last executing test programs: 1m16.852223092s ago: executing program 0 (id=232): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) setresgid(0xee00, 0xee01, 0x0) setresgid(0xffffffffffffffff, 0xee00, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r0, 0x7a6, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x800000000003, 0x7, 0x4be}) 1m15.992729295s ago: executing program 0 (id=238): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100)='jffs2\x00', 0x0, 0x0) mount(0x0, &(0x7f0000001340)='./mnt\x00', 0x0, 0x800024, 0x0) faccessat2(0xffffffffffffff9c, 0x0, 0x5, 0x300) syz_open_dev$vim2m(&(0x7f0000000000), 0x3, 0x2) 1m15.992543043s ago: executing program 0 (id=239): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x3, 0x56a, 0x3f, 0x0, 0x0, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135) write$UHID_DESTROY(r0, &(0x7f0000000040), 0x4) (fail_nth: 5) 1m15.839679879s ago: executing program 0 (id=240): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_open_procfs(0x0, &(0x7f0000000680)='cmdline\x00') r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) fcntl$setstatus(r2, 0x4, 0x2800) ioctl$DRM_IOCTL_ADD_BUFS(r2, 0xc0186416, &(0x7f0000000080)={0x5, 0x6, 0x4, 0x2, 0x4, 0x7ff}) preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000040)=""/3, 0x3}, {0x0, 0x3}], 0x2, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RGETLOCK(r3, &(0x7f00000002c0)=ANY=[], 0x200002e6) fcntl$setpipe(r3, 0x407, 0x7000000) fcntl$setpipe(r3, 0x407, 0x100000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000a0000000000000010"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/sda\x00', 0x2, 0x0) ioctl$BLKDISCARD(r4, 0x1277, &(0x7f0000000000)=0x100000) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) openat$ppp(0xffffffffffffff9c, 0x0, 0x161042, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x7fc8, 0x1000, 0x40002, 0x393}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) syz_ublk_add_dev(0xffffffffffffffff, r5, r6, r7, &(0x7f0000000400)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x3, 0x603, 0x0, 0x0, 0x1000, 0xb6a7, 0x0, 0x0, 0x28}}}, &(0x7f0000000180)=0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) r10 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) syz_ublk_setup_queues(r10, r9, &(0x7f0000000480)={0x0, 0x18ee, 0x1000, 0x3, 0x1d2}, &(0x7f0000002680)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb656, 0x20, 0x2, 0x342, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x842d, 0x40, 0x2, 0x6a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb6d4, 0x10000, 0x1, 0x252}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xeaff, 0x8, 0x0, 0x231}}], 0x4, &(0x7f0000003900)={0x2e, 0x62, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x9}, 0x0, r8, '\x00', {0x2003, 0xb66, 0x0, 0x0}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)={0x14, 0x23, 0x409, 0x70bd25, 0x25dfd3ff, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x24040811}, 0x8410) syz_clone(0x280000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)) bind$alg(0xffffffffffffffff, 0x0, 0x0) 1m14.862557233s ago: executing program 0 (id=245): syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = syz_open_dev$loop(&(0x7f0000000080), 0x100d, 0xde8bef52389a5434) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000280)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x2000000000, 0x5, 0x0, 0x0, 0x12, 0x14, "996a78edc5cac93c3e473f65d9eb5297f0ca82d56dcddb164e29606b4f2cf0b60d9b92b3cf1597f6b7ff9c4fbf4326f66eccdbf05411d4a42e798491c54e3e6f", "3c54d63cef61aa187f941933694c882f4835e79819ddc15edb9ca42b19129e446327fbe58f617cc4617f5347a395cacecf34365db4d55dace1d4e9d56e6fa42e", "fd0000e7744b74eaa2317fdd9db2fea7e7d63f9a007866063c8c162b99d845fb", [0x61, 0x4]}}) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c06, 0x4) 1m14.150074191s ago: executing program 0 (id=249): sched_setattr(0x0, &(0x7f0000000280)={0x73, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa12, 0xffffffff}, 0x0) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$pmem0(0xffffffffffffff9c, &(0x7f0000002340), 0x80d01, 0x0) pwrite64(r1, &(0x7f0000000000)="a5", 0xfffffe8c, 0x2) ioctl$BLKRRPART(r1, 0x125f, 0x1f) mkdir(&(0x7f0000000080)='./cgroup/../file0\x00', 0x102) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040), 0x12) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) ioctl$KVM_SET_USER_MEMORY_REGION2(r0, 0x40a0ae49, &(0x7f0000000540)={0x0, 0x2, 0x4, 0x1000, &(0x7f00002d3000/0x1000)=nil, 0x100000, r0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$sock_int(r2, 0x1, 0x5, &(0x7f0000000000), 0x4) r3 = io_uring_setup(0x2e08, &(0x7f00000001c0)={0x0, 0xfffffffc, 0x0, 0xffffffff, 0x1}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000400)={'veth1_to_bond\x00', &(0x7f0000000340)=@ethtool_gstrings={0x1b, 0x6}}) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0xf5, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000030700000a90000000060a030400000000000000000a0000050900010073797a3100000000500004804c0001800b00010074f778617267657400003c000280240003007339f2f304fdd672bad09dfb040000000001000001f9580dabf95ddc91967c2008000240000000000c00010052415445455354000900020073797a3200000000140000001100010000000000000000000100000a3e934853bfd2f9c8a1eca2d212219a0d0e2c9ff015cae7d53065dd4be10075efa0be910bc4a3f190205a03e0d8ce64304ba3c3033efc1de69dbe93b6563ee93c6aa3e09d19049c769c243467ed9d58f3a20532"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x20008040) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) mount(0x0, 0x0, &(0x7f00000000c0)='gfs2\x00', 0x10, &(0x7f0000000100)='barrier') sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000300)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r5, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) 1m14.060921485s ago: executing program 32 (id=249): sched_setattr(0x0, &(0x7f0000000280)={0x73, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa12, 0xffffffff}, 0x0) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$pmem0(0xffffffffffffff9c, &(0x7f0000002340), 0x80d01, 0x0) pwrite64(r1, &(0x7f0000000000)="a5", 0xfffffe8c, 0x2) ioctl$BLKRRPART(r1, 0x125f, 0x1f) mkdir(&(0x7f0000000080)='./cgroup/../file0\x00', 0x102) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040), 0x12) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) ioctl$KVM_SET_USER_MEMORY_REGION2(r0, 0x40a0ae49, &(0x7f0000000540)={0x0, 0x2, 0x4, 0x1000, &(0x7f00002d3000/0x1000)=nil, 0x100000, r0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$sock_int(r2, 0x1, 0x5, &(0x7f0000000000), 0x4) r3 = io_uring_setup(0x2e08, &(0x7f00000001c0)={0x0, 0xfffffffc, 0x0, 0xffffffff, 0x1}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000400)={'veth1_to_bond\x00', &(0x7f0000000340)=@ethtool_gstrings={0x1b, 0x6}}) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0xf5, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000030700000a90000000060a030400000000000000000a0000050900010073797a3100000000500004804c0001800b00010074f778617267657400003c000280240003007339f2f304fdd672bad09dfb040000000001000001f9580dabf95ddc91967c2008000240000000000c00010052415445455354000900020073797a3200000000140000001100010000000000000000000100000a3e934853bfd2f9c8a1eca2d212219a0d0e2c9ff015cae7d53065dd4be10075efa0be910bc4a3f190205a03e0d8ce64304ba3c3033efc1de69dbe93b6563ee93c6aa3e09d19049c769c243467ed9d58f3a20532"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x20008040) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) mount(0x0, 0x0, &(0x7f00000000c0)='gfs2\x00', 0x10, &(0x7f0000000100)='barrier') sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000300)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r5, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) 1m2.563949847s ago: executing program 3 (id=314): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'bond_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@TCA_INGRESS_BLOCK={0x8}]}, 0x2c}}, 0x4c840) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newtfilter={0x4c, 0x2c, 0xf3f, 0x30bd29, 0x25ffdbfd, {0x0, 0x0, 0x0, r2, {0xffff, 0xf}, {0x0, 0xfff3}, {0x2, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_VLAN_ID={0x6, 0x17, 0xb8a}, @TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x88a8}, @TCA_FLOWER_KEY_VLAN_PRIO={0x5, 0x18, 0x4}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@getchain={0x2c, 0x11, 0x839, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4, 0xc}, {0x9}, {0xa, 0x1c}}, [{0x8}]}, 0xfffffffffffffff6}, 0x1, 0x0, 0x0, 0x4040091}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e09030001000102000109022700010100c0320904000003ffffff00070581034000010705020240"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x1, 0x0) write(r3, &(0x7f0000000100)="3c5c0f2397b4d84500b5f812365f00000000000000", 0xff40) socket$key(0xf, 0x3, 0x2) gettid() r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x8000) read(r4, &(0x7f0000000000)=""/219, 0xdb) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000180)={0x335, @time={0x101, 0x1}, 0x1b, {}, 0x2, 0x0, 0x6}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r4, 0xc0bc5351, &(0x7f0000000300)={0x9, 0x2, 'client1\x00', 0x80000000, "f3768b5f9445c33a", "345dbbfb091846825ff4166f705930ad5b6e5d46f78448033995dd722337c7e6", 0x10000009, 0x3}) 59.402073365s ago: executing program 3 (id=326): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000280), 0x4841, 0x0) write$dsp(r2, &(0x7f00000001c0), 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1f, 0x0, 0x0, 0x1000, 0x0, 0x1}, 0x50) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x28011, r3, 0x0) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_opts(r4, 0x0, 0xf, &(0x7f0000000000)='\x00', 0x1) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSLCKTRMIOS(r6, 0x80047456, &(0x7f00000010c0)) sendmsg$nl_route(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x40008c3}, 0x0) read$eventfd(r1, 0x0, 0x0) r7 = fsopen(&(0x7f0000000040)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000080)='size\x00', &(0x7f00000000c0)='10M\x00', 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x3, 0xfa}, 0x2) syz_emit_ethernet(0x3f, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd606410a600090000fc020000000000000000000000000000fe8000000000000000000000000000aa223427d5c9a46b9fa1c9cf2f5f915681a5fe46ad18fb92971aae2bceda909b307387e1bbaa219ab10ab946195f8c415d0013036308f59468365489d6b319cbbceabffebda84e413be43e767f3ea76595783ed9371053fc2730419d1a5e865687aba8b44d3da1790dfe6defe75719dce04fbd09aacdf97d9e9b5f1933ee6c3ea0de5abd4a992cd46aea7555d552a16dfe4a6409d6544767e15e423d35d8b5"], 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f00000000c0)="0f20c06635000000400f22c00f01cfb800008ee0bad004b80b00ef660f70420000baf80c66b8502c238166efbafc0c66b80000000066efba610066b8510000000f01cb66b9800000c00f32c0b89257870f30f2a5660f38814b01", 0x5a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) 58.235301099s ago: executing program 3 (id=334): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x8000) read(r0, &(0x7f0000000000)=""/219, 0xdb) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000180)={0x335, @time={0x101, 0x1}, 0x1b, {}, 0x2, 0x0, 0x6}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f0000000300)={0x9, 0x2, 'client1\x00', 0x80000000, "f3768b5f9445c33a", "345dbbfb091846825ff4166f705930ad5b6e5d46f78448033995dd722337c7e6", 0x10000009, 0x3}) 57.292214249s ago: executing program 3 (id=338): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_open_procfs(0x0, &(0x7f0000000680)='cmdline\x00') r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) fcntl$setstatus(r2, 0x4, 0x2800) ioctl$DRM_IOCTL_ADD_BUFS(r2, 0xc0186416, &(0x7f0000000080)={0x5, 0x6, 0x4, 0x2, 0x4, 0x7ff}) preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000040)=""/3, 0x3}, {0x0, 0x3}], 0x2, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RGETLOCK(r3, &(0x7f00000002c0)=ANY=[], 0x200002e6) fcntl$setpipe(r3, 0x407, 0x7000000) fcntl$setpipe(r3, 0x407, 0x100000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000a0000000000000010"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/sda\x00', 0x2, 0x0) ioctl$BLKDISCARD(r4, 0x1277, &(0x7f0000000000)=0x100000) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) openat$ppp(0xffffffffffffff9c, 0x0, 0x161042, 0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x3, 0x603, 0x0, 0x0, 0x1000, 0xb6a7, 0x0, 0x0, 0x28}}}, &(0x7f0000000180)=0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) syz_ublk_setup_queues(r7, r6, &(0x7f0000000480)={0x0, 0x18ee, 0x1000, 0x3, 0x1d2}, &(0x7f0000002680)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb656, 0x20, 0x2, 0x342, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x842d, 0x40, 0x2, 0x6a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb6d4, 0x10000, 0x1, 0x252}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xeaff, 0x8, 0x0, 0x231}}], 0x4, &(0x7f0000003900)={0x2e, 0x62, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x9}, 0x0, r5, '\x00', {0x2003, 0xb66, 0x0, 0x0}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)={0x14, 0x23, 0x409, 0x70bd25, 0x25dfd3ff, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x24040811}, 0x8410) syz_clone(0x280000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)) bind$alg(0xffffffffffffffff, 0x0, 0x0) 56.252673838s ago: executing program 3 (id=345): ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000540)={0x2, 0x2, 0x1000, 0x5}) r0 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'dh\x00', 0x10, 0x5, 0x2d}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'none\x00', 0x3a, 0x5, 0x54}, 0x2c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYRES16=r3, @ANYRES8=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) r6 = open_tree(0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00', 0xc101) r7 = syz_open_procfs(0x0, &(0x7f0000000040)) name_to_handle_at(r7, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)=@FILEID_BTRFS_WITH_PARENT_ROOT={0x28, 0x4e, {0x1, 0x5, 0x9, 0xc3e9, 0x8, 0xffff}}, &(0x7f0000000100), 0x600) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r8, &(0x7f0000000040)=0x8000000001cb, 0x12) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0x98, 0x0, 0x0, 0x70bd2d, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0xe, 0xa, 'syzkaller\x00'}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x120}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r8}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x98}, 0x1, 0x0, 0x0, 0x20008040}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 55.211268341s ago: executing program 3 (id=350): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r2 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r0, r1, 0x5, 0x0, @void}, 0x10) close(r2) 54.692770706s ago: executing program 33 (id=350): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r2 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r0, r1, 0x5, 0x0, @void}, 0x10) close(r2) 13.442227889s ago: executing program 1 (id=595): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'sit0\x00', 0x0}) sendto$packet(r0, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) r2 = fsopen(&(0x7f0000000020)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f00000000c0)='xprtsec\x00', &(0x7f00000000e0)='tls\x00', 0x0) syz_clone(0x2280700, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='rdma.current\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r3, 0x0) mbind(&(0x7f0000283000/0x4000)=nil, 0x4000, 0x1, 0x0, 0x7, 0x0) mlock2(&(0x7f0000834000/0x4000)=nil, 0x4000, 0x0) mbind(&(0x7f00000bd000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x0, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3401) ioctl$USBDEVFS_RESETEP(r4, 0x80045503, &(0x7f0000000080)={0x1, 0x1}) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x420082, 0x80, 0x3f}, 0x18) r5 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) fsopen(&(0x7f0000000020)='nfs\x00', 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r8, @ANYBLOB="01000000000000001c0012000c000100626f6e640000"], 0x3c}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="15000000", @ANYRES32=0x0, @ANYRESHEX=r8, @ANYRES32=r8, @ANYRES64], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@newlink={0x280, 0x10, 0x439, 0x0, 0x60000, {0x0, 0x0, 0x0, 0x0, 0x2d800}, [@IFLA_VFINFO_LIST={0x260, 0x16, 0x0, 0x1, [{0x94, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN_LIST={0x68, 0xc, 0x0, 0x1, [{0x14, 0x1, {0xa, 0xb4d, 0x5, 0x88a8}}, {0x14, 0x1, {0xfffff338, 0x20d, 0x8, 0x8100}}, {0x14, 0x1, {0x5, 0x86e, 0x10001, 0x8100}}, {0x14, 0x1, {0x85, 0x4f, 0x5, 0x8100}}, {0x14, 0x1, {0xfe, 0x2e3, 0x0, 0x8100}}]}, @IFLA_VF_MAC={0x28, 0x1, {0x800, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}}}]}, {0x70, 0x1, 0x0, 0x1, [@IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x2d, 0x631}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x6, 0x9}}, @IFLA_VF_VLAN_LIST={0x2c, 0xc, 0x0, 0x1, [{0x14, 0x1, {0x1, 0x22c, 0x0, 0x8100}}, {0x14, 0x1, {0x40, 0xfd3, 0x8, 0x8100}}]}, @IFLA_VF_IB_PORT_GUID={0x10, 0xb, {0xffffffff}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0xfffffff1, 0xffff66aa}}, @IFLA_VF_TRUST={0xc, 0x9, {0x1, 0xbee}}]}, {0x48, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0x80009, @multicast}}, @IFLA_VF_IB_NODE_GUID={0x10, 0xa, {0x80, 0x1}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x1, 0x3}}]}, {0x80, 0x1, 0x0, 0x1, [@IFLA_VF_TX_RATE={0xc, 0x3, {0x800, 0x2}}, @IFLA_VF_RATE={0x10, 0x6, {0x840d, 0x100, 0xfffffba9}}, @IFLA_VF_VLAN={0x10, 0x2, {0xa5, 0xd27, 0x4}}, @IFLA_VF_IB_NODE_GUID={0x10, 0xa, {0x9, 0x3}}, @IFLA_VF_TX_RATE={0xc, 0x3, {0x13aa71bb, 0x4}}, @IFLA_VF_TX_RATE={0xc, 0x3, {0x5, 0x8}}, @IFLA_VF_MAC={0x28, 0x1, {0x6, @multicast}}]}, {0x20, 0x1, 0x0, 0x1, [@IFLA_VF_TX_RATE={0xc, 0x3, {0x4, 0x6}}, @IFLA_VF_IB_NODE_GUID={0x10, 0xa, {0x3ff, 0x7}}]}, {0x14, 0x1, 0x0, 0x1, [@IFLA_VF_RATE={0x10, 0x6, {0x100, 0x7f, 0xffffff7f}}]}, {0x5c, 0x1, 0x0, 0x1, [@IFLA_VF_IB_NODE_GUID={0x10, 0xa, {0x2, 0xef7}}, @IFLA_VF_IB_PORT_GUID={0xe, 0xb, {0x12, 0x3}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x400, 0x8000}}, @IFLA_VF_RATE={0x10, 0x6, {0x1, 0x6, 0x8ae}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x9, 0xfffffffb}}, @IFLA_VF_IB_PORT_GUID={0x10, 0xb, {0x7, 0x6}}]}]}]}, 0x280}, 0x1, 0x0, 0x0, 0x80}, 0x8000000) 13.263951763s ago: executing program 1 (id=596): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x2002) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={0xffffffffffffffff, 0x7e, 0x10}, 0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r2, 0x58, &(0x7f0000000100)}, 0x10) readv(r1, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000380)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) 11.915936448s ago: executing program 1 (id=603): fsopen(0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_rdma(0x10, 0x3, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000028c0)=@newtaction={0x5c, 0x30, 0x1, 0x0, 0x0, {}, [{0x48, 0x1, [@m_police={0x44, 0x5, 0x0, 0x0, {{0xb}, {0x4}, {0x15, 0x6, "eae6c922b6946eee1061554dd95f3daa5c"}, {0xc, 0x7, {0x1, 0x76d724fbc13eae7d}}, {0xc, 0x8, {0x2}}}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_ZCRX_CTRL(0xffffffffffffffff, 0x24, &(0x7f0000000300)={0xcdb2, 0x0, '\x00', @zc_export={r0}}, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) ioctl$XFS_IOC_FSGROWFSLOG(r3, 0x4008586f, &(0x7f0000000180)={0xff, 0x1}) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f0000002840)='./file0\x00', &(0x7f0000002880), 0x700, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) ioperm(0x8, 0x9, 0x5a) gettid() r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f00000000c0)={'pcl711\x00', [0x100, 0x80000000, 0x2, 0x10, 0xe, 0x5, 0x79, 0xfffffff8, 0x80008, 0x0, 0x7, 0x1, 0x7, 0x2, 0x0, 0xfd, 0xfffffffb, 0x9, 0x100003, 0x7fffffff, 0x489, 0x7, 0xfffffffd, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x8, 0x6, 0xffffffff, 0xfffffff8]}) ioctl$COMEDI_BUFCONFIG(r4, 0x8020640d, &(0x7f0000000000)={0x7f, 0x8, 0x0, 0x2}) fchownat(0xffffffffffffff9c, 0x0, 0xee01, 0xee01, 0x1000) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) 10.597532392s ago: executing program 1 (id=610): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_open_procfs(0x0, &(0x7f0000000680)='cmdline\x00') r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) fcntl$setstatus(r2, 0x4, 0x2800) ioctl$DRM_IOCTL_ADD_BUFS(r2, 0xc0186416, &(0x7f0000000080)={0x5, 0x6, 0x4, 0x2, 0x4, 0x7ff}) preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000040)=""/3, 0x3}, {0x0, 0x3}], 0x2, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RGETLOCK(r3, &(0x7f00000002c0)=ANY=[], 0x200002e6) fcntl$setpipe(r3, 0x407, 0x7000000) fcntl$setpipe(r3, 0x407, 0x100000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/sda\x00', 0x2, 0x0) ioctl$BLKDISCARD(r4, 0x1277, &(0x7f0000000000)=0x100000) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) openat$ppp(0xffffffffffffff9c, 0x0, 0x161042, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x7fc8, 0x1000, 0x40002, 0x393}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) syz_ublk_add_dev(0xffffffffffffffff, r5, r6, r7, &(0x7f0000000400)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x3, 0x603, 0x0, 0x0, 0x1000, 0xb6a7, 0x0, 0x0, 0x28}}}, &(0x7f0000000180)=0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) r10 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) syz_ublk_setup_queues(r10, r9, &(0x7f0000000480)={0x0, 0x18ee, 0x1000, 0x3, 0x1d2}, &(0x7f0000002680)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb656, 0x20, 0x2, 0x342, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x842d, 0x40, 0x2, 0x6a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb6d4, 0x10000, 0x1, 0x252}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xeaff, 0x8, 0x0, 0x231}}], 0x4, &(0x7f0000003900)={0x2e, 0x62, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x9}, 0x0, r8, '\x00', {0x2003, 0xb66, 0x0, 0x0}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)={0x14, 0x23, 0x409, 0x70bd25, 0x25dfd3ff, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x24040811}, 0x8410) syz_clone(0x280000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)) bind$alg(0xffffffffffffffff, 0x0, 0x0) 9.321197112s ago: executing program 1 (id=615): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000440)=0x4) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040301, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0xc0684113, &(0x7f0000000080)={0x1, 0xfffff800, 0x3, 0x77fffdff, 0x1f, 0xb1d, 0x8001, 0xe, 0x78, 0x3c, 0x4, 0x2}) 8.772362779s ago: executing program 1 (id=622): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000280), 0x4841, 0x0) write$dsp(r2, &(0x7f00000001c0), 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1f, 0x0, 0x0, 0x1000, 0x0, 0x1}, 0x50) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x28011, r3, 0x0) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_opts(r4, 0x0, 0xf, &(0x7f0000000000)='\x00', 0x1) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSLCKTRMIOS(r6, 0x80047456, &(0x7f00000010c0)) sendmsg$nl_route(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x40008c3}, 0x0) read$eventfd(r1, &(0x7f0000000040), 0xffffffffffffffd6) r7 = fsopen(&(0x7f0000000040)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000080)='size\x00', &(0x7f00000000c0)='10M\x00', 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x3, 0xfa}, 0x2) syz_emit_ethernet(0x3f, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f00000000c0)="0f20c06635000000400f22c00f01cfb800008ee0bad004b80b00ef660f70420000baf80c66b8502c238166efbafc0c66b80000000066efba610066b8510000000f01cb66b9800000c00f32c0b89257870f30f2a5660f38814b01", 0x5a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) 8.733089321s ago: executing program 34 (id=622): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000280), 0x4841, 0x0) write$dsp(r2, &(0x7f00000001c0), 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1f, 0x0, 0x0, 0x1000, 0x0, 0x1}, 0x50) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x28011, r3, 0x0) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_opts(r4, 0x0, 0xf, &(0x7f0000000000)='\x00', 0x1) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSLCKTRMIOS(r6, 0x80047456, &(0x7f00000010c0)) sendmsg$nl_route(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x40008c3}, 0x0) read$eventfd(r1, &(0x7f0000000040), 0xffffffffffffffd6) r7 = fsopen(&(0x7f0000000040)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000080)='size\x00', &(0x7f00000000c0)='10M\x00', 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x3, 0xfa}, 0x2) syz_emit_ethernet(0x3f, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f00000000c0)="0f20c06635000000400f22c00f01cfb800008ee0bad004b80b00ef660f70420000baf80c66b8502c238166efbafc0c66b80000000066efba610066b8510000000f01cb66b9800000c00f32c0b89257870f30f2a5660f38814b01", 0x5a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) 5.412567467s ago: executing program 6 (id=636): openat$cdrom(0xffffffffffffff9c, 0x0, 0x101000, 0x0) 5.401946085s ago: executing program 6 (id=637): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_open_procfs(0x0, &(0x7f0000000680)='cmdline\x00') r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) fcntl$setstatus(r2, 0x4, 0x2800) ioctl$DRM_IOCTL_ADD_BUFS(r2, 0xc0186416, &(0x7f0000000080)={0x5, 0x6, 0x4, 0x2, 0x4, 0x7ff}) preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000040)=""/3, 0x3}, {0x0, 0x3}], 0x2, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RGETLOCK(r3, &(0x7f00000002c0)=ANY=[], 0x200002e6) fcntl$setpipe(r3, 0x407, 0x7000000) fcntl$setpipe(r3, 0x407, 0x100000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/sda\x00', 0x2, 0x0) ioctl$BLKDISCARD(r4, 0x1277, &(0x7f0000000000)=0x100000) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) openat$ppp(0xffffffffffffff9c, 0x0, 0x161042, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x7fc8, 0x1000, 0x40002, 0x393}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) syz_ublk_add_dev(0xffffffffffffffff, r5, r6, r7, &(0x7f0000000400)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x3, 0x603, 0x0, 0x0, 0x1000, 0xb6a7, 0x0, 0x0, 0x28}}}, &(0x7f0000000180)=0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) r10 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) syz_ublk_setup_queues(r10, r9, &(0x7f0000000480)={0x0, 0x18ee, 0x1000, 0x3, 0x1d2}, &(0x7f0000002680)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb656, 0x20, 0x2, 0x342, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x842d, 0x40, 0x2, 0x6a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb6d4, 0x10000, 0x1, 0x252}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xeaff, 0x8, 0x0, 0x231}}], 0x4, &(0x7f0000003900)={0x2e, 0x62, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x9}, 0x0, r8, '\x00', {0x2003, 0xb66, 0x0, 0x0}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)={0x14, 0x23, 0x409, 0x70bd25, 0x25dfd3ff, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x24040811}, 0x8410) syz_clone(0x280000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)) bind$alg(0xffffffffffffffff, 0x0, 0x0) 4.330742184s ago: executing program 5 (id=644): r0 = fsopen(&(0x7f0000000140)='pipefs\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r1) syz_open_dev$radio(&(0x7f0000000040), 0x3, 0x2) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x1810040, &(0x7f0000000500)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 4.281440145s ago: executing program 5 (id=646): sched_setattr(0x0, &(0x7f0000000280)={0x73, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa12, 0xffffffff}, 0x0) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$pmem0(0xffffffffffffff9c, &(0x7f0000002340), 0x80d01, 0x0) pwrite64(r1, &(0x7f0000000000)="a5", 0xfffffe8c, 0x2) ioctl$BLKRRPART(r1, 0x125f, 0x1f) mkdir(&(0x7f0000000080)='./cgroup/../file0\x00', 0x102) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) ioctl$KVM_SET_USER_MEMORY_REGION2(r0, 0x40a0ae49, &(0x7f0000000540)={0x0, 0x2, 0x4, 0x1000, &(0x7f00002d3000/0x1000)=nil, 0x100000, r0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$sock_int(r2, 0x1, 0x5, &(0x7f0000000000), 0x4) r3 = io_uring_setup(0x2e08, &(0x7f00000001c0)={0x0, 0xfffffffc, 0x0, 0xffffffff, 0x1}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000400)={'veth1_to_bond\x00', &(0x7f0000000340)=@ethtool_gstrings={0x1b, 0x6}}) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0xf5, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000030700000a90000000060a030400000000000000000a0000050900010073797a3100000000500004804c0001800b00010074f778617267657400003c000280240003007339f2f304fdd672bad09dfb040000000001000001f9580dabf95ddc91967c2008000240000000000c00010052415445455354000900020073797a3200000000140000001100010000000000000000000100000a3e934853bfd2f9c8a1eca2d212219a0d0e2c9ff015cae7d53065dd4be10075efa0be910bc4a3f190205a03e0d8ce64304ba3c3033efc1de69dbe93b6563ee93c6aa3e09d19049c769c243467ed9d58f3a20532"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x20008040) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8937, &(0x7f0000000300)={'batadv0\x00', @broadcast}) mount(0x0, 0x0, &(0x7f00000000c0)='gfs2\x00', 0x10, &(0x7f0000000100)='barrier') sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000300)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r5, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) 3.896009024s ago: executing program 5 (id=647): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0x80200, 0x0) r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001880)=@newtfilter={0x894, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x860, 0x2, [@TCA_U32_POLICE={0x848, 0x6, [@TCA_POLICE_RATE={0x404, 0x2, [0x80000, 0x3, 0xf, 0xfdb, 0x1, 0x80, 0x7, 0x7, 0x40000000, 0xaa04, 0x80000001, 0x99, 0x8000, 0x1000, 0x3, 0x0, 0x7fffffff, 0x80, 0x1, 0x4, 0x0, 0x9, 0x4, 0x5, 0x80000001, 0x2, 0xe0, 0x9, 0x1, 0x80000000, 0x1, 0xffff8001, 0x9, 0x10001, 0x7, 0x10000, 0x30, 0x803, 0x1000, 0xfff, 0x7, 0x2, 0x5, 0x48a, 0x9, 0x1000, 0x7, 0x7198, 0x8, 0x80000001, 0x1, 0x101, 0x3, 0x7, 0x2, 0x1, 0x10001, 0x2, 0x1, 0x2, 0x6, 0x9, 0x13, 0x2, 0xffff, 0x80, 0xbf77, 0x8, 0xc52, 0x6, 0x9, 0x7, 0x9, 0x5, 0x8, 0x3, 0x8, 0x5, 0x8, 0x1, 0x3, 0x7fffffff, 0x8, 0x2845, 0x2, 0xe9, 0x2a, 0x3, 0x891, 0x7, 0x1, 0x12, 0x6, 0xfff, 0xffffc9b5, 0x4, 0x2, 0x6, 0x6, 0xaa, 0xffffffff, 0x8, 0x0, 0x0, 0x5, 0x1, 0x2, 0x40, 0x4, 0x7, 0xa, 0x8000, 0x4, 0xffffff2d, 0x0, 0xffff7fff, 0x2, 0x3, 0x6, 0xebb, 0x8, 0xfcb, 0x8, 0x1, 0x9, 0x6fe68a84, 0x200, 0x1, 0xfffffff9, 0xb, 0x1, 0xab, 0x9, 0x7, 0x0, 0x80e, 0x10001, 0x8, 0xa, 0x6, 0xe, 0xa1, 0x4, 0xffff519d, 0x9, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, 0x4ae, 0x8, 0x1e9, 0x9, 0x101, 0x200, 0x4, 0x4, 0x1, 0x5, 0x5, 0x7, 0x5, 0x0, 0x7, 0x80, 0x2, 0x2, 0x1, 0x5, 0x101, 0x7, 0x4, 0x9, 0x7e32, 0x8800, 0x4, 0xf85f, 0x10000, 0x800, 0xffffffff, 0x7, 0x4af, 0x7e21, 0x1, 0x5027, 0x8, 0x6, 0x4, 0x3, 0x7, 0x680, 0xc1, 0x2, 0x7, 0x8, 0x401, 0x74db, 0x400000, 0x401, 0x92c, 0xffff32d2, 0x4, 0xafcf, 0x7f, 0x5, 0xffff0000, 0x0, 0x8, 0x200, 0x4a, 0x4000, 0x0, 0x9, 0x10000, 0x4d4fbb35, 0xb2, 0x4, 0x5, 0x0, 0x100, 0x8001, 0x6, 0xfffffff8, 0x9, 0x2, 0x7f, 0x2, 0xc, 0xa, 0x94, 0x3b0, 0x401, 0x118966c9, 0xe56, 0x8, 0x4, 0x1800000, 0x6a, 0x9d6, 0x200, 0x2, 0x40, 0x7, 0x8000, 0x7e, 0x4, 0x5, 0x7, 0x4, 0x3, 0x400, 0xe, 0x4, 0x5]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x1, 0x1, 0x53e5, 0x7f, 0x4, 0x3000000, 0x0, 0xf0000000, 0x3, 0xfff, 0xe, 0x7, 0xf6, 0x1ff, 0x3, 0x800001, 0xfffffffb, 0x8001, 0xff, 0x0, 0xfff, 0x82, 0x1, 0x5, 0xffff, 0x6, 0x1, 0x7, 0x9, 0x10000, 0x0, 0x5, 0xe184, 0x4, 0x1, 0xadd, 0x1, 0x16, 0x4, 0xa35c, 0xc, 0x80, 0xff, 0x6, 0x2, 0xd, 0x4, 0x4003, 0x5, 0x4, 0x401, 0x4, 0x4, 0x1, 0x3, 0x8, 0xfffffffc, 0x3, 0xc1, 0x0, 0xffff, 0x80, 0xfffffff1, 0x7ff, 0x9, 0xfffffffe, 0x2, 0x6, 0x80, 0x200, 0x1000, 0xb11a, 0x0, 0x5, 0x8, 0xf499, 0x5, 0x3361, 0x435, 0x7fffffff, 0x2, 0x806, 0xc4, 0x9, 0x0, 0xee2, 0x2, 0x401, 0xfffffffa, 0x8000, 0x2, 0x0, 0x5, 0x5dd3c81c, 0xffffffff, 0x7, 0x3, 0x81, 0x9, 0x5, 0xfffffffc, 0x2, 0x1, 0x8, 0x6, 0x0, 0x6, 0xc, 0x8, 0x6, 0x100, 0x1, 0xb5a, 0xa, 0x4, 0x18, 0x8, 0x31, 0x1ff, 0x4, 0x9, 0x400, 0x2, 0x6, 0x7, 0x9, 0x91e7, 0x5, 0x4, 0x81eb, 0x400, 0xffff, 0x9, 0x9, 0x6, 0x7, 0x6, 0xea, 0x3, 0x9, 0x200004, 0x3, 0x7, 0x0, 0x8, 0x1, 0xbf0, 0x7, 0x7, 0x66, 0x7, 0x6, 0x3, 0x9, 0x0, 0x9c4, 0x7fff, 0x7, 0x800, 0x5, 0x9, 0x10001, 0x4, 0x2a64aeea, 0x0, 0x5, 0x2, 0x1, 0xf, 0x1ff, 0x400, 0x3, 0x3ff, 0xb, 0x39, 0x0, 0x8, 0xffffffff, 0x0, 0x8, 0x6, 0x9, 0x2, 0xffffffff, 0x401, 0x9, 0x800, 0x9, 0xeb, 0x8, 0x6ed, 0x5, 0x2004, 0x4c3e, 0x1bd, 0x381, 0x4282, 0x4, 0x7, 0x1, 0x4, 0xfffffff7, 0x5, 0x7, 0x0, 0x46, 0x9, 0x3, 0x3, 0x6, 0x9, 0x4, 0x1, 0x4, 0xfffeffff, 0xe, 0x3ff, 0x80000000, 0x7, 0x80, 0x7, 0x42b, 0x7, 0x7, 0xfff, 0x5, 0x8, 0xffffffff, 0xffff671f, 0x7, 0x4, 0x80, 0x6, 0x4, 0xd, 0x1, 0xff, 0x2, 0x5be228d5, 0x2, 0x0, 0x8, 0xaff0, 0x8001, 0x3, 0x1, 0x7, 0x0, 0x51e, 0x2, 0x6, 0x4, 0xfffffffc, 0xd97, 0xa8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x4, 0x4, 0x6, 0x0, {0x7, 0x2, 0x3, 0x10, 0x4, 0x8}, {0x6, 0x2, 0x9, 0xe23, 0x100, 0x5}, 0x7, 0x99, 0xef2}}]}, @TCA_U32_SEL={0x14, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0x894}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040084) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000100), 0x4) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket$inet(0x2, 0x2, 0x0) recvmmsg(r4, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) shmat(0xffffffffffffffff, &(0x7f00000e8000/0x1000)=nil, 0x2000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0x36, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa22}, 0x94) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2200000004"], 0x48) r6 = socket(0x29, 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000180)='net/kcm\x00') preadv(r7, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/168, 0xa8}], 0x1, 0x2004, 0x80) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r8}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={r5, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0920000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r9, @ANYBLOB="0000000000020000b7050000080000001c00000000000000bf980000000000000d080000000000008500000006000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) 3.891475516s ago: executing program 6 (id=648): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08061cdc030ec080000000080000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120800030006010000bdad446b9bbc7a46e3988285dcdf12f2130809d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff000000000000000000", 0x89}], 0x1}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r1, 0x5607, 0x30) ioctl$VT_ACTIVATE(r1, 0x5606, 0x4) r2 = syz_open_dev$mtd(&(0x7f0000000900), 0xbf8, 0x10581) ioctl$MEMWRITE(r2, 0xc0304d18, &(0x7f0000000100)={0x74, 0x0, 0x0, 0x0, 0x0, 0x2}) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f00000006c0)=ANY=[@ANYBLOB="020300020c00000028bd7000000000000300060000000000020000000000000000000000000000000200010000000000050009077fffffff030005000000000002000000640101020000000000000000020008000800000034000000000000006e0ec06af3132e16e66e7ba2e26c522c32cb9adb9fa30236eb9d5d1dcae623838a9d7facdc7b95642a601406c74e7a0cac807cf36b7f39dd8d28d4555ec5da92e65fd82e974e94a7f5419091b842a0a19bf01ead5af42098017e6a8f3a7c094715607966c9fb1f999afc9bc270b647c2918ffb5ac096f3868173a923d5ec091b336d77bac3745066cdf9a0b1a532ed6b3d13ed77b1188c4df2984ac421de3fa15620a91279e6c76cf1a577ec0c342ee847ceccd33ddbe7"], 0x60}, 0x1, 0x7}, 0x0) prlimit64(0x0, 0xf, &(0x7f0000000380)={0x1, 0x100018b}, 0x0) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(0xffffffffffffffff, 0xc0106441, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) sched_setscheduler(0x0, 0x6, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) sendmsg$key(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[], 0x100}}, 0x40) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) shmat(0x0, &(0x7f0000ffd000/0x1000)=nil, 0x2000) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYRES16=0x0], 0x108}, 0x1, 0x0, 0x0, 0x40065}, 0x0) shmctl$SHM_LOCK(0x0, 0xb) shmctl$IPC_RMID(0x0, 0x0) socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r3, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="18000000140081ae00002c000500015601618575c485af0100d41f215c0000883795c04a31377a1b2cc32b38d300"/57, 0x39}], 0x1, 0x0, 0x0, 0xc00e}, 0x44004) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x20b00, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000000c0)=0xf) 2.883437026s ago: executing program 6 (id=651): ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000540)={0x2, 0x2, 0x1000, 0x5}) r0 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'dh\x00', 0x10, 0x5, 0x2d}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'none\x00', 0x3a, 0x5, 0x54}, 0x2c) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYRES16=r3, @ANYRES8=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) r6 = open_tree(0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00', 0xc101) r7 = syz_open_procfs(0x0, &(0x7f0000000040)) name_to_handle_at(r7, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)=@FILEID_BTRFS_WITH_PARENT_ROOT={0x28, 0x4e, {0x1, 0x5, 0x9, 0xc3e9, 0x8, 0xffff}}, &(0x7f0000000100), 0x600) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r8, &(0x7f0000000040)=0x8000000001cb, 0x12) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0x98, 0x0, 0x0, 0x70bd2d, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0xe, 0xa, 'syzkaller\x00'}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x120}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r8}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x98}, 0x1, 0x0, 0x0, 0x20008040}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 2.843593592s ago: executing program 5 (id=652): r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000440)=0x4) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040301, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0xc0684113, &(0x7f0000000080)={0x1, 0xfffff800, 0x3, 0x77fffdff, 0x1f, 0xb1d, 0x8001, 0xe, 0x78, 0x3c, 0x4, 0x2}) 2.752345057s ago: executing program 2 (id=654): syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r0 = openat$pfkey(0xffffff9c, &(0x7f0000000000), 0x981a40, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x8946, 0x0) 2.752103033s ago: executing program 2 (id=656): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) pwritev2(0xffffffffffffffff, &(0x7f0000001480)=[{&(0x7f0000000040)="2e80940951b1f8cdb0417e1c7582739c958b083201", 0x15}], 0x1, 0xb, 0x800, 0x818dcc9cb13a6f3) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) fcntl$lock(r2, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)={0x2c, r4, 0xb97534d5fe9704cf, 0x70bd0b, 0x25dfdc02, {{0x12}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4094}, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r5, @ANYBLOB="0c00990dc09fc5758facc200"], 0x28}}, 0x0) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r0, 0xf504, 0x0) 2.680115432s ago: executing program 2 (id=657): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r1, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d") ioctl(r1, 0xc138fd09, &(0x7f0000000000)) landlock_restrict_self(r1, 0x18) syz_usb_connect$midi(0x2, 0x34, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, 0x0, 0x0) write$bt_hci(r2, 0x0, 0x17) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) getegid() getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, 0x0) getresgid(&(0x7f000000ef00), &(0x7f000000ef40), &(0x7f000000ef80)) 2.143799346s ago: executing program 4 (id=658): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0x80200, 0x0) r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001880)=@newtfilter={0x894, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x860, 0x2, [@TCA_U32_POLICE={0x848, 0x6, [@TCA_POLICE_RATE={0x404, 0x2, [0x80000, 0x3, 0xf, 0xfdb, 0x1, 0x80, 0x7, 0x7, 0x40000000, 0xaa04, 0x80000001, 0x99, 0x8000, 0x1000, 0x3, 0x0, 0x7fffffff, 0x80, 0x1, 0x4, 0x0, 0x9, 0x4, 0x5, 0x80000001, 0x2, 0xe0, 0x9, 0x1, 0x80000000, 0x1, 0xffff8001, 0x9, 0x10001, 0x7, 0x10000, 0x30, 0x803, 0x1000, 0xfff, 0x7, 0x2, 0x5, 0x48a, 0x9, 0x1000, 0x7, 0x7198, 0x8, 0x80000001, 0x1, 0x101, 0x3, 0x7, 0x2, 0x1, 0x10001, 0x2, 0x1, 0x2, 0x6, 0x9, 0x13, 0x2, 0xffff, 0x80, 0xbf77, 0x8, 0xc52, 0x6, 0x9, 0x7, 0x9, 0x5, 0x8, 0x3, 0x8, 0x5, 0x8, 0x1, 0x3, 0x7fffffff, 0x8, 0x2845, 0x2, 0xe9, 0x2a, 0x3, 0x891, 0x7, 0x1, 0x12, 0x6, 0xfff, 0xffffc9b5, 0x4, 0x2, 0x6, 0x6, 0xaa, 0xffffffff, 0x8, 0x0, 0x0, 0x5, 0x1, 0x2, 0x40, 0x4, 0x7, 0xa, 0x8000, 0x4, 0xffffff2d, 0x0, 0xffff7fff, 0x2, 0x3, 0x6, 0xebb, 0x8, 0xfcb, 0x8, 0x1, 0x9, 0x6fe68a84, 0x200, 0x1, 0xfffffff9, 0xb, 0x1, 0xab, 0x9, 0x7, 0x0, 0x80e, 0x10001, 0x8, 0xa, 0x6, 0xe, 0xa1, 0x4, 0xffff519d, 0x9, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, 0x4ae, 0x8, 0x1e9, 0x9, 0x101, 0x200, 0x4, 0x4, 0x1, 0x5, 0x5, 0x7, 0x5, 0x0, 0x7, 0x80, 0x2, 0x2, 0x1, 0x5, 0x101, 0x7, 0x4, 0x9, 0x7e32, 0x8800, 0x4, 0xf85f, 0x10000, 0x800, 0xffffffff, 0x7, 0x4af, 0x7e21, 0x1, 0x5027, 0x8, 0x6, 0x4, 0x3, 0x7, 0x680, 0xc1, 0x2, 0x7, 0x8, 0x401, 0x74db, 0x400000, 0x401, 0x92c, 0xffff32d2, 0x4, 0xafcf, 0x7f, 0x5, 0xffff0000, 0x0, 0x8, 0x200, 0x4a, 0x4000, 0x0, 0x9, 0x10000, 0x4d4fbb35, 0xb2, 0x4, 0x5, 0x0, 0x100, 0x8001, 0x6, 0xfffffff8, 0x9, 0x2, 0x7f, 0x2, 0xc, 0xa, 0x94, 0x3b0, 0x401, 0x118966c9, 0xe56, 0x8, 0x4, 0x1800000, 0x6a, 0x9d6, 0x200, 0x2, 0x40, 0x7, 0x8000, 0x7e, 0x4, 0x5, 0x7, 0x4, 0x3, 0x400, 0xe, 0x4, 0x5]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x1, 0x1, 0x53e5, 0x7f, 0x4, 0x3000000, 0x0, 0xf0000000, 0x3, 0xfff, 0xe, 0x7, 0xf6, 0x1ff, 0x3, 0x800001, 0xfffffffb, 0x8001, 0xff, 0x0, 0xfff, 0x82, 0x1, 0x5, 0xffff, 0x6, 0x1, 0x7, 0x9, 0x10000, 0x0, 0x5, 0xe184, 0x4, 0x1, 0xadd, 0x1, 0x16, 0x4, 0xa35c, 0xc, 0x80, 0xff, 0x6, 0x2, 0xd, 0x4, 0x4003, 0x5, 0x4, 0x401, 0x4, 0x4, 0x1, 0x3, 0x8, 0xfffffffc, 0x3, 0xc1, 0x0, 0xffff, 0x80, 0xfffffff1, 0x7ff, 0x9, 0xfffffffe, 0x2, 0x6, 0x80, 0x200, 0x1000, 0xb11a, 0x0, 0x5, 0x8, 0xf499, 0x5, 0x3361, 0x435, 0x7fffffff, 0x2, 0x806, 0xc4, 0x9, 0x0, 0xee2, 0x2, 0x401, 0xfffffffa, 0x8000, 0x2, 0x0, 0x5, 0x5dd3c81c, 0xffffffff, 0x7, 0x3, 0x81, 0x9, 0x5, 0xfffffffc, 0x2, 0x1, 0x8, 0x6, 0x0, 0x6, 0xc, 0x8, 0x6, 0x100, 0x1, 0xb5a, 0xa, 0x4, 0x18, 0x8, 0x31, 0x1ff, 0x4, 0x9, 0x400, 0x2, 0x6, 0x7, 0x9, 0x91e7, 0x5, 0x4, 0x81eb, 0x400, 0xffff, 0x9, 0x9, 0x6, 0x7, 0x6, 0xea, 0x3, 0x9, 0x200004, 0x3, 0x7, 0x0, 0x8, 0x1, 0xbf0, 0x7, 0x7, 0x66, 0x7, 0x6, 0x3, 0x9, 0x0, 0x9c4, 0x7fff, 0x7, 0x800, 0x5, 0x9, 0x10001, 0x4, 0x2a64aeea, 0x0, 0x5, 0x2, 0x1, 0xf, 0x1ff, 0x400, 0x3, 0x3ff, 0xb, 0x39, 0x0, 0x8, 0xffffffff, 0x0, 0x8, 0x6, 0x9, 0x2, 0xffffffff, 0x401, 0x9, 0x800, 0x9, 0xeb, 0x8, 0x6ed, 0x5, 0x2004, 0x4c3e, 0x1bd, 0x381, 0x4282, 0x4, 0x7, 0x1, 0x4, 0xfffffff7, 0x5, 0x7, 0x0, 0x46, 0x9, 0x3, 0x3, 0x6, 0x9, 0x4, 0x1, 0x4, 0xfffeffff, 0xe, 0x3ff, 0x80000000, 0x7, 0x80, 0x7, 0x42b, 0x7, 0x7, 0xfff, 0x5, 0x8, 0xffffffff, 0xffff671f, 0x7, 0x4, 0x80, 0x6, 0x4, 0xd, 0x1, 0xff, 0x2, 0x5be228d5, 0x2, 0x0, 0x8, 0xaff0, 0x8001, 0x3, 0x1, 0x7, 0x0, 0x51e, 0x2, 0x6, 0x4, 0xfffffffc, 0xd97, 0xa8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x4, 0x4, 0x6, 0x0, {0x7, 0x2, 0x3, 0x10, 0x4, 0x8}, {0x6, 0x2, 0x9, 0xe23, 0x100, 0x5}, 0x7, 0x99, 0xef2}}]}, @TCA_U32_SEL={0x14, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0x894}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040084) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000100), 0x4) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket$inet(0x2, 0x2, 0x0) recvmmsg(r4, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) shmat(0xffffffffffffffff, &(0x7f00000e8000/0x1000)=nil, 0x2000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0x36, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa22}, 0x94) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2200000004"], 0x48) r6 = socket(0x29, 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000180)='net/kcm\x00') preadv(r7, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/168, 0xa8}], 0x1, 0x2004, 0x80) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r8}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={r5, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0920000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r9, @ANYBLOB="0000000000020000b7050000080000001c00000000000000bf980000000000000d080000000000008500000006000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="28010000100007000000000000000000ff0204000000000a0000000000000001e00000020000000000000000000000004e2000000261c1790000000002000000a2c6b72293e61184e1d06d29ed7b340b416212e1c189ee3f2c987827979786c74129cfbfe77c3edc5c6f3b824d5a091e9757a5fc15de17799aac12d275684b42d8246bd4b47e8f", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc000000000000000000000000000000000000000000000000000000000000000200000000000000fdffffffffffffff0000001000000000ffffffffffffffff00000000000000000000000000000000000000000000000000002000000000000700000000000000000000000000000000000400fdffffffe80a000000000000000000000a0002003400000014000e00fe8000000000000000000000000000bb2400090003000000000000000100000000000080b4000000000000000500000000000000"], 0x128}}, 0x0) 2.070474472s ago: executing program 2 (id=659): sched_setattr(0x0, &(0x7f0000000280)={0x73, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa12, 0xffffffff}, 0x0) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$pmem0(0xffffffffffffff9c, &(0x7f0000002340), 0x80d01, 0x0) pwrite64(r1, &(0x7f0000000000)="a5", 0xfffffe8c, 0x2) ioctl$BLKRRPART(r1, 0x125f, 0x1f) mkdir(&(0x7f0000000080)='./cgroup/../file0\x00', 0x102) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040), 0x12) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) ioctl$KVM_SET_USER_MEMORY_REGION2(r0, 0x40a0ae49, &(0x7f0000000540)={0x0, 0x2, 0x4, 0x1000, &(0x7f00002d3000/0x1000)=nil, 0x100000, r0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$sock_int(r2, 0x1, 0x5, &(0x7f0000000000), 0x4) r3 = io_uring_setup(0x2e08, &(0x7f00000001c0)={0x0, 0xfffffffc, 0x0, 0xffffffff, 0x1}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000400)={'veth1_to_bond\x00', &(0x7f0000000340)=@ethtool_gstrings={0x1b, 0x6}}) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0xf5, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000030700000a90000000060a030400000000000000000a0000050900010073797a3100000000500004804c0001800b00010074f778617267657400003c000280240003007339f2f304fdd672bad09dfb040000000001000001f9580dabf95ddc91967c2008000240000000000c00010052415445455354000900020073797a3200000000140000001100010000000000000000000100000a3e934853bfd2f9c8a1eca2d212219a0d0e2c9ff015cae7d53065dd4be10075efa0be910bc4a3f190205a03e0d8ce64304ba3c3033efc1de69dbe93b6563ee93c6aa3e09d19049c769c243467ed9d58f3a20532"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x20008040) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8937, &(0x7f0000000300)={'batadv0\x00', @broadcast}) mount(0x0, 0x0, &(0x7f00000000c0)='gfs2\x00', 0x10, &(0x7f0000000100)='barrier') sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000300)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r5, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) 1.900942221s ago: executing program 5 (id=660): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) fremovexattr(0xffffffffffffffff, 0x0) 1.700711495s ago: executing program 5 (id=661): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'bond_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@TCA_INGRESS_BLOCK={0x8}]}, 0x2c}}, 0x4c840) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newtfilter={0x4c, 0x2c, 0xf3f, 0x30bd29, 0x25ffdbfd, {0x0, 0x0, 0x0, r2, {0xffff, 0xf}, {0x0, 0xfff3}, {0x2, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_VLAN_ID={0x6, 0x17, 0xb8a}, @TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x88a8}, @TCA_FLOWER_KEY_VLAN_PRIO={0x5, 0x18, 0x4}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@getchain={0x2c, 0x11, 0x839, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4, 0xc}, {0x9}, {0xa, 0x1c}}, [{0x8}]}, 0xfffffffffffffff6}, 0x1, 0x0, 0x0, 0x4040091}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e09030001000102000109022700010100c0320904000003ffffff00070581034000010705020240"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x1, 0x0) write(r3, &(0x7f0000000100)="3c5c0f2397b4d84500b5f812365f00000000000000", 0xff40) socket$key(0xf, 0x3, 0x2) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x8000) read(r4, &(0x7f0000000000)=""/219, 0xdb) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000180)={0x335, @time={0x101, 0x1}, 0x1b, {}, 0x2, 0x0, 0x6}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r4, 0xc0bc5351, &(0x7f0000000300)={0x9, 0x2, 'client1\x00', 0x80000000, "f3768b5f9445c33a", "345dbbfb091846825ff4166f705930ad5b6e5d46f78448033995dd722337c7e6", 0x10000009, 0x3}) tkill(0x0, 0x7) 1.263005295s ago: executing program 4 (id=662): r0 = fsopen(&(0x7f0000000140)='pipefs\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r1) syz_open_dev$radio(&(0x7f0000000040), 0x3, 0x2) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x1810040, &(0x7f0000000500)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) (fail_nth: 3) 1.159553529s ago: executing program 4 (id=663): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x2002) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={0xffffffffffffffff, 0x7e, 0x10}, 0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r2, 0x58, &(0x7f0000000100)}, 0x10) readv(r1, &(0x7f00000000c0)=[{0x0}], 0x1) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000380)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) 1.158386609s ago: executing program 2 (id=664): r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0cc5605, 0x0) pipe2(&(0x7f0000001cc0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x18000c8, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@noextend}, {@access_any}]}}) 1.156210975s ago: executing program 6 (id=665): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_open_procfs(0x0, &(0x7f0000000680)='cmdline\x00') r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) fcntl$setstatus(r2, 0x4, 0x2800) ioctl$DRM_IOCTL_ADD_BUFS(r2, 0xc0186416, &(0x7f0000000080)={0x5, 0x6, 0x4, 0x2, 0x4, 0x7ff}) preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000040)=""/3, 0x3}, {0x0, 0x3}], 0x2, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RGETLOCK(r3, &(0x7f00000002c0)=ANY=[], 0x200002e6) fcntl$setpipe(r3, 0x407, 0x7000000) fcntl$setpipe(r3, 0x407, 0x100000) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000a0000000000000010"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/sda\x00', 0x2, 0x0) ioctl$BLKDISCARD(r4, 0x1277, &(0x7f0000000000)=0x100000) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) openat$ppp(0xffffffffffffff9c, 0x0, 0x161042, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x7fc8, 0x1000, 0x40002, 0x393}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) syz_ublk_add_dev(0xffffffffffffffff, r5, r6, r7, &(0x7f0000000400)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x3, 0x603, 0x0, 0x0, 0x1000, 0xb6a7, 0x0, 0x0, 0x28}}}, &(0x7f0000000180)=0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) r10 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) syz_ublk_setup_queues(r10, r9, &(0x7f0000000480)={0x0, 0x18ee, 0x1000, 0x3, 0x1d2}, &(0x7f0000002680)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb656, 0x20, 0x2, 0x342, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x842d, 0x40, 0x2, 0x6a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb6d4, 0x10000, 0x1, 0x252}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xeaff, 0x8, 0x0, 0x231}}], 0x4, &(0x7f0000003900)={0x2e, 0x62, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x9}, 0x0, r8, '\x00', {0x2003, 0xb66, 0x0, 0x0}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)={0x14, 0x23, 0x409, 0x70bd25, 0x25dfd3ff, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x24040811}, 0x8410) syz_clone(0x280000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)) bind$alg(0xffffffffffffffff, 0x0, 0x0) 1.058747891s ago: executing program 4 (id=666): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000200)={0x40020100, 0x0, 0x0, 0x0, {0x2d}, 0x0, 0x0, 0x0, 0x0}, 0x58) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00'}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_i', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r1, 0xe503, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 923.604948ms ago: executing program 2 (id=667): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000000a80)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7}, 0x1c, &(0x7f0000000640)=[{&(0x7f0000000140)=':', 0x1}], 0x1}}, {{&(0x7f0000000440)={0xa, 0x4e23, 0x9, @private0={0xfc, 0x0, '\x00', 0x1}, 0x2}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000080)='@', 0x1}], 0x1}}], 0x2, 0x0) (async) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="140100001f0001000000000000000000010100800c0001000400"], 0x114}], 0x1, 0x0, 0x0, 0x20044080}, 0x4000000) (async) r2 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x402) ioctl$EVIOCSKEYCODE_V2(r2, 0x40284504, &(0x7f0000000000)={0x1c, 0x2, 0xeffe, 0x9, "cd511591002a49500000008000000000f86a1d73f20000000000000000fbf29c"}) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r3, 0x4b4c, &(0x7f0000000080)={0x400, 0x5}) (async) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001ac0)=@buf={0x1000, &(0x7f0000000ac0)="ae8035c519c110caf20f4ce9848c62188192f96097ebdbf828470fe03cd456e78ee8e35f8e458f46776e414222a3bef8059159d471702a9dff4dbacec3c1676dc6dc040921f029a7c1aea117e563abd5c1abb767175d9e6193780264515ec0e668bd5cee795e7d07d1c1da4a7a3077f97bd453fe07fa24daf07b1b7ad960c6766a94f6697e6bc99dab43543c04d5b10fa0aad0a8bdf3c132cff0e62f5c584c52c3a89e015d4738ac6541a602f2e0e2a18f15552781d903787682ab061b54624c3a74a8d7059c48376ff19949e22612d93485b18c0de17d0b3b8172fbd040bb93cbd20401ce17957ca611ae418140d088e77832ca8b3a8e07d5083e1d68e8dcbc2953d213f88d6ecbbd550c29513ebaf8f56defc1eafef8cc04d908d64a2a5110b2a175e41ed593d5982c44281a1b292291b05b01fbb3cc2525427776d794cc618ae0bad006a35fc2fe47edb56f02ea0906a0ef4499b69668ee8661c7d36d5755c9222dfd8688bd5c951fef4430d4758bd7314ecd38aa98fc6c581c11a5656037af8a7765980185460b5996af9c7edf61d6145f899ac3ae5cc8b4d443836df23f18b9d8065c8d2fb6b3990935db09a3f2f2987d2692ea3a366f8bd6f1312bb75e9de6847ef6d8ed20ae4c38d7365faac9b97d2b1a35fd7bed0f60b578f0cc993fd4f929cd20cdb0452afd63a2bc309045f527f90fb4d53588aae7444d4628e71d600bd5ecb4951a7a4efa0495480b631c735c18b330df657ac711eb7eb5535b0e3fb0ab0cdb7c0e1c6cfc2344e302691ec793cbf72a640b450901561a010ff5f1a54bfa06f2cc6ce2229b259bfda7c7b8bb621ed2a7734521c6b37e89c532c5998a3c650905a98189783b70e5543686d9e8c283c5e86180e6a3a5002b1987bc0373bb91dc12c8f00f6aad9b3eb5645d65c8085ee9d5c29f8594c5275a7104eca53ddb1d807ac46b6f0b69cbb9a72f43b4ebd020ef64fbefc32fb5fd5b949cf00caf4f86f78410f20bf74ad65122a8243233f1e48b791bb2de9ccac71137fdd6145db0e6aa86fe9b2731649cba4da1dc39eaa4a2e7c0e1ff8036112cbffb098253ed94295756ed829aca50e9372e29ca7633b63357c6b70e91fdf90020e9aa579e911b341d4f7916d56b615acda5c72c8f93f13cb8ed58874a9edff8f3849f9534f1cb949a0fc0e1b256b742d75bd197dc69d816854081d441ea61b98d83d964f10c8e751660163e0277d3ddd0c7802abb067afd5007fd7685628112ba10a546387a5da6a19a7c371912e7cd1b4742aa4db4cfbc8d8fdfed1652e12473d281c6e84683d8658d35859dcd827a965d5b0ef2452c1fb636102c5af66c319f27ff850cd718cda777215885e21ef92e2f0927c83efe1cbfa21c0d5e64135b7cb683dfd4bdab567c8dfe62bd3733796490175ead28bc3a816d345b63db05a81f2740e0f5f3c2abff75f097b219404707c99ffb74ec6bbabb429123f126a1421b62e688675db7352a2fb4d8bcdd35d1377f9473111cbc35691bca66263521d94b993e070189bdbe5d869e9eb2470181b42314e48a5ceadb497045488b9a9b05890043eff8e83fc5ca1b5bfc223ceff60199e7f5d74d2441a6f5c690061362519223238e6a6bb186d8cc151ae38285c5f5bc79c30ecc4655d106a6c1401a6802cf2a3c345099aed6af59fcc210b2777d211a993a814a645580d8d2574c514b0c40c822f5982eab362560b89aa595665285d5add86dce5adeb609f808fb2ae24a13b5ec0d9b83cfda2f87932c780cff5210e013e8a8dc1c942c3f2c83f7825f8dea687cbc9b89463db445d9a466cda7be4f4f6af4ccc514b20ffb65b3c668179bdba4b9ababc373623ecc359c1b3cfdf265c38718bb594143ae46e1927486a447093456a8d1c10266bb67b6f2978ad2db27ec7678f1a62ca57f3e851ed4c373c17dbea668d21f85423236f3e013dc84d234b3cab922ae1c968b8129ecfa1c3d0fe0abf08586f2824291200c9bfb686e2ff65a50b3215ca86a7431545fb8c27a79499552aeb5d960e16591e75818f85d405da1c2199d28af3416312e3ead716b0500fa7f8a460fc07bb69617d4ce1f2f1bd4c0f3defb122cfb3d23d73dfd26a821622a1ce653cb75fc783241111ae3f8fe9155603ac16b405c6a0f75a97e5930722491a7fc2e2bb5822161c5ca507afdf6eb46766e01c8a9fd74c472339ad2fe47e54ed476cbe492bc2a3153eb95e46245cae4cc81e9a9df32055bda94012f977aa8e8a25bd666b0bed0aca89ecaa7ff08d7209303d18efb84d4efc31acd9d32f10367cd6b6bb4512b1a6fd63837150b7b8a1cb91a543dd94184c35ae407b41f9f351a3b3216d9e346c63f5ae5ca2fed748f741f02a14328ec5d5c8633d01c42b9c93561513cdf1b05f012cf06a7ba442f9d5e79dd0aa0b4aa51aada72f3b3fde741a090ba02dded794f722e517b9c686c9ee8f056d86b5166707c261ee83170c23ff74e5e4aad9904c8523dbabf83eb9ddedcee2ab29a2147021ff3812c83e5c828cd89b0d36f41f0b667d1855bf5d7528dbecc28469380355af4b8111c9c863dbf0e3b0f9dadfece5e2c5f17c90125841c9226424526c248c622394e16782e75fbb7f16805b9840fba988852a00181a75abcd14a38f2fadcfefc30a0212935ea7153dc2e8d17cbafcaae9329e8755b82416d5b99318066602680229ca14eb0e61f44c865dec7a0180eba60752104a68462bd33f68b581c918da7d1cf6c6f77f6a9e51df0c3a4a9e354144e1ebea2f869a640ad53f869849a437630a4ca1b7bc1ed43c64bfc90e2e6e1448bed4f7785319a0b5ab2681e7479fb795f286db8ac48188f6e76495bade3867d1722875661671c90aa70bbf2180e361db2f57d3afc3533308ba304137b86d8e9780c798ac44369eae727d983a45821e5a67ff7c6fbd84c0c491238070e36cc72c887314bb85afdb3ec3722c9a93bf135695c3d712287af39797a0dbb233b7b073454320e76c0cb5cf1b3d34616ef1e2f4106acd173a63902b80076ed741c3ec4c7811a1e1f2030e8c2def736153f743ce22efce7bc41d015e4277ec43d91917a6bb78104947bcbecc6b20ebefaa573e84e61a4b87e4e6c0518095c3c17ed3d35459b776b784e163ce9ee7fbf297ed3172f1cbcf194fbd074ac190749949f0919af68b9d59606dea65e1b89d5d167aa3b2992a16e16bb4bd53e718c4b653ab8565f29585a2d3cbd389110b971470a3f0db0e83fc9102b9d7ee2e74fd6f70820062459b0c1699a94ac0d9643b8bdcc31b35c6bbf777105e3f9a4e904c7fcf4ca5036211c5f3399c03d63227d8a6e7fb3f391b1b9a20ef8514c1136e4bbce728e2eef29df290f00649d632b142e02255a6f8961d817d69f8d550cc4221536cd56f0b59dfc83230164062bfe93f623cf10f7d6e31ea05bde2f6bf7608cf604736bd353ab2f216bd9d4f7572a4e410c03b4cbc98130b07a9032bd54cb6b92cdb43dfb3aee622660d90a3e5050fc571915ea6ed667c5ac55e9a2f36b76064a6ff32c664017911773d6692c0edd9a6eaabb1f2cb650b76abcb64ba60b3ce329eddf210ab04a9648f279787ecbcac9a9ddf2e18a25cb99cf51d621da2955b563549b1f8e2c6e8b3733b66c4ad1da50d4703b7f51aaee742c8356dd5bf80a26269f9e11bca0ace244a80c113eac0d087940f86d2a79a3d9c8a74c282fb3ac7d2b6ef5fdca1518081a092b88fcbccc29fdca048f41246c63dc5e4231ef41673f8fb5db0fd27b02eb9c5a408a757ce547c76d58b2fd6fad64f75b700eae186405a22def42d97f072ed6fb59911ba319293532f6a8d530911d51a91a124d7265e5717d880ae91ffb90a77045ec237027118281ebe47f02e6bfd6cc9adbc23ec63e717357dab1eff085e4cd86d165d263ac1c8ae32f0e953dfe4e5943eb4e538ca1d7ff3b368be438554be587a211581afaddce61c86f6b550315965f7e90882806e0961a2827269c37111e68130bc9a814dee227b24eaae85f2033042b1863d923e5737a552eb964c40b3261fd3c7681dff88e49d93a4e421af800f4e14faf38586db3f94fcc54d1fe07046484b93f6d1dc436ae02adb354e21846a7a96ae30ca32005ea0ab39bd52ecd76f2ef3f868520fc5ce68e6c3d3a7a5da23e392e5e81ac44bb38a8e91e8b0c98911bad71d096ee7321e1e2d38a38a93dcf4da5a35287d5f8a7c02498ff10ba2d520db876798694e897d8f7934af7136746fe9af9e7933d484fd8dc9a1dff69e3d831a006c1d2bd6140844fb0940d91e1c3fdf2c9c55e59b18ff6b783bac45e6a272d3b4378a1ceaedab407ff0d14e9cfdc1745f6ddc4adc7910c5d025ece7c64efa19dcfe1847f1ff68089fe8eec498dfac05b7e81d0f383d10f8ef3653c00d3f69c3039f6fd48cda092a60b7f71ce80c17e08097859abcdd8af538a85e58b0d717873ad1979e1356095847498eda14fdd263fad0ef5d17260553c2f1c3e8c15cfb2f17b4534e0135c853cb5a20f01b124544de849acacc09b6da32f18207f2269b37de53b67faed3d2962218df854b4e5b94b611e4ec15c691eabf7ec9353b368574961707c849ffd3702490563ec187084fdf9deb81649c3a7aa729636946ea7d07317de2f5aaaa002d54b4781f7c554e6e0b96ac774eb50835dceb7c3e48c3a551895e2ef948ba737cbe714d81607843a7bada95e124b36e59d26fa9ebb5a14c83ab51eef472eb3768c5fe91ea549fecb64dc9520f5f377d03178ef14d01713cc262ee12eec7d67011e2330648a5a16e2ea84c598d54809d61e8a44d4bdb3086490612473377a2ea01fbfe088fb216cf009fbd52059785089bcab11cffebfb7f131085623d3b39912a4e7187c5ebf19facb55556819538eb1b4f61a661b33132290c46a29a53a0a75a8f17233187f174b032c1e94d4aee68cf6b6f38bff591969738acf3b13f80b6bcc5f4cceab995a11c22d6d139d8a8a08eb9d1e3330630b60c3837ffeb572305213e8ad119436ace1ffd2988b7316e349ebf4d7541a88e10258b14f593b96cc3356e8066000b3d9e0f86b1db8e83c4cccd0cbf8ce0669153db0f5333d46aa232e79e71e0d050258afc122495b3796079010aa5e53017e7b9ed125ae52813677c780c68580f694140595ec8d3bdf7b741e84d9e88fceb288522563259446affc11d62b9f2da499cb4d5b6d26d13bc9878ba27d8e5deceac20abfeb7f553f50f9d9874b975b5cf9801370b3d849a6a5c228050a24194f545b4a34c1539d36b9e634bd3367e8e7ddb21c2b091e15f67de95e002dd7fd408af88af91da5ffca35436a008ea494dbdd7f5817827fa0ad734d479be99dd8e47b4c4b8d08614e27f910c6bd8ead20e555b759480c302bbf50e0d3812c092d33fdea2ac63b399378b03f456b78ed2c08ff422c6376ff11b6a4b5782a437b5a13680b234268e7a258e5734e16d52ee4e777ed13378ead4a870951cea10f1eb27badd3ccc6a051a406d898dddc582b551856655b573ced233ed2b9d59538896a0c31e92d9a78db21c786b33f0699b1fe9753ed03ffcfc138df7d949937d0c95a87b96205037a5d6d00ef3f13eb8b9b34a6ebb526e6540b7548b7212b527660687370c6a64152e1c5c70ea6e04c366eaf73663646cefa5928e5409004bf0108259cef41427d507d558f251d091ee1b6d21fad7a0185cf3dff781bbe0016125ea25492ceb1616da653544785f12fb465fb97fe7617a1e2717aa1b5aac4bdd7f5c853f977481db236d665c9c688c5f45f21ac4b49ed56e4d00e42"}) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) (async) mbind(&(0x7f0000926000/0x3000)=nil, 0x3000, 0x6, &(0x7f0000000000)=0x549, 0x8, 0x5) (async) get_mempolicy(0x0, 0x0, 0x2, &(0x7f00005e7000/0x1000)=nil, 0x2) (async) shutdown(r0, 0x1) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000000c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) (async) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0xfff2, 0xe}, {0x0, 0x9}, {0xffe0, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_CT_STATE={0x6, 0x5b, 0x3e}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x41}, 0x20040054) (async) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000240)={0x0, 0x0, 0xfffffff9, 0x80000001}, 0x10) 921.709772ms ago: executing program 4 (id=668): r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000440)=0x4) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040301, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0xc0684113, &(0x7f0000000080)={0x1, 0xfffff800, 0x3, 0x77fffdff, 0x1f, 0xb1d, 0x8001, 0xe, 0x78, 0x3c, 0x4, 0x2}) 119.250414ms ago: executing program 6 (id=669): ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f00000001c0)={0x5, 0x80000, 0xffffffffffffffff}) r1 = socket(0x1, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f00000000c0)=0xc) setresuid(0x0, r2, r2) sendmsg$nl_xfrm(r0, &(0x7f0000001bc0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001b80)={&(0x7f0000000ac0)=@report={0x1098, 0x20, 0x400, 0x70bd25, 0x25dfdbfd, {0x33, {@in=@multicast1, @in=@rand_addr=0x64010102, 0x4e24, 0xfffa, 0x4e21, 0xc, 0x2, 0xa0, 0x0, 0x0, 0x0, r2}}, [@algo_aead={0x104c, 0x12, {{'authenc(cmac-aes-neon,chacha20)\x00'}, 0x8000, 0x0, "bcb5bb591f3e7b3345f4caaf10a1428a104f1cb8b44fd1bcb4ca54ef9227b074a3544721756ebb4787dcfc5671d174dfc0a21be7376130ffb7155b5caf988eb5079102e6e97c7a6530d85ee2d40d224b73a72c3c3bde5062e0bf25a3016e288b83acda46243526d3da030501d677f5ec0a7448ebe78c89b8039ce3e09f4e116159cf6bd2da4c08a64ca15f38c4d543b4b53f33a2e8ce2b48841c2cb17919632d6435863854ecac0d11a78ab39127f51e424275d4ed9ccb79f5d5e02e0810f7de47e9df61924a24851459143fb66b59eeb69d7240455aefc980a056405d5268821282cb8963f047624febdf164033c7ee32e37df1033433ccac6218af831931040664fcd0a8664fe764a856811680d17c5ffecf6b051cf7d73ff6388f679210375e9044f8c4820c30e83d302db8b8df3c61f922e1cfe051b9cfc00f0da6f460fb825d426c78259cadc8ef745d0b9efa20981526b3744cdf45d889563614357254589ed8897b1465a53671d99227d02578bedd9f9b244f0b73446442f22bfd9668f5506c41fb9151401f00a706f3ae4ab3bb4ae09ab7770ea2a8c11b7c3d0d2cccafafa52e7555dbbfae5ff085136f20f47d3b11ca2e29dd54ece3b599efdbcf0dc8131752ac2255cdc762ebedcecb510074df32f56588ba811ef0fd019dc91f96965d6aaf3926185f94b9f8256df82e94774755233f2cb5762cb842f3567a380d763796af36c10a2118a8f0b353104e831f494ea180305e4145aecb221c920e8ac718f57ef1978775fd4d7366291c147d413a68893a64c40f72e08858225f26da5789deb3eaa482b53f3c4c00427d55fa9c0282f3ec706ab164c14115597f0fb7d5546e46f2f0802539a23967d856bf82a475578cd94cd11a6f8b616bbad745c9cc06fe140ae097925041bab4c39fdc560b1138a4a22c9108567b5d579e82635244be30ca1731dd3f7b06a3ef8a5f599f73dcebe10cc6b7bb7ed303f1f33bfaa3a15781360054fdb857f2e58b11e5c7da8111feffdf35da5969ab438b3bdf2cabd0dfb20d426d2e07227e28c2d6e07ed5d6c900527e656e9c7cc06a723ed12593c9fd80a90fec3ac61eb66bd41a4c987a4feb0c834c023b00f6f9d6f9c44bef956cfeabe0eba5b6729b59ed828d7581c42839583ad8e0600716548ed0b9919e27ff0dc3cc7a82c714fb52f7c98ce94d59bed57be2e71d712e1858eccf1a74815c5f99d32b593b58ce5abb4357952afc6fb6a5bf7462eac7c01b7132a1fae88d1e12e96d1b0fe67db9579fb819249a14a6c2eee8cef55c9966535f4e61a8239b5eb44d7db0ca3fd95af8cbd868f599a2fc676b72a516f676b5c8d13db725fcb4b13e4c6567f5726bed2d58662ac219b4b98040f3a6860bc8411c9ae41088a74dbd2bee53fa903176fa5911b137398593e7f5b17a6984500fd6c83dfb65d003ad2d847cf776a759241dfc6c457de15ec5a3cedbc8aed2ed4027aad3505bafea59618e663eb9a6a2cf0263e1e6a5c4164c63749ef41068a626d562995b8a4cad0b172292e99260f140f5c00f7afcc9e825156f543003f82ff8f4cc3d454e43c4f7c4905485b1a4f23e89d7090c40df68f7a0a5ad3b545bb77d9d7c26dd5feaa3b5c388ab23b10be95fc50e8ed85bbd0f66cf587b72a880d3f5ef9ae0f8db784b746c30a1a2d2737711d9a39f6091dffe1e376136406a2034f13d1c39e031e805507850d6b16495971bb0570239150de57f582695d83eb4c68ddb798ec4200207e380c07f54fe861d9e1882d74ea8b065fe58ce6393f5262239cc75b7684fb99dd7d8a6257b919b618f8adc6b2d85c529a32009705d043c5f15a3f0ff5e39b9dc0266fb5011c802d0a598198f5e614077c4db738d651eee81fb38aea76c2184f1c11d4327ab367d96ae48538b5b326bca82e2e122e568f7cf8ebcb62b81b8cdee7bef13effe40ef32f616ab3812609adc3f46af9dd8d1b4dff33483ad02d18bcefd639e518e27f9122a18f769a96bd46b68ddfde1e5fc916cf1761a9d5f91ec5b3766dc1c47ed2a48e7f04291a985c5c6a43341ab8389f0e4a629328f6e7a05605b7dd134619aa678024bf95f90755ce474061d104a144e5d5737228aa333fe9b03914294b0e725327fe57a32a7e8ba16aea56fa94d495a1f84f178d138f7cc4bc4b2a54c145d35007d32974e1f5de85b993f4318ca92881216585c1a23528179dbe16c6fd75277a74d42fb572a21536d9683a7eff697d3cb11c233fea0e7088e34efcac687f64f657c55495fdea5a718d9b6cebd9030878d6d76864ef02b3518f7075fd9988cc11cec8a29fca9631793924acadb9ed02d305aa0eafb93c14af43ecdadee567e7483e256166953c7e7d73272029361f7ce1fe88db153f4f519e0838a70e67346edd162b185949928791271a6bb0c1f401c233cb42e87e0ec4abc8a3587c65d277b2f6e7d333ecf4de2fd01012a0c88bd5123167f72d7bf7b1912a8fcb141c156fdae2266c5fae56043646a5c0db53c31bb1a2119c5730d20342f82df47117bc1c06cf92890d86217f6eb8325e9e6b73591263d996b7780086339d4ea15f57d6029a4c26e5a962f313800d2027645ae8c190482c6d0c0772c2936ee5602fbed7cb471e4949982a7504c07e603535dbbae198931f10cb2af97437ff07fdc494f2c9217184ae2b4d4b554d9380177bcddd4ebd6bfdd8a8835623f19fa8d9bdba3a1a1d3c8732f495cd3380ed0b15b130c45006fbc90fd828bd8b8a9f5759aaec9df8e7c683b180c855fc09cc364ad554e6b167b8e18dd074c6717f5018496b94c0f73133ae7ec40e87ac989033ad25f9812076f64f12b350f5b1ce061a052b93481d07c3c0de91b4394e681f0a5dd973d53c3ee243c03258cd2bc7acb467955a2667aa30b63ab6ef9d3e6d862c48bca9b6ca567962bb7fe5368785168545a4b805dad947237f9fceddcedd73ff2fa5f09cbbd81dbe4f8feca2ecc3c921496272dd3be98e9fdf878a93143d7dc5eff5045489c39635d66d279739c10ba8c5067baf1ae96bbc9402c1098f3dcbe3397a7dcd73ea87075640607562f2fbaa5714f0f557c3819bb34b4a989d0d59da17c9272776cb295fc72cf3065616dfe9a77e30a5baa7cc406f0dc2833f0915fc3332bdf516dfbf2ef8a0938bb77b8a3223d45e210870306b814866a64fba940cb5f3489793fcdb324e27f02326f0857b12928de0d95e9c67a5a7efdf7334f536333b3b002a1b80aed61dd105c756a0c618b51de2b2425a0a9d09d4d06e42d2086539995bf89b65839eb8b5b438f710de98be8f1179c13e4c969874c356579529361e209d281c413e40eb97706ef95d4f133bbb6077adfe7a1dfde5e0d933798a0c9d359e9eee0b2ae710598dd60c6b6236f7b1106b59561f335c9e96f5f1f36a373079c4b17ec302641c03473d1c7c7d4291507057c0117ca0b94373f56013231eb1fdb2859feffe97bace1d2c0be2ca09c6a0e27e950472e7e19207d6c487151f7339223e4db6ed1b89f736bb2e0113c0d825771688545d5a35ebf8d94afb91bdf1b1acee746e191404ae9a97ef537dba603d52b4d0840e36d3f533a413fb9b3c4356dde7c527ac4fde656b5a028c4ed12fd933e7f09f423fae63cd1f939cfb9b6dabdf5a7b33d7db01d0565fbe5b2b73f9fa808d2c39e447ad40624cd93ace04924fbf886000510ff79e36816c619a44c9664d94fbdd2fdff514d5e88e03ab289710e79f69f1cebc66cb01a875e7e12f56c39d38df9445e1c6ad87eb5c28a41ee0be8b76d4bc019f1893261c1c77490eff3644ae0892329222f9d214b11b9c13433e1c48657e60fc8d5c2037be916c85918f29ac143fcf76125dd24aa9d1c2cf1e1b2ab604caead00f88dbc8e26d5c1b8b22440ba9fa5aefdc83866487114a9e3e959961ad8faa9dbaab5eebd4f552a6aef70960700021646e9d4b97f1b96b36d197b42dde204b2b39ea4b5a83fd93096ce91185a41586aa02519464700ecf818f24e003a71f97e2c33a1b3899d5c0dff99ea44f8ae6b52031b81000f3bb112ebc919e8d686e881c47c07752c2544d508283190e24c7b608efc7016b7692a4c58fd99059159ab33da10aec2c99541c504689d339e9749ed8814729548a8e4d1ab8a2bc38ae53330ea78ae68f0c3ac162ae02284cb52152aa13dbf97db135bd673f8c6e60ef46d32e29a368cb62003ed7dea3b5ba46ef9c6ee27e2563b148adf9bb201e07b74f16dfdf9023eea60c18ca803e86841c240e377ea68ecdcc4ca48c955fe3c2deac6e76e313c092d0f453ebeeaefd69831a3053d12ea0cefef80404a4618ca9406e97ec227bc9478acbb331e7c406493251183ccd31b11fe1991d16428f276f4c912110a1391cb27583cfa7a7063b6857f479cddebc0366343b83b281967d18bd93fac9cecc5fff646175715c1f466f0176955c018b748b5e6d8090b7607ade35d107846e5b2113f7c573d49eb3b180f867ca51917e1a8fc984ff8a0c15d44e7dc15fa0a8d796e7bfa5f23715493fe872829ad04f09c7bfc9ca3f63a25d8a885d06215a384a6d55ef4b8a76dd7d115a3e1f16d8330f9be6cf1d28c5e8c6332fac059c0329e426ab4b9267f4cd5858edabfd20ed8d578b80175a2af9790ba55b401db316da94c29b45155b93c2e9fdec55114e9160b53871be7d17a719fae762e7f416cdb001666f505b8d9593ce0d90d90fd4ba39f4c663294d8ac15d127a1b141d3117c5990aa37d3db49838969ac16997710da4279da3d3c0120e3d4067d8f8029234792d97d85b96e222b99af6fd28def859670a6441b8dfa84719103d249f5ca1df465cd5f888e176ed89d8f62ef3bc7b09e5f2cfa122b746f2f97eb75890905a9d9bbcb6a4558a54e918a0656f3532e19158c8e88aa2c0c4bed8a3c6a8470a9ee290b66c9a04172ac1e6bb6bbf40030f011149b5d3f894110a506dd636f4e14cc7d32f3c254adb7d7f4fbc002c943ade2d4a4348a13998bd20a77990f740defbc86863e687cad8bcd8fba1585a7c92c7c6f2c41273d0f28c8b20214aed23383f7844c980aa71ed44e64adfb53e427452f93be56517a7fe5538c5b1d5b4efffefa45a6dd37c6f32180affd396864f1254afce4456d6f021ca59f81c59697dd80e541164ca7e9837ac00ad2aa9faf32856635329fc96c06f9b86843644475bc0cb2ad52051ef0d7c01801b2f696f75a7996f11076cc79195f7b97ca14832b024dd2c3302b53524f26eedf934e71f5d1a5e39499f12faefe93ce68f95c913032ffcb06da8b84cfc184220de1f12d81eec56a06e0541bb0784a7d2325199918047976d5c426dada96c78bfce01eedeaebf42ee45fdaef5ba3a557985240a7dede3db86f4e13af8572bdfc269e7620389ebaf3ad23023a051fa3c5f368629a5609decf011501a01cf5b795a08418b790c4a006277e0a04fb7aaa33dac8dff5133ee777ced5280b0ba0ff322912eaf81b200ed6d0be5fdfac69a3b9106a53ed6a3f2392f3480ef9bec4bc58d33e5f8ae7abc696f1959e678ebafdec5fb948d81ef09e61674c9894cf24df53f5491d72d57307af51f9b837b3c983d6e92953a7d7cb6cf5ef81baae9f5463e30400762b1ca21227143c0a688f546f09c2e610ddf11ef4ed766e1777e81c20bf6817682e1f20b8953bac1fa711c946f5b410b33a224b0bbad0d440dcaac7e7221ab28708d5e0b518d602be38064f06f722e856a8f6ef95cdeaafca1f4700f237e29ea833fa0df85344fdd6bddb91beaa866208fa91e28ce4ff14eda27b77ccc2"}}]}, 0x1098}, 0x1, 0x0, 0x0, 0x400d0}, 0x400c0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r3, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000080)=ANY=[@ANYBLOB="05000000020800de9c00000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0xea60, @ANYBLOB="0000004001"], 0x80}, 0x1, 0x0, 0x0, 0x40084}, 0x20000000) sendmsg$can_bcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)=ANY=[@ANYBLOB="050000009a0c00000100000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="0000004001"], 0x38}}, 0x4) r4 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r5, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r5, 0x7a0, &(0x7f0000000040)={@host}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r5, 0x7a8, &(0x7f0000000340)={{@host}, @host, 0x0, 0x6, 0x244c, 0xffffffffffffffff, 0x101, 0x0, 0xfffffffc}) ioctl$IOCTL_VMCI_VERSION2(r5, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r5, 0x7a4, &(0x7f0000000140)={{@host, 0x1}, 0x200000000001, 0x0, 0x1000, 0xfffffff9}) r6 = socket(0x10, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r7, @ANYBLOB="0200000000008000800012000800010076746936"], 0xa0}}, 0x0) connect$bt_rfcomm(r4, &(0x7f00000000c0)={0x1f, @none, 0x6}, 0xa) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000002f0008002abd7000000000000569a7a29c7d43c6a4f2824700000005001180e7000000"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 0s ago: executing program 4 (id=670): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0x80200, 0x0) r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001880)=@newtfilter={0x894, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x860, 0x2, [@TCA_U32_POLICE={0x848, 0x6, [@TCA_POLICE_RATE={0x404, 0x2, [0x80000, 0x3, 0xf, 0xfdb, 0x1, 0x80, 0x7, 0x7, 0x40000000, 0xaa04, 0x80000001, 0x99, 0x8000, 0x1000, 0x3, 0x0, 0x7fffffff, 0x80, 0x1, 0x4, 0x0, 0x9, 0x4, 0x5, 0x80000001, 0x2, 0xe0, 0x9, 0x1, 0x80000000, 0x1, 0xffff8001, 0x9, 0x10001, 0x7, 0x10000, 0x30, 0x803, 0x1000, 0xfff, 0x7, 0x2, 0x5, 0x48a, 0x9, 0x1000, 0x7, 0x7198, 0x8, 0x80000001, 0x1, 0x101, 0x3, 0x7, 0x2, 0x1, 0x10001, 0x2, 0x1, 0x2, 0x6, 0x9, 0x13, 0x2, 0xffff, 0x80, 0xbf77, 0x8, 0xc52, 0x6, 0x9, 0x7, 0x9, 0x5, 0x8, 0x3, 0x8, 0x5, 0x8, 0x1, 0x3, 0x7fffffff, 0x8, 0x2845, 0x2, 0xe9, 0x2a, 0x3, 0x891, 0x7, 0x1, 0x12, 0x6, 0xfff, 0xffffc9b5, 0x4, 0x2, 0x6, 0x6, 0xaa, 0xffffffff, 0x8, 0x0, 0x0, 0x5, 0x1, 0x2, 0x40, 0x4, 0x7, 0xa, 0x8000, 0x4, 0xffffff2d, 0x0, 0xffff7fff, 0x2, 0x3, 0x6, 0xebb, 0x8, 0xfcb, 0x8, 0x1, 0x9, 0x6fe68a84, 0x200, 0x1, 0xfffffff9, 0xb, 0x1, 0xab, 0x9, 0x7, 0x0, 0x80e, 0x10001, 0x8, 0xa, 0x6, 0xe, 0xa1, 0x4, 0xffff519d, 0x9, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, 0x4ae, 0x8, 0x1e9, 0x9, 0x101, 0x200, 0x4, 0x4, 0x1, 0x5, 0x5, 0x7, 0x5, 0x0, 0x7, 0x80, 0x2, 0x2, 0x1, 0x5, 0x101, 0x7, 0x4, 0x9, 0x7e32, 0x8800, 0x4, 0xf85f, 0x10000, 0x800, 0xffffffff, 0x7, 0x4af, 0x7e21, 0x1, 0x5027, 0x8, 0x6, 0x4, 0x3, 0x7, 0x680, 0xc1, 0x2, 0x7, 0x8, 0x401, 0x74db, 0x400000, 0x401, 0x92c, 0xffff32d2, 0x4, 0xafcf, 0x7f, 0x5, 0xffff0000, 0x0, 0x8, 0x200, 0x4a, 0x4000, 0x0, 0x9, 0x10000, 0x4d4fbb35, 0xb2, 0x4, 0x5, 0x0, 0x100, 0x8001, 0x6, 0xfffffff8, 0x9, 0x2, 0x7f, 0x2, 0xc, 0xa, 0x94, 0x3b0, 0x401, 0x118966c9, 0xe56, 0x8, 0x4, 0x1800000, 0x6a, 0x9d6, 0x200, 0x2, 0x40, 0x7, 0x8000, 0x7e, 0x4, 0x5, 0x7, 0x4, 0x3, 0x400, 0xe, 0x4, 0x5]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x1, 0x1, 0x53e5, 0x7f, 0x4, 0x3000000, 0x0, 0xf0000000, 0x3, 0xfff, 0xe, 0x7, 0xf6, 0x1ff, 0x3, 0x800001, 0xfffffffb, 0x8001, 0xff, 0x0, 0xfff, 0x82, 0x1, 0x5, 0xffff, 0x6, 0x1, 0x7, 0x9, 0x10000, 0x0, 0x5, 0xe184, 0x4, 0x1, 0xadd, 0x1, 0x16, 0x4, 0xa35c, 0xc, 0x80, 0xff, 0x6, 0x2, 0xd, 0x4, 0x4003, 0x5, 0x4, 0x401, 0x4, 0x4, 0x1, 0x3, 0x8, 0xfffffffc, 0x3, 0xc1, 0x0, 0xffff, 0x80, 0xfffffff1, 0x7ff, 0x9, 0xfffffffe, 0x2, 0x6, 0x80, 0x200, 0x1000, 0xb11a, 0x0, 0x5, 0x8, 0xf499, 0x5, 0x3361, 0x435, 0x7fffffff, 0x2, 0x806, 0xc4, 0x9, 0x0, 0xee2, 0x2, 0x401, 0xfffffffa, 0x8000, 0x2, 0x0, 0x5, 0x5dd3c81c, 0xffffffff, 0x7, 0x3, 0x81, 0x9, 0x5, 0xfffffffc, 0x2, 0x1, 0x8, 0x6, 0x0, 0x6, 0xc, 0x8, 0x6, 0x100, 0x1, 0xb5a, 0xa, 0x4, 0x18, 0x8, 0x31, 0x1ff, 0x4, 0x9, 0x400, 0x2, 0x6, 0x7, 0x9, 0x91e7, 0x5, 0x4, 0x81eb, 0x400, 0xffff, 0x9, 0x9, 0x6, 0x7, 0x6, 0xea, 0x3, 0x9, 0x200004, 0x3, 0x7, 0x0, 0x8, 0x1, 0xbf0, 0x7, 0x7, 0x66, 0x7, 0x6, 0x3, 0x9, 0x0, 0x9c4, 0x7fff, 0x7, 0x800, 0x5, 0x9, 0x10001, 0x4, 0x2a64aeea, 0x0, 0x5, 0x2, 0x1, 0xf, 0x1ff, 0x400, 0x3, 0x3ff, 0xb, 0x39, 0x0, 0x8, 0xffffffff, 0x0, 0x8, 0x6, 0x9, 0x2, 0xffffffff, 0x401, 0x9, 0x800, 0x9, 0xeb, 0x8, 0x6ed, 0x5, 0x2004, 0x4c3e, 0x1bd, 0x381, 0x4282, 0x4, 0x7, 0x1, 0x4, 0xfffffff7, 0x5, 0x7, 0x0, 0x46, 0x9, 0x3, 0x3, 0x6, 0x9, 0x4, 0x1, 0x4, 0xfffeffff, 0xe, 0x3ff, 0x80000000, 0x7, 0x80, 0x7, 0x42b, 0x7, 0x7, 0xfff, 0x5, 0x8, 0xffffffff, 0xffff671f, 0x7, 0x4, 0x80, 0x6, 0x4, 0xd, 0x1, 0xff, 0x2, 0x5be228d5, 0x2, 0x0, 0x8, 0xaff0, 0x8001, 0x3, 0x1, 0x7, 0x0, 0x51e, 0x2, 0x6, 0x4, 0xfffffffc, 0xd97, 0xa8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x4, 0x4, 0x6, 0x0, {0x7, 0x2, 0x3, 0x10, 0x4, 0x8}, {0x6, 0x2, 0x9, 0xe23, 0x100, 0x5}, 0x7, 0x99, 0xef2}}]}, @TCA_U32_SEL={0x14, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0x894}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040084) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000100), 0x4) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket$inet(0x2, 0x2, 0x0) recvmmsg(r4, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) shmat(0xffffffffffffffff, &(0x7f00000e8000/0x1000)=nil, 0x2000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0x36, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa22}, 0x94) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2200000004"], 0x48) r6 = socket(0x29, 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000180)='net/kcm\x00') preadv(r7, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/168, 0xa8}], 0x1, 0x2004, 0x80) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r8}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={r5, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0920000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r9, @ANYBLOB="0000000000020000b7050000080000001c00000000000000bf980000000000000d080000000000008500000006000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="28010000100007000000000000000000ff0204000000000a0000000000000001e00000020000000000000000000000004e2000000261c1790000000002000000a2c6b72293e61184e1d06d29ed7b340b416212e1c189ee3f2c987827979786c74129cfbfe77c3edc5c6f3b824d5a091e9757a5fc15de17799aac12d275684b42d8246bd4b47e8f", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc000000000000000000000000000000000000000000000000000000000000000200000000000000fdffffffffffffff0000001000000000ffffffffffffffff00000000000000000000000000000000000000000000000000002000000000000700000000000000000000000000000000000400fdffffffe80a000000000000000000000a0002003400000014000e00fe8000000000000000000000000000bb2400090003000000000000000100000000000080b4000000000000000500000000000000"], 0x128}}, 0x0) kernel console output (not intermixed with test programs): 5][ T5834] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 102.201117][ T5834] usb 6-1: config 168 interface 0 has no altsetting 0 [ 102.203291][ T5834] usb 6-1: string descriptor 0 read error: -22 [ 102.203347][ T5834] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.214988][ T5834] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 102.306457][ T30] usb 42-1: SetAddress Request (14) to port 0 [ 102.306492][ T30] usb 42-1: new SuperSpeed USB device number 14 using vhci_hcd [ 102.463894][ T10] usb 6-1: USB disconnect, device number 7 [ 102.635866][ T6749] vhci_hcd: connection reset by peer [ 102.636152][ T5781] vhci_hcd vhci_hcd.2: stop threads [ 102.636166][ T5781] vhci_hcd vhci_hcd.2: release socket [ 102.636193][ T5781] vhci_hcd vhci_hcd.2: disconnect device [ 103.016499][ T1033] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 103.053459][ T43] audit: type=1326 audit(1791062805.792:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6763 comm="syz.0.200" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f04fec code=0x0 [ 103.174058][ T1033] usb 8-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 103.179702][ T1033] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 103.179733][ T1033] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 103.179744][ T1033] usb 8-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 103.181967][ T1033] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 103.181982][ T1033] usb 8-1: Product: syz [ 103.181989][ T1033] usb 8-1: Manufacturer: syz [ 103.184691][ T6762] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 103.193412][ T1033] garmin_gps 8-1:1.0: Garmin GPS usb/tty converter detected [ 103.232286][ T1033] usb 8-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 103.736718][ T1033] usb 8-1: USB disconnect, device number 5 [ 103.743468][ T1033] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 103.743931][ T1033] garmin_gps 8-1:1.0: device disconnected [ 103.998341][ T6785] openvswitch: netlink: Invalid VLAN frame [ 104.896626][ T6800] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(8) [ 104.896656][ T6800] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 104.896754][ T6800] vhci_hcd vhci_hcd.0: Device attached [ 105.206734][ T5523] usb 44-1: SetAddress Request (10) to port 0 [ 105.206787][ T5523] usb 44-1: new SuperSpeed USB device number 10 using vhci_hcd [ 105.275087][ T43] audit: type=1326 audit(1791062808.012:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6819 comm="syz.0.215" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f04fec code=0x0 [ 105.282181][ T6806] vhci_hcd: connection reset by peer [ 105.282668][ T5808] vhci_hcd vhci_hcd.3: stop threads [ 105.282691][ T5808] vhci_hcd vhci_hcd.3: release socket [ 105.286241][ T5808] vhci_hcd vhci_hcd.3: disconnect device [ 106.770773][ T6855] program syz.2.224 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 106.924822][ T10] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 106.932166][ T10] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 107.149662][ T6855] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.151434][ T6855] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.188212][ T5878] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 107.214512][ T6855] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 107.219321][ T6855] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 107.367227][ T30] usb 42-1: device descriptor read/8, error -110 [ 107.517184][ T5808] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.517225][ T5808] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.517252][ T5808] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.517280][ T5808] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.707958][ T1033] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 107.735593][ T6859] ceph: No mds server is up or the cluster is laggy [ 107.784752][ T43] audit: type=1326 audit(1791062810.522:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6872 comm="syz.1.228" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf706efec code=0x0 [ 107.804841][ T30] usb usb42-port1: attempt power cycle [ 108.623623][ T30] usb usb42-port1: unable to enumerate USB device [ 108.742736][ T6891] tmpfs: Using encoding : utf8-12.1.0 [ 108.749379][ T6891] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 108.768143][ T6893] FAULT_INJECTION: forcing a failure. [ 108.768143][ T6893] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 108.768165][ T6893] CPU: 3 UID: 0 PID: 6893 Comm: syz.1.234 Not tainted syzkaller #0 PREEMPT(full) [ 108.768177][ T6893] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 108.768183][ T6893] Call Trace: [ 108.768187][ T6893] [ 108.768192][ T6893] dump_stack_lvl+0x100/0x190 [ 108.768211][ T6893] should_fail_ex.cold+0x5/0xa [ 108.768229][ T6893] _copy_from_user+0x2e/0xd0 [ 108.768249][ T6893] memdup_user+0x6b/0xe0 [ 108.768262][ T6893] dvb_frontend_handle_compat_ioctl+0x1e0/0x710 [ 108.768277][ T6893] ? tomoyo_path_number_perm+0x28f/0x580 [ 108.768289][ T6893] ? __pfx_dvb_frontend_handle_compat_ioctl+0x10/0x10 [ 108.768305][ T6893] ? tomoyo_path_number_perm+0x188/0x580 [ 108.768318][ T6893] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 108.768330][ T6893] ? get_pid_task+0x106/0x250 [ 108.768346][ T6893] ? __lock_acquire+0x5c0/0x1f40 [ 108.768364][ T6893] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 108.768380][ T6893] ? do_raw_spin_lock+0x128/0x260 [ 108.768392][ T6893] ? find_held_lock+0x2b/0x80 [ 108.768407][ T6893] ? down_interruptible+0x66/0xa0 [ 108.768422][ T6893] ? rcu_is_watching+0x13/0xc0 [ 108.768435][ T6893] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 108.768449][ T6893] ? lockdep_hardirqs_on+0x7d/0x110 [ 108.768477][ T6893] dvb_frontend_compat_ioctl+0xf6/0x180 [ 108.768491][ T6893] ? __pfx_dvb_frontend_compat_ioctl+0x10/0x10 [ 108.768505][ T6893] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 108.768519][ T6893] __do_fast_syscall_32+0x13a/0x8b0 [ 108.768536][ T6893] ? lockdep_hardirqs_on+0x7d/0x110 [ 108.768550][ T6893] do_fast_syscall_32+0x32/0x70 [ 108.768565][ T6893] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 108.768579][ T6893] RIP: 0023:0xf706efec [ 108.768592][ T6893] Code: Unable to access opcode bytes at 0xf706efc2. [ 108.768597][ T6893] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 108.768607][ T6893] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040086f52 [ 108.768614][ T6893] RDX: 0000000080000340 RSI: 0000000000000000 RDI: 0000000000000000 [ 108.768620][ T6893] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 108.768631][ T6893] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 108.768637][ T6893] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 108.768651][ T6893] [ 108.953670][ T6901] Zero length message leads to an empty skb [ 109.024475][ T6904] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(8) [ 109.024493][ T6904] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 109.024679][ T6904] vhci_hcd vhci_hcd.0: Device attached [ 109.228004][ T6905] vhci_hcd: connection closed [ 109.251953][ T5808] vhci_hcd vhci_hcd.3: stop threads [ 109.251981][ T5808] vhci_hcd vhci_hcd.3: release socket [ 109.266750][ T5808] vhci_hcd vhci_hcd.3: disconnect device [ 109.489856][ T6912] jffs2: notice: (6912) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 109.547558][ T10] wacom 0003:056A:003F.0002: hidraw1: USB HID v0.00 Gamepad [syz0] on syz0 [ 109.784417][ T6917] fido_id[6917]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 109.968720][ T43] audit: type=1326 audit(1791062812.712:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6929 comm="syz.3.243" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fcefec code=0x0 [ 110.316953][ T5523] usb 44-1: device descriptor read/8, error -110 [ 110.722933][ T5523] usb usb44-port1: attempt power cycle [ 110.847247][ T30] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 110.983140][ T43] audit: type=1326 audit(1791062813.722:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6941 comm="syz.3.248" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fcefec code=0x0 [ 110.997756][ T30] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 110.998780][ T30] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 110.998818][ T30] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 110.998837][ T30] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 111.000219][ T30] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 111.000238][ T30] usb 6-1: Product: syz [ 111.000250][ T30] usb 6-1: Manufacturer: syz [ 111.004015][ T6938] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 111.006601][ T30] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 111.014933][ T30] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 111.164081][ T5781] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.245866][ T5781] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.319096][ T5781] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.369320][ T5523] usb usb44-port1: unable to enumerate USB device [ 111.416853][ T5781] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.420743][ T5523] usb 6-1: USB disconnect, device number 8 [ 111.433987][ T5523] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 111.434281][ T5523] garmin_gps 6-1:1.0: device disconnected [ 111.571495][ T5781] bridge_slave_1: left allmulticast mode [ 111.571535][ T5781] bridge_slave_1: left promiscuous mode [ 111.573158][ T5781] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.581066][ T5743] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 111.585832][ T5743] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 111.586626][ T5743] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 111.588012][ T5743] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 111.589760][ T5743] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 111.592485][ T5781] bridge_slave_0: left allmulticast mode [ 111.592506][ T5781] bridge_slave_0: left promiscuous mode [ 111.592851][ T5781] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.894866][ T5781] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 111.907145][ T5781] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 111.909676][ T5781] bond0 (unregistering): Released all slaves [ 111.939666][ T6961] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 111.939697][ T6961] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 111.939793][ T6961] vhci_hcd vhci_hcd.0: Device attached [ 112.226456][ T5523] usb 42-1: SetAddress Request (18) to port 0 [ 112.226514][ T5523] usb 42-1: new SuperSpeed USB device number 18 using vhci_hcd [ 112.332081][ T5446] 8021q: adding VLAN 0 to HW filter on device eth2 [ 112.361054][ T6962] vhci_hcd: connection reset by peer [ 112.362556][ T12] vhci_hcd vhci_hcd.2: stop threads [ 112.362575][ T12] vhci_hcd vhci_hcd.2: release socket [ 112.362614][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 112.458770][ T43] audit: type=1326 audit(1791062815.192:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6978 comm="syz.3.254" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fcefec code=0x0 [ 112.548452][ T5781] hsr_slave_0: left promiscuous mode [ 112.549083][ T5781] hsr_slave_1: left promiscuous mode [ 112.551740][ T5781] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 112.551764][ T5781] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 112.552524][ T5781] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 112.552542][ T5781] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 112.581891][ T5781] veth1_macvtap: left promiscuous mode [ 112.581951][ T5781] veth0_macvtap: left promiscuous mode [ 112.582029][ T5781] veth1_vlan: left promiscuous mode [ 112.582103][ T5781] veth0_vlan: left promiscuous mode [ 112.822936][ T5781] team0 (unregistering): Port device team_slave_1 removed [ 112.843120][ T5781] team0 (unregistering): Port device team_slave_0 removed [ 113.021107][ T5446] 8021q: adding VLAN 0 to HW filter on device eth3 [ 113.115384][ T43] audit: type=1326 audit(1791062815.852:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6996 comm="syz.2.255" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 113.152714][ T6955] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.152854][ T6955] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.152975][ T6955] bridge_slave_0: entered allmulticast mode [ 113.155432][ T6955] bridge_slave_0: entered promiscuous mode [ 113.157146][ T6955] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.157231][ T6955] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.157289][ T6955] bridge_slave_1: entered allmulticast mode [ 113.158071][ T6955] bridge_slave_1: entered promiscuous mode [ 113.181511][ T6955] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 113.184068][ T6955] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 113.207025][ T6955] team0: Port device team_slave_0 added [ 113.208428][ T6955] team0: Port device team_slave_1 added [ 113.225387][ T6955] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 113.225398][ T6955] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 113.225410][ T6955] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 113.226217][ T6955] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 113.226224][ T6955] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 113.226237][ T6955] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 113.249023][ T6955] hsr_slave_0: entered promiscuous mode [ 113.249458][ T6955] hsr_slave_1: entered promiscuous mode [ 113.249736][ T6955] debugfs: 'hsr0' already exists in 'hsr' [ 113.249747][ T6955] Cannot create hsr debugfs directory [ 113.349608][ T5446] 8021q: adding VLAN 0 to HW filter on device eth4 [ 113.355774][ T7012] netlink: 8 bytes leftover after parsing attributes in process `syz.3.258'. [ 113.373505][ T6955] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 113.376684][ T6955] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 113.379228][ T6955] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 113.384516][ T6955] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 113.386669][ T6955] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 113.395476][ T6955] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 113.395960][ T6955] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 113.405145][ T6955] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 113.414427][ T5781] IPVS: stop unused estimator thread 0... [ 113.432658][ T6955] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.432709][ T6955] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.432845][ T6955] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.432890][ T6955] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.481225][ T6955] 8021q: adding VLAN 0 to HW filter on device bond0 [ 113.490818][ T6439] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.491442][ T6439] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.507061][ T6955] 8021q: adding VLAN 0 to HW filter on device team0 [ 113.512204][ T6439] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.512286][ T6439] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.515211][ T6439] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.515258][ T6439] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.564216][ T5446] 8021q: adding VLAN 0 to HW filter on device eth5 [ 113.679758][ T5738] Bluetooth: hci2: command tx timeout [ 113.736708][ T50] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 113.788744][ T6955] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 113.887303][ T50] usb 8-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 113.888257][ T50] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.888297][ T50] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 113.888319][ T50] usb 8-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 113.889974][ T50] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 113.889995][ T50] usb 8-1: Product: syz [ 113.890007][ T50] usb 8-1: Manufacturer: syz [ 113.901278][ T7029] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 113.902809][ T50] garmin_gps 8-1:1.0: Garmin GPS usb/tty converter detected [ 113.919899][ T50] usb 8-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 114.008475][ T6955] veth0_vlan: entered promiscuous mode [ 114.020931][ T6955] veth1_vlan: entered promiscuous mode [ 114.021085][ T7054] netlink: 4 bytes leftover after parsing attributes in process `syz.2.262'. [ 114.029407][ T7054] netlink: 28 bytes leftover after parsing attributes in process `syz.2.262'. [ 114.038702][ T7054] jffs2: notice: (7054) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 114.063721][ T6955] veth0_macvtap: entered promiscuous mode [ 114.070711][ T6955] veth1_macvtap: entered promiscuous mode [ 114.094583][ T6955] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 114.103992][ T6955] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 114.140848][ T5781] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.140893][ T5781] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.141006][ T5781] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.141038][ T5781] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.186236][ T6434] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.186252][ T6434] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.220174][ T6439] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.220195][ T6439] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.294545][ T7065] jffs2: notice: (7065) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 114.644731][ T43] audit: type=1326 audit(1791062817.382:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7083 comm="syz.1.269" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf706efec code=0x0 [ 114.968386][ T6436] IPVS: starting estimator thread 0... [ 115.061528][ T7059] ceph: No mds server is up or the cluster is laggy [ 115.069367][ T7094] IPVS: using max 26 ests per chain, 62400 per kthread [ 115.766991][ T5738] Bluetooth: hci2: command tx timeout [ 115.916520][ T42] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 116.067392][ T42] usb 9-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 116.068540][ T42] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 116.068562][ T42] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 116.068593][ T42] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.336690][ T30] usb 9-1: USB disconnect, device number 2 [ 116.495832][ T42] usb 8-1: USB disconnect, device number 6 [ 116.509890][ T42] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 116.510161][ T42] garmin_gps 8-1:1.0: device disconnected [ 116.554802][ T7123] nftables ruleset with unbound chain [ 116.590060][ T43] audit: type=1326 audit(1791062819.332:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7124 comm="syz.3.282" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fcefec code=0x0 [ 117.276594][ T5523] usb 42-1: device descriptor read/8, error -110 [ 117.666955][ T5523] usb usb42-port1: attempt power cycle [ 117.837059][ T5738] Bluetooth: hci2: command tx timeout [ 118.161570][ T7153] netlink: 4 bytes leftover after parsing attributes in process `syz.3.291'. [ 118.171376][ T7153] netlink: 28 bytes leftover after parsing attributes in process `syz.3.291'. [ 118.175817][ T7153] jffs2: notice: (7153) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 118.306422][ T58] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 118.319538][ T5523] usb usb42-port1: unable to enumerate USB device [ 118.460810][ T58] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 118.461928][ T58] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 118.461969][ T58] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 118.461988][ T58] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 118.463268][ T58] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 118.463281][ T58] usb 6-1: Product: syz [ 118.463288][ T58] usb 6-1: Manufacturer: syz [ 118.465432][ T7147] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 118.471223][ T58] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 118.477257][ T58] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 118.766476][ T1033] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 118.766481][ T5523] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 118.916936][ T5523] usb 9-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 118.917203][ T1033] usb 7-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 118.918158][ T1033] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 118.918183][ T1033] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 118.918213][ T1033] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.919700][ T5523] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 118.919716][ T5523] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 118.919735][ T5523] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.112808][ T43] audit: type=1326 audit(1791062821.852:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7169 comm="syz.3.297" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fcefec code=0x0 [ 119.194051][ T1033] usb 9-1: USB disconnect, device number 3 [ 119.322164][ T10] usb 7-1: USB disconnect, device number 2 [ 119.800449][ T7180] FAULT_INJECTION: forcing a failure. [ 119.800449][ T7180] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 119.800477][ T7180] CPU: 0 UID: 0 PID: 7180 Comm: syz.4.298 Not tainted syzkaller #0 PREEMPT(full) [ 119.800497][ T7180] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 119.800507][ T7180] Call Trace: [ 119.800514][ T7180] [ 119.800521][ T7180] dump_stack_lvl+0x100/0x190 [ 119.800551][ T7180] should_fail_ex.cold+0x5/0xa [ 119.800573][ T7180] _copy_to_user+0x32/0xd0 [ 119.800599][ T7180] simple_read_from_buffer+0xcb/0x170 [ 119.800623][ T7180] proc_fail_nth_read+0x1af/0x230 [ 119.800645][ T7180] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 119.800668][ T7180] ? rw_verify_area+0xce/0x6d0 [ 119.800686][ T7180] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 119.800707][ T7180] vfs_read+0x1e4/0xb40 [ 119.800727][ T7180] ? lock_acquire+0x1d1/0x380 [ 119.800749][ T7180] ? __fget_files+0x34/0x3d0 [ 119.800769][ T7180] ? __pfx_vfs_read+0x10/0x10 [ 119.800785][ T7180] ? find_held_lock+0x2b/0x80 [ 119.800805][ T7180] ? __fget_files+0x215/0x3d0 [ 119.800831][ T7180] ? __fget_files+0x21f/0x3d0 [ 119.800858][ T7180] ksys_read+0x12a/0x250 [ 119.800905][ T7180] ? __pfx_ksys_read+0x10/0x10 [ 119.800935][ T7180] do_int80_emulation+0x166/0x650 [ 119.800962][ T7180] asm_int80_emulation+0x1a/0x20 [ 119.800989][ T7180] RIP: 0023:0xf71175ab [ 119.801008][ T7180] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 119.801023][ T7180] RSP: 002b:00000000f53cd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 119.801040][ T7180] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53cd5d0 [ 119.801051][ T7180] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 119.801061][ T7180] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 119.801070][ T7180] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 119.801081][ T7180] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 119.801106][ T7180] [ 119.916401][ T5738] Bluetooth: hci2: command tx timeout [ 120.156862][ T5523] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 120.327380][ T5523] usb 9-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 0.00 [ 120.329532][ T5523] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 64 [ 120.329570][ T5523] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0xE has invalid maxpacket 64 [ 120.329614][ T5523] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 120.329658][ T5523] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 120.329706][ T5523] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 64 [ 120.329761][ T5523] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 64 [ 120.331778][ T5523] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 120.331821][ T5523] usb 9-1: Product: syz [ 120.331852][ T5523] usb 9-1: Manufacturer: syz [ 120.343495][ T7184] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 120.343617][ T7184] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 120.343697][ T7184] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 120.343791][ T7184] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 120.343848][ T7184] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 120.344312][ T7184] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 120.357335][ T5523] usb 9-1: USB2VGA dongle found at address 4 [ 120.362810][ T5523] usb 9-1: Allocated 8 output buffers [ 120.371045][ T5523] usb 9-1: Failed to early initialize device [ 120.672681][ T7184] usb 9-1: Failed to initialize device [ 120.677814][ T58] usb 9-1: USB disconnect, device number 4 [ 121.092497][ T10] usb 6-1: USB disconnect, device number 9 [ 121.104259][ T10] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 121.104740][ T10] garmin_gps 6-1:1.0: device disconnected [ 121.853875][ T43] audit: type=1326 audit(1791062824.592:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7212 comm="syz.2.310" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 121.994602][ T7216] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 121.994631][ T7216] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 122.006538][ T7216] vhci_hcd vhci_hcd.0: Device attached [ 122.228218][ T7223] gtp0: entered promiscuous mode [ 122.228240][ T7223] gtp0: entered allmulticast mode [ 122.596439][ T50] usb 46-1: SetAddress Request (2) to port 0 [ 122.596477][ T50] usb 46-1: new SuperSpeed USB device number 2 using vhci_hcd [ 122.620635][ T7217] vhci_hcd: connection reset by peer [ 122.623142][ T5808] vhci_hcd vhci_hcd.4: stop threads [ 122.623159][ T5808] vhci_hcd vhci_hcd.4: release socket [ 122.623189][ T5808] vhci_hcd vhci_hcd.4: disconnect device [ 123.216818][ T10] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 123.275341][ T7234] gtp0: entered promiscuous mode [ 123.275361][ T7234] gtp0: entered allmulticast mode [ 123.366900][ T10] usb 8-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 123.367782][ T10] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 123.367805][ T10] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 123.367817][ T10] usb 8-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 123.369076][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 123.369087][ T10] usb 8-1: Product: syz [ 123.369094][ T10] usb 8-1: Manufacturer: syz [ 123.378030][ T7232] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 123.379544][ T10] garmin_gps 8-1:1.0: Garmin GPS usb/tty converter detected [ 123.385674][ T10] usb 8-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 124.567084][ T7264] syz.4.320 uses obsolete (PF_INET,SOCK_PACKET) [ 124.581534][ T7264] netlink: 4 bytes leftover after parsing attributes in process `syz.4.320'. [ 124.581549][ T7264] openvswitch: netlink: Flow actions attr not present in new flow. [ 124.583317][ T7264] netlink: 36 bytes leftover after parsing attributes in process `syz.4.320'. [ 124.583330][ T7264] netlink: 36 bytes leftover after parsing attributes in process `syz.4.320'. [ 125.788802][ T7282] netlink: 64 bytes leftover after parsing attributes in process `syz.1.325'. [ 126.013962][ T5523] usb 8-1: USB disconnect, device number 7 [ 126.067274][ T5523] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 126.068042][ T5523] garmin_gps 8-1:1.0: device disconnected [ 126.113983][ T43] audit: type=1326 audit(1791062828.852:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7293 comm="syz.3.326" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fcefec code=0x0 [ 127.996412][ T5743] Bluetooth: hci0: command 0x2006 tx timeout [ 127.997974][ T5738] Bluetooth: hci0: Opcode 0x2006 failed: -110 [ 128.053759][ T50] usb 46-1: device descriptor read/8, error -110 [ 128.391394][ T7341] ieee802154 phy0 wpan0: encryption failed: -22 [ 128.436943][ T50] usb usb46-port1: attempt power cycle [ 128.472812][ T7345] FAULT_INJECTION: forcing a failure. [ 128.472812][ T7345] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 128.472832][ T7345] CPU: 3 UID: 0 PID: 7345 Comm: syz.2.341 Not tainted syzkaller #0 PREEMPT(full) [ 128.472872][ T7345] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 128.472881][ T7345] Call Trace: [ 128.472886][ T7345] [ 128.472892][ T7345] dump_stack_lvl+0x100/0x190 [ 128.472918][ T7345] should_fail_ex.cold+0x5/0xa [ 128.472933][ T7345] _copy_from_iter+0x1f4/0x1690 [ 128.472953][ T7345] ? __pfx__copy_from_iter+0x10/0x10 [ 128.472969][ T7345] ? _copy_from_iter+0x270/0x1690 [ 128.472985][ T7345] ? __lock_acquire+0x5c0/0x1f40 [ 128.473003][ T7345] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 128.473022][ T7345] skb_copy_datagram_from_iter+0x11f/0x720 [ 128.473038][ T7345] ? aa_file_perm+0x197/0x14d0 [ 128.473052][ T7345] ? iov_iter_advance+0xac/0x6d0 [ 128.473066][ T7345] ? find_held_lock+0x2b/0x80 [ 128.473081][ T7345] tun_get_user+0x1866/0x3cc0 [ 128.473103][ T7345] ? __lock_acquire+0x5c0/0x1f40 [ 128.473119][ T7345] ? __pfx_tun_get_user+0x10/0x10 [ 128.473137][ T7345] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 128.473153][ T7345] ? find_held_lock+0x2b/0x80 [ 128.473165][ T7345] ? tun_get+0x191/0x370 [ 128.473181][ T7345] ? tun_get+0x191/0x370 [ 128.473199][ T7345] tun_chr_write_iter+0xdc/0x200 [ 128.473211][ T7345] vfs_write+0x6af/0x1050 [ 128.473224][ T7345] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 128.473243][ T7345] ? __pfx_vfs_write+0x10/0x10 [ 128.473255][ T7345] ? find_held_lock+0x2b/0x80 [ 128.473288][ T7345] ksys_write+0x12a/0x250 [ 128.473303][ T7345] ? __pfx_ksys_write+0x10/0x10 [ 128.473315][ T7345] ? ksys_write+0x1ac/0x250 [ 128.473328][ T7345] ? __pfx_ksys_write+0x10/0x10 [ 128.473344][ T7345] __do_fast_syscall_32+0x13a/0x8b0 [ 128.473358][ T7345] ? lockdep_hardirqs_on+0x7d/0x110 [ 128.473373][ T7345] do_fast_syscall_32+0x32/0x70 [ 128.473388][ T7345] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 128.473402][ T7345] RIP: 0023:0xf705efec [ 128.473415][ T7345] Code: Unable to access opcode bytes at 0xf705efc2. [ 128.473420][ T7345] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 128.473431][ T7345] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 128.473438][ T7345] RDX: 000000000000004e RSI: 0000000000000000 RDI: 0000000000000000 [ 128.473444][ T7345] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 128.473450][ T7345] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 128.473456][ T7345] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 128.473469][ T7345] [ 128.651120][ T43] audit: type=1326 audit(1791062831.392:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7353 comm="syz.2.343" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 128.996977][ T50] usb usb46-port1: unable to enumerate USB device [ 130.072905][ T5808] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 130.160384][ T5808] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 130.227860][ T5808] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 130.295472][ T5808] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 130.808637][ T5808] bridge_slave_1: left allmulticast mode [ 130.808887][ T5808] bridge_slave_1: left promiscuous mode [ 130.817973][ T5808] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.858295][ T5808] bridge_slave_0: left allmulticast mode [ 130.858312][ T5808] bridge_slave_0: left promiscuous mode [ 130.858466][ T5808] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.116206][ T5743] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 131.125686][ T5743] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 131.128936][ T5743] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 131.133888][ T5743] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 131.134705][ T5743] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 131.175623][ T5808] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 131.189721][ T5808] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 131.191831][ T5808] bond0 (unregistering): Released all slaves [ 131.201791][ T5808] bond1 (unregistering): Released all slaves [ 131.464289][ T43] audit: type=1326 audit(1791062834.202:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7404 comm="syz.1.355" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf706efec code=0x0 [ 131.537626][ T5446] 8021q: adding VLAN 0 to HW filter on device eth7 [ 131.681606][ T5808] hsr_slave_0: left promiscuous mode [ 131.684282][ T5808] hsr_slave_1: left promiscuous mode [ 131.684763][ T5808] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 131.684775][ T5808] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 131.685554][ T5808] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 131.685564][ T5808] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 131.701945][ T5808] veth1_macvtap: left promiscuous mode [ 131.702042][ T5808] veth0_macvtap: left promiscuous mode [ 131.702128][ T5808] veth1_vlan: left promiscuous mode [ 131.702179][ T5808] veth0_vlan: left promiscuous mode [ 131.874891][ T5808] team0 (unregistering): Port device team_slave_1 removed [ 131.883164][ T5808] team0 (unregistering): Port device team_slave_0 removed [ 131.942924][ T5446] 8021q: adding VLAN 0 to HW filter on device eth6 [ 132.050409][ T7379] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.050486][ T7379] bridge0: port 1(bridge_slave_0) entered disabled state [ 132.050539][ T7379] bridge_slave_0: entered allmulticast mode [ 132.051376][ T7379] bridge_slave_0: entered promiscuous mode [ 132.052622][ T7379] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.052687][ T7379] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.052743][ T7379] bridge_slave_1: entered allmulticast mode [ 132.053540][ T7379] bridge_slave_1: entered promiscuous mode [ 132.067804][ T7379] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 132.069333][ T7379] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 132.083266][ T7379] team0: Port device team_slave_0 added [ 132.084593][ T7379] team0: Port device team_slave_1 added [ 132.099045][ T7379] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 132.099056][ T7379] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 132.099069][ T7379] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 132.099950][ T7379] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 132.099958][ T7379] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 132.099970][ T7379] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 132.125446][ T7379] hsr_slave_0: entered promiscuous mode [ 132.125911][ T7379] hsr_slave_1: entered promiscuous mode [ 132.156582][ T5446] 8021q: adding VLAN 0 to HW filter on device eth9 [ 132.217187][ T5808] IPVS: stop unused estimator thread 0... [ 132.317733][ T1436] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.317764][ T1436] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.542337][ T43] audit: type=1800 audit(1791062835.252:35): pid=7439 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.357" name="file0" dev="overlay" ino=545 res=0 errno=0 [ 132.846708][ T5446] 8021q: adding VLAN 0 to HW filter on device eth8 [ 133.051817][ T7379] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 133.060353][ T7379] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 133.060844][ T7379] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 133.081477][ T7379] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 133.083465][ T7379] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 133.134099][ T7379] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 133.136789][ T7379] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 133.160371][ T7379] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 133.196544][ T5738] Bluetooth: hci3: command tx timeout [ 133.314137][ T7379] 8021q: adding VLAN 0 to HW filter on device bond0 [ 133.338572][ T7379] 8021q: adding VLAN 0 to HW filter on device team0 [ 133.343132][ T6434] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.343182][ T6434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.347096][ T6434] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.347143][ T6434] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.629136][ T7379] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 133.799876][ T7379] veth0_vlan: entered promiscuous mode [ 133.803762][ T7379] veth1_vlan: entered promiscuous mode [ 133.835132][ T7379] veth0_macvtap: entered promiscuous mode [ 133.843314][ T7379] veth1_macvtap: entered promiscuous mode [ 133.851813][ T7379] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 133.858702][ T7379] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 133.887999][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.888046][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.888076][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.888105][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.917312][ T6437] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 133.917327][ T6437] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 133.930515][ T6434] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 133.930528][ T6434] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 134.105152][ T7488] netlink: 4 bytes leftover after parsing attributes in process `syz.5.352'. [ 134.105168][ T7488] openvswitch: netlink: Flow actions attr not present in new flow. [ 134.107058][ T7488] netlink: 36 bytes leftover after parsing attributes in process `syz.5.352'. [ 134.107075][ T7488] netlink: 36 bytes leftover after parsing attributes in process `syz.5.352'. [ 134.209056][ T7493] No source specified [ 134.456567][ T5803] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 134.603772][ T43] audit: type=1326 audit(1791062837.342:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7503 comm="syz.1.366" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf706efec code=0x0 [ 134.628426][ T5803] usb 9-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 134.629348][ T5803] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 134.629369][ T5803] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 134.629398][ T5803] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.860596][ T50] usb 9-1: USB disconnect, device number 5 [ 135.279587][ T5738] Bluetooth: hci3: command tx timeout [ 135.575687][ T7525] No source specified [ 135.686564][ T5803] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 135.788715][ T5738] Bluetooth: hci0: unexpected event for opcode 0x0c6d [ 135.848322][ T5803] usb 10-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 135.849442][ T5803] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 135.849482][ T5803] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 135.849500][ T5803] usb 10-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 135.851235][ T5803] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 135.851255][ T5803] usb 10-1: Product: syz [ 135.851268][ T5803] usb 10-1: Manufacturer: syz [ 135.855445][ T7517] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 135.858528][ T5803] garmin_gps 10-1:1.0: Garmin GPS usb/tty converter detected [ 135.863252][ T5803] usb 10-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 136.439408][ T5803] usb 10-1: USB disconnect, device number 2 [ 136.456698][ T5803] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 136.457198][ T5803] garmin_gps 10-1:1.0: device disconnected [ 136.805670][ T7544] netlink: 16 bytes leftover after parsing attributes in process `syz.2.378'. [ 137.092754][ T43] audit: type=1326 audit(1791062839.832:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7555 comm="syz.2.381" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 137.201243][ T7554] comedi comedi3: dt2817: I/O base address or length out of range [ 137.366528][ T5743] Bluetooth: hci3: command tx timeout [ 137.428871][ T5523] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 137.607790][ T5523] usb 6-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 137.615883][ T5523] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 137.615911][ T5523] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 137.615945][ T5523] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.852519][ T1033] usb 6-1: USB disconnect, device number 10 [ 137.916526][ T5743] Bluetooth: hci0: command 0x2006 tx timeout [ 137.918613][ T5738] Bluetooth: hci0: Opcode 0x2006 failed: -110 [ 138.776632][ T5834] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 139.066859][ T5834] usb 7-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 139.067638][ T5834] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 139.067660][ T5834] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 139.067672][ T5834] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 139.068880][ T5834] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 139.068892][ T5834] usb 7-1: Product: syz [ 139.068899][ T5834] usb 7-1: Manufacturer: syz [ 139.070652][ T7581] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 139.071534][ T5834] garmin_gps 7-1:1.0: Garmin GPS usb/tty converter detected [ 139.073367][ T5834] usb 7-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 139.446432][ T5738] Bluetooth: hci3: command tx timeout [ 139.682404][ T42] usb 7-1: USB disconnect, device number 3 [ 139.691882][ T42] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 139.692214][ T42] garmin_gps 7-1:1.0: device disconnected [ 139.969911][ T43] audit: type=1326 audit(1791062842.712:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7605 comm="syz.5.395" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf709efec code=0x0 [ 140.276775][ T35] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 140.428900][ T35] usb 9-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 140.429866][ T35] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 140.429882][ T35] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 140.429904][ T35] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.138823][ T7646] CIFS: enabling forceuid mount option implicitly because uid= option is specified [ 141.138838][ T7646] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 141.138854][ T7646] CIFS mount error: No usable UNC path provided in device string! [ 141.138854][ T7646] [ 141.139041][ T7646] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 141.796760][ T5803] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 141.873125][ T7663] netlink: 64 bytes leftover after parsing attributes in process `syz.5.411'. [ 141.924352][ T43] audit: type=1326 audit(1791062844.662:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7664 comm="syz.5.412" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf709efec code=0x0 [ 141.947160][ T5803] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 141.948028][ T5803] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 141.948053][ T5803] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 141.948068][ T5803] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 141.949251][ T5803] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 141.949265][ T5803] usb 6-1: Product: syz [ 141.949273][ T5803] usb 6-1: Manufacturer: syz [ 141.952632][ T7657] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 141.953925][ T5803] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 141.958492][ T5803] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 142.349157][ T5803] usb 6-1: USB disconnect, device number 11 [ 142.355498][ T5803] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 142.355803][ T5803] garmin_gps 6-1:1.0: device disconnected [ 142.746477][ T5523] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 142.908011][ T5523] usb 7-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 142.910783][ T5523] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.910806][ T5523] usb 7-1: Product: syz [ 142.910817][ T5523] usb 7-1: Manufacturer: syz [ 142.910828][ T5523] usb 7-1: SerialNumber: syz [ 142.914969][ T5523] usb 7-1: NFC: intf ffff8880009bd000 id ffffffff8fe95de0 [ 142.944912][ T5523] nfcmrvl 7-1:1.0: NFC: registered with nci successfully [ 143.023890][ T1033] usb 9-1: USB disconnect, device number 6 [ 143.141898][ T5808] nfcmrvl 7-1:1.0: NFC: send entry, len 4 [ 143.194587][ T7697] FAULT_INJECTION: forcing a failure. [ 143.194587][ T7697] name failslab, interval 1, probability 0, space 0, times 0 [ 143.194611][ T7697] CPU: 0 UID: 0 PID: 7697 Comm: syz.4.418 Not tainted syzkaller #0 PREEMPT(full) [ 143.194626][ T7697] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 143.194645][ T7697] Call Trace: [ 143.194651][ T7697] [ 143.194656][ T7697] dump_stack_lvl+0x100/0x190 [ 143.194676][ T7697] should_fail_ex.cold+0x5/0xa [ 143.194693][ T7697] should_failslab+0xc2/0x120 [ 143.194712][ T7697] __kvmalloc_node_noprof+0x113/0x9b0 [ 143.194729][ T7697] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 143.194743][ T7697] ? io_uring_setup.cold+0x1f4/0x1c5e [ 143.194763][ T7697] io_uring_setup.cold+0x1f4/0x1c5e [ 143.194781][ T7697] ? find_held_lock+0x2b/0x80 [ 143.194797][ T7697] ? __pfx_io_uring_setup+0x10/0x10 [ 143.194816][ T7697] ? do_futex+0x190/0x440 [ 143.194829][ T7697] ? __pfx_do_futex+0x10/0x10 [ 143.194847][ T7697] ? xfd_validate_state+0x129/0x190 [ 143.194869][ T7697] __ia32_sys_io_uring_setup+0xc2/0x170 [ 143.194880][ T7697] __do_fast_syscall_32+0x13a/0x8b0 [ 143.194898][ T7697] do_fast_syscall_32+0x32/0x70 [ 143.194913][ T7697] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 143.194928][ T7697] RIP: 0023:0xf6fdefec [ 143.194942][ T7697] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 143.194947][ T7697] RSP: 002b:00000000f53ac4bc EFLAGS: 00000282 ORIG_RAX: 00000000000001a9 [ 143.194960][ T7697] RAX: ffffffffffffffda RBX: 0000000000000030 RCX: 0000000080000180 [ 143.194968][ T7697] RDX: 00000000f7140fd7 RSI: 0000000000000001 RDI: 00000000f53ac53c [ 143.194975][ T7697] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 143.194982][ T7697] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 143.194990][ T7697] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 143.195004][ T7697] [ 143.208126][ T7698] kvm: user requested TSC rate below hardware speed [ 143.215151][ T7698] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 144.007557][ T7712] loop9: detected capacity change from 0 to 16384 [ 144.078094][ T7712] loop9: detected capacity change from 16384 to 16383 [ 144.356397][ T5835] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 144.538067][ T5835] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 144.539093][ T5835] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 144.539117][ T5835] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 144.539131][ T5835] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 144.540446][ T5835] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 144.540460][ T5835] usb 6-1: Product: syz [ 144.540468][ T5835] usb 6-1: Manufacturer: syz [ 144.545770][ T7716] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 144.548741][ T5835] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 144.554360][ T5835] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 144.931221][ T5523] usb 6-1: USB disconnect, device number 12 [ 144.943673][ T5523] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 144.944386][ T5523] garmin_gps 6-1:1.0: device disconnected [ 145.484946][ T7672] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 145.485871][ C0] nfcmrvl 7-1:1.0: NFC: urb ffff88802a3aae00 status -2 count 0 [ 145.498991][ T1033] usb 7-1: USB disconnect, device number 4 [ 145.510047][ T1033] usb 7-1: NFC: intf ffff8880009bd000 [ 145.635290][ T7751] netlink: 16 bytes leftover after parsing attributes in process `syz.2.428'. [ 145.797189][ T42] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 145.947146][ T42] usb 6-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 145.948151][ T42] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 145.948176][ T42] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 145.948211][ T42] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.501857][ T43] audit: type=1326 audit(1791062849.242:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7772 comm="syz.2.433" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 146.807693][ T42] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 146.814256][ T5945] IPVS: starting estimator thread 0... [ 146.906612][ T7781] IPVS: using max 43 ests per chain, 103200 per kthread [ 146.977047][ T42] usb 9-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 146.977961][ T42] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 146.977984][ T42] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 146.977996][ T42] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 146.979265][ T42] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 146.979283][ T42] usb 9-1: Product: syz [ 146.979290][ T42] usb 9-1: Manufacturer: syz [ 146.985025][ T7775] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 146.987118][ T42] garmin_gps 9-1:1.0: Garmin GPS usb/tty converter detected [ 146.990597][ T42] usb 9-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 147.385048][ T42] usb 9-1: USB disconnect, device number 7 [ 147.393184][ T42] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 147.393950][ T42] garmin_gps 9-1:1.0: device disconnected [ 147.422460][ T7787] jffs2: notice: (7787) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 147.472928][ T43] audit: type=1326 audit(1791062850.212:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7789 comm="syz.2.437" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 148.492244][ T43] audit: type=1326 audit(1791062851.232:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7816 comm="syz.2.444" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 148.581477][ T42] usb 6-1: USB disconnect, device number 13 [ 148.637690][ T5834] usb 10-1: new full-speed USB device number 3 using dummy_hcd [ 148.800462][ T5834] usb 10-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice=7a.5a [ 148.809118][ T5834] usb 10-1: config 0 has an invalid interface number: 143 but max is 0 [ 148.809142][ T5834] usb 10-1: config 0 has an invalid descriptor of length 129, skipping remainder of the config [ 148.809159][ T5834] usb 10-1: config 0 has no interface number 0 [ 148.809182][ T5834] usb 10-1: too many endpoints for config 0 interface 143 altsetting 112: 149, using maximum allowed: 30 [ 148.809212][ T5834] usb 10-1: config 0 interface 143 altsetting 112 has 0 endpoint descriptors, different from the interface descriptor's value: 149 [ 148.809237][ T5834] usb 10-1: config 0 interface 143 has no altsetting 0 [ 148.812880][ T5834] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.812905][ T5834] usb 10-1: Product: syz [ 148.812918][ T5834] usb 10-1: Manufacturer: syz [ 148.812931][ T5834] usb 10-1: SerialNumber: syz [ 148.822002][ T5834] usb 10-1: config 0 descriptor?? [ 149.035093][ T5834] usb 10-1: USB disconnect, device number 3 [ 149.526589][ T5835] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 149.696445][ T5835] usb 10-1: Using ep0 maxpacket: 16 [ 149.697165][ T5835] usb 10-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice=7a.5a [ 149.703840][ T5835] usb 10-1: config 0 has an invalid interface number: 143 but max is 0 [ 149.703863][ T5835] usb 10-1: config 0 has an invalid descriptor of length 129, skipping remainder of the config [ 149.703878][ T5835] usb 10-1: config 0 has no interface number 0 [ 149.703898][ T5835] usb 10-1: too many endpoints for config 0 interface 143 altsetting 112: 149, using maximum allowed: 30 [ 149.703929][ T5835] usb 10-1: config 0 interface 143 altsetting 112 has 0 endpoint descriptors, different from the interface descriptor's value: 149 [ 149.705077][ T5835] usb 10-1: config 0 interface 143 has no altsetting 0 [ 149.707774][ T5835] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.707791][ T5835] usb 10-1: Product: syz [ 149.707801][ T5835] usb 10-1: Manufacturer: syz [ 149.707810][ T5835] usb 10-1: SerialNumber: syz [ 149.711731][ T5835] usb 10-1: config 0 descriptor?? [ 149.931772][ T7831] netlink: 8 bytes leftover after parsing attributes in process `syz.4.447'. [ 150.076607][ T58] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 150.239366][ T58] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 150.241955][ T58] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 150.241983][ T58] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 150.241997][ T58] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 150.243610][ T58] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 150.243633][ T58] usb 6-1: Product: syz [ 150.243646][ T58] usb 6-1: Manufacturer: syz [ 150.251145][ T7840] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 150.273587][ T58] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 150.279144][ T58] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 150.486567][ T35] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 150.648427][ T35] usb 7-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 150.649965][ T35] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 150.649991][ T35] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 150.650009][ T35] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 150.655378][ T1033] usb 6-1: USB disconnect, device number 14 [ 150.710480][ T1033] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 150.710932][ T1033] garmin_gps 6-1:1.0: device disconnected [ 151.231919][ T43] audit: type=1326 audit(1791062853.972:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7874 comm="syz.1.456" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf706efec code=0x0 [ 151.284346][ T7876] misc userio: Invalid payload size [ 151.342706][ T5835] usb 10-1: USB disconnect, device number 4 [ 152.025120][ T7885] netlink: 8752 bytes leftover after parsing attributes in process `syz.4.459'. [ 152.403717][ T7906] FAULT_INJECTION: forcing a failure. [ 152.403717][ T7906] name failslab, interval 1, probability 0, space 0, times 0 [ 152.403748][ T7906] CPU: 3 UID: 0 PID: 7906 Comm: syz.1.465 Not tainted syzkaller #0 PREEMPT(full) [ 152.403767][ T7906] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 152.403777][ T7906] Call Trace: [ 152.403784][ T7906] [ 152.403791][ T7906] dump_stack_lvl+0x100/0x190 [ 152.403828][ T7906] should_fail_ex.cold+0x5/0xa [ 152.403852][ T7906] should_failslab+0xc2/0x120 [ 152.403879][ T7906] __kmalloc_noprof+0xfc/0x840 [ 152.403901][ T7906] ? __pfx_dynamic_dname+0x10/0x10 [ 152.403921][ T7906] ? tomoyo_encode2+0xfb/0x3c0 [ 152.403947][ T7906] tomoyo_encode2+0xfb/0x3c0 [ 152.403973][ T7906] tomoyo_encode+0x29/0x50 [ 152.403994][ T7906] tomoyo_realpath_from_path+0x18c/0x690 [ 152.404022][ T7906] tomoyo_path_number_perm+0x23c/0x580 [ 152.404041][ T7906] ? tomoyo_path_number_perm+0x22e/0x580 [ 152.404061][ T7906] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 152.404082][ T7906] ? get_pid_task+0x106/0x250 [ 152.404109][ T7906] ? __lock_acquire+0x5c0/0x1f40 [ 152.404149][ T7906] ? __fget_files+0x34/0x3d0 [ 152.404172][ T7906] ? find_held_lock+0x2b/0x80 [ 152.404193][ T7906] ? __fget_files+0x215/0x3d0 [ 152.404215][ T7906] ? hook_file_ioctl_common+0x140/0x440 [ 152.404235][ T7906] ? __fget_files+0x215/0x3d0 [ 152.404263][ T7906] ? __fget_files+0x21f/0x3d0 [ 152.404291][ T7906] security_file_ioctl_compat+0xd3/0x230 [ 152.404312][ T7906] __ia32_compat_sys_ioctl+0xc2/0x360 [ 152.404336][ T7906] __do_fast_syscall_32+0x13a/0x8b0 [ 152.404377][ T7906] ? lockdep_hardirqs_on+0x7d/0x110 [ 152.404403][ T7906] do_fast_syscall_32+0x32/0x70 [ 152.404427][ T7906] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 152.404450][ T7906] RIP: 0023:0xf706efec [ 152.404469][ T7906] Code: Unable to access opcode bytes at 0xf706efc2. [ 152.404477][ T7906] RSP: 002b:00000000f543c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 152.404495][ T7906] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c028aa05 [ 152.404507][ T7906] RDX: 0000000080000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 152.404517][ T7906] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 152.404528][ T7906] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 152.404540][ T7906] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 152.404564][ T7906] [ 152.404717][ T7906] ERROR: Out of memory at tomoyo_realpath_from_path. [ 152.566449][ T5523] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 152.719405][ T5523] usb 10-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 152.720263][ T5523] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 152.720287][ T5523] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 152.720300][ T5523] usb 10-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 152.721653][ T5523] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 152.721666][ T5523] usb 10-1: Product: syz [ 152.721673][ T5523] usb 10-1: Manufacturer: syz [ 152.725986][ T7899] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 152.754694][ T5523] garmin_gps 10-1:1.0: Garmin GPS usb/tty converter detected [ 152.765478][ T5523] usb 10-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 153.109382][ T5523] usb 10-1: USB disconnect, device number 5 [ 153.114130][ T5523] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 153.114623][ T5523] garmin_gps 10-1:1.0: device disconnected [ 153.259657][ T5835] usb 7-1: USB disconnect, device number 5 [ 153.505738][ T43] audit: type=1326 audit(1791062856.242:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7922 comm="syz.2.470" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 153.557212][ T7924] misc userio: Invalid payload size [ 153.929331][ T7929] netlink: 8 bytes leftover after parsing attributes in process `syz.5.471'. [ 154.538961][ T43] audit: type=1326 audit(1791062857.282:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7940 comm="syz.4.474" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fdefec code=0x0 [ 154.625314][ T7946] netlink: 4 bytes leftover after parsing attributes in process `syz.5.475'. [ 154.823729][ T7960] FAULT_INJECTION: forcing a failure. [ 154.823729][ T7960] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 154.823766][ T7960] CPU: 2 UID: 0 PID: 7960 Comm: syz.5.480 Not tainted syzkaller #0 PREEMPT(full) [ 154.823785][ T7960] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 154.823796][ T7960] Call Trace: [ 154.823803][ T7960] [ 154.823810][ T7960] dump_stack_lvl+0x100/0x190 [ 154.823833][ T7960] should_fail_ex.cold+0x5/0xa [ 154.823848][ T7960] _copy_to_iter+0x5a4/0x1720 [ 154.823867][ T7960] ? __pfx__copy_to_iter+0x10/0x10 [ 154.823883][ T7960] ? __up_read+0x333/0x980 [ 154.823895][ T7960] ? __pfx___up_read+0x10/0x10 [ 154.823905][ T7960] ? seq_read_iter+0xd33/0x1270 [ 154.823919][ T7960] ? seq_read_iter+0xd33/0x1270 [ 154.823935][ T7960] seq_read_iter+0xdab/0x1270 [ 154.823954][ T7960] seq_read+0x344/0x4d0 [ 154.823967][ T7960] ? __pfx_seq_read+0x10/0x10 [ 154.823980][ T7960] ? lock_acquire+0x1d1/0x380 [ 154.824001][ T7960] ? common_file_perm+0x266/0x500 [ 154.824017][ T7960] ? rw_verify_area+0xce/0x6d0 [ 154.824029][ T7960] ? __pfx_seq_read+0x10/0x10 [ 154.824042][ T7960] vfs_read+0x1e4/0xb40 [ 154.824055][ T7960] ? lock_acquire+0x1d1/0x380 [ 154.824071][ T7960] ? __fget_files+0x34/0x3d0 [ 154.824085][ T7960] ? __pfx_vfs_read+0x10/0x10 [ 154.824097][ T7960] ? find_held_lock+0x2b/0x80 [ 154.824114][ T7960] ? __fget_files+0x215/0x3d0 [ 154.824139][ T7960] ? __fget_files+0x21f/0x3d0 [ 154.824169][ T7960] ksys_read+0x12a/0x250 [ 154.824189][ T7960] ? __pfx_ksys_read+0x10/0x10 [ 154.824209][ T7960] ? ksys_write+0x1ac/0x250 [ 154.824230][ T7960] ? __pfx_ksys_write+0x10/0x10 [ 154.824253][ T7960] __do_fast_syscall_32+0x13a/0x8b0 [ 154.824270][ T7960] ? lockdep_hardirqs_on+0x7d/0x110 [ 154.824284][ T7960] do_fast_syscall_32+0x32/0x70 [ 154.824299][ T7960] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 154.824313][ T7960] RIP: 0023:0xf709efec [ 154.824326][ T7960] Code: Unable to access opcode bytes at 0xf709efc2. [ 154.824331][ T7960] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000003 [ 154.824342][ T7960] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000180 [ 154.824349][ T7960] RDX: 0000000000001000 RSI: 0000000000000000 RDI: 0000000000000000 [ 154.824355][ T7960] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 154.824361][ T7960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 154.824368][ T7960] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 154.824381][ T7960] [ 154.906403][ T30] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 155.057435][ T30] usb 7-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 155.058242][ T30] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 155.058256][ T30] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 155.058273][ T30] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 155.199308][ T7968] netlink: 4 bytes leftover after parsing attributes in process `syz.5.484'. [ 155.302977][ T43] audit: type=1326 audit(1791062858.042:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7970 comm="syz.5.485" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf709efec code=0x0 [ 155.359708][ T7973] misc userio: Invalid payload size [ 155.508705][ T30] usb 7-1: USB disconnect, device number 6 [ 155.638691][ T7983] FAULT_INJECTION: forcing a failure. [ 155.638691][ T7983] name failslab, interval 1, probability 0, space 0, times 0 [ 155.638723][ T7983] CPU: 2 UID: 0 PID: 7983 Comm: syz.1.487 Not tainted syzkaller #0 PREEMPT(full) [ 155.638746][ T7983] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 155.638758][ T7983] Call Trace: [ 155.638765][ T7983] [ 155.638773][ T7983] dump_stack_lvl+0x100/0x190 [ 155.638804][ T7983] should_fail_ex.cold+0x5/0xa [ 155.638837][ T7983] should_failslab+0xc2/0x120 [ 155.638867][ T7983] __kmalloc_noprof+0xfc/0x840 [ 155.638892][ T7983] ? __pfx_dynamic_dname+0x10/0x10 [ 155.638931][ T7983] ? tomoyo_encode2+0xfb/0x3c0 [ 155.638962][ T7983] tomoyo_encode2+0xfb/0x3c0 [ 155.638990][ T7983] tomoyo_encode+0x29/0x50 [ 155.639014][ T7983] tomoyo_realpath_from_path+0x18c/0x690 [ 155.639046][ T7983] tomoyo_path_number_perm+0x23c/0x580 [ 155.639066][ T7983] ? tomoyo_path_number_perm+0x22e/0x580 [ 155.639089][ T7983] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 155.639112][ T7983] ? get_pid_task+0x106/0x250 [ 155.639141][ T7983] ? __lock_acquire+0x5c0/0x1f40 [ 155.639182][ T7983] ? __fget_files+0x34/0x3d0 [ 155.639208][ T7983] ? find_held_lock+0x2b/0x80 [ 155.639230][ T7983] ? __fget_files+0x215/0x3d0 [ 155.639253][ T7983] ? hook_file_ioctl_common+0x140/0x440 [ 155.639274][ T7983] ? __fget_files+0x215/0x3d0 [ 155.639303][ T7983] ? __fget_files+0x21f/0x3d0 [ 155.639332][ T7983] security_file_ioctl_compat+0xd3/0x230 [ 155.639356][ T7983] __ia32_compat_sys_ioctl+0xc2/0x360 [ 155.639383][ T7983] __do_fast_syscall_32+0x13a/0x8b0 [ 155.639409][ T7983] ? lockdep_hardirqs_on+0x7d/0x110 [ 155.639435][ T7983] do_fast_syscall_32+0x32/0x70 [ 155.639462][ T7983] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 155.639487][ T7983] RIP: 0023:0xf706efec [ 155.639509][ T7983] Code: Unable to access opcode bytes at 0xf706efc2. [ 155.639518][ T7983] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 155.639538][ T7983] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000008954 [ 155.639551][ T7983] RDX: 0000000080000240 RSI: 0000000000000000 RDI: 0000000000000000 [ 155.639563][ T7983] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 155.639575][ T7983] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 155.639586][ T7983] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 155.639613][ T7983] [ 155.639728][ T7983] ERROR: Out of memory at tomoyo_realpath_from_path. [ 156.306434][ T5834] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 156.406695][ T7994] FAULT_INJECTION: forcing a failure. [ 156.406695][ T7994] name failslab, interval 1, probability 0, space 0, times 0 [ 156.406728][ T7994] CPU: 2 UID: 0 PID: 7994 Comm: syz.5.493 Not tainted syzkaller #0 PREEMPT(full) [ 156.406749][ T7994] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 156.406760][ T7994] Call Trace: [ 156.406767][ T7994] [ 156.406775][ T7994] dump_stack_lvl+0x100/0x190 [ 156.406806][ T7994] should_fail_ex.cold+0x5/0xa [ 156.406832][ T7994] should_failslab+0xc2/0x120 [ 156.406861][ T7994] __kmalloc_noprof+0xfc/0x840 [ 156.406891][ T7994] ? tomoyo_encode2+0xfb/0x3c0 [ 156.406920][ T7994] tomoyo_encode2+0xfb/0x3c0 [ 156.406946][ T7994] tomoyo_encode+0x29/0x50 [ 156.406968][ T7994] tomoyo_realpath_from_path+0x18c/0x690 [ 156.406998][ T7994] tomoyo_path_number_perm+0x23c/0x580 [ 156.407017][ T7994] ? tomoyo_path_number_perm+0x22e/0x580 [ 156.407039][ T7994] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 156.407060][ T7994] ? get_pid_task+0x106/0x250 [ 156.407087][ T7994] ? __lock_acquire+0x5c0/0x1f40 [ 156.407126][ T7994] ? __fget_files+0x34/0x3d0 [ 156.407151][ T7994] ? find_held_lock+0x2b/0x80 [ 156.407172][ T7994] ? __fget_files+0x215/0x3d0 [ 156.407193][ T7994] ? hook_file_ioctl_common+0x140/0x440 [ 156.407213][ T7994] ? __fget_files+0x215/0x3d0 [ 156.407240][ T7994] ? __fget_files+0x21f/0x3d0 [ 156.407267][ T7994] security_file_ioctl_compat+0xd3/0x230 [ 156.407290][ T7994] __ia32_compat_sys_ioctl+0xc2/0x360 [ 156.407315][ T7994] __do_fast_syscall_32+0x13a/0x8b0 [ 156.407343][ T7994] ? lockdep_hardirqs_on+0x7d/0x110 [ 156.407384][ T7994] do_fast_syscall_32+0x32/0x70 [ 156.407409][ T7994] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 156.407432][ T7994] RIP: 0023:0xf709efec [ 156.407454][ T7994] Code: Unable to access opcode bytes at 0xf709efc2. [ 156.407462][ T7994] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 156.407481][ T7994] RAX: ffffffffffffffda RBX: 0000000000000011 RCX: 00000000c03864bc [ 156.407493][ T7994] RDX: 0000000080000180 RSI: 0000000000000000 RDI: 0000000000000000 [ 156.407504][ T7994] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 156.407515][ T7994] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 156.407526][ T7994] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 156.407552][ T7994] [ 156.409671][ T7994] ERROR: Out of memory at tomoyo_realpath_from_path. [ 156.456472][ T5834] usb 6-1: Using ep0 maxpacket: 32 [ 156.459388][ T5834] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 156.461458][ T5834] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 156.461483][ T5834] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 156.461511][ T5834] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 156.461542][ T5834] usb 6-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 156.461568][ T5834] usb 6-1: config 0 interface 0 has no altsetting 0 [ 156.464174][ T5834] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 156.464198][ T5834] usb 6-1: Product: syz [ 156.464213][ T5834] usb 6-1: Manufacturer: syz [ 156.464227][ T5834] usb 6-1: SerialNumber: syz [ 156.472093][ T5834] usb 6-1: config 0 descriptor?? [ 156.478828][ T5834] ldusb 6-1:0.0: Interrupt in endpoint not found [ 156.675083][ T7991] FAULT_INJECTION: forcing a failure. [ 156.675083][ T7991] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 156.675105][ T7991] CPU: 3 UID: 0 PID: 7991 Comm: syz.1.491 Not tainted syzkaller #0 PREEMPT(full) [ 156.675118][ T7991] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 156.675124][ T7991] Call Trace: [ 156.675129][ T7991] [ 156.675134][ T7991] dump_stack_lvl+0x100/0x190 [ 156.675153][ T7991] should_fail_ex.cold+0x5/0xa [ 156.675168][ T7991] strncpy_from_user+0x3b/0x2d0 [ 156.675187][ T7991] do_getname+0x78/0x390 [ 156.675212][ T7991] do_sys_openat2+0xc7/0x1e0 [ 156.675232][ T7991] ? __pfx_do_sys_openat2+0x10/0x10 [ 156.675249][ T7991] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 156.675266][ T7991] ? __fget_files+0x21f/0x3d0 [ 156.675282][ T7991] __ia32_compat_sys_openat+0x12d/0x210 [ 156.675294][ T7991] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 156.675305][ T7991] ? ksys_write+0x1ac/0x250 [ 156.675330][ T7991] do_int80_emulation+0x166/0x650 [ 156.675346][ T7991] asm_int80_emulation+0x1a/0x20 [ 156.675358][ T7991] RIP: 0023:0xf71a75ab [ 156.675368][ T7991] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 156.675379][ T7991] RSP: 002b:00000000f545d03c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 156.675391][ T7991] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f545d100 [ 156.675398][ T7991] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 156.675405][ T7991] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 156.675411][ T7991] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 156.675418][ T7991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 156.675431][ T7991] [ 156.700012][ T58] usb 6-1: USB disconnect, device number 15 [ 156.978620][ T43] audit: type=1326 audit(1791062859.722:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8017 comm="syz.5.501" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf709efec code=0x0 [ 157.126456][ T50] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 157.211331][ T8022] FAULT_INJECTION: forcing a failure. [ 157.211331][ T8022] name failslab, interval 1, probability 0, space 0, times 0 [ 157.211353][ T8022] CPU: 2 UID: 0 PID: 8022 Comm: syz.1.502 Not tainted syzkaller #0 PREEMPT(full) [ 157.211366][ T8022] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 157.211372][ T8022] Call Trace: [ 157.211377][ T8022] [ 157.211381][ T8022] dump_stack_lvl+0x100/0x190 [ 157.211400][ T8022] should_fail_ex.cold+0x5/0xa [ 157.211416][ T8022] should_failslab+0xc2/0x120 [ 157.211432][ T8022] __kmalloc_noprof+0xfc/0x840 [ 157.211446][ T8022] ? rcu_is_watching+0x13/0xc0 [ 157.211459][ T8022] ? tomoyo_realpath_from_path+0xb6/0x690 [ 157.211476][ T8022] tomoyo_realpath_from_path+0xb6/0x690 [ 157.211493][ T8022] tomoyo_path_number_perm+0x23c/0x580 [ 157.211505][ T8022] ? tomoyo_path_number_perm+0x22e/0x580 [ 157.211517][ T8022] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 157.211529][ T8022] ? get_pid_task+0x106/0x250 [ 157.211546][ T8022] ? __lock_acquire+0x5c0/0x1f40 [ 157.211568][ T8022] ? __fget_files+0x34/0x3d0 [ 157.211583][ T8022] ? find_held_lock+0x2b/0x80 [ 157.211595][ T8022] ? __fget_files+0x215/0x3d0 [ 157.211608][ T8022] ? hook_file_ioctl_common+0x140/0x440 [ 157.211620][ T8022] ? __fget_files+0x215/0x3d0 [ 157.211636][ T8022] ? __fget_files+0x21f/0x3d0 [ 157.211652][ T8022] security_file_ioctl_compat+0xd3/0x230 [ 157.211666][ T8022] __ia32_compat_sys_ioctl+0xc2/0x360 [ 157.211680][ T8022] __do_fast_syscall_32+0x13a/0x8b0 [ 157.211695][ T8022] ? lockdep_hardirqs_on+0x7d/0x110 [ 157.211709][ T8022] do_fast_syscall_32+0x32/0x70 [ 157.211724][ T8022] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 157.211738][ T8022] RIP: 0023:0xf706efec [ 157.211751][ T8022] Code: Unable to access opcode bytes at 0xf706efc2. [ 157.211761][ T8022] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 157.211773][ T8022] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000008b05 [ 157.211780][ T8022] RDX: 0000000080000880 RSI: 0000000000000000 RDI: 0000000000000000 [ 157.211786][ T8022] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 157.211793][ T8022] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 157.211799][ T8022] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 157.211813][ T8022] [ 157.211817][ T8022] ERROR: Out of memory at tomoyo_realpath_from_path. [ 157.211828][ T8022] warning: `syz.1.502' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 157.242307][ T8024] netlink: 64 bytes leftover after parsing attributes in process `syz.1.503'. [ 157.319183][ T50] usb 9-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 157.320043][ T50] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 157.320058][ T50] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 157.320076][ T50] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.759627][ T5835] usb 9-1: USB disconnect, device number 8 [ 157.946081][ T8042] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 158.789229][ T8050] netlink: 64 bytes leftover after parsing attributes in process `syz.4.512'. [ 159.694739][ T43] audit: type=1326 audit(1791062862.432:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8064 comm="syz.5.517" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf709efec code=0x0 [ 160.036656][ T30] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 160.196930][ T30] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 160.197702][ T30] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 160.197729][ T30] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 160.197743][ T30] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 160.198848][ T30] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 160.198861][ T30] usb 6-1: Product: syz [ 160.198869][ T30] usb 6-1: Manufacturer: syz [ 160.203056][ T8071] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 160.204210][ T30] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 160.206786][ T30] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 160.206972][ T50] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 160.377365][ T50] usb 9-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 160.378414][ T50] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 160.378429][ T50] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 160.378447][ T50] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 160.501496][ T50] usb 6-1: USB disconnect, device number 16 [ 160.504348][ T50] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 160.507033][ T50] garmin_gps 6-1:1.0: device disconnected [ 160.607308][ T8081] FAULT_INJECTION: forcing a failure. [ 160.607308][ T8081] name failslab, interval 1, probability 0, space 0, times 0 [ 160.607330][ T8081] CPU: 1 UID: 0 PID: 8081 Comm: syz.2.531 Not tainted syzkaller #0 PREEMPT(full) [ 160.607343][ T8081] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 160.607350][ T8081] Call Trace: [ 160.607354][ T8081] [ 160.607359][ T8081] dump_stack_lvl+0x100/0x190 [ 160.607383][ T8081] should_fail_ex.cold+0x5/0xa [ 160.607400][ T8081] should_failslab+0xc2/0x120 [ 160.607417][ T8081] __kmalloc_noprof+0xfc/0x840 [ 160.607431][ T8081] ? tomoyo_encode2+0xfb/0x3c0 [ 160.607448][ T8081] tomoyo_encode2+0xfb/0x3c0 [ 160.607463][ T8081] tomoyo_encode+0x29/0x50 [ 160.607476][ T8081] tomoyo_realpath_from_path+0x18c/0x690 [ 160.607494][ T8081] tomoyo_path_number_perm+0x23c/0x580 [ 160.607505][ T8081] ? tomoyo_path_number_perm+0x22e/0x580 [ 160.607518][ T8081] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 160.607544][ T8081] ? get_pid_task+0x106/0x250 [ 160.607562][ T8081] ? __lock_acquire+0x5c0/0x1f40 [ 160.607585][ T8081] ? __fget_files+0x34/0x3d0 [ 160.607599][ T8081] ? find_held_lock+0x2b/0x80 [ 160.607612][ T8081] ? __fget_files+0x215/0x3d0 [ 160.607625][ T8081] ? hook_file_ioctl_common+0x140/0x440 [ 160.607637][ T8081] ? __fget_files+0x215/0x3d0 [ 160.607653][ T8081] ? __fget_files+0x21f/0x3d0 [ 160.607669][ T8081] security_file_ioctl_compat+0xd3/0x230 [ 160.607683][ T8081] __ia32_compat_sys_ioctl+0xc2/0x360 [ 160.607697][ T8081] __do_fast_syscall_32+0x13a/0x8b0 [ 160.607713][ T8081] ? lockdep_hardirqs_on+0x7d/0x110 [ 160.607727][ T8081] do_fast_syscall_32+0x32/0x70 [ 160.607742][ T8081] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 160.607756][ T8081] RIP: 0023:0xf705efec [ 160.607770][ T8081] Code: Unable to access opcode bytes at 0xf705efc2. [ 160.607774][ T8081] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 160.607786][ T8081] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000c0306201 [ 160.607793][ T8081] RDX: 00000000800001c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 160.607799][ T8081] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 160.607806][ T8081] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 160.607812][ T8081] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 160.607826][ T8081] [ 160.607847][ T8081] ERROR: Out of memory at tomoyo_realpath_from_path. [ 160.632449][ T43] audit: type=1326 audit(1791062863.372:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8082 comm="syz.5.523" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf709efec code=0x0 [ 160.697639][ T8087] misc userio: Invalid payload size [ 160.820482][ T50] usb 9-1: USB disconnect, device number 9 [ 160.858406][ T8095] netlink: 256 bytes leftover after parsing attributes in process `syz.2.525'. [ 160.919430][ T8093] trusted_key: syz.2.525 sent an empty control message without MSG_MORE. [ 161.493860][ T43] audit: type=1326 audit(1791062864.232:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8113 comm="syz.4.532" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fdefec code=0x0 [ 162.376958][ T50] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 162.528628][ T50] usb 6-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 162.530040][ T50] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 162.530056][ T50] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 162.530075][ T50] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.624568][ T43] audit: type=1326 audit(1791062865.362:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8143 comm="syz.4.542" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fdefec code=0x0 [ 162.671488][ T8146] netlink: 64 bytes leftover after parsing attributes in process `syz.5.543'. [ 162.682688][ T8147] misc userio: Invalid payload size [ 162.968960][ T9] usb 6-1: USB disconnect, device number 17 [ 163.281040][ T8155] netlink: 40 bytes leftover after parsing attributes in process `syz.2.544'. [ 163.608869][ T43] audit: type=1326 audit(1791062866.352:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8168 comm="syz.4.550" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fdefec code=0x0 [ 163.732635][ T5743] Bluetooth: hci0: unexpected event for opcode 0x0c6d [ 164.553045][ T8190] netlink: 64 bytes leftover after parsing attributes in process `syz.4.556'. [ 164.866545][ T5523] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 165.017219][ T5523] usb 7-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 165.018243][ T5523] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 165.018265][ T5523] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 165.018294][ T5523] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 165.116564][ T5743] Bluetooth: hci1: command 0x0406 tx timeout [ 165.292738][ T8200] pci_bus 0000:01: busn_res: [bus 01] is released [ 165.328306][ T8203] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 165.332661][ T8203] pci 0000:00:04.0: PCI bridge to [bus 01] [ 165.332868][ T8203] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 165.332991][ T8203] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 165.334881][ T8203] pci 0000:00:04.0: bridge window [mem 0xfe000000-0xfe1fffff 64bit pref] [ 165.336787][ T8203] pci 0000:00:04.0: enabling Extended Tags [ 165.355583][ T8203] pci 0000:00:04.0: Adding to iommu group 4 [ 165.380750][ T8203] pci 0000:00:04.0: PCI bridge to [bus 01] [ 165.384320][ T8203] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 165.384372][ T8203] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 165.384493][ T8203] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 165.384519][ T8203] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 165.384546][ T8203] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 165.384696][ T8203] pci 0000:00:04.0: PCI bridge to [bus 01] [ 165.384784][ T8203] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 165.387599][ T8203] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 165.389196][ T8203] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 165.462067][ T9] usb 7-1: USB disconnect, device number 7 [ 165.484659][ T8203] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 165.494053][ T8203] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 165.580395][ T8215] netlink: 64 bytes leftover after parsing attributes in process `syz.5.562'. [ 166.051058][ T8219] FAULT_INJECTION: forcing a failure. [ 166.051058][ T8219] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 166.051087][ T8219] CPU: 0 UID: 0 PID: 8219 Comm: syz.1.563 Not tainted syzkaller #0 PREEMPT(full) [ 166.051105][ T8219] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 166.051115][ T8219] Call Trace: [ 166.051121][ T8219] [ 166.051128][ T8219] dump_stack_lvl+0x100/0x190 [ 166.051154][ T8219] should_fail_ex.cold+0x5/0xa [ 166.051177][ T8219] _copy_to_user+0x32/0xd0 [ 166.051202][ T8219] bpf_prog_test_run_raw_tp+0x3f0/0x7d0 [ 166.051247][ T8219] ? __pfx_bpf_prog_test_run_raw_tp+0x10/0x10 [ 166.051273][ T8219] ? fput+0x7c/0x100 [ 166.051296][ T8219] ? __bpf_prog_get+0x97/0x290 [ 166.051320][ T8219] ? __pfx_bpf_prog_test_run_raw_tp+0x10/0x10 [ 166.051344][ T8219] __sys_bpf+0x2265/0x4a30 [ 166.051368][ T8219] ? __pfx___sys_bpf+0x10/0x10 [ 166.051384][ T8219] ? lock_acquire+0x1d1/0x380 [ 166.051407][ T8219] ? get_pid_task+0x2a/0x250 [ 166.051426][ T8219] ? find_held_lock+0x2b/0x80 [ 166.051444][ T8219] ? get_pid_task+0xfc/0x250 [ 166.051460][ T8219] ? get_pid_task+0xfc/0x250 [ 166.051483][ T8219] ? proc_fail_nth_write+0x9f/0x220 [ 166.051503][ T8219] ? find_held_lock+0x2b/0x80 [ 166.051526][ T8219] ? rcu_read_lock_any_held+0x6a/0x90 [ 166.051546][ T8219] ? find_held_lock+0x2b/0x80 [ 166.051564][ T8219] ? ksys_write+0x190/0x250 [ 166.051583][ T8219] ? ksys_write+0x190/0x250 [ 166.051602][ T8219] ? lock_acquire+0x1d1/0x380 [ 166.051640][ T8219] ? fput+0x7c/0x100 [ 166.051665][ T8219] ? __ia32_sys_bpf+0xcc/0x170 [ 166.051683][ T8219] __ia32_sys_bpf+0xcc/0x170 [ 166.051712][ T8219] ? __do_fast_syscall_32+0xb3/0x8b0 [ 166.051736][ T8219] __do_fast_syscall_32+0x13a/0x8b0 [ 166.051756][ T8219] ? lockdep_hardirqs_on+0x7d/0x110 [ 166.051777][ T8219] do_fast_syscall_32+0x32/0x70 [ 166.051799][ T8219] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 166.051818][ T8219] RIP: 0023:0xf706efec [ 166.051836][ T8219] Code: Unable to access opcode bytes at 0xf706efc2. [ 166.051843][ T8219] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 166.051860][ T8219] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000080 [ 166.051871][ T8219] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 166.051881][ T8219] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 166.051891][ T8219] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 166.051901][ T8219] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 166.051923][ T8219] [ 166.088528][ T43] audit: type=1326 audit(1791062868.832:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8220 comm="syz.2.564" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 166.617004][ T5092] Bluetooth: hci0: unexpected event for opcode 0x0c6d [ 166.915220][ T8243] FAULT_INJECTION: forcing a failure. [ 166.915220][ T8243] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 166.915253][ T8243] CPU: 1 UID: 0 PID: 8243 Comm: syz.4.567 Not tainted syzkaller #0 PREEMPT(full) [ 166.915288][ T8243] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 166.915300][ T8243] Call Trace: [ 166.915307][ T8243] [ 166.915315][ T8243] dump_stack_lvl+0x100/0x190 [ 166.915344][ T8243] should_fail_ex.cold+0x5/0xa [ 166.915373][ T8243] _copy_to_iter+0x5a4/0x1720 [ 166.915398][ T8243] ? __pfx___skb_try_recv_datagram+0x10/0x10 [ 166.915425][ T8243] ? __pfx__copy_to_iter+0x10/0x10 [ 166.915450][ T8243] ? up_write+0x2dc/0x5b0 [ 166.915469][ T8243] ? __skb_recv_datagram+0x1b2/0x220 [ 166.915498][ T8243] simple_copy_to_iter+0x46/0x90 [ 166.915524][ T8243] __skb_datagram_iter+0x129/0x900 [ 166.915545][ T8243] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 166.915573][ T8243] ? skb_recv_datagram+0x88/0xc0 [ 166.915606][ T8243] skb_copy_datagram_iter+0xa1/0x250 [ 166.915631][ T8243] netlink_recvmsg+0x27e/0xa90 [ 166.915657][ T8243] ? __pfx_netlink_recvmsg+0x10/0x10 [ 166.915686][ T8243] ? aa_sock_msg_perm+0x11e/0x200 [ 166.915714][ T8243] ? __pfx_netlink_recvmsg+0x10/0x10 [ 166.915740][ T8243] sock_recvmsg+0x1d5/0x220 [ 166.915760][ T8243] ____sys_recvmsg+0x21e/0x670 [ 166.915786][ T8243] ? __pfx_____sys_recvmsg+0x10/0x10 [ 166.915811][ T8243] ? __lock_acquire+0x5c0/0x1f40 [ 166.915831][ T8243] ___sys_recvmsg+0x16a/0x1a0 [ 166.915846][ T8243] ? __pfx____sys_recvmsg+0x10/0x10 [ 166.915863][ T8243] ? lock_acquire+0x1d1/0x380 [ 166.915889][ T8243] do_recvmmsg+0x54d/0x740 [ 166.915906][ T8243] ? __pfx_do_recvmmsg+0x10/0x10 [ 166.915921][ T8243] ? find_held_lock+0x2b/0x80 [ 166.915934][ T8243] ? ksys_write+0x190/0x250 [ 166.915946][ T8243] ? ksys_write+0x190/0x250 [ 166.915964][ T8243] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 166.915982][ T8243] __sys_recvmmsg+0x21f/0x270 [ 166.915994][ T8243] ? __pfx___sys_recvmmsg+0x10/0x10 [ 166.916006][ T8243] ? ksys_write+0x1ac/0x250 [ 166.916020][ T8243] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 166.916036][ T8243] ? __do_fast_syscall_32+0xb3/0x8b0 [ 166.916051][ T8243] ? lockdep_hardirqs_on+0x7d/0x110 [ 166.916064][ T8243] __do_fast_syscall_32+0x13a/0x8b0 [ 166.916078][ T8243] ? lockdep_hardirqs_on+0x7d/0x110 [ 166.916092][ T8243] do_fast_syscall_32+0x32/0x70 [ 166.916107][ T8243] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 166.916122][ T8243] RIP: 0023:0xf6fdefec [ 166.916136][ T8243] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 166.916141][ T8243] RSP: 002b:00000000f538b50c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 166.916153][ T8243] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080001640 [ 166.916160][ T8243] RDX: 0000000000000300 RSI: 0000000000034000 RDI: 0000000000000000 [ 166.916166][ T8243] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 166.916173][ T8243] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 166.916179][ T8243] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 166.916193][ T8243] [ 167.206405][ T5738] Bluetooth: hci0: Opcode 0x2006 failed: -110 [ 168.164031][ T8261] FAULT_INJECTION: forcing a failure. [ 168.164031][ T8261] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 168.164052][ T8261] CPU: 2 UID: 0 PID: 8261 Comm: syz.4.572 Not tainted syzkaller #0 PREEMPT(full) [ 168.164065][ T8261] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 168.164072][ T8261] Call Trace: [ 168.164076][ T8261] [ 168.164080][ T8261] dump_stack_lvl+0x100/0x190 [ 168.164099][ T8261] should_fail_ex.cold+0x5/0xa [ 168.164114][ T8261] _copy_from_user+0x2e/0xd0 [ 168.164131][ T8261] get_compat_msghdr+0xb3/0x480 [ 168.164145][ T8261] ? __pfx_get_compat_msghdr+0x10/0x10 [ 168.164164][ T8261] ___sys_sendmsg+0x1b6/0x1e0 [ 168.164180][ T8261] ? __pfx____sys_sendmsg+0x10/0x10 [ 168.164206][ T8261] ? find_held_lock+0x2b/0x80 [ 168.164228][ T8261] __sys_sendmsg+0x160/0x210 [ 168.164240][ T8261] ? __pfx___sys_sendmsg+0x10/0x10 [ 168.164254][ T8261] ? __pfx_ksys_write+0x10/0x10 [ 168.164270][ T8261] __do_fast_syscall_32+0x13a/0x8b0 [ 168.164285][ T8261] ? lockdep_hardirqs_on+0x7d/0x110 [ 168.164299][ T8261] do_fast_syscall_32+0x32/0x70 [ 168.164314][ T8261] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 168.164329][ T8261] RIP: 0023:0xf6fdefec [ 168.164341][ T8261] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 168.164346][ T8261] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 168.164357][ T8261] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 168.164364][ T8261] RDX: 000000003aa711f2 RSI: 0000000000000000 RDI: 0000000000000000 [ 168.164371][ T8261] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 168.164377][ T8261] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 168.164384][ T8261] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 168.164397][ T8261] [ 168.290617][ T43] audit: type=1326 audit(1791062871.032:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8263 comm="syz.2.573" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 168.547137][ T8273] FAULT_INJECTION: forcing a failure. [ 168.547137][ T8273] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 168.547169][ T8273] CPU: 3 UID: 0 PID: 8273 Comm: syz.4.576 Not tainted syzkaller #0 PREEMPT(full) [ 168.547190][ T8273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 168.547200][ T8273] Call Trace: [ 168.547207][ T8273] [ 168.547214][ T8273] dump_stack_lvl+0x100/0x190 [ 168.547242][ T8273] should_fail_ex.cold+0x5/0xa [ 168.547265][ T8273] _copy_from_user+0x2e/0xd0 [ 168.547290][ T8273] get_compat_msghdr+0xb3/0x480 [ 168.547314][ T8273] ? __pfx_get_compat_msghdr+0x10/0x10 [ 168.547335][ T8273] ? rcu_is_watching+0x13/0xc0 [ 168.547354][ T8273] ? ___sys_recvmsg+0x177/0x1a0 [ 168.547375][ T8273] ? kfree+0x1e5/0x6d0 [ 168.547392][ T8273] ? slab_free_after_rcu_debug+0xdf/0x170 [ 168.547424][ T8273] ___sys_recvmsg+0x193/0x1a0 [ 168.547447][ T8273] ? __pfx____sys_recvmsg+0x10/0x10 [ 168.547469][ T8273] ? lock_acquire+0x1d1/0x380 [ 168.547505][ T8273] ? __pfx___might_resched+0x10/0x10 [ 168.547531][ T8273] do_recvmmsg+0x54d/0x740 [ 168.547557][ T8273] ? __pfx_do_recvmmsg+0x10/0x10 [ 168.547579][ T8273] ? lockdep_hardirqs_on+0x7d/0x110 [ 168.547618][ T8273] ? finish_task_switch.isra.0+0x2c2/0x10d0 [ 168.547659][ T8273] __sys_recvmmsg+0x21f/0x270 [ 168.547678][ T8273] ? __pfx___sys_recvmmsg+0x10/0x10 [ 168.547696][ T8273] ? xfd_validate_state+0x129/0x190 [ 168.547726][ T8273] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 168.547749][ T8273] ? __do_fast_syscall_32+0xb3/0x8b0 [ 168.547771][ T8273] ? lockdep_hardirqs_on+0x7d/0x110 [ 168.547791][ T8273] __do_fast_syscall_32+0x13a/0x8b0 [ 168.547815][ T8273] do_fast_syscall_32+0x32/0x70 [ 168.547837][ T8273] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 168.547858][ T8273] RIP: 0023:0xf6fdefec [ 168.547877][ T8273] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 168.547885][ T8273] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 168.547902][ T8273] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800048c0 [ 168.547913][ T8273] RDX: 0000000000001003 RSI: 0000000000010122 RDI: 0000000000000000 [ 168.547924][ T8273] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 168.547934][ T8273] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 168.547943][ T8273] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 168.547966][ T8273] [ 169.509138][ T43] audit: type=1326 audit(1791062872.252:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8281 comm="syz.2.578" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 169.768153][ T8292] netlink: 8 bytes leftover after parsing attributes in process `syz.1.581'. [ 169.768167][ T8292] netlink: 28 bytes leftover after parsing attributes in process `syz.1.581'. [ 170.326480][ T5803] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 170.476789][ T5803] usb 10-1: Using ep0 maxpacket: 32 [ 170.478763][ T5803] usb 10-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 170.482566][ T5803] usb 10-1: config index 0 descriptor too short (expected 156, got 27) [ 170.482599][ T5803] usb 10-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 170.482629][ T5803] usb 10-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 170.482653][ T5803] usb 10-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 170.482674][ T5803] usb 10-1: config 0 interface 0 has no altsetting 0 [ 170.485035][ T5803] usb 10-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 170.485056][ T5803] usb 10-1: Product: syz [ 170.485069][ T5803] usb 10-1: Manufacturer: syz [ 170.485080][ T5803] usb 10-1: SerialNumber: syz [ 170.496622][ T5803] usb 10-1: config 0 descriptor?? [ 170.499995][ T5803] ldusb 10-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 170.507287][ T5803] ldusb 10-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 170.555003][ T43] audit: type=1326 audit(1791062873.292:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8307 comm="syz.2.585" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 170.721817][ T5803] usb 10-1: USB disconnect, device number 6 [ 170.732621][ T5803] ldusb 10-1:0.0: LD USB Device #0 now disconnected [ 171.086500][ T5523] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 171.239767][ T5523] usb 9-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 171.240609][ T5523] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 171.240625][ T5523] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 171.240670][ T5523] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.357171][ T8323] comedi comedi1: dt2814: I/O base address or length out of range [ 171.357215][ T8323] FAULT_INJECTION: forcing a failure. [ 171.357215][ T8323] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 171.357239][ T8323] CPU: 1 UID: 0 PID: 8323 Comm: syz.5.590 Not tainted syzkaller #0 PREEMPT(full) [ 171.357259][ T8323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 171.357270][ T8323] Call Trace: [ 171.357276][ T8323] [ 171.357283][ T8323] dump_stack_lvl+0x100/0x190 [ 171.357313][ T8323] should_fail_ex.cold+0x5/0xa [ 171.357347][ T8323] _copy_to_user+0x32/0xd0 [ 171.357383][ T8323] simple_read_from_buffer+0xcb/0x170 [ 171.357415][ T8323] proc_fail_nth_read+0x1af/0x230 [ 171.357442][ T8323] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 171.357461][ T8323] ? rw_verify_area+0xce/0x6d0 [ 171.357477][ T8323] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 171.357497][ T8323] vfs_read+0x1e4/0xb40 [ 171.357517][ T8323] ? lock_acquire+0x1d1/0x380 [ 171.357543][ T8323] ? __fget_files+0x34/0x3d0 [ 171.357565][ T8323] ? __pfx_vfs_read+0x10/0x10 [ 171.357584][ T8323] ? find_held_lock+0x2b/0x80 [ 171.357605][ T8323] ? __fget_files+0x215/0x3d0 [ 171.357633][ T8323] ? __fget_files+0x21f/0x3d0 [ 171.357663][ T8323] ksys_read+0x12a/0x250 [ 171.357684][ T8323] ? __pfx_ksys_read+0x10/0x10 [ 171.357712][ T8323] do_int80_emulation+0x166/0x650 [ 171.357740][ T8323] asm_int80_emulation+0x1a/0x20 [ 171.357758][ T8323] RIP: 0023:0xf71d75ab [ 171.357773][ T8323] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 171.357791][ T8323] RSP: 002b:00000000f548d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 171.357809][ T8323] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f548d5d0 [ 171.357820][ T8323] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 171.357830][ T8323] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 171.357840][ T8323] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 171.357852][ T8323] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 171.357877][ T8323] [ 171.560693][ T43] audit: type=1326 audit(1791062874.302:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8328 comm="syz.2.592" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 171.683678][ T5803] usb 9-1: USB disconnect, device number 10 [ 172.002511][ T8343] comedi comedi1: dt2814: I/O base address or length out of range [ 173.738412][ T8376] netlink: 'syz.2.605': attribute type 4 has an invalid length. [ 173.738439][ T8376] netlink: 152 bytes leftover after parsing attributes in process `syz.2.605'. [ 173.760368][ T8376] 8021q: adding VLAN 0 to HW filter on device bond0 [ 173.794935][ T8376] mmap: syz.2.605 (8376) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 173.983899][ T8374] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(8) [ 173.983925][ T8374] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 173.984229][ T8374] vhci_hcd vhci_hcd.0: Device attached [ 174.105240][ T8387] tipc: Started in network mode [ 174.105258][ T8387] tipc: Node identity a2469d95e954, cluster identity 4711 [ 174.107040][ T8387] tipc: Enabled bearer , priority 0 [ 174.107395][ T8387] syzkaller0: entered promiscuous mode [ 174.107405][ T8387] syzkaller0: entered allmulticast mode [ 174.109527][ T8387] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 174.266732][ T9] usb 40-1: SetAddress Request (6) to port 0 [ 174.267541][ T9] usb 40-1: new SuperSpeed USB device number 6 using vhci_hcd [ 174.345642][ T8380] vhci_hcd: connection reset by peer [ 174.345940][ T12] vhci_hcd vhci_hcd.1: stop threads [ 174.345956][ T12] vhci_hcd vhci_hcd.1: release socket [ 174.345993][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 174.538789][ T43] audit: type=1326 audit(1791062877.282:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8390 comm="syz.2.608" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 174.930700][ T8384] tipc: Resetting bearer [ 174.952584][ T8384] tipc: Disabling bearer [ 176.533856][ T43] audit: type=1400 audit(1791062879.272:59): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name="batadv_slave_1" pid=8422 comm="syz.4.618" [ 176.663711][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.735163][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.746528][ T5834] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 176.814519][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.861151][ T5092] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 176.861787][ T5092] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 176.864015][ T5092] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 176.865268][ T5092] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 176.865648][ T5092] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 176.907193][ T5834] usb 7-1: New USB device found, idVendor=19d2, idProduct=0139, bcdDevice=72.bd [ 176.908277][ T5834] usb 7-1: config 9 has an invalid interface number: 26 but max is 2 [ 176.908302][ T5834] usb 7-1: config 9 has an invalid interface number: 110 but max is 2 [ 176.908322][ T5834] usb 7-1: config 9 has an invalid interface number: 46 but max is 2 [ 176.908341][ T5834] usb 7-1: config 9 has no interface number 0 [ 176.908356][ T5834] usb 7-1: config 9 has no interface number 1 [ 176.908371][ T5834] usb 7-1: config 9 has no interface number 2 [ 176.908420][ T5834] usb 7-1: config 9 interface 26 altsetting 10 endpoint 0xB has invalid wMaxPacketSize 0 [ 176.908438][ T5834] usb 7-1: config 9 interface 26 altsetting 10 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 176.908462][ T5834] usb 7-1: config 9 interface 26 altsetting 10 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 176.908485][ T5834] usb 7-1: config 9 interface 26 altsetting 10 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 176.908509][ T5834] usb 7-1: config 9 interface 26 altsetting 10 endpoint 0xF has invalid maxpacket 1023, setting to 64 [ 176.908532][ T5834] usb 7-1: config 9 interface 26 altsetting 10 has a duplicate endpoint with address 0x1, skipping [ 176.908565][ T5834] usb 7-1: config 9 interface 110 altsetting 7 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 176.908589][ T5834] usb 7-1: config 9 interface 110 altsetting 7 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 176.908633][ T5834] usb 7-1: config 9 interface 110 altsetting 7 has a duplicate endpoint with address 0xE, skipping [ 176.908667][ T5834] usb 7-1: config 9 interface 46 altsetting 8 has a duplicate endpoint with address 0xE, skipping [ 176.908683][ T5834] usb 7-1: config 9 interface 46 altsetting 8 has a duplicate endpoint with address 0x8, skipping [ 176.908703][ T5834] usb 7-1: config 9 interface 46 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 176.908722][ T5834] usb 7-1: config 9 interface 46 altsetting 8 has a duplicate endpoint with address 0xA, skipping [ 176.908740][ T5834] usb 7-1: config 9 interface 46 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 176.908757][ T5834] usb 7-1: config 9 interface 46 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 176.908775][ T5834] usb 7-1: config 9 interface 46 altsetting 8 has a duplicate endpoint with address 0x6, skipping [ 176.908791][ T5834] usb 7-1: config 9 interface 46 altsetting 8 has a duplicate endpoint with address 0xF, skipping [ 176.908810][ T5834] usb 7-1: config 9 interface 46 altsetting 8 bulk endpoint 0x2 has invalid maxpacket 1024 [ 176.908831][ T5834] usb 7-1: config 9 interface 26 has no altsetting 0 [ 176.908848][ T5834] usb 7-1: config 9 interface 110 has no altsetting 0 [ 176.908864][ T5834] usb 7-1: config 9 interface 46 has no altsetting 0 [ 176.912165][ T5834] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.912186][ T5834] usb 7-1: Product: syz [ 176.912199][ T5834] usb 7-1: Manufacturer: syz [ 176.912212][ T5834] usb 7-1: SerialNumber: syz [ 176.952540][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.093338][ T12] bridge_slave_1: left allmulticast mode [ 177.093427][ T12] bridge_slave_1: left promiscuous mode [ 177.095413][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 177.100879][ T12] bridge_slave_0: left allmulticast mode [ 177.100901][ T12] bridge_slave_0: left promiscuous mode [ 177.101069][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 177.233852][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 177.235902][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 177.238367][ T12] bond0 (unregistering): Released all slaves [ 177.287068][ T5834] option 7-1:9.26: GSM modem (1-port) converter detected [ 177.311342][ T5834] rndis_host 7-1:9.110: More than one union descriptor, skipping ... [ 177.311357][ T5834] rndis_host 7-1:9.110: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 177.319428][ T5834] usb 7-1: USB disconnect, device number 8 [ 177.325505][ T5834] option 7-1:9.26: device disconnected [ 177.607685][ T12] hsr_slave_0: left promiscuous mode [ 177.608304][ T12] hsr_slave_1: left promiscuous mode [ 177.608724][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 177.608737][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 177.610307][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 177.610319][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 177.615073][ T12] veth1_macvtap: left promiscuous mode [ 177.616279][ T12] veth0_macvtap: left promiscuous mode [ 177.617808][ T12] veth1_vlan: left promiscuous mode [ 177.617864][ T12] veth0_vlan: left promiscuous mode [ 177.819732][ T12] team0 (unregistering): Port device team_slave_1 removed [ 177.832408][ T12] team0 (unregistering): Port device team_slave_0 removed [ 177.945010][ T5446] 8021q: adding VLAN 0 to HW filter on device eth10 [ 178.043760][ T8436] bridge0: port 1(bridge_slave_0) entered blocking state [ 178.045848][ T8436] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.046029][ T8436] bridge_slave_0: entered allmulticast mode [ 178.057336][ T8436] bridge_slave_0: entered promiscuous mode [ 178.073362][ T8436] bridge0: port 2(bridge_slave_1) entered blocking state [ 178.073495][ T8436] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.073619][ T8436] bridge_slave_1: entered allmulticast mode [ 178.075110][ T8436] bridge_slave_1: entered promiscuous mode [ 178.135674][ T8436] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 178.148454][ T8436] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 178.162541][ T8436] team0: Port device team_slave_0 added [ 178.163820][ T8436] team0: Port device team_slave_1 added [ 178.195181][ T8436] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 178.195200][ T8436] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 178.195221][ T8436] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 178.207866][ T8436] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 178.207878][ T8436] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 178.207892][ T8436] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 178.234577][ T12] IPVS: stop unused estimator thread 0... [ 178.240012][ T8436] hsr_slave_0: entered promiscuous mode [ 178.240489][ T8436] hsr_slave_1: entered promiscuous mode [ 178.240894][ T8436] debugfs: 'hsr0' already exists in 'hsr' [ 178.240906][ T8436] Cannot create hsr debugfs directory [ 178.305203][ T5446] 8021q: adding VLAN 0 to HW filter on device eth11 [ 178.371176][ T8436] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 178.374444][ T8436] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 178.375043][ T8436] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 178.377546][ T8436] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 178.378077][ T8436] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 178.382945][ T8436] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 178.383872][ T8436] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 178.391102][ T8436] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 178.410574][ T8436] bridge0: port 2(bridge_slave_1) entered blocking state [ 178.410624][ T8436] bridge0: port 2(bridge_slave_1) entered forwarding state [ 178.410754][ T8436] bridge0: port 1(bridge_slave_0) entered blocking state [ 178.410801][ T8436] bridge0: port 1(bridge_slave_0) entered forwarding state [ 178.439959][ T8436] 8021q: adding VLAN 0 to HW filter on device bond0 [ 178.445134][ T5958] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.445496][ T5958] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.462275][ T8436] 8021q: adding VLAN 0 to HW filter on device team0 [ 178.465531][ T5958] bridge0: port 1(bridge_slave_0) entered blocking state [ 178.465612][ T5958] bridge0: port 1(bridge_slave_0) entered forwarding state [ 178.469998][ T5958] bridge0: port 2(bridge_slave_1) entered blocking state [ 178.470046][ T5958] bridge0: port 2(bridge_slave_1) entered forwarding state [ 178.496450][ T5840] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 178.517949][ T5446] 8021q: adding VLAN 0 to HW filter on device eth12 [ 178.649543][ T5840] usb 10-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 178.650405][ T5840] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 178.650421][ T5840] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 178.650439][ T5840] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.704519][ T5446] 8021q: adding VLAN 0 to HW filter on device eth13 [ 178.774298][ T8436] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 178.887188][ T5092] Bluetooth: hci0: command tx timeout [ 178.954161][ T8436] veth0_vlan: entered promiscuous mode [ 178.957895][ T8436] veth1_vlan: entered promiscuous mode [ 178.970690][ T8436] veth0_macvtap: entered promiscuous mode [ 178.973021][ T8436] veth1_macvtap: entered promiscuous mode [ 178.979469][ T8436] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 178.984127][ T8436] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 178.989420][ T5808] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.989549][ T5808] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.007736][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.007781][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.060381][ T6431] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 179.060401][ T6431] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 179.082418][ T6431] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 179.082431][ T6431] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 179.090619][ T5840] usb 10-1: USB disconnect, device number 7 [ 179.440250][ T9] usb 40-1: device descriptor read/8, error -110 [ 179.629496][ T8541] Bluetooth: MGMT ver 1.23 [ 179.833911][ T9] usb usb40-port1: attempt power cycle [ 180.407371][ T9] usb usb40-port1: unable to enumerate USB device [ 180.956517][ T5092] Bluetooth: hci0: command tx timeout [ 181.189096][ T8580] ======================================================= [ 181.189096][ T8580] WARNING: The mand mount option has been deprecated and [ 181.189096][ T8580] and is ignored by this kernel. Remove the mand [ 181.189096][ T8580] option from the mount to silence this warning. [ 181.189096][ T8580] ======================================================= [ 182.637456][ T8606] netlink: 'syz.4.650': attribute type 4 has an invalid length. [ 182.637473][ T8606] netlink: 152 bytes leftover after parsing attributes in process `syz.4.650'. [ 182.709439][ T8611] FAULT_INJECTION: forcing a failure. [ 182.709439][ T8611] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 182.709461][ T8611] CPU: 2 UID: 0 PID: 8611 Comm: syz.2.653 Not tainted syzkaller #0 PREEMPT(full) [ 182.709475][ T8611] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 182.709481][ T8611] Call Trace: [ 182.709486][ T8611] [ 182.709491][ T8611] dump_stack_lvl+0x100/0x190 [ 182.709511][ T8611] should_fail_ex.cold+0x5/0xa [ 182.709528][ T8611] _copy_from_user+0x2e/0xd0 [ 182.709545][ T8611] get_compat_msghdr+0xb3/0x480 [ 182.709560][ T8611] ? __pfx_get_compat_msghdr+0x10/0x10 [ 182.709579][ T8611] ___sys_sendmsg+0x1b6/0x1e0 [ 182.709595][ T8611] ? __pfx____sys_sendmsg+0x10/0x10 [ 182.709616][ T8611] ? find_held_lock+0x2b/0x80 [ 182.709639][ T8611] __sys_sendmsg+0x160/0x210 [ 182.709650][ T8611] ? __pfx___sys_sendmsg+0x10/0x10 [ 182.709665][ T8611] ? __pfx_ksys_write+0x10/0x10 [ 182.709682][ T8611] __do_fast_syscall_32+0x13a/0x8b0 [ 182.709698][ T8611] ? lockdep_hardirqs_on+0x7d/0x110 [ 182.709713][ T8611] do_fast_syscall_32+0x32/0x70 [ 182.709727][ T8611] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 182.709741][ T8611] RIP: 0023:0xf705efec [ 182.709755][ T8611] Code: Unable to access opcode bytes at 0xf705efc2. [ 182.709760][ T8611] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 182.709772][ T8611] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 182.709779][ T8611] RDX: 0000000000000084 RSI: 0000000000000000 RDI: 0000000000000000 [ 182.709787][ T8611] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 182.709794][ T8611] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 182.709801][ T8611] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 182.709814][ T8611] [ 182.914984][ T6437] IPVS: starting estimator thread 0... [ 183.006583][ T8622] IPVS: using max 43 ests per chain, 103200 per kthread [ 183.036969][ T5092] Bluetooth: hci0: command tx timeout [ 184.016486][ T42] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 184.168767][ T42] usb 10-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 184.170440][ T42] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 184.170486][ T42] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 184.170508][ T42] usb 10-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 184.171916][ T42] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 184.171935][ T42] usb 10-1: Product: syz [ 184.171947][ T42] usb 10-1: Manufacturer: syz [ 184.175878][ T8634] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 184.177630][ T42] garmin_gps 10-1:1.0: Garmin GPS usb/tty converter detected [ 184.181326][ T42] usb 10-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 184.309118][ T8638] FAULT_INJECTION: forcing a failure. [ 184.309118][ T8638] name failslab, interval 1, probability 0, space 0, times 0 [ 184.309139][ T8638] CPU: 0 UID: 0 PID: 8638 Comm: syz.4.662 Not tainted syzkaller #0 PREEMPT(full) [ 184.309152][ T8638] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 184.309159][ T8638] Call Trace: [ 184.309163][ T8638] [ 184.309167][ T8638] dump_stack_lvl+0x100/0x190 [ 184.309185][ T8638] should_fail_ex.cold+0x5/0xa [ 184.309201][ T8638] should_failslab+0xc2/0x120 [ 184.309221][ T8638] __kmalloc_cache_noprof+0x91/0x6d0 [ 184.309233][ T8638] ? copy_mount_options+0x55/0x190 [ 184.309247][ T8638] copy_mount_options+0x55/0x190 [ 184.309259][ T8638] __ia32_sys_mount+0x1ab/0x310 [ 184.309278][ T8638] ? __pfx___ia32_sys_mount+0x10/0x10 [ 184.309295][ T8638] ? ksys_write+0x1ac/0x250 [ 184.309308][ T8638] ? __pfx_ksys_write+0x10/0x10 [ 184.309323][ T8638] __do_fast_syscall_32+0x13a/0x8b0 [ 184.309338][ T8638] ? lockdep_hardirqs_on+0x7d/0x110 [ 184.309352][ T8638] do_fast_syscall_32+0x32/0x70 [ 184.309367][ T8638] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 184.309381][ T8638] RIP: 0023:0xf6fdefec [ 184.309394][ T8638] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 184.309399][ T8638] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 184.309410][ T8638] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000000 [ 184.309417][ T8638] RDX: 0000000080000080 RSI: 0000000001810040 RDI: 0000000080000500 [ 184.309424][ T8638] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 184.309430][ T8638] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 184.309437][ T8638] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 184.309450][ T8638] [ 184.826398][ T9] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 184.996887][ T9] usb 7-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 184.997797][ T9] usb 7-1: config index 0 descriptor too short (expected 23569, got 27) [ 184.997822][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 184.998791][ T9] usb 7-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 184.998804][ T9] usb 7-1: Manufacturer: syz [ 185.002042][ T9] usb 7-1: config 0 descriptor?? [ 185.047310][ T9] rc_core: IR keymap rc-hauppauge not found [ 185.047328][ T9] Registered IR keymap rc-empty [ 185.053465][ T9] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0 [ 185.055659][ T9] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0/input8 [ 185.116442][ T5092] Bluetooth: hci0: command tx timeout [ 185.204539][ T8657] netlink: 'syz.2.667': attribute type 1 has an invalid length. [ 185.204558][ T8657] netlink: 244 bytes leftover after parsing attributes in process `syz.2.667'. [ 185.318978][ T42] usb 7-1: USB disconnect, device number 9 [ 185.777255][ T8675] netlink: 116 bytes leftover after parsing attributes in process `syz.6.669'. [ 185.782225][ T8675] [ 185.787049][ T8675] ====================================================== [ 185.789966][ T8675] WARNING: possible circular locking dependency detected [ 185.792886][ T8675] syzkaller #0 Not tainted [ 185.795031][ T8675] ------------------------------------------------------ [ 185.797937][ T8675] syz.6.669/8675 is trying to acquire lock: [ 185.800277][ T8675] ffff88804e2dc0b8 (&hdev->lock){+.+.}-{4:4}, at: l2cap_chan_connect+0xac/0x2110 [ 185.804017][ T8675] [ 185.804017][ T8675] but task is already holding lock: [ 185.807016][ T8675] ffffffff90f86da0 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0x92/0xac0 [ 185.810554][ T8675] [ 185.810554][ T8675] which lock already depends on the new lock. [ 185.810554][ T8675] [ 185.814754][ T8675] [ 185.814754][ T8675] the existing dependency chain (in reverse order) is: [ 185.818343][ T8675] [ 185.818343][ T8675] -> #2 (rfcomm_mutex){+.+.}-{4:4}: [ 185.821323][ T8675] lock_acquire+0x1d1/0x380 [ 185.823371][ T8675] __mutex_lock+0x1a4/0x1bd0 [ 185.825448][ T8675] rfcomm_security_cfm+0x3f/0x4b0 [ 185.827853][ T8675] hci_encrypt_cfm+0x18e/0x740 [ 185.830059][ T8675] hci_encrypt_change_evt+0x3e1/0xfb0 [ 185.832544][ T8675] hci_event_packet+0x8e9/0xcd0 [ 185.834846][ T8675] hci_rx_work+0x451/0xfc0 [ 185.836975][ T8675] process_one_work+0xac7/0x1b10 [ 185.839259][ T8675] worker_thread+0x5ef/0xe50 [ 185.841451][ T8675] kthread+0x373/0x450 [ 185.843403][ T8675] ret_from_fork+0x730/0xd60 [ 185.845583][ T8675] ret_from_fork_asm+0x1a/0x30 [ 185.847830][ T8675] [ 185.847830][ T8675] -> #1 (hci_cb_list_lock){+.+.}-{4:4}: [ 185.851014][ T8675] lock_acquire+0x1d1/0x380 [ 185.853097][ T8675] __mutex_lock+0x1a4/0x1bd0 [ 185.855180][ T8675] hci_remote_features_evt+0x485/0x9b0 [ 185.857613][ T8675] hci_event_packet+0x8e9/0xcd0 [ 185.859846][ T8675] hci_rx_work+0x451/0xfc0 [ 185.861897][ T8675] process_one_work+0xac7/0x1b10 [ 185.864188][ T8675] worker_thread+0x5ef/0xe50 [ 185.866396][ T8675] kthread+0x373/0x450 [ 185.868376][ T8675] ret_from_fork+0x730/0xd60 [ 185.870517][ T8675] ret_from_fork_asm+0x1a/0x30 [ 185.872783][ T8675] [ 185.872783][ T8675] -> #0 (&hdev->lock){+.+.}-{4:4}: [ 185.875867][ T8675] check_prev_add+0xeb/0xe60 [ 185.878119][ T8675] __lock_acquire+0x1528/0x1f40 [ 185.880545][ T8675] lock_acquire+0x1d1/0x380 [ 185.882754][ T8675] __mutex_lock+0x1a4/0x1bd0 [ 185.884944][ T8675] l2cap_chan_connect+0xac/0x2110 [ 185.887259][ T8675] l2cap_sock_connect+0x37a/0x770 [ 185.889664][ T8675] kernel_connect+0x107/0x160 [ 185.891861][ T8675] rfcomm_dlc_open+0x838/0xac0 [ 185.894094][ T8675] rfcomm_sock_connect+0x42c/0x690 [ 185.896335][ T8675] __sys_connect_file+0x146/0x1a0 [ 185.898695][ T8675] __sys_connect+0x141/0x170 [ 185.901015][ T8675] __ia32_sys_connect+0x71/0xb0 [ 185.903464][ T8675] __do_fast_syscall_32+0x13a/0x8b0 [ 185.906110][ T8675] do_fast_syscall_32+0x32/0x70 [ 185.908376][ T8675] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 185.911106][ T8675] [ 185.911106][ T8675] other info that might help us debug this: [ 185.911106][ T8675] [ 185.915117][ T8675] Chain exists of: [ 185.915117][ T8675] &hdev->lock --> hci_cb_list_lock --> rfcomm_mutex [ 185.915117][ T8675] [ 185.920103][ T8675] Possible unsafe locking scenario: [ 185.920103][ T8675] [ 185.923181][ T8675] CPU0 CPU1 [ 185.925231][ T8675] ---- ---- [ 185.927364][ T8675] lock(rfcomm_mutex); [ 185.929091][ T8675] lock(hci_cb_list_lock); [ 185.931949][ T8675] lock(rfcomm_mutex); [ 185.934797][ T8675] lock(&hdev->lock); [ 185.936515][ T8675] [ 185.936515][ T8675] *** DEADLOCK *** [ 185.936515][ T8675] [ 185.939817][ T8675] locks held by syz.6.669/8675: 1, last CPU#3: [ 185.942404][ T8675] #0: ffffffff90f86da0 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0x92/0xac0 [ 185.946138][ T8675] [ 185.946138][ T8675] stack backtrace: [ 185.948633][ T8675] CPU: 3 UID: 0 PID: 8675 Comm: syz.6.669 Not tainted syzkaller #0 PREEMPT(full) [ 185.952405][ T8675] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 185.956621][ T8675] Call Trace: [ 185.958058][ T8675] [ 185.959327][ T8675] dump_stack_lvl+0x100/0x190 [ 185.961159][ T8675] print_circular_bug.cold+0x178/0x1be [ 185.963465][ T8675] check_noncircular+0x146/0x160 [ 185.965596][ T8675] check_prev_add+0xeb/0xe60 [ 185.967606][ T8675] __lock_acquire+0x1528/0x1f40 [ 185.969702][ T8675] lock_acquire+0x1d1/0x380 [ 185.971636][ T8675] ? l2cap_chan_connect+0xac/0x2110 [ 185.973850][ T8675] ? __pfx___might_resched+0x10/0x10 [ 185.976061][ T8675] __mutex_lock+0x1a4/0x1bd0 [ 185.978049][ T8675] ? l2cap_chan_connect+0xac/0x2110 [ 185.980248][ T8675] ? l2cap_chan_connect+0xac/0x2110 [ 185.982450][ T8675] ? hci_get_route+0x368/0x520 [ 185.984473][ T8675] ? hci_get_route+0x368/0x520 [ 185.986510][ T8675] ? __pfx___mutex_lock+0x10/0x10 [ 185.988653][ T8675] ? _raw_read_unlock+0x28/0x50 [ 185.990731][ T8675] ? hci_get_route+0x368/0x520 [ 185.992777][ T8675] ? __pfx_hci_get_route+0x10/0x10 [ 185.994940][ T8675] ? reacquire_held_locks+0xdd/0x1f0 [ 185.997144][ T8675] ? release_sock+0x21/0x280 [ 185.999110][ T8675] ? l2cap_chan_connect+0xac/0x2110 [ 186.001304][ T8675] l2cap_chan_connect+0xac/0x2110 [ 186.003426][ T8675] ? __local_bh_enable_ip+0xa5/0x120 [ 186.005648][ T8675] l2cap_sock_connect+0x37a/0x770 [ 186.007724][ T8675] ? __pfx_l2cap_sock_connect+0x10/0x10 [ 186.010054][ T8675] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 186.012509][ T8675] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 186.014981][ T8675] kernel_connect+0x107/0x160 [ 186.016976][ T8675] ? __pfx_kernel_connect+0x10/0x10 [ 186.019019][ T8675] ? timer_init_key+0x150/0x310 [ 186.020986][ T8675] rfcomm_dlc_open+0x838/0xac0 [ 186.022945][ T8675] ? __pfx_rfcomm_dlc_open+0x10/0x10 [ 186.025042][ T8675] ? rfcomm_sock_connect+0x3e8/0x690 [ 186.027190][ T8675] ? find_held_lock+0x2b/0x80 [ 186.029194][ T8675] ? rfcomm_sock_connect+0x3e8/0x690 [ 186.031378][ T8675] ? __local_bh_enable_ip+0xa5/0x120 [ 186.033535][ T8675] rfcomm_sock_connect+0x42c/0x690 [ 186.035594][ T8675] __sys_connect_file+0x146/0x1a0 [ 186.037719][ T8675] __sys_connect+0x141/0x170 [ 186.039630][ T8675] ? __pfx___sys_connect+0x10/0x10 [ 186.041750][ T8675] __ia32_sys_connect+0x71/0xb0 [ 186.043755][ T8675] ? lockdep_hardirqs_on+0x7d/0x110 [ 186.045978][ T8675] __do_fast_syscall_32+0x13a/0x8b0 [ 186.048122][ T8675] ? lockdep_hardirqs_on+0x7d/0x110 [ 186.050287][ T8675] do_fast_syscall_32+0x32/0x70 [ 186.052367][ T8675] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 186.054990][ T8675] RIP: 0023:0xf706efec [ 186.056758][ T8675] Code: Unable to access opcode bytes at 0xf706efc2. [ 186.059041][ T8675] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 000000000000016a [ 186.061992][ T8675] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000800000c0 [ 186.065298][ T8675] RDX: 000000000000000a RSI: 0000000000000000 RDI: 0000000000000000 [ 186.068305][ T8675] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 186.071590][ T8675] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 186.074846][ T8675] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 186.078082][ T8675] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 186.809973][ T5803] usb 10-1: USB disconnect, device number 8 [ 186.814397][ T5803] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 186.814679][ T5803] garmin_gps 10-1:1.0: device disconnected [ 186.829057][ T5808] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.888400][ T5808] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.959101][ T5808] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.010675][ T5808] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.074947][ T5808] bridge_slave_1: left allmulticast mode [ 187.074962][ T5808] bridge_slave_1: left promiscuous mode [ 187.075044][ T5808] bridge0: port 2(bridge_slave_1) entered disabled state [ 187.075831][ T5808] bridge_slave_0: left allmulticast mode [ 187.075847][ T5808] bridge_slave_0: left promiscuous mode [ 187.075940][ T5808] bridge0: port 1(bridge_slave_0) entered disabled state [ 187.114168][ T5808] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 187.115374][ T5808] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 187.115967][ T5808] bond0 (unregistering): Released all slaves [ 187.226483][ T5446] 8021q: adding VLAN 0 to HW filter on device eth14 [ 187.296893][ T5808] hsr_slave_0: left promiscuous mode [ 187.297286][ T5808] hsr_slave_1: left promiscuous mode [ 187.297582][ T5808] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 187.297593][ T5808] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 187.297906][ T5808] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 187.297915][ T5808] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 187.299478][ T5808] veth1_macvtap: left promiscuous mode [ 187.299501][ T5808] veth0_macvtap: left promiscuous mode [ 187.299529][ T5808] veth1_vlan: left promiscuous mode [ 187.299554][ T5808] veth0_vlan: left promiscuous mode [ 187.369680][ T5808] team0 (unregistering): Port device team_slave_1 removed [ 187.372084][ T5808] team0 (unregistering): Port device team_slave_0 removed [ 187.397783][ T5446] 8021q: adding VLAN 0 to HW filter on device eth15 [ 187.525231][ T5446] 8021q: adding VLAN 0 to HW filter on device eth16 [ 187.642287][ T5446] 8021q: adding VLAN 0 to HW filter on device eth17 [ 187.681145][ T5808] IPVS: stop unused estimator thread 0... [ 187.724286][ T5808] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.771935][ T5808] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.819103][ T5808] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.878976][ T5808] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.957602][ T5808] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.020713][ T5808] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.053517][ T5446] 8021q: adding VLAN 0 to HW filter on device eth18 [ 188.062290][ T5808] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.089789][ T5808] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.155908][ T5446] 8021q: adding VLAN 0 to HW filter on device eth19 [ 188.284285][ T5446] 8021q: adding VLAN 0 to HW filter on device eth20 [ 188.404737][ T5446] 8021q: adding VLAN 0 to HW filter on device eth21 [ 188.425194][ T5808] bridge_slave_1: left allmulticast mode [ 188.425211][ T5808] bridge_slave_1: left promiscuous mode [ 188.425281][ T5808] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.426008][ T5808] bridge_slave_0: left allmulticast mode [ 188.426019][ T5808] bridge_slave_0: left promiscuous mode [ 188.426097][ T5808] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.441609][ T5808] bridge_slave_1: left allmulticast mode [ 188.441625][ T5808] bridge_slave_1: left promiscuous mode [ 188.441706][ T5808] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.446002][ T5808] bridge_slave_0: left allmulticast mode [ 188.446018][ T5808] bridge_slave_0: left promiscuous mode [ 188.446088][ T5808] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.455552][ T5808] bridge_slave_1: left allmulticast mode [ 188.455573][ T5808] bridge_slave_1: left promiscuous mode [ 188.455679][ T5808] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.456670][ T5808] bridge_slave_0: left allmulticast mode [ 188.456684][ T5808] bridge_slave_0: left promiscuous mode [ 188.456771][ T5808] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.506705][ T5808] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 188.507902][ T5808] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 188.508542][ T5808] bond0 (unregistering): Released all slaves [ 188.550547][ T5808] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 188.551655][ T5808] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 188.552326][ T5808] bond0 (unregistering): Released all slaves [ 188.598875][ T5808] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 188.599813][ T5808] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 188.600328][ T5808] bond0 (unregistering): Released all slaves [ 188.655087][ T5808] tipc: Left network mode [ 188.738622][ T5446] 8021q: adding VLAN 0 to HW filter on device eth22 [ 188.954689][ T5446] 8021q: adding VLAN 0 to HW filter on device eth23 [ 189.070448][ T5808] hsr_slave_0: left promiscuous mode [ 189.070675][ T5808] hsr_slave_1: left promiscuous mode [ 189.070896][ T5808] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 189.070905][ T5808] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 189.071169][ T5808] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 189.071177][ T5808] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 189.073061][ T5808] hsr_slave_0: left promiscuous mode [ 189.073310][ T5808] hsr_slave_1: left promiscuous mode [ 189.073880][ T5808] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 189.073890][ T5808] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 189.074189][ T5808] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 189.074198][ T5808] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 189.076163][ T5808] hsr_slave_0: left promiscuous mode [ 189.078771][ T5808] hsr_slave_1: left promiscuous mode [ 189.079235][ T5808] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 189.081327][ T5808] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 189.090367][ T5808] veth1_macvtap: left promiscuous mode [ 189.090413][ T5808] veth0_macvtap: left promiscuous mode [ 189.090477][ T5808] veth1_vlan: left promiscuous mode [ 189.090511][ T5808] veth0_vlan: left promiscuous mode [ 189.100446][ T5808] veth1_macvtap: left promiscuous mode [ 189.100472][ T5808] veth0_macvtap: left promiscuous mode [ 189.100516][ T5808] veth1_vlan: left promiscuous mode [ 189.100548][ T5808] veth0_vlan: left promiscuous mode [ 189.194565][ T5808] team0 (unregistering): Port device team_slave_1 removed [ 189.199856][ T5808] team0 (unregistering): Port device team_slave_0 removed [ 189.283483][ T5808] team0 (unregistering): Port device team_slave_1 removed [ 189.289201][ T5808] team0 (unregistering): Port device team_slave_0 removed [ 189.365682][ T5808] team0 (unregistering): Port device team_slave_1 removed [ 189.368934][ T5808] team0 (unregistering): Port device team_slave_0 removed [ 189.388877][ T5446] 8021q: adding VLAN 0 to HW filter on device eth24 [ 189.624776][ T5446] 8021q: adding VLAN 0 to HW filter on device eth25 [ 189.749538][ T5446] 8021q: adding VLAN 0 to HW filter on device eth27 [ 189.961717][ T5446] 8021q: adding VLAN 0 to HW filter on device eth26 [ 190.054138][ T5446] 8021q: adding VLAN 0 to HW filter on device eth28 [ 190.152910][ T5808] IPVS: stop unused estimator thread 0... [ 190.153221][ T5808] IPVS: stop unused estimator thread 0... [ 190.153290][ T5446] 8021q: adding VLAN 0 to HW filter on device eth29 [ 190.153447][ T5808] IPVS: stop unused estimator thread 0... [ 193.757909][ T1436] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.757993][ T1436] ieee802154 phy1 wpan1: encryption failed: -22