last executing test programs: 8m50.703163548s ago: executing program 2 (id=6136): r0 = socket(0x23, 0x0, 0xb) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder1\x00', 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000001c0), 0x2, 0x8081) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = signalfd4(r0, &(0x7f0000000180)={[0x4, 0xffff8000]}, 0x8, 0x80800) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f00000038c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) r4 = eventfd(0x80000001) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) ioctl$VHOST_RESET_OWNER(r3, 0xaf02, 0x0) write$UHID_CREATE2(r2, &(0x7f00000003c0)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x13, 0x8, 0x7, 0x2, 0xaa, 0x2, "67e1348bf6d1d967b7d7044a8781551ee20634"}}, 0x12b) syz_io_uring_setup(0x49d, &(0x7f0000000100)={0x0, 0x79af, 0x2, 0x8000, 0x400246}, 0x0, 0x0, 0x0) io_getevents(0x0, 0xffffffff, 0x0, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00') getdents64(r5, &(0x7f0000002f40)=""/4098, 0x1002) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000005c0)={'ip6tnl0\x00', &(0x7f0000000540)={'syztnl2\x00', 0x0, 0x29, 0x4, 0x4, 0x0, 0x4c, @dev={0xfe, 0x80, '\x00', 0x1e}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x20, 0x700, 0x3, 0x6}}) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="4600010002"], 0x8) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r6, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) read(0xffffffffffffffff, &(0x7f0000000080)=""/102, 0x66) sendmsg$ETHTOOL_MSG_COALESCE_SET(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x34, 0x0, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@ETHTOOL_A_COALESCE_TX_USECS_HIGH={0x8, 0x15, 0x5}, @ETHTOOL_A_COALESCE_PKT_RATE_HIGH={0x8, 0x12, 0x7}, @ETHTOOL_A_COALESCE_STATS_BLOCK_USECS={0x8, 0xa, 0x9}, @ETHTOOL_A_COALESCE_RX_USECS_HIGH={0x8, 0x13, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x80, 0x30, 0xb, 0x70bd2c, 0x25dfdbfb, {}, [{0x6c, 0x1, [@m_ct={0x68, 0x1, 0x0, 0x0, {{0x7}, {0x40, 0x2, 0x0, 0x1, [@TCA_CT_NAT_IPV6_MIN={0x14, 0xb, @loopback}, @TCA_CT_ACTION={0x6, 0x3, 0x19}, @TCA_CT_MARK_MASK={0x8, 0x6, 0x3}, @TCA_CT_PARMS={0x18, 0x1, {0xfffffffc, 0xc60a, 0x3, 0x101, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8890}, 0x840) 8m49.535723369s ago: executing program 2 (id=6138): r0 = socket(0x2, 0x805, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f0000000100)=[@in={0x2, 0x4e20, @rand_addr=0x64010102}, @in={0x2, 0x4e20, @remote}]}, &(0x7f00000007c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000340)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000180)={r1, 0x2, 0x6, 0x80000000, 0xa18c, 0x8}, &(0x7f00000001c0)=0x14) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x3e, &(0x7f00000040c0)=0x7, 0x4) sendmmsg$inet(r2, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x3284b164842c97f7, 0x8014) 8m49.225595209s ago: executing program 2 (id=6146): mremap(&(0x7f0000000000/0x9000)=nil, 0x600000, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x13, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0xc, 0x4}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0xf}, 0x94) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) creat(&(0x7f0000000340)='./file0/file0\x00', 0x0) chdir(&(0x7f0000000140)='./bus\x00') r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000002540)) close_range(r0, 0xffffffffffffffff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001500add427323b470c45b45602067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET_DEF(r5, 0x4b52, &(0x7f00000001c0)={0x2, 0x1000, 0xf, 0x1e, 0x0, 0x0}) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r6 = open(&(0x7f0000000240)='.\x00', 0x0, 0xc4) r7 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000800)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) write$cgroup_int(r7, &(0x7f0000000040)=0x3, 0x12) mkdirat(r6, &(0x7f0000000180)='./file0/file0\x00', 0x0) 8m49.0946068s ago: executing program 2 (id=6149): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x49d8, 0x1, 0x5, 0x1}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000010400)={0x11, 0xd, &(0x7f0000000280)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xf}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1000}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r3) tkill(r3, 0x12) ptrace(0x4208, r3) ptrace$setsig(0x4203, r3, 0x4, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$video4linux(&(0x7f0000000040), 0x0, 0x0) futex(&(0x7f000000cffc), 0xb, 0x0, &(0x7f0000000240)={0x77359400}, &(0x7f0000048000)=0x1, 0x0) 8m47.876823141s ago: executing program 2 (id=6155): syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x1, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x2082) 8m45.812103642s ago: executing program 2 (id=6160): syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x20}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1000000000021, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="3c0000001000030426bd7000ffdbdf2500", @ANYRES32=0x0, @ANYBLOB="adffa88801200500180012800e0001007769726567756172640000000400028004001a80c93f93c30aed2ca2dfb1232d55ff6aae432ecebd578c0fd59634258a82e5e227"], 0x3c}}, 0x440088c4) r4 = socket$netlink(0x10, 0x3, 0x4) ioctl$sock_SIOCETHTOOL(r4, 0x8946, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f71, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYNAME(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000000e060300000000000800000005000008320ec2efc058cce325d0fd269e2b4c0c327c34369534211c503a5c1aedd5587fd2279d96f59066e672"], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000240)={[{0x2, 0x5, 0x9b, 0x1, 0x0, 0x5f, 0x7, 0x20, 0xa6, 0x1, 0x5, 0xd, 0xce}, {0xfffffff9, 0xfffa, 0x7f, 0x0, 0x0, 0x2, 0xc9, 0x0, 0x4, 0xff, 0x4, 0x0, 0x800000000000000}, {0xffffff01, 0x35, 0x0, 0x0, 0x4, 0x4, 0x7, 0xfe, 0x7, 0x8, 0x7e, 0x4, 0x1000000000000007}], 0xcc78}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x0, 0xfffffffffffffffc, 0x5, 0x7fff, 0x1000200004, 0x101, 0x2, 0x0, 0x80], 0x8080000, 0x4}) setrlimit(0x7, &(0x7f0000000400)) socket$kcm(0xa, 0x3, 0x3a) ioctl$KVM_RUN(r5, 0xae80, 0x0) r7 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0x101202, 0x0) write$nci(r7, 0x0, 0x4) ioctl$FIBMAP(0xffffffffffffffff, 0x1, &(0x7f0000000040)=0x8) 8m44.734851062s ago: executing program 32 (id=6160): syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x20}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1000000000021, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="3c0000001000030426bd7000ffdbdf2500", @ANYRES32=0x0, @ANYBLOB="adffa88801200500180012800e0001007769726567756172640000000400028004001a80c93f93c30aed2ca2dfb1232d55ff6aae432ecebd578c0fd59634258a82e5e227"], 0x3c}}, 0x440088c4) r4 = socket$netlink(0x10, 0x3, 0x4) ioctl$sock_SIOCETHTOOL(r4, 0x8946, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f71, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYNAME(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000000e060300000000000800000005000008320ec2efc058cce325d0fd269e2b4c0c327c34369534211c503a5c1aedd5587fd2279d96f59066e672"], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000240)={[{0x2, 0x5, 0x9b, 0x1, 0x0, 0x5f, 0x7, 0x20, 0xa6, 0x1, 0x5, 0xd, 0xce}, {0xfffffff9, 0xfffa, 0x7f, 0x0, 0x0, 0x2, 0xc9, 0x0, 0x4, 0xff, 0x4, 0x0, 0x800000000000000}, {0xffffff01, 0x35, 0x0, 0x0, 0x4, 0x4, 0x7, 0xfe, 0x7, 0x8, 0x7e, 0x4, 0x1000000000000007}], 0xcc78}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x0, 0xfffffffffffffffc, 0x5, 0x7fff, 0x1000200004, 0x101, 0x2, 0x0, 0x80], 0x8080000, 0x4}) setrlimit(0x7, &(0x7f0000000400)) socket$kcm(0xa, 0x3, 0x3a) ioctl$KVM_RUN(r5, 0xae80, 0x0) r7 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0x101202, 0x0) write$nci(r7, 0x0, 0x4) ioctl$FIBMAP(0xffffffffffffffff, 0x1, &(0x7f0000000040)=0x8) 3m3.032769073s ago: executing program 4 (id=7180): r0 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) syz_usb_disconnect(0xffffffffffffffff) ioctl$HIDIOCGFEATURE(r0, 0xc0404807, &(0x7f0000000940)={0x0, "95bc9233a0ffadb335984bb3280b7840ca360400f05cff8500bd160634843f462a2e51c23b47519839c74c89785759d861f0cbab603459d543d8937b4693682b"}) (fail_nth: 2) 3m2.003819324s ago: executing program 4 (id=7184): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="5095c907a93fc3b04cc4f079d085a3000000020605000000000000000000000000000500040000000000096ecb0073797a32000000000c0007800800124000000000050005000200000005000100060000000c000300686173683a697000f7f8261b618b95be4d355ac89d0589ab3953399e996684b9b09e19f6ab23f2d308fa14ac8185796a6919b1f336b0f5afdf6f33"], 0x50}}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) io_uring_setup(0x664b, &(0x7f0000000500)) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_emit_ethernet(0x4b, &(0x7f0000000a40)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@mpls_uc={0x8847, {[{0xa, 0x0, 0x1}, {0x8}, {0x4, 0x0, 0x1}], @llc={@snap={0x0, 0xaa, "ae", "929d63", 0x11, "2e6e4b89803ff8164bd760f2323496bfe465daf0850832026af8bee15ddf19527126a8b03b1a551b68"}}}}}}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = openat$dir(0xffffff9c, &(0x7f0000000040)='./file0\x00', 0x210000, 0x31) ioctl$AUTOFS_IOC_EXPIRE(r1, 0x810c9365, &(0x7f0000000580)={{0x5, 0x4}, 0x100}) r2 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$dri(0x0, 0xd21, 0x0) iopl(0x3) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mknod$loop(&(0x7f000000db40)='./file0\x00', 0x1000, 0x0) openat2(0xffffffffffffff9c, &(0x7f0000001400)='./file0\x00', &(0x7f0000001440)={0x122240, 0x10b, 0x7}, 0x18) 3m0.681622121s ago: executing program 4 (id=7187): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) 3m0.453607167s ago: executing program 4 (id=7189): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r1 = dup(r0) write$cgroup_netprio_ifpriomap(r1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r1, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000040)='/', &(0x7f0000000080)='./file0\x00', 0x0, 0x197841, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0x9) sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c000000d5d622ae43144c6cc74f2e6df60f92408656f01e75833be59fb4a87c4d7ec4e06e52a2a04ec0cf3b3566d67ff812b5a683011a4da03f85318ef82b6cd980827f97b965a2bc34e4b250852e6728680c6de3f27f8cabdeffb52490372b2b848e98d2c596b43a5961cf9305f7b982df61b16bcd88b22bd32884169fa3643822578c98fed850d52f0c7fc9c9fe2d64c8b4d880c5634b0da0fdfc6f2be3f0566904711ec4a478dc4333b1b2a7a5dff56683e0057cdc422d50418c68c8e93cd9e1dfe6db6e0b6172c9a35e3e01d26b679b65f6fdefb780b45790ee", @ANYRES16=r3, @ANYBLOB="000426bd7000ffdbdf25050000000c00020007000000000000000c000600000000000000000010000a002f6465762f6e756c6c623000"], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x4000000) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000000)={0x600, 0x1000000}) io_uring_register$IORING_REGISTER_PBUF_STATUS(r1, 0x1a, &(0x7f00000001c0), 0x1) ioctl$SNDCTL_DSP_GETOSPACE(r1, 0x8010500c, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) 2m59.29031321s ago: executing program 4 (id=7193): socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x5, 0x10, 0x2, 0x9, 0x0, 0xffffffffffffffff, 0x10000}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0xf, &(0x7f0000000080)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x2}, {0x85, 0x0, 0x0, 0x9d}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x9}, 0x94) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x10}]}]}, 0x5c}}, 0x0) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) 2m58.754860037s ago: executing program 4 (id=7195): r0 = add_key$keyring(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff}, 0x80) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat(r2, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x118) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv4_newrule={0x24, 0x20, 0x301, 0x0, 0x8000, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x10002}, [@FRA_GENERIC_POLICY=@FRA_L3MDEV={0x5, 0x13, 0x1}]}, 0x24}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0xa) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mount$tmpfs(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0xc00, &(0x7f0000000240)=ANY=[]) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)={0x20, 0x3, 0x3, 0x101, 0x0, 0x0, {}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0x3, 0xff}}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x4) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mount$9p_virtio(&(0x7f00000000c0), 0x0, 0x0, 0x20000cc, 0x0) r6 = syz_io_uring_setup(0x3b, &(0x7f0000000080)={0x0, 0x0, 0x400}, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_NAPI(r6, 0x1b, &(0x7f0000000040)={0xffffff01, 0x3}, 0x1) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0x0) keyctl$clear(0x7, r0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYRES32=0x0], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x80000002}, 0x8, 0x10, &(0x7f0000000100)={0x0, 0x1}, 0x10}, 0x94) 2m58.690155829s ago: executing program 33 (id=7195): r0 = add_key$keyring(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff}, 0x80) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat(r2, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x118) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv4_newrule={0x24, 0x20, 0x301, 0x0, 0x8000, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x10002}, [@FRA_GENERIC_POLICY=@FRA_L3MDEV={0x5, 0x13, 0x1}]}, 0x24}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0xa) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mount$tmpfs(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0xc00, &(0x7f0000000240)=ANY=[]) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)={0x20, 0x3, 0x3, 0x101, 0x0, 0x0, {}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0x3, 0xff}}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x4) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mount$9p_virtio(&(0x7f00000000c0), 0x0, 0x0, 0x20000cc, 0x0) r6 = syz_io_uring_setup(0x3b, &(0x7f0000000080)={0x0, 0x0, 0x400}, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_NAPI(r6, 0x1b, &(0x7f0000000040)={0xffffff01, 0x3}, 0x1) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0x0) keyctl$clear(0x7, r0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYRES32=0x0], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x80000002}, 0x8, 0x10, &(0x7f0000000100)={0x0, 0x1}, 0x10}, 0x94) 9.335869167s ago: executing program 0 (id=7760): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) renameat2(0xffffffffffffffff, &(0x7f00000002c0)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffffff, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_mptcp(0x2, 0x1, 0x106) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) lseek(0xffffffffffffffff, 0x7fff, 0x4) r1 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0xa) fchdir(r2) r3 = open(&(0x7f0000000080)='./bus\x00', 0x1031c2, 0xb4) ftruncate(r3, 0x2007ffb) close(r3) fcntl$notify(0xffffffffffffffff, 0x402, 0x8000003d) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x88882, 0x0) (fail_nth: 2) 9.003753736s ago: executing program 0 (id=7761): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000280)='veno', 0x4) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x4000) getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x4f) socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x3, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="18020000011b00000000000003000000850000002000000085000000a000000095"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x410fd, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xd, 0x0, &(0x7f0000000100)="0000000000000000000051229d", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r3 = msgget$private(0x0, 0xfffffffffffffffd) msgrcv(r3, 0x0, 0x0, 0x1, 0x3000) msgsnd(r3, &(0x7f0000000040)={0x1}, 0x8, 0x0) fstat(r1, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = gettid() capset(&(0x7f0000000080)={0x19980330, r6}, 0x0) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f00000008c0)={0x0, 0xffff, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r3, 0x1, &(0x7f0000000940)={{0x3, 0x0, r4, r5, 0x0, 0x75, 0x7}, 0x0, 0x0, 0x538, 0x0, 0x9, 0xff, 0x0, 0x885a, 0x5, 0xfa2e, r6, r7}) 8.564614593s ago: executing program 1 (id=7762): socket$packet(0x11, 0x3, 0x300) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) recvmsg(r0, &(0x7f00000015c0)={0x0, 0x0, 0x0}, 0x22) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0xffffffffffffffff, 0xb, &(0x7f0000000140)={0x30, 0x8d}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f00000000c0)=ANY=[@ANYRES64, @ANYBLOB="0100000000000000000003000000210001800400028008000300fdffffff0e"], 0x68}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x18, 0x6, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000fb000000000000000000e500020000000000e500fcff00000000060000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0xd, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe1e}, 0x94) r6 = socket$inet6_udp(0xa, 0x2, 0x0) fchownat(0xffffffffffffffff, &(0x7f0000000480)='./file0\x00', 0x0, 0x0, 0x1000) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, &(0x7f0000000180)={@remote, 0x8000000, 0x0, 0x0, 0x1, 0xffff}, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r7 = inotify_init1(0x80000) r8 = dup(r7) read$FUSE(r8, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYRES16=r5], &(0x7f0000000100)=""/17, 0x37, 0x11, 0x1, 0xfffffffb, 0x10000, @value=r8}, 0x28) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 8.006428465s ago: executing program 0 (id=7764): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) io_uring_setup(0x664b, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, 0x0) iopl(0x3) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) shutdown(0xffffffffffffffff, 0x1) mknod$loop(&(0x7f000000db40)='./file0\x00', 0x1000, 0x0) openat2(0xffffffffffffff9c, &(0x7f0000001400)='./file0\x00', &(0x7f0000001440)={0x122240, 0x10b, 0x7}, 0x18) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x3000009, 0x46031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00", @ANYRES32], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 7.316565006s ago: executing program 5 (id=7766): io_uring_setup(0x7c63, &(0x7f0000000440)={0x0, 0xd870, 0x40, 0x0, 0x268}) r0 = socket$kcm(0x10, 0x2, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0xa, 0x7, 0x106) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) setrlimit(0xd, &(0x7f0000000280)={0xc800, 0x10000}) setpriority(0x1, 0x0, 0x80000000) read$FUSE(0xffffffffffffffff, &(0x7f0000003680)={0x2020}, 0x2020) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000000c0)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef59510525ba56dcd79a36c23d3b9844e1571a86ea1698fa51f60a64c9f408000000e786a6d0bdd70000", 0x51}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x80) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r2, 0x0, 0x0) setsockopt$PNPIPE_ENCAP(r2, 0x113, 0x1, &(0x7f0000000140)=0x1, 0x4) socket$nl_route(0x10, 0x3, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x1, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0x16}}}, &(0x7f0000000280)) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r4 = io_uring_setup(0x666, &(0x7f00000002c0)={0x0, 0x284f, 0x40, 0xfffffffe, 0x235}) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r4, 0x12, 0x0, r5) 6.822323632s ago: executing program 0 (id=7768): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 6.299307524s ago: executing program 3 (id=7769): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x4) 6.079056463s ago: executing program 3 (id=7770): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB="300000002c0007012bbd7000ffdbdf25067c0000080001800900000014000380100001"], 0x30}, 0x1, 0x0, 0x0, 0x10000004}, 0xc010) r3 = socket(0x10, 0x803, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0x2, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newtfilter={0x44, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xc, 0x4}, {}, {0xf, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_BOS={0x5, 0x44, 0x7d}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @link_local={0x17, 0x80, 0xc2, 0x6, 0x5}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "182325", 0x10, 0x2c, 0x0, @remote, @local, {[@routing={0x2b, 0x0, 0x2, 0x41}, @dstopts={0x4}]}}}}}, 0x0) recvfrom$inet_nvme(r3, &(0x7f0000000340)=""/41, 0x29, 0x40000100, &(0x7f0000000440)=@tipc=@nameseq={0x1e, 0x1, 0x3, {0x40, 0x1, 0x4}}, 0x80) syz_emit_ethernet(0x3e, &(0x7f0000000240)=ANY=[@ANYBLOB="0180c20000000180c200000086dd6003000000082cfffe8000000000000000000000000000bbfe8000000000000000000000000000aa5c00020401000000"], 0x0) r6 = openat$autofs(0xffffff9c, &(0x7f0000000380), 0x8800, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(r6, 0xc0189376, &(0x7f0000000280)={{0x1, 0x1, 0x18, r2, {0x22}}, './file0\x00'}) ioctl$FS_IOC_FSSETXATTR(r7, 0x401c5820, &(0x7f00000002c0)={0x8000, 0xfffffffe, 0x62, 0x7, 0x1}) r8 = syz_open_procfs(0x0, &(0x7f0000000140)='ns\x00') getdents(r8, &(0x7f0000000000)=""/182, 0xb6) accept4$tipc(r8, &(0x7f0000000100), &(0x7f0000000140)=0x10, 0x800) 6.076626703s ago: executing program 5 (id=7771): socket$nl_rdma(0x10, 0x3, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r2, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000080), &(0x7f0000000000)=0x8) getresgid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) 5.887946914s ago: executing program 3 (id=7772): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000280)='veno', 0x4) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x4000) getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x4f) socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x3, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="18020000011b00000000000003000000850000002000000085000000a000000095"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x410fd, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xd, 0x0, &(0x7f0000000100)="0000000000000000000051229d", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r3 = msgget$private(0x0, 0xfffffffffffffffd) msgrcv(r3, 0x0, 0x0, 0x1, 0x3000) msgsnd(r3, &(0x7f0000000040)={0x1}, 0x8, 0x0) fstat(r1, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = gettid() capset(&(0x7f0000000080)={0x19980330, r6}, 0x0) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f00000008c0)={0x0, 0xffff, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r3, 0x1, &(0x7f0000000940)={{0x3, 0x0, r4, r5, 0x0, 0x75, 0x7}, 0x0, 0x0, 0x538, 0x0, 0x9, 0xff, 0x0, 0x885a, 0x5, 0xfa2e, r6, r7}) 5.611966208s ago: executing program 1 (id=7773): r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000240)={'syztnl2\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x2d, 0x3, 0x6, 0x2, 0x24, @empty, @ipv4={'\x00', '\xff\xff', @empty}, 0x40, 0x20, 0x0, 0xffffffff}}) r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000300), 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{0x1, 0xffffffffffffffff}, &(0x7f0000000340), &(0x7f0000000540)=r2}, 0x1c) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r6, 0x5, &(0x7f00000005c0)='fd', 0x0, r5) pidfd_getfd(0xffffffffffffffff, r2, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r4, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000380)=@bpf_tracing={0x1a, 0x1c, &(0x7f0000000640)=@raw=[@alu={0x7, 0x0, 0x0, 0x3, 0x0, 0xffffffffffffffff, 0xfffffffffffffff0}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @map_idx={0x18, 0xb, 0x5, 0x0, 0x10}, @tail_call={{0x18, 0x2, 0x1, 0x0, r5}}, @call={0x85, 0x0, 0x0, 0x67}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}}], &(0x7f0000000080)='GPL\x00', 0x1, 0xf6, &(0x7f00000000c0)=""/246, 0x40f00, 0x8, '\x00', r1, 0x1a, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x4, 0x4}, 0x8, 0x10, &(0x7f00000002c0)={0x0, 0x1, 0x8fd5, 0x3}, 0x10, 0x11997, r2, 0x4, 0x0, &(0x7f0000000480)=[{0x3, 0x3, 0x9, 0x9}, {0x5, 0x3, 0xb, 0x6}, {0x3, 0x5, 0x1, 0x5}, {0x5, 0x3, 0xb, 0x4}], 0x10, 0x6}, 0x94) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r8, 0x40046f41, &(0x7f0000000440)=0x10) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)={{0x14}, [@NFT_MSG_DELCHAIN={0x30, 0x5, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x58}, 0x1, 0x0, 0x0, 0x2800c005}, 0x4) close(r0) syz_emit_vhci(&(0x7f0000000140)=@HCI_EVENT_PKT={0x4, @hci_ev_clock_offset={{0x1c, 0x5}, {0x0, 0xc8, 0x3}}}, 0x8) 5.595828205s ago: executing program 0 (id=7774): bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) sendto$packet(r0, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) mbind(&(0x7f0000ccd000/0x1000)=nil, 0x1000, 0x1, 0x0, 0x6, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r2) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000740)={0x38, r3, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLST={0x10, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x4}]}, 0x38}}, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) preadv(r1, &(0x7f00000002c0)=[{&(0x7f00000001c0)=""/194, 0xc2}], 0x1, 0x5fae, 0x5) 5.254122816s ago: executing program 1 (id=7775): bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) sendto$packet(r0, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) mbind(&(0x7f0000ccd000/0x1000)=nil, 0x1000, 0x1, 0x0, 0x6, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r2) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000740)={0x38, r3, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLST={0x10, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x4}]}, 0x38}}, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) preadv(r1, &(0x7f00000002c0)=[{&(0x7f00000001c0)=""/194, 0xc2}], 0x1, 0x5fae, 0x5) 5.004227076s ago: executing program 5 (id=7776): prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x80000007, 0x1}, 0x1c) r1 = socket(0x10, 0x803, 0x0) getsockname$packet(r1, 0x0, 0x0) recvmmsg$unix(r0, &(0x7f00000007c0)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000005c0)=""/227, 0xe3}], 0x1}}], 0x1, 0x40000000, 0x0) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) (fail_nth: 2) 5.003524418s ago: executing program 0 (id=7777): r0 = add_key$fscrypt_v1(&(0x7f0000000200), &(0x7f00000000c0)={'fscrypt:', @desc2}, &(0x7f0000000440)={0x0, "bfdce99fa0a15ad765e2d11a06db42e4f62deb72e935e793f8349dbe36f9b1f140fd7a541cd5ef29256e5e20d8a9bc0eba6dfa2b410dde9154c9c7d99a5e9005", 0x80032}, 0x48, 0xfffffffffffffffc) keyctl$get_persistent(0x16, 0x0, r0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1, 0x4, &(0x7f0000006680)) r2 = socket$can_bcm(0x1d, 0x2, 0x2) fstatfs(r2, &(0x7f0000000000)=""/204) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$uac2(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_open_dev$dvb_dvr(&(0x7f0000000180), 0x5, 0x200800) r3 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x8102) writev(r3, &(0x7f0000001500)=[{&(0x7f0000000000)="47ad3d32240000006bdb74ecb9f7c342cc2c008d3ec3c2d2d5bbf6a4e41419ec3dc11a4f85090084665ea561e52d97fbe9e8c5a0", 0x34}], 0x1) r4 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000140)={&(0x7f0000001680)=[{0x7, 0x6221, 0x0, 0x0}], 0x1}) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$FBIOPUT_VSCREENINFO(r5, 0x4601, &(0x7f0000000380)={0x353, 0x78, 0x300, 0x0, 0xa, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x100}, {}, {}, 0x0, 0x100, 0x3, 0x2, 0x1, 0x4, 0x9f6, 0x3, 0x1ff, 0x803d, 0x1, 0x7, 0x5f, 0x202, 0x1, 0xc}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io$uac3(r1, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.878001114s ago: executing program 3 (id=7778): socket$netlink(0x10, 0x3, 0x0) socket(0x11, 0xa, 0x979) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000340), 0xf) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0xa8300, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) pwritev2(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000100)="3f6c5b761046b0a77db63c34e13408e27fcea6c7605a226d926b187e4d85c6dc144795bcb7eb57aa924187b4915c60848ced868e669e7383365c1b98ccdf87f4db91bf74c981a25caf0102470956f6b38a96d397cb995a13c9f1c474091c01e8c3c09a356e7dac9e7405acd7d332ba3fbb177cd8b2ffba8cc8d01264085fa41b35c651a946b8f2034baaa01bc5c5b1179e2e6e82dc3f059c52451ba5abc1", 0x9e}, {&(0x7f00000003c0)="87348b520f8a493ad8a047181df6537bdb1a05021f46d8199da66dd518ae99529927d7ba3d466263445843914d169d37b43a394b7f72563bb2b3f4d7d82ce7f5fd8465297d841e964f9ebefcab497fd319e92f52", 0x54}, {&(0x7f00000005c0)="f92c1e79acd0f7cdc8d83328244f9958c71163a4241e65d197e16cc0f83b426f50b2e198556fb3093a6c773014485fa3d250498d3c37886f01e28967891c211476b81d48e0d8c0e00a702dc058b1ea7a3379e60ec24f132994e5e71486e475fbd0bc45120c98a1f481eeed303a49c3715c922f20115a81e65ff34d2b6d903525677b13dc5a7a0dcf0d9fefab6f10ac3943b6fa40", 0x94}, {&(0x7f0000000540)="2f3a267f685a2d1298bed1b1df1e89e1fd29af64d0999594571ec52aa9ef8d2142b7d0ee618cd40d6c820d028cd41af19d307be674027c1096e85f739afb383cde82b296fa62d3e85d13dc0ba6", 0x4d}], 0x4, 0x0, 0x1, 0x1d) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x13, 0x4}) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) open(&(0x7f0000000200)='./file0\x00', 0x4008040, 0x0) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) splice(r4, 0x0, r3, 0x0, 0x6, 0x0) write(r3, &(0x7f00000002c0)="fe", 0xfdef) read$watch_queue(r2, &(0x7f0000000780)=""/221, 0xfdef) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3]) sendmsg$NFNL_MSG_CTHELPER_GET(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000010901"], 0x14}}, 0x0) pselect6(0x40, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0xc}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x381, 0x0, 0x0, 0x9e25, 0x10000000000}, 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x13) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)=ANY=[@ANYBLOB="7569ce8f", @ANYRESHEX=0x0, @ANYBLOB=',\x00']) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) 4.561976118s ago: executing program 1 (id=7779): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x4) 4.503560159s ago: executing program 1 (id=7780): io_uring_setup(0x7c63, &(0x7f0000000440)={0x0, 0xd870, 0x40, 0x0, 0x268}) r0 = socket$kcm(0x10, 0x2, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0xa, 0x7, 0x106) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) setrlimit(0xd, &(0x7f0000000280)={0xc800, 0x10000}) setpriority(0x1, 0x0, 0x80000000) read$FUSE(0xffffffffffffffff, &(0x7f0000003680)={0x2020}, 0x2020) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000000c0)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef59510525ba56dcd79a36c23d3b9844e1571a86ea1698fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb918", 0x57}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x80) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r2, 0x0, 0x0) setsockopt$PNPIPE_ENCAP(r2, 0x113, 0x1, &(0x7f0000000140)=0x1, 0x4) socket$nl_route(0x10, 0x3, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x1, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0x16}}}, &(0x7f0000000280)) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r4 = io_uring_setup(0x666, &(0x7f00000002c0)={0x0, 0x284f, 0x40, 0xfffffffe, 0x235}) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r4, 0x12, 0x0, r5) 4.040254486s ago: executing program 5 (id=7781): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, 0x0, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000100)={0x0, 0x9, 0xffff0000, 0x1, 0x0, 0x4, 0x4, 0x5, {0x0, @in6={{0xa, 0x4e22, 0x2, @private1, 0xb1}}, 0x6, 0x6bae33de, 0x80000000, 0xfffffff7}}, &(0x7f00000001c0)=0xb0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000440)={0x0, 0x23, "fee8e0005b1449fb422f5372bd29d46e7cddaa47e3c3a6e3b7aa8874d0bde53d176ac6"}, 0x0) r2 = fsopen(&(0x7f0000000280)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, 0x0, &(0x7f0000005fc0)='//\xf2/\x06\b\xba\xdf//\xdc/\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) splice(r5, 0x0, r4, 0x0, 0x6, 0x0) write(r4, &(0x7f00000002c0)="fe", 0xfdef) read$watch_queue(r3, &(0x7f0000000780)=""/221, 0xfdef) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) sendmsg$NFNL_MSG_CTHELPER_GET(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000010901"], 0x14}}, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000440)={0x0, 0x9, 0x7, 0x10000, 0x12, "000000ddff00000000000000000000f30200"}) pselect6(0x40, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0xc}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x381, 0x0, 0x0, 0x9e25, 0x10000000000}, 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x13) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)=ANY=[@ANYBLOB="7569ce8f", @ANYRESHEX=0x0, @ANYBLOB=',\x00']) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) 3.345150469s ago: executing program 1 (id=7783): r0 = io_uring_setup(0x7c63, &(0x7f0000000440)={0x0, 0xd870, 0x40, 0x0, 0x268}) r1 = socket$kcm(0x10, 0x2, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0xa, 0x7, 0x106) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) setrlimit(0xd, &(0x7f0000000280)={0xc800, 0x10000}) setpriority(0x1, 0x0, 0x80000000) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='stat\x00') read$FUSE(r3, &(0x7f0000003680)={0x2020}, 0x2020) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000000c0)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef59510525ba56", 0x2e}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x80) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r4, 0x0, 0x0) setsockopt$PNPIPE_ENCAP(r4, 0x113, 0x1, &(0x7f0000000140)=0x1, 0x4) socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_setup(0x9b, 0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x1, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0x16}}}, &(0x7f0000000280)) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000000, 0x4010, r0, 0x10000000) r5 = socket$key(0xf, 0x3, 0x2) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) sendmsg$key(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYRES16], 0x28}}, 0x4000) r7 = io_uring_setup(0x666, &(0x7f00000002c0)={0x0, 0x284f, 0x40, 0xfffffffe, 0x235}) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0x12, 0x0, r8) 3.081654038s ago: executing program 5 (id=7784): mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) open(&(0x7f0000000200)='./file0\x00', 0x4008040, 0x0) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) splice(r1, 0x0, r0, 0x0, 0x6, 0x0) write(r0, &(0x7f00000002c0)="fe", 0xfdef) sendmsg$NFNL_MSG_CTHELPER_GET(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000010901"], 0x14}}, 0x0) 2.599538649s ago: executing program 3 (id=7785): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000480), 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2], 0x1c}}, 0x840) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x1c) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b"], 0x0) r3 = socket(0x2, 0xa, 0x0) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='befs\x00', 0x200000, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r3, 0x8912, &(0x7f0000000040)) 0s ago: executing program 5 (id=7786): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000280)='veno', 0x4) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x4000) getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x4f) socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x3, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="18020000011b00000000000003000000850000002000000085000000a000000095"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x410fd, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="0000000000000000000051229dc9", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = msgget$private(0x0, 0xfffffffffffffffd) msgrcv(r3, 0x0, 0x0, 0x1, 0x3000) msgsnd(r3, 0x0, 0x0, 0x0) fstat(r1, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = gettid() capset(&(0x7f0000000080)={0x19980330, r6}, 0x0) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f00000008c0)={0x0, 0xffff, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r3, 0x1, &(0x7f0000000940)={{0x3, 0x0, r4, r5, 0x0, 0x75, 0x7}, 0x0, 0x0, 0x538, 0x0, 0x9, 0xff, 0x0, 0x885a, 0x5, 0xfa2e, r6, r7}) kernel console output (not intermixed with test programs): 2407.754369][ T2529] usb 10-1: USB disconnect, device number 2 [ 2407.927267][ T7531] netlink: 'syz.1.7331': attribute type 2 has an invalid length. [ 2408.350259][ T1385] usb usb44-port1: unable to enumerate USB device [ 2408.542688][ T7544] FAULT_INJECTION: forcing a failure. [ 2408.542688][ T7544] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2408.567992][ T7544] CPU: 3 UID: 0 PID: 7544 Comm: syz.0.7336 Tainted: G L syzkaller #0 PREEMPT(full) [ 2408.568013][ T7544] Tainted: [L]=SOFTLOCKUP [ 2408.568017][ T7544] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2408.568023][ T7544] Call Trace: [ 2408.568027][ T7544] [ 2408.568032][ T7544] dump_stack_lvl+0x100/0x190 [ 2408.568054][ T7544] should_fail_ex.cold+0x5/0xa [ 2408.568066][ T7544] ? prepare_alloc_pages+0x16d/0x5f0 [ 2408.568081][ T7544] should_fail_alloc_page+0xeb/0x140 [ 2408.568095][ T7544] prepare_alloc_pages+0x1f0/0x5f0 [ 2408.568110][ T7544] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 2408.568141][ T7544] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 2408.568161][ T7544] ? __lock_acquire+0x4a5/0x2630 [ 2408.568177][ T7544] ? __lock_acquire+0x4a5/0x2630 [ 2408.568197][ T7544] ? lock_acquire+0x1b1/0x370 [ 2408.568212][ T7544] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2408.568228][ T7544] ? policy_nodemask+0xed/0x4f0 [ 2408.568242][ T7544] alloc_pages_mpol+0x1fb/0x540 [ 2408.568255][ T7544] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 2408.568268][ T7544] ? swap_entry_swapped+0x20c/0x2a0 [ 2408.568280][ T7544] ? __pfx_swap_entry_swapped+0x10/0x10 [ 2408.568294][ T7544] folio_alloc_mpol_noprof+0x36/0x260 [ 2408.568310][ T7544] swap_cache_alloc_folio+0x1a8/0x300 [ 2408.568327][ T7544] ? __pfx_swap_cache_alloc_folio+0x10/0x10 [ 2408.568344][ T7544] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 2408.568359][ T7544] swap_cluster_readahead+0x53b/0x770 [ 2408.568378][ T7544] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 2408.568394][ T7544] ? __lock_acquire+0x4a5/0x2630 [ 2408.568410][ T7544] ? rcu_is_watching+0x12/0xc0 [ 2408.568426][ T7544] ? finish_task_switch.isra.0+0x2cb/0x1010 [ 2408.568451][ T7544] ? do_raw_spin_lock+0x128/0x260 [ 2408.568473][ T7544] ? get_vma_policy+0x23d/0x3b0 [ 2408.568496][ T7544] swapin_readahead+0x160/0x12c0 [ 2408.568530][ T7544] ? __pfx_swapin_readahead+0x10/0x10 [ 2408.568555][ T7544] ? find_held_lock+0x2b/0x80 [ 2408.568599][ T7544] ? swap_table_get+0x103/0x2c0 [ 2408.568625][ T7544] ? swap_table_get+0x10d/0x2c0 [ 2408.568642][ T7544] ? swap_cache_get_folio+0x286/0x350 [ 2408.568658][ T7544] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 2408.568677][ T7544] ? __pfx_get_swap_device+0x10/0x10 [ 2408.568701][ T7544] ? do_swap_page+0x931/0x6180 [ 2408.568726][ T7544] do_swap_page+0x931/0x6180 [ 2408.568751][ T7544] ? poll_freewait+0x1be/0x250 [ 2408.568776][ T7544] ? __pfx_do_swap_page+0x10/0x10 [ 2408.568805][ T7544] ? rcu_is_watching+0x12/0xc0 [ 2408.568824][ T7544] ? __pte_offset_map+0x179/0x310 [ 2408.568849][ T7544] __handle_mm_fault+0x192f/0x2a00 [ 2408.568879][ T7544] ? mt_find+0x45e/0x8e0 [ 2408.568907][ T7544] ? __pfx___handle_mm_fault+0x10/0x10 [ 2408.568932][ T7544] ? __pfx_mt_find+0x10/0x10 [ 2408.568969][ T7544] ? find_vma+0xbf/0x140 [ 2408.569004][ T7544] ? __pfx_find_vma+0x10/0x10 [ 2408.569025][ T7544] handle_mm_fault+0x37b/0xa30 [ 2408.569053][ T7544] do_user_addr_fault+0x74c/0x12f0 [ 2408.569077][ T7544] ? trace_page_fault_kernel+0x7a/0x200 [ 2408.569099][ T7544] exc_page_fault+0x6f/0xd0 [ 2408.569123][ T7544] asm_exc_page_fault+0x26/0x30 [ 2408.569162][ T7544] RIP: 0010:compat_put_bitmap+0xc3/0x180 [ 2408.569190][ T7544] Code: fc ff df e8 df ed 0a 00 4c 89 ef 49 83 c5 08 48 89 f8 48 c1 e8 03 42 80 3c 30 00 0f 85 a3 00 00 00 49 8b 6d f8 4d 8d 7c 24 04 <41> 89 2c 24 e8 b4 ed 0a 00 49 83 c4 08 48 c1 ed 20 41 89 2f e8 a4 [ 2408.569203][ T7544] RSP: 0000:ffffc9000cd07b18 EFLAGS: 00050246 [ 2408.569213][ T7544] RAX: 1ffff920019a0f88 RBX: 0000000000000002 RCX: ffffffff81fd0f6c [ 2408.569220][ T7544] RDX: ffff888052278000 RSI: ffffffff81fd0f81 RDI: ffffc9000cd07c40 [ 2408.569227][ T7544] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000001 [ 2408.569233][ T7544] R10: 0000000000000002 R11: 0000000000000000 R12: 0000000080000100 [ 2408.569240][ T7544] R13: ffffc9000cd07c48 R14: dffffc0000000000 R15: 0000000080000104 [ 2408.569250][ T7544] ? compat_put_bitmap+0x8c/0x180 [ 2408.569266][ T7544] ? compat_put_bitmap+0xa1/0x180 [ 2408.569284][ T7544] ? compat_put_bitmap+0xa1/0x180 [ 2408.569301][ T7544] compat_core_sys_select+0x6d9/0x8b0 [ 2408.569317][ T7544] ? __pfx_compat_core_sys_select+0x10/0x10 [ 2408.569344][ T7544] ? __pfx_set_compat_user_sigmask+0x10/0x10 [ 2408.569357][ T7544] ? ktime_get_ts64+0x318/0x420 [ 2408.569373][ T7544] ? ktime_get_ts64+0x257/0x420 [ 2408.569390][ T7544] do_compat_pselect+0x27a/0x2b0 [ 2408.569403][ T7544] ? __pfx_do_compat_pselect+0x10/0x10 [ 2408.569421][ T7544] __ia32_compat_sys_pselect6_time32+0x152/0x1c0 [ 2408.569438][ T7544] __do_fast_syscall_32+0xe7/0x970 [ 2408.569453][ T7544] ? lockdep_hardirqs_on+0x78/0x100 [ 2408.569469][ T7544] do_fast_syscall_32+0x32/0x70 [ 2408.569485][ T7544] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2408.569498][ T7544] RIP: 0023:0xf708ef7c [ 2408.569507][ T7544] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2408.569517][ T7544] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000134 [ 2408.569526][ T7544] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 0000000080000100 [ 2408.569532][ T7544] RDX: 0000000000000000 RSI: 0000000080000240 RDI: 0000000080000280 [ 2408.569539][ T7544] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2408.569545][ T7544] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 2408.569551][ T7544] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2408.569564][ T7544] [ 2409.188091][ T7561] netlink: 'syz.5.7339': attribute type 2 has an invalid length. [ 2409.512108][ T5754] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 2409.545712][ T5754] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 2409.592503][ T5754] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 2409.592701][T30567] syz_tun (unregistering): left allmulticast mode [ 2409.599185][ T5754] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 2409.602166][ T5754] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 2409.985524][ T7570] hsr0 speed is unknown, defaulting to 1000 [ 2411.409576][ T7620] netlink: 'syz.1.7355': attribute type 2 has an invalid length. [ 2411.641367][ T7570] bridge0: port 1(bridge_slave_0) entered blocking state [ 2411.654152][ T7570] bridge0: port 1(bridge_slave_0) entered disabled state [ 2411.659524][ T7570] bridge_slave_0: entered allmulticast mode [ 2411.669362][ T7570] bridge_slave_0: entered promiscuous mode [ 2411.737519][ T7570] bridge0: port 2(bridge_slave_1) entered blocking state [ 2411.743230][ T7570] bridge0: port 2(bridge_slave_1) entered disabled state [ 2411.751824][ T7570] bridge_slave_1: entered allmulticast mode [ 2411.760185][ T7570] bridge_slave_1: entered promiscuous mode [ 2411.825061][ T5757] Bluetooth: hci4: command tx timeout [ 2411.890087][ T7570] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2411.921228][ T7570] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2412.305959][ T7570] team0: Port device team_slave_0 added [ 2412.324359][ T226] dvmrp0: left allmulticast mode [ 2412.407393][ T7633] netlink: 'syz.0.7357': attribute type 2 has an invalid length. [ 2413.129088][ T226] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2413.170928][ T7642] netlink: 'syz.5.7359': attribute type 2 has an invalid length. [ 2413.299610][ T226] bond_slave_0: left promiscuous mode [ 2413.573790][ T226] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2413.755893][ T226] bond_slave_1: left promiscuous mode [ 2413.778679][ T226] bond0 (unregistering): Released all slaves [ 2414.068126][ T5757] Bluetooth: hci4: command tx timeout [ 2414.076431][ T226] bond1 (unregistering): Released all slaves [ 2414.304581][ T7570] team0: Port device team_slave_1 added [ 2414.504224][ T7570] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2414.512711][ T7570] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2414.523563][ T7570] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2414.545252][ T7570] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2414.547519][ T7570] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2414.558520][ T7570] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2414.625758][ T7570] hsr_slave_0: entered promiscuous mode [ 2414.629121][ T7570] hsr_slave_1: entered promiscuous mode [ 2414.632153][ T7570] debugfs: 'hsr0' already exists in 'hsr' [ 2414.638316][ T7570] Cannot create hsr debugfs directory [ 2414.874202][ T5459] 8021q: adding VLAN 0 to HW filter on device eth10 [ 2415.055636][ T7666] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7363'. [ 2415.374158][ T226] hsr_slave_0: left promiscuous mode [ 2415.380207][ T226] hsr_slave_1: left promiscuous mode [ 2415.384195][ T226] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2415.389144][ T226] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2415.436310][ T7676] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7366'. [ 2415.721850][ T226] team0 (unregistering): Port device team_slave_1 removed [ 2415.743973][ T226] team0 (unregistering): Port device team_slave_0 removed [ 2415.977781][ T7686] bridge_slave_0: default FDB implementation only supports local addresses [ 2416.294668][ T5757] Bluetooth: hci4: command tx timeout [ 2416.368382][ T7570] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 2416.379877][ T7570] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2416.387674][ T7570] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 2416.402436][ T7570] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2416.410808][ T7570] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 2416.417441][ T7570] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2416.423152][ T7570] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 2416.433410][ T7570] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2416.531639][ T226] IPVS: stop unused estimator thread 0... [ 2416.573372][ T7711] netlink: 'syz.1.7370': attribute type 2 has an invalid length. [ 2416.793173][ T7570] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2416.811964][ T7570] 8021q: adding VLAN 0 to HW filter on device team0 [ 2416.821172][ T100] bridge0: port 1(bridge_slave_0) entered blocking state [ 2416.824197][ T100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2416.859055][ T2675] bridge0: port 2(bridge_slave_1) entered blocking state [ 2416.862114][ T2675] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2416.952420][ T7570] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 2418.450775][ T7570] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2418.490039][ T7570] veth0_vlan: entered promiscuous mode [ 2418.493858][ T5757] Bluetooth: hci4: command tx timeout [ 2418.508861][ T7570] veth1_vlan: entered promiscuous mode [ 2418.536724][ T7570] veth0_macvtap: entered promiscuous mode [ 2418.545730][ T7570] veth1_macvtap: entered promiscuous mode [ 2418.559193][ T7570] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2418.588028][ T7570] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2418.619658][ T100] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2418.626362][ T100] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2418.646303][ T100] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2418.649333][ T100] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2418.716970][ T4393] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2418.722017][ T4393] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2418.755834][ T4393] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2418.760742][ T4393] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2421.506001][ T7789] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 2421.508044][ T7789] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 2421.510865][ T7789] vhci_hcd vhci_hcd.0: Device attached [ 2421.536449][T27891] usb 8-1: new high-speed USB device number 114 using dummy_hcd [ 2421.708403][T27891] usb 8-1: Using ep0 maxpacket: 8 [ 2421.725670][T27891] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 2421.743849][T27891] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2421.766832][T27891] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2421.796901][T27891] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 2421.817652][T27891] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2421.833392][T27891] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2421.839118][T27891] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2422.257234][ T7792] vhci_hcd: connection closed [ 2422.309243][ T2675] vhci_hcd vhci_hcd.0: stop threads [ 2422.322528][ T2675] vhci_hcd vhci_hcd.0: release socket [ 2422.349596][ T2675] vhci_hcd vhci_hcd.0: disconnect device [ 2422.368165][T18121] usb 38-1: SetAddress Request (20) to port 0 [ 2422.540195][T18121] usb 38-1: new SuperSpeed USB device number 20 using vhci_hcd [ 2422.714890][T27891] usb 8-1: usb_control_msg returned -32 [ 2422.718655][T27891] usbtmc 8-1:16.0: can't read capabilities [ 2424.099211][ T7778] usbtmc 8-1:16.0: usb_control_msg returned -71 [ 2424.148876][ T7817] usbtmc 8-1:16.0: send_request_dev_dep_msg_in returned -90 [ 2424.153541][T21251] usb 8-1: USB disconnect, device number 114 [ 2424.182063][ T7818] usbtmc 8-1:16.0: send_request_dev_dep_msg_in returned -19 [ 2427.959074][ T7850] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(7) [ 2427.961755][ T7850] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 2427.980400][T18121] usb 38-1: device descriptor read/8, error -110 [ 2428.003708][ T7850] vhci_hcd vhci_hcd.0: Device attached [ 2428.257419][T18121] usb 38-1: SetAddress Request (21) to port 0 [ 2428.260385][T18121] usb 38-1: new SuperSpeed USB device number 21 using vhci_hcd [ 2428.290070][ T7058] usb 48-1: SetAddress Request (10) to port 0 [ 2428.292926][ T7058] usb 48-1: new SuperSpeed USB device number 10 using vhci_hcd [ 2428.722037][ T7851] vhci_hcd: connection reset by peer [ 2428.730058][ T3544] vhci_hcd vhci_hcd.5: stop threads [ 2428.731814][ T3544] vhci_hcd vhci_hcd.5: release socket [ 2428.736499][ T3544] vhci_hcd vhci_hcd.5: disconnect device [ 2429.784724][ T7870] FAULT_INJECTION: forcing a failure. [ 2429.784724][ T7870] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2429.789213][ T7870] CPU: 2 UID: 0 PID: 7870 Comm: syz.5.7406 Tainted: G L syzkaller #0 PREEMPT(full) [ 2429.789231][ T7870] Tainted: [L]=SOFTLOCKUP [ 2429.789235][ T7870] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2429.789242][ T7870] Call Trace: [ 2429.789246][ T7870] [ 2429.789251][ T7870] dump_stack_lvl+0x100/0x190 [ 2429.789273][ T7870] should_fail_ex.cold+0x5/0xa [ 2429.789287][ T7870] _copy_from_user+0x2e/0xd0 [ 2429.789303][ T7870] kstrtouint_from_user+0xd6/0x1d0 [ 2429.789314][ T7870] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 2429.789325][ T7870] ? __lock_acquire+0x4a5/0x2630 [ 2429.789347][ T7870] proc_fail_nth_write+0x83/0x220 [ 2429.789369][ T7870] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2429.789398][ T7870] vfs_write+0x2aa/0x1070 [ 2429.789417][ T7870] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2429.789455][ T7870] ? __pfx_vfs_write+0x10/0x10 [ 2429.789472][ T7870] ? find_held_lock+0x2b/0x80 [ 2429.789492][ T7870] ? __fget_files+0x215/0x3d0 [ 2429.789517][ T7870] ? __fget_files+0x21f/0x3d0 [ 2429.789543][ T7870] ksys_write+0x12a/0x250 [ 2429.789562][ T7870] ? __pfx_ksys_write+0x10/0x10 [ 2429.789584][ T7870] ? rcu_is_watching+0x12/0xc0 [ 2429.789608][ T7870] do_int80_emulation+0x14b/0x720 [ 2429.789639][ T7870] asm_int80_emulation+0x1a/0x20 [ 2429.789657][ T7870] RIP: 0023:0xf71861ab [ 2429.789672][ T7870] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 2429.789689][ T7870] RSP: 002b:00000000f54464bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 2429.789705][ T7870] RAX: ffffffffffffffda RBX: 0000000000000017 RCX: 00000000f54465d0 [ 2429.789716][ T7870] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 2429.789727][ T7870] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2429.789737][ T7870] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 2429.789748][ T7870] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2429.789772][ T7870] [ 2429.860959][ C2] hpet_rtc_timer_reinit: 35 callbacks suppressed [ 2429.860969][ C2] hpet: Lost 4 RTC interrupts [ 2430.001466][ T2529] usb 6-1: new high-speed USB device number 119 using dummy_hcd [ 2430.182054][ T2529] usb 6-1: Using ep0 maxpacket: 8 [ 2430.185026][ T2529] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 2430.187640][ T2529] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2430.190734][ T2529] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2430.196330][ T2529] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 2430.200746][ T2529] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2430.437140][ T2529] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2430.447770][ T2529] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2430.550564][ T7885] FAULT_INJECTION: forcing a failure. [ 2430.550564][ T7885] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2430.554992][ T7885] CPU: 1 UID: 0 PID: 7885 Comm: syz.0.7411 Tainted: G L syzkaller #0 PREEMPT(full) [ 2430.555009][ T7885] Tainted: [L]=SOFTLOCKUP [ 2430.555014][ T7885] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2430.555020][ T7885] Call Trace: [ 2430.555025][ T7885] [ 2430.555029][ T7885] dump_stack_lvl+0x100/0x190 [ 2430.555050][ T7885] should_fail_ex.cold+0x5/0xa [ 2430.555064][ T7885] _copy_from_user+0x2e/0xd0 [ 2430.555079][ T7885] move_addr_to_kernel+0x65/0x170 [ 2430.555096][ T7885] get_compat_msghdr+0x3ee/0x4b0 [ 2430.555109][ T7885] ? __pfx_get_compat_msghdr+0x10/0x10 [ 2430.555126][ T7885] ___sys_sendmsg+0x1b6/0x1e0 [ 2430.555141][ T7885] ? __pfx____sys_sendmsg+0x10/0x10 [ 2430.555161][ T7885] ? rcu_is_watching+0x12/0xc0 [ 2430.555181][ T7885] __sys_sendmsg+0x170/0x220 [ 2430.555193][ T7885] ? __pfx___sys_sendmsg+0x10/0x10 [ 2430.555202][ T7885] ? __fget_files+0x21f/0x3d0 [ 2430.555218][ T7885] ? ksys_write+0x1ac/0x250 [ 2430.555231][ T7885] ? rcu_is_watching+0x12/0xc0 [ 2430.555245][ T7885] __do_fast_syscall_32+0xe7/0x970 [ 2430.555263][ T7885] ? lockdep_hardirqs_on+0x78/0x100 [ 2430.555279][ T7885] do_fast_syscall_32+0x32/0x70 [ 2430.555295][ T7885] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2430.555322][ T7885] RIP: 0023:0xf708ef7c [ 2430.555331][ T7885] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2430.555342][ T7885] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 2430.555353][ T7885] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080002840 [ 2430.555359][ T7885] RDX: 000000000000c180 RSI: 0000000000000000 RDI: 0000000000000000 [ 2430.555365][ T7885] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2430.555372][ T7885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2430.555377][ T7885] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2430.555390][ T7885] [ 2430.948212][ T2529] usb 6-1: usb_control_msg returned -32 [ 2430.950090][ T2529] usbtmc 6-1:16.0: can't read capabilities [ 2431.186967][ T7880] hsr0 speed is unknown, defaulting to 1000 [ 2431.339573][ T7868] usbtmc 6-1:16.0: usb_control_msg returned -71 [ 2431.339808][ T7023] usb 6-1: USB disconnect, device number 119 [ 2431.342459][ T7890] usbtmc 6-1:16.0: send_request_dev_dep_msg_in returned -19 [ 2431.347701][ T7892] usbtmc 6-1:16.0: send_request_dev_dep_msg_in returned -19 [ 2432.301029][ T7905] FAULT_INJECTION: forcing a failure. [ 2432.301029][ T7905] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2432.305080][ T7905] CPU: 2 UID: 0 PID: 7905 Comm: syz.1.7416 Tainted: G L syzkaller #0 PREEMPT(full) [ 2432.305097][ T7905] Tainted: [L]=SOFTLOCKUP [ 2432.305101][ T7905] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2432.305107][ T7905] Call Trace: [ 2432.305112][ T7905] [ 2432.305116][ T7905] dump_stack_lvl+0x100/0x190 [ 2432.305138][ T7905] should_fail_ex.cold+0x5/0xa [ 2432.305152][ T7905] strncpy_from_user+0x3b/0x2d0 [ 2432.305170][ T7905] do_getname+0x78/0x390 [ 2432.305186][ T7905] do_sys_openat2+0xc5/0x1e0 [ 2432.305203][ T7905] ? __pfx_do_sys_openat2+0x10/0x10 [ 2432.305219][ T7905] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2432.305239][ T7905] __ia32_compat_sys_openat+0x12d/0x210 [ 2432.305257][ T7905] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 2432.305274][ T7905] ? fput+0x79/0x100 [ 2432.305288][ T7905] ? ksys_write+0x1ac/0x250 [ 2432.305301][ T7905] ? rcu_is_watching+0x12/0xc0 [ 2432.305315][ T7905] __do_fast_syscall_32+0xe7/0x970 [ 2432.305330][ T7905] ? lockdep_hardirqs_on+0x78/0x100 [ 2432.305350][ T7905] do_fast_syscall_32+0x32/0x70 [ 2432.305367][ T7905] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2432.305380][ T7905] RIP: 0023:0xf700ef7c [ 2432.305389][ T7905] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2432.305400][ T7905] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 2432.305410][ T7905] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000000 [ 2432.305417][ T7905] RDX: 0000000000088000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2432.305423][ T7905] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2432.305429][ T7905] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 2432.305435][ T7905] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2432.305448][ T7905] [ 2432.384895][ C2] hpet: Lost 4 RTC interrupts [ 2432.505395][ T7908] netlink: 32 bytes leftover after parsing attributes in process `syz.1.7417'. [ 2433.709169][ T7058] usb 48-1: device descriptor read/8, error -110 [ 2433.718490][T18121] usb 38-1: device descriptor read/8, error -110 [ 2433.861721][T18121] usb usb38-port1: attempt power cycle [ 2433.932696][ T869] usb 8-1: new high-speed USB device number 115 using dummy_hcd [ 2434.126937][ T869] usb 8-1: Using ep0 maxpacket: 8 [ 2434.130766][ T869] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 2434.141198][ T7058] usb usb48-port1: attempt power cycle [ 2434.142069][ T869] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2434.163487][ T869] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2434.170805][ T869] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 2434.177604][ T869] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2434.187129][ T869] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2434.193024][ T869] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2434.413128][T18121] usb 38-1: SetAddress Request (22) to port 0 [ 2434.417263][T18121] usb 38-1: new SuperSpeed USB device number 22 using vhci_hcd [ 2434.446995][ T869] usb 8-1: usb_control_msg returned -32 [ 2434.454175][ T869] usbtmc 8-1:16.0: can't read capabilities [ 2434.745218][ T7058] usb usb48-port1: unable to enumerate USB device [ 2434.841905][ T869] usb 8-1: USB disconnect, device number 115 [ 2434.844615][ T7910] usbtmc 8-1:16.0: usb_control_msg returned -71 [ 2434.852393][ T7928] usbtmc 8-1:16.0: send_request_dev_dep_msg_in returned -19 [ 2434.856672][ T7929] usbtmc 8-1:16.0: send_request_dev_dep_msg_in returned -19 [ 2434.980699][ T7932] nbd: socks must be embedded in a SOCK_ITEM attr [ 2434.987634][ T7932] block nbd0: shutting down sockets [ 2435.924915][ T7972] netlink: 'syz.5.7428': attribute type 1 has an invalid length. [ 2435.956290][ T7972] 8021q: adding VLAN 0 to HW filter on device bond1 [ 2436.043457][ T7974] gretap1: entered promiscuous mode [ 2436.074531][ T7974] bond1: (slave gretap1): making interface the new active one [ 2436.083281][ T7974] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 2436.219638][ T869] usb 6-1: new high-speed USB device number 120 using dummy_hcd [ 2436.303689][ T7981] FAULT_INJECTION: forcing a failure. [ 2436.303689][ T7981] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2436.309089][ T7981] CPU: 2 UID: 0 PID: 7981 Comm: syz.0.7432 Tainted: G L syzkaller #0 PREEMPT(full) [ 2436.309118][ T7981] Tainted: [L]=SOFTLOCKUP [ 2436.309126][ T7981] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2436.309137][ T7981] Call Trace: [ 2436.309144][ T7981] [ 2436.309154][ T7981] dump_stack_lvl+0x100/0x190 [ 2436.309189][ T7981] should_fail_ex.cold+0x5/0xa [ 2436.309215][ T7981] _copy_to_iter+0x1f3/0x1720 [ 2436.309248][ T7981] ? __pfx__copy_to_iter+0x10/0x10 [ 2436.309276][ T7981] ? __lock_acquire+0x4a5/0x2630 [ 2436.309304][ T7981] ? __lock_acquire+0x4a5/0x2630 [ 2436.309337][ T7981] simple_copy_to_iter+0x46/0x90 [ 2436.309387][ T7981] __skb_datagram_iter+0x5c8/0x900 [ 2436.309412][ T7981] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 2436.309446][ T7981] skb_copy_datagram_iter+0xa5/0x270 [ 2436.309473][ T7981] ? mptcp_rps_record_subflows+0x19/0x410 [ 2436.309498][ T7981] mptcp_recvmsg+0x6d7/0x1120 [ 2436.309531][ T7981] ? __pfx_mptcp_recvmsg+0x10/0x10 [ 2436.309555][ T7981] ? __pfx_aa_sk_perm+0x10/0x10 [ 2436.309582][ T7981] ? find_held_lock+0x2b/0x80 [ 2436.309609][ T7981] ? __pfx_mptcp_recvmsg+0x10/0x10 [ 2436.309630][ T7981] inet_recvmsg+0x455/0x4c0 [ 2436.309661][ T7981] ? bpf_lsm_socket_recvmsg+0x9/0x10 [ 2436.309686][ T7981] ? __pfx_inet_recvmsg+0x10/0x10 [ 2436.309716][ T7981] sock_recvmsg+0x187/0x1f0 [ 2436.309742][ T7981] ____sys_recvmsg+0x218/0x640 [ 2436.309771][ T7981] ? __pfx_____sys_recvmsg+0x10/0x10 [ 2436.309805][ T7981] ? __lock_acquire+0x4a5/0x2630 [ 2436.309839][ T7981] ___sys_recvmsg+0x16a/0x1a0 [ 2436.309865][ T7981] ? __pfx____sys_recvmsg+0x10/0x10 [ 2436.309912][ T7981] do_recvmmsg+0x563/0x760 [ 2436.309942][ T7981] ? __pfx_do_recvmmsg+0x10/0x10 [ 2436.309971][ T7981] ? ksys_write+0x190/0x250 [ 2436.309994][ T7981] ? ksys_write+0x190/0x250 [ 2436.310023][ T7981] ? __fget_files+0x215/0x3d0 [ 2436.310045][ T7981] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2436.310078][ T7981] __sys_recvmmsg+0x21f/0x270 [ 2436.310101][ T7981] ? __pfx___sys_recvmmsg+0x10/0x10 [ 2436.310123][ T7981] ? ksys_write+0x1ac/0x250 [ 2436.310147][ T7981] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 2436.310170][ T7981] ? __do_fast_syscall_32+0x98/0x970 [ 2436.310197][ T7981] ? lockdep_hardirqs_on+0x78/0x100 [ 2436.310224][ T7981] __do_fast_syscall_32+0xe7/0x970 [ 2436.310250][ T7981] ? lockdep_hardirqs_on+0x78/0x100 [ 2436.310279][ T7981] do_fast_syscall_32+0x32/0x70 [ 2436.310307][ T7981] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2436.310332][ T7981] RIP: 0023:0xf708ef7c [ 2436.310349][ T7981] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2436.310367][ T7981] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 2436.310387][ T7981] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001b00 [ 2436.310400][ T7981] RDX: 0000000000000001 RSI: 0000000000010140 RDI: 0000000000000000 [ 2436.310411][ T7981] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2436.310422][ T7981] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 2436.310433][ T7981] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2436.310456][ T7981] [ 2436.314823][ T7972] macvlan2: entered promiscuous mode [ 2436.379382][ T869] usb 6-1: Using ep0 maxpacket: 32 [ 2436.405718][ T7972] macvlan2: entered allmulticast mode [ 2436.412318][ T869] usb 6-1: config index 0 descriptor too short (expected 17179, got 27) [ 2436.436053][ T869] usb 6-1: config 83 has too many interfaces: 65, using maximum allowed: 32 [ 2436.437469][ T7972] bond1: entered promiscuous mode [ 2436.439854][ T869] usb 6-1: config 83 has an invalid descriptor of length 32, skipping remainder of the config [ 2436.445278][ T7972] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 2436.445637][ T869] usb 6-1: config 83 has 0 interfaces, different from the descriptor's value: 65 [ 2436.450812][ T7972] bond1: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 2436.455806][ T869] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2436.458994][ T7972] bond1: left promiscuous mode [ 2436.463215][ T869] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2436.477678][ T869] usb 6-1: Product: syz [ 2436.482363][ T869] usb 6-1: Manufacturer: syz [ 2436.487437][ T869] usb 6-1: SerialNumber: syz [ 2436.893212][ T7940] befs: (nullb0): No write support. Marking filesystem read-only [ 2436.899849][ T7940] befs: (nullb0): invalid magic header [ 2437.185093][ T869] usb 6-1: USB disconnect, device number 120 [ 2437.415527][ T7992] hsr0 speed is unknown, defaulting to 1000 [ 2437.450999][ T7994] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2437.470292][ T7992] Cannot find add_set index 0 as target [ 2437.614785][ T8000] FAULT_INJECTION: forcing a failure. [ 2437.614785][ T8000] name failslab, interval 1, probability 0, space 0, times 0 [ 2437.631367][ T8000] CPU: 3 UID: 0 PID: 8000 Comm: syz.0.7437 Tainted: G L syzkaller #0 PREEMPT(full) [ 2437.631402][ T8000] Tainted: [L]=SOFTLOCKUP [ 2437.631408][ T8000] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2437.631420][ T8000] Call Trace: [ 2437.631426][ T8000] [ 2437.631435][ T8000] dump_stack_lvl+0x100/0x190 [ 2437.631470][ T8000] should_fail_ex.cold+0x5/0xa [ 2437.631495][ T8000] should_failslab+0xc2/0x120 [ 2437.631518][ T8000] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 2437.631549][ T8000] ? __alloc_skb+0x140/0x710 [ 2437.631566][ T8000] ? __alloc_skb+0x5b7/0x710 [ 2437.631588][ T8000] __alloc_skb+0x140/0x710 [ 2437.631603][ T8000] ? __alloc_skb+0x5b7/0x710 [ 2437.631621][ T8000] ? __pfx___alloc_skb+0x10/0x10 [ 2437.631638][ T8000] ? __pfx___might_resched+0x10/0x10 [ 2437.631666][ T8000] netlink_alloc_large_skb+0x69/0x150 [ 2437.631694][ T8000] netlink_sendmsg+0x680/0xda0 [ 2437.631723][ T8000] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2437.631749][ T8000] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 2437.631775][ T8000] ____sys_sendmsg+0x9e1/0xb70 [ 2437.631799][ T8000] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2437.631824][ T8000] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2437.631860][ T8000] ___sys_sendmsg+0x190/0x1e0 [ 2437.631886][ T8000] ? __pfx____sys_sendmsg+0x10/0x10 [ 2437.631922][ T8000] ? find_held_lock+0x2b/0x80 [ 2437.631960][ T8000] __sys_sendmsg+0x170/0x220 [ 2437.631981][ T8000] ? __pfx___sys_sendmsg+0x10/0x10 [ 2437.631998][ T8000] ? __fget_files+0x21f/0x3d0 [ 2437.632027][ T8000] ? ksys_write+0x1ac/0x250 [ 2437.632051][ T8000] ? rcu_is_watching+0x12/0xc0 [ 2437.632076][ T8000] __do_fast_syscall_32+0xe7/0x970 [ 2437.632108][ T8000] ? lockdep_hardirqs_on+0x78/0x100 [ 2437.632135][ T8000] do_fast_syscall_32+0x32/0x70 [ 2437.632196][ T8000] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2437.632221][ T8000] RIP: 0023:0xf708ef7c [ 2437.632237][ T8000] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2437.632255][ T8000] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 2437.632274][ T8000] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 2437.632285][ T8000] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2437.632297][ T8000] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2437.632307][ T8000] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2437.632316][ T8000] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2437.632340][ T8000] [ 2438.069658][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 2438.151325][ T8021] batman_adv: batadv0: Adding interface: dummy0 [ 2438.154681][ T8021] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2438.165130][ T8021] batman_adv: batadv0: Interface activated: dummy0 [ 2438.170211][ T8021] FAULT_INJECTION: forcing a failure. [ 2438.170211][ T8021] name failslab, interval 1, probability 0, space 0, times 0 [ 2438.185225][ T8021] CPU: 2 UID: 0 PID: 8021 Comm: syz.0.7443 Tainted: G L syzkaller #0 PREEMPT(full) [ 2438.185257][ T8021] Tainted: [L]=SOFTLOCKUP [ 2438.185262][ T8021] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2438.185271][ T8021] Call Trace: [ 2438.185277][ T8021] [ 2438.185283][ T8021] dump_stack_lvl+0x100/0x190 [ 2438.185312][ T8021] should_fail_ex.cold+0x5/0xa [ 2438.185331][ T8021] ? tomoyo_encode2+0xfb/0x3c0 [ 2438.185350][ T8021] should_failslab+0xc2/0x120 [ 2438.185368][ T8021] __kmalloc_noprof+0xe0/0x850 [ 2438.185394][ T8021] tomoyo_encode2+0xfb/0x3c0 [ 2438.185417][ T8021] tomoyo_encode+0x29/0x50 [ 2438.185460][ T8021] tomoyo_realpath_from_path+0x18c/0x690 [ 2438.185488][ T8021] tomoyo_path_number_perm+0x23c/0x580 [ 2438.185509][ T8021] ? tomoyo_path_number_perm+0x22e/0x580 [ 2438.185533][ T8021] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2438.185553][ T8021] ? get_pid_task+0x106/0x250 [ 2438.185596][ T8021] ? find_held_lock+0x2b/0x80 [ 2438.185615][ T8021] ? __fget_files+0x215/0x3d0 [ 2438.185634][ T8021] ? hook_file_ioctl_common+0x149/0x410 [ 2438.185654][ T8021] ? __fget_files+0x215/0x3d0 [ 2438.185677][ T8021] ? __fget_files+0x21f/0x3d0 [ 2438.185700][ T8021] security_file_ioctl_compat+0xd3/0x230 [ 2438.185722][ T8021] __ia32_compat_sys_ioctl+0xc2/0x360 [ 2438.185744][ T8021] __do_fast_syscall_32+0xe7/0x970 [ 2438.185769][ T8021] ? lockdep_hardirqs_on+0x78/0x100 [ 2438.185795][ T8021] do_fast_syscall_32+0x32/0x70 [ 2438.185822][ T8021] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2438.185844][ T8021] RIP: 0023:0xf708ef7c [ 2438.185860][ T8021] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2438.185877][ T8021] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 2438.185896][ T8021] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000000008922 [ 2438.185907][ T8021] RDX: 0000000080000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 2438.185917][ T8021] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2438.185927][ T8021] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2438.185937][ T8021] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2438.185961][ T8021] [ 2438.185995][ T8021] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2438.288688][ T8021] batadv0: mtu less than device minimum [ 2438.292083][ T8021] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 2438.297175][ T8021] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 2438.303026][ T8021] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 2438.307931][ T8021] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 2438.313062][ T8021] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 2438.318950][ T8021] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 2438.324041][ T8021] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 2438.329195][ T8021] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 2438.420399][ T7058] usb 8-1: new high-speed USB device number 116 using dummy_hcd [ 2438.582623][ T7058] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2438.586628][ T7058] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2438.589648][ T7058] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 2438.594337][ T7058] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2438.597872][ T7058] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2438.601476][ T7058] usb 8-1: config 0 descriptor?? [ 2439.078170][ T8023] CIFS: VFS: UNC: path must begin with // or \\ [ 2439.081031][ T8023] Malformed UNC in devname [ 2439.081031][ T8023] [ 2439.086694][ T8023] CIFS: VFS: Malformed UNC in devname [ 2439.091008][ T7058] usbhid 8-1:0.0: can't add hid device: -71 [ 2439.100483][ T7058] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 2439.108717][ T7058] usb 8-1: USB disconnect, device number 116 [ 2439.254612][ T8035] tipc: Enabling of bearer rejected, failed to enable media [ 2439.261219][ T8035] batman_adv: batadv0: Adding interface: dummy0 [ 2439.266648][ T8035] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2439.278113][ T8035] batman_adv: batadv0: Interface activated: dummy0 [ 2439.812623][ T8045] macvlan2: entered promiscuous mode [ 2439.815027][ T8045] macvlan2: entered allmulticast mode [ 2439.817854][ T8045] netdevsim netdevsim3 netdevsim2: entered allmulticast mode [ 2439.824080][ T8045] netdevsim netdevsim3 netdevsim2: entered promiscuous mode [ 2439.830965][ T8045] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 2439.838378][ T8045] team0: Port device macvlan2 added [ 2439.922788][T18121] usb 38-1: device descriptor read/8, error -110 [ 2440.107187][ T8052] vhci_hcd vhci_hcd.0: port 0 already used [ 2440.612355][T18121] usb 38-1: SetAddress Request (23) to port 0 [ 2440.616085][T18121] usb 38-1: new SuperSpeed USB device number 23 using vhci_hcd [ 2442.446404][ T8092] syzkaller0: entered promiscuous mode [ 2442.448202][ T8092] syzkaller0: entered allmulticast mode [ 2443.046290][ T8101] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(7) [ 2443.048441][ T8101] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 2443.051807][ T8101] vhci_hcd vhci_hcd.0: Device attached [ 2443.357330][ T1385] usb 48-1: SetAddress Request (14) to port 0 [ 2443.359922][ T1385] usb 48-1: new SuperSpeed USB device number 14 using vhci_hcd [ 2443.788890][ T8102] vhci_hcd: connection reset by peer [ 2443.793695][ T226] vhci_hcd vhci_hcd.5: stop threads [ 2443.806955][ T226] vhci_hcd vhci_hcd.5: release socket [ 2443.814680][ T226] vhci_hcd vhci_hcd.5: disconnect device [ 2444.469181][ T7058] usb 8-1: new high-speed USB device number 117 using dummy_hcd [ 2444.618352][ T7058] usb 8-1: device descriptor read/64, error -71 [ 2444.897484][ T7058] usb 8-1: new high-speed USB device number 118 using dummy_hcd [ 2445.035071][ T7058] usb 8-1: device descriptor read/64, error -71 [ 2445.166067][ T7058] usb usb8-port1: attempt power cycle [ 2445.335726][ T869] usb 6-1: new high-speed USB device number 121 using dummy_hcd [ 2445.526607][ T869] usb 6-1: Using ep0 maxpacket: 32 [ 2445.547979][ T7058] usb 8-1: new high-speed USB device number 119 using dummy_hcd [ 2445.551813][ T869] usb 6-1: config index 0 descriptor too short (expected 17179, got 27) [ 2445.570107][ T7058] usb 8-1: device descriptor read/8, error -71 [ 2445.676652][ T869] usb 6-1: config 83 has too many interfaces: 65, using maximum allowed: 32 [ 2445.681204][ T869] usb 6-1: config 83 has an invalid descriptor of length 32, skipping remainder of the config [ 2445.684829][ T869] usb 6-1: config 83 has 0 interfaces, different from the descriptor's value: 65 [ 2445.698313][ T869] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2445.701669][ T869] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2445.704241][ T869] usb 6-1: Product: syz [ 2445.706711][ T869] usb 6-1: Manufacturer: syz [ 2445.709838][ T869] usb 6-1: SerialNumber: syz [ 2445.852176][ T7058] usb 8-1: new high-speed USB device number 120 using dummy_hcd [ 2445.869307][ T7058] usb 8-1: device descriptor read/8, error -71 [ 2445.986488][ T7058] usb usb8-port1: unable to enumerate USB device [ 2446.030201][T18121] usb 38-1: device descriptor read/8, error -110 [ 2446.106568][ T8128] befs: (nullb0): No write support. Marking filesystem read-only [ 2446.112019][ T8128] befs: (nullb0): invalid magic header [ 2446.146446][T18121] usb usb38-port1: unable to enumerate USB device [ 2446.273931][ T869] usb 6-1: USB disconnect, device number 121 [ 2446.315207][ T8172] netlink: 144 bytes leftover after parsing attributes in process `syz.5.7479'. [ 2446.459142][ T8176] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(7) [ 2446.461990][ T8176] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 2446.471844][ T8176] vhci_hcd vhci_hcd.0: Device attached [ 2447.008210][ T8185] netlink: 'syz.1.7483': attribute type 1 has an invalid length. [ 2447.264734][ T8177] vhci_hcd: connection closed [ 2447.264955][ T6973] vhci_hcd vhci_hcd.5: stop threads [ 2447.275205][ T6973] vhci_hcd vhci_hcd.5: release socket [ 2447.277459][ T6973] vhci_hcd vhci_hcd.5: disconnect device [ 2447.852417][ T8201] overlayfs: missing 'lowerdir' [ 2448.186993][ T8207] hsr0 speed is unknown, defaulting to 1000 [ 2448.331112][ T8205] bond2 (unregistering): Released all slaves [ 2448.456999][ C2] hpet: Lost 1 RTC interrupts [ 2448.739680][ T8220] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7492'. [ 2448.756211][ T1385] usb 48-1: device descriptor read/8, error -110 [ 2448.924383][ T869] usb 8-1: new high-speed USB device number 121 using dummy_hcd [ 2449.064260][ T869] usb 8-1: device descriptor read/64, error -71 [ 2449.182022][ T1385] usb usb48-port1: attempt power cycle [ 2449.322055][ T869] usb 8-1: new high-speed USB device number 122 using dummy_hcd [ 2449.352857][T21251] usb 6-1: new high-speed USB device number 122 using dummy_hcd [ 2449.459074][ T869] usb 8-1: device descriptor read/64, error -71 [ 2449.523353][T21251] usb 6-1: Using ep0 maxpacket: 32 [ 2449.577265][ T869] usb usb8-port1: attempt power cycle [ 2449.778206][ T8254] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(7) [ 2449.780674][ T8254] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 2449.791344][ T8254] vhci_hcd vhci_hcd.0: Device attached [ 2449.843831][ T1385] usb 48-1: SetAddress Request (17) to port 0 [ 2449.846570][ T1385] usb 48-1: new SuperSpeed USB device number 17 using vhci_hcd [ 2449.940002][ T869] usb 8-1: new high-speed USB device number 123 using dummy_hcd [ 2449.949626][T21251] usb 6-1: config index 0 descriptor too short (expected 17179, got 27) [ 2449.952414][T21251] usb 6-1: config 83 has too many interfaces: 65, using maximum allowed: 32 [ 2449.956868][T21251] usb 6-1: config 83 has an invalid descriptor of length 32, skipping remainder of the config [ 2449.962998][T21251] usb 6-1: config 83 has 0 interfaces, different from the descriptor's value: 65 [ 2449.967820][ T869] usb 8-1: device descriptor read/8, error -71 [ 2449.971490][T21251] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2449.974379][T21251] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2449.976828][T21251] usb 6-1: Product: syz [ 2449.978112][T21251] usb 6-1: Manufacturer: syz [ 2449.979583][T21251] usb 6-1: SerialNumber: syz [ 2450.219137][ T869] usb 8-1: new high-speed USB device number 124 using dummy_hcd [ 2450.240380][ T869] usb 8-1: device descriptor read/8, error -71 [ 2450.315031][ T8219] /dev/nullb0: Can't open blockdev [ 2450.323629][T21251] usb 6-1: USB disconnect, device number 122 [ 2450.371945][ T869] usb usb8-port1: unable to enumerate USB device [ 2450.493899][ T8260] Invalid ELF header len 9 [ 2450.600151][ T8255] vhci_hcd: connection reset by peer [ 2450.605040][T14641] vhci_hcd vhci_hcd.5: stop threads [ 2450.607198][T14641] vhci_hcd vhci_hcd.5: release socket [ 2450.613762][T14641] vhci_hcd vhci_hcd.5: disconnect device [ 2451.744112][ T8272] netlink: 'syz.5.7500': attribute type 2 has an invalid length. [ 2452.581302][ T8284] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7503'. [ 2452.585161][ T8284] netlink: 'syz.1.7503': attribute type 10 has an invalid length. [ 2452.603080][ T8284] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2452.634241][ T8284] team0: Port device bond0 added [ 2454.589234][ T50] usb 6-1: new high-speed USB device number 123 using dummy_hcd [ 2454.759363][ T50] usb 6-1: Using ep0 maxpacket: 32 [ 2454.865345][ T50] usb 6-1: config index 0 descriptor too short (expected 17179, got 27) [ 2454.865456][ T50] usb 6-1: config 83 has too many interfaces: 65, using maximum allowed: 32 [ 2454.865476][ T50] usb 6-1: config 83 has an invalid descriptor of length 32, skipping remainder of the config [ 2454.865558][ T50] usb 6-1: config 83 has 0 interfaces, different from the descriptor's value: 65 [ 2454.872503][ T50] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2454.872531][ T50] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2454.872548][ T50] usb 6-1: Product: syz [ 2454.872562][ T50] usb 6-1: Manufacturer: syz [ 2454.872576][ T50] usb 6-1: SerialNumber: syz [ 2455.263828][ T1385] usb 48-1: device descriptor read/8, error -110 [ 2455.369363][T26972] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 2455.396042][ T1385] usb usb48-port1: unable to enumerate USB device [ 2455.521214][T26972] usb 10-1: device descriptor read/64, error -71 [ 2455.852077][T26972] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 2456.009803][T26972] usb 10-1: device descriptor read/64, error -71 [ 2456.142575][T26972] usb usb10-port1: attempt power cycle [ 2456.470814][ T8300] befs: (nullb0): No write support. Marking filesystem read-only [ 2456.473459][ T8300] befs: (nullb0): invalid magic header [ 2456.477191][ T8360] netlink: 'syz.3.7515': attribute type 1 has an invalid length. [ 2456.490709][ T8360] bond1: entered promiscuous mode [ 2456.492562][ T8360] 8021q: adding VLAN 0 to HW filter on device bond1 [ 2456.519773][ T8360] bond1: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 2456.523991][ T8360] bond1: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 2456.527406][ T8360] bond1: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 2456.544026][T26972] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 2456.555730][ T50] usb 6-1: USB disconnect, device number 123 [ 2456.570746][ T8364] FAULT_INJECTION: forcing a failure. [ 2456.570746][ T8364] name failslab, interval 1, probability 0, space 0, times 0 [ 2456.575670][ T8364] CPU: 2 UID: 0 PID: 8364 Comm: syz.0.7516 Tainted: G L syzkaller #0 PREEMPT(full) [ 2456.575696][ T8364] Tainted: [L]=SOFTLOCKUP [ 2456.575702][ T8364] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2456.575711][ T8364] Call Trace: [ 2456.575718][ T8364] [ 2456.575725][ T8364] dump_stack_lvl+0x100/0x190 [ 2456.575762][ T8364] should_fail_ex.cold+0x5/0xa [ 2456.575784][ T8364] ? iovec_from_user+0x8d/0x140 [ 2456.575807][ T8364] should_failslab+0xc2/0x120 [ 2456.575830][ T8364] __kmalloc_noprof+0xe0/0x850 [ 2456.575871][ T8364] ? find_held_lock+0x2b/0x80 [ 2456.575918][ T8364] iovec_from_user+0x8d/0x140 [ 2456.575948][ T8364] __import_iovec+0x81/0x640 [ 2456.575972][ T8364] ? __might_fault+0xc5/0x140 [ 2456.576003][ T8364] import_iovec+0x82/0xb0 [ 2456.576031][ T8364] get_compat_msghdr+0x2ea/0x4b0 [ 2456.576052][ T8364] ? __pfx_get_compat_msghdr+0x10/0x10 [ 2456.576073][ T8364] ? _kstrtoull+0x13c/0x1f0 [ 2456.576092][ T8364] ? __pfx__kstrtoull+0x10/0x10 [ 2456.576110][ T8364] ___sys_sendmsg+0x1b6/0x1e0 [ 2456.576136][ T8364] ? __pfx____sys_sendmsg+0x10/0x10 [ 2456.576159][ T8364] ? __lock_acquire+0x4a5/0x2630 [ 2456.576193][ T8364] __sys_sendmmsg+0x2ff/0x430 [ 2456.576207][ T8364] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2456.576223][ T8364] ? __fget_files+0x215/0x3d0 [ 2456.576242][ T8364] ? fput+0x79/0x100 [ 2456.576257][ T8364] ? ksys_write+0x1ac/0x250 [ 2456.576271][ T8364] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 2456.576285][ T8364] ? lockdep_hardirqs_on+0x78/0x100 [ 2456.576301][ T8364] __do_fast_syscall_32+0xe7/0x970 [ 2456.576317][ T8364] ? lockdep_hardirqs_on+0x78/0x100 [ 2456.576333][ T8364] do_fast_syscall_32+0x32/0x70 [ 2456.576350][ T8364] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2456.576364][ T8364] RIP: 0023:0xf708ef7c [ 2456.576374][ T8364] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2456.576385][ T8364] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 2456.576396][ T8364] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000640 [ 2456.576404][ T8364] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 2456.576410][ T8364] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2456.576416][ T8364] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 2456.576422][ T8364] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2456.576436][ T8364] [ 2456.602761][T26972] usb 10-1: device descriptor read/8, error -71 [ 2456.604399][ C2] hpet: Lost 1 RTC interrupts [ 2456.671086][ C2] hpet: Lost 3 RTC interrupts [ 2456.875278][T26972] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 2456.907853][T26972] usb 10-1: device descriptor read/8, error -71 [ 2457.035903][T26972] usb usb10-port1: unable to enumerate USB device [ 2457.370744][ T8376] netlink: 56 bytes leftover after parsing attributes in process `syz.1.7519'. [ 2458.519800][ T8387] fuse: Unknown parameter 'ì[sðÏ\®7m»·Ë' [ 2458.960402][ T8398] FAULT_INJECTION: forcing a failure. [ 2458.960402][ T8398] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2458.989219][ T8398] CPU: 1 UID: 0 PID: 8398 Comm: syz.0.7525 Tainted: G L syzkaller #0 PREEMPT(full) [ 2458.989239][ T8398] Tainted: [L]=SOFTLOCKUP [ 2458.989244][ T8398] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2458.989250][ T8398] Call Trace: [ 2458.989254][ T8398] [ 2458.989259][ T8398] dump_stack_lvl+0x100/0x190 [ 2458.989281][ T8398] should_fail_ex.cold+0x5/0xa [ 2458.989295][ T8398] _copy_from_iter+0x1f4/0x1690 [ 2458.989314][ T8398] ? __pfx__copy_from_iter+0x10/0x10 [ 2458.989329][ T8398] ? find_held_lock+0x2b/0x80 [ 2458.989350][ T8398] bcm_sendmsg+0x18f/0x4510 [ 2458.989369][ T8398] ? aa_sk_perm+0x309/0xaa0 [ 2458.989391][ T8398] ? __pfx_bcm_sendmsg+0x10/0x10 [ 2458.989407][ T8398] ? __pfx_aa_sk_perm+0x10/0x10 [ 2458.989447][ T8398] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 2458.989470][ T8398] ____sys_sendmsg+0x9e1/0xb70 [ 2458.989495][ T8398] ? __pfx_bcm_sendmsg+0x10/0x10 [ 2458.989513][ T8398] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2458.989547][ T8398] ___sys_sendmsg+0x190/0x1e0 [ 2458.989573][ T8398] ? __pfx____sys_sendmsg+0x10/0x10 [ 2458.989603][ T8398] ? find_held_lock+0x2b/0x80 [ 2458.989624][ T8398] __sys_sendmsg+0x170/0x220 [ 2458.989636][ T8398] ? __pfx___sys_sendmsg+0x10/0x10 [ 2458.989646][ T8398] ? __fget_files+0x21f/0x3d0 [ 2458.989663][ T8398] ? ksys_write+0x1ac/0x250 [ 2458.989676][ T8398] ? rcu_is_watching+0x12/0xc0 [ 2458.989691][ T8398] __do_fast_syscall_32+0xe7/0x970 [ 2458.989706][ T8398] ? lockdep_hardirqs_on+0x78/0x100 [ 2458.989723][ T8398] do_fast_syscall_32+0x32/0x70 [ 2458.989739][ T8398] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2458.989752][ T8398] RIP: 0023:0xf708ef7c [ 2458.989762][ T8398] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2458.989772][ T8398] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 2458.989783][ T8398] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000180 [ 2458.989790][ T8398] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2458.989796][ T8398] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2458.989803][ T8398] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 2458.989809][ T8398] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2458.989822][ T8398] [ 2459.219964][ T8404] netlink: 'syz.3.7526': attribute type 2 has an invalid length. [ 2459.557417][ T7023] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 2459.728434][ T7023] usb 5-1: device descriptor read/64, error -71 [ 2460.231784][ T8417] FAULT_INJECTION: forcing a failure. [ 2460.231784][ T8417] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2460.235788][ T8417] CPU: 3 UID: 0 PID: 8417 Comm: syz.3.7530 Tainted: G L syzkaller #0 PREEMPT(full) [ 2460.235805][ T8417] Tainted: [L]=SOFTLOCKUP [ 2460.235809][ T8417] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2460.235816][ T8417] Call Trace: [ 2460.235820][ T8417] [ 2460.235844][ T8417] dump_stack_lvl+0x100/0x190 [ 2460.235867][ T8417] should_fail_ex.cold+0x5/0xa [ 2460.235882][ T8417] _copy_to_user+0x32/0xd0 [ 2460.235906][ T8417] simple_read_from_buffer+0xcb/0x170 [ 2460.235920][ T8417] proc_fail_nth_read+0x1af/0x230 [ 2460.235938][ T8417] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2460.235956][ T8417] ? rw_verify_area+0xce/0x6d0 [ 2460.235966][ T8417] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2460.235983][ T8417] vfs_read+0x1e4/0xb30 [ 2460.235997][ T8417] ? __pfx_vfs_read+0x10/0x10 [ 2460.236007][ T8417] ? find_held_lock+0x2b/0x80 [ 2460.236021][ T8417] ? __fget_files+0x215/0x3d0 [ 2460.236036][ T8417] ? __fget_files+0x21f/0x3d0 [ 2460.236052][ T8417] ksys_read+0x12a/0x250 [ 2460.236064][ T8417] ? __pfx_ksys_read+0x10/0x10 [ 2460.236075][ T8417] ? rcu_is_watching+0x12/0xc0 [ 2460.236088][ T8417] ? rcu_is_watching+0x12/0xc0 [ 2460.236102][ T8417] do_int80_emulation+0x14b/0x720 [ 2460.236121][ T8417] asm_int80_emulation+0x1a/0x20 [ 2460.236132][ T8417] RIP: 0023:0xf72061ab [ 2460.236141][ T8417] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 2460.236152][ T8417] RSP: 002b:00000000f54bd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 2460.236162][ T8417] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54bd5d0 [ 2460.236169][ T8417] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 2460.236175][ T8417] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2460.236181][ T8417] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 2460.236187][ T8417] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2460.236201][ T8417] [ 2460.647421][ T7023] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 2460.814060][ T7023] usb 5-1: device descriptor read/64, error -71 [ 2460.926225][ T7023] usb usb5-port1: attempt power cycle [ 2461.289352][ T7023] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 2461.314338][ T7023] usb 5-1: device descriptor read/8, error -71 [ 2461.579501][ T7023] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 2461.599303][ T7023] usb 5-1: device descriptor read/8, error -71 [ 2461.720404][ T7023] usb usb5-port1: unable to enumerate USB device [ 2461.783652][ T8432] FAULT_INJECTION: forcing a failure. [ 2461.783652][ T8432] name failslab, interval 1, probability 0, space 0, times 0 [ 2461.788620][ T8432] CPU: 0 UID: 0 PID: 8432 Comm: syz.1.7535 Tainted: G L syzkaller #0 PREEMPT(full) [ 2461.788645][ T8432] Tainted: [L]=SOFTLOCKUP [ 2461.788649][ T8432] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2461.788656][ T8432] Call Trace: [ 2461.788660][ T8432] [ 2461.788665][ T8432] dump_stack_lvl+0x100/0x190 [ 2461.788687][ T8432] should_fail_ex.cold+0x5/0xa [ 2461.788701][ T8432] should_failslab+0xc2/0x120 [ 2461.788715][ T8432] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 2461.788733][ T8432] ? __alloc_skb+0x140/0x710 [ 2461.788742][ T8432] ? __alloc_skb+0x5b7/0x710 [ 2461.788753][ T8432] __alloc_skb+0x140/0x710 [ 2461.788762][ T8432] ? __alloc_skb+0x5b7/0x710 [ 2461.788772][ T8432] ? __pfx___alloc_skb+0x10/0x10 [ 2461.788785][ T8432] netlink_alloc_large_skb+0x69/0x150 [ 2461.788801][ T8432] netlink_sendmsg+0x680/0xda0 [ 2461.788818][ T8432] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2461.788833][ T8432] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 2461.788848][ T8432] ____sys_sendmsg+0x9e1/0xb70 [ 2461.788861][ T8432] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2461.788876][ T8432] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2461.788896][ T8432] ___sys_sendmsg+0x190/0x1e0 [ 2461.788926][ T8432] ? __pfx____sys_sendmsg+0x10/0x10 [ 2461.788947][ T8432] ? find_held_lock+0x2b/0x80 [ 2461.788969][ T8432] __sys_sendmsg+0x170/0x220 [ 2461.788983][ T8432] ? __pfx___sys_sendmsg+0x10/0x10 [ 2461.789002][ T8432] ? __fget_files+0x21f/0x3d0 [ 2461.789019][ T8432] ? ksys_write+0x1ac/0x250 [ 2461.789032][ T8432] ? rcu_is_watching+0x12/0xc0 [ 2461.789047][ T8432] __do_fast_syscall_32+0xe7/0x970 [ 2461.789063][ T8432] ? lockdep_hardirqs_on+0x78/0x100 [ 2461.789079][ T8432] do_fast_syscall_32+0x32/0x70 [ 2461.789095][ T8432] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2461.789108][ T8432] RIP: 0023:0xf700ef7c [ 2461.789118][ T8432] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2461.789129][ T8432] RSP: 002b:00000000f53dc50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 2461.789140][ T8432] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000100 [ 2461.789147][ T8432] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000000 [ 2461.789153][ T8432] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2461.789159][ T8432] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 2461.789165][ T8432] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2461.789178][ T8432] [ 2462.002376][ T8437] FAULT_INJECTION: forcing a failure. [ 2462.002376][ T8437] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2462.008408][ T8437] CPU: 3 UID: 0 PID: 8437 Comm: syz.5.7537 Tainted: G L syzkaller #0 PREEMPT(full) [ 2462.008436][ T8437] Tainted: [L]=SOFTLOCKUP [ 2462.008443][ T8437] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2462.008453][ T8437] Call Trace: [ 2462.008460][ T8437] [ 2462.008468][ T8437] dump_stack_lvl+0x100/0x190 [ 2462.008502][ T8437] should_fail_ex.cold+0x5/0xa [ 2462.008526][ T8437] _copy_from_user+0x2e/0xd0 [ 2462.008552][ T8437] memdup_user+0x6b/0xe0 [ 2462.008573][ T8437] strndup_user+0x78/0xe0 [ 2462.008593][ T8437] __ia32_sys_fsopen+0xa0/0x230 [ 2462.008623][ T8437] __do_fast_syscall_32+0xe7/0x970 [ 2462.008650][ T8437] ? lockdep_hardirqs_on+0x78/0x100 [ 2462.008676][ T8437] do_fast_syscall_32+0x32/0x70 [ 2462.008702][ T8437] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2462.008726][ T8437] RIP: 0023:0xf7f88f7c [ 2462.008740][ T8437] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2462.008756][ T8437] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 00000000000001ae [ 2462.008773][ T8437] RAX: ffffffffffffffda RBX: 0000000080000100 RCX: 0000000000000000 [ 2462.008784][ T8437] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2462.008794][ T8437] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2462.008806][ T8437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2462.008815][ T8437] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2462.008838][ T8437] [ 2462.271280][ T8442] netlink: 'syz.5.7538': attribute type 2 has an invalid length. [ 2462.728456][ T40] audit: type=1326 audit(1781299505.106:7660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8430 comm="syz.3.7534" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cef7c code=0x7fc00000 [ 2463.346739][ T8468] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7543'. [ 2463.378131][ T8468] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7543'. [ 2463.586051][ T1385] usb 8-1: new high-speed USB device number 125 using dummy_hcd [ 2463.669058][ T5757] Bluetooth: hci4: link tx timeout [ 2463.671796][ T5757] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 2463.680161][ T5757] Bluetooth: hci4: link tx timeout [ 2463.681777][ T5757] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 2463.790816][ T1385] usb 8-1: Using ep0 maxpacket: 32 [ 2463.794633][ T1385] usb 8-1: config index 0 descriptor too short (expected 17179, got 27) [ 2463.798269][ T1385] usb 8-1: config 83 has too many interfaces: 65, using maximum allowed: 32 [ 2463.801671][ T1385] usb 8-1: config 83 has an invalid descriptor of length 32, skipping remainder of the config [ 2463.805032][ T1385] usb 8-1: config 83 has 0 interfaces, different from the descriptor's value: 65 [ 2463.813896][ T1385] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2463.816927][ T1385] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2463.820011][ T1385] usb 8-1: Product: syz [ 2463.821736][ T1385] usb 8-1: Manufacturer: syz [ 2463.823294][ T1385] usb 8-1: SerialNumber: syz [ 2464.146429][ T8459] befs: (nullb0): No write support. Marking filesystem read-only [ 2464.149001][ T8459] befs: (nullb0): invalid magic header [ 2464.159961][ T1385] usb 8-1: USB disconnect, device number 125 [ 2464.825684][T21251] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 2464.837313][ T8509] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7548'. [ 2464.911605][ T8509] netlink: 260 bytes leftover after parsing attributes in process `syz.5.7548'. [ 2464.924525][ T1385] usb 6-1: new high-speed USB device number 124 using dummy_hcd [ 2464.996666][T21251] usb 5-1: Using ep0 maxpacket: 32 [ 2465.000443][T21251] usb 5-1: config index 0 descriptor too short (expected 17179, got 27) [ 2465.003482][T21251] usb 5-1: config 83 has too many interfaces: 65, using maximum allowed: 32 [ 2465.009737][T21251] usb 5-1: config 83 has an invalid descriptor of length 32, skipping remainder of the config [ 2465.021058][T21251] usb 5-1: config 83 has 0 interfaces, different from the descriptor's value: 65 [ 2465.064407][ T7023] usb 8-1: new full-speed USB device number 126 using dummy_hcd [ 2465.085550][ T1385] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 2465.088399][T21251] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2465.090906][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2465.092426][T21251] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2465.098012][ T1385] usb 6-1: config 0 has no interfaces? [ 2465.101786][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2465.104753][T21251] usb 5-1: Product: syz [ 2465.104921][T21251] usb 5-1: Manufacturer: syz [ 2465.110976][ T1385] usb 6-1: config 0 has no interfaces? [ 2465.114795][T21251] usb 5-1: SerialNumber: syz [ 2465.117237][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2465.122192][ T1385] usb 6-1: config 0 has no interfaces? [ 2465.128697][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2465.133305][ T1385] usb 6-1: config 0 has no interfaces? [ 2465.136184][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2465.139421][ T1385] usb 6-1: config 0 has no interfaces? [ 2465.141970][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2465.145134][ T1385] usb 6-1: config 0 has no interfaces? [ 2465.148302][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2465.151463][ T1385] usb 6-1: config 0 has no interfaces? [ 2465.155056][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2465.161237][ T1385] usb 6-1: config 0 has no interfaces? [ 2465.170522][ T1385] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 2465.174369][ T1385] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 2465.199197][ T1385] usb 6-1: Product: syz [ 2465.201444][ T1385] usb 6-1: Manufacturer: syz [ 2465.202921][ T1385] usb 6-1: SerialNumber: syz [ 2465.208223][ T1385] usb 6-1: config 0 descriptor?? [ 2465.247243][ T7023] usb 8-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 2465.253027][ T7023] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2465.266254][ T7023] usb 8-1: Product: syz [ 2465.268120][ T7023] usb 8-1: Manufacturer: syz [ 2465.273302][ T7023] usb 8-1: SerialNumber: syz [ 2465.738282][ T7023] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 126 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 2465.858498][ T6275] Bluetooth: hci4: command 0x0406 tx timeout [ 2465.880012][ T8499] befs: (nullb0): No write support. Marking filesystem read-only [ 2465.890167][ T8499] befs: (nullb0): invalid magic header [ 2466.165474][ T1385] usb 6-1: USB disconnect, device number 124 [ 2466.261490][T21251] usb 5-1: USB disconnect, device number 121 [ 2466.307681][ T8547] ubi16: detaching mtd0 [ 2466.359292][ T8547] ubi16: mtd0 is detached [ 2467.653519][ T5754] Bluetooth: hci3: command 0x0406 tx timeout [ 2468.031580][T21251] usb 8-1: USB disconnect, device number 126 [ 2468.068632][T21251] usblp0: removed [ 2468.263497][ T8573] FAULT_INJECTION: forcing a failure. [ 2468.263497][ T8573] name failslab, interval 1, probability 0, space 0, times 0 [ 2468.269794][ T8573] CPU: 2 UID: 0 PID: 8573 Comm: syz.0.7559 Tainted: G L syzkaller #0 PREEMPT(full) [ 2468.269824][ T8573] Tainted: [L]=SOFTLOCKUP [ 2468.269830][ T8573] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2468.269840][ T8573] Call Trace: [ 2468.269846][ T8573] [ 2468.269853][ T8573] dump_stack_lvl+0x100/0x190 [ 2468.269887][ T8573] should_fail_ex.cold+0x5/0xa [ 2468.269908][ T8573] ? tomoyo_encode2+0xfb/0x3c0 [ 2468.269931][ T8573] should_failslab+0xc2/0x120 [ 2468.269953][ T8573] __kmalloc_noprof+0xe0/0x850 [ 2468.269979][ T8573] ? d_absolute_path+0x136/0x1b0 [ 2468.270002][ T8573] tomoyo_encode2+0xfb/0x3c0 [ 2468.270029][ T8573] tomoyo_encode+0x29/0x50 [ 2468.270052][ T8573] tomoyo_realpath_from_path+0x18c/0x690 [ 2468.270104][ T8573] tomoyo_path_number_perm+0x23c/0x580 [ 2468.270126][ T8573] ? tomoyo_path_number_perm+0x22e/0x580 [ 2468.270149][ T8573] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2468.270172][ T8573] ? get_pid_task+0x106/0x250 [ 2468.270219][ T8573] ? find_held_lock+0x2b/0x80 [ 2468.270241][ T8573] ? __fget_files+0x215/0x3d0 [ 2468.270260][ T8573] ? hook_file_ioctl_common+0x149/0x410 [ 2468.270281][ T8573] ? __fget_files+0x215/0x3d0 [ 2468.270311][ T8573] ? __fget_files+0x21f/0x3d0 [ 2468.270336][ T8573] security_file_ioctl_compat+0xd3/0x230 [ 2468.270359][ T8573] __ia32_compat_sys_ioctl+0xc2/0x360 [ 2468.270378][ T8573] __do_fast_syscall_32+0xe7/0x970 [ 2468.270404][ T8573] ? lockdep_hardirqs_on+0x78/0x100 [ 2468.270429][ T8573] do_fast_syscall_32+0x32/0x70 [ 2468.270456][ T8573] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2468.270476][ T8573] RIP: 0023:0xf708ef7c [ 2468.270491][ T8573] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2468.270507][ T8573] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 2468.270528][ T8573] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080045505 [ 2468.270541][ T8573] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 2468.270550][ T8573] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2468.270561][ T8573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2468.270570][ T8573] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2468.270592][ T8573] [ 2468.270756][ T8573] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2468.844681][ T50] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 2469.017521][ T50] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 2469.026468][ T50] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2469.035736][ T50] usb 5-1: config 0 has no interfaces? [ 2469.043256][ T50] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2469.051040][ T50] usb 5-1: config 0 has no interfaces? [ 2469.058120][ T50] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2469.067562][ T50] usb 5-1: config 0 has no interfaces? [ 2469.071128][ T50] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2469.079286][ T50] usb 5-1: config 0 has no interfaces? [ 2469.085766][ T50] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2469.093824][ T50] usb 5-1: config 0 has no interfaces? [ 2469.100649][ T50] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2469.108252][ T50] usb 5-1: config 0 has no interfaces? [ 2469.118180][ T50] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2469.123878][ T50] usb 5-1: config 0 has no interfaces? [ 2469.134975][ T50] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2469.140253][ T50] usb 5-1: config 0 has no interfaces? [ 2469.152763][ T50] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 2469.163277][ T50] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 2469.174886][ T50] usb 5-1: Product: syz [ 2469.176778][ T50] usb 5-1: Manufacturer: syz [ 2469.181263][ T50] usb 5-1: SerialNumber: syz [ 2469.191462][ T50] usb 5-1: config 0 descriptor?? [ 2469.702652][ T8597] netlink: 68 bytes leftover after parsing attributes in process `syz.3.7564'. [ 2469.945852][ T1385] usb 5-1: USB disconnect, device number 122 [ 2470.740733][ T8614] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7569'. [ 2470.836642][ T8615] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7569'. [ 2470.845357][ T8615] netlink: 72 bytes leftover after parsing attributes in process `syz.0.7569'. [ 2471.523703][ T8610] overlayfs: failed to resolve '/ile0': -2 [ 2471.568222][ T8627] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2471.574387][ T8627] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2471.646443][ T8629] FAULT_INJECTION: forcing a failure. [ 2471.646443][ T8629] name failslab, interval 1, probability 0, space 0, times 0 [ 2471.652921][ T8629] CPU: 0 UID: 0 PID: 8629 Comm: syz.1.7573 Tainted: G L syzkaller #0 PREEMPT(full) [ 2471.652950][ T8629] Tainted: [L]=SOFTLOCKUP [ 2471.652958][ T8629] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2471.652969][ T8629] Call Trace: [ 2471.652975][ T8629] [ 2471.652982][ T8629] dump_stack_lvl+0x100/0x190 [ 2471.653018][ T8629] should_fail_ex.cold+0x5/0xa [ 2471.653041][ T8629] ? bpf_test_init.isra.0+0x88/0x100 [ 2471.653060][ T8629] should_failslab+0xc2/0x120 [ 2471.653082][ T8629] __kmalloc_noprof+0xe0/0x850 [ 2471.653110][ T8629] ? __lock_acquire+0x4a5/0x2630 [ 2471.653141][ T8629] bpf_test_init.isra.0+0x88/0x100 [ 2471.653165][ T8629] bpf_prog_test_run_xdp+0x57e/0x1670 [ 2471.653197][ T8629] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 2471.653234][ T8629] ? fput+0x79/0x100 [ 2471.653253][ T8629] ? __bpf_prog_get+0x97/0x2a0 [ 2471.653274][ T8629] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 2471.653297][ T8629] __sys_bpf+0x1725/0x4b90 [ 2471.653318][ T8629] ? __pfx___sys_bpf+0x10/0x10 [ 2471.653333][ T8629] ? get_pid_task+0x106/0x250 [ 2471.653359][ T8629] ? proc_fail_nth_write+0x9f/0x220 [ 2471.653391][ T8629] ? find_held_lock+0x2b/0x80 [ 2471.653418][ T8629] ? find_held_lock+0x2b/0x80 [ 2471.653440][ T8629] ? ksys_write+0x190/0x250 [ 2471.653465][ T8629] ? __mutex_unlock_slowpath+0x15d/0x8a0 [ 2471.653491][ T8629] ? __pfx_vfs_write+0x3/0x10 [ 2471.653524][ T8629] ? fput+0x79/0x100 [ 2471.653546][ T8629] ? ksys_write+0x1ac/0x250 [ 2471.653570][ T8629] __ia32_sys_bpf+0x79/0xf0 [ 2471.653587][ T8629] ? lockdep_hardirqs_on+0x78/0x100 [ 2471.653611][ T8629] __do_fast_syscall_32+0xe7/0x970 [ 2471.653637][ T8629] ? lockdep_hardirqs_on+0x78/0x100 [ 2471.653663][ T8629] do_fast_syscall_32+0x32/0x70 [ 2471.653690][ T8629] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2471.653712][ T8629] RIP: 0023:0xf700ef7c [ 2471.653728][ T8629] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2471.653745][ T8629] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 2471.653762][ T8629] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000600 [ 2471.653774][ T8629] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 2471.653783][ T8629] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2471.653792][ T8629] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 2471.653803][ T8629] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2471.653827][ T8629] [ 2472.199096][ T1385] usb 6-1: new high-speed USB device number 125 using dummy_hcd [ 2472.406208][ T1385] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 2472.426513][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2472.443894][ T1385] usb 6-1: config 0 has no interfaces? [ 2472.483272][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2472.491808][ T1385] usb 6-1: config 0 has no interfaces? [ 2472.540590][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2472.567715][ T1385] usb 6-1: config 0 has no interfaces? [ 2472.587482][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2472.594126][ T1385] usb 6-1: config 0 has no interfaces? [ 2472.607914][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2472.613634][ T1385] usb 6-1: config 0 has no interfaces? [ 2472.643253][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2472.654434][ T1385] usb 6-1: config 0 has no interfaces? [ 2472.684052][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2472.699180][ T1385] usb 6-1: config 0 has no interfaces? [ 2472.714991][ T1385] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2472.727543][ T1385] usb 6-1: config 0 has no interfaces? [ 2472.777924][ T1385] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 2472.794850][ T1385] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 2472.810079][ T1385] usb 6-1: Product: syz [ 2472.816102][ T1385] usb 6-1: Manufacturer: syz [ 2472.825700][ T1385] usb 6-1: SerialNumber: syz [ 2472.864436][ T1385] usb 6-1: config 0 descriptor?? [ 2473.319811][ T8652] FAULT_INJECTION: forcing a failure. [ 2473.319811][ T8652] name failslab, interval 1, probability 0, space 0, times 0 [ 2473.324677][ T8652] CPU: 3 UID: 0 PID: 8652 Comm: syz.3.7582 Tainted: G L syzkaller #0 PREEMPT(full) [ 2473.324696][ T8652] Tainted: [L]=SOFTLOCKUP [ 2473.324700][ T8652] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2473.324707][ T8652] Call Trace: [ 2473.324711][ T8652] [ 2473.324715][ T8652] dump_stack_lvl+0x100/0x190 [ 2473.324737][ T8652] should_fail_ex.cold+0x5/0xa [ 2473.324750][ T8652] ? bpf_test_init.isra.0+0x88/0x100 [ 2473.324763][ T8652] should_failslab+0xc2/0x120 [ 2473.324776][ T8652] __kmalloc_noprof+0xe0/0x850 [ 2473.324795][ T8652] bpf_test_init.isra.0+0x88/0x100 [ 2473.324809][ T8652] bpf_prog_test_run_skb+0x497/0x3540 [ 2473.324827][ T8652] ? find_held_lock+0x2b/0x80 [ 2473.324840][ T8652] ? __fget_files+0x131/0x3d0 [ 2473.324856][ T8652] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 2473.324872][ T8652] ? fput+0x79/0x100 [ 2473.324888][ T8652] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 2473.324901][ T8652] __sys_bpf+0x1725/0x4b90 [ 2473.324914][ T8652] ? __pfx___sys_bpf+0x10/0x10 [ 2473.324923][ T8652] ? get_pid_task+0x106/0x250 [ 2473.324938][ T8652] ? proc_fail_nth_write+0x9f/0x220 [ 2473.324955][ T8652] ? find_held_lock+0x2b/0x80 [ 2473.324970][ T8652] ? find_held_lock+0x2b/0x80 [ 2473.324983][ T8652] ? ksys_write+0x190/0x250 [ 2473.325009][ T8652] ? __mutex_unlock_slowpath+0x15d/0x8a0 [ 2473.325028][ T8652] ? __pfx_vfs_write+0x3/0x10 [ 2473.325047][ T8652] ? fput+0x79/0x100 [ 2473.325061][ T8652] ? ksys_write+0x1ac/0x250 [ 2473.325074][ T8652] __ia32_sys_bpf+0x79/0xf0 [ 2473.325084][ T8652] ? lockdep_hardirqs_on+0x78/0x100 [ 2473.325099][ T8652] __do_fast_syscall_32+0xe7/0x970 [ 2473.325114][ T8652] ? lockdep_hardirqs_on+0x78/0x100 [ 2473.325130][ T8652] do_fast_syscall_32+0x32/0x70 [ 2473.325147][ T8652] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2473.325160][ T8652] RIP: 0023:0xf70cef7c [ 2473.325184][ T8652] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2473.325195][ T8652] RSP: 002b:00000000f54bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 2473.325205][ T8652] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000a40 [ 2473.325212][ T8652] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 2473.325218][ T8652] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2473.325224][ T8652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2473.325231][ T8652] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2473.325244][ T8652] [ 2473.419518][ T8654] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2473.424836][ T8654] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2474.015937][T28674] usb 6-1: USB disconnect, device number 125 [ 2475.479894][T26972] usb 6-1: new high-speed USB device number 126 using dummy_hcd [ 2475.650567][T26972] usb 6-1: Using ep0 maxpacket: 8 [ 2475.653893][T26972] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 2475.658771][T26972] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2475.668811][T26972] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2475.675662][T26972] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 2475.681907][T26972] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2475.690574][T26972] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2475.694863][T26972] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2476.180230][T26972] usb 6-1: usb_control_msg returned -32 [ 2476.182652][T26972] usbtmc 6-1:16.0: can't read capabilities [ 2476.558293][ T8688] usbtmc 6-1:16.0: usb_control_msg returned -71 [ 2476.558516][ T10] usb 6-1: USB disconnect, device number 126 [ 2476.576709][ T8697] FAULT_INJECTION: forcing a failure. [ 2476.576709][ T8697] name failslab, interval 1, probability 0, space 0, times 0 [ 2476.609478][ T8697] CPU: 2 UID: 0 PID: 8697 Comm: syz.1.7591 Tainted: G L syzkaller #0 PREEMPT(full) [ 2476.609498][ T8697] Tainted: [L]=SOFTLOCKUP [ 2476.609502][ T8697] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2476.609509][ T8697] Call Trace: [ 2476.609513][ T8697] [ 2476.609518][ T8697] dump_stack_lvl+0x100/0x190 [ 2476.609540][ T8697] should_fail_ex.cold+0x5/0xa [ 2476.609554][ T8697] should_failslab+0xc2/0x120 [ 2476.609568][ T8697] __kmalloc_cache_noprof+0x7a/0x6f0 [ 2476.609583][ T8697] ? usbtmc_read+0x249/0x10b0 [ 2476.609603][ T8697] usbtmc_read+0x249/0x10b0 [ 2476.609624][ T8697] ? __pfx_usbtmc_read+0x10/0x10 [ 2476.609642][ T8697] ? bpf_lsm_file_permission+0x9/0x10 [ 2476.609652][ T8697] ? security_file_permission+0x76/0x210 [ 2476.609666][ T8697] ? rw_verify_area+0xce/0x6d0 [ 2476.609677][ T8697] ? __pfx_usbtmc_read+0x10/0x10 [ 2476.609694][ T8697] vfs_read+0x1e4/0xb30 [ 2476.609715][ T8697] ? __pfx_vfs_read+0x10/0x10 [ 2476.609726][ T8697] ? find_held_lock+0x2b/0x80 [ 2476.609739][ T8697] ? __fget_files+0x215/0x3d0 [ 2476.609751][ T8697] ? __fget_files+0x215/0x3d0 [ 2476.609765][ T8697] ? __fget_files+0x21f/0x3d0 [ 2476.609781][ T8697] ksys_read+0x12a/0x250 [ 2476.609792][ T8697] ? __pfx_ksys_read+0x10/0x10 [ 2476.609803][ T8697] ? ksys_write+0x1ac/0x250 [ 2476.609816][ T8697] ? rcu_is_watching+0x12/0xc0 [ 2476.609830][ T8697] __do_fast_syscall_32+0xe7/0x970 [ 2476.609847][ T8697] ? lockdep_hardirqs_on+0x78/0x100 [ 2476.609863][ T8697] do_fast_syscall_32+0x32/0x70 [ 2476.609878][ T8697] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2476.609892][ T8697] RIP: 0023:0xf700ef7c [ 2476.609902][ T8697] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2476.609912][ T8697] RSP: 002b:00000000f53dc50c EFLAGS: 00000292 ORIG_RAX: 0000000000000003 [ 2476.609923][ T8697] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000 [ 2476.609930][ T8697] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2476.609936][ T8697] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2476.609942][ T8697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2476.609948][ T8697] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2476.609961][ T8697] [ 2476.696486][ C2] hpet: Lost 4 RTC interrupts [ 2478.021146][ T8729] netlink: 'syz.0.7602': attribute type 1 has an invalid length. [ 2478.977780][ T8752] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7607'. [ 2479.465214][ T8755] vhci_hcd vhci_hcd.0: port 0 already used [ 2480.836870][ T8767] FAULT_INJECTION: forcing a failure. [ 2480.836870][ T8767] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2480.854661][ T8767] CPU: 0 UID: 0 PID: 8767 Comm: syz.5.7610 Tainted: G L syzkaller #0 PREEMPT(full) [ 2480.854680][ T8767] Tainted: [L]=SOFTLOCKUP [ 2480.854684][ T8767] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2480.854690][ T8767] Call Trace: [ 2480.854695][ T8767] [ 2480.854699][ T8767] dump_stack_lvl+0x100/0x190 [ 2480.854722][ T8767] should_fail_ex.cold+0x5/0xa [ 2480.854736][ T8767] _copy_from_user+0x2e/0xd0 [ 2480.854752][ T8767] move_addr_to_kernel+0x65/0x170 [ 2480.854768][ T8767] __sys_sendto+0x1c9/0x4b0 [ 2480.854785][ T8767] ? __pfx___sys_sendto+0x10/0x10 [ 2480.854801][ T8767] ? __lock_acquire+0x4a5/0x2630 [ 2480.854830][ T8767] __ia32_compat_sys_socketcall+0x59a/0x770 [ 2480.854845][ T8767] ? __fget_files+0x21f/0x3d0 [ 2480.854858][ T8767] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 2480.854873][ T8767] ? fput+0x79/0x100 [ 2480.854890][ T8767] ? rcu_is_watching+0x12/0xc0 [ 2480.854904][ T8767] do_int80_emulation+0x14b/0x720 [ 2480.854922][ T8767] asm_int80_emulation+0x1a/0x20 [ 2480.854933][ T8767] RIP: 0023:0xf71861ab [ 2480.854942][ T8767] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 2480.854952][ T8767] RSP: 002b:00000000f544534c EFLAGS: 00000246 ORIG_RAX: 0000000000000066 [ 2480.854963][ T8767] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00000000f54453f4 [ 2480.854970][ T8767] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2480.854976][ T8767] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2480.854982][ T8767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2480.854988][ T8767] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2480.855001][ T8767] [ 2481.478657][ T8779] fuse: Unknown parameter '0x0000000000000008' [ 2482.873866][ T8798] vxcan0: tx address claim with dest, not broadcast [ 2482.878542][ T8808] vhci_hcd vhci_hcd.0: port 0 already used [ 2483.245615][ T8814] hsr0 speed is unknown, defaulting to 1000 [ 2484.608294][ T8836] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7628'. [ 2484.612031][ T8836] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7628'. [ 2486.361853][ T8851] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 2487.872704][T28674] usb 8-1: new high-speed USB device number 127 using dummy_hcd [ 2488.092648][T28674] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 2488.100492][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2488.104448][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2488.108156][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2488.114814][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2488.129913][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2488.217018][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2488.236087][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2488.240300][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2488.269001][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2488.285114][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2488.292014][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2488.312169][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2488.326709][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2488.340805][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2488.353916][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2488.357093][ T5854] usb 6-1: new high-speed USB device number 127 using dummy_hcd [ 2488.376566][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2488.394799][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2488.462786][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2488.487340][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2488.503093][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2488.517576][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2488.527819][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2488.532133][ T5854] usb 6-1: Using ep0 maxpacket: 32 [ 2488.535320][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2488.540959][ T5854] usb 6-1: config index 0 descriptor too short (expected 17179, got 27) [ 2488.547467][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2488.549975][ T5854] usb 6-1: config 83 has too many interfaces: 65, using maximum allowed: 32 [ 2488.556676][ T5854] usb 6-1: config 83 has an invalid descriptor of length 32, skipping remainder of the config [ 2488.569569][T28674] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 2488.573226][T28674] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 2488.575949][T28674] usb 8-1: Product: syz [ 2488.595079][T28674] usb 8-1: Manufacturer: syz [ 2488.597105][T28674] usb 8-1: SerialNumber: syz [ 2488.598630][ T5854] usb 6-1: config 83 has 0 interfaces, different from the descriptor's value: 65 [ 2488.617219][ T5854] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2488.634201][ T5854] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2488.636969][ T5854] usb 6-1: Product: syz [ 2488.638266][ T5854] usb 6-1: Manufacturer: syz [ 2488.639933][ T5854] usb 6-1: SerialNumber: syz [ 2488.799868][T28674] usb 8-1: config 0 descriptor?? [ 2488.992652][T28674] yurex 8-1:0.0: Could not find endpoints [ 2489.276804][ T8872] befs: (nullb0): No write support. Marking filesystem read-only [ 2489.280497][ T8872] befs: (nullb0): invalid magic header [ 2490.697779][ T5854] usb 6-1: USB disconnect, device number 127 [ 2491.373908][T26972] usb 8-1: USB disconnect, device number 127 [ 2492.299457][ T7023] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 2492.482087][ T7023] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 2492.490689][ T7023] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2492.495403][ T7023] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2492.498203][ T7023] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2492.503630][ T7023] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2492.507675][ T7023] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2492.510843][ T7023] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2492.514215][ T7023] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2492.518323][ T7023] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2492.522190][ T7023] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2492.525552][ T7023] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2492.531843][ T7023] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2492.540119][ T7023] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2492.543241][ T7023] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2492.546515][ T7023] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2492.549420][ T7023] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2492.553497][ T7023] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2492.556645][ T7023] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2492.559781][ T7023] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2492.562680][ T7023] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2492.567070][ T7023] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2492.569988][ T7023] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2492.573173][ T7023] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2492.575980][ T7023] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2492.580366][ T7023] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2492.583400][ T7023] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2492.586543][ T7023] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2492.590790][ T7023] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2492.596608][ T7023] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2492.602794][ T7023] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2492.607061][ T7023] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2492.611167][ T7023] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2492.616216][ T7023] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2492.621441][ T7023] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 2492.625129][ T7023] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 2492.628506][ T7023] usb 6-1: Product: syz [ 2492.630358][ T7023] usb 6-1: Manufacturer: syz [ 2492.632442][ T7023] usb 6-1: SerialNumber: syz [ 2492.637611][ T7023] usb 6-1: config 0 descriptor?? [ 2492.644154][ T7023] yurex 6-1:0.0: Could not find endpoints [ 2493.156378][ T8965] tipc: Started in network mode [ 2493.158478][ T8965] tipc: Node identity ac14140f, cluster identity 4711 [ 2493.161301][ T8965] tipc: New replicast peer: 255.255.255.255 [ 2493.163704][ T8965] tipc: Enabled bearer , priority 10 [ 2493.760093][ T10] usb 6-1: USB disconnect, device number 2 [ 2494.379896][ T7023] tipc: Node number set to 2886997007 [ 2494.919864][ T8979] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7655'. [ 2494.966300][ T8982] FAULT_INJECTION: forcing a failure. [ 2494.966300][ T8982] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2494.972189][ T8982] CPU: 0 UID: 0 PID: 8982 Comm: syz.1.7656 Tainted: G L syzkaller #0 PREEMPT(full) [ 2494.972209][ T8982] Tainted: [L]=SOFTLOCKUP [ 2494.972213][ T8982] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2494.972219][ T8982] Call Trace: [ 2494.972224][ T8982] [ 2494.972229][ T8982] dump_stack_lvl+0x100/0x190 [ 2494.972251][ T8982] should_fail_ex.cold+0x5/0xa [ 2494.972265][ T8982] _copy_to_user+0x32/0xd0 [ 2494.972281][ T8982] bpf_prog_test_run_raw_tp+0x53d/0x700 [ 2494.972297][ T8982] ? __pfx_bpf_prog_test_run_raw_tp+0x10/0x10 [ 2494.972313][ T8982] ? fput+0x79/0x100 [ 2494.972327][ T8982] ? __bpf_prog_get+0x97/0x2a0 [ 2494.972341][ T8982] ? __pfx_bpf_prog_test_run_raw_tp+0x10/0x10 [ 2494.972360][ T8982] __sys_bpf+0x1725/0x4b90 [ 2494.972372][ T8982] ? __pfx___sys_bpf+0x10/0x10 [ 2494.972381][ T8982] ? get_pid_task+0x106/0x250 [ 2494.972397][ T8982] ? proc_fail_nth_write+0x9f/0x220 [ 2494.972414][ T8982] ? find_held_lock+0x2b/0x80 [ 2494.972430][ T8982] ? find_held_lock+0x2b/0x80 [ 2494.972443][ T8982] ? ksys_write+0x190/0x250 [ 2494.972457][ T8982] ? __mutex_unlock_slowpath+0x15d/0x8a0 [ 2494.972473][ T8982] ? __pfx_vfs_write+0x3/0x10 [ 2494.972492][ T8982] ? fput+0x79/0x100 [ 2494.972506][ T8982] ? ksys_write+0x1ac/0x250 [ 2494.972519][ T8982] __ia32_sys_bpf+0x79/0xf0 [ 2494.972529][ T8982] ? lockdep_hardirqs_on+0x78/0x100 [ 2494.972545][ T8982] __do_fast_syscall_32+0xe7/0x970 [ 2494.972560][ T8982] ? lockdep_hardirqs_on+0x78/0x100 [ 2494.972576][ T8982] do_fast_syscall_32+0x32/0x70 [ 2494.972592][ T8982] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2494.972606][ T8982] RIP: 0023:0xf700ef7c [ 2494.972615][ T8982] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2494.972626][ T8982] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 2494.972637][ T8982] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000300 [ 2494.972644][ T8982] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 2494.972650][ T8982] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2494.972656][ T8982] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2494.972662][ T8982] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2494.972675][ T8982] [ 2495.089052][ T8988] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7657'. [ 2495.094704][ T8988] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7657'. [ 2496.636521][ T9020] overlayfs: metacopy with no lower data found - abort lookup (/file2) [ 2499.390116][ T9059] overlayfs: metacopy with no lower data found - abort lookup (/file2) [ 2501.206453][ T9078] netlink: 'syz.1.7682': attribute type 10 has an invalid length. [ 2501.209871][ T9078] syz_tun: entered promiscuous mode [ 2501.216294][ T9078] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 2503.670423][T21251] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 2503.730442][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 2503.834624][T21251] usb 5-1: config 128 has an invalid interface number: 148 but max is 0 [ 2503.837342][T21251] usb 5-1: config 128 has no interface number 0 [ 2503.839269][T21251] usb 5-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 2503.842735][T21251] usb 5-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 2503.846559][T21251] usb 5-1: config 128 interface 148 has no altsetting 0 [ 2503.850566][T21251] usb 5-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 2503.854659][T21251] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2503.857523][T21251] usb 5-1: Product: syz [ 2503.858851][T21251] usb 5-1: Manufacturer: syz [ 2503.860774][T21251] usb 5-1: SerialNumber: syz [ 2504.178450][T21251] usb 5-1: USB disconnect, device number 123 [ 2504.842971][ T9125] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7690'. [ 2505.948952][ T5754] Bluetooth: hci1: command 0x0406 tx timeout [ 2506.022608][T18121] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 2506.223405][T18121] usb 8-1: Using ep0 maxpacket: 32 [ 2506.253153][T18121] usb 8-1: config index 0 descriptor too short (expected 17179, got 27) [ 2506.269101][T18121] usb 8-1: config 83 has too many interfaces: 65, using maximum allowed: 32 [ 2506.290843][T18121] usb 8-1: config 83 has an invalid descriptor of length 32, skipping remainder of the config [ 2506.315319][T18121] usb 8-1: config 83 has 0 interfaces, different from the descriptor's value: 65 [ 2506.356601][T18121] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2506.370184][T18121] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2506.394961][T18121] usb 8-1: Product: syz [ 2506.404884][T18121] usb 8-1: Manufacturer: syz [ 2506.418277][T18121] usb 8-1: SerialNumber: syz [ 2506.785799][ T9128] befs: (nullb0): No write support. Marking filesystem read-only [ 2506.789176][ T9128] befs: (nullb0): invalid magic header [ 2507.545471][T18121] usb 8-1: USB disconnect, device number 2 [ 2512.273731][ T5854] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 2512.460242][ T5854] usb 10-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 2512.465301][ T5854] usb 10-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 2512.469258][ T5854] usb 10-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 2512.473882][ T5854] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2512.534416][ T9227] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 2512.565210][ T5854] usb 10-1: Quirk or no altset; falling back to MIDI 1.0 [ 2513.022083][ T1390] IPVS: starting estimator thread 0... [ 2513.115938][ T9244] IPVS: using max 47 ests per chain, 112800 per kthread [ 2513.224226][ T1390] usb 10-1: USB disconnect, device number 7 [ 2513.530705][ T9248] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7714'. [ 2513.537203][ T9248] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7714'. [ 2513.647870][ T9252] tmpfs: Bad value for 'mpol' [ 2514.068951][ T9262] netdevsim netdevsim5: Firmware load for '..' refused, path contains '..' component [ 2514.076824][ T9262] netlink: 'syz.5.7720': attribute type 10 has an invalid length. [ 2514.082114][ T9262] syz_tun: entered promiscuous mode [ 2514.095326][ T9262] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 2517.412704][ T9317] FAULT_INJECTION: forcing a failure. [ 2517.412704][ T9317] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2517.416788][ T9317] CPU: 1 UID: 0 PID: 9317 Comm: syz.0.7733 Tainted: G L syzkaller #0 PREEMPT(full) [ 2517.416806][ T9317] Tainted: [L]=SOFTLOCKUP [ 2517.416809][ T9317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2517.416816][ T9317] Call Trace: [ 2517.416820][ T9317] [ 2517.416825][ T9317] dump_stack_lvl+0x100/0x190 [ 2517.416846][ T9317] should_fail_ex.cold+0x5/0xa [ 2517.416861][ T9317] _copy_to_user+0x32/0xd0 [ 2517.416877][ T9317] simple_read_from_buffer+0xcb/0x170 [ 2517.416891][ T9317] proc_fail_nth_read+0x1af/0x230 [ 2517.416909][ T9317] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2517.416927][ T9317] ? rw_verify_area+0xce/0x6d0 [ 2517.416938][ T9317] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2517.416954][ T9317] vfs_read+0x1e4/0xb30 [ 2517.416968][ T9317] ? __pfx_vfs_read+0x10/0x10 [ 2517.416979][ T9317] ? find_held_lock+0x2b/0x80 [ 2517.416993][ T9317] ? __fget_files+0x215/0x3d0 [ 2517.417008][ T9317] ? __fget_files+0x21f/0x3d0 [ 2517.417024][ T9317] ksys_read+0x12a/0x250 [ 2517.417035][ T9317] ? __pfx_ksys_read+0x10/0x10 [ 2517.417047][ T9317] ? rcu_is_watching+0x12/0xc0 [ 2517.417060][ T9317] ? rcu_is_watching+0x12/0xc0 [ 2517.417073][ T9317] do_int80_emulation+0x14b/0x720 [ 2517.417092][ T9317] asm_int80_emulation+0x1a/0x20 [ 2517.417103][ T9317] RIP: 0023:0xf71c61ab [ 2517.417112][ T9317] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 2517.417122][ T9317] RSP: 002b:00000000f547d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 2517.417132][ T9317] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000f547d5d0 [ 2517.417139][ T9317] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 2517.417145][ T9317] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2517.417151][ T9317] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 2517.417157][ T9317] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2517.417171][ T9317] [ 2520.191340][ T9361] FAULT_INJECTION: forcing a failure. [ 2520.191340][ T9361] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2520.195567][ T9361] CPU: 0 UID: 0 PID: 9361 Comm: syz.1.7744 Tainted: G L syzkaller #0 PREEMPT(full) [ 2520.195592][ T9361] Tainted: [L]=SOFTLOCKUP [ 2520.195598][ T9361] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2520.195607][ T9361] Call Trace: [ 2520.195615][ T9361] [ 2520.195622][ T9361] dump_stack_lvl+0x100/0x190 [ 2520.195658][ T9361] should_fail_ex.cold+0x5/0xa [ 2520.195677][ T9361] strncpy_from_user+0x3b/0x2d0 [ 2520.195702][ T9361] do_getname+0x78/0x390 [ 2520.195728][ T9361] __ia32_sys_rename+0x56/0xb0 [ 2520.195751][ T9361] __do_fast_syscall_32+0xe7/0x970 [ 2520.195772][ T9361] ? lockdep_hardirqs_on+0x78/0x100 [ 2520.195788][ T9361] do_fast_syscall_32+0x32/0x70 [ 2520.195804][ T9361] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2520.195818][ T9361] RIP: 0023:0xf700ef7c [ 2520.195827][ T9361] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2520.195838][ T9361] RSP: 002b:00000000f53bb50c EFLAGS: 00000292 ORIG_RAX: 0000000000000026 [ 2520.195849][ T9361] RAX: ffffffffffffffda RBX: 0000000080000100 RCX: 0000000080000140 [ 2520.195856][ T9361] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2520.195862][ T9361] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2520.195868][ T9361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2520.195874][ T9361] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2520.195887][ T9361] [ 2522.327256][T28674] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 2522.509566][T28674] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 2522.521226][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2522.533675][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2522.548055][T28674] usb 8-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2522.561206][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2522.572758][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2522.582557][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2522.592259][T28674] usb 8-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2522.605632][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2522.611934][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2522.619002][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2522.628732][T28674] usb 8-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2522.639561][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2522.646825][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2522.653443][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2522.674560][T28674] usb 8-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2522.691310][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2522.697818][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2522.708732][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2522.719689][T28674] usb 8-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2522.733740][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2522.743665][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2522.755948][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2522.763860][T28674] usb 8-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2522.774559][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2522.783904][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2522.792080][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2522.802646][T28674] usb 8-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2522.815414][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2522.830106][T28674] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2522.839569][T28674] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2522.846667][T28674] usb 8-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2522.858616][T28674] usb 8-1: config 0 interface 0 has no altsetting 0 [ 2522.876959][T28674] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 2522.881562][T28674] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 2522.896185][T28674] usb 8-1: Product: syz [ 2522.900318][T28674] usb 8-1: Manufacturer: syz [ 2522.901944][T28674] usb 8-1: SerialNumber: syz [ 2522.918547][T28674] usb 8-1: config 0 descriptor?? [ 2522.931687][T28674] yurex 8-1:0.0: Could not find endpoints [ 2523.051791][ T9416] FAULT_INJECTION: forcing a failure. [ 2523.051791][ T9416] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2523.055843][ T9416] CPU: 1 UID: 0 PID: 9416 Comm: syz.0.7760 Tainted: G L syzkaller #0 PREEMPT(full) [ 2523.055860][ T9416] Tainted: [L]=SOFTLOCKUP [ 2523.055864][ T9416] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2523.055871][ T9416] Call Trace: [ 2523.055875][ T9416] [ 2523.055880][ T9416] dump_stack_lvl+0x100/0x190 [ 2523.055902][ T9416] should_fail_ex.cold+0x5/0xa [ 2523.055917][ T9416] strncpy_from_user+0x3b/0x2d0 [ 2523.055934][ T9416] do_getname+0x78/0x390 [ 2523.055951][ T9416] do_sys_openat2+0xc5/0x1e0 [ 2523.055967][ T9416] ? __pfx_do_sys_openat2+0x10/0x10 [ 2523.055984][ T9416] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2523.056010][ T9416] __ia32_compat_sys_openat+0x12d/0x210 [ 2523.056027][ T9416] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 2523.056044][ T9416] ? fput+0x79/0x100 [ 2523.056058][ T9416] ? ksys_write+0x1ac/0x250 [ 2523.056070][ T9416] ? rcu_is_watching+0x12/0xc0 [ 2523.056084][ T9416] __do_fast_syscall_32+0xe7/0x970 [ 2523.056100][ T9416] ? lockdep_hardirqs_on+0x78/0x100 [ 2523.056116][ T9416] do_fast_syscall_32+0x32/0x70 [ 2523.056132][ T9416] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2523.056145][ T9416] RIP: 0023:0xf708ef7c [ 2523.056154][ T9416] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2523.056165][ T9416] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 2523.056176][ T9416] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000180 [ 2523.056183][ T9416] RDX: 0000000000088882 RSI: 0000000000000000 RDI: 0000000000000000 [ 2523.056189][ T9416] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2523.056195][ T9416] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 2523.056201][ T9416] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2523.056214][ T9416] [ 2524.210732][ T10] usb 8-1: USB disconnect, device number 3 [ 2524.333908][ T9434] netlink: 20 bytes leftover after parsing attributes in process `syz.5.7763'. [ 2524.355399][ T9434] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7763'. [ 2526.176585][ T9456] netlink: 'syz.3.7770': attribute type 1 has an invalid length. [ 2527.335168][ T9480] FAULT_INJECTION: forcing a failure. [ 2527.335168][ T9480] name failslab, interval 1, probability 0, space 0, times 0 [ 2527.339698][ T9480] CPU: 0 UID: 0 PID: 9480 Comm: syz.5.7776 Tainted: G L syzkaller #0 PREEMPT(full) [ 2527.339716][ T9480] Tainted: [L]=SOFTLOCKUP [ 2527.339721][ T9480] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2527.339727][ T9480] Call Trace: [ 2527.339731][ T9480] [ 2527.339736][ T9480] dump_stack_lvl+0x100/0x190 [ 2527.339758][ T9480] should_fail_ex.cold+0x5/0xa [ 2527.339772][ T9480] should_failslab+0xc2/0x120 [ 2527.339785][ T9480] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 2527.339803][ T9480] ? __alloc_skb+0x140/0x710 [ 2527.339816][ T9480] __alloc_skb+0x140/0x710 [ 2527.339825][ T9480] ? __pfx___alloc_skb+0x10/0x10 [ 2527.339837][ T9480] ? __asan_memset+0x23/0x50 [ 2527.339855][ T9480] tipc_buf_acquire+0x26/0xe0 [ 2527.339869][ T9480] tipc_msg_build+0x597/0x1100 [ 2527.339886][ T9480] ? __pfx_tipc_msg_build+0x10/0x10 [ 2527.339906][ T9480] tipc_send_group_bcast+0x736/0xa20 [ 2527.339927][ T9480] ? __pfx_tipc_send_group_bcast+0x10/0x10 [ 2527.339943][ T9480] ? process_measurement+0x4c8/0x2350 [ 2527.339961][ T9480] ? __pfx_woken_wake_function+0x10/0x10 [ 2527.339974][ T9480] ? aa_label_sk_perm+0x194/0x5f0 [ 2527.339992][ T9480] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 2527.340008][ T9480] __tipc_sendmsg+0x4a3/0x1ad0 [ 2527.340020][ T9480] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 2527.340041][ T9480] ? __pfx___tipc_sendmsg+0x10/0x10 [ 2527.340053][ T9480] ? __lock_acquire+0x4a5/0x2630 [ 2527.340070][ T9480] ? __lock_acquire+0x4a5/0x2630 [ 2527.340095][ T9480] ? __local_bh_enable_ip+0x9e/0x120 [ 2527.340111][ T9480] tipc_sendmsg+0x4f/0x70 [ 2527.340123][ T9480] ____sys_sendmsg+0x9e1/0xb70 [ 2527.340136][ T9480] ? __pfx_tipc_sendmsg+0x10/0x10 [ 2527.340149][ T9480] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2527.340165][ T9480] ? _kstrtoull+0x13c/0x1f0 [ 2527.340176][ T9480] ? __pfx__kstrtoull+0x10/0x10 [ 2527.340188][ T9480] ___sys_sendmsg+0x190/0x1e0 [ 2527.340203][ T9480] ? __pfx____sys_sendmsg+0x10/0x10 [ 2527.340218][ T9480] ? __lock_acquire+0x4a5/0x2630 [ 2527.340248][ T9480] __sys_sendmmsg+0x2ff/0x430 [ 2527.340260][ T9480] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2527.340276][ T9480] ? __fget_files+0x215/0x3d0 [ 2527.340294][ T9480] ? fput+0x79/0x100 [ 2527.340308][ T9480] ? ksys_write+0x1ac/0x250 [ 2527.340322][ T9480] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 2527.340336][ T9480] ? lockdep_hardirqs_on+0x78/0x100 [ 2527.340351][ T9480] __do_fast_syscall_32+0xe7/0x970 [ 2527.340367][ T9480] ? lockdep_hardirqs_on+0x78/0x100 [ 2527.340383][ T9480] do_fast_syscall_32+0x32/0x70 [ 2527.340399][ T9480] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2527.340413][ T9480] RIP: 0023:0xf7f88f7c [ 2527.340422][ T9480] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2527.340432][ T9480] RSP: 002b:00000000f542550c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 2527.340443][ T9480] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800030c0 [ 2527.340449][ T9480] RDX: 0000000000000181 RSI: 0000000000000000 RDI: 0000000000000000 [ 2527.340456][ T9480] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2527.340462][ T9480] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2527.340468][ T9480] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2527.340481][ T9480] [ 2527.510023][T28674] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 2527.670806][T28674] usb 5-1: Using ep0 maxpacket: 16 [ 2527.679548][T28674] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 2527.686595][T28674] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2527.690441][T28674] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2527.709066][T28674] usb 5-1: Product: syz [ 2527.710814][T28674] usb 5-1: Manufacturer: syz [ 2527.712877][T28674] usb 5-1: SerialNumber: syz [ 2527.718397][T28674] usb 5-1: config 0 descriptor?? [ 2527.725900][T28674] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2527.729664][T28674] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 2528.569359][T28674] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 2529.461732][T28674] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 2529.823557][ T9519] ata1.00: invalid multi_count 1 ignored [ 2530.310495][T28674] em28xx 5-1:0.0: board has no eeprom [ 2530.472748][ T9519] em28xx 5-1:0.0: reading from i2c device at 0xe failed (error=-5) [ 2530.535149][T18121] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 2530.705851][T18121] usb 8-1: Using ep0 maxpacket: 32 [ 2530.730218][T18121] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2530.752970][T18121] usb 8-1: config 0 has no interfaces? [ 2530.795414][T18121] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2530.808909][T18121] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2530.820456][T18121] usb 8-1: Product: syz [ 2530.828982][T18121] usb 8-1: Manufacturer: syz [ 2530.843158][T18121] usb 8-1: SerialNumber: syz [ 2530.902057][T18121] usb 8-1: config 0 descriptor?? [ 2531.174326][ T9527] befs: (nullb0): No write support. Marking filesystem read-only [ 2531.178977][ T9527] befs: (nullb0): invalid magic header [ 2531.731080][T28674] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 2532.064479][T28674] em28xx 5-1:0.0: dvb set to bulk mode. [ 2532.066537][ T1385] em28xx 5-1:0.0: Binding DVB extension [ 2532.076234][T28674] usb 5-1: USB disconnect, device number 124 [ 2532.080392][T28674] em28xx 5-1:0.0: Disconnecting em28xx [ 2532.120506][ T1385] kworker/1:4: page allocation failure: order:4, mode:0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2532.124808][ T1385] CPU: 1 UID: 0 PID: 1385 Comm: kworker/1:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 2532.124826][ T1385] Tainted: [L]=SOFTLOCKUP [ 2532.124830][ T1385] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2532.124839][ T1385] Workqueue: events request_module_async [ 2532.124856][ T1385] Call Trace: [ 2532.124861][ T1385] [ 2532.124865][ T1385] dump_stack_lvl+0x100/0x190 [ 2532.124886][ T1385] warn_alloc.cold+0x95/0x1c1 [ 2532.124898][ T1385] ? __pfx_warn_alloc+0x10/0x10 [ 2532.124921][ T1385] ? __pfx___might_resched+0x10/0x10 [ 2532.124937][ T1385] __alloc_frozen_pages_noprof+0xf25/0x2bc0 [ 2532.124959][ T1385] ? stack_trace_save+0x8e/0xc0 [ 2532.124973][ T1385] ? em28xx_read_reg_req_len+0x216/0x2b0 [ 2532.124990][ T1385] ? stack_depot_save_flags+0x27/0x9d0 [ 2532.125008][ T1385] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 2532.125025][ T1385] ? usb_alloc_urb+0x66/0xa0 [ 2532.125040][ T1385] ? kasan_save_stack+0x30/0x50 [ 2532.125051][ T1385] ? __kasan_kmalloc+0xaa/0xb0 [ 2532.125060][ T1385] ? usb_alloc_urb+0x66/0xa0 [ 2532.125074][ T1385] ? em28xx_alloc_urbs+0x5fa/0xf60 [ 2532.125084][ T1385] ? em28xx_dvb_init.cold+0x1f2/0x7391 [ 2532.125101][ T1385] ? request_module_async+0x61/0x80 [ 2532.125112][ T1385] ? process_one_work+0xa0e/0x1980 [ 2532.125121][ T1385] ? worker_thread+0x5ef/0xe50 [ 2532.125136][ T1385] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2532.125152][ T1385] ? policy_nodemask+0xed/0x4f0 [ 2532.125166][ T1385] alloc_pages_mpol+0x1fb/0x540 [ 2532.125180][ T1385] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 2532.125196][ T1385] ? em28xx_alloc_urbs+0x655/0xf60 [ 2532.125205][ T1385] ___kmalloc_large_node+0xe5/0x120 [ 2532.125220][ T1385] __kmalloc_large_node_noprof+0x1c/0x70 [ 2532.125235][ T1385] __kmalloc_noprof+0x5be/0x850 [ 2532.125251][ T1385] ? __asan_memset+0x23/0x50 [ 2532.125269][ T1385] em28xx_alloc_urbs+0x655/0xf60 [ 2532.125283][ T1385] ? kasan_save_track+0x14/0x30 [ 2532.125295][ T1385] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2532.125310][ T1385] em28xx_dvb_init.cold+0x1f2/0x7391 [ 2532.125330][ T1385] ? lock_acquire+0x1b1/0x370 [ 2532.125346][ T1385] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2532.125367][ T1385] ? rcu_is_watching+0x12/0xc0 [ 2532.125379][ T1385] ? trace_contention_end+0x122/0x170 [ 2532.125390][ T1385] ? __mutex_lock+0x26d/0x1b10 [ 2532.125406][ T1385] ? em28xx_init_extension+0x2f/0x200 [ 2532.125416][ T1385] ? register_lock_class+0x40/0x560 [ 2532.125433][ T1385] ? do_raw_spin_lock+0x128/0x260 [ 2532.125444][ T1385] ? em28xx_audio_init+0x132/0x1a0 [ 2532.125459][ T1385] ? __pfx___mutex_lock+0x10/0x10 [ 2532.125476][ T1385] ? em28xx_v4l2_init+0x89/0xb0 [ 2532.125491][ T1385] ? __pfx_em28xx_audio_init+0x10/0x10 [ 2532.125511][ T1385] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2532.125526][ T1385] em28xx_init_extension+0x13a/0x200 [ 2532.125539][ T1385] request_module_async+0x61/0x80 [ 2532.125551][ T1385] process_one_work+0xa0e/0x1980 [ 2532.125566][ T1385] ? __pfx_process_one_work+0x10/0x10 [ 2532.125580][ T1385] ? __pfx_request_module_async+0x10/0x10 [ 2532.125594][ T1385] worker_thread+0x5ef/0xe50 [ 2532.125607][ T1385] ? __pfx_worker_thread+0x10/0x10 [ 2532.125618][ T1385] ? kthread+0x13a/0x450 [ 2532.125633][ T1385] ? __pfx_worker_thread+0x10/0x10 [ 2532.125642][ T1385] kthread+0x370/0x450 [ 2532.125657][ T1385] ? __pfx_kthread+0x10/0x10 [ 2532.125673][ T1385] ret_from_fork+0x72b/0xd50 [ 2532.125685][ T1385] ? __pfx_ret_from_fork+0x10/0x10 [ 2532.125697][ T1385] ? __switch_to+0x800/0x1100 [ 2532.125711][ T1385] ? __pfx_kthread+0x10/0x10 [ 2532.125727][ T1385] ret_from_fork_asm+0x1a/0x30 [ 2532.125747][ T1385] [ 2532.125752][ T1385] Mem-Info: [ 2532.237681][ T1385] active_anon:795 inactive_anon:592 isolated_anon:0 [ 2532.237681][ T1385] active_file:6562 inactive_file:8997 isolated_file:0 [ 2532.237681][ T1385] unevictable:1768 dirty:231 writeback:0 [ 2532.237681][ T1385] slab_reclaimable:8046 slab_unreclaimable:112999 [ 2532.237681][ T1385] mapped:24267 shmem:1769 pagetables:1430 [ 2532.237681][ T1385] sec_pagetables:422 bounce:0 [ 2532.237681][ T1385] kernel_misc_reclaimable:0 [ 2532.237681][ T1385] free:21366 free_pcp:342 free_cma:0 [ 2532.254737][ T1385] Node 0 active_anon:64kB inactive_anon:4kB active_file:24kB inactive_file:584kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:56kB dirty:8kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8192kB pagetables:1712kB sec_pagetables:1232kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2532.267026][ T1385] Node 1 active_anon:5116kB inactive_anon:364kB active_file:26224kB inactive_file:35104kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:97012kB dirty:916kB writeback:0kB shmem:3540kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16060kB pagetables:4008kB sec_pagetables:456kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2532.277496][ T1385] Node 0 DMA free:2532kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:24kB unevictable:0kB writepending:4kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2532.286542][ T1385] lowmem_reserve[]: 0 285 285 285 285 [ 2532.288370][ T1385] Node 0 DMA32 free:21280kB boost:29460kB min:42556kB low:45828kB high:49100kB reserved_highatomic:0KB free_highatomic:0KB active_anon:64kB inactive_anon:4kB active_file:20kB inactive_file:408kB unevictable:3536kB writepending:4kB zspages:636kB present:1032196kB managed:292744kB mlocked:0kB bounce:0kB free_pcp:188kB local_pcp:0kB free_cma:0kB [ 2532.298030][ T1385] lowmem_reserve[]: 0 0 0 0 0 [ 2532.299526][ T1385] Node 1 DMA32 free:62128kB boost:14336kB min:61476kB low:73260kB high:85044kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1304kB inactive_anon:3984kB active_file:25928kB inactive_file:35092kB unevictable:3536kB writepending:916kB zspages:6108kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:1184kB local_pcp:0kB free_cma:0kB [ 2532.310979][ T1385] lowmem_reserve[]: 0 0 0 0 0 [ 2532.312484][ T1385] Node 0 DMA: 91*4kB (UM) 49*8kB (UM) 21*16kB (UM) 11*32kB (UM) 9*64kB (UM) 2*128kB (M) 1*256kB (M) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 2532kB [ 2532.316995][ T1385] Node 0 DMA32: 1296*4kB (UME) 376*8kB (UME) 195*16kB (UME) 78*32kB (UME) 30*64kB (UME) 13*128kB (UME) 13*256kB (UME) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 21232kB [ 2532.322035][ T1385] Node 1 DMA32: 535*4kB (UME) 1083*8kB (UM) 3148*16kB (UME) 31*32kB (UME) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 62164kB [ 2532.326396][ T1385] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2532.330645][ T1385] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2532.335860][ T1385] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2532.343606][ T1385] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2532.349104][ T1385] 18335 total pagecache pages [ 2532.350562][ T1385] 1281 pages in swap cache [ 2532.354408][ T1385] Free swap = 95384kB [ 2532.355698][ T1385] Total swap = 124996kB [ 2532.359210][ T1385] 524155 pages RAM [ 2532.360440][ T1385] 0 pages HighMem/MovableOnly [ 2532.372130][ T1385] 210076 pages reserved [ 2532.373471][ T1385] 0 pages cma reserved [ 2532.374995][ T1385] ------------[ cut here ]------------ [ 2532.376703][ T1385] !PageLargeKmalloc(page) [ 2532.376710][ T1385] WARNING: mm/slub.c:6476 at free_large_kmalloc+0xbf/0x100, CPU#1: kworker/1:4/1385 [ 2532.380904][ T1385] Modules linked in: [ 2532.382613][ T1385] CPU: 1 UID: 0 PID: 1385 Comm: kworker/1:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 2532.386597][ T1385] Tainted: [L]=SOFTLOCKUP [ 2532.387952][ T1385] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2532.391247][ T1385] Workqueue: events request_module_async [ 2532.392972][ T1385] RIP: 0010:free_large_kmalloc+0xbf/0x100 [ 2532.395001][ T1385] Code: 28 90 0f 0b 90 80 3d d5 09 57 0e 00 0f 84 d7 91 bb fe 48 8b 74 24 28 48 89 ef e8 4c 00 0c 00 b8 00 f0 ff ff 45 31 ed eb 9d 90 <0f> 0b 90 48 83 c4 08 48 89 df 48 c7 c6 bf 68 f0 8d 5b 5d 41 5c 41 [ 2532.401138][ T1385] RSP: 0018:ffffc90003b67810 EFLAGS: 00010293 [ 2532.403161][ T1385] RAX: 00000000000000f0 RBX: ffffea0001fb9800 RCX: 000000000000002e [ 2532.405771][ T1385] RDX: 0000000000000000 RSI: ffff88807ee60000 RDI: ffffea0001fb9800 [ 2532.408294][ T1385] RBP: ffff88807ee60000 R08: 0000000000000005 R09: 0000000000000000 [ 2532.410958][ T1385] R10: ffffffffffffffff R11: dffffc0000000000 R12: ffff888064d01e98 [ 2532.413503][ T1385] R13: ffff888024820500 R14: dffffc0000000000 R15: ffffed100c9a03d5 [ 2532.416047][ T1385] FS: 0000000000000000(0000) GS:ffff88809728e000(0000) knlGS:0000000000000000 [ 2532.418994][ T1385] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2532.421245][ T1385] CR2: 00007f212148d068 CR3: 000000006b6b1000 CR4: 0000000000352ef0 [ 2532.423900][ T1385] Call Trace: [ 2532.425114][ T1385] [ 2532.426109][ T1385] usb_free_urb.part.0+0xf8/0x110 [ 2532.427713][ T1385] usb_free_urb+0x1f/0x30 [ 2532.429085][ T1385] em28xx_uninit_usb_xfer+0xf3/0x360 [ 2532.430728][ T1385] em28xx_alloc_urbs+0xb43/0xf60 [ 2532.432291][ T1385] ? kasan_save_track+0x14/0x30 [ 2532.433804][ T1385] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2532.435496][ T1385] em28xx_dvb_init.cold+0x1f2/0x7391 [ 2532.437271][ T1385] ? lock_acquire+0x1b1/0x370 [ 2532.439116][ T1385] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2532.440754][ T1385] ? rcu_is_watching+0x12/0xc0 [ 2532.442254][ T1385] ? trace_contention_end+0x122/0x170 [ 2532.444146][ T1385] ? __mutex_lock+0x26d/0x1b10 [ 2532.446118][ T1385] ? em28xx_init_extension+0x2f/0x200 [ 2532.447929][ T1385] ? register_lock_class+0x40/0x560 [ 2532.449658][ T1385] ? do_raw_spin_lock+0x128/0x260 [ 2532.451207][ T1385] ? em28xx_audio_init+0x132/0x1a0 [ 2532.453033][ T1385] ? __pfx___mutex_lock+0x10/0x10 [ 2532.454936][ T1385] ? em28xx_v4l2_init+0x89/0xb0 [ 2532.456864][ T1385] ? __pfx_em28xx_audio_init+0x10/0x10 [ 2532.459065][ T1385] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2532.460795][ T1385] em28xx_init_extension+0x13a/0x200 [ 2532.462618][ T1385] request_module_async+0x61/0x80 [ 2532.464337][ T1385] process_one_work+0xa0e/0x1980 [ 2532.466147][ T1385] ? __pfx_process_one_work+0x10/0x10 [ 2532.468112][ T1385] ? __pfx_request_module_async+0x10/0x10 [ 2532.470395][ T1385] worker_thread+0x5ef/0xe50 [ 2532.471947][ T1385] ? __pfx_worker_thread+0x10/0x10 [ 2532.473998][ T1385] ? kthread+0x13a/0x450 [ 2532.475599][ T1385] ? __pfx_worker_thread+0x10/0x10 [ 2532.477418][ T1385] kthread+0x370/0x450 [ 2532.478657][ T1385] ? __pfx_kthread+0x10/0x10 [ 2532.480196][ T1385] ret_from_fork+0x72b/0xd50 [ 2532.481639][ T1385] ? __pfx_ret_from_fork+0x10/0x10 [ 2532.483226][ T1385] ? __switch_to+0x800/0x1100 [ 2532.484710][ T1385] ? __pfx_kthread+0x10/0x10 [ 2532.486152][ T1385] ret_from_fork_asm+0x1a/0x30 [ 2532.487657][ T1385] [ 2532.488643][ T1385] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 2532.490875][ T1385] CPU: 1 UID: 0 PID: 1385 Comm: kworker/1:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 2532.494128][ T1385] Tainted: [L]=SOFTLOCKUP [ 2532.495454][ T1385] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2532.498514][ T1385] Workqueue: events request_module_async [ 2532.500483][ T1385] Call Trace: [ 2532.501753][ T1385] [ 2532.502929][ T1385] dump_stack_lvl+0x100/0x190 [ 2532.504769][ T1385] vpanic+0x552/0x970 [ 2532.506053][ T1385] ? __pfx_vpanic+0x10/0x10 [ 2532.507816][ T1385] panic+0xd1/0xe0 [ 2532.509315][ T1385] ? __pfx_panic+0x10/0x10 [ 2532.511014][ T1385] ? check_panic_on_warn+0x1f/0x90 [ 2532.512777][ T1385] check_panic_on_warn.cold+0x19/0x34 [ 2532.514860][ T1385] ? free_large_kmalloc+0xbf/0x100 [ 2532.516875][ T1385] __warn.cold+0x191/0x328 [ 2532.518625][ T1385] __report_bug+0x296/0x3d0 [ 2532.520413][ T1385] ? free_large_kmalloc+0xbf/0x100 [ 2532.522400][ T1385] ? __pfx___report_bug+0x10/0x10 [ 2532.524087][ T1385] ? lock_acquire+0x1b1/0x370 [ 2532.525932][ T1385] ? find_held_lock+0x2b/0x80 [ 2532.527777][ T1385] ? __free_one_page+0x109/0x1090 [ 2532.529599][ T1385] ? __free_one_page+0x109/0x1090 [ 2532.531433][ T1385] ? free_large_kmalloc+0xbf/0x100 [ 2532.533418][ T1385] report_bug+0xb2/0x220 [ 2532.534974][ T1385] ? free_large_kmalloc+0xbf/0x100 [ 2532.536827][ T1385] handle_bug+0x16a/0x2a0 [ 2532.538361][ T1385] exc_invalid_op+0x17/0x50 [ 2532.540035][ T1385] asm_exc_invalid_op+0x1a/0x20 [ 2532.541685][ T1385] RIP: 0010:free_large_kmalloc+0xbf/0x100 [ 2532.543902][ T1385] Code: 28 90 0f 0b 90 80 3d d5 09 57 0e 00 0f 84 d7 91 bb fe 48 8b 74 24 28 48 89 ef e8 4c 00 0c 00 b8 00 f0 ff ff 45 31 ed eb 9d 90 <0f> 0b 90 48 83 c4 08 48 89 df 48 c7 c6 bf 68 f0 8d 5b 5d 41 5c 41 [ 2532.551146][ T1385] RSP: 0018:ffffc90003b67810 EFLAGS: 00010293 [ 2532.553285][ T1385] RAX: 00000000000000f0 RBX: ffffea0001fb9800 RCX: 000000000000002e [ 2532.556317][ T1385] RDX: 0000000000000000 RSI: ffff88807ee60000 RDI: ffffea0001fb9800 [ 2532.559242][ T1385] RBP: ffff88807ee60000 R08: 0000000000000005 R09: 0000000000000000 [ 2532.562261][ T1385] R10: ffffffffffffffff R11: dffffc0000000000 R12: ffff888064d01e98 [ 2532.565045][ T1385] R13: ffff888024820500 R14: dffffc0000000000 R15: ffffed100c9a03d5 [ 2532.568111][ T1385] usb_free_urb.part.0+0xf8/0x110 [ 2532.569683][ T1385] usb_free_urb+0x1f/0x30 [ 2532.571077][ T1385] em28xx_uninit_usb_xfer+0xf3/0x360 [ 2532.573151][ T1385] em28xx_alloc_urbs+0xb43/0xf60 [ 2532.574969][ T1385] ? kasan_save_track+0x14/0x30 [ 2532.576463][ T1385] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2532.578091][ T1385] em28xx_dvb_init.cold+0x1f2/0x7391 [ 2532.579735][ T1385] ? lock_acquire+0x1b1/0x370 [ 2532.581121][ T1385] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2532.582749][ T1385] ? rcu_is_watching+0x12/0xc0 [ 2532.584263][ T1385] ? trace_contention_end+0x122/0x170 [ 2532.586330][ T1385] ? __mutex_lock+0x26d/0x1b10 [ 2532.588218][ T1385] ? em28xx_init_extension+0x2f/0x200 [ 2532.590283][ T1385] ? register_lock_class+0x40/0x560 [ 2532.592081][ T1385] ? do_raw_spin_lock+0x128/0x260 [ 2532.594042][ T1385] ? em28xx_audio_init+0x132/0x1a0 [ 2532.596021][ T1385] ? __pfx___mutex_lock+0x10/0x10 [ 2532.597848][ T1385] ? em28xx_v4l2_init+0x89/0xb0 [ 2532.599728][ T1385] ? __pfx_em28xx_audio_init+0x10/0x10 [ 2532.601834][ T1385] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2532.603909][ T1385] em28xx_init_extension+0x13a/0x200 [ 2532.605821][ T1385] request_module_async+0x61/0x80 [ 2532.607637][ T1385] process_one_work+0xa0e/0x1980 [ 2532.609607][ T1385] ? __pfx_process_one_work+0x10/0x10 [ 2532.611705][ T1385] ? __pfx_request_module_async+0x10/0x10 [ 2532.613919][ T1385] worker_thread+0x5ef/0xe50 [ 2532.615762][ T1385] ? __pfx_worker_thread+0x10/0x10 [ 2532.617747][ T1385] ? kthread+0x13a/0x450 [ 2532.619141][ T1385] ? __pfx_worker_thread+0x10/0x10 [ 2532.621212][ T1385] kthread+0x370/0x450 [ 2532.622914][ T1385] ? __pfx_kthread+0x10/0x10 [ 2532.624597][ T1385] ret_from_fork+0x72b/0xd50 [ 2532.626470][ T1385] ? __pfx_ret_from_fork+0x10/0x10 [ 2532.628486][ T1385] ? __switch_to+0x800/0x1100 [ 2532.630047][ T1385] ? __pfx_kthread+0x10/0x10 [ 2532.631885][ T1385] ret_from_fork_asm+0x1a/0x30 [ 2532.633789][ T1385] [ 2532.635529][ T1385] Kernel Offset: disabled [ 2532.637239][ T1385] Rebooting in 86400 seconds..