ac81ed3f654532615a7b6af4861ac9ef03897c24c28b44a4b6ece260b4af413c5fd78068109b3285a5209194d429209c85da19eba0f451b66bb219ba0983595d3f1f75294a18ee1020fd461ac76d9a9ab9e7fec49f50eef3a8954d60aa90ecfcb1dd3dea9529c2d6d4acbb4d3a9fdff9df5609590682fbc0adc5339e2c86f005b9a71ca729df0412b9391ca2ca7620a632f08a3f2d6bb39c9542e317ac1a3aee110b1ebdc6a0457f475f76cdcd0efd87f24c8e370cd7405beab01c3aea3331059f89c91bd672b6e08d0d83c78697db24caf2d7cc4fe5cd65ad46990d05d3e804f963f2f225c58955efe011e01f4de2c093af625593ba8f0ac5012887404da7ab65d862bc69a13e93f4451b0289ad84c7351246387a76a99e8092981d17cd4d670bcb63beea2b4990dc1cf006d1c171cd4accffbdb0922c2d51f42a2a4cfebbd3bb781f3904ddb16981e0d57ade1d2cb401e85c623c41b5f4490c7ab234f3dd2d574dfe5f51959afc0ffe37cbe1e1b32ccb4364aecf6dfea06fdaa6d61ec0e77f659cc38a1ee173611cf7e027e89e6394bc6786837ae6ef59a89e129df1e7ba9357e9dfc5c6187ec1f6ead57b529f77d767f7794a7921b076097f875575559cea0b94b9f1deea012552436d3911777a113f966c4c2d86cc667fefe92d319000fab6d57ddaa46d5f62f0467f2aa4cbfae94ffd055aa4cedac3e8677067187845c7282d0a645807f08023557c54786b7d646757ec90a2315753c733db63aacce459ad935851e23dd186de50d979438908552fcb636eca44b5bfa4d0341fab869a76e1e3c3e121b8cf81c99b62584dd341f3050565e6d6fad3653077c9f798cb9ed835ef28c1a76ea30f70b40100cdfde2e0b7d471c0ea963951e9f15feb7b231e12044bab754902f3a3c0006f7aff3e5c6c597f88637e7097df1436b2eaaa41fca2b43190d09c68f60f57eeb9da0b8b82747b55ae7f15b50c2657444b7f0b3f9c28b4a5e20f733cf78522c4cdc2f5554f7c4015edbf74daaaaeeb86e29abf017d33b85b3e962c3298859f9b91b4a4523632ea4114ab45580af5a4d35d2c44deba0cf46dbacbfbe94d21235e353e7616003814b664173b9963db313f8f6688aa711cee3072c2025911e5604bfa62fb86f0af4b8460a737b0a37fcd775ddf4c2b8d02b822bd89335399a49fb5b0546c8e472d254439569cb1c39482f122a3a5f47fa7cb67c1ce88148ec8aa4c7952a41c92d4eb7c27a338510d23a208d118cd1b65eeab1a935ceb3427156ddaf730adecf169de03095c0776304498eb2bbb78ba1217e579b88c412fda19bfe9b09007d6f5fd8b1193cd11515d401cd1a1edcde8b9dac179b4ff14b0b11c258e0f2d61bf6c686c1953b27c71dc675fc89aeb82dcd4b519049f0ca0e73cc7a6cbadcb392296399b3edfb87c1c8b4024b239829b5ee58d1cca06dbc4c31901df7a4fb0cbbcb621036db834ecac6057a1aab4ab9413000ccdcea843013dbfb61e9f78a0de03bbb0b35a7d9f48cebf90d44a792cf2fb81a785c95f0414971293c54da201ab4714ddffbd7c61570d16820c10", &(0x7f0000002900)=""/205, 0x4, 0x0, 0x91, 0x50, &(0x7f0000002a00)="5e8c31e6eaff469b0e2359e6feb7f76400e06756fc86b0241f8976406743ce09e00ad7eb737c8215a2d67094b90f885da0a1f3cbe6a1f9a3b74762d24ca1e52a15d6f7f9e0fa43788ebaad171c4b608e8714950a9088e1485ba6af2becb3d23b3cb561cdf41ed16febb0c971ae33399f954d019b0d847a8a507fd170b3188e9db56f159d67cf43992adf492e34a1671d7d", &(0x7f0000002ac0)="fd58b5580c35c54b6b2c0f7b20732ce32fdd8c450e1dd261e3ca4a1c90d1ea71452afa5bef68e56ac7e67c2b71e431831b6e6daa00e48f4121ba8d1c1eacecaa3c013a38a25b37740cf1f0aad1e0535f", 0x0, 0x0, 0x6}, 0x4c) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r8 = accept4(r7, 0x0, 0x0, 0x0) sendmsg$alg(r8, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@assoc={0x18, 0x117, 0x4, 0x200}], 0x18}, 0x28000054) sendmsg$nl_route_sched_retired(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000014c0)=@delchain={0x43c, 0x65, 0x800, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x9, 0xc}, {0x3, 0x8}, {0x6, 0x6}}, [@f_rsvp6={{0xa}, {0x40c, 0x2, [@TCA_RSVP_POLICE={0x408, 0x5, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x2, 0x7, 0x897, 0x5, 0x0, 0xa, 0x7fff, 0x40, 0x7, 0x871, 0xfffffeff, 0xb32, 0x6, 0x3, 0xe033, 0x4, 0xa, 0x0, 0xe, 0x53, 0x5, 0xd0, 0x10000, 0xfffffffb, 0x10, 0x7fff, 0x7fff, 0x4, 0x2, 0x6, 0x1e42, 0x8f7, 0x32c, 0xffff0001, 0x3, 0x4, 0xd1, 0x100, 0x2, 0x3, 0x3, 0x82, 0x100, 0x7, 0x8, 0x97, 0xffff, 0x5, 0x8000, 0x7f, 0xe7, 0xbb69, 0x6, 0x5, 0x8de, 0x7f, 0x5, 0xfffffffe, 0x40, 0x81, 0x0, 0x3502, 0x5, 0xb, 0x5, 0x2b, 0x8, 0x4, 0xaa2, 0x8, 0x8, 0x7, 0x800, 0x7fffffff, 0x6, 0x2, 0x5, 0x2, 0xfffffffe, 0xfa, 0x1, 0x2, 0x789, 0x4, 0x0, 0x3, 0x7, 0x6, 0x5, 0xfc, 0x6, 0x10003, 0xf160, 0x1, 0x1, 0x8, 0x242, 0x6, 0x1fd, 0x4d, 0xfffffff7, 0x4, 0x0, 0x0, 0xe6, 0xefed, 0x706, 0x2, 0xffffffff, 0xfffffeed, 0x4000006, 0xdc5, 0x1, 0x7, 0x2, 0x3, 0x6, 0x7f, 0x3, 0x80000000, 0x1, 0x6, 0xffff, 0x5, 0x13, 0x77797056, 0x4, 0x5bb, 0x4, 0xb1d, 0x8, 0x7, 0x2, 0x5, 0x6c, 0x2, 0xd, 0x4, 0x7, 0x0, 0x8000003, 0xda26, 0x2, 0x422, 0xa, 0x1, 0xee, 0x6, 0xfffffff9, 0x17d6, 0x5, 0x1, 0x7, 0xfff, 0xa, 0x46264ca1, 0x9, 0x0, 0x400, 0xfffffffa, 0x8, 0x633, 0x8, 0x40, 0x5, 0x7, 0x7, 0x1, 0x2, 0x9, 0x8, 0x200, 0x8, 0x6, 0x57, 0x9, 0x1, 0xc36, 0x3, 0x3, 0x7, 0x6, 0x3, 0x2, 0xf, 0x4, 0x2, 0x0, 0x401, 0x7, 0xfffffffa, 0x4f63, 0x10001, 0x80000001, 0x21, 0x207, 0x1, 0x79e, 0xd, 0x80000001, 0xa492, 0x7, 0x87, 0xd, 0x0, 0x7e, 0x1fcc000, 0x80, 0xe, 0x0, 0xbf000, 0x126, 0x80, 0x9, 0x4, 0x5, 0x4, 0x5, 0x7, 0x6, 0x401, 0x8, 0x10001, 0x4f, 0x2, 0x3, 0x5366afc2, 0x401, 0x0, 0x6, 0x6, 0x9, 0xfffffff8, 0xffffffff, 0x0, 0x4, 0x3e, 0x7fff, 0x6a59, 0x7, 0x80000000, 0x9, 0x7ff, 0x5a3, 0x8, 0x2, 0x3, 0x2, 0xed, 0xa1, 0x2, 0x8001, 0x5, 0x2, 0x3, 0x80000001]}]}]}}]}, 0x43c}}, 0x24000085) recvmmsg(r8, &(0x7f0000001200)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000500)=""/204, 0xcc}, {&(0x7f0000000340)=""/121, 0x79}, {&(0x7f0000000600)=""/134, 0x86}, {&(0x7f0000000480)=""/21, 0x15}, {&(0x7f00000006c0)=""/21, 0x15}], 0x5}, 0x4}], 0x2, 0x60, 0x0) kexec_load(0x0, 0x0, &(0x7f0000000000), 0x80000) kexec_load(0x2, 0x1, &(0x7f0000000140)=[{&(0x7f0000000080)="4c2a9e5fdbbd6e10d17cae3b91d35d734a99bc6074fb67a79fbdcb93ec0c7a03c7d6f538e40ee641013705c91365cb8a8e2da00766d6417883cab2493185e9a69c488747e20a6c377387c3223f906091c88dca43d7a411499dd0a227a1cd89882e9ac2206832b884c8684edc1d19693da78b49aa82d1749b89889d8bbc950d8ba4ef9d694141a5f2aa8a8c3ebe9f0d434ee5ec3354d99ff87422614e48c8d1b9f78f63e6203ad18ea2bb0721b3084e3dcd6ce355313c00", 0xb7, 0x3, 0x2}], 0x80000) 0s ago: executing program 2 (id=4310): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) futex(&(0x7f0000000040)=0x2, 0x6, 0x1, &(0x7f0000000080)={0x77359400}, 0x0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x46, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000340)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x3, 0x0, 0x7, 0xfa11, 0xffffffff}, 0x0) r3 = openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r3, 0xc0f8565c, &(0x7f0000000000)={0x0, 0x6, 0x0, {0xa, @pix_mp={0x0, 0x0, 0x41414270, 0x0, 0x0, [{}, {}, {0x0, 0xffffffff}, {}, {}, {}, {0x0, 0x7}], 0x7}}, 0xfffffffc}) openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) r4 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r4, 0x4020565a, &(0x7f0000000180)={0x3, 0x980900, 0x1}) ioctl$VIDIOC_DQEVENT(r4, 0x80885659, &(0x7f0000000240)={0x0, @src_change}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) r5 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) ioctl$EVIOCGMASK(r5, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"}) ioctl$EVIOCGLED(r5, 0x80404519, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xf8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x9, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x1}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}, 0x40, 0x80}, [@tmpl={0x44, 0x5, [{{@in6=@mcast2, 0x3, 0x3c}, 0x0, @in6=@empty, 0x0, 0x0, 0x3}]}]}, 0xf8}}, 0x4810) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000100), 0x2, 0x6}}, 0x20) sendmsg$nl_xfrm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="02000000000000005000110000000000000000000000ffff7f000001fc00000000000000000000000000000164010102000000000000000000000000fc0200000000000000000000000000003c00000000000000020008002c"], 0xcc}, 0x1, 0x0, 0x0, 0x800}, 0x42000) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af60, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) syz_usb_connect(0x0, 0x12, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_vlan\x00'}) sendmsg$nl_route_sched(r8, 0x0, 0x0) kernel console output (not intermixed with test programs): a_rxe: rxe_newlink: failed to add wg2 [ 1278.392107][ T8641] usb 44-1: SetAddress Request (26) to port 0 [ 1278.394877][ T8641] usb 44-1: new SuperSpeed USB device number 26 using vhci_hcd [ 1278.708234][T21156] vhci_hcd: connection reset by peer [ 1278.712194][ T59] vhci_hcd vhci_hcd.3: stop threads [ 1278.713876][ T59] vhci_hcd vhci_hcd.3: release socket [ 1278.715598][ T59] vhci_hcd vhci_hcd.3: disconnect device [ 1279.315660][T21170] program syz.3.3907 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1279.336451][T21170] macvlan0: entered promiscuous mode [ 1279.338858][T21170] bridge0: entered promiscuous mode [ 1279.342746][T21171] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3907'. [ 1279.486227][T21175] tmpfs: Unknown parameter 'urquota' [ 1279.523417][T21174] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1279.526766][T21174] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1279.529165][T21174] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1279.753502][T21189] lo speed is unknown, defaulting to 1000 [ 1279.841427][ T6089] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 1279.865301][ C1] imon 7-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 1279.890185][ T29] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/input/input27 [ 1279.909268][ T29] imon:send_packet: packet tx failed (-71) [ 1279.931526][ T29] imon 7-1:0.0: panel buttons/knobs setup failed [ 1279.981685][ T29] rc_core: IR keymap rc-imon-pad not found [ 1279.983606][ T29] Registered IR keymap rc-empty [ 1279.985279][ T29] imon 7-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 1279.990866][ T29] imon 7-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1279.997083][ T29] imon:send_packet: packet tx failed (-71) [ 1280.002312][ T6089] usb 5-1: Using ep0 maxpacket: 32 [ 1280.006767][ T6089] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1280.011445][ T29] imon 7-1:0.0: remote input dev register failed [ 1280.013542][ T29] imon 7-1:0.0: imon_init_intf0: rc device setup failed [ 1280.016947][ T6089] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1280.020396][ T6089] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1280.024100][ T6089] usb 5-1: Product: syz [ 1280.026269][ T6089] usb 5-1: Manufacturer: syz [ 1280.027833][ T6089] usb 5-1: SerialNumber: syz [ 1280.028455][ T29] imon 7-1:0.0: unable to initialize intf0, err 0 [ 1280.031433][ T6089] usb 5-1: config 0 descriptor?? [ 1280.031972][T21182] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 1280.034002][ T29] imon:imon_probe: failed to initialize context! [ 1280.037317][ T29] imon 7-1:0.0: unable to register, err -19 [ 1280.042820][ T29] usb 7-1: USB disconnect, device number 125 [ 1280.361117][ T29] usb 7-1: new high-speed USB device number 126 using dummy_hcd [ 1280.523187][ T29] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1280.527689][ T29] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1280.532265][ T29] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 1280.536866][ T29] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 1280.546668][ T29] usb 7-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 1280.550627][ T29] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1280.554353][ T29] usb 7-1: Product: syz [ 1280.556174][ T29] usb 7-1: Manufacturer: syz [ 1280.558051][ T29] usb 7-1: SerialNumber: syz [ 1280.564955][ T29] usb 7-1: config 0 descriptor?? [ 1280.841258][ T29] adutux 7-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux1 [ 1280.985908][ T6089] usb 7-1: USB disconnect, device number 126 [ 1281.530669][ T62] Bluetooth: hci1: command 0x0c1a tx timeout [ 1281.530806][ T5953] Bluetooth: hci5: command 0x0c1a tx timeout [ 1281.534104][ T62] Bluetooth: hci4: command 0x040f tx timeout [ 1281.794190][T21224] FAULT_INJECTION: forcing a failure. [ 1281.794190][T21224] name failslab, interval 1, probability 0, space 0, times 0 [ 1281.799479][T21224] CPU: 3 UID: 0 PID: 21224 Comm: syz.1.3922 Tainted: G L syzkaller #0 PREEMPT(full) [ 1281.799507][T21224] Tainted: [L]=SOFTLOCKUP [ 1281.799514][T21224] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1281.799525][T21224] Call Trace: [ 1281.799533][T21224] [ 1281.799541][T21224] dump_stack_lvl+0x100/0x190 [ 1281.799573][T21224] should_fail_ex.cold+0x5/0xa [ 1281.799596][T21224] should_failslab+0xc2/0x120 [ 1281.799617][T21224] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 1281.799645][T21224] ? alloc_empty_file+0x55/0x1c0 [ 1281.799668][T21224] ? is_bpf_text_address+0x8a/0x1a0 [ 1281.799700][T21224] alloc_empty_file+0x55/0x1c0 [ 1281.799724][T21224] path_openat+0xe8/0x31a0 [ 1281.799744][T21224] ? __kernel_text_address+0xd/0x30 [ 1281.799770][T21224] ? unwind_get_return_address+0x59/0xa0 [ 1281.799791][T21224] ? arch_stack_walk+0xa6/0xf0 [ 1281.799814][T21224] ? __pfx_path_openat+0x10/0x10 [ 1281.799837][T21224] ? stack_trace_save+0x8e/0xc0 [ 1281.799856][T21224] ? __pfx_stack_trace_save+0x10/0x10 [ 1281.799878][T21224] do_file_open+0x20e/0x430 [ 1281.799900][T21224] ? __pfx_do_file_open+0x10/0x10 [ 1281.799918][T21224] ? kasan_save_stack+0x30/0x50 [ 1281.799934][T21224] ? kasan_save_track+0x14/0x30 [ 1281.799949][T21224] ? __kasan_slab_alloc+0x89/0x90 [ 1281.799993][T21224] do_open_execat+0xd1/0x360 [ 1281.800020][T21224] ? __pfx_do_open_execat+0x10/0x10 [ 1281.800048][T21224] ? __might_fault+0xc5/0x140 [ 1281.800073][T21224] ? __might_fault+0xc5/0x140 [ 1281.800103][T21224] alloc_bprm+0x2d/0x710 [ 1281.800133][T21224] do_execveat_common.isra.0+0x19c/0x580 [ 1281.800161][T21224] ? do_getname+0x191/0x390 [ 1281.800186][T21224] __ia32_compat_sys_execveat+0xe4/0x130 [ 1281.800207][T21224] __do_fast_syscall_32+0xe3/0x8c0 [ 1281.800237][T21224] do_fast_syscall_32+0x32/0x70 [ 1281.800258][T21224] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1281.800294][T21224] RIP: 0023:0xf7f92f6c [ 1281.800309][T21224] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1281.800326][T21224] RSP: 002b:00000000f541450c EFLAGS: 00000292 ORIG_RAX: 0000000000000166 [ 1281.800344][T21224] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080001400 [ 1281.800354][T21224] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1281.800363][T21224] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1281.800373][T21224] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1281.800382][T21224] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1281.800405][T21224] [ 1281.965692][T21229] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3924'. [ 1282.108759][T21234] tmpfs: Unknown parameter 'urquota' [ 1282.116371][T21231] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1282.121174][T21231] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1282.128704][T21231] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1282.176890][T21236] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3926'. [ 1282.743607][ T6089] usb 5-1: USB disconnect, device number 6 [ 1283.460352][ T8641] usb 44-1: device descriptor read/8, error -110 [ 1283.930085][ T8641] usb usb44-port1: attempt power cycle [ 1284.169512][ T62] Bluetooth: hci5: command 0x0c1a tx timeout [ 1284.169540][ T5953] Bluetooth: hci4: command 0x040f tx timeout [ 1284.174325][T18121] Bluetooth: hci1: command 0x0c1a tx timeout [ 1284.489798][ T8641] usb usb44-port1: unable to enumerate USB device [ 1284.546266][ T40] kauditd_printk_skb: 107 callbacks suppressed [ 1284.546282][ T40] audit: type=1800 audit(1775434032.391:69062): pid=21256 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3931" name="/" dev="fuse" ino=4 res=0 errno=0 [ 1284.641573][T21265] tmpfs: Unknown parameter 'urquota' [ 1284.659213][T21264] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1284.662028][T21264] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1284.665065][T21264] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1285.024645][ T40] audit: type=1800 audit(1775434032.872:69063): pid=21262 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3934" name="/" dev="fuse" ino=4 res=0 errno=0 [ 1285.060588][T21273] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 1285.092131][T21212] mkiss: ax0: crc mode is auto. [ 1285.626254][T21278] FAULT_INJECTION: forcing a failure. [ 1285.626254][T21278] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1285.632208][T21278] CPU: 2 UID: 0 PID: 21278 Comm: syz.3.3940 Tainted: G L syzkaller #0 PREEMPT(full) [ 1285.632229][T21278] Tainted: [L]=SOFTLOCKUP [ 1285.632234][T21278] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1285.632244][T21278] Call Trace: [ 1285.632250][T21278] [ 1285.632268][T21278] dump_stack_lvl+0x100/0x190 [ 1285.632298][T21278] should_fail_ex.cold+0x5/0xa [ 1285.632318][T21278] _copy_from_iter+0x1f4/0x1690 [ 1285.632342][T21278] ? kmalloc_reserve+0xf9/0x350 [ 1285.632364][T21278] ? __pfx__copy_from_iter+0x10/0x10 [ 1285.632398][T21278] ? __alloc_skb+0x4e9/0x710 [ 1285.632422][T21278] ? __alloc_skb+0x5b7/0x710 [ 1285.632444][T21278] ? __pfx___alloc_skb+0x10/0x10 [ 1285.632474][T21278] pfkey_sendmsg+0x1ce/0x840 [ 1285.632549][T21278] ____sys_sendmsg+0x9e1/0xb70 [ 1285.632569][T21278] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1285.632595][T21278] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1285.632624][T21278] ___sys_sendmsg+0x190/0x1e0 [ 1285.632646][T21278] ? __pfx____sys_sendmsg+0x10/0x10 [ 1285.632692][T21278] __sys_sendmsg+0x170/0x220 [ 1285.632709][T21278] ? __pfx___sys_sendmsg+0x10/0x10 [ 1285.632732][T21278] ? __pfx_ksys_write+0x10/0x10 [ 1285.632756][T21278] __do_fast_syscall_32+0xe3/0x8c0 [ 1285.632778][T21278] do_fast_syscall_32+0x32/0x70 [ 1285.632796][T21278] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1285.632817][T21278] RIP: 0023:0xf7fb3f6c [ 1285.632832][T21278] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1285.632848][T21278] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1285.632866][T21278] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 1285.632876][T21278] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1285.632886][T21278] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1285.632895][T21278] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1285.632905][T21278] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1285.632926][T21278] [ 1285.770018][T21282] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 1285.772774][T21282] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1285.776522][T21282] vhci_hcd vhci_hcd.0: Device attached [ 1285.778837][T21281] lo speed is unknown, defaulting to 1000 [ 1285.799370][T21282] rdma_rxe: rxe_newlink: failed to add wg2 [ 1285.841358][T21285] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3941'. [ 1285.862233][T21285] lo speed is unknown, defaulting to 1000 [ 1285.943881][T21283] vhci_hcd: connection closed [ 1285.944144][ T59] vhci_hcd vhci_hcd.1: stop threads [ 1285.949645][ T59] vhci_hcd vhci_hcd.1: release socket [ 1285.952237][ T59] vhci_hcd vhci_hcd.1: disconnect device [ 1286.252177][T21289] tipc: Started in network mode [ 1286.253783][T21289] tipc: Node identity 1eb7f6555b09, cluster identity 4711 [ 1286.256560][T21289] tipc: Enabled bearer , priority 0 [ 1286.284714][T21289] syzkaller0: entered promiscuous mode [ 1286.286511][T21289] syzkaller0: entered allmulticast mode [ 1286.292216][T21294] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 1286.295044][T21294] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1286.299207][T21294] vhci_hcd vhci_hcd.0: Device attached [ 1286.313796][T21289] tipc: Resetting bearer [ 1286.335221][T21294] rdma_rxe: rxe_newlink: failed to add wg2 [ 1286.340515][T21287] tipc: Resetting bearer [ 1286.363599][T21287] tipc: Disabling bearer [ 1286.644274][ T29] usb 44-1: SetAddress Request (30) to port 0 [ 1286.646616][ T29] usb 44-1: new SuperSpeed USB device number 30 using vhci_hcd [ 1286.727980][T18121] Bluetooth: hci1: command 0x0c1a tx timeout [ 1286.729802][T18121] Bluetooth: hci5: command 0x0c1a tx timeout [ 1286.731958][T18121] Bluetooth: hci4: command 0x040f tx timeout [ 1286.796894][T21300] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 1286.799120][T21300] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1286.838576][T21300] vhci_hcd vhci_hcd.0: Device attached [ 1286.899729][T21295] vhci_hcd: connection reset by peer [ 1286.902092][ T59] vhci_hcd vhci_hcd.3: stop threads [ 1286.904280][ T59] vhci_hcd vhci_hcd.3: release socket [ 1286.908263][ T59] vhci_hcd vhci_hcd.3: disconnect device [ 1286.979633][T21306] tmpfs: Unknown parameter 'urquota' [ 1286.990476][T21305] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1286.993422][T21305] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1286.998098][T21305] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1287.077919][T21299] rdma_rxe: rxe_newlink: failed to add wg2 [ 1287.107827][ T8665] usb 42-1: SetAddress Request (22) to port 0 [ 1287.110433][ T8665] usb 42-1: new SuperSpeed USB device number 22 using vhci_hcd [ 1287.455009][T21318] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1287.457675][T21301] vhci_hcd: connection reset by peer [ 1287.461353][T21112] vhci_hcd vhci_hcd.2: stop threads [ 1287.463548][T21112] vhci_hcd vhci_hcd.2: release socket [ 1287.466271][T21112] vhci_hcd vhci_hcd.2: disconnect device [ 1288.081504][T21329] kvm: kvm [21328]: vcpu0, guest rIP: 0x1a3 Unhandled WRMSR(0x187) = 0x8000 [ 1288.302069][T21336] tmpfs: Unknown parameter 'urquota' [ 1288.309002][T21334] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1288.314076][T21334] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1288.324847][T21334] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1289.177549][T21350] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 1289.179927][T21350] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1289.183269][T21350] vhci_hcd vhci_hcd.0: Device attached [ 1289.302683][T21350] blktrace: Concurrent blktraces are not allowed on nbd3 [ 1289.350318][T21350] rdma_rxe: rxe_newlink: failed to add wg2 [ 1289.669862][T21357] block nbd4: shutting down sockets [ 1289.753365][T21351] vhci_hcd: connection closed [ 1289.753755][ T12] vhci_hcd vhci_hcd.3: stop threads [ 1289.758239][ T12] vhci_hcd vhci_hcd.3: release socket [ 1289.763822][ T12] vhci_hcd vhci_hcd.3: disconnect device [ 1289.933637][T21363] netlink: 'syz.2.3962': attribute type 8 has an invalid length. [ 1290.022125][T21368] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3963'. [ 1290.063958][T21370] sp0: Synchronizing with TNC [ 1290.071785][T21370] sp0: Found TNC [ 1290.326258][T18121] Bluetooth: hci4: command 0x040f tx timeout [ 1290.326339][ T62] Bluetooth: hci1: command 0x0c1a tx timeout [ 1290.326378][ T5953] Bluetooth: hci5: command 0x0c1a tx timeout [ 1291.254390][T21394] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3967'. [ 1291.365877][T21385] block nbd3: shutting down sockets [ 1291.717720][ T29] usb 44-1: device descriptor read/8, error -110 [ 1291.747036][T21410] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 1291.749093][T21410] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1291.752066][T21410] vhci_hcd vhci_hcd.0: Device attached [ 1291.870111][T21413] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 1291.872428][T21413] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1291.880231][T21413] vhci_hcd vhci_hcd.0: Device attached [ 1291.955501][ T29] usb 44-1: SetAddress Request (31) to port 0 [ 1291.963986][ T29] usb 44-1: new SuperSpeed USB device number 31 using vhci_hcd [ 1292.005507][T21413] blktrace: Concurrent blktraces are not allowed on nbd3 [ 1292.035298][ T8641] usb 40-1: SetAddress Request (24) to port 0 [ 1292.043192][ T8641] usb 40-1: new SuperSpeed USB device number 24 using vhci_hcd [ 1292.063121][T21413] rdma_rxe: rxe_newlink: failed to add wg2 [ 1292.165628][ T8665] usb 42-1: device descriptor read/8, error -110 [ 1292.184184][T21418] FAULT_INJECTION: forcing a failure. [ 1292.184184][T21418] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1292.191545][T21418] CPU: 3 UID: 0 PID: 21418 Comm: syz.0.3975 Tainted: G L syzkaller #0 PREEMPT(full) [ 1292.191570][T21418] Tainted: [L]=SOFTLOCKUP [ 1292.191574][T21418] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1292.191582][T21418] Call Trace: [ 1292.191587][T21418] [ 1292.191594][T21418] dump_stack_lvl+0x100/0x190 [ 1292.191619][T21418] should_fail_ex.cold+0x5/0xa [ 1292.191635][T21418] _copy_to_user+0x32/0xd0 [ 1292.191653][T21418] __ip_vs_get_service_entries+0x1f7/0x520 [ 1292.191720][T21418] ? __pfx___ip_vs_get_service_entries+0x10/0x10 [ 1292.191747][T21418] do_ip_vs_get_ctl+0x93f/0x11a0 [ 1292.191765][T21418] ? __pfx_do_ip_vs_get_ctl+0x10/0x10 [ 1292.191780][T21418] ? find_held_lock+0x2b/0x80 [ 1292.191793][T21418] ? nf_sockopt_find.isra.0+0x222/0x290 [ 1292.191810][T21418] ? nf_sockopt_find.isra.0+0x222/0x290 [ 1292.191828][T21418] ? __mutex_unlock_slowpath+0x15c/0x790 [ 1292.191845][T21418] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1292.191868][T21418] ? nf_sockopt_find.isra.0+0x222/0x290 [ 1292.191885][T21418] nf_getsockopt+0x7c/0xe0 [ 1292.191901][T21418] ip_getsockopt+0x192/0x1e0 [ 1292.191919][T21418] ? __pfx_ip_getsockopt+0x10/0x10 [ 1292.191941][T21418] tcp_getsockopt+0xa1/0x110 [ 1292.191965][T21418] smc_getsockopt+0x165/0x390 [ 1292.192021][T21418] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1292.192037][T21418] ? __pfx_smc_getsockopt+0x10/0x10 [ 1292.192054][T21418] ? aa_sock_opt_perm+0xfe/0x1b0 [ 1292.192078][T21418] ? __pfx_smc_getsockopt+0x10/0x10 [ 1292.192095][T21418] do_sock_getsockopt+0x259/0x3d0 [ 1292.192113][T21418] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1292.192136][T21418] __sys_getsockopt+0x133/0x1d0 [ 1292.192158][T21418] ? ksys_write+0x1ac/0x250 [ 1292.192173][T21418] ? __ia32_sys_getsockopt+0xbc/0x160 [ 1292.192198][T21418] __ia32_sys_getsockopt+0xbc/0x160 [ 1292.192219][T21418] ? __do_fast_syscall_32+0x94/0x8c0 [ 1292.192234][T21418] ? lockdep_hardirqs_on+0x78/0x100 [ 1292.192247][T21418] __do_fast_syscall_32+0xe3/0x8c0 [ 1292.192264][T21418] do_fast_syscall_32+0x32/0x70 [ 1292.192279][T21418] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1292.192297][T21418] RIP: 0023:0xf709ef6c [ 1292.192308][T21418] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1292.192321][T21418] RSP: 002b:00000000f546c50c EFLAGS: 00000292 ORIG_RAX: 000000000000016d [ 1292.192334][T21418] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000000000000 [ 1292.192342][T21418] RDX: 0000000000000482 RSI: 0000000080000000 RDI: 00000000800000c0 [ 1292.192350][T21418] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1292.192357][T21418] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1292.192365][T21418] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1292.192380][T21418] [ 1292.283408][T21410] rdma_rxe: rxe_newlink: failed to add wg2 [ 1292.527200][T21414] vhci_hcd: connection reset by peer [ 1292.532055][ T13] vhci_hcd vhci_hcd.3: stop threads [ 1292.534772][ T13] vhci_hcd vhci_hcd.3: release socket [ 1292.538100][ T13] vhci_hcd vhci_hcd.3: disconnect device [ 1292.585611][ T8665] usb usb42-port1: attempt power cycle [ 1292.608253][T21411] vhci_hcd: connection reset by peer [ 1292.612301][ T13] vhci_hcd vhci_hcd.1: stop threads [ 1292.615073][ T13] vhci_hcd vhci_hcd.1: release socket [ 1292.617709][ T13] vhci_hcd vhci_hcd.1: disconnect device [ 1293.213321][ T8665] usb usb42-port1: unable to enumerate USB device [ 1293.884926][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 1293.926242][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 1294.506720][T21438] syzkaller0: entered promiscuous mode [ 1294.509250][T21438] syzkaller0: entered allmulticast mode [ 1294.657861][T21442] FAULT_INJECTION: forcing a failure. [ 1294.657861][T21442] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1294.660600][T21441] syzkaller0: entered promiscuous mode [ 1294.663122][T21442] CPU: 3 UID: 0 PID: 21442 Comm: syz.3.3983 Tainted: G L syzkaller #0 PREEMPT(full) [ 1294.663145][T21442] Tainted: [L]=SOFTLOCKUP [ 1294.663151][T21442] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1294.663160][T21442] Call Trace: [ 1294.663168][T21442] [ 1294.663176][T21442] dump_stack_lvl+0x100/0x190 [ 1294.663211][T21442] should_fail_ex.cold+0x5/0xa [ 1294.663230][T21442] _copy_to_user+0x32/0xd0 [ 1294.663251][T21442] simple_read_from_buffer+0xcb/0x170 [ 1294.663283][T21442] proc_fail_nth_read+0x1af/0x230 [ 1294.663308][T21442] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1294.663327][T21442] ? rw_verify_area+0xce/0x6d0 [ 1294.663353][T21442] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1294.663378][T21442] vfs_read+0x1e4/0xb30 [ 1294.663400][T21442] ? __pfx_vfs_read+0x10/0x10 [ 1294.663418][T21442] ? find_held_lock+0x2b/0x80 [ 1294.663437][T21442] ? __fget_files+0x215/0x3d0 [ 1294.663461][T21442] ? __fget_files+0x21f/0x3d0 [ 1294.663487][T21442] ksys_read+0x12a/0x250 [ 1294.663505][T21442] ? __pfx_ksys_read+0x10/0x10 [ 1294.663529][T21442] do_int80_emulation+0x141/0x6b0 [ 1294.663556][T21442] asm_int80_emulation+0x1a/0x20 [ 1294.663574][T21442] RIP: 0023:0xf71b5cab [ 1294.663589][T21442] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1294.663606][T21442] RSP: 002b:00000000f54554bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1294.663627][T21442] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000f54555d0 [ 1294.663640][T21442] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1294.663650][T21442] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1294.663658][T21442] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1294.663666][T21442] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1294.663685][T21442] [ 1294.773978][T21441] syzkaller0: entered allmulticast mode [ 1295.064582][T18121] Bluetooth: hci1: unexpected event for opcode 0x0c7b [ 1295.480307][T21455] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(10) [ 1295.482674][T21455] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1295.485651][T21455] vhci_hcd vhci_hcd.0: Device attached [ 1295.503700][T21452] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 1295.505812][T21452] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1295.621044][T21452] vhci_hcd vhci_hcd.0: Device attached [ 1295.728412][T21460] blktrace: Concurrent blktraces are not allowed on nbd0 [ 1295.809445][T21452] rdma_rxe: rxe_newlink: failed to add wg2 [ 1295.981557][T21454] vhci_hcd: connection closed [ 1295.981878][ T12] vhci_hcd vhci_hcd.0: stop threads [ 1295.985256][ T12] vhci_hcd vhci_hcd.0: release socket [ 1295.987026][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 1295.993409][ T1722] usb 38-1: enqueue for inactive port 0 [ 1296.213883][T21456] vhci_hcd: connection closed [ 1296.217191][ T12] vhci_hcd vhci_hcd.1: stop threads [ 1296.220444][ T12] vhci_hcd vhci_hcd.1: release socket [ 1296.224684][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 1296.255964][ T40] audit: type=1326 audit(1775434044.107:69064): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21463 comm="syz.2.3987" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6ffef6c code=0x0 [ 1296.483110][T21470] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1296.513601][ T1722] usb usb38-port1: attempt power cycle [ 1297.720308][ T29] usb 44-1: device descriptor read/8, error -110 [ 1297.721494][T21479] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3991'. [ 1297.722531][ T8641] usb 40-1: device descriptor read/8, error -110 [ 1298.162160][T21482] xt_connbytes: Forcing CT accounting to be enabled [ 1298.477662][T21473] 9pnet_virtio: no channels available for device ./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 1298.478279][T21473] 9pnet_virtio: no channels available for device ./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 1298.510667][T21473] dummy0: entered promiscuous mode [ 1298.541456][T21473] macvlan0: entered promiscuous mode [ 1298.543218][T21473] macvlan0: entered allmulticast mode [ 1298.544916][T21473] dummy0: entered allmulticast mode [ 1298.548816][T21473] netlink: 3 bytes leftover after parsing attributes in process `syz.0.3989'. [ 1298.552075][T21473] netlink: 3 bytes leftover after parsing attributes in process `syz.0.3989'. [ 1298.555325][ T29] usb usb44-port1: attempt power cycle [ 1298.572451][T21474] netlink: 3 bytes leftover after parsing attributes in process `syz.0.3989'. [ 1298.576720][T21474] netlink: 3 bytes leftover after parsing attributes in process `syz.0.3989'. [ 1298.773153][ T1722] usb usb38-port1: unable to enumerate USB device [ 1298.853615][ T8641] usb usb40-port1: attempt power cycle [ 1298.942092][ T8665] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 1299.246045][ T29] usb usb44-port1: unable to enumerate USB device [ 1299.489634][T21509] random: crng reseeded on system resumption [ 1299.500522][T21509] netlink: 19 bytes leftover after parsing attributes in process `syz.2.3999'. [ 1299.804068][T21528] ptrace attach of "/syz-executor exec"[21533] was attempted by "/syz-executor exec"[21528] [ 1299.835442][T21534] tmpfs: Unknown parameter 'urquota' [ 1299.845718][T21531] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1299.848579][T21531] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1299.852203][T21531] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1300.291616][ T8641] usb usb40-port1: unable to enumerate USB device [ 1301.296553][T21555] netlink: 'syz.2.4013': attribute type 8 has an invalid length. [ 1301.850917][ T62] Bluetooth: hci4: command 0x040f tx timeout [ 1301.931044][T18121] Bluetooth: hci5: command 0x0c1a tx timeout [ 1301.931091][ T62] Bluetooth: hci1: command 0x0c1a tx timeout [ 1302.354106][T21571] FAULT_INJECTION: forcing a failure. [ 1302.354106][T21571] name failslab, interval 1, probability 0, space 0, times 0 [ 1302.354155][T21571] CPU: 3 UID: 0 PID: 21571 Comm: syz.3.4015 Tainted: G L syzkaller #0 PREEMPT(full) [ 1302.354172][T21571] Tainted: [L]=SOFTLOCKUP [ 1302.354176][T21571] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1302.354188][T21571] Call Trace: [ 1302.354192][T21571] [ 1302.354197][T21571] dump_stack_lvl+0x100/0x190 [ 1302.354218][T21571] should_fail_ex.cold+0x5/0xa [ 1302.354232][T21571] should_failslab+0xc2/0x120 [ 1302.354246][T21571] __kmalloc_cache_noprof+0x7a/0x6f0 [ 1302.354262][T21571] ? vhost_task_create+0xee/0x370 [ 1302.354282][T21571] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 1302.354298][T21571] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 1302.354315][T21571] vhost_task_create+0xee/0x370 [ 1302.354332][T21571] ? __pfx_vhost_task_create+0x10/0x10 [ 1302.354349][T21571] ? register_lock_class+0x40/0x560 [ 1302.354368][T21571] ? __pfx_vhost_task_fn+0x10/0x10 [ 1302.354387][T21571] ? __pfx___mutex_lock+0x10/0x10 [ 1302.354404][T21571] kvm_mmu_post_init_vm+0x1b3/0x370 [ 1302.354418][T21571] kvm_arch_vcpu_ioctl_run+0x66/0x1830 [ 1302.354431][T21571] ? kvm_vcpu_ioctl+0x155c/0x1730 [ 1302.354450][T21571] kvm_vcpu_ioctl+0x730/0x1730 [ 1302.354490][T21571] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1302.354514][T21571] ? tomoyo_path_number_perm+0x188/0x580 [ 1302.354533][T21571] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1302.354552][T21571] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1302.354566][T21571] ? do_vfs_ioctl+0x226/0x13e0 [ 1302.354584][T21571] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1302.354607][T21571] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 1302.354624][T21571] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 1302.354640][T21571] ? __fget_files+0x21f/0x3d0 [ 1302.354654][T21571] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 1302.354671][T21571] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1302.354691][T21571] __do_fast_syscall_32+0xe3/0x8c0 [ 1302.354706][T21571] do_fast_syscall_32+0x32/0x70 [ 1302.354719][T21571] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1302.354733][T21571] RIP: 0023:0xf7fb3f6c [ 1302.354743][T21571] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1302.354754][T21571] RSP: 002b:00000000f545550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1302.354766][T21571] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 1302.354773][T21571] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1302.354780][T21571] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1302.354786][T21571] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1302.354793][T21571] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1302.354807][T21571] [ 1302.570326][T21568] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1302.668342][T21580] netlink: 'syz.1.4017': attribute type 8 has an invalid length. [ 1303.912881][T21590] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1303.952162][T21591] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1304.337369][ T62] Bluetooth: hci4: Malformed MSFT vendor event: 0x02 [ 1304.511561][T21608] netlink: 'syz.1.4024': attribute type 8 has an invalid length. [ 1305.155552][ T1418] ieee802154 phy0 wpan0: encryption failed: -22 [ 1305.677299][T21622] netlink: 'syz.0.4027': attribute type 8 has an invalid length. [ 1306.639617][ T40] audit: type=1326 audit(1775434054.502:69065): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21617 comm="syz.0.4027" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1306.647047][ T40] audit: type=1326 audit(1775434054.502:69066): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21617 comm="syz.0.4027" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1306.663194][ T40] audit: type=1326 audit(1775434054.522:69067): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21617 comm="syz.0.4027" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709ef88 code=0x7ffc0000 [ 1306.670903][ T40] audit: type=1326 audit(1775434054.522:69068): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21617 comm="syz.0.4027" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709ef88 code=0x7ffc0000 [ 1306.678379][ T40] audit: type=1326 audit(1775434054.522:69069): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21617 comm="syz.0.4027" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1306.685802][ T40] audit: type=1326 audit(1775434054.522:69070): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21617 comm="syz.0.4027" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1306.693322][ T40] audit: type=1326 audit(1775434054.522:69071): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21617 comm="syz.0.4027" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1306.700700][ T40] audit: type=1326 audit(1775434054.522:69072): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21617 comm="syz.0.4027" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1306.709198][ T40] audit: type=1326 audit(1775434054.522:69073): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21617 comm="syz.0.4027" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1306.716570][ T40] audit: type=1326 audit(1775434054.522:69074): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21617 comm="syz.0.4027" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709ef88 code=0x7ffc0000 [ 1306.795108][T21646] netlink: 'syz.3.4033': attribute type 8 has an invalid length. [ 1306.854476][T21636] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4031'. [ 1306.889928][T21647] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4034'. [ 1306.893604][T21647] tmpfs: Bad value for 'mpol' [ 1307.004299][T21654] FAULT_INJECTION: forcing a failure. [ 1307.004299][T21654] name failslab, interval 1, probability 0, space 0, times 0 [ 1307.009789][T21654] CPU: 3 UID: 0 PID: 21654 Comm: syz.0.4036 Tainted: G L syzkaller #0 PREEMPT(full) [ 1307.009809][T21654] Tainted: [L]=SOFTLOCKUP [ 1307.009814][T21654] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1307.009821][T21654] Call Trace: [ 1307.009826][T21654] [ 1307.009835][T21654] dump_stack_lvl+0x100/0x190 [ 1307.009870][T21654] should_fail_ex.cold+0x5/0xa [ 1307.009897][T21654] ? tomoyo_encode2+0xfb/0x3c0 [ 1307.009914][T21654] should_failslab+0xc2/0x120 [ 1307.009927][T21654] __kmalloc_noprof+0xe0/0x850 [ 1307.009949][T21654] tomoyo_encode2+0xfb/0x3c0 [ 1307.009967][T21654] tomoyo_encode+0x29/0x50 [ 1307.009983][T21654] tomoyo_realpath_from_path+0x18c/0x690 [ 1307.010003][T21654] tomoyo_path_number_perm+0x23c/0x580 [ 1307.010017][T21654] ? tomoyo_path_number_perm+0x22e/0x580 [ 1307.010031][T21654] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1307.010060][T21654] ? find_held_lock+0x2b/0x80 [ 1307.010071][T21654] ? hook_file_ioctl_common+0x146/0x410 [ 1307.010085][T21654] ? __fget_files+0x215/0x3d0 [ 1307.010099][T21654] ? __fget_files+0x21f/0x3d0 [ 1307.010112][T21654] security_file_ioctl_compat+0xd3/0x230 [ 1307.010128][T21654] __ia32_compat_sys_ioctl+0xc2/0x360 [ 1307.010148][T21654] __do_fast_syscall_32+0xe3/0x8c0 [ 1307.010164][T21654] do_fast_syscall_32+0x32/0x70 [ 1307.010177][T21654] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1307.010192][T21654] RIP: 0023:0xf709ef6c [ 1307.010202][T21654] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1307.010213][T21654] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1307.010225][T21654] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 1307.010232][T21654] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1307.010239][T21654] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1307.010245][T21654] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1307.010251][T21654] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1307.010265][T21654] [ 1307.010337][T21654] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1308.007249][T21663] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4038'. [ 1308.056800][T21666] syzkaller0: entered promiscuous mode [ 1308.072651][T21669] FAULT_INJECTION: forcing a failure. [ 1308.072651][T21669] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1308.077367][T21669] CPU: 0 UID: 0 PID: 21669 Comm: syz.3.4040 Tainted: G L syzkaller #0 PREEMPT(full) [ 1308.077395][T21669] Tainted: [L]=SOFTLOCKUP [ 1308.077401][T21669] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1308.077413][T21669] Call Trace: [ 1308.077419][T21669] [ 1308.077428][T21669] dump_stack_lvl+0x100/0x190 [ 1308.077459][T21669] should_fail_ex.cold+0x5/0xa [ 1308.077479][T21669] strncpy_from_user+0x3b/0x2d0 [ 1308.077503][T21669] do_getname+0x78/0x390 [ 1308.077526][T21669] do_sys_openat2+0xc5/0x1e0 [ 1308.077549][T21669] ? __pfx_do_sys_openat2+0x10/0x10 [ 1308.077570][T21669] ? __fget_files+0x215/0x3d0 [ 1308.077591][T21669] ? __fget_files+0x21f/0x3d0 [ 1308.077610][T21669] __ia32_compat_sys_openat+0x12d/0x210 [ 1308.077635][T21669] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 1308.077663][T21669] ? __pfx_ksys_write+0x10/0x10 [ 1308.077684][T21669] __do_fast_syscall_32+0xe3/0x8c0 [ 1308.077708][T21669] do_fast_syscall_32+0x32/0x70 [ 1308.077727][T21669] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1308.077749][T21669] RIP: 0023:0xf7fb3f6c [ 1308.077763][T21669] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1308.077779][T21669] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 1308.077797][T21669] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000280 [ 1308.077808][T21669] RDX: 0000000000004080 RSI: 0000000000000000 RDI: 0000000000000000 [ 1308.077818][T21669] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1308.077828][T21669] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1308.077836][T21669] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1308.077859][T21669] [ 1308.181383][T21672] netlink: 'syz.3.4041': attribute type 13 has an invalid length. [ 1308.336732][T21679] netlink: 'syz.3.4042': attribute type 8 has an invalid length. [ 1308.592234][T21685] input: syz0 as /devices/virtual/input/input30 [ 1310.245206][T21688] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 1310.248185][T21688] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1310.316429][T21688] vhci_hcd vhci_hcd.0: Device attached [ 1310.370237][T21693] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1310.474579][T21690] vhci_hcd: connection closed [ 1310.474794][ T12] vhci_hcd vhci_hcd.0: stop threads [ 1310.479627][ T12] vhci_hcd vhci_hcd.0: release socket [ 1310.483364][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 1310.518166][T21703] FAULT_INJECTION: forcing a failure. [ 1310.518166][T21703] name failslab, interval 1, probability 0, space 0, times 0 [ 1310.523324][T21703] CPU: 2 UID: 0 PID: 21703 Comm: syz.2.4049 Tainted: G L syzkaller #0 PREEMPT(full) [ 1310.523345][T21703] Tainted: [L]=SOFTLOCKUP [ 1310.523350][T21703] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1310.523358][T21703] Call Trace: [ 1310.523364][T21703] [ 1310.523371][T21703] dump_stack_lvl+0x100/0x190 [ 1310.523396][T21703] should_fail_ex.cold+0x5/0xa [ 1310.523412][T21703] ? tomoyo_encode2+0xfb/0x3c0 [ 1310.523429][T21703] should_failslab+0xc2/0x120 [ 1310.523445][T21703] __kmalloc_noprof+0xe0/0x850 [ 1310.523465][T21703] ? d_absolute_path+0x136/0x1b0 [ 1310.523486][T21703] tomoyo_encode2+0xfb/0x3c0 [ 1310.523507][T21703] tomoyo_encode+0x29/0x50 [ 1310.523525][T21703] tomoyo_realpath_from_path+0x18c/0x690 [ 1310.523547][T21703] tomoyo_path_number_perm+0x23c/0x580 [ 1310.523563][T21703] ? tomoyo_path_number_perm+0x22e/0x580 [ 1310.523580][T21703] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1310.523611][T21703] ? find_held_lock+0x2b/0x80 [ 1310.523624][T21703] ? hook_file_ioctl_common+0x146/0x410 [ 1310.523666][T21703] ? __fget_files+0x215/0x3d0 [ 1310.523684][T21703] ? __fget_files+0x21f/0x3d0 [ 1310.523699][T21703] security_file_ioctl_compat+0xd3/0x230 [ 1310.523717][T21703] __ia32_compat_sys_ioctl+0xc2/0x360 [ 1310.523739][T21703] __do_fast_syscall_32+0xe3/0x8c0 [ 1310.523757][T21703] do_fast_syscall_32+0x32/0x70 [ 1310.523772][T21703] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1310.523789][T21703] RIP: 0023:0xf6ffef6c [ 1310.523801][T21703] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1310.523813][T21703] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1310.523826][T21703] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000000007cb [ 1310.523834][T21703] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 1310.523842][T21703] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1310.523853][T21703] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1310.523860][T21703] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1310.523876][T21703] [ 1310.523893][T21703] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1310.600675][T21707] tmpfs: Unknown parameter 'urquota' [ 1310.656453][T21705] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1310.659720][T21705] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1310.662503][T21705] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1310.682086][T21709] FAULT_INJECTION: forcing a failure. [ 1310.682086][T21709] name failslab, interval 1, probability 0, space 0, times 0 [ 1310.687893][T21709] CPU: 3 UID: 0 PID: 21709 Comm: syz.2.4051 Tainted: G L syzkaller #0 PREEMPT(full) [ 1310.687929][T21709] Tainted: [L]=SOFTLOCKUP [ 1310.687937][T21709] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1310.687950][T21709] Call Trace: [ 1310.687958][T21709] [ 1310.687966][T21709] dump_stack_lvl+0x100/0x190 [ 1310.688004][T21709] should_fail_ex.cold+0x5/0xa [ 1310.688030][T21709] should_failslab+0xc2/0x120 [ 1310.688054][T21709] __kvmalloc_node_noprof+0xfa/0xa00 [ 1310.688074][T21709] ? traverse.part.0.constprop.0+0x397/0x650 [ 1310.688113][T21709] traverse.part.0.constprop.0+0x397/0x650 [ 1310.688154][T21709] seq_read_iter+0x93f/0x1270 [ 1310.688199][T21709] proc_reg_read_iter+0x220/0x310 [ 1310.688232][T21709] ? __pfx_proc_reg_read_iter+0x10/0x10 [ 1310.688260][T21709] vfs_read+0x825/0xb30 [ 1310.688281][T21709] ? __pfx_vfs_read+0x10/0x10 [ 1310.688297][T21709] ? find_held_lock+0x2b/0x80 [ 1310.688333][T21709] ksys_pread64+0x161/0x1a0 [ 1310.688352][T21709] ? __pfx_ksys_pread64+0x10/0x10 [ 1310.688372][T21709] ? __pfx_ksys_write+0x10/0x10 [ 1310.688402][T21709] __do_fast_syscall_32+0xe3/0x8c0 [ 1310.688433][T21709] do_fast_syscall_32+0x32/0x70 [ 1310.688459][T21709] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1310.688510][T21709] RIP: 0023:0xf6ffef6c [ 1310.688529][T21709] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1310.688551][T21709] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 00000000000000b4 [ 1310.688574][T21709] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080003b00 [ 1310.688589][T21709] RDX: 00000000000000c3 RSI: 000000000000591f RDI: 0000000000000000 [ 1310.688603][T21709] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1310.688616][T21709] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1310.688629][T21709] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1310.688661][T21709] [ 1310.696012][ T8665] usb 8-1: new high-speed USB device number 91 using dummy_hcd [ 1310.749305][T21716] FAULT_INJECTION: forcing a failure. [ 1310.749305][T21716] name failslab, interval 1, probability 0, space 0, times 0 [ 1310.788972][T21716] CPU: 3 UID: 0 PID: 21716 Comm: syz.2.4053 Tainted: G L syzkaller #0 PREEMPT(full) [ 1310.788995][T21716] Tainted: [L]=SOFTLOCKUP [ 1310.789000][T21716] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1310.789008][T21716] Call Trace: [ 1310.789014][T21716] [ 1310.789019][T21716] dump_stack_lvl+0x100/0x190 [ 1310.789043][T21716] should_fail_ex.cold+0x5/0xa [ 1310.789064][T21716] should_failslab+0xc2/0x120 [ 1310.789079][T21716] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 1310.789100][T21716] ? __alloc_skb+0x140/0x710 [ 1310.789127][T21716] __alloc_skb+0x140/0x710 [ 1310.789145][T21716] ? __alloc_skb+0x5b7/0x710 [ 1310.789164][T21716] ? __pfx___alloc_skb+0x10/0x10 [ 1310.789188][T21716] netlink_alloc_large_skb+0x69/0x150 [ 1310.789204][T21716] netlink_sendmsg+0x680/0xda0 [ 1310.789220][T21716] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1310.789236][T21716] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 1310.789253][T21716] ____sys_sendmsg+0x9e1/0xb70 [ 1310.789268][T21716] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1310.789283][T21716] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1310.789306][T21716] ___sys_sendmsg+0x190/0x1e0 [ 1310.789324][T21716] ? __pfx____sys_sendmsg+0x10/0x10 [ 1310.789359][T21716] __sys_sendmsg+0x170/0x220 [ 1310.789372][T21716] ? __pfx___sys_sendmsg+0x10/0x10 [ 1310.789389][T21716] ? __pfx_ksys_write+0x10/0x10 [ 1310.789406][T21716] __do_fast_syscall_32+0xe3/0x8c0 [ 1310.789423][T21716] do_fast_syscall_32+0x32/0x70 [ 1310.789437][T21716] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1310.789455][T21716] RIP: 0023:0xf6ffef6c [ 1310.789466][T21716] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1310.789478][T21716] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1310.789491][T21716] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800001c0 [ 1310.789500][T21716] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1310.789507][T21716] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1310.789514][T21716] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1310.789521][T21716] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1310.789537][T21716] [ 1310.920510][T21723] FAULT_INJECTION: forcing a failure. [ 1310.920510][T21723] name failslab, interval 1, probability 0, space 0, times 0 [ 1310.927727][T21723] CPU: 2 UID: 0 PID: 21723 Comm: syz.2.4056 Tainted: G L syzkaller #0 PREEMPT(full) [ 1310.927747][T21723] Tainted: [L]=SOFTLOCKUP [ 1310.927752][T21723] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1310.927759][T21723] Call Trace: [ 1310.927764][T21723] [ 1310.927769][T21723] dump_stack_lvl+0x100/0x190 [ 1310.927792][T21723] should_fail_ex.cold+0x5/0xa [ 1310.927807][T21723] ? alloc_pipe_info+0x1ec/0x590 [ 1310.927823][T21723] should_failslab+0xc2/0x120 [ 1310.927836][T21723] __kmalloc_noprof+0xe0/0x850 [ 1310.927857][T21723] alloc_pipe_info+0x1ec/0x590 [ 1310.927871][T21723] splice_direct_to_actor+0x78f/0xa30 [ 1310.927884][T21723] ? __lock_acquire+0x4a5/0x2630 [ 1310.927899][T21723] ? __pfx_direct_splice_actor+0x10/0x10 [ 1310.927912][T21723] ? __pfx_aa_file_perm+0x10/0x10 [ 1310.927930][T21723] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1310.927946][T21723] do_splice_direct+0x174/0x240 [ 1310.927959][T21723] ? __pfx_do_splice_direct+0x10/0x10 [ 1310.927977][T21723] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1310.928008][T21723] ? rw_verify_area+0xce/0x6d0 [ 1310.928032][T21723] do_sendfile+0xadc/0xe20 [ 1310.928064][T21723] ? __pfx_do_sendfile+0x10/0x10 [ 1310.928090][T21723] ? __fget_files+0x21f/0x3d0 [ 1310.928113][T21723] __ia32_compat_sys_sendfile+0x1e5/0x220 [ 1310.928134][T21723] ? __pfx___ia32_compat_sys_sendfile+0x10/0x10 [ 1310.928152][T21723] ? arch_syscall_is_vdso_sigreturn+0x19b/0x200 [ 1310.928172][T21723] ? syscall_user_dispatch+0x76/0x130 [ 1310.928198][T21723] __do_fast_syscall_32+0xe3/0x8c0 [ 1310.928220][T21723] do_fast_syscall_32+0x32/0x70 [ 1310.928238][T21723] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1310.928260][T21723] RIP: 0023:0xf6ffef6c [ 1310.928274][T21723] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1310.928290][T21723] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 00000000000000bb [ 1310.928306][T21723] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000003 [ 1310.928316][T21723] RDX: 0000000000000000 RSI: 00000000fffffffb RDI: 0000000000000000 [ 1310.928326][T21723] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1310.928336][T21723] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1310.928345][T21723] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1310.928368][T21723] [ 1310.935944][ T8665] usb 8-1: Using ep0 maxpacket: 32 [ 1311.097813][ T8665] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1311.104799][ T8665] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1311.109530][ T8665] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1311.113039][ T8665] usb 8-1: Product: syz [ 1311.114974][ T8665] usb 8-1: Manufacturer: syz [ 1311.118321][ T8665] usb 8-1: SerialNumber: syz [ 1311.123409][ T8665] usb 8-1: config 0 descriptor?? [ 1311.128317][T21700] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1311.414834][T21737] tmpfs: Unknown parameter 'urquota' [ 1311.425986][T21735] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1311.429586][T21735] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1311.433311][T21735] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1311.886374][T21745] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 1311.889211][T21745] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1311.893481][T21745] vhci_hcd vhci_hcd.0: Device attached [ 1311.999045][T21749] FAULT_INJECTION: forcing a failure. [ 1311.999045][T21749] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1312.027284][T21749] CPU: 3 UID: 0 PID: 21749 Comm: syz.2.4064 Tainted: G L syzkaller #0 PREEMPT(full) [ 1312.027316][T21749] Tainted: [L]=SOFTLOCKUP [ 1312.027323][T21749] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1312.027334][T21749] Call Trace: [ 1312.027341][T21749] [ 1312.027349][T21749] dump_stack_lvl+0x100/0x190 [ 1312.027382][T21749] should_fail_ex.cold+0x5/0xa [ 1312.027405][T21749] _copy_from_user+0x2e/0xd0 [ 1312.027430][T21749] drm_ioctl+0x520/0xc60 [ 1312.027459][T21749] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 1312.027489][T21749] ? __pfx_drm_ioctl+0x10/0x10 [ 1312.027530][T21749] drm_compat_ioctl+0x386/0x4c0 [ 1312.027562][T21749] ? __pfx_drm_compat_ioctl+0x10/0x10 [ 1312.027590][T21749] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1312.027621][T21749] __do_fast_syscall_32+0xe3/0x8c0 [ 1312.027646][T21749] do_fast_syscall_32+0x32/0x70 [ 1312.027667][T21749] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1312.027689][T21749] RIP: 0023:0xf6ffef6c [ 1312.027705][T21749] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1312.027723][T21749] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1312.027741][T21749] RAX: ffffffffffffffda RBX: 0000000000000012 RCX: 00000000c03864bc [ 1312.027753][T21749] RDX: 0000000080000180 RSI: 0000000000000000 RDI: 0000000000000000 [ 1312.027764][T21749] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1312.027774][T21749] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1312.027785][T21749] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1312.027808][T21749] [ 1312.033704][T21752] fuse: Bad value for 'fd' [ 1312.285166][ T8641] usb 38-1: SetAddress Request (39) to port 0 [ 1312.512787][ T8641] usb 38-1: new SuperSpeed USB device number 39 using vhci_hcd [ 1312.518337][T21746] vhci_hcd: connection closed [ 1312.518614][T21112] vhci_hcd vhci_hcd.0: stop threads [ 1312.522524][T21112] vhci_hcd vhci_hcd.0: release socket [ 1312.525330][T21112] vhci_hcd vhci_hcd.0: disconnect device [ 1312.545105][ T8641] usb 38-1: enqueue for inactive port 0 [ 1312.781214][ T40] kauditd_printk_skb: 122 callbacks suppressed [ 1312.781235][ T40] audit: type=1326 audit(1775434060.645:69197): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21768 comm="syz.2.4069" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6ffef6c code=0x0 [ 1312.935534][ T8641] usb usb38-port1: attempt power cycle [ 1313.207573][T21777] FAULT_INJECTION: forcing a failure. [ 1313.207573][T21777] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1313.212344][T21777] CPU: 1 UID: 0 PID: 21777 Comm: syz.0.4072 Tainted: G L syzkaller #0 PREEMPT(full) [ 1313.212364][T21777] Tainted: [L]=SOFTLOCKUP [ 1313.212368][T21777] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1313.212375][T21777] Call Trace: [ 1313.212380][T21777] [ 1313.212385][T21777] dump_stack_lvl+0x100/0x190 [ 1313.212408][T21777] should_fail_ex.cold+0x5/0xa [ 1313.212422][T21777] _copy_from_user+0x2e/0xd0 [ 1313.212437][T21777] dvb_frontend_handle_compat_ioctl+0x189/0x710 [ 1313.212452][T21777] ? tomoyo_path_number_perm+0x28f/0x580 [ 1313.212466][T21777] ? __pfx_dvb_frontend_handle_compat_ioctl+0x10/0x10 [ 1313.212482][T21777] ? tomoyo_path_number_perm+0x188/0x580 [ 1313.212497][T21777] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1313.212517][T21777] ? __lock_acquire+0x4a5/0x2630 [ 1313.212533][T21777] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1313.212553][T21777] ? do_raw_spin_lock+0x128/0x260 [ 1313.212571][T21777] ? find_held_lock+0x2b/0x80 [ 1313.212582][T21777] ? down_interruptible+0x66/0xa0 [ 1313.212598][T21777] ? rcu_is_watching+0x12/0xc0 [ 1313.212616][T21777] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1313.212635][T21777] ? lockdep_hardirqs_on+0x78/0x100 [ 1313.212649][T21777] dvb_frontend_compat_ioctl+0xf6/0x180 [ 1313.212662][T21777] ? __pfx_dvb_frontend_compat_ioctl+0x10/0x10 [ 1313.212675][T21777] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1313.212694][T21777] __do_fast_syscall_32+0xe3/0x8c0 [ 1313.212709][T21777] do_fast_syscall_32+0x32/0x70 [ 1313.212722][T21777] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1313.212737][T21777] RIP: 0023:0xf709ef6c [ 1313.212747][T21777] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1313.212759][T21777] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1313.212770][T21777] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040086f52 [ 1313.212778][T21777] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1313.212785][T21777] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1313.212791][T21777] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1313.212797][T21777] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1313.212812][T21777] [ 1313.434712][ T62] Bluetooth: hci1: command 0x0c1a tx timeout [ 1313.434745][T18121] Bluetooth: hci5: command 0x0c1a tx timeout [ 1313.434770][ T5953] Bluetooth: hci4: command 0x040f tx timeout [ 1313.512470][T21781] comedi comedi3: rti800: I/O port conflict (0x3,16) [ 1313.517462][ T6089] usb 8-1: USB disconnect, device number 91 [ 1313.596385][ T8641] usb usb38-port1: unable to enumerate USB device [ 1313.692616][T21788] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4074'. [ 1313.874443][T21794] FAULT_INJECTION: forcing a failure. [ 1313.874443][T21794] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1313.879668][T21794] CPU: 0 UID: 0 PID: 21794 Comm: syz.1.4077 Tainted: G L syzkaller #0 PREEMPT(full) [ 1313.879698][T21794] Tainted: [L]=SOFTLOCKUP [ 1313.879704][T21794] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1313.879714][T21794] Call Trace: [ 1313.879722][T21794] [ 1313.879730][T21794] dump_stack_lvl+0x100/0x190 [ 1313.879763][T21794] should_fail_ex.cold+0x5/0xa [ 1313.879786][T21794] _copy_to_user+0x32/0xd0 [ 1313.879813][T21794] simple_read_from_buffer+0xcb/0x170 [ 1313.879846][T21794] proc_fail_nth_read+0x1af/0x230 [ 1313.879872][T21794] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1313.879896][T21794] ? rw_verify_area+0xce/0x6d0 [ 1313.879919][T21794] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1313.879942][T21794] vfs_read+0x1e4/0xb30 [ 1313.879964][T21794] ? __pfx_vfs_read+0x10/0x10 [ 1313.879981][T21794] ? find_held_lock+0x2b/0x80 [ 1313.880001][T21794] ? __fget_files+0x215/0x3d0 [ 1313.880025][T21794] ? __fget_files+0x21f/0x3d0 [ 1313.880050][T21794] ksys_read+0x12a/0x250 [ 1313.880067][T21794] ? __pfx_ksys_read+0x10/0x10 [ 1313.880100][T21794] do_int80_emulation+0x141/0x6b0 [ 1313.880124][T21794] asm_int80_emulation+0x1a/0x20 [ 1313.880144][T21794] RIP: 0023:0xf7195cab [ 1313.880160][T21794] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1313.880175][T21794] RSP: 002b:00000000f54564bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1313.880196][T21794] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f54565d0 [ 1313.880207][T21794] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1313.880217][T21794] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1313.880228][T21794] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1313.880239][T21794] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1313.880262][T21794] [ 1314.145459][T21805] input: syz0 as /devices/virtual/input/input31 [ 1314.379739][T21808] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 1314.381990][T21808] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1314.401611][T21808] vhci_hcd vhci_hcd.0: Device attached [ 1314.419952][T21808] blktrace: Concurrent blktraces are not allowed on nbd1 [ 1314.443811][T21808] rdma_rxe: rxe_newlink: failed to add wg2 [ 1314.669087][T21820] openvswitch: netlink: EtherType 50a is less than min 600 [ 1314.669166][T21818] overlay: ./file0 is not a directory [ 1314.674960][ T8641] usb 40-1: SetAddress Request (28) to port 0 [ 1314.677096][ T8641] usb 40-1: new SuperSpeed USB device number 28 using vhci_hcd [ 1314.713214][T21824] FAULT_INJECTION: forcing a failure. [ 1314.713214][T21824] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1314.718349][T21824] CPU: 0 UID: 0 PID: 21824 Comm: syz.2.4089 Tainted: G L syzkaller #0 PREEMPT(full) [ 1314.718371][T21824] Tainted: [L]=SOFTLOCKUP [ 1314.718376][T21824] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1314.718384][T21824] Call Trace: [ 1314.718389][T21824] [ 1314.718395][T21824] dump_stack_lvl+0x100/0x190 [ 1314.718452][T21824] should_fail_ex.cold+0x5/0xa [ 1314.718472][T21824] _copy_from_iter+0x1f4/0x1690 [ 1314.718492][T21824] ? __asan_memset+0x23/0x50 [ 1314.718513][T21824] ? __pfx__copy_from_iter+0x10/0x10 [ 1314.718530][T21824] ? __pfx___alloc_skb+0x10/0x10 [ 1314.718558][T21824] netlink_sendmsg+0x808/0xda0 [ 1314.718576][T21824] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1314.718592][T21824] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 1314.718609][T21824] ____sys_sendmsg+0x9e1/0xb70 [ 1314.718625][T21824] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1314.718641][T21824] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1314.718664][T21824] ___sys_sendmsg+0x190/0x1e0 [ 1314.718699][T21824] ? __pfx____sys_sendmsg+0x10/0x10 [ 1314.718737][T21824] __sys_sendmsg+0x170/0x220 [ 1314.718751][T21824] ? __pfx___sys_sendmsg+0x10/0x10 [ 1314.718769][T21824] ? __pfx_ksys_write+0x10/0x10 [ 1314.718787][T21824] __do_fast_syscall_32+0xe3/0x8c0 [ 1314.718805][T21824] do_fast_syscall_32+0x32/0x70 [ 1314.718820][T21824] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1314.718837][T21824] RIP: 0023:0xf6ffef6c [ 1314.718848][T21824] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1314.718860][T21824] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1314.718874][T21824] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 1314.718883][T21824] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1314.718890][T21824] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1314.718898][T21824] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1314.718905][T21824] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1314.718922][T21824] [ 1314.880083][T21827] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4090'. [ 1314.974830][T21809] vhci_hcd: connection reset by peer [ 1314.993956][ T12] vhci_hcd vhci_hcd.1: stop threads [ 1314.995659][ T12] vhci_hcd vhci_hcd.1: release socket [ 1314.997439][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 1315.155584][T21845] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 1315.158364][T21845] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1315.162168][T21845] vhci_hcd vhci_hcd.0: Device attached [ 1315.174836][T21845] netlink: 220 bytes leftover after parsing attributes in process `syz.0.4095'. [ 1315.177910][T21845] tc_dump_action: action bad kind [ 1315.180451][T21846] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 0 [ 1315.183264][ T13] vhci_hcd vhci_hcd.0: stop threads [ 1315.185697][ T13] vhci_hcd vhci_hcd.0: release socket [ 1315.188033][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 1315.663850][ T6089] usb 7-1: new high-speed USB device number 127 using dummy_hcd [ 1315.768275][T21861] PKCS8: Unsupported PKCS#8 version [ 1315.780143][T21861] pim6reg: entered allmulticast mode [ 1315.785688][T21861] pim6reg: left allmulticast mode [ 1315.813740][ T6089] usb 7-1: Using ep0 maxpacket: 32 [ 1315.818546][ T6089] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1315.823501][ T6089] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1315.826453][ T6089] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1315.829335][ T6089] usb 7-1: Product: syz [ 1315.830803][ T6089] usb 7-1: Manufacturer: syz [ 1315.832315][ T6089] usb 7-1: SerialNumber: syz [ 1315.836330][ T6089] usb 7-1: config 0 descriptor?? [ 1315.838591][T21854] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1316.326202][T21869] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1316.543165][T21876] 9p: Bad value for 'wfdno' [ 1316.603574][T21879] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 1316.610239][T21879] qnx6: wrong signature (magic) in superblock #1. [ 1316.613372][T21879] qnx6: unable to read the first superblock [ 1316.853073][ T6089] usb 6-1: new low-speed USB device number 108 using dummy_hcd [ 1316.926318][T21882] netlink: 14 bytes leftover after parsing attributes in process `syz.0.4105'. [ 1316.948592][T21882] dummy0 (unregistering): left promiscuous mode [ 1317.015118][ T6089] usb 6-1: config 1 interface 0 altsetting 15 endpoint 0x1 is Bulk; changing to Interrupt [ 1317.018897][ T6089] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1317.024558][ T6089] usb 6-1: string descriptor 0 read error: -22 [ 1317.026558][ T6089] usb 6-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 1317.029751][ T6089] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1317.038109][T21876] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1317.105753][T21886] netlink: 'syz.0.4106': attribute type 1 has an invalid length. [ 1317.251670][ T6089] usb 6-1: USB disconnect, device number 108 [ 1317.389045][T21891] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4107'. [ 1317.459361][T21892] ALSA: mixer_oss: invalid OSS volume '' [ 1318.216385][T21896] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4108'. [ 1318.300996][T21897] ALSA: mixer_oss: invalid OSS volume '' [ 1318.602887][ T6089] usb 7-1: USB disconnect, device number 127 [ 1319.318681][T21910] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4109'. [ 1319.751507][ T8641] usb 40-1: device descriptor read/8, error -110 [ 1319.876859][ T40] audit: type=1326 audit(1775434067.739:69198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21912 comm="syz.0.4111" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1319.888651][ T40] audit: type=1326 audit(1775434067.739:69199): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21912 comm="syz.0.4111" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1319.904436][ T40] audit: type=1326 audit(1775434067.749:69200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21912 comm="syz.0.4111" exe="/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1319.916397][ T40] audit: type=1326 audit(1775434067.749:69201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21912 comm="syz.0.4111" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1319.926943][ T40] audit: type=1326 audit(1775434067.749:69202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21912 comm="syz.0.4111" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1319.937398][ T40] audit: type=1326 audit(1775434067.749:69203): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21912 comm="syz.0.4111" exe="/syz-executor" sig=0 arch=40000003 syscall=297 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1319.946115][ T40] audit: type=1326 audit(1775434067.749:69204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21912 comm="syz.0.4111" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1319.954457][ T40] audit: type=1326 audit(1775434067.749:69205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21912 comm="syz.0.4111" exe="/syz-executor" sig=0 arch=40000003 syscall=358 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1319.961727][ T40] audit: type=1326 audit(1775434067.749:69206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21912 comm="syz.0.4111" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1319.968893][ T40] audit: type=1326 audit(1775434067.759:69207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21912 comm="syz.0.4111" exe="/syz-executor" sig=0 arch=40000003 syscall=427 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1320.142156][ T8641] usb usb40-port1: attempt power cycle [ 1320.231370][T21926] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4114'. [ 1320.712070][ T8641] usb usb40-port1: unable to enumerate USB device [ 1321.081347][ T6063] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 1321.230689][ T6063] usb 5-1: Using ep0 maxpacket: 32 [ 1321.240817][ T6063] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1321.248395][ T6063] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1321.253006][ T6063] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1321.256262][ T6063] usb 5-1: Product: syz [ 1321.258537][ T6063] usb 5-1: Manufacturer: syz [ 1321.260840][ T6063] usb 5-1: SerialNumber: syz [ 1321.270088][ T6063] usb 5-1: config 0 descriptor?? [ 1321.273516][T21934] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1321.539502][T21937] nbd: must specify at least one socket [ 1322.782866][T21953] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 1322.785613][T21953] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1322.800811][T21953] vhci_hcd vhci_hcd.0: Device attached [ 1322.896767][T21953] blktrace: Concurrent blktraces are not allowed on nbd1 [ 1322.934261][T21953] rdma_rxe: rxe_newlink: failed to add wg2 [ 1323.089900][ T8641] usb 40-1: SetAddress Request (32) to port 0 [ 1323.092776][ T8641] usb 40-1: new SuperSpeed USB device number 32 using vhci_hcd [ 1323.157452][T21960] input: syz0 as /devices/virtual/input/input32 [ 1323.383091][T21954] vhci_hcd: connection reset by peer [ 1323.385088][ T12] vhci_hcd vhci_hcd.1: stop threads [ 1323.386861][ T12] vhci_hcd vhci_hcd.1: release socket [ 1323.388864][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 1323.963219][ T6063] usb 5-1: USB disconnect, device number 7 [ 1324.077728][T21978] tmpfs: Unknown parameter 'urquota' [ 1324.089395][T21977] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1324.092266][T21977] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1324.094751][T21977] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1324.418871][T21987] lo speed is unknown, defaulting to 1000 [ 1325.190903][T21991] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4135'. [ 1325.305104][T21981] lo speed is unknown, defaulting to 1000 [ 1325.948356][T11907] usb 8-1: new high-speed USB device number 92 using dummy_hcd [ 1326.140297][T11907] usb 8-1: Using ep0 maxpacket: 32 [ 1326.204549][ T62] Bluetooth: hci5: command 0x0c1a tx timeout [ 1326.207138][ T62] Bluetooth: hci4: command 0x040f tx timeout [ 1326.209151][T18121] Bluetooth: hci1: command 0x0c1a tx timeout [ 1326.343932][T22013] netlink: 'syz.0.4142': attribute type 8 has an invalid length. [ 1326.395129][T11907] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1326.401084][T11907] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1326.408223][T11907] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1326.411307][T11907] usb 8-1: Product: syz [ 1326.412717][T11907] usb 8-1: Manufacturer: syz [ 1326.414264][T11907] usb 8-1: SerialNumber: syz [ 1326.421830][T11907] usb 8-1: config 0 descriptor?? [ 1326.424115][T22015] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 1326.424478][T22002] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1326.426600][T22015] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1326.432971][T22015] vhci_hcd vhci_hcd.0: Device attached [ 1326.529535][T22015] blktrace: Concurrent blktraces are not allowed on nbd1 [ 1326.550701][T22015] rdma_rxe: rxe_newlink: failed to add wg2 [ 1326.813983][T22016] vhci_hcd: connection closed [ 1326.814205][ T1200] vhci_hcd vhci_hcd.1: stop threads [ 1326.819705][ T1200] vhci_hcd vhci_hcd.1: release socket [ 1326.822116][ T1200] vhci_hcd vhci_hcd.1: disconnect device [ 1327.483616][ T40] kauditd_printk_skb: 25 callbacks suppressed [ 1327.483634][ T40] audit: type=1326 audit(1775434075.353:69233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22010 comm="syz.0.4142" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1327.541857][ T40] audit: type=1326 audit(1775434075.353:69234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22010 comm="syz.0.4142" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1327.625632][ T40] audit: type=1326 audit(1775434075.353:69235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22010 comm="syz.0.4142" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709ef88 code=0x7ffc0000 [ 1327.634053][ T40] audit: type=1326 audit(1775434075.353:69236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22010 comm="syz.0.4142" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1327.746385][T22027] netlink: 'syz.0.4144': attribute type 8 has an invalid length. [ 1327.959781][ T40] audit: type=1326 audit(1775434075.373:69237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22010 comm="syz.0.4142" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709ef88 code=0x7ffc0000 [ 1327.966673][ T40] audit: type=1326 audit(1775434075.373:69238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22010 comm="syz.0.4142" exe="/syz-executor" sig=0 arch=40000003 syscall=322 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1327.974661][ T40] audit: type=1326 audit(1775434075.373:69239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22010 comm="syz.0.4142" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1328.037356][ T40] audit: type=1326 audit(1775434075.373:69240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22010 comm="syz.0.4142" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1328.045597][ T40] audit: type=1326 audit(1775434075.373:69241): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22010 comm="syz.0.4142" exe="/syz-executor" sig=0 arch=40000003 syscall=326 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1328.055007][ T40] audit: type=1326 audit(1775434075.373:69242): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22010 comm="syz.0.4142" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 1328.147463][ T8641] usb 40-1: device descriptor read/8, error -110 [ 1328.561498][T22043] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(13) [ 1328.563640][T22043] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1328.566343][T22043] vhci_hcd vhci_hcd.0: Device attached [ 1328.570735][T22045] vhci_hcd: connection closed [ 1328.570861][ T13] vhci_hcd vhci_hcd.1: stop threads [ 1328.576818][ T13] vhci_hcd vhci_hcd.1: release socket [ 1328.579078][ T13] vhci_hcd vhci_hcd.1: disconnect device [ 1328.639561][T22048] FAULT_INJECTION: forcing a failure. [ 1328.639561][T22048] name failslab, interval 1, probability 0, space 0, times 0 [ 1328.644164][T22048] CPU: 2 UID: 0 PID: 22048 Comm: syz.2.4147 Tainted: G L syzkaller #0 PREEMPT(full) [ 1328.644201][T22048] Tainted: [L]=SOFTLOCKUP [ 1328.644206][T22048] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1328.644216][T22048] Call Trace: [ 1328.644222][T22048] [ 1328.644228][T22048] dump_stack_lvl+0x100/0x190 [ 1328.644255][T22048] should_fail_ex.cold+0x5/0xa [ 1328.644273][T22048] ? bpf_test_init.isra.0+0x88/0x100 [ 1328.644294][T22048] should_failslab+0xc2/0x120 [ 1328.644310][T22048] __kmalloc_noprof+0xe0/0x850 [ 1328.644336][T22048] bpf_test_init.isra.0+0x88/0x100 [ 1328.644359][T22048] bpf_prog_test_run_skb+0x489/0x3230 [ 1328.644379][T22048] ? find_held_lock+0x2b/0x80 [ 1328.644394][T22048] ? __fget_files+0x215/0x3d0 [ 1328.644414][T22048] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1328.644432][T22048] ? fput+0x79/0x100 [ 1328.644452][T22048] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1328.644467][T22048] __sys_bpf+0x1725/0x4b90 [ 1328.644488][T22048] ? __pfx___sys_bpf+0x10/0x10 [ 1328.644505][T22048] ? proc_fail_nth_write+0x9f/0x220 [ 1328.644524][T22048] ? find_held_lock+0x2b/0x80 [ 1328.644543][T22048] ? find_held_lock+0x2b/0x80 [ 1328.644557][T22048] ? ksys_write+0x190/0x250 [ 1328.644575][T22048] ? __mutex_unlock_slowpath+0x15c/0x790 [ 1328.644604][T22048] ? fput+0x79/0x100 [ 1328.644621][T22048] ? ksys_write+0x1ac/0x250 [ 1328.644638][T22048] __ia32_sys_bpf+0x79/0xf0 [ 1328.644655][T22048] ? lockdep_hardirqs_on+0x78/0x100 [ 1328.644671][T22048] __do_fast_syscall_32+0xe3/0x8c0 [ 1328.644690][T22048] do_fast_syscall_32+0x32/0x70 [ 1328.644706][T22048] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1328.644725][T22048] RIP: 0023:0xf6ffef6c [ 1328.644737][T22048] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1328.644751][T22048] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1328.644767][T22048] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000640 [ 1328.644777][T22048] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 1328.644786][T22048] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1328.644801][T22048] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1328.644809][T22048] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1328.644829][T22048] [ 1328.816388][ T6063] usb 8-1: USB disconnect, device number 92 [ 1328.933388][T22053] lo speed is unknown, defaulting to 1000 [ 1329.119905][T22069] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4149'. [ 1329.206171][T22062] lo speed is unknown, defaulting to 1000 [ 1331.588532][T22093] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 1331.590651][T22093] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1331.594384][T22093] vhci_hcd vhci_hcd.0: Device attached [ 1331.755235][T22093] blktrace: Concurrent blktraces are not allowed on nbd1 [ 1331.820228][T22093] rdma_rxe: rxe_newlink: failed to add wg2 [ 1331.892336][T22097] netlink: 'syz.0.4156': attribute type 11 has an invalid length. [ 1332.000006][T22099] FAULT_INJECTION: forcing a failure. [ 1332.000006][T22099] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1332.004156][T22099] CPU: 3 UID: 0 PID: 22099 Comm: syz.0.4157 Tainted: G L syzkaller #0 PREEMPT(full) [ 1332.004176][T22099] Tainted: [L]=SOFTLOCKUP [ 1332.004180][T22099] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1332.004187][T22099] Call Trace: [ 1332.004193][T22099] [ 1332.004198][T22099] dump_stack_lvl+0x100/0x190 [ 1332.004220][T22099] should_fail_ex.cold+0x5/0xa [ 1332.004235][T22099] __kvm_write_guest_page+0x127/0x2b0 [ 1332.004249][T22099] kvm_vcpu_write_guest+0x8a/0x130 [ 1332.004263][T22099] write_emulate+0x33/0x80 [ 1332.004277][T22099] emulator_read_write_onepage+0x2e2/0xb20 [ 1332.004298][T22099] emulator_read_write+0x1d1/0x5c0 [ 1332.004317][T22099] segmented_write.isra.0+0x101/0x160 [ 1332.004330][T22099] ? __pfx_segmented_write.isra.0+0x10/0x10 [ 1332.004342][T22099] ? vmx_cache_reg+0x12c/0x7b0 [ 1332.004360][T22099] emulate_push+0x398/0x5c0 [ 1332.004375][T22099] ? __pfx_emulate_push+0x10/0x10 [ 1332.004387][T22099] ? emulator_get_msr+0xac/0x200 [ 1332.004401][T22099] ? tag_chunk+0xbf0/0x1350 [ 1332.004419][T22099] ? vmx_cache_reg+0x4d0/0x7b0 [ 1332.004437][T22099] em_call_far+0x5c1/0x8d0 [ 1332.004453][T22099] ? __pfx_em_call_far+0x10/0x10 [ 1332.004466][T22099] ? trace_kvm_mmio+0x7c/0x250 [ 1332.004488][T22099] ? __asan_memcpy+0x3c/0x60 [ 1332.004505][T22099] ? read_emulated+0x1c8/0x290 [ 1332.004525][T22099] ? __pfx_em_call_far+0x10/0x10 [ 1332.004538][T22099] x86_emulate_insn+0x5a7/0x4ad0 [ 1332.004556][T22099] ? __pfx_x86_emulate_insn+0x10/0x10 [ 1332.004572][T22099] ? vmx_vcpu_load_vmcs+0x222/0x770 [ 1332.004589][T22099] ? __lock_acquire+0x4a5/0x2630 [ 1332.004606][T22099] x86_emulate_instruction+0xb1c/0x1f80 [ 1332.004624][T22099] complete_emulated_mmio+0x659/0x7f0 [ 1332.004638][T22099] ? __pfx_complete_emulated_mmio+0x10/0x10 [ 1332.004650][T22099] kvm_arch_vcpu_ioctl_run+0x13ca/0x1830 [ 1332.004667][T22099] kvm_vcpu_ioctl+0x730/0x1730 [ 1332.004684][T22099] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1332.004705][T22099] ? tomoyo_path_number_perm+0x188/0x580 [ 1332.004720][T22099] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1332.004739][T22099] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1332.004752][T22099] ? do_vfs_ioctl+0x226/0x13e0 [ 1332.004769][T22099] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1332.004792][T22099] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 1332.004809][T22099] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 1332.004825][T22099] ? __fget_files+0x21f/0x3d0 [ 1332.004840][T22099] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 1332.004856][T22099] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1332.004875][T22099] __do_fast_syscall_32+0xe3/0x8c0 [ 1332.004891][T22099] do_fast_syscall_32+0x32/0x70 [ 1332.004904][T22099] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1332.004919][T22099] RIP: 0023:0xf709ef6c [ 1332.004929][T22099] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1332.004940][T22099] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1332.004952][T22099] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 1332.004958][T22099] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1332.004965][T22099] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1332.004971][T22099] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1332.004978][T22099] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1332.004991][T22099] [ 1332.124366][ T8665] usb 40-1: SetAddress Request (34) to port 0 [ 1332.126995][ T8665] usb 40-1: new SuperSpeed USB device number 34 using vhci_hcd [ 1332.525075][ T6063] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 1332.537451][T22094] vhci_hcd: connection reset by peer [ 1332.539788][T18273] vhci_hcd vhci_hcd.1: stop threads [ 1332.541889][T18273] vhci_hcd vhci_hcd.1: release socket [ 1332.544777][T18273] vhci_hcd vhci_hcd.1: disconnect device [ 1332.675004][ T6063] usb 5-1: Using ep0 maxpacket: 32 [ 1332.678439][ T6063] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1332.685371][ T6063] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1332.689191][ T6063] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1332.692642][ T6063] usb 5-1: Product: syz [ 1332.694778][ T6063] usb 5-1: Manufacturer: syz [ 1332.697299][ T6063] usb 5-1: SerialNumber: syz [ 1332.706163][ T6063] usb 5-1: config 0 descriptor?? [ 1332.709219][T22102] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1332.865661][T22106] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4159'. [ 1332.869970][T22108] netlink: 104 bytes leftover after parsing attributes in process `syz.3.4159'. [ 1332.873075][T22108] netlink: 104 bytes leftover after parsing attributes in process `syz.3.4159'. [ 1334.049188][T22127] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4164'. [ 1334.149669][T22134] PKCS7: Unknown OID: [4] 2.19.50.2018883.1651(bad) [ 1334.154399][T22134] PKCS7: Only support pkcs7_signedData type [ 1334.575610][ T1200] Bluetooth: hci2: Frame reassembly failed (-84) [ 1334.771815][T22144] blktrace: Concurrent blktraces are not allowed on nbd3 [ 1334.852682][T22144] rdma_rxe: rxe_newlink: failed to add wg2 [ 1335.421336][T22147] tmpfs: Unknown parameter 'urquota' [ 1335.444002][T22146] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1335.446902][T22146] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1335.449913][T22146] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1335.454008][T21883] usb 5-1: USB disconnect, device number 8 [ 1335.557878][T22149] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1335.623480][T22154] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1335.873502][T21883] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 1336.003357][T21883] usb 5-1: device descriptor read/64, error -71 [ 1336.130686][T22149] fuse: Bad value for 'fd' [ 1336.172978][T22156] input: syz0 as /devices/virtual/input/input33 [ 1336.623082][ T62] Bluetooth: hci2: command 0x1003 tx timeout [ 1336.627917][T18121] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 1336.904669][T22165] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4177'. [ 1336.951539][T22167] Cannot find map_set index 2 as target [ 1337.118109][T22174] netlink: 'syz.2.4179': attribute type 8 has an invalid length. [ 1337.184390][ T8665] usb 40-1: device descriptor read/8, error -110 [ 1337.236113][ T62] block nbd3: Receive control failed (result -32) [ 1337.242907][T18121] block nbd3: Receive control failed (result -32) [ 1337.298054][T22179] netlink: 'syz.0.4176': attribute type 8 has an invalid length. [ 1337.512641][ T62] Bluetooth: hci1: command 0x0c1a tx timeout [ 1337.512693][T18121] Bluetooth: hci5: command 0x0c1a tx timeout [ 1337.512745][T19226] Bluetooth: hci4: command 0x040f tx timeout [ 1337.596924][ T8665] usb usb40-port1: attempt power cycle [ 1338.153372][ T40] kauditd_printk_skb: 440 callbacks suppressed [ 1338.153388][ T40] audit: type=1326 audit(1775434086.028:69683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22168 comm="syz.2.4179" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6ffef88 code=0x7ffc0000 [ 1338.172260][ T40] audit: type=1326 audit(1775434086.038:69684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22168 comm="syz.2.4179" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6ffef88 code=0x7ffc0000 [ 1338.179347][ T40] audit: type=1326 audit(1775434086.038:69685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22168 comm="syz.2.4179" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6ffef88 code=0x7ffc0000 [ 1338.192441][ T40] audit: type=1326 audit(1775434086.038:69686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22168 comm="syz.2.4179" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6ffef88 code=0x7ffc0000 [ 1338.202398][ T40] audit: type=1326 audit(1775434086.038:69687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22168 comm="syz.2.4179" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6ffef88 code=0x7ffc0000 [ 1338.211228][ T40] audit: type=1326 audit(1775434086.038:69688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22168 comm="syz.2.4179" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6ffef88 code=0x7ffc0000 [ 1338.220980][ T40] audit: type=1326 audit(1775434086.038:69689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22168 comm="syz.2.4179" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6ffef88 code=0x7ffc0000 [ 1338.228827][ T40] audit: type=1326 audit(1775434086.038:69690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22168 comm="syz.2.4179" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6ffef88 code=0x7ffc0000 [ 1338.236669][ T40] audit: type=1326 audit(1775434086.038:69691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22168 comm="syz.2.4179" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6ffef88 code=0x7ffc0000 [ 1338.244473][ T40] audit: type=1326 audit(1775434086.038:69692): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22168 comm="syz.2.4179" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6ffef88 code=0x7ffc0000 [ 1338.410734][ T8665] usb usb40-port1: unable to enumerate USB device [ 1338.461112][T22183] input: syz0 as /devices/virtual/input/input34 [ 1338.713183][T22196] Cannot find map_set index 2 as target [ 1338.854794][T19226] block nbd4: Receive control failed (result -32) [ 1338.905073][T22204] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4185'. [ 1339.189784][T19226] block nbd5: Receive control failed (result -32) [ 1339.189788][T18121] block nbd5: Receive control failed (result -32) [ 1339.189803][ T62] block nbd5: Receive control failed (result -32) [ 1339.461600][ T6089] usb 8-1: new high-speed USB device number 93 using dummy_hcd [ 1339.539483][T22210] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4191'. [ 1339.547701][T22210] netlink: 'syz.2.4191': attribute type 1 has an invalid length. [ 1339.611455][ T6089] usb 8-1: Using ep0 maxpacket: 8 [ 1339.614413][ T6089] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 1339.618031][ T6089] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1339.622544][ T6089] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1339.626750][ T6089] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1339.630696][ T6089] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1339.636003][ T6089] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1339.639787][ T6089] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1339.854483][ T6089] usb 8-1: usb_control_msg returned -32 [ 1339.857530][ T6089] usbtmc 8-1:16.0: can't read capabilities [ 1340.159698][T22206] usbtmc 8-1:16.0: usb_control_msg returned -71 [ 1340.159896][ T6089] usb 8-1: USB disconnect, device number 93 [ 1340.162138][T22212] usbtmc 8-1:16.0: send_request_dev_dep_msg_in returned -19 [ 1340.508384][T22217] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4192'. [ 1340.572453][T22218] ALSA: mixer_oss: invalid OSS volume '' [ 1340.623169][T22220] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4193'. [ 1341.682397][T22228] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 1341.685225][T22228] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1341.700550][T22228] vhci_hcd vhci_hcd.0: Device attached [ 1341.804414][T22232] Cannot find map_set index 2 as target [ 1342.040403][ T8665] usb 44-1: SetAddress Request (34) to port 0 [ 1342.042479][ T8665] usb 44-1: new SuperSpeed USB device number 34 using vhci_hcd [ 1342.060099][T19226] block nbd6: Receive control failed (result -32) [ 1342.136730][T22241] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 1342.179229][T22229] vhci_hcd: connection reset by peer [ 1342.186426][ T1200] vhci_hcd vhci_hcd.3: stop threads [ 1342.188769][ T1200] vhci_hcd vhci_hcd.3: release socket [ 1342.191129][ T1200] vhci_hcd vhci_hcd.3: disconnect device [ 1342.370117][T15022] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 1342.530119][T15022] usb 5-1: Using ep0 maxpacket: 8 [ 1342.534872][T15022] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1342.540033][T15022] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1342.543228][T15022] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1342.545411][T15022] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1342.548581][T15022] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1342.627909][T15022] usb 5-1: config 0 descriptor?? [ 1342.825170][T22246] blktrace: Concurrent blktraces are not allowed on nbd1 [ 1342.855883][T22246] rdma_rxe: rxe_newlink: failed to add wg2 [ 1342.939458][T22250] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4202'. [ 1343.227040][T22258] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4204'. [ 1343.253129][T22240] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1343.263183][T22240] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1343.274634][T22240] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1343.278899][T22240] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1343.296525][T15022] usbhid 5-1:0.0: can't add hid device: -71 [ 1343.299647][T15022] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1343.315518][T15022] usb 5-1: USB disconnect, device number 11 [ 1344.030759][T19226] block nbd7: Receive control failed (result -32) [ 1344.247103][T22275] fuse: Bad value for 'group_id' [ 1344.248976][T22275] fuse: Bad value for 'group_id' [ 1345.101270][T22288] netlink: 'syz.2.4212': attribute type 9 has an invalid length. [ 1345.105146][T22288] netlink: 'syz.2.4212': attribute type 7 has an invalid length. [ 1345.108180][T22288] netlink: 'syz.2.4212': attribute type 8 has an invalid length. [ 1345.273900][T22293] Cannot find map_set index 2 as target [ 1345.687520][T22303] netlink: 'syz.1.4217': attribute type 8 has an invalid length. [ 1346.485589][T22307] FAULT_INJECTION: forcing a failure. [ 1346.485589][T22307] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1346.490536][T22307] CPU: 2 UID: 0 PID: 22307 Comm: syz.0.4218 Tainted: G L syzkaller #0 PREEMPT(full) [ 1346.490556][T22307] Tainted: [L]=SOFTLOCKUP [ 1346.490560][T22307] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1346.490567][T22307] Call Trace: [ 1346.490573][T22307] [ 1346.490579][T22307] dump_stack_lvl+0x100/0x190 [ 1346.490601][T22307] should_fail_ex.cold+0x5/0xa [ 1346.490615][T22307] _copy_from_user+0x2e/0xd0 [ 1346.490631][T22307] vmci_host_unlocked_ioctl+0x15c/0x2070 [ 1346.490646][T22307] ? __pfx_vmci_host_unlocked_ioctl+0x10/0x10 [ 1346.490666][T22307] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1346.490680][T22307] ? do_vfs_ioctl+0x226/0x13e0 [ 1346.490697][T22307] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1346.490718][T22307] ? find_held_lock+0x2b/0x80 [ 1346.490729][T22307] ? hook_file_ioctl_common+0x146/0x410 [ 1346.490747][T22307] ? __fget_files+0x21f/0x3d0 [ 1346.490760][T22307] ? __pfx_vmci_host_unlocked_ioctl+0x10/0x10 [ 1346.490773][T22307] compat_ptr_ioctl+0x6e/0xa0 [ 1346.490789][T22307] ? __pfx_compat_ptr_ioctl+0x10/0x10 [ 1346.490806][T22307] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1346.490825][T22307] __do_fast_syscall_32+0xe3/0x8c0 [ 1346.490840][T22307] do_fast_syscall_32+0x32/0x70 [ 1346.490853][T22307] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1346.490868][T22307] RIP: 0023:0xf709ef6c [ 1346.490882][T22307] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1346.490896][T22307] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1346.490912][T22307] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000000007a0 [ 1346.490923][T22307] RDX: 0000000080000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 1346.490932][T22307] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1346.490942][T22307] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1346.490953][T22307] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1346.490976][T22307] [ 1346.848646][T22309] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4219'. [ 1347.098321][ T8665] usb 44-1: device descriptor read/8, error -110 [ 1347.299326][T22319] netlink: 'syz.3.4221': attribute type 8 has an invalid length. [ 1347.624540][T22335] netlink: 'syz.1.4229': attribute type 8 has an invalid length. [ 1347.896407][ T8665] usb usb44-port1: attempt power cycle [ 1348.199092][T22342] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4230'. [ 1348.405682][ T40] kauditd_printk_skb: 511 callbacks suppressed [ 1348.405697][ T40] audit: type=1326 audit(1775434096.283:70204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22313 comm="syz.3.4221" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fb3f88 code=0x7ffc0000 [ 1348.417820][ T40] audit: type=1326 audit(1775434096.283:70205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22313 comm="syz.3.4221" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fb3f88 code=0x7ffc0000 [ 1348.424759][ T40] audit: type=1326 audit(1775434096.283:70206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22313 comm="syz.3.4221" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fb3f88 code=0x7ffc0000 [ 1348.432853][ T40] audit: type=1326 audit(1775434096.283:70207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22313 comm="syz.3.4221" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fb3f88 code=0x7ffc0000 [ 1348.440731][ T40] audit: type=1326 audit(1775434096.283:70208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22313 comm="syz.3.4221" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fb3f88 code=0x7ffc0000 [ 1348.449019][ T40] audit: type=1326 audit(1775434096.283:70209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22313 comm="syz.3.4221" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fb3f88 code=0x7ffc0000 [ 1348.456136][ T40] audit: type=1326 audit(1775434096.283:70210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22313 comm="syz.3.4221" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fb3f88 code=0x7ffc0000 [ 1348.463750][ T40] audit: type=1326 audit(1775434096.283:70211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22313 comm="syz.3.4221" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fb3f88 code=0x7ffc0000 [ 1348.471126][ T40] audit: type=1326 audit(1775434096.283:70212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22313 comm="syz.3.4221" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fb3f88 code=0x7ffc0000 [ 1348.478657][ T40] audit: type=1326 audit(1775434096.283:70213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22313 comm="syz.3.4221" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fb3f88 code=0x7ffc0000 [ 1348.808223][T22352] FAULT_INJECTION: forcing a failure. [ 1348.808223][T22352] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1348.812841][T22352] CPU: 2 UID: 0 PID: 22352 Comm: syz.2.4234 Tainted: G L syzkaller #0 PREEMPT(full) [ 1348.812862][T22352] Tainted: [L]=SOFTLOCKUP [ 1348.812867][T22352] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1348.812874][T22352] Call Trace: [ 1348.812880][T22352] [ 1348.812885][T22352] dump_stack_lvl+0x100/0x190 [ 1348.812910][T22352] should_fail_ex.cold+0x5/0xa [ 1348.812925][T22352] _copy_to_user+0x32/0xd0 [ 1348.812943][T22352] simple_read_from_buffer+0xcb/0x170 [ 1348.812964][T22352] proc_fail_nth_read+0x1af/0x230 [ 1348.812995][T22352] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1348.813012][T22352] ? rw_verify_area+0xce/0x6d0 [ 1348.813031][T22352] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1348.813046][T22352] vfs_read+0x1e4/0xb30 [ 1348.813060][T22352] ? __pfx_vfs_read+0x10/0x10 [ 1348.813070][T22352] ? find_held_lock+0x2b/0x80 [ 1348.813083][T22352] ? __fget_files+0x215/0x3d0 [ 1348.813098][T22352] ? __fget_files+0x21f/0x3d0 [ 1348.813114][T22352] ksys_read+0x12a/0x250 [ 1348.813126][T22352] ? __pfx_ksys_read+0x10/0x10 [ 1348.813142][T22352] do_int80_emulation+0x141/0x6b0 [ 1348.813159][T22352] asm_int80_emulation+0x1a/0x20 [ 1348.813172][T22352] RIP: 0023:0xf7135cab [ 1348.813183][T22352] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1348.813195][T22352] RSP: 002b:00000000f53ed4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1348.813208][T22352] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53ed5d0 [ 1348.813216][T22352] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1348.813222][T22352] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1348.813229][T22352] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1348.813237][T22352] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1348.813252][T22352] [ 1348.927560][T22358] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4237'. [ 1348.936438][T22361] FAULT_INJECTION: forcing a failure. [ 1348.936438][T22361] name failslab, interval 1, probability 0, space 0, times 0 [ 1348.942011][T22361] CPU: 2 UID: 0 PID: 22361 Comm: syz.1.4238 Tainted: G L syzkaller #0 PREEMPT(full) [ 1348.942032][T22361] Tainted: [L]=SOFTLOCKUP [ 1348.942036][T22361] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1348.942044][T22361] Call Trace: [ 1348.942048][T22361] [ 1348.942054][T22361] dump_stack_lvl+0x100/0x190 [ 1348.942076][T22361] should_fail_ex.cold+0x5/0xa [ 1348.942090][T22361] should_failslab+0xc2/0x120 [ 1348.942104][T22361] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 1348.942122][T22361] ? alloc_vmap_area+0x640/0x2bd0 [ 1348.942148][T22361] alloc_vmap_area+0x640/0x2bd0 [ 1348.942168][T22361] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1348.942185][T22361] __get_vm_area_node+0x1ca/0x330 [ 1348.942201][T22361] __vmalloc_node_range_noprof+0x213/0x1530 [ 1348.942217][T22361] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 1348.942235][T22361] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 1348.942250][T22361] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 1348.942284][T22361] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 1348.942302][T22361] ? __lock_acquire+0x4a5/0x2630 [ 1348.942319][T22361] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1348.942335][T22361] ? __lock_acquire+0x4a5/0x2630 [ 1348.942354][T22361] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 1348.942371][T22361] __vmalloc_node_noprof+0xad/0xf0 [ 1348.942386][T22361] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 1348.942405][T22361] __vmalloc_noprof+0xa3/0x120 [ 1348.942419][T22361] ? __pfx___vmalloc_noprof+0x10/0x10 [ 1348.942433][T22361] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1348.942447][T22361] ? rcu_is_watching+0x12/0xc0 [ 1348.942465][T22361] ? apparmor_capable+0x1d7/0x4d0 [ 1348.942477][T22361] ? __kernel_text_address+0xd/0x30 [ 1348.942495][T22361] bpf_prog_alloc_no_stats+0x58/0x640 [ 1348.942512][T22361] ? security_capable+0x80/0x260 [ 1348.942524][T22361] bpf_prog_alloc+0x3b/0x200 [ 1348.942540][T22361] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1348.942553][T22361] bpf_prog_load+0x494/0x2c20 [ 1348.942566][T22361] ? _parse_integer_limit+0x17f/0x1d0 [ 1348.942587][T22361] ? __pfx_bpf_prog_load+0x10/0x10 [ 1348.942599][T22361] ? __lock_acquire+0x4a5/0x2630 [ 1348.942628][T22361] __sys_bpf+0x223a/0x4b90 [ 1348.942644][T22361] ? __pfx___sys_bpf+0x10/0x10 [ 1348.942657][T22361] ? proc_fail_nth_write+0x9f/0x220 [ 1348.942672][T22361] ? find_held_lock+0x2b/0x80 [ 1348.942690][T22361] ? find_held_lock+0x2b/0x80 [ 1348.942702][T22361] ? ksys_write+0x190/0x250 [ 1348.942715][T22361] ? __mutex_unlock_slowpath+0x15c/0x790 [ 1348.942737][T22361] ? fput+0x79/0x100 [ 1348.942751][T22361] ? ksys_write+0x1ac/0x250 [ 1348.942764][T22361] __ia32_sys_bpf+0x79/0xf0 [ 1348.942777][T22361] ? lockdep_hardirqs_on+0x78/0x100 [ 1348.942789][T22361] __do_fast_syscall_32+0xe3/0x8c0 [ 1348.942804][T22361] do_fast_syscall_32+0x32/0x70 [ 1348.942817][T22361] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1348.942832][T22361] RIP: 0023:0xf7f92f6c [ 1348.942842][T22361] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1348.942854][T22361] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1348.942866][T22361] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800054c0 [ 1348.942873][T22361] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 1348.942879][T22361] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1348.942886][T22361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1348.942893][T22361] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1348.942907][T22361] [ 1348.942940][T22361] syz.1.4238: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null) [ 1349.027343][ T8665] usb usb44-port1: unable to enumerate USB device [ 1349.028405][T22361] ,cpuset=/,mems_allowed=0-1 [ 1349.068361][T22361] CPU: 2 UID: 0 PID: 22361 Comm: syz.1.4238 Tainted: G L syzkaller #0 PREEMPT(full) [ 1349.068379][T22361] Tainted: [L]=SOFTLOCKUP [ 1349.068384][T22361] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1349.068392][T22361] Call Trace: [ 1349.068396][T22361] [ 1349.068401][T22361] dump_stack_lvl+0x100/0x190 [ 1349.068433][T22361] warn_alloc.cold+0x95/0x1c1 [ 1349.068455][T22361] ? __pfx_warn_alloc+0x10/0x10 [ 1349.068472][T22361] ? lockdep_hardirqs_on+0x78/0x100 [ 1349.068487][T22361] ? __get_vm_area_node+0x2c5/0x330 [ 1349.068504][T22361] ? __get_vm_area_node+0x208/0x330 [ 1349.068521][T22361] __vmalloc_node_range_noprof+0xbf4/0x1530 [ 1349.068537][T22361] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 1349.068552][T22361] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 1349.068567][T22361] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 1349.068586][T22361] ? __lock_acquire+0x4a5/0x2630 [ 1349.068604][T22361] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1349.068619][T22361] ? __lock_acquire+0x4a5/0x2630 [ 1349.068638][T22361] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 1349.068656][T22361] __vmalloc_node_noprof+0xad/0xf0 [ 1349.068671][T22361] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 1349.068693][T22361] __vmalloc_noprof+0xa3/0x120 [ 1349.068708][T22361] ? __pfx___vmalloc_noprof+0x10/0x10 [ 1349.068722][T22361] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1349.068736][T22361] ? rcu_is_watching+0x12/0xc0 [ 1349.068755][T22361] ? apparmor_capable+0x1d7/0x4d0 [ 1349.068767][T22361] ? __kernel_text_address+0xd/0x30 [ 1349.068786][T22361] bpf_prog_alloc_no_stats+0x58/0x640 [ 1349.068803][T22361] ? security_capable+0x80/0x260 [ 1349.068815][T22361] bpf_prog_alloc+0x3b/0x200 [ 1349.068831][T22361] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1349.068844][T22361] bpf_prog_load+0x494/0x2c20 [ 1349.068856][T22361] ? _parse_integer_limit+0x17f/0x1d0 [ 1349.068877][T22361] ? __pfx_bpf_prog_load+0x10/0x10 [ 1349.068889][T22361] ? __lock_acquire+0x4a5/0x2630 [ 1349.068918][T22361] __sys_bpf+0x223a/0x4b90 [ 1349.068934][T22361] ? __pfx___sys_bpf+0x10/0x10 [ 1349.068947][T22361] ? proc_fail_nth_write+0x9f/0x220 [ 1349.068962][T22361] ? find_held_lock+0x2b/0x80 [ 1349.068976][T22361] ? find_held_lock+0x2b/0x80 [ 1349.068987][T22361] ? ksys_write+0x190/0x250 [ 1349.069002][T22361] ? __mutex_unlock_slowpath+0x15c/0x790 [ 1349.069023][T22361] ? fput+0x79/0x100 [ 1349.069036][T22361] ? ksys_write+0x1ac/0x250 [ 1349.069049][T22361] __ia32_sys_bpf+0x79/0xf0 [ 1349.069063][T22361] ? lockdep_hardirqs_on+0x78/0x100 [ 1349.069074][T22361] __do_fast_syscall_32+0xe3/0x8c0 [ 1349.069089][T22361] do_fast_syscall_32+0x32/0x70 [ 1349.069103][T22361] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1349.069117][T22361] RIP: 0023:0xf7f92f6c [ 1349.069127][T22361] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1349.069138][T22361] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1349.069149][T22361] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800054c0 [ 1349.069156][T22361] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 1349.069163][T22361] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1349.069169][T22361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1349.069176][T22361] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1349.069190][T22361] [ 1349.069208][T22361] Mem-Info: [ 1349.181855][T22361] active_anon:6036 inactive_anon:2793 isolated_anon:0 [ 1349.181855][T22361] active_file:7281 inactive_file:18104 isolated_file:0 [ 1349.181855][T22361] unevictable:1768 dirty:423 writeback:0 [ 1349.181855][T22361] slab_reclaimable:6715 slab_unreclaimable:59928 [ 1349.181855][T22361] mapped:26232 shmem:3116 pagetables:1305 [ 1349.181855][T22361] sec_pagetables:322 bounce:0 [ 1349.181855][T22361] kernel_misc_reclaimable:0 [ 1349.181855][T22361] free:58315 free_pcp:13629 free_cma:0 [ 1349.196832][T22361] Node 0 active_anon:104kB inactive_anon:56kB active_file:2812kB inactive_file:0kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:20kB dirty:4kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7584kB pagetables:1228kB sec_pagetables:1108kB all_unreclaimable? yes Balloon:0kB [ 1349.207116][T22361] Node 1 active_anon:24040kB inactive_anon:11116kB active_file:26312kB inactive_file:72416kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:104908kB dirty:1688kB writeback:0kB shmem:8928kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5404kB pagetables:3992kB sec_pagetables:180kB all_unreclaimable? no Balloon:0kB [ 1349.217635][T22361] Node 0 DMA free:2584kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 1349.227272][T22361] lowmem_reserve[]: 0 285 285 285 285 [ 1349.229043][T22361] Node 0 DMA32 free:28552kB boost:14336kB min:27404kB low:30668kB high:33932kB reserved_highatomic:0KB free_highatomic:0KB active_anon:104kB inactive_anon:56kB active_file:2808kB inactive_file:0kB unevictable:3536kB writepending:4kB zspages:296kB present:1032196kB managed:292456kB mlocked:0kB bounce:0kB free_pcp:2684kB local_pcp:1276kB free_cma:0kB [ 1349.239674][T22361] lowmem_reserve[]: 0 0 0 0 0 [ 1349.241225][T22361] Node 1 DMA32 free:202124kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24040kB inactive_anon:11116kB active_file:26312kB inactive_file:72416kB unevictable:3536kB writepending:1688kB zspages:5184kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:51588kB local_pcp:14504kB free_cma:0kB [ 1349.252197][T22361] lowmem_reserve[]: 0 0 0 0 0 [ 1349.254044][T22361] Node 0 DMA: 156*4kB (UM) 13*8kB (UM) 2*16kB (UM) 3*32kB (U) 1*64kB (M) 1*128kB (M) 0*256kB 1*512kB (M) 1*1024kB (M) 0*2048kB 0*4096kB = 2584kB [ 1349.259698][T22361] Node 0 DMA32: 1176*4kB (UME) 447*8kB (UME) 147*16kB (UE) 194*32kB (UME) 67*64kB (UME) 24*128kB (UM) 9*256kB (UME) 2*512kB (UM) 1*1024kB (M) 0*2048kB 0*4096kB = 28552kB [ 1349.265026][T22361] Node 1 DMA32: 4469*4kB (UM) 3473*8kB (UM) 2605*16kB (UME) 119*32kB (UME) 21*64kB (UME) 59*128kB (UME) 89*256kB (UME) 49*512kB (UM) 43*1024kB (UM) 5*2048kB (UM) 0*4096kB = 202188kB [ 1349.266779][T22365] block nbd8: server does not support multiple connections per device. [ 1349.270922][T22361] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1349.275198][T22365] block nbd8: shutting down sockets [ 1349.277441][T22361] Node 0 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 1349.282797][T22361] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1349.286364][T22361] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 1349.289394][T22361] 29943 total pagecache pages [ 1349.290936][T22361] 1431 pages in swap cache [ 1349.292527][T22361] Free swap = 102884kB [ 1349.294284][T22361] Total swap = 124996kB [ 1349.296009][T22361] 524155 pages RAM [ 1349.297687][T22361] 0 pages HighMem/MovableOnly [ 1349.299747][T22361] 210148 pages reserved [ 1349.301254][T22361] 0 pages cma reserved [ 1349.680349][T22377] netlink: 'syz.3.4245': attribute type 2 has an invalid length. [ 1349.837117][T22381] binder: 22380:22381 ioctl c018620c 80000100 returned -1 [ 1349.907936][T22387] FAULT_INJECTION: forcing a failure. [ 1349.907936][T22387] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1349.912545][T22387] CPU: 2 UID: 0 PID: 22387 Comm: syz.3.4249 Tainted: G L syzkaller #0 PREEMPT(full) [ 1349.912566][T22387] Tainted: [L]=SOFTLOCKUP [ 1349.912570][T22387] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1349.912577][T22387] Call Trace: [ 1349.912583][T22387] [ 1349.912589][T22387] dump_stack_lvl+0x100/0x190 [ 1349.912612][T22387] should_fail_ex.cold+0x5/0xa [ 1349.912627][T22387] _copy_from_iter+0x1f4/0x1690 [ 1349.912650][T22387] ? __asan_memset+0x23/0x50 [ 1349.912668][T22387] ? __pfx__copy_from_iter+0x10/0x10 [ 1349.912683][T22387] ? __pfx___alloc_skb+0x10/0x10 [ 1349.912707][T22387] netlink_sendmsg+0x808/0xda0 [ 1349.912723][T22387] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1349.912737][T22387] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 1349.912752][T22387] ____sys_sendmsg+0x9e1/0xb70 [ 1349.912766][T22387] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1349.912780][T22387] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1349.912800][T22387] ___sys_sendmsg+0x190/0x1e0 [ 1349.912816][T22387] ? __pfx____sys_sendmsg+0x10/0x10 [ 1349.912847][T22387] __sys_sendmsg+0x170/0x220 [ 1349.912859][T22387] ? __pfx___sys_sendmsg+0x10/0x10 [ 1349.912874][T22387] ? __pfx_ksys_write+0x10/0x10 [ 1349.912889][T22387] __do_fast_syscall_32+0xe3/0x8c0 [ 1349.912904][T22387] do_fast_syscall_32+0x32/0x70 [ 1349.912918][T22387] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1349.912934][T22387] RIP: 0023:0xf7fb3f6c [ 1349.912944][T22387] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1349.912955][T22387] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1349.912967][T22387] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 1349.912975][T22387] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1349.912982][T22387] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1349.912988][T22387] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1349.912995][T22387] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1349.913009][T22387] [ 1349.984125][T22388] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1350.474722][T22406] lo: Caught tx_queue_len zero misconfig [ 1350.478700][T22406] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 1350.546687][T22406] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1350.548948][T22406] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1350.551661][T22406] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1350.615542][T22411] netlink: 830 bytes leftover after parsing attributes in process `syz.3.4257'. [ 1350.895677][T22422] misc userio: Can't change port type on an already running userio instance [ 1351.026058][T21935] usb 8-1: new high-speed USB device number 94 using dummy_hcd [ 1351.186650][T21935] usb 8-1: Using ep0 maxpacket: 16 [ 1351.194614][T19226] Bluetooth: hci4: Unknown advertising packet type: 0x3c [ 1351.194683][T19226] Bluetooth: hci4: adv larger than maximum supported [ 1351.201142][T21935] usb 8-1: unable to get BOS descriptor or descriptor too short [ 1351.201454][T19226] Bluetooth: hci4: Malformed LE Event: 0x0d [ 1351.205448][T21935] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 1351.213371][T21935] usb 8-1: can't read configurations, error -71 [ 1351.263931][T22438] netlink: 'syz.2.4267': attribute type 1 has an invalid length. [ 1351.269152][T22438] netlink: 224 bytes leftover after parsing attributes in process `syz.2.4267'. [ 1351.521538][T22446] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 1351.524194][T22446] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1351.527993][T22446] vhci_hcd vhci_hcd.0: Device attached [ 1351.533820][T22446] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4269'. [ 1351.540512][T22446] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4269'. [ 1351.544523][T22446] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4269'. [ 1351.548740][T22446] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4269'. [ 1351.553025][T22446] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4269'. [ 1351.561595][T22446] random: crng reseeded on system resumption [ 1351.745767][T22459] nfs4: Bad value for 'source' [ 1351.815756][ T8665] usb 38-1: SetAddress Request (43) to port 0 [ 1351.819067][ T8665] usb 38-1: new SuperSpeed USB device number 43 using vhci_hcd [ 1352.093819][T22470] FAULT_INJECTION: forcing a failure. [ 1352.093819][T22470] name failslab, interval 1, probability 0, space 0, times 0 [ 1352.099359][T22470] CPU: 3 UID: 0 PID: 22470 Comm: syz.3.4277 Tainted: G L syzkaller #0 PREEMPT(full) [ 1352.099390][T22470] Tainted: [L]=SOFTLOCKUP [ 1352.099396][T22470] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1352.099408][T22470] Call Trace: [ 1352.099416][T22470] [ 1352.099426][T22470] dump_stack_lvl+0x100/0x190 [ 1352.099459][T22470] should_fail_ex.cold+0x5/0xa [ 1352.099481][T22470] should_failslab+0xc2/0x120 [ 1352.099502][T22470] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 1352.099529][T22470] ? alloc_empty_file+0x55/0x1c0 [ 1352.099550][T22470] ? devpts_mntget+0x2fb/0x410 [ 1352.099579][T22470] alloc_empty_file+0x55/0x1c0 [ 1352.099603][T22470] dentry_open+0x46/0xd0 [ 1352.099626][T22470] ptm_open_peer+0x1c5/0x2d0 [ 1352.099652][T22470] ? __pfx_ptm_open_peer+0x10/0x10 [ 1352.099689][T22470] tty_ioctl+0xae6/0x1690 [ 1352.099719][T22470] ? __pfx_tty_ioctl+0x10/0x10 [ 1352.099746][T22470] ? do_vfs_ioctl+0x226/0x13e0 [ 1352.099773][T22470] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1352.099805][T22470] ? find_held_lock+0x2b/0x80 [ 1352.099823][T22470] ? hook_file_ioctl_common+0x146/0x410 [ 1352.099852][T22470] ? __fget_files+0x21f/0x3d0 [ 1352.099873][T22470] tty_compat_ioctl+0x87/0x420 [ 1352.099890][T22470] ? __pfx_tty_compat_ioctl+0x10/0x10 [ 1352.099906][T22470] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1352.099935][T22470] __do_fast_syscall_32+0xe3/0x8c0 [ 1352.099960][T22470] do_fast_syscall_32+0x32/0x70 [ 1352.099980][T22470] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1352.100002][T22470] RIP: 0023:0xf7fb3f6c [ 1352.100017][T22470] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1352.100034][T22470] RSP: 002b:00000000f545550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1352.100053][T22470] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000005441 [ 1352.100079][T22470] RDX: 0000000000004b6c RSI: 0000000000000000 RDI: 0000000000000000 [ 1352.100091][T22470] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1352.100102][T22470] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1352.100112][T22470] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1352.100136][T22470] [ 1352.186817][T22448] vhci_hcd: connection reset by peer [ 1352.192003][ T13] vhci_hcd vhci_hcd.0: stop threads [ 1352.193994][ T13] vhci_hcd vhci_hcd.0: release socket [ 1352.196008][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 1352.625279][T19226] Bluetooth: hci1: command 0x0c1a tx timeout [ 1352.625343][T18121] Bluetooth: hci5: command 0x0c1a tx timeout [ 1352.625389][ T62] Bluetooth: hci4: command 0x040f tx timeout [ 1352.679566][T22472] __nla_validate_parse: 5 callbacks suppressed [ 1352.679579][T22472] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4278'. [ 1352.684739][T22472] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4278'. [ 1352.777897][T22476] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 1352.889876][T22483] FAULT_INJECTION: forcing a failure. [ 1352.889876][T22483] name failslab, interval 1, probability 0, space 0, times 0 [ 1352.895277][T22483] CPU: 3 UID: 0 PID: 22483 Comm: syz.0.4283 Tainted: G L syzkaller #0 PREEMPT(full) [ 1352.895306][T22483] Tainted: [L]=SOFTLOCKUP [ 1352.895312][T22483] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1352.895323][T22483] Call Trace: [ 1352.895330][T22483] [ 1352.895337][T22483] dump_stack_lvl+0x100/0x190 [ 1352.895369][T22483] should_fail_ex.cold+0x5/0xa [ 1352.895391][T22483] should_failslab+0xc2/0x120 [ 1352.895412][T22483] __kmalloc_cache_noprof+0x7a/0x6f0 [ 1352.895435][T22483] ? binder_get_thread+0x201/0x850 [ 1352.895525][T22483] binder_get_thread+0x201/0x850 [ 1352.895546][T22483] ? __pfx_binder_ioctl+0x10/0x10 [ 1352.895565][T22483] binder_ioctl+0x26f/0x7610 [ 1352.895588][T22483] ? find_held_lock+0x2b/0x80 [ 1352.895605][T22483] ? tomoyo_path_number_perm+0x28f/0x580 [ 1352.895627][T22483] ? tomoyo_path_number_perm+0x28f/0x580 [ 1352.895671][T22483] ? tomoyo_path_number_perm+0x188/0x580 [ 1352.895695][T22483] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1352.895716][T22483] ? __pfx_binder_ioctl+0x10/0x10 [ 1352.895741][T22483] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1352.895760][T22483] ? do_vfs_ioctl+0x226/0x13e0 [ 1352.895788][T22483] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1352.895819][T22483] ? find_held_lock+0x2b/0x80 [ 1352.895835][T22483] ? hook_file_ioctl_common+0x146/0x410 [ 1352.895861][T22483] ? __fget_files+0x21f/0x3d0 [ 1352.895880][T22483] ? __pfx_binder_ioctl+0x10/0x10 [ 1352.895899][T22483] compat_ptr_ioctl+0x6e/0xa0 [ 1352.895923][T22483] ? __pfx_compat_ptr_ioctl+0x10/0x10 [ 1352.895946][T22483] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1352.895974][T22483] __do_fast_syscall_32+0xe3/0x8c0 [ 1352.895997][T22483] do_fast_syscall_32+0x32/0x70 [ 1352.896018][T22483] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1352.896040][T22483] RIP: 0023:0xf709ef6c [ 1352.896055][T22483] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1352.896071][T22483] RSP: 002b:00000000f546c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1352.896089][T22483] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000c0306201 [ 1352.896100][T22483] RDX: 0000000080000500 RSI: 0000000000000000 RDI: 0000000000000000 [ 1352.896110][T22483] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1352.896119][T22483] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1352.896130][T22483] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1352.896152][T22483] [ 1352.896200][T22483] binder: 22480:22483 ioctl c0306201 80000500 returned -12 [ 1353.050824][T22493] netlink: 'syz.3.4287': attribute type 1 has an invalid length. [ 1353.054054][T22493] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4287'. [ 1353.367600][T22507] comedi comedi3: rti800: I/O port conflict (0x3,16) [ 1354.195654][T22525] FAULT_INJECTION: forcing a failure. [ 1354.195654][T22525] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1354.200439][T22525] CPU: 1 UID: 0 PID: 22525 Comm: syz.3.4300 Tainted: G L syzkaller #0 PREEMPT(full) [ 1354.200460][T22525] Tainted: [L]=SOFTLOCKUP [ 1354.200464][T22525] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1354.200471][T22525] Call Trace: [ 1354.200477][T22525] [ 1354.200483][T22525] dump_stack_lvl+0x100/0x190 [ 1354.200505][T22525] should_fail_ex.cold+0x5/0xa [ 1354.200520][T22525] _copy_from_user+0x2e/0xd0 [ 1354.200537][T22525] video_usercopy+0x9e0/0x14d0 [ 1354.200551][T22525] ? __pfx___video_do_ioctl+0x10/0x10 [ 1354.200564][T22525] ? __pfx_video_usercopy+0x10/0x10 [ 1354.200580][T22525] ? hook_file_ioctl_common+0x146/0x410 [ 1354.200600][T22525] v4l2_ioctl+0x1bd/0x250 [ 1354.200615][T22525] v4l2_compat_ioctl32+0x20f/0x2d0 [ 1354.200632][T22525] ? __pfx_v4l2_compat_ioctl32+0x10/0x10 [ 1354.200650][T22525] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1354.200670][T22525] __do_fast_syscall_32+0xe3/0x8c0 [ 1354.200686][T22525] do_fast_syscall_32+0x32/0x70 [ 1354.200700][T22525] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1354.200715][T22525] RIP: 0023:0xf7fb3f6c [ 1354.200725][T22525] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1354.200737][T22525] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1354.200748][T22525] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c02c5638 [ 1354.200756][T22525] RDX: 0000000080000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 1354.200762][T22525] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1354.200769][T22525] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1354.200776][T22525] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1354.200790][T22525] [ 1354.305243][T22528] binder: BINDER_SET_CONTEXT_MGR already set [ 1354.307364][T22528] binder: 22527:22528 ioctl 4018620d 80000040 returned -16 [ 1354.316675][T22526] lo speed is unknown, defaulting to 1000 [ 1354.539386][T22539] netlink: 'syz.2.4303': attribute type 8 has an invalid length. [ 1355.259741][T22552] binder: 22550:22552 ioctl 80406409 80000240 returned -22 [ 1355.855166][T22561] lo speed is unknown, defaulting to 1000 [ 1355.890961][T22561] trusted_key: syz.1.4309 sent an empty control message without MSG_MORE. [ 1355.894895][T22561] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI [ 1355.899366][T22561] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 1355.902959][T22561] CPU: 0 UID: 0 PID: 22561 Comm: syz.1.4309 Tainted: G L syzkaller #0 PREEMPT(full) [ 1355.906675][T22561] Tainted: [L]=SOFTLOCKUP [ 1355.908146][T22561] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1355.911822][T22561] RIP: 0010:memcpy_sglist+0x3eb/0x760 [ 1355.913592][T22561] Code: e8 0a e8 4d fd 4d 85 ff 48 8b 14 24 0f 85 09 02 00 00 48 89 14 24 e8 14 ed 4d fd 48 8b 14 24 48 8d 7a 08 48 89 f8 48 c1 e8 03 <0f> b6 04 18 84 c0 74 08 3c 03 0f 8e 22 03 00 00 48 8d 7a 0c 44 8b [ 1355.920838][T22561] RSP: 0018:ffffc90002f2f820 EFLAGS: 00010202 [ 1355.923232][T22561] RAX: 0000000000000001 RBX: dffffc0000000000 RCX: ffffc9000c4f2000 [ 1355.926190][T22561] RDX: 0000000000000000 RSI: ffffffff84ba5bec RDI: 0000000000000008 [ 1355.928779][T22561] RBP: ffff888074f600a0 R08: 0000000000000005 R09: 0000000000000000 [ 1355.931582][T22561] R10: 0000000000000002 R11: 0000000000000000 R12: ffff888023aab600 [ 1355.934899][T22561] R13: 000000000000000b R14: 00000000000001f5 R15: 0000000000000002 [ 1355.937681][T22561] FS: 0000000000000000(0000) GS:ffff888097140000(0063) knlGS:00000000f5435b40 [ 1355.941071][T22561] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 1355.943216][T22561] CR2: 000000002f2e0000 CR3: 000000005f1fb000 CR4: 0000000000352ef0 [ 1355.946321][T22561] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1355.949448][T22561] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1355.952635][T22561] Call Trace: [ 1355.954043][T22561] [ 1355.955180][T22561] aead_recvmsg+0x60a/0x1180 [ 1355.956873][T22561] ? __pfx_aead_recvmsg+0x10/0x10 [ 1355.958568][T22561] ? iovec_from_user+0xda/0x140 [ 1355.960268][T22561] ____sys_recvmsg+0x5b3/0x640 [ 1355.961878][T22561] ? __pfx_aead_recvmsg+0x10/0x10 [ 1355.963656][T22561] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1355.965444][T22561] ? ___sys_recvmsg+0x177/0x1a0 [ 1355.967169][T22561] ? kfree+0x2ec/0x6b0 [ 1355.968584][T22561] ? futex_unqueue+0x13d/0x2c0 [ 1355.970446][T22561] ___sys_recvmsg+0x16a/0x1a0 [ 1355.972163][T22561] ? __pfx____sys_recvmsg+0x10/0x10 [ 1355.973897][T22561] ? find_held_lock+0x2b/0x80 [ 1355.975488][T22561] ? __pfx___might_resched+0x10/0x10 [ 1355.977229][T22561] do_recvmmsg+0x563/0x760 [ 1355.978739][T22561] ? __pfx_do_recvmmsg+0x10/0x10 [ 1355.980561][T22561] ? fput+0x79/0x100 [ 1355.982361][T22561] ? __sys_sendmsg+0x18f/0x220 [ 1355.984603][T22561] __sys_recvmmsg+0x21f/0x270 [ 1355.986694][T22561] ? __pfx___sys_recvmmsg+0x10/0x10 [ 1355.989465][T22561] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 1355.991934][T22561] ? __do_fast_syscall_32+0x94/0x8c0 [ 1355.993767][T22561] ? lockdep_hardirqs_on+0x78/0x100 [ 1355.995638][T22561] __do_fast_syscall_32+0xe3/0x8c0 [ 1355.997673][T22561] do_fast_syscall_32+0x32/0x70 [ 1355.999651][T22561] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1356.001763][T22561] RIP: 0023:0xf7f92f6c [ 1356.003163][T22561] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1356.010123][T22561] RSP: 002b:00000000f543550c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 1356.013087][T22561] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080001200 [ 1356.015631][T22561] RDX: 0000000000000002 RSI: 0000000000000060 RDI: 0000000000000000 [ 1356.018194][T22561] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1356.020828][T22561] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1356.023365][T22561] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1356.025884][T22561] [ 1356.027033][T22561] Modules linked in: [ 1356.029315][T22561] ---[ end trace 0000000000000000 ]--- [ 1356.031887][T22561] RIP: 0010:memcpy_sglist+0x3eb/0x760 [ 1356.033932][T22561] Code: e8 0a e8 4d fd 4d 85 ff 48 8b 14 24 0f 85 09 02 00 00 48 89 14 24 e8 14 ed 4d fd 48 8b 14 24 48 8d 7a 08 48 89 f8 48 c1 e8 03 <0f> b6 04 18 84 c0 74 08 3c 03 0f 8e 22 03 00 00 48 8d 7a 0c 44 8b [ 1356.041286][T22561] RSP: 0018:ffffc90002f2f820 EFLAGS: 00010202 [ 1356.043333][T22561] RAX: 0000000000000001 RBX: dffffc0000000000 RCX: ffffc9000c4f2000 [ 1356.045859][T22561] RDX: 0000000000000000 RSI: ffffffff84ba5bec RDI: 0000000000000008 [ 1356.048448][T22561] RBP: ffff888074f600a0 R08: 0000000000000005 R09: 0000000000000000 [ 1356.051744][T22561] R10: 0000000000000002 R11: 0000000000000000 R12: ffff888023aab600 [ 1356.054551][T22561] R13: 000000000000000b R14: 00000000000001f5 R15: 0000000000000002 [ 1356.057091][T22561] FS: 0000000000000000(0000) GS:ffff888097140000(0063) knlGS:00000000f5435b40 [ 1356.060004][T22561] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 1356.062240][T22561] CR2: 000000002f2e0000 CR3: 000000005f1fb000 CR4: 0000000000352ef0 [ 1356.065156][T22561] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1356.067795][T22561] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1356.071222][T22561] Kernel panic - not syncing: Fatal exception [ 1356.074750][T22561] Kernel Offset: disabled [ 1356.076176][T22561] Rebooting in 86400 seconds..