last executing test programs: 2m23.281099718s ago: executing program 1 (id=452): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000002640)=[{&(0x7f0000000400)="8d9debaaeb4a74c244a5cd1e8e4ba0b4a77c353b4d622f70e728ea49a7f5a2e82e18ccd0bd3c82c4c2ad23211823d1e35098518ac21d32575e828cf475d6ae2232ebb40db572a05f9c33f79dd9f793ebdff879094d96e9c53fb4c63cc7109e2df542cc2ee463ac926b1e665dbb8f8f07", 0x70}, {&(0x7f0000000540)="e642139495560c6e3714cf8686d2e184475db28c20901b9594b116815c70c7fa5119c1bf250e5e0b1ab193885bce759314f660d481c6ba7348f729c6dffe54dea9863a26bbeaaccb81b8b5674b021697bc5812326e09508a827022f26906ad94304285aec1447fded38da56a4e1c1eb564761acd", 0x74}, {&(0x7f0000000600)="2d0f3d9371ff9a71e974343e7fc675c1762a199a17558863e4e02029c0ad0b9d2f28ce4ca8ce530f1fb5d06693599206", 0x30}, {&(0x7f0000001640)="2848d30f913e5b7c9ae644aea71775345611e0e4fb77df756b6b4d022484ccfd05a3475cc4796d0f59e78b426af41ec84e4818ec54ed483b9bac27357d9409f03f6aabb271d714ed01a5f142d5b6d9be13067ffabbab0ce60b7f4457e1d9beb16d0200456083e206e3c6edb7264ad8a3b0cc919b01369ac9a0b1f0c8851afecc35e4d3bf37c34cc8e66d693466c1efc6cc7b2cb22ca0866932f2a3880a105f313cf9c615ae28ca6a8c808a52fec04449f46be37fb876ccf2eec4275d9eb321834b21c704aa0d7438574d01fbaf7219b919a0eefcc8b69c2fdd46bb986bc75e46a5f3f77c562e1b29abbd224482f00e4aa8a87a1ea2a6bd7739ed8ef24c60067d53ad1a910f10f8783c7a1af33923f325718a049bbfbb860e1911b875ec25e4eb32ece485cbc802b13fc8e690be6f2251b1e5f69d70c932a4f182b04461a5890e45bfd6b6d8fed892af5ef0cd039c225590f41227e7ac25761d728d1a2d1f5dce60fb3497c68c684969cf41f27a02f2e18350539897ea46ff393a2570431ac0af51d3fe7c4f0eec0d69004d24c022f4f56020c4cb384111e3b2abad1dfba288ff64f9706f7f5a85ea15c55ec2ef67cceec044f1fa8a946addfe22d696c135d414cf7b3dc504ffd37e7f0f5542f233643704a7928ffffc2635f87d5b6007ca23ad42756f648fddadfd045e0d750cb4bf870c84f24b5affb4554f66a8ce0f04a8c3b1f4aa90b55ffed0aaa8f7de7ccfd12970bcb3c8263f537e26febe99d20cb19890c0a623512331a0db4969e8a3fc62775c3186556f40fc4030063da807e889bc68076e598251ea5b659e8e4d748974d6b71412e5d58ecf3f2609f0f63e60a34b9e6404a4654328c05c61213532a353b3df41e02f0fa502d3b4b6d1667647fff785cbad171204fa9fe6c47d8f6462e30ef869bf5369984a88b99136cbb9c91334600cd335a34d2e1389a4ee83d4d5619c06e3f32c1a8c41906a5a1c3f9cad1939f1c08a527e6c9a4da4ecd9fde19ad984e061163efb9fc9742f6fd8da5df0009a1bd867c9524bc50ca361b2c121f790ef286e289c051646dff0a8e618866be6fc81d39aa074256a41d6dab9a68e544d9d2e947462068151ed95d10595919e521c4a38c15ed59a77abcc28fa6e0bebc6ca397ebc6fdaed530fe797e2d4b00142086a54addc848a6aa8fe524bc09915323265e325110040c92449f390daae7b07c783d1a521f6ce060cb940fd2a1a318614d5a2ffc35fec5141d115d70e5a168e869fc4c7abf81157429c9b468fd59998b0dd7b691ee144a9eb229709df34ee7128cdce1f9851422afae6aa5e3967dc1fa3297333bbe1c8c34b8516bf1ca231a3c2973a7bb9b883d5aa60ac4c97428e8f9d8a4459213cc46cd488c95c1d18a1492a57dede664de8ac33747d9498fd51e661bbdfa4a00b632f77b8507fae64aaf7f5e998dea7f78a015ba44e6ad580525aa64073cd2534df026963ac717adc63681d196c5a7862d9ffd1fcea14f7c9f6d557c3dcc7c15afccf6f29288801392f980840a8e24c4c87eb576df50dee896f894f8c5c9f08dc39e0ba0fa6215bc442d8e4260f73da70ff1073cc40d20daa7fa47884369acb61494d2d0a78d9cf36cbca16d47cc650e7918d2d8b3afe7a0abd8eebb8261936ecf5528748d9434d785f5601b84cd4eb6fcca00e8ab0e57e69a8c4283ce0b3f52621825003d7a19c9a0b27bd072d1799fe0a8820ada74bf1bff6e48303776a8b5fbb568a603212c3de41861469375b6b26376452980658c17ffbb04194173148fe977065c4aa494d621086476d8e1547ed3976b81ca6d45383c646fdd9dcc5f833381b6bb6c18e06839a8c4b67cac54c92cf2da6563daa5214b6e7497f2fab56172b4d2f41d4c471e7c991f12f2ba61a0c1f0872d1dbe9aaf9ca1fc0776844e7629266db00530d93596f6c0a2227fc142d467ab694c84db0af12df07789b717a5cc2eda545d2d664abfd9befb045947066d8f5195504e7e5bafd96039491eca03e3ba074c56d0fae7c4dc5f83f65039dc0569d50da9399dc63ab91bbe4dd5dd52c39f0e9021a8a93f9717048fae201aac42d2d3b910002bbce2020fd5f07f07786504c5a3684b5a6084d7c8447ca23639db6fdf225a7c1e85d76f2638fd2553dafcf2286eaa2e58db0f1247d10b4b0838b2991570f23e4b02981b4afbaa14af610b185fccedbc276842788de3855967e7b09e27c170358d0951237168fc1ec0111fea3b570b25bc2f45ee03f285d96f83ec45ec2acd56dc2c3ce2b4cd0d3cbb17e3b97c1c351894e54f0bf0859550f3b7263ee0b296a298de6b416ad7df04c31f330b0de6305422a13182ff874d313d3535b94e98f59c99f5b81545fcc7806ef6c35481e41dd0620145306d6ac77dd38282a930d69d35b981e059d5255df6edfd6a110acf7fcee5e1e3b8fb7ca57b8ced43dadbd2ad42835129ee9f47e94ae62f3115a37b46bd038879936f4792658d808137ed89534ffc064963934aa61011058ef3e46cc69f53a47b477aab064bec5094fdeac36cf204e367519615dc3a9d6a40d7a952fb0c07ebc503ebcdcd23b480199d132a31acd816d69ab8c56a3e1f539d29343ae2ac636111b27a04deb2c133975513cbcc974dabda4a0755759a5958faf2a236cf622cfd2491598dbe51bb8ebf4f4b36897a40d149bee99e41e4e43748ecfa4ccb871ad2772ff7e77423ddf0020d7061c0d5857e0fb61af281f292bffa18bd5be54cbb169ec72838a7392130e75a81af92b88ffea34137d3ff15f3fcb8f0593617766b5088b10c07a52f39c265157a57445ac9e70fe4308533cd21491c2e3f28f0139d432ae8d9a391304143be82ab03b9b508b361e9dcb8566c79713a8884445a4e37b0e298f799aaefec166f64019da664558e5d9705b870e3aeafef939e1c7c16319bfa6bd13435f6d6e04d1480b95316c8e9edc4d9ec3cd49c1994ef407b758c0d5cfeaeef25779067eac37c5b8eb701324ad047fb773a228dce25cfc3bdea15625cbe122b02908dd30be21073a4651a74b5086f8d03a25dc2c6971f1c28e2b0e29349d7927ef7a9cc94d570ae6a7248807c05f888f3f64444edda3d647b877cf4db6c13b890cbf1767f05e6438aa2b168e7f943842575525104fa6366c6b8379dcf0aa3c6dd34f2dd2a3ba9a2ffe8b044d691e388eb0c783e7ccd62fbaabb76fbfb6a0f7b7db6710267025ab724c58a19455860d5a124003704a84066c8e42bc65de3cf54942629eefc1a7b6f217a13d0281ab7ce459098dd56277a23715c9c5649474913bb33fdc0e27abb764b6eff675b7a99b3ca7f2c2617f5e09fd77666af328d4d1c7c41ca551d51826893cb619246b091f9954588a5e6deb7e9221e1aa5bd925ae2f1b3167322cc108320bfeef8d9ae5428074d3de823d39b636ea07cf639c8e43d5a2756edec63ba395dd5cad7b93df29d0cad070d59be09bb8116e5b9923e700d57b6c777dc42edf92102d518cf1563692e3b154a7161a82d12eccfae9d8952d1428720e110543599e0410908e78df43218b2192a160725e67e76f382cbf689cb0d1eda68307a3dc4bc7040f50ba174f20d604930fc7fbfa6ac7170a0a80c70a98cda55412e5f29e00971641a699f2ba343ba2a26a7ec73a18697e56458d926bf7364da5b426ba1d177cc1683563d77de47785546ed10a9e4665efc329244543d550ac06fe4aaa0f4598c8f1a112c5a0572d8bb4b9fa5d5c6b2d2032274efb82b947521af154ae0458f9673a90344981363e551c662c65a2d0f46e18af3458f886dfe241e25486454c6857966e3fea2c07a2eb36082cba435aed9d317d6681d2814ad14e1d0d619886282493089ea39e7378a4485ad9c06abe3467521d6e1406609ac0e113c91e54c922d5184b70d1656739059f7782f706e8ca123ac42cf206339c27ebdff86b59068b6f77f88b47f8dc14153c8327deeb95c39651c511f5a05be0ee6b836e2b33a596dea6899fb90a62edf3b6a3b81c5f0a8411f33251d65f8e836874452419f638a36ecbbf64c5201cbeba34728a5574c9cfec811ed55b8f584b87acc4947c7dea9f068319b031a05515541d518251169e87552ecfdd070fe2bacc7b7560b050740c6b22b3d2cbdfdcc2d5287d68f7e61a22beccce05c58434761a644412e3c958c0ebe4d058cf95a078a244c1415d83bcb2d34bbe4311b2f023483d0c205343801107c29d86851b26d9d430bc098bf3ba67d3806c2d4cd3baa5e0d6741ce2f375bd23f4ed02b1947b3379431e4c7f553fd0f238b5d9b3a607dca8e465b3268ce344778ecda456c2d1030dfd87c093236a75e7099ae08b1d73488c9300b20771fbc31523431c4888830c3496829ef0fc627191c77f1ecccd33d5fc04bce711bb631a14a06b1195f7ebb0160ad5b88380dea8db9a8a280075f10a643d3c1667a13ccdde3c3b36257b655cde9773bf8fe74502a91104e0bbca6dfa6a6603442152adb4c9fcc8c2983b4a855c37fa3d9ac8b9f263b0b0453ec2162968894e37860f63dc8af32fa682a9fcbaca89354fb0292f47831408169ca4e54d7fa08e6b51a31c84a3745d83e368e07cd701376a7dbe71a0432e1198093e6279f3c5856a0ee3ec22a163b4b6ae831110c24602dabeb3e7e3d5d32945fb37745d755c97a492cbbd97666078a006ba49f313b0101ff6817a8175f4f44f76d70ca2512a0be8591a4c8f08f0a83d7eff951791e76dc01cc5a5621532925722a82344ee485fa0f2b91f378adc385084340738747486b3eef9857655d9cc5e18c893129cf60340118a0c4e1fd426d220dd8a0746e8651b01fc64d31ea44e31d6805b54c861069ff3347d24a933b0bdea1db761b10e1e1fa32cd6bea8fc4d9e2126beb2f9a25c1334d36c28be221475665a80d05dda14a4ac4fde4f5da8c98a35daf484668e1db2cd9ac935cb9dc43ab6f1ba396ad023e081ef2a71b273526492c622adf84d62e8baf1cbdcc3f701dc78e50138a1702e7c512806aaee7068793be3f92c740758e5a41773d2c7a62cf8db9cb016a1369ef5284e7e91e224a38952f7de91311fd0636376928144137b7a6b9cb0e0d20e3496dc13821f0f751ef41039a476ee050350b39282c957033543ec9edb9d880d95def5328a11703fb6ebf78c10b01cd927ad3fd13dfd04237d2220e9cba11023b696647cfff358b9b4b2f09425169b469a6c8cfcbf79f662c096ba5a8d90eb4afff79c55a50fec28527d8b1ef2b3656df530db0647ea5f130ee2960cd7d5bccf5ae094127b47c3494a15eb5864e50e9af17b46e81dbd8c99dfee069b36d31cda4eac9a139d7247d07d7f0423ec24a06d1445332fa4f46d7b35eb9fdd4b7fe4f28afdb174e42e8d733d3f9f8e0e6ac1f0a8b48cb404909e1d16ea23379ec4b5aa56080fd35ef7e6d0bcc89dc0e92fb630a1ef9944d321063fa887f23374b593688a4e22d417d5af55ac84b9ce16a4a55779427ac8352383c32bcc78214966bcf0e0c1039a75589c8049317b60fb50fa1fb227aab3c9f072e8dfbca6407f24602df91e2eba53b3f1f972f3f92d8c1dcc1b0c0fb1b00b08e300f732b186acb6fd0906b732315ed5ac89b9e33ede9f7bd84aebf2b1bc8c30eb2479d6b193576728ec20e429607c9cc42b7226ab2a1f73cbbf0f6c6aa0619a1ce91b6bf2755fabcd73b5f277aabb3b61dacbb56f61f0fe34227a41e0183746a6f78d689dbc859e32be8cb77109ee4cf0bb1957125e8f45214106bed01d9ca251a1e9a39a1f5f6c45d59454046b03623968a74cc517bb", 0x1000}], 0x4) r2 = openat(0xffffffffffffff9c, 0x0, 0x320800d, 0x31) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00'}) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, 0x0, 0x0) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, 0x0, 0x0) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f00000000c0)={'8255\x00', [0x140, 0x1f, 0x409, 0x2, 0x10000007, 0x1, 0x7fff, 0x30000002, 0x7, 0xc72d, 0x0, 0x7, 0x3, 0x400008, 0x29, 0x72f0, 0x101, 0x6, 0x6, 0x401, 0x4, 0x484, 0xa2dc, 0x9, 0x1000, 0x80000001, 0xa, 0x0, 0x383, 0x8001, 0x4]}) writev(r4, &(0x7f00000001c0)=[{&(0x7f0000000180)="29e3e5864ceda68155960e4b20eb0403a718", 0x12}, {&(0x7f0000000300)="ac3d900278bc4f67", 0x8}, {&(0x7f0000000640)="79baf7c80af72c6d074d7aa55d18c2b3f92fb55d09041ffa4b66a0ed18f70954cc0a5bc1461a6d07e6d4f31058721987ab90040f06c98df9afdd7c6614915beee9a0bea8187c6315a4be760ebc06c000bbe9a766f3752ff9ed8b304d3378bfd1a88dfc510d611a8c13259173a7c957bdd73f09abefc7302f22bf6795474455a958f56a17d1551e00"/147, 0x93}, {0x0}, {&(0x7f00000004c0)="a407d58cecfb1369d434cee2363e2e667262a9fda651de7eb280ec8ff5087e0036af2fef7939cac0a06e6169aa6caa951a4a9b35e608532fafaa74692296b26bf752bbefeadde445128254deda33cb8622aad1f5aa0ab3ba8a81949805", 0x5d}, {0x0}], 0x6) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r5, @ANYBLOB="0008000007500500580012800b00010062726964676500004800028005001900"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) r7 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r7, 0x29, 0x13, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config\x00', 0x1c7) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) 2m22.981329344s ago: executing program 1 (id=456): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='0', 0x1) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='usbip-vudc.0', 0xc) write(r1, &(0x7f00000004c0)='\n', 0x1) (fail_nth: 3) 2m22.361590658s ago: executing program 1 (id=458): r0 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x9b) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000940)={{0x0, 0x2001, 0xfff9, 0x3}, 'syz0\x00', 0x38}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x12) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) sendfile64(r1, r0, 0x0, 0x1) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 2m21.561769337s ago: executing program 1 (id=461): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = open$dir(&(0x7f0000000140)='./config/usb_gadget/g1/UDC\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000380)='0', 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020732500000000000709007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000730000008500000050000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000000600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$pokeuser(0x6, r2, 0x108, 0x4) r3 = syz_open_dev$audion(&(0x7f0000000300), 0xfffffff7, 0x4000) recvmsg$can_j1939(r3, &(0x7f0000000bc0)={&(0x7f0000000680)=@ethernet, 0x80, &(0x7f0000000b40)=[{&(0x7f0000000700)=""/225, 0xe1}, {&(0x7f0000000800)=""/69, 0x45}, {&(0x7f0000000880)=""/93, 0x5d}, {&(0x7f0000000900)=""/252, 0xfc}, {&(0x7f0000000a00)=""/231, 0xe7}, {&(0x7f0000000b00)=""/26, 0x1a}], 0x6, &(0x7f0000000b80), 0x64}, 0x0) ptrace$pokeuser(0x6, r2, 0x118, 0x1) ptrace$pokeuser(0x6, r2, 0x6, 0x3) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000380)={0xfffffff8, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x22, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1c) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000000480)='usbip-vudc.0', 0xc) faccessat2(r0, &(0x7f0000000180)='./config/usb_gadget/g1/UDC\x00', 0x5, 0x1000) write(r5, &(0x7f00000004c0)='\n', 0x1) symlinkat(&(0x7f0000000000)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000000), 0x1000) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x613402) getuid() ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000240)={{0x1, 0x1, 0x18, r5, {0x0, 0xee01}}, './config\x00'}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) 2m21.320094022s ago: executing program 1 (id=464): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101302, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x4}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0xa000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r2 = getpgid(0x0) syz_init_net_socket$llc(0x1a, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x40, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r6, 0x4068aea3, &(0x7f0000000100)={0xd5, 0x0, 0x800000}) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r7) socket(0x2, 0x80000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0xc41, 0x0, 0x0, 0x1000, 0x7, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r8) 2m21.031467266s ago: executing program 1 (id=467): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sched_setscheduler(0x0, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[], 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r2) socket$key(0xf, 0x3, 0x2) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000840)={r3, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xb5, 0x7, 0x4}, 0x9c) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ehci-pci/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='0000:00:1d.7', 0xc) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/pci/drivers/ehci-pci/bind\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='0000:00:1d.7', 0xc) write(0xffffffffffffffff, &(0x7f0000000080)="240000004e0025000307f4f9002304000a04f55f08000100020100020800038005000000", 0x24) accept4$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, &(0x7f00000001c0)=0x10, 0x80000) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="04010000100007000000000000000000ff02000000000000000000000000000100000000000000000000000000000000ffff0000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00], 0x104}}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x25) 2m20.191000386s ago: executing program 32 (id=467): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sched_setscheduler(0x0, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[], 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r2) socket$key(0xf, 0x3, 0x2) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000840)={r3, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xb5, 0x7, 0x4}, 0x9c) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ehci-pci/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='0000:00:1d.7', 0xc) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/pci/drivers/ehci-pci/bind\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='0000:00:1d.7', 0xc) write(0xffffffffffffffff, &(0x7f0000000080)="240000004e0025000307f4f9002304000a04f55f08000100020100020800038005000000", 0x24) accept4$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, &(0x7f00000001c0)=0x10, 0x80000) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="04010000100007000000000000000000ff02000000000000000000000000000100000000000000000000000000000000ffff0000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00], 0x104}}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x25) 6.172201611s ago: executing program 0 (id=923): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000400)={{{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x2, 0x120, 0x20}, {0xffffffff80000001, 0x1be, 0xff, 0x0, 0x0, 0x4000, 0x0, 0x5}, {0x800, 0x0, 0xfffffffffffffff1}, 0x0, 0x0, 0x1}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x6c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203}}, 0xe4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10) (fail_nth: 2) 6.052338244s ago: executing program 0 (id=924): r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0x9f, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES64=r2], 0x40}}, 0x0) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x5, 0x1000000000, 0x5, 0x7fffffffffffffff, 0x80000000, 0x3, 0x2004d0, 0x0, 0xa19, 0x8, 0x5, 0x0, 0x3, 0x2, 0x5, 0x8000000000], 0x10000}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) ioctl$FICLONERANGE(r5, 0x4020940d, &(0x7f0000000100)={{r6}, 0xa673, 0x0, 0x4}) ppoll(&(0x7f00000000c0)=[{r0, 0x9f712fd3135d63af}], 0x1, 0x0, 0x0, 0x0) 5.81209086s ago: executing program 2 (id=925): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sched_setscheduler(0x0, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[], 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$key(0xf, 0x3, 0x2) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000840)={r2, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xb5, 0x7, 0x4}, 0x9c) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ehci-pci/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='0000:00:1d.7', 0xc) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/pci/drivers/ehci-pci/bind\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='0000:00:1d.7', 0xc) r5 = socket(0x10, 0x3, 0x0) write(r5, &(0x7f0000000080)="240000004e0025000307f4f9002304000a04f55f08000100020100020800038005000000", 0x24) accept4$inet(r5, &(0x7f0000000080)={0x2, 0x0, @dev}, &(0x7f00000001c0)=0x10, 0x80000) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="04010000100007000000000000000000ff02000000000000000000000000000100000000000000000000000000000000ffff0000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00], 0x104}}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x25) 5.504992088s ago: executing program 3 (id=928): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x2, 0x1000, @empty}, 0x1c) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r1, &(0x7f0000000240)={0xa, 0x2, 0x1000, @empty}, 0x1c) dup3(r0, r1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mysys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mysys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, &(0x7f0000000140)) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./mysys/class/i2c-dev/i2c-0/device/new_device\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='typec_fusb302 0x22\n\x00', 0x13) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/class/i2c-dev/i2c-1/device/new_device\x00', 0x1, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) write(r3, &(0x7f0000000240)='typec_fusb302 0x22\n\x00', 0x13) 5.136699495s ago: executing program 3 (id=929): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$NFC_CMD_FW_DOWNLOAD(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000680)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00022cbd7000fcdbdf25150000000500140000000000040014000800140047504c000800140047504c005ec5e918d95f96f2f5ab36dc50fb12ba0cb00dd3894d74abe2b861c0ac3cd4269bb44c4633d823894775c19f0796889bd059f28b2e496350ea9a781ebfe596cbf9606c4c06b8f60e1bd8daa5ac021841d86d505706c43919434952026eb88d9cf3c6d163b7e1bf2569fb433c83034b339d5cce8338d72dcae05d9e234db9e83a40c4ac82bbe4fd49a918211e16655c2f8b46593cdfd45bd563da98803ab6ccaf6ca80505a1f70371db7baaba7686815c3bba5d5ba7239a220a46cf8a3d53648b74c03dfa82f16007fb1959146304b24e517160fe5afdb3ea"], 0x30}, 0x1, 0x0, 0x0, 0x84016}, 0x0) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r0, 0x0, 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000bc0)=@bpf_tracing={0x1a, 0x2d, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1}, {}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @alu={0x4, 0x1, 0x0, 0x4, 0x5, 0xfffffffffffffffc}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x101}}, @ldst={0x0, 0x3, 0xdc65d231dbe5d1ab, 0x8, 0xb, 0xfffffffffffffff4, 0x10}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x2}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000940)='GPL\x00', 0x7, 0xf9, &(0x7f0000000980)=""/249, 0x41100, 0x10, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000a80)={0x1, 0x1}, 0x10, 0x2eef3, 0xffffffffffffffff, 0x0, &(0x7f0000000ac0)=[0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x20, &(0x7f0000000000)={&(0x7f0000000240)=""/187, 0xbb, 0x0, &(0x7f0000000440)=""/204, 0xcc}}, 0x10) io_uring_setup(0xf06, &(0x7f00000003c0)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) init_module(0x0, 0x0, 0x0) get_robust_list(0x0, &(0x7f0000000240)=0x0, &(0x7f0000000280)) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="04010000160001000000000000000000fe8000000000000000000000000000aae000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0200000000000000000000000000000000ddff32000000ffffffff000000020000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000002"], 0x104}, 0x1, 0x0, 0x0, 0x40004}, 0x0) sendmsg$nl_xfrm(r2, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$DRM_IOCTL_GET_MAP(0xffffffffffffffff, 0xc0186404, &(0x7f00000000c0)={&(0x7f0000006000/0x2000)=nil}) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) close(0xffffffffffffffff) 5.131182494s ago: executing program 0 (id=930): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=@newtaction={0x110, 0x30, 0x1, 0x0, 0x0, {}, [{0xfc, 0x1, [@m_skbedit={0xb0, 0x0, 0x0, 0x0, {{0xc}, {0x4c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xffff, 0xa}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xffe0, 0xfff1}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x7}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x8001}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xb, 0xfff2}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xb, 0x9, 0x3, 0x7, 0x7}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x88fc9d66c8570d13}]}, {0x3c, 0x6, "9c0d6928ae300f1c09b2d372c98813697435303fa353a54cc06fa545942aa536b9c113fe9367e59a80f0ed2527aecf82fd0677cbaf23b31c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000180)=0x4, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0xc4c03d12, &(0x7f0000000040)={0x5, 0x4}) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000200)=[@timestamp, @timestamp], 0x2) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x4000, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/11], 0x50) 4.161613916s ago: executing program 3 (id=931): r0 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuset.memory_pressure\x00', 0x275a, 0x0) write$UHID_INPUT(r2, &(0x7f00000007c0)={0x8, {"dc5d3b0169633d3eba3eabbc09167be55101d4af4b22a373236464d2dbfaa84399b77bd438a54364a7ebc5bdaab4f9decb7c044318cd59a0af8279bcab35dd7daf7a0ceb381df2c32eff45b13e2c8f40e1895355bf6f165200cb1ca41a155730ee2e9f83183e9fafe029d0401b0770618254a8b2dc87b630072b1e2de160d1afed51b74c14b71ec1b226a324482d14ad586b1a4ce80e458fe45244c01eddeddf3564af838d6d5324f8a77023d6eb7aa14397a0e1413ea1c3dfdf063a35b709e627f36fe403ee3117365be5017682f53595f28543062c740a94a794312f5cebc315044b8ea000a5d0f27812ab0ce149d11e6f6f7620c5f3e250bf67d13a1ca39dbb7b8b5a31e3d7ba7ebe5849a7a09b61fc9f2cfc54b89e9cd0105bca49483ce55e0187ce2ad692a18219d881057c838587b915337169ee054655f26a04df913a658fccbf4def6aad750ca4796b74d322c67e9d4ee6a530a22dcc35db850b424d6ec9f62495b9f9fd2b000feadd57d26dbd505798c208d91eb0aab0fd97537631b8bf81ce0e2241c4272be4ff69b390e4485d574146b76d1fdbf7fc5334906805534cdae1e47240af7761a18fc8bd0a694be47529da98bc0f98eb7db3fc4a74cbb6e486f4de90fbf2452e72c2e1dca44543ad9ad094b8bc861eef1e814662d0b350339e3a510d459c6f83aabd5fd3dcb38224056d761e7df9b482b9905f1e2135c1929be328ecdb69c007a3efd548502c83106f6df1ab1178fac499eda92ad4373155227ec2df150c919d322ecb3ea37e659285f18a3e2f79b59900ca438df3a1381380a12d3ad7678e0a8d3bdfb40651389b4ac8c66138d442d70eafdc2df8b080028006b124e4ebe0d9883ef100f1934e425a4146056d800975675bb1913142adbc039a9c68c2f146a0e8903447313f5e5549905f397a9b1f21a93b80c4d04a8ea7a29a50fbc5407a9305bba420edf898ea678d6879489c39692c99bb6dacf61f5f97637b94c1031d635b5423d27f7b78fafa060000006eadc21466af5a10281e6a808748969d29efb444c99a4cb2111732a792dbca4376a125a68f7cdac065cc6173dc21caafba48c742d9a7df2f771ff2f5725b22c247d4e0c6106f9f5f6929b69929ab37e9a9b326ce618bb702b883b12026f1300f21f2c7440cac8c5f1210a78aa067211d2827f5dcc7578252c2ccc3f67bab9d1bb6939b21b550788ef550acfed4bf50c0b4fb3ca4d2872ee64f95d611a317d9daaf373a10d868680b2226396c95fa2b0ab4d6fce06c3b42cb97d17a7b5089061537fdeb1a53040869f7befca330358fdba86754fc2e46c2113e1484cb37534af8f0408a7ee313778dab49f08229964298f847ea66c4ec319f64b6a12da585bc59e82e0263c507b397d3efee3b4066f4d25566aa1549f6185f6375f84b65fa8945148b90430c86a5b6fdf58d5c812b98d9dc621fd9a3d9f1a577495356516d1cbcf5e8bb8923b54b247225b9c3892b18a9e137f3620c734052af9dc8f1ea36f0d4592d5ee32e35676a84dc891f97456f2ac3a4ab58a42bcdc221a4ac8bb28d428add2fcbe5b110a8afd5d23b31e827bd16167b2d88cae024afc04a722ac0b4d45c52512e6b6f102aac4be21bc89ce246539048370553665b0a4336a6db99d0d19399be6437bf21419304331b4342b2c1db580f0c9bf681fdb8e9fa3e025454197bbc82ef93ee2f385660818ec5127080675a8013766469afe3b1e36e81bf2f04c3a26eaf4517551e734d21ba3bc90e48aea0891792970c39f3f528397e9b7ae190f1760fe5960dc763ee0a17939c60bfcac0a8914be82c749e4fe85d1ac5fa733413468fb8941085e8c4d6e0b6d1e62e20da58440facd640ddbb6c1f694b3ca48757a34c5a11668368711a1d4f3a81d31ac30d71277d7ae77882b6841cfa6289e6cce84a3ad57eeb328f831888ac7d3cfcd3a472a48d903f20cec8c8ae8d0bea04ebf7413ef7693f8ed876e49bd5f89d7e1078208ff62712e330fc0341b9ccf26845578d44b1e0c66d1bebc14742baedfabb8e9a2c8f42730360c72997efe0ce786ff330c2eb6e0ff20896f813c2a515ce76f87d2a1a1c1588eb369231ddeb4a2f9f9591ecdecc74d20aeb50047beb3ab89a9e4e1b805a20b645c79d0bc5d0247fab8ba46a97a07630b1f1cb69b42b568af746733d2c581f057873d64fe6e659b00b4a26745f5fba1fe7406a86b007936c7cfdac53a4c5b0ea9f6604863c8e3f174eddbb09175f6e13cda9a860cf400ef9ed02b895502ac6e6de6a658249c3c6e8a653517eae2231e56e0f120547923c6549ebc1ed14c623637ce3d96af5c93a32e58e2d9659d8b5b145888b52d9a5b5cb3cdf594eb137bcef2ba068cfd2c6ccf7ab6e5b4ec55e9197bfb91c9b8729f7b50cf0b0326f7ea3e712c77674d48545ca2a86744c3c38f149d69cf811beacf7e5f49c7bfba20f1dcf3d7bc0b9c796016820a46495d244c9606a06fe2e14233eda78d69ae4523ad7b708b0c7ead44d7fd376fed60e3cc2ee25e9600adfbe87ac7c8fb8269aec9459602af0f420becda6120ce7d9626c65ae7f860639e8bf664eb4301ec18add0e436c0356c12ab6b4ca35da2b43c4a8c239fd0b59a2ce94843cdfa1667053165053633b062844dbb0d00070fde74fa3178eb5f1f5fd02e2088d8690379f39ab22c080cdcb29d700bac74fabd8a356fe99afe83a5d99aa5024e9158a299eda6c99b6701e64f1d68e7e2c0c6e88396bb535a02d0948f0a250a6e090041c96d9c9acd6134d44d516fd1010c39e572b86b05bb1326a2a4f23f11181186f9c2a01dc7b58c0129f4b851ca9b1e3dc35db7364e29ef646211796b1651511e041345abce427fa5d6e48b8fb078c8432061a4cc518a8f2a2caf709a5c1473a62112a6650afc64eec12f8f9c08cff1b6fbf7a1209fc8661f62303b7c5d49c1d0b32a9f37e81ed9ab6193816d40995ed49c10b9f5752e04d57535a3d16f06c65d32846c31ec9787ec4a965679eb804e86b45d007f38d8104550770dc6f313bc846e43a14a8c21d0628c744e3e83cb998d1b7acfe996541a8c03852dadf9326444c582b481cae844e4f3fe3d638903b38f24633b63adbad841ac6c4c1169d781a0e271e8a967b1c7e986fcb3a66168e86e3559a44fcfa92452260491da9397659af60453f4cd4be2d15439445ec2b4366a79d3283da912d9d499df1242bd174edc235848caa21d2c997aff0e95c7e5cc0803c90fab84e7be7b37909d0388acb6800baba183ecc8eea8c71c0d65d669e41f99ceae523b7a6b772f3b8ebba1d2127ccc3ddb7ddcb4ec73cbdc26fc87c3848e258a0b5484d3a13e40ec4e4a65dd92f09e9fe1e3e2f8b96c4e363aa3683860dee62dfcf8823ee4a3593a092e0bd9c4cedacf44a272faa164447b01f46a7795642a40c61b0034a37f0e9b792428a0ddcd144fe8263088eaac8016f8f1cd30b55ac90a8f10d785b7570dd9e639a4a068d3fe98a42010e24f69de817f676c2a224300d749571ad43f49d1fbe838f4566bc7b5f104c384ad87189213152b644d9fcbdf98bafeee569d640ce9045779f1d90024c023a7480a358dee276fba139c14b4fdb12885240903d0e61dc161659a68f62c92b899007e0f2b65bf0a069e9e57c9b6ae50a3b30dd1003fb0eead73ae2f6010b3b356b4060579a4f29935e1f00c01d12e5f44e8e3163d81dfef7ca8560604240c7e96e4454c6971614df306c768121abb3f628e3f1d2d026f58d1087334c5bdb74d7c949b0ee66a4531ba4e9b922aee3d0f802ed034734507a5913c52966f1f8bd4577840de0253aabc23299dced2a299859c07af9fb0f9c29b6533b9d84d471390d59ab315f5ddb226f6b8dd7889295f0fb1f7bd1adafe4cc520a1e84bf2a59d5b9795aeafc8d6fd66a8228aba8653b98622617ddfeb5d6795c9bd2f35d4a0c386e862675a50e3314c3fbb17aca151c13c7fc8b1d1b72ed0a958537b5ddc9e74bddc2b9571ec3f2b7775b125338d4852a75a63941564c65bb36dfb6bea4aab1ae7a4f285c2177aa98406eb2cc10934aa92d5a9612d4455c84ad200841d289b5c2d5deab0d8e2459598ef183d3dc46f6bad0b9513710600cfa4d69fcd5763cdcc4f2c2b7cd7d4491fd52f4aec82ce846c0988f6f0123e21e900d39c61085e68c9badc350b44004f6c042d64b0d0cbf91ad0592b198f1eeea1e52200bc8e6d62848d6884b10bdde72466039da488be6b340c23148f666f2fe6e032c07dac43586df182aca9116f4600313fa8375c76337ba86bdc391dae6450218f58f047ced64befc6bb5c2a60024669630a6279fedf2fe45e7e19ce582ad96ae0d023eb9b39f5f1e666e73bb038ae38157275be5eb3e7cbc8b05adf53e817646bdc2cfce98e5d162bf7faaca787db8717ab8b27b9e35609c5fb9fe9def07f010df8b43cf5c96851eadfdeff0b7bc5826e7e15490ae9c3d14166ee81bef007070e7981235a673804ad89943ee6b51ac63364f7870e121e6ff23a0c7d179527cd58dd7a4ca37247c2bd9efc79b720bb1ee2d39862e98cb81e93cf5b48d5d02ee8ac737ab504c867a1c49e678300803c94fbe978dea918a1e71b9791ee1e4d30056e86c26a4670b451a13ece52a89a7057fe2052e11c6666eb916d823ea66bf217c320acba3b714910734b2d27c2fa586bd7f7664b0d1422adabad2ce2afc10270057f11940fac1a51d023ce48bd04ea39b7f99381b239fd0ddeea0dce7863ec1f8f61775013b6414ecf86e686a340a3148f87a9d7d60a1f2da53436d16fc88d6a4e7c3d55e0dd004cbecc15a5558eb705d82aacb1862ddc251dd5d9cbf1d78f97900ce6e8dab0ea678cb823bd1e7bbd1e927878c19f4f322228f9b36287fc13e7c1293ea875ae73815e052d6c2ebc40df8f7b9d1f76e0b10e35aa160944983d8e6b790df0d9b13f3460657336d81f7d83c0350324b930ec9c7557ce12887f76372e126f504b0980fea27f31a780c05187b9b5353dafc6b101543b24332b96e15bc26b19062e52fa9f86d260ee3a3bc92a133e328407bb85357ee5c45cb87228f44888b14941b5911b050e9319fe88033f830a8490917a9c0572ebbc5492b4e1083a2e3d77215a34abef947b5b9a950e780662de18873e55899c92db3ad3d437e8407890afa6b0c04ef861b8bc85fbbe1bb67b3d9ef001409f84b8ec4f01d861cecc143a805b981ab5cf5b605057b63cb2c84ec358e510a69cd8c33a8a62fe4680d0c980145cc709157832bfaef261cb0466c237376ca2944ce9affffd4b1dc7cc9511da0b34bffb9ac216fb8cf7c6572d95627787720d1ba67c6512fcdb16f6329e9668681c404efebad559f81f05971b5efb6b4cca97ad0346753cc0a40a877242d8a808c602b03dc962cee38e646cb18abb079c70d357c30738a70f55cd3c5956a83a1bfcd6649dd765f16bfe968066345df7380bbc0c16b3b5af513d6458c791343952f33a051c5d711c1f35af1b47f3db9bbfb5c7c636b3a2b52805d606479879be0b404a28ade5649a3185e0f85a85fc15cd824671c2befdd0da509597c87d869f0bd7ad163ad93ca28fc0c4025eccaafe385ec3fc06c54ebcd7b07b6c7e0197c5b9ef886159a1585ae45248f865be760db6f5bc8f868fc6aefd04e34ecb51159e4cdcc2214b42b1ca9caec13ba3e1b2e7a3c736977b226213d265c2873195122a9b448088c8b50edd549be41c38ab176807b75e7267f86e400000000000000000000000000000001df00", 0x1000}}, 0x1006) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x61, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4055}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a50000000060a010400000000000000000a0000010900010073797a31000000002400048020000180070001006374000014000280080002400000001208000140000000090900feff72797a3200000000140000001100010000000000000000000200000a7c4a526a3c74ac15ad93c24021808025c302e4d12ee594b7c60ef7f7b412d7225b20aaad1589e8f80a8018fed60e77eaa1c5fb71e56615c5aca00167d8ecaa7a85a2593ca2a29b"], 0x78}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$loop(&(0x7f0000000000), 0x4, 0x80) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000040)=0x1) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001080)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="3f9d02000000fcdbdf251700002208000300", @ANYRES32=r6, @ANYBLOB="4000308014000400f94b54cce6396c3599431c882366da0105000200fd00000020000180050002000100000008000100030000000c0005"], 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "9001001c551265406c7f306003d8a0f4bd0000000300", [0x10, 0x4]}}) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) 4.022411782s ago: executing program 4 (id=932): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0xc50}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xff, 0x0, 0x4, 0x6, 0x7f, 0x20c}, {0xf1c2, 0x3, 0x38, 0xf, 0x84, 0x7, 0x3, 0x50, 0x0, 0x5, 0x4, 0x5, 0x3a}], 0xffffffff}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r5, @ANYBLOB="08002600940900000800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 4.02196668s ago: executing program 3 (id=933): ioctl$VHOST_SET_VRING_ENDIAN(0xffffffffffffffff, 0x4008af13, &(0x7f0000000100)={0x1, 0x200}) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) socket$inet_udp(0x2, 0x2, 0x0) r1 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r4, 0xc018643a, &(0x7f0000000140)={0x4000000}) pread64(r4, 0x0, 0x0, 0x100000000) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(0x0, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020300091800000000000000000000000400030000000000000000000000000000000000000000000000000000000000050006003c0000000a0000000000fffffc0100000000000000000000000000000000000000000000010004"], 0xc0}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000540)=0x1, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) bind$inet6(r7, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback={0xff00000000000000}}, 0x1c) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@bridge_delneigh={0x28, 0x1d, 0x1, 0x70bd25, 0x25dfdbcd, {0x7, 0x0, 0x0, r8, 0x80, 0x2, 0x8}, [@NDA_LLADDR={0xa, 0x2, @link_local}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000800}, 0x24044050) ioctl$sock_ifreq(r2, 0x8990, &(0x7f0000000480)={'dummy0\x00', @ifru_data=&(0x7f0000000440)="d39dbee1f98213b860157c7485cdf319f525b87836d19b04f4aff9e841689326"}) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'tunl0\x00'}) 3.872116422s ago: executing program 4 (id=934): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) mkdir(&(0x7f0000001e00)='./file0\x00', 0x58) mount$9p_tcp(&(0x7f00000024c0), &(0x7f0000002500)='./file0\x00', &(0x7f0000002540), 0x0, &(0x7f0000002580)={'trans=tcp,', {'port', 0x3d, 0x4e22}, 0x2c, {[{@ignoreqv}, {@access_any}, {@version_L}, {@privport}], [{@hash}]}}) recvmsg$can_bcm(r0, &(0x7f0000001640)={&(0x7f0000000340)=@caif=@dbg, 0x80, &(0x7f00000015c0)=[{&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/169, 0xa9}, {&(0x7f0000001480)=""/123, 0x7b}, {&(0x7f0000001500)=""/9, 0x9}, {&(0x7f0000001540)=""/101, 0x65}], 0x5, &(0x7f0000001600)=""/52, 0x34}, 0x2020) r1 = gettid() fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)={0x0, 0x0}) rt_tgsigqueueinfo(r1, r2, 0x1a, &(0x7f0000000240)={0x11, 0x3, 0x3}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x18) write$binfmt_register(r3, &(0x7f00000002c0)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x2, 0x3a, 'sysfs\x00', 0x3a, '', 0x3a, './sys/bus/pci/devices/0000:00:02.0/remove', 0x3a, [0xc3]}, 0x50) write(r3, &(0x7f00000000c0)='1\x00', 0x1) ioctl$SG_BLKTRACESTART(r3, 0x1274, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001680)={&(0x7f00000016c0)={0x28, 0x23, 0x409, 0x70bd25, 0x25dfd3ff, {0x2}, [@typed={0x14, 0x1, 0x0, 0x0, @ipv6=@local}]}, 0x28}, 0x1, 0x0, 0x0, 0x24040811}, 0xd849e02b843f39f9) r5 = syz_open_dev$dri(&(0x7f00000005c0), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r5, 0xc02064a5, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/remove\x00', 0x1, 0x0) prctl$PR_MCE_KILL(0x29, 0x1, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x68346000) write(r6, &(0x7f0000000140)='1\x00', 0x1) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) preadv2(r7, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0xe0000}], 0xc4, 0x3000, 0x0, 0x9) r8 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r8, &(0x7f00000001c0)='1\x00', 0x1) 3.611442796s ago: executing program 2 (id=935): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x0, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0x8}, {}, {0x5, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x62b9, 0x5, 0xfffffff7, 0x5, 0x3, 0xe1cb, 0x5, 0x1, 0x3, 0x0, 0x1, 0x2, 0x6, 0xacd, 0x0, 0x364, 0x1, 0x2, 0xffffff44, 0x3, 0x2, 0x8, 0x3, 0x6, 0xffffffc0, 0xb, 0x688, 0xffff, 0x0, 0x2, 0xfffffeff, 0x0, 0xb, 0x5, 0x0, 0x5, 0xffffadc0, 0x8001, 0xf, 0x1, 0x8d2a00, 0x8, 0xf, 0x4ba, 0x1, 0x80, 0xffff, 0x1, 0x7, 0x0, 0x400, 0xe5, 0x93, 0x2, 0x45a5, 0x8, 0x6, 0x4, 0x0, 0x59, 0x3, 0x80, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x2, 0x3, 0x4, 0x7f, 0x101, 0xde, 0x10, 0x7, 0x6, 0x7f, 0xfff, 0x6, 0x9, 0xf7, 0x5, 0x2, 0x81, 0x0, 0x6, 0x7, 0x1, 0x437, 0x6, 0x3, 0x2, 0x7000000, 0x5, 0x9, 0xecc, 0x6, 0x4, 0x8, 0x400, 0x7a5, 0x9, 0x9, 0x0, 0x9, 0x8, 0x0, 0x3, 0x7ff, 0x5, 0x6, 0x4, 0x7, 0x10, 0x4001d1da, 0x8, 0xbdb, 0x1, 0x8, 0x8001, 0xe3c8, 0xffffffff, 0xd, 0x6, 0x4, 0x9, 0x7fffffff, 0x3, 0xb8b4, 0x723, 0x15, 0x9367, 0x81, 0x400000, 0x9, 0x6, 0x75, 0x1ff, 0xc695, 0x4, 0xf, 0x7, 0x3, 0x0, 0x3ff, 0x8000, 0xff, 0x4, 0x0, 0x6496, 0x7f, 0x3, 0x0, 0xf528, 0x6, 0x80000000, 0x6, 0x157b, 0x7, 0x40, 0x1, 0x10001, 0x3, 0x9, 0x2, 0x98de, 0x2450, 0x86d, 0x2, 0x7, 0x7, 0xfffffffa, 0x800, 0xfffffffb, 0x4, 0xb6, 0x5, 0x7fff, 0x9f4c, 0x1, 0x8, 0xe, 0x11d, 0x7fff, 0xf, 0x8, 0x3, 0xa, 0x9, 0x9, 0x2, 0x4, 0x2, 0x8, 0x5, 0x5, 0x401, 0x9, 0x4b8, 0xa78, 0xec8, 0x1, 0xfffffffa, 0x80020000, 0x0, 0x0, 0x7f, 0x8c1, 0x5, 0xfffffffa, 0x6, 0x175b, 0x7fffffff, 0x4, 0x4, 0xffff8001, 0x8001, 0xffff, 0x5, 0x0, 0x401, 0x5, 0x10, 0x7fff, 0xffffff00, 0x3, 0x8, 0x9268, 0x80000000, 0x2, 0x7, 0x0, 0x3, 0x4, 0xced, 0x5, 0xa524, 0x7, 0x81f, 0x3, 0x10, 0x80, 0x1ff, 0x1109, 0x9, 0x1, 0x0, 0x2, 0x0, 0x8, 0x3, 0x3, 0x6, 0x4]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, 0x0, {0xffff}, {}, {0x2, 0xc}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x1c, 0x2, [@TCA_CBS_PARMS={0x18, 0x1, {0x81, '\x00', 0xfffff000, 0x31, 0x3, 0x581}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40098}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r10 = epoll_create1(0x0) waitid(0x0, 0x0, 0x0, 0xe, 0x0) r11 = syz_pidfd_open(r9, 0x0) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r11, &(0x7f0000000100)={0x2002}) r12 = socket$unix(0x1, 0x1, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=ANY=[@ANYBLOB="2400000047000701feffffffffffffff04000000080001"], 0x24}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r14 = syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042) writev(r14, &(0x7f0000000000)=[{&(0x7f0000000640)="f3", 0xf000}], 0x1) sendto$packet(r14, &(0x7f00000008c0)="4ca49039fc2de224c044b5c370176e88c40a6653d14023fa2cc2effafad26bc4a07e8c80e7baec845c23542106f09be44b03cbb09cc6ba237ad64f6aca325f7b1a4ae582b16324fcd81ace15ffbe75243530dec607fb67343d6ac0ffa1829318f10d2ebe113e09f8430bb654b492d1efce03910a016af83c500cbf36c0d09156dbeb22cc67f4ee0f58780b5e049fb55d52d5829d948043782a843963d8ff23fed0fab5f10118d4371647a758eaf62a8b84ca29de6cdf6af2793e950660b6d43ae10e8fbf4827bfae056f6f9725f2a6", 0xcf, 0xc0, 0x0, 0x0) sendmsg$NL80211_CMD_DEL_MPATH(r13, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x50, 0x0, 0x300, 0x70bd29, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x50}, 0x1, 0x0, 0x0, 0x48004}, 0x20000044) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfc, {0x0, 0x0, 0x0, r15, {0x2}, {0x0, 0xfff1}, {0x4, 0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0xdb, 0x7ff, 0x2, 0x9, 0x6, 0x2, 0xfffffffb, 0xc00000}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40098}, 0x4000000) 3.561072774s ago: executing program 0 (id=936): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0xc50}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xff, 0x0, 0x4, 0x6, 0x7f, 0x20c}, {0xf1c2, 0x3, 0x38, 0xf, 0x84, 0x7, 0x3, 0x50, 0x0, 0x5, 0x4, 0x5, 0x3a}], 0xffffffff}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r5, @ANYBLOB="08002600940900000800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 3.228690302s ago: executing program 0 (id=937): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[], 0x48) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e045f2d20"], 0x7) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000100), 0xffffffffffffffff) r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f00000003c0)={0x0, {0x2, 0x4e24, @broadcast}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x10}}, {0x2, 0x4e24, @broadcast}, 0x1, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x1, 0x8}) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8841}, 0x4008041) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = dup(0xffffffffffffffff) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000480)=@HCI_SCODATA_PKT={0x3, {0xc9, 0x8b}, "d7d54fdb46f5ac3753ee9cddb568665fbd34c395ffa0d5a93e3ba26f4b8d24096441343208caf4893a2755ba68570af320d8ad961badbbb3ecb18c01a5eed1637ba265e99a61f18388a96978f91f6fda9ec721875c8932cc6cca5760b1bc588fe7c7dc37fedc26e2ced1ccf8187c69677819945f0284314cbbd182243357005cb1de30ad901918f33a473e"}, 0x8f) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000080)={{0xa, 0x4e22, 0xffff26c0, @loopback, 0x28}, {0xa, 0x4e22, 0x5, @mcast1}, 0x0, {[0x8, 0x8, 0x101, 0x8, 0x1, 0x200, 0x8, 0x6]}}, 0x5c) r3 = socket$inet_sctp(0x2, 0x1, 0x84) syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x1a}, @l2cap_cid_signaling={{0x16}, [@l2cap_conn_req={{0x2, 0x36, 0x4}, {0xd, 0x2}}, @l2cap_disconn_rsp={{0x7, 0x81, 0x4}, {0x1, 0x3}}, @l2cap_cmd_rej_unk={{0x1, 0x6, 0x2}, {0xc66}}]}}, 0x1f) sendto$inet(r3, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r3, 0xda90) accept4(r3, 0x0, 0x0, 0x0) fsopen(&(0x7f0000000040)='f2fs\x00', 0x1) openat$cgroup_root(0xffffff9c, &(0x7f0000000340)='./cgroup/syz0\x00', 0x200002, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000100)='test_dum\ry_encpyp+\x84E\xdc', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\r\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8c{\x9e\x85\xdbO\xb3\xa2\xfev\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Q', 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f0000000000)=@req3={0x1, 0x8, 0x7, 0x4, 0xf8b, 0x1, 0x80}, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7c2}, 0x94) 3.082129029s ago: executing program 3 (id=938): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/mdstat\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r0, 0x2008}], 0x1, 0x283) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000016c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002bbd7000ffdbdf251400000008000300", @ANYRES32=r4, @ANYBLOB="060036002cc16c1c050029000a"], 0x2c}, 0x1, 0x0, 0x0, 0x44051}, 0x24000004) 2.869101408s ago: executing program 2 (id=939): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$NFC_CMD_FW_DOWNLOAD(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000680)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00022cbd7000fcdbdf25150000000500140000000000040014000800140047504c000800140047504c005ec5e918d95f96f2f5ab36dc50fb12ba0cb00dd3894d74abe2b861c0ac3cd4269bb44c4633d823894775c19f0796889bd059f28b2e496350ea9a781ebfe596cbf9606c4c06b8f60e1bd8daa5ac021841d86d505706c43919434952026eb88d9cf3c6d163b7e1bf2569fb433c83034b339d5cce8338d72dcae05d9e234db9e83a40c4ac82bbe4fd49a918211e16655c2f8b46593cdfd45bd563da98803ab6ccaf6ca80505a1f70371db7baaba7686815c3bba5d5ba7239a220a46cf8a3d53648b74c03dfa82f16007fb1959146304b24e517160fe5afdb3ea"], 0x30}, 0x1, 0x0, 0x0, 0x84016}, 0x0) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r0, 0x0, 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000bc0)=@bpf_tracing={0x1a, 0x2d, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1}, {}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @alu={0x4, 0x1, 0x0, 0x4, 0x5, 0xfffffffffffffffc}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x101}}, @ldst={0x0, 0x3, 0xdc65d231dbe5d1ab, 0x8, 0xb, 0xfffffffffffffff4, 0x10}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x2}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000940)='GPL\x00', 0x7, 0xf9, &(0x7f0000000980)=""/249, 0x41100, 0x10, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000a80)={0x1, 0x1}, 0x10, 0x2eef3, 0xffffffffffffffff, 0x0, &(0x7f0000000ac0)=[0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x20, &(0x7f0000000000)={&(0x7f0000000240)=""/187, 0xbb, 0x0, &(0x7f0000000440)=""/204, 0xcc}}, 0x10) io_uring_setup(0xf06, &(0x7f00000003c0)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) init_module(0x0, 0x0, 0x0) get_robust_list(0x0, &(0x7f0000000240)=0x0, &(0x7f0000000280)) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="04010000160001000000000000000000fe8000000000000000000000000000aae000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0200000000000000000000000000000000ddff32000000ffffffff000000020000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000002"], 0x104}, 0x1, 0x0, 0x0, 0x40004}, 0x0) sendmsg$nl_xfrm(r2, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$DRM_IOCTL_GET_MAP(0xffffffffffffffff, 0xc0186404, &(0x7f00000000c0)={&(0x7f0000006000/0x2000)=nil}) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) close(0xffffffffffffffff) 2.351927203s ago: executing program 3 (id=940): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=@newtaction={0x110, 0x30, 0x1, 0x0, 0x0, {}, [{0xfc, 0x1, [@m_skbedit={0xb0, 0x0, 0x0, 0x0, {{0xc}, {0x4c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xffff, 0xa}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x9}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x7}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x8001}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xb, 0xfff2}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xb, 0x9, 0x3, 0x7, 0x7}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x88fc9d66c8570d13}]}, {0x3c, 0x6, "9c0d6928ae300f1c09b2d372c98813697435303fa353a54cc06fa545942aa536b9c113fe9367e59a80f0ed2527aecf82fd0677cbaf23b31c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000180)=0x4, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0xc4c03d12, &(0x7f0000000040)={0x5, 0x4}) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000200)=[@timestamp, @timestamp], 0x2) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x4000, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/11], 0x50) 1.936826685s ago: executing program 2 (id=941): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x103201, 0x0) write$P9_RSTATu(r1, &(0x7f0000000080)={0x265, 0x2, 0xafd, {{0x54f, 0x124, 0x28, 0x1f00, {}, 0x0, 0x0, 0xc, 0x401, 0xffffffffffffff7d, '\nnodev{evo\x03\xd3\x8b\x92\x00'/27, 0x28, 'pg>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18x\x99\xa9\x16c\x88\x14\xe5p\x81\x03\xb4\x94\xe1\x00\x00\x00\x00\x00\x00\x00\x00', 0x2, '\b\x00', 0xac, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4@\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xe2\x89\xdad\x9a7\x009\x86Ac\x1dD\xf4\xa3\x9b\x11\x91\x93z(\x0e\x8d\x88\x9f\xc2 \xd1\x15\xac\x8e/\x18K\x9aau\x8d&w*\xb0\xf2\x04M\x8e\xf0&=\xdd\x97\xd3\xc4\'\xb3\xa52\xef\xab\x1d\x1c\xe3,\xa7\xc1\xfc#\x1a\xf4\x84\b\xe0+%P(\xb7\xc9\xbb\x859oM\x8a\xf0\xeb\x95\xfc\x0e\xcc\x99\xf7\x80\xe2'}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0xfd85) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0x401, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_RESEND_IGMP={0x8, 0xf, 0xb}]}}}]}, 0x3c}}, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000400)={{{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x2, 0x120, 0x20}, {0xffffffff80000001, 0x1be, 0xff, 0x0, 0x0, 0x4000, 0x3f8000000000000, 0x5}, {0x800, 0x0, 0xfffffffffffffff1}, 0x0, 0x0, 0x1}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x6c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203}}, 0xe4) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10) 1.897746202s ago: executing program 4 (id=942): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0xc50}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xff, 0x0, 0x4, 0x6, 0x7f, 0x20c}, {0xf1c2, 0x3, 0x38, 0xf, 0x84, 0x7, 0x3, 0x50, 0x0, 0x5, 0x4, 0x5, 0x3a}], 0xffffffff}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x4, 0x7fff, 0x3, 0x400000000], 0x80a0000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r5, @ANYBLOB="08002600940900000800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 1.692143659s ago: executing program 2 (id=943): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sched_setscheduler(0x0, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[], 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$key(0xf, 0x3, 0x2) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000840)={r2, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xb5, 0x7, 0x4}, 0x9c) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ehci-pci/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='0000:00:1d.7', 0xc) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/pci/drivers/ehci-pci/bind\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='0000:00:1d.7', 0xc) r5 = socket(0x10, 0x3, 0x0) write(r5, &(0x7f0000000080)="240000004e0025000307f4f9002304000a04f55f08000100020100020800038005000000", 0x24) accept4$inet(r5, &(0x7f0000000080)={0x2, 0x0, @dev}, &(0x7f00000001c0)=0x10, 0x80000) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="04010000100007000000000000000000ff02000000000000000000000000000100000000000000000000000000000000ffff0000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00], 0x104}}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x25) 1.575874264s ago: executing program 4 (id=944): openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x80, 0x0) mount$tmpfs(0x0, &(0x7f0000000300)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x86022, &(0x7f0000000180)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000002000100fffe0900010073797a300000000040000000030a01020000000000000000010000000900030073797a310000000014000480080002400000000008000140000000040900010073797a300000000064000000060a010400000000000000000100000008000b40000000000900010073797a30000000003c00048010000180080001006c6f6700040002802800018008000100666962001c000280080001400000001108000340000000050800"], 0xec}}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) mount(0x0, 0x0, 0x0, 0x44021, 0x0) madvise(&(0x7f00002d9000/0x2000)=nil, 0x2000, 0x70) r1 = openat$null(0xffffff9c, &(0x7f0000000140), 0x101201, 0x0) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000340)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}) set_mempolicy(0x0, &(0x7f0000000040)=0xfffffffffffffbff, 0x5) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES16], 0x48) set_mempolicy(0x8000, &(0x7f0000000100)=0x9, 0x1) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x41, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x44) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f000000bbc0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000001180)="dd", 0x1}], 0x1, &(0x7f00000003c0)=[@rights={{0x10, 0x1, 0x1, [r3]}}], 0x10, 0x20000041}}], 0x1, 0xc004) recvmmsg(r4, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}}], 0x700, 0x2, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f0000000500)={'nat\x00', 0x0, 0x4, 0x0, [0x0, 0x7, 0x2, 0x0, 0x6, 0x5], 0x0, &(0x7f00000002c0), 0x0}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) ptrace(0x4206, 0x0) 542.037809ms ago: executing program 4 (id=945): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b0000000700000023000100090000"], 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x1c, 0x21, 0x9, 0x2, 0x25dfdbff, {0x3}, [@typed={0x8, 0x8, 0x0, 0x0, @fd=r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4008814) connect$unix(0xffffffffffffffff, 0x0, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x200) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x2c}) openat$sequencer(0xffffff9c, &(0x7f0000000040), 0x460400, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000240)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000, 0x1}) socket$nl_generic(0x10, 0x3, 0x10) write(0xffffffffffffffff, &(0x7f0000000180), 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$OCFS2_IOC_INFO(0xffffffffffffffff, 0x80106f05, &(0x7f000000c140)={0x0}) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001d40)=ANY=[], 0x1858}, 0x1, 0x0, 0x0, 0x200408d1}, 0x4008094) 71.915268ms ago: executing program 4 (id=946): ioctl$VHOST_SET_VRING_ENDIAN(0xffffffffffffffff, 0x4008af13, &(0x7f0000000100)={0x1, 0x200}) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) socket$inet_udp(0x2, 0x2, 0x0) r1 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r4, 0xc018643a, &(0x7f0000000140)={0x4000000}) pread64(r4, 0x0, 0x0, 0x100000000) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(0x0, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020300091800000000000000000000000400030000000000000000000000000000000000000000000000000000000000050006003c0000000a0000000000fffffc0100000000000000000000000000000000000000000000010004"], 0xc0}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000540)=0x1, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) bind$inet6(r7, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback={0xff00000000000000}}, 0x1c) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@bridge_delneigh={0x28, 0x1d, 0x1, 0x70bd25, 0x25dfdbcd, {0x7, 0x0, 0x0, r8, 0x80, 0x2, 0x8}, [@NDA_LLADDR={0xa, 0x2, @link_local}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000800}, 0x24044050) ioctl$sock_ifreq(r2, 0x8990, &(0x7f0000000480)={'dummy0\x00', @ifru_data=&(0x7f0000000440)="d39dbee1f98213b860157c7485cdf319f525b87836d19b04f4aff9e841689326"}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=@newqdisc={0x148, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0x16}}, [@qdisc_kind_options=@q_red={{0x8}, {0x11c, 0x2, [@TCA_RED_STAB={0x104, 0x2, "09000020000000008f29d158039b90627d7b60f0d5ca47f33eed46409b7c8722ce020df6b24c2e6ac7b97dc04d01be2092874115214b1ebb764511f69cd1e9f6263346363d2c639c76000067af25166c2f0f85f36aa8867406119c010400002e31dea98204000000d560eae59ea49ef95d73202a6e3b5e1eb38244e694e7410d33bc92794ad27031f2a19698b5142ddf36e2a876a4fc871207bf12a84f1d4d132f5bb7edcf2d08d677e6a7268e106b6ced3c7f53df24092ddb9e0fac6a1153c3fc88bfd1404fef22cf3e825a6e19c6a48a5444eabb459ac3ec9a278df4011773d2f2e6529ed0ad424b47ec67522477f979360b76d1008000"}, @TCA_RED_PARMS={0x14, 0x1, {0x3f26, 0xbe, 0x81, 0xc, 0xb, 0x54, 0x5}}]}}]}, 0x148}}, 0x2004809c) 71.045306ms ago: executing program 2 (id=947): socket$nl_rdma(0x10, 0x3, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x14, 0x30, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) setgroups(0x0, 0x0) socket$inet6(0xa, 0x80002, 0x88) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000007fc0)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000100)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000040), 0x55af) inotify_init1(0x800) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r4, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) openat2$dir(0xffffff9c, &(0x7f0000000300)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000300), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000080)='ubifs\x00', 0x0, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x1) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x7a, &(0x7f0000000080), &(0x7f0000000000)=0x8) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0) 0s ago: executing program 0 (id=948): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r8, r7, &(0x7f0000000280)={0x0, 0xf5b8, 0x10, 0x1, 0x215, 0x0, r1}, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe4b8, 0x2, 0x3, 0xf}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2b4f, 0x4000, 0x0, 0x344}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6f38, 0x1, 0x3, 0x221, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa5df, 0x801, 0x2, 0x2bd, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0xc, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xfff9}, 0x0, r6, '\x00', {0x1, 0x362, 0x0, 0x0}}, &(0x7f0000001e40)) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/strings/0x409/s1\x00', 0x1ff) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r10) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x2}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20) sendmsg$nl_route_sched(r11, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r12, {0x0, 0xe}, {0xfff7, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x5, 0x8, 0x9, 0x3ff, 0xa0dd}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r13 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r13, 0x0, 0x0, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r12, 0x1, 0xd8, 0x6, @remote}, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0x85) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000080)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/mass_storage.usb0\x00') r14 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r14, 0x8916, &(0x7f0000000340)={@dev={0xfe, 0x80, '\x00', 0x26}, 0x7c, r12}) write(r14, &(0x7f0000000d00)='dummy_udc.0', 0xb) kernel console output (not intermixed with test programs): 64] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 244.005444][ T8464] usb usb1: SerialNumber: 0000:00:1d.7 [ 244.017624][ T8464] hub 1-0:1.0: USB hub found [ 244.020744][ T8464] hub 1-0:1.0: 6 ports detected [ 244.063587][ T8464] hub 2-0:1.0: USB hub found [ 244.070987][ T8464] hub 2-0:1.0: 2 ports detected [ 244.113806][ T8464] hub 3-0:1.0: USB hub found [ 244.117300][ T8464] hub 3-0:1.0: 2 ports detected [ 244.162173][ T8464] hub 4-0:1.0: USB hub found [ 244.167997][ T8464] hub 4-0:1.0: 2 ports detected [ 244.185991][ T8468] ehci-pci 0000:00:1d.7: remove, state 1 [ 244.196099][ T8468] usb usb1: USB disconnect, device number 1 [ 244.238857][ T9] usb usb1-port1: attempt power cycle [ 244.276277][ T5741] Bluetooth: hci3: Malformed MSFT vendor event: 0x02 [ 244.338623][ T8468] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 244.512284][ T8496] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 244.525298][ T8496] FAULT_INJECTION: forcing a failure. [ 244.525298][ T8496] name failslab, interval 1, probability 0, space 0, times 0 [ 244.531805][ T8496] CPU: 2 UID: 0 PID: 8496 Comm: syz.0.602 Not tainted syzkaller #0 PREEMPT(full) [ 244.531828][ T8496] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 244.531838][ T8496] Call Trace: [ 244.531844][ T8496] [ 244.531851][ T8496] dump_stack_lvl+0x100/0x190 [ 244.531877][ T8496] should_fail_ex.cold+0x5/0xa [ 244.531898][ T8496] should_failslab+0xc2/0x120 [ 244.531921][ T8496] kmem_cache_alloc_noprof+0x91/0x6a0 [ 244.531945][ T8496] ? do_getname+0x35/0x390 [ 244.531972][ T8496] do_getname+0x35/0x390 [ 244.531995][ T8496] __ia32_sys_symlinkat+0x8a/0xe0 [ 244.532019][ T8496] __do_fast_syscall_32+0xe7/0x970 [ 244.532040][ T8496] ? lockdep_hardirqs_on+0x78/0x100 [ 244.532061][ T8496] do_fast_syscall_32+0x32/0x70 [ 244.532084][ T8496] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 244.532105][ T8496] RIP: 0023:0xf70befec [ 244.532124][ T8496] Code: Unable to access opcode bytes at 0xf70befc2. [ 244.532132][ T8496] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000130 [ 244.532150][ T8496] RAX: ffffffffffffffda RBX: 0000000080001200 RCX: 00000000ffffff9c [ 244.532161][ T8496] RDX: 0000000080001300 RSI: 0000000000000000 RDI: 0000000000000000 [ 244.532170][ T8496] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 244.532180][ T8496] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 244.532190][ T8496] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 244.532214][ T8496] [ 244.595965][ T6151] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 244.618622][ T55] usb 2-1: new full-speed USB device number 42 using uhci_hcd [ 244.749934][ T6151] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 244.753489][ T6151] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 244.756843][ T6151] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 244.759936][ T6151] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.769245][ T8494] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 244.781098][ T6151] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 244.792273][ T8503] netlink: 'syz.4.604': attribute type 3 has an invalid length. [ 244.800556][ T55] usb 2-1: not running at top speed; connect to a high speed hub [ 244.816510][ T8503] netlink: 24 bytes leftover after parsing attributes in process `syz.4.604'. [ 244.830908][ T55] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 244.833983][ T55] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 244.836705][ T55] usb 2-1: Product: QEMU USB Tablet [ 244.841623][ T55] usb 2-1: Manufacturer: QEMU [ 244.846675][ T55] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 244.924908][ T55] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.003F/input/input78 [ 245.013504][ T55] hid-generic 0003:0627:0001.003F: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 245.030843][ T8507] netlink: 'syz.3.605': attribute type 3 has an invalid length. [ 245.034487][ T8501] usb 2-1: USB disconnect, device number 42 [ 245.045812][ T8507] netlink: 24 bytes leftover after parsing attributes in process `syz.3.605'. [ 245.438660][ T8501] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 245.525343][ T8501] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 245.534683][ T8501] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 245.558830][ T8501] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 245.580375][ T8501] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 245.583396][ T8501] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 245.585998][ T8501] usb usb1: Product: EHCI Host Controller [ 245.587768][ T8501] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 245.589974][ T8501] usb usb1: SerialNumber: 0000:00:1d.7 [ 245.775865][ T8501] hub 1-0:1.0: USB hub found [ 245.780739][ T8501] hub 1-0:1.0: 6 ports detected [ 245.884282][ T8501] hub 2-0:1.0: USB hub found [ 245.887522][ T8501] hub 2-0:1.0: 2 ports detected [ 245.971753][ T8501] hub 3-0:1.0: USB hub found [ 245.977103][ T8501] hub 3-0:1.0: 2 ports detected [ 245.977328][ T8510] fido_id[8510]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 246.080605][ T8501] hub 4-0:1.0: USB hub found [ 246.083992][ T8501] hub 4-0:1.0: 2 ports detected [ 246.197916][ T8506] ehci-pci 0000:00:1d.7: remove, state 1 [ 246.199810][ T8506] usb usb1: USB disconnect, device number 1 [ 246.218841][ T5992] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 246.222036][ T5992] usb usb1-port1: attempt power cycle [ 246.344923][ T8506] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 246.870547][ T5992] usb 2-1: new full-speed USB device number 43 using uhci_hcd [ 247.285283][ T5992] usb 2-1: not running at top speed; connect to a high speed hub [ 247.322052][ T5992] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 247.330891][ T5992] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 247.336105][ T5992] usb 2-1: Product: QEMU USB Tablet [ 247.338103][ T5992] usb 2-1: Manufacturer: QEMU [ 247.342783][ T5992] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 247.441488][ T3980] usb 7-1: USB disconnect, device number 4 [ 247.745391][ T5992] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0040/input/input79 [ 247.837017][ T5992] hid-generic 0003:0627:0001.0040: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 247.938140][ T8536] net_ratelimit: 28 callbacks suppressed [ 247.938152][ T8536] netlink: zone id is out of range [ 247.943590][ T8536] netlink: zone id is out of range [ 247.946021][ T8536] netlink: zone id is out of range [ 247.951744][ T8536] netlink: zone id is out of range [ 247.955722][ T8536] netlink: zone id is out of range [ 247.959328][ T8536] netlink: zone id is out of range [ 247.961267][ T8536] netlink: zone id is out of range [ 247.966177][ T8536] netlink: zone id is out of range [ 247.974359][ T8536] netlink: zone id is out of range [ 247.978898][ T8536] netlink: zone id is out of range [ 248.308231][ T8540] netlink: 16 bytes leftover after parsing attributes in process `syz.3.613'. [ 249.823116][ T8564] netlink: 8 bytes leftover after parsing attributes in process `syz.4.620'. [ 249.832358][ T8564] gtp0: entered allmulticast mode [ 250.190031][ T8570] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 250.192758][ T8570] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 250.262285][ T8570] vhci_hcd vhci_hcd.0: Device attached [ 250.482565][ T8582] se_dev->se_dev_ptr already set for storage object [ 250.522923][ T8571] vhci_hcd: connection closed [ 250.524304][ T5849] vhci_hcd vhci_hcd.0: stop threads [ 250.541833][ T5849] vhci_hcd vhci_hcd.0: release socket [ 250.546477][ T5849] vhci_hcd vhci_hcd.0: disconnect device [ 250.578520][ T3980] usb 38-1: enqueue for inactive port 0 [ 250.597307][ T8585] random: crng reseeded on system resumption [ 250.669033][ T5741] Bluetooth: hci2: link tx timeout [ 250.672200][ T5741] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 251.284223][ T64] Bluetooth: hci3: unexpected event for opcode 0x202d [ 251.292409][ T64] Bluetooth: hci3: SCO packet for unknown connection handle 201 [ 251.345162][ T64] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 251.467183][ T8600] FAULT_INJECTION: forcing a failure. [ 251.467183][ T8600] name failslab, interval 1, probability 0, space 0, times 0 [ 251.474850][ T8600] CPU: 3 UID: 0 PID: 8600 Comm: syz.3.629 Not tainted syzkaller #0 PREEMPT(full) [ 251.474873][ T8600] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 251.474884][ T8600] Call Trace: [ 251.474889][ T8600] [ 251.474896][ T8600] dump_stack_lvl+0x100/0x190 [ 251.474938][ T8600] should_fail_ex.cold+0x5/0xa [ 251.474959][ T8600] should_failslab+0xc2/0x120 [ 251.474984][ T8600] __kmalloc_noprof+0xfc/0x820 [ 251.475005][ T8600] ? __pfx_dynamic_dname+0x10/0x10 [ 251.475030][ T8600] ? tomoyo_encode2+0xfb/0x3c0 [ 251.475060][ T8600] tomoyo_encode2+0xfb/0x3c0 [ 251.475087][ T8600] tomoyo_encode+0x29/0x50 [ 251.475110][ T8600] tomoyo_realpath_from_path+0x18c/0x690 [ 251.475141][ T8600] tomoyo_path_number_perm+0x23c/0x580 [ 251.475165][ T8600] ? tomoyo_path_number_perm+0x22e/0x580 [ 251.475189][ T8600] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 251.475211][ T8600] ? get_pid_task+0x106/0x250 [ 251.475257][ T8600] ? find_held_lock+0x2b/0x80 [ 251.475277][ T8600] ? __fget_files+0x215/0x3d0 [ 251.475292][ T8600] ? hook_file_ioctl_common+0x140/0x440 [ 251.475313][ T8600] ? __fget_files+0x215/0x3d0 [ 251.475332][ T8600] ? __fget_files+0x21f/0x3d0 [ 251.475352][ T8600] security_file_ioctl_compat+0xd3/0x230 [ 251.475375][ T8600] __ia32_compat_sys_ioctl+0xc2/0x360 [ 251.475404][ T8600] __do_fast_syscall_32+0xe7/0x970 [ 251.475425][ T8600] ? lockdep_hardirqs_on+0x78/0x100 [ 251.475447][ T8600] do_fast_syscall_32+0x32/0x70 [ 251.475468][ T8600] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 251.475489][ T8600] RIP: 0023:0xf7f46fec [ 251.475508][ T8600] Code: Unable to access opcode bytes at 0xf7f46fc2. [ 251.475515][ T8600] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 251.475534][ T8600] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000004068aea3 [ 251.475545][ T8600] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 251.475557][ T8600] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 251.475566][ T8600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 251.475576][ T8600] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 251.475599][ T8600] [ 251.475738][ T8600] ERROR: Out of memory at tomoyo_realpath_from_path. [ 251.522147][ T3980] usb usb38-port1: attempt power cycle [ 252.126116][ T8610] netlink: 'syz.3.632': attribute type 49 has an invalid length. [ 252.229865][ T8610] ip6gretap0: entered promiscuous mode [ 252.231766][ T8610] ip6gretap0: entered allmulticast mode [ 252.239271][ T8616] FAULT_INJECTION: forcing a failure. [ 252.239271][ T8616] name failslab, interval 1, probability 0, space 0, times 0 [ 252.243685][ T8616] CPU: 0 UID: 0 PID: 8616 Comm: syz.2.634 Not tainted syzkaller #0 PREEMPT(full) [ 252.243700][ T8616] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 252.243706][ T8616] Call Trace: [ 252.243710][ T8616] [ 252.243714][ T8616] dump_stack_lvl+0x100/0x190 [ 252.243731][ T8616] should_fail_ex.cold+0x5/0xa [ 252.243743][ T8616] should_failslab+0xc2/0x120 [ 252.243759][ T8616] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 252.243774][ T8616] ? __alloc_skb+0x5b7/0x710 [ 252.243787][ T8616] ? __alloc_skb+0x140/0x710 [ 252.243802][ T8616] __alloc_skb+0x140/0x710 [ 252.243815][ T8616] ? __alloc_skb+0x5b7/0x710 [ 252.243830][ T8616] ? __pfx___alloc_skb+0x10/0x10 [ 252.243862][ T8616] netlink_alloc_large_skb+0x69/0x150 [ 252.243876][ T8616] netlink_sendmsg+0x680/0xda0 [ 252.243890][ T8616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 252.243903][ T8616] ? apparmor_socket_sendmsg+0x15b/0x270 [ 252.243918][ T8616] ____sys_sendmsg+0xa4d/0xbe0 [ 252.243928][ T8616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 252.243940][ T8616] ? __pfx_____sys_sendmsg+0x10/0x10 [ 252.243956][ T8616] ___sys_sendmsg+0x190/0x1e0 [ 252.243968][ T8616] ? __pfx____sys_sendmsg+0x10/0x10 [ 252.243986][ T8616] ? find_held_lock+0x2b/0x80 [ 252.244008][ T8616] __sys_sendmsg+0x160/0x210 [ 252.244024][ T8616] ? __pfx___sys_sendmsg+0x10/0x10 [ 252.244042][ T8616] ? __pfx_ksys_write+0x10/0x10 [ 252.244055][ T8616] __do_fast_syscall_32+0xe7/0x970 [ 252.244069][ T8616] ? lockdep_hardirqs_on+0x78/0x100 [ 252.244083][ T8616] do_fast_syscall_32+0x32/0x70 [ 252.244097][ T8616] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 252.244111][ T8616] RIP: 0023:0xf703efec [ 252.244124][ T8616] Code: Unable to access opcode bytes at 0xf703efc2. [ 252.244129][ T8616] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 252.244139][ T8616] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000540 [ 252.244147][ T8616] RDX: 0000000000008084 RSI: 0000000000000000 RDI: 0000000000000000 [ 252.244153][ T8616] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 252.244159][ T8616] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 252.244165][ T8616] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 252.244178][ T8616] [ 252.555865][ T8629] netlink: 'syz.2.635': attribute type 3 has an invalid length. [ 252.574803][ T8629] netlink: 24 bytes leftover after parsing attributes in process `syz.2.635'. [ 252.646149][ T8625] usb 2-1: USB disconnect, device number 43 [ 252.679115][ T3980] usb usb38-port1: unable to enumerate USB device [ 252.689027][ T64] Bluetooth: hci2: command 0x0406 tx timeout [ 252.767291][ T5741] Bluetooth: hci1: unexpected event for opcode 0x202d [ 252.771839][ T5741] Bluetooth: hci1: SCO packet for unknown connection handle 201 [ 252.826698][ T5741] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 252.837340][ T8625] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 252.843598][ T8625] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 252.852935][ T8625] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 252.868624][ T8625] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 252.887692][ T8625] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 252.891470][ T8625] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 252.895037][ T8625] usb usb1: Product: EHCI Host Controller [ 252.897508][ T8625] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 252.900809][ T8625] usb usb1: SerialNumber: 0000:00:1d.7 [ 252.940200][ T8625] hub 1-0:1.0: USB hub found [ 252.943212][ T8625] hub 1-0:1.0: 6 ports detected [ 252.970020][ T8611] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 253.044994][ T8625] hub 2-0:1.0: USB hub found [ 253.047118][ T8611] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 253.047519][ T8625] hub 2-0:1.0: 2 ports detected [ 253.062951][ T8611] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 253.065092][ T8611] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 253.068044][ T8611] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 253.071066][ T8611] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 253.098296][ T8625] hub 3-0:1.0: USB hub found [ 253.107417][ T8625] hub 3-0:1.0: 2 ports detected [ 253.140700][ T5741] Bluetooth: hci2: unexpected event for opcode 0x202d [ 253.150643][ T5741] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 253.221730][ T5741] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 253.229085][ T8625] hub 4-0:1.0: USB hub found [ 253.231799][ T8625] hub 4-0:1.0: 2 ports detected [ 253.248509][ T5110] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 253.489061][ T5110] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 253.493480][ T5110] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 253.497070][ T5110] usb 1-1: Product: QEMU USB Tablet [ 253.499588][ T5110] usb 1-1: Manufacturer: QEMU [ 253.501272][ T5110] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 253.544454][ T5110] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0041/input/input80 [ 253.611096][ T5110] hid-generic 0003:0627:0001.0041: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 253.978161][ T8649] syz.4.641 uses obsolete (PF_INET,SOCK_PACKET) [ 253.984411][ T8649] netlink: 8 bytes leftover after parsing attributes in process `syz.4.641'. [ 254.193182][ T8656] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 254.196665][ T8656] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 254.201077][ T8656] vhci_hcd vhci_hcd.0: Device attached [ 254.421821][ T8657] vhci_hcd: connection closed [ 254.422101][ T5849] vhci_hcd vhci_hcd.3: stop threads [ 254.426386][ T5849] vhci_hcd vhci_hcd.3: release socket [ 254.432752][ T5849] vhci_hcd vhci_hcd.3: disconnect device [ 254.459473][ T5741] Bluetooth: hci0: command 0x0406 tx timeout [ 254.468531][ T3980] usb 44-1: enqueue for inactive port 0 [ 254.520476][ T8666] ehci-pci 0000:00:1d.7: remove, state 1 [ 254.523697][ T8666] usb usb1: USB disconnect, device number 1 [ 254.526503][ T8666] usb 1-1: USB disconnect, device number 2 [ 254.666066][ T8668] netlink: 'syz.2.644': attribute type 3 has an invalid length. [ 254.717566][ T8668] netlink: 24 bytes leftover after parsing attributes in process `syz.2.644'. [ 254.856945][ T5741] Bluetooth: hci1: unexpected event for opcode 0x202d [ 254.859440][ T5741] Bluetooth: hci1: SCO packet for unknown connection handle 201 [ 254.911384][ T5741] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 255.032740][ T8666] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 255.089247][ T5741] Bluetooth: hci3: command 0x0406 tx timeout [ 255.549393][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.552307][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.827751][ T3980] usb usb44-port1: attempt power cycle [ 256.038241][ T8683] FAULT_INJECTION: forcing a failure. [ 256.038241][ T8683] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 256.042393][ T8683] CPU: 1 UID: 0 PID: 8683 Comm: syz.0.649 Not tainted syzkaller #0 PREEMPT(full) [ 256.042408][ T8683] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 256.042415][ T8683] Call Trace: [ 256.042420][ T8683] [ 256.042424][ T8683] dump_stack_lvl+0x100/0x190 [ 256.042441][ T8683] should_fail_ex.cold+0x5/0xa [ 256.042451][ T8683] ? prepare_alloc_pages+0x16d/0x5f0 [ 256.042469][ T8683] should_fail_alloc_page+0xeb/0x140 [ 256.042486][ T8683] prepare_alloc_pages+0x1f0/0x5f0 [ 256.042504][ T8683] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 256.042523][ T8683] ? stack_depot_save_flags+0x479/0x9d0 [ 256.042542][ T8683] ? rcu_is_watching+0x12/0xc0 [ 256.042556][ T8683] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 256.042568][ T8683] ? lockdep_hardirqs_on+0x78/0x100 [ 256.042580][ T8683] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 256.042592][ T8683] ? stack_depot_save_flags+0x479/0x9d0 [ 256.042610][ T8683] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 256.042624][ T8683] ? kasan_save_stack+0x30/0x50 [ 256.042637][ T8683] ? kasan_save_track+0x14/0x30 [ 256.042650][ T8683] ? __kasan_kmalloc+0xaa/0xb0 [ 256.042662][ T8683] ? __kmalloc_noprof+0x322/0x820 [ 256.042674][ T8683] ? iovec_from_user+0x8d/0x140 [ 256.042691][ T8683] ? __import_iovec+0x81/0x640 [ 256.042707][ T8683] ? import_iovec+0x82/0xb0 [ 256.042722][ T8683] ? vfs_writev+0x197/0xdd0 [ 256.042738][ T8683] ? do_writev+0x13e/0x340 [ 256.042754][ T8683] ? do_fast_syscall_32+0x32/0x70 [ 256.042770][ T8683] ? __lock_acquire+0x49f/0x1a40 [ 256.042792][ T8683] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 256.042809][ T8683] ? policy_nodemask+0xed/0x4f0 [ 256.042826][ T8683] alloc_pages_mpol+0x1fb/0x540 [ 256.042843][ T8683] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 256.042860][ T8683] ? rcu_is_watching+0x12/0xc0 [ 256.042874][ T8683] ? __pfx_vcs_write+0x10/0x10 [ 256.042885][ T8683] alloc_pages_noprof+0x1a/0x160 [ 256.042904][ T8683] get_free_pages_noprof+0x10/0xb0 [ 256.042918][ T8683] vcs_write+0x11a/0xd70 [ 256.042930][ T8683] ? __pfx___might_resched+0x10/0x10 [ 256.042948][ T8683] ? iovec_from_user+0xda/0x140 [ 256.042967][ T8683] ? __pfx_vcs_write+0x10/0x10 [ 256.042978][ T8683] ? apparmor_file_permission+0x13f/0x1c0 [ 256.042993][ T8683] ? bpf_lsm_file_permission+0x9/0x10 [ 256.043003][ T8683] ? security_file_permission+0x76/0x210 [ 256.043019][ T8683] ? rw_verify_area+0xce/0x6d0 [ 256.043036][ T8683] ? __pfx_vcs_write+0x10/0x10 [ 256.043047][ T8683] vfs_writev+0x5ed/0xdd0 [ 256.043067][ T8683] ? __pfx_vfs_writev+0x10/0x10 [ 256.043092][ T8683] ? __fget_files+0x21f/0x3d0 [ 256.043106][ T8683] ? do_writev+0x13e/0x340 [ 256.043121][ T8683] do_writev+0x13e/0x340 [ 256.043138][ T8683] ? __pfx_do_writev+0x10/0x10 [ 256.043154][ T8683] ? ksys_write+0x1ac/0x250 [ 256.043164][ T8683] ? __pfx_ksys_write+0x10/0x10 [ 256.043176][ T8683] __do_fast_syscall_32+0xe7/0x970 [ 256.043190][ T8683] ? lockdep_hardirqs_on+0x78/0x100 [ 256.043203][ T8683] do_fast_syscall_32+0x32/0x70 [ 256.043217][ T8683] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 256.043232][ T8683] RIP: 0023:0xf70befec [ 256.043245][ T8683] Code: Unable to access opcode bytes at 0xf70befc2. [ 256.043250][ T8683] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000092 [ 256.043260][ T8683] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000c40 [ 256.043267][ T8683] RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000000 [ 256.043274][ T8683] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 256.043280][ T8683] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 256.043286][ T8683] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 256.043299][ T8683] [ 256.243738][ T5741] Bluetooth: hci0: unexpected event for opcode 0x202d [ 256.256485][ T5741] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 256.302031][ T8667] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 256.312790][ T5741] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 256.318515][ T8667] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 256.328826][ T8667] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 256.358620][ T8667] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 256.367969][ T8667] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 256.373259][ T8667] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 256.377006][ T8667] usb usb1: Product: EHCI Host Controller [ 256.381372][ T8667] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 256.383857][ T8667] usb usb1: SerialNumber: 0000:00:1d.7 [ 256.399647][ T8667] hub 1-0:1.0: USB hub found [ 256.402445][ T8667] hub 1-0:1.0: 6 ports detected [ 256.461168][ T8667] hub 2-0:1.0: USB hub found [ 256.463487][ T8667] hub 2-0:1.0: 2 ports detected [ 256.490021][ T3980] usb usb44-port1: unable to enumerate USB device [ 256.512449][ T8667] hub 3-0:1.0: USB hub found [ 256.519687][ T8667] hub 3-0:1.0: 2 ports detected [ 256.550025][ T8667] hub 4-0:1.0: USB hub found [ 256.558939][ T8667] hub 4-0:1.0: 2 ports detected [ 256.678512][ T3980] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 256.894358][ T3980] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 256.902142][ T3980] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 256.905630][ T3980] usb 1-1: Product: QEMU USB Tablet [ 256.908606][ T3980] usb 1-1: Manufacturer: QEMU [ 256.923656][ T3980] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 256.952132][ T3980] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0042/input/input81 [ 257.025976][ T3980] hid-generic 0003:0627:0001.0042: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 257.076907][ T8702] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 257.079548][ T8702] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 257.083344][ T8702] vhci_hcd vhci_hcd.0: Device attached [ 257.215043][ T5741] Bluetooth: hci2: unexpected event for opcode 0x202d [ 257.220900][ T5741] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 257.275020][ T5741] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 257.881028][ T8703] vhci_hcd: connection closed [ 257.882900][ T5849] vhci_hcd vhci_hcd.2: stop threads [ 257.886491][ T5849] vhci_hcd vhci_hcd.2: release socket [ 257.888279][ T5849] vhci_hcd vhci_hcd.2: disconnect device [ 257.898556][ T3980] usb 42-1: enqueue for inactive port 0 [ 258.578824][ T3980] usb usb42-port1: attempt power cycle [ 259.229054][ T3980] usb usb42-port1: unable to enumerate USB device [ 259.304413][ T8734] Driver unsupported XDP return value 0 on prog (id 24) dev N/A, expect packet loss! [ 259.367672][ T8737] netlink: 16 bytes leftover after parsing attributes in process `syz.3.664'. [ 260.487069][ T5741] Bluetooth: hci0: unexpected event for opcode 0x202d [ 260.545430][ T5741] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 260.612322][ T5741] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 260.732330][ T8759] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 260.734971][ T8759] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 260.739492][ T8759] vhci_hcd vhci_hcd.0: Device attached [ 261.018665][ T5992] usb 42-1: SetAddress Request (18) to port 0 [ 261.024450][ T5992] usb 42-1: new SuperSpeed USB device number 18 using vhci_hcd [ 261.044058][ T8769] net_ratelimit: 9 callbacks suppressed [ 261.044069][ T8769] netlink: zone id is out of range [ 261.048750][ T8769] netlink: zone id is out of range [ 261.052295][ T8769] netlink: zone id is out of range [ 261.055952][ T8769] netlink: zone id is out of range [ 261.061265][ T8769] netlink: zone id is out of range [ 261.065215][ T8769] netlink: zone id is out of range [ 261.066992][ T8769] netlink: zone id is out of range [ 261.070571][ T8769] netlink: zone id is out of range [ 261.072579][ T8769] netlink: zone id is out of range [ 261.074954][ T8769] netlink: zone id is out of range [ 261.196734][ T8772] ehci-pci 0000:00:1d.7: remove, state 1 [ 261.199227][ T8772] usb usb1: USB disconnect, device number 1 [ 261.201970][ T8772] usb 1-1: USB disconnect, device number 2 [ 261.341625][ T8774] netlink: 'syz.3.671': attribute type 3 has an invalid length. [ 261.355793][ T8774] netlink: 24 bytes leftover after parsing attributes in process `syz.3.671'. [ 261.528680][ T8772] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 261.594022][ T8760] vhci_hcd: connection reset by peer [ 261.611926][ T5849] vhci_hcd vhci_hcd.2: stop threads [ 261.613776][ T5849] vhci_hcd vhci_hcd.2: release socket [ 261.621859][ T5849] vhci_hcd vhci_hcd.2: disconnect device [ 261.848801][ T5971] usb 2-1: new full-speed USB device number 44 using uhci_hcd [ 262.030708][ T5971] usb 2-1: not running at top speed; connect to a high speed hub [ 262.083729][ T5971] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 262.094116][ T5971] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 262.126266][ T5971] usb 2-1: Product: QEMU USB Tablet [ 262.146304][ T5971] usb 2-1: Manufacturer: QEMU [ 262.168101][ T5971] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 262.259960][ T5741] Bluetooth: hci1: SCO packet for unknown connection handle 201 [ 262.334406][ T5741] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 262.366131][ T5971] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0043/input/input82 [ 262.444673][ T5971] hid-generic 0003:0627:0001.0043: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 263.233802][ T8773] usb 2-1: USB disconnect, device number 44 [ 263.409026][ T8791] netlink: 8 bytes leftover after parsing attributes in process `syz.2.675'. [ 263.432108][ T8791] netlink: 4 bytes leftover after parsing attributes in process `syz.2.675'. [ 263.437612][ T8791] netlink: 'syz.2.675': attribute type 7 has an invalid length. [ 263.452718][ T8789] fido_id[8789]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 263.482838][ T5849] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 263.508279][ T8773] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 263.517392][ T8773] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 263.521664][ T5849] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 263.531034][ T5849] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 263.532487][ T8773] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 263.537061][ T5849] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 263.566554][ T5741] Bluetooth: hci3: unexpected event for opcode 0x202d [ 263.569215][ T8773] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 263.576543][ T5741] Bluetooth: hci3: SCO packet for unknown connection handle 201 [ 263.577708][ T8773] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 263.585121][ T8773] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 263.589236][ T8773] usb usb1: Product: EHCI Host Controller [ 263.591724][ T8773] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 263.594300][ T8773] usb usb1: SerialNumber: 0000:00:1d.7 [ 263.604050][ T8773] hub 1-0:1.0: USB hub found [ 263.606129][ T8773] hub 1-0:1.0: 6 ports detected [ 263.630188][ T5741] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 263.655111][ T8773] hub 2-0:1.0: USB hub found [ 263.659988][ T8773] hub 2-0:1.0: 2 ports detected [ 263.707731][ T8773] hub 3-0:1.0: USB hub found [ 263.712615][ T8773] hub 3-0:1.0: 2 ports detected [ 263.750809][ T8773] hub 4-0:1.0: USB hub found [ 263.755348][ T8773] hub 4-0:1.0: 2 ports detected [ 263.879069][ T24] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 264.056800][ T8806] netlink: 'syz.4.680': attribute type 3 has an invalid length. [ 264.076872][ T8806] netlink: 24 bytes leftover after parsing attributes in process `syz.4.680'. [ 264.210500][ T8809] ehci-pci 0000:00:1d.7: remove, state 1 [ 264.213116][ T8809] usb usb1: USB disconnect, device number 1 [ 264.289077][ T24] usb 1-1: device descriptor read/all, error -108 [ 264.335898][ T8812] netlink: 'syz.3.679': attribute type 3 has an invalid length. [ 264.341871][ T8812] netlink: 24 bytes leftover after parsing attributes in process `syz.3.679'. [ 264.861880][ T24] usb usb1-port1: attempt power cycle [ 265.247043][ T8809] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 265.330716][ T8828] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 265.332744][ T8828] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 265.336459][ T8828] vhci_hcd vhci_hcd.0: Device attached [ 265.508635][ T55] usb 2-1: new full-speed USB device number 45 using uhci_hcd [ 265.598566][ T5971] usb 46-1: SetAddress Request (6) to port 0 [ 265.601358][ T5971] usb 46-1: new SuperSpeed USB device number 6 using vhci_hcd [ 265.665701][ T55] usb 2-1: not running at top speed; connect to a high speed hub [ 265.687258][ T55] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 265.691263][ T55] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 265.694681][ T55] usb 2-1: Product: QEMU USB Tablet [ 265.696949][ T55] usb 2-1: Manufacturer: QEMU [ 265.699799][ T55] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 265.724737][ T55] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0044/input/input83 [ 265.792809][ T55] hid-generic 0003:0627:0001.0044: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 265.806646][ T8810] usb 2-1: USB disconnect, device number 45 [ 265.963201][ T8841] FAULT_INJECTION: forcing a failure. [ 265.963201][ T8841] name failslab, interval 1, probability 0, space 0, times 0 [ 265.967295][ T8841] CPU: 3 UID: 0 PID: 8841 Comm: syz.0.686 Not tainted syzkaller #0 PREEMPT(full) [ 265.967311][ T8841] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 265.967318][ T8841] Call Trace: [ 265.967323][ T8841] [ 265.967327][ T8841] dump_stack_lvl+0x100/0x190 [ 265.967343][ T8841] should_fail_ex.cold+0x5/0xa [ 265.967356][ T8841] should_failslab+0xc2/0x120 [ 265.967372][ T8841] __kmalloc_noprof+0xfc/0x820 [ 265.967386][ T8841] ? tomoyo_encode2+0xfb/0x3c0 [ 265.967405][ T8841] tomoyo_encode2+0xfb/0x3c0 [ 265.967423][ T8841] tomoyo_encode+0x29/0x50 [ 265.967444][ T8841] tomoyo_realpath_from_path+0x18c/0x690 [ 265.967493][ T8841] tomoyo_path_number_perm+0x23c/0x580 [ 265.967514][ T8841] ? tomoyo_path_number_perm+0x22e/0x580 [ 265.967529][ T8841] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 265.967544][ T8841] ? get_pid_task+0x106/0x250 [ 265.967571][ T8841] ? find_held_lock+0x2b/0x80 [ 265.967584][ T8841] ? __fget_files+0x215/0x3d0 [ 265.967593][ T8841] ? hook_file_ioctl_common+0x140/0x440 [ 265.967608][ T8841] ? __fget_files+0x215/0x3d0 [ 265.967620][ T8841] ? __fget_files+0x21f/0x3d0 [ 265.967632][ T8841] security_file_ioctl_compat+0xd3/0x230 [ 265.967647][ T8841] __ia32_compat_sys_ioctl+0xc2/0x360 [ 265.967666][ T8841] __do_fast_syscall_32+0xe7/0x970 [ 265.967680][ T8841] ? lockdep_hardirqs_on+0x78/0x100 [ 265.967694][ T8841] do_fast_syscall_32+0x32/0x70 [ 265.967708][ T8841] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 265.967723][ T8841] RIP: 0023:0xf70befec [ 265.967737][ T8841] Code: Unable to access opcode bytes at 0xf70befc2. [ 265.967742][ T8841] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 265.967753][ T8841] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0386105 [ 265.967760][ T8841] RDX: 0000000080000480 RSI: 0000000000000000 RDI: 0000000000000000 [ 265.967767][ T8841] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 265.967773][ T8841] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 265.967779][ T8841] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 265.967793][ T8841] [ 265.967803][ T8841] ERROR: Out of memory at tomoyo_realpath_from_path. [ 266.055326][ T8829] vhci_hcd: connection reset by peer [ 266.074514][ T5992] usb 42-1: device descriptor read/8, error -110 [ 266.111826][ T5819] vhci_hcd vhci_hcd.4: stop threads [ 266.327510][ T8810] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 266.407445][ T8810] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 266.431174][ T8810] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 266.443867][ T8846] fido_id[8846]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 266.470450][ T8810] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 266.474381][ T5819] vhci_hcd vhci_hcd.4: release socket [ 266.474727][ T5992] usb usb42-port1: attempt power cycle [ 266.545520][ T8810] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 266.569594][ T8810] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 266.588855][ T8810] usb usb1: Product: EHCI Host Controller [ 266.590735][ T8810] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 266.613599][ T8810] usb usb1: SerialNumber: 0000:00:1d.7 [ 266.676437][ T8810] hub 1-0:1.0: USB hub found [ 266.704632][ T8810] hub 1-0:1.0: 6 ports detected [ 266.848518][ T5819] vhci_hcd vhci_hcd.4: disconnect device [ 266.863770][ T8810] hub 2-0:1.0: USB hub found [ 266.903119][ T8810] hub 2-0:1.0: 2 ports detected [ 266.969501][ T8810] hub 3-0:1.0: USB hub found [ 266.974547][ T8810] hub 3-0:1.0: 2 ports detected [ 267.023325][ T8810] hub 4-0:1.0: USB hub found [ 267.033070][ T8810] hub 4-0:1.0: 2 ports detected [ 267.078576][ T6062] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 267.107251][ T8851] netlink: 'syz.4.689': attribute type 3 has an invalid length. [ 267.125107][ T8855] netlink: 16 bytes leftover after parsing attributes in process `syz.0.691'. [ 267.125148][ T8851] netlink: 24 bytes leftover after parsing attributes in process `syz.4.689'. [ 267.238664][ T5992] usb usb42-port1: unable to enumerate USB device [ 267.844822][ T6062] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 268.103743][ T6062] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 268.110706][ T6062] usb 1-1: Product: QEMU USB Tablet [ 268.112369][ T6062] usb 1-1: Manufacturer: QEMU [ 268.119285][ T6062] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 268.149281][ T6062] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0045/input/input84 [ 268.220195][ T6062] hid-generic 0003:0627:0001.0045: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 268.332663][ T8880] net_ratelimit: 9 callbacks suppressed [ 268.332729][ T8880] netlink: zone id is out of range [ 268.337740][ T8880] netlink: zone id is out of range [ 268.341973][ T8880] netlink: zone id is out of range [ 268.344338][ T8880] netlink: zone id is out of range [ 268.348486][ T8880] netlink: zone id is out of range [ 268.350408][ T8880] netlink: zone id is out of range [ 268.352740][ T8880] netlink: zone id is out of range [ 268.354958][ T8880] netlink: zone id is out of range [ 268.356925][ T8880] netlink: zone id is out of range [ 268.359364][ T8880] netlink: zone id is out of range [ 268.958717][ T8891] netlink: 72 bytes leftover after parsing attributes in process `syz.3.700'. [ 270.029426][ T8914] se_dev->se_dev_ptr already set for storage object [ 270.105238][ T5741] Bluetooth: hci1: unexpected event for opcode 0x202d [ 270.213542][ T5741] Bluetooth: hci1: SCO packet for unknown connection handle 201 [ 270.220833][ T8924] netlink: 8 bytes leftover after parsing attributes in process `syz.4.710'. [ 270.266357][ T5741] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 270.759938][ T5971] usb 46-1: device descriptor read/8, error -110 [ 271.181193][ T5971] usb usb46-port1: attempt power cycle [ 271.307907][ T8935] ehci-pci 0000:00:1d.7: remove, state 1 [ 271.310639][ T8935] usb usb1: USB disconnect, device number 1 [ 271.313560][ T8935] usb 1-1: USB disconnect, device number 2 [ 271.429655][ T8938] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 271.431678][ T8938] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 271.447642][ T8938] vhci_hcd vhci_hcd.0: Device attached [ 271.462595][ T8941] netlink: 'syz.4.712': attribute type 3 has an invalid length. [ 271.501007][ T8941] netlink: 24 bytes leftover after parsing attributes in process `syz.4.712'. [ 271.661887][ T8935] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 271.708573][ T5992] usb 44-1: SetAddress Request (26) to port 0 [ 271.711050][ T5992] usb 44-1: new SuperSpeed USB device number 26 using vhci_hcd [ 271.789353][ T5971] usb usb46-port1: unable to enumerate USB device [ 271.918478][ T55] usb 2-1: new full-speed USB device number 46 using uhci_hcd [ 272.036391][ T8939] vhci_hcd: connection reset by peer [ 272.039619][ T5819] vhci_hcd vhci_hcd.3: stop threads [ 272.042139][ T5819] vhci_hcd vhci_hcd.3: release socket [ 272.044552][ T5819] vhci_hcd vhci_hcd.3: disconnect device [ 272.075198][ T55] usb 2-1: not running at top speed; connect to a high speed hub [ 272.097387][ T55] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 272.101666][ T55] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 272.105332][ T55] usb 2-1: Product: QEMU USB Tablet [ 272.107075][ T55] usb 2-1: Manufacturer: QEMU [ 272.111551][ T55] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 272.142292][ T55] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0046/input/input85 [ 272.214283][ T55] hid-generic 0003:0627:0001.0046: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 272.382314][ T8937] usb 2-1: USB disconnect, device number 46 [ 272.393152][ T8950] fido_id[8950]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/2-1/report_descriptor': No such file or directory [ 272.560659][ T8937] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 272.570115][ T8937] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 272.580674][ T8937] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 272.618785][ T8937] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 272.625518][ T8937] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 272.628497][ T8937] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 272.630988][ T8937] usb usb1: Product: EHCI Host Controller [ 272.633159][ T8937] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 272.635221][ T8937] usb usb1: SerialNumber: 0000:00:1d.7 [ 272.647844][ T8937] hub 1-0:1.0: USB hub found [ 272.650667][ T8937] hub 1-0:1.0: 6 ports detected [ 272.721880][ T8937] hub 2-0:1.0: USB hub found [ 272.723674][ T8937] hub 2-0:1.0: 2 ports detected [ 272.759497][ T8937] hub 3-0:1.0: USB hub found [ 272.762752][ T8937] hub 3-0:1.0: 2 ports detected [ 272.817653][ T8937] hub 4-0:1.0: USB hub found [ 272.820592][ T8937] hub 4-0:1.0: 2 ports detected [ 272.971388][ T6543] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 273.160936][ T6543] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 273.164808][ T6543] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 273.167753][ T6543] usb 1-1: Product: QEMU USB Tablet [ 273.170508][ T6543] usb 1-1: Manufacturer: QEMU [ 273.172576][ T6543] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 273.199969][ T6543] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0047/input/input86 [ 273.260866][ T6543] hid-generic 0003:0627:0001.0047: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 273.300206][ T5741] Bluetooth: hci1: unexpected event for opcode 0x202d [ 273.315905][ T5741] Bluetooth: hci1: SCO packet for unknown connection handle 201 [ 273.394082][ T5741] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 274.065072][ T8991] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 274.068236][ T8991] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 274.101076][ T8991] vhci_hcd vhci_hcd.0: Device attached [ 274.388617][ T55] usb 42-1: SetAddress Request (22) to port 0 [ 274.391533][ T55] usb 42-1: new SuperSpeed USB device number 22 using vhci_hcd [ 274.616049][ T8992] vhci_hcd: connection reset by peer [ 274.617961][ T5819] vhci_hcd vhci_hcd.2: stop threads [ 274.619680][ T5819] vhci_hcd vhci_hcd.2: release socket [ 274.622173][ T5819] vhci_hcd vhci_hcd.2: disconnect device [ 274.859221][ T5741] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 274.940893][ T5741] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 276.256472][ T9015] netlink: 16 bytes leftover after parsing attributes in process `syz.3.734'. [ 276.326876][ T9016] ehci-pci 0000:00:1d.7: remove, state 1 [ 276.329660][ T9016] usb usb1: USB disconnect, device number 1 [ 276.332109][ T9016] usb 1-1: USB disconnect, device number 2 [ 276.494261][ T9021] netlink: 'syz.4.732': attribute type 3 has an invalid length. [ 276.533884][ T9021] netlink: 24 bytes leftover after parsing attributes in process `syz.4.732'. [ 276.809614][ T5992] usb 44-1: device descriptor read/8, error -110 [ 276.870823][ T9016] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 276.906597][ T9029] FAULT_INJECTION: forcing a failure. [ 276.906597][ T9029] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 276.913365][ T9029] CPU: 1 UID: 0 PID: 9029 Comm: syz.2.737 Not tainted syzkaller #0 PREEMPT(full) [ 276.913404][ T9029] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 276.913416][ T9029] Call Trace: [ 276.913422][ T9029] [ 276.913428][ T9029] dump_stack_lvl+0x100/0x190 [ 276.913454][ T9029] should_fail_ex.cold+0x5/0xa [ 276.913476][ T9029] strncpy_from_user+0x3b/0x2d0 [ 276.913524][ T9029] do_getname+0x78/0x390 [ 276.913550][ T9029] __ia32_compat_sys_execveat+0xc4/0x130 [ 276.913580][ T9029] __do_fast_syscall_32+0xe7/0x970 [ 276.913603][ T9029] ? lockdep_hardirqs_on+0x78/0x100 [ 276.913627][ T9029] do_fast_syscall_32+0x32/0x70 [ 276.913651][ T9029] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 276.913674][ T9029] RIP: 0023:0xf703efec [ 276.913695][ T9029] Code: Unable to access opcode bytes at 0xf703efc2. [ 276.913703][ T9029] RSP: 002b:00000000f540c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000166 [ 276.913721][ T9029] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080001400 [ 276.913732][ T9029] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 276.913741][ T9029] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 276.913752][ T9029] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 276.913762][ T9029] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 276.913784][ T9029] [ 277.168929][ T3980] usb 2-1: new full-speed USB device number 47 using uhci_hcd [ 277.265017][ T5992] usb usb44-port1: attempt power cycle [ 277.335991][ T3980] usb 2-1: not running at top speed; connect to a high speed hub [ 277.336616][ T5741] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 277.393349][ T5741] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 277.692085][ T149] IPVS: starting estimator thread 0... [ 277.798929][ T9041] IPVS: using max 27 ests per chain, 64800 per kthread [ 278.506981][ T3980] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 278.510277][ T3980] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 278.512784][ T3980] usb 2-1: Product: QEMU USB Tablet [ 278.513548][ T42] audit: type=1326 audit(1784947997.447:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9051 comm="syz.3.745" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f46fec code=0x0 [ 278.514410][ T3980] usb 2-1: Manufacturer: QEMU [ 278.514420][ T3980] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 278.550992][ T3980] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0048/input/input87 [ 278.654019][ T9058] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 278.656137][ T9058] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 278.663481][ T9058] vhci_hcd vhci_hcd.0: Device attached [ 278.666550][ T3980] hid-generic 0003:0627:0001.0048: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 278.684829][ T9020] usb 2-1: USB disconnect, device number 47 [ 278.790436][ T5992] usb usb44-port1: unable to enumerate USB device [ 278.856613][ T9068] fido_id[9068]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 278.945698][ T9020] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 278.952627][ T9020] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 278.962682][ T9020] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 278.998730][ T9020] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 279.011527][ T9020] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 279.017187][ T9020] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 279.023958][ T9020] usb usb1: Product: EHCI Host Controller [ 279.033661][ T9020] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 279.043936][ T9020] usb usb1: SerialNumber: 0000:00:1d.7 [ 279.059130][ T9020] hub 1-0:1.0: USB hub found [ 279.062840][ T9020] hub 1-0:1.0: 6 ports detected [ 279.130619][ T9020] hub 2-0:1.0: USB hub found [ 279.133910][ T9020] hub 2-0:1.0: 2 ports detected [ 279.170716][ T9020] hub 3-0:1.0: USB hub found [ 279.173930][ T9020] hub 3-0:1.0: 2 ports detected [ 279.200370][ T9020] hub 4-0:1.0: USB hub found [ 279.204534][ T9020] hub 4-0:1.0: 2 ports detected [ 279.375245][ T9059] vhci_hcd: connection closed [ 279.376558][ T5849] vhci_hcd vhci_hcd.2: stop threads [ 279.379981][ T7163] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 279.382757][ T5849] vhci_hcd vhci_hcd.2: release socket [ 279.384631][ T5849] vhci_hcd vhci_hcd.2: disconnect device [ 279.433534][ T5741] Bluetooth: hci2: unexpected event for opcode 0x202d [ 279.439980][ T5741] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 279.489443][ T55] usb 42-1: device descriptor read/8, error -110 [ 279.586927][ T7163] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 279.603949][ T7163] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 279.610343][ T7163] usb 1-1: Product: QEMU USB Tablet [ 279.621038][ T5741] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 279.622033][ T7163] usb 1-1: Manufacturer: QEMU [ 279.632035][ T7163] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 279.655555][ T9073] netlink: 4 bytes leftover after parsing attributes in process `syz.3.749'. [ 279.674676][ T7163] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0049/input/input88 [ 279.751709][ T7163] hid-generic 0003:0627:0001.0049: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 279.930016][ T55] usb usb42-port1: attempt power cycle [ 280.292482][ T9095] FAULT_INJECTION: forcing a failure. [ 280.292482][ T9095] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 280.298510][ T9095] CPU: 2 UID: 0 PID: 9095 Comm: syz.3.755 Not tainted syzkaller #0 PREEMPT(full) [ 280.298526][ T9095] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 280.298533][ T9095] Call Trace: [ 280.298537][ T9095] [ 280.298542][ T9095] dump_stack_lvl+0x100/0x190 [ 280.298558][ T9095] should_fail_ex.cold+0x5/0xa [ 280.298571][ T9095] _copy_from_user+0x2e/0xd0 [ 280.298589][ T9095] sctp_setsockopt+0x8cc/0xb370 [ 280.298601][ T9095] ? __pfx_aa_sk_perm+0x10/0x10 [ 280.298616][ T9095] ? __pfx_sctp_setsockopt+0x10/0x10 [ 280.298629][ T9095] ? aa_sock_opt_perm+0xfe/0x1b0 [ 280.298639][ T9095] ? sock_common_setsockopt+0x2e/0xf0 [ 280.298657][ T9095] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 280.298675][ T9095] do_sock_setsockopt+0xf3/0x1d0 [ 280.298695][ T9095] __sys_setsockopt+0x119/0x190 [ 280.298718][ T9095] __ia32_sys_setsockopt+0xbc/0x160 [ 280.298732][ T9095] ? __do_fast_syscall_32+0x98/0x970 [ 280.298747][ T9095] ? lockdep_hardirqs_on+0x78/0x100 [ 280.298760][ T9095] __do_fast_syscall_32+0xe7/0x970 [ 280.298773][ T9095] ? lockdep_hardirqs_on+0x78/0x100 [ 280.298786][ T9095] do_fast_syscall_32+0x32/0x70 [ 280.298814][ T9095] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 280.298828][ T9095] RIP: 0023:0xf7f46fec [ 280.298841][ T9095] Code: Unable to access opcode bytes at 0xf7f46fc2. [ 280.298846][ T9095] RSP: 002b:00000000f53c450c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 280.298857][ T9095] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000084 [ 280.298864][ T9095] RDX: 0000000000000009 RSI: 00000000800002c0 RDI: 000000000000009c [ 280.298870][ T9095] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 280.298876][ T9095] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 280.298882][ T9095] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 280.298896][ T9095] [ 280.499385][ T55] usb usb42-port1: unable to enumerate USB device [ 280.520003][ T9097] FAULT_INJECTION: forcing a failure. [ 280.520003][ T9097] name failslab, interval 1, probability 0, space 0, times 0 [ 280.525208][ T9097] CPU: 3 UID: 0 PID: 9097 Comm: syz.0.757 Not tainted syzkaller #0 PREEMPT(full) [ 280.525230][ T9097] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 280.525240][ T9097] Call Trace: [ 280.525245][ T9097] [ 280.525252][ T9097] dump_stack_lvl+0x100/0x190 [ 280.525275][ T9097] should_fail_ex.cold+0x5/0xa [ 280.525301][ T9097] should_failslab+0xc2/0x120 [ 280.525324][ T9097] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 280.525346][ T9097] ? __alloc_skb+0x5b7/0x710 [ 280.525367][ T9097] ? __alloc_skb+0x140/0x710 [ 280.525393][ T9097] __alloc_skb+0x140/0x710 [ 280.525415][ T9097] ? __alloc_skb+0x5b7/0x710 [ 280.525435][ T9097] ? __pfx___alloc_skb+0x10/0x10 [ 280.525462][ T9097] netlink_alloc_large_skb+0x69/0x150 [ 280.525505][ T9097] netlink_sendmsg+0x680/0xda0 [ 280.525527][ T9097] ? __pfx_netlink_sendmsg+0x10/0x10 [ 280.525549][ T9097] ? apparmor_socket_sendmsg+0x15b/0x270 [ 280.525572][ T9097] ____sys_sendmsg+0xa4d/0xbe0 [ 280.525587][ T9097] ? __pfx_netlink_sendmsg+0x10/0x10 [ 280.525607][ T9097] ? __pfx_____sys_sendmsg+0x10/0x10 [ 280.525636][ T9097] ___sys_sendmsg+0x190/0x1e0 [ 280.525655][ T9097] ? __pfx____sys_sendmsg+0x10/0x10 [ 280.525684][ T9097] ? find_held_lock+0x2b/0x80 [ 280.525724][ T9097] __sys_sendmsg+0x160/0x210 [ 280.525747][ T9097] ? __pfx___sys_sendmsg+0x10/0x10 [ 280.525775][ T9097] ? __pfx_ksys_write+0x10/0x10 [ 280.525795][ T9097] __do_fast_syscall_32+0xe7/0x970 [ 280.525818][ T9097] ? lockdep_hardirqs_on+0x78/0x100 [ 280.525839][ T9097] do_fast_syscall_32+0x32/0x70 [ 280.525861][ T9097] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 280.525884][ T9097] RIP: 0023:0xf70befec [ 280.525905][ T9097] Code: Unable to access opcode bytes at 0xf70befc2. [ 280.525913][ T9097] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 280.525929][ T9097] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 280.525940][ T9097] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 280.525950][ T9097] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 280.525960][ T9097] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 280.525969][ T9097] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 280.525992][ T9097] [ 281.927353][ T9124] netlink: 6208 bytes leftover after parsing attributes in process `syz.0.765'. [ 282.122522][ T9126] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 282.124934][ T9126] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 282.133485][ T9126] vhci_hcd vhci_hcd.0: Device attached [ 282.179089][ T9131] netlink: 11 bytes leftover after parsing attributes in process `syz.4.766'. [ 282.279231][ T5741] Bluetooth: hci0: unexpected event for opcode 0x0000 [ 282.283944][ T5741] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 282.367884][ T5741] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 282.458615][ T5992] usb 42-1: SetAddress Request (26) to port 0 [ 282.461499][ T5992] usb 42-1: new SuperSpeed USB device number 26 using vhci_hcd [ 282.758536][ T9127] vhci_hcd: connection reset by peer [ 282.763427][ T5849] vhci_hcd vhci_hcd.2: stop threads [ 282.765706][ T5849] vhci_hcd vhci_hcd.2: release socket [ 282.768778][ T5849] vhci_hcd vhci_hcd.2: disconnect device [ 283.476590][ T9154] netlink: 16 bytes leftover after parsing attributes in process `syz.3.770'. [ 284.570679][ T5741] Bluetooth: hci0: unexpected event for opcode 0x202d [ 284.574855][ T5741] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 284.630247][ T5741] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 284.711970][ T9172] ehci-pci 0000:00:1d.7: remove, state 1 [ 284.714218][ T9172] usb usb1: USB disconnect, device number 1 [ 284.716443][ T9172] usb 1-1: USB disconnect, device number 2 [ 284.852037][ T9172] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 284.856681][ T9174] netlink: 'syz.2.775': attribute type 3 has an invalid length. [ 284.868250][ T9174] netlink: 24 bytes leftover after parsing attributes in process `syz.2.775'. [ 285.128811][ T3980] usb 2-1: new full-speed USB device number 48 using uhci_hcd [ 285.294199][ T3980] usb 2-1: not running at top speed; connect to a high speed hub [ 285.315820][ T3980] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 285.319265][ T3980] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 285.321874][ T3980] usb 2-1: Product: QEMU USB Tablet [ 285.323531][ T3980] usb 2-1: Manufacturer: QEMU [ 285.325099][ T3980] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 285.355061][ T3980] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.004A/input/input89 [ 285.435884][ T3980] hid-generic 0003:0627:0001.004A: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 285.483639][ T9173] usb 2-1: USB disconnect, device number 48 [ 285.592278][ T9179] netlink: 4 bytes leftover after parsing attributes in process `syz.0.777'. [ 285.596583][ T9179] netlink: 28 bytes leftover after parsing attributes in process `syz.0.777'. [ 285.607482][ T9179] bond0: (slave bond_slave_0): Releasing backup interface [ 285.612849][ T9179] bond0: (slave bond_slave_1): Releasing backup interface [ 285.615490][ T9175] fido_id[9175]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 285.617383][ T9179] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 285.623893][ T9179] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 285.633087][ T9179] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 285.636294][ T9179] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 285.649961][ T9179] net_ratelimit: 47 callbacks suppressed [ 285.649986][ T9179] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 285.765357][ T9173] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 285.782089][ T9173] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 285.795146][ T9173] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 285.838839][ T9173] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 285.859269][ T9173] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 285.862905][ T9179] batadv_slave_1: entered promiscuous mode [ 285.863587][ T9173] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 285.870495][ T9173] usb usb1: Product: EHCI Host Controller [ 285.873213][ T9179] macvlan2: entered allmulticast mode [ 285.873250][ T9179] batadv_slave_1: entered allmulticast mode [ 285.876715][ T9179] batman_adv: batadv0: Adding interface: macvlan2 [ 285.878290][ T9173] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 285.880946][ T9179] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 285.884517][ T9173] usb usb1: SerialNumber: 0000:00:1d.7 [ 285.898701][ T9179] batman_adv: batadv0: Interface activated: macvlan2 [ 285.930128][ T9173] hub 1-0:1.0: USB hub found [ 285.932640][ T9179] tipc: Enabling of bearer rejected, failed to enable media [ 285.935076][ T9173] hub 1-0:1.0: 6 ports detected [ 286.029653][ T9173] hub 2-0:1.0: USB hub found [ 286.033119][ T9173] hub 2-0:1.0: 2 ports detected [ 286.074708][ T9188] input: syz0 as /devices/virtual/input/input90 [ 286.115608][ T9173] hub 3-0:1.0: USB hub found [ 286.120209][ T9173] hub 3-0:1.0: 2 ports detected [ 286.190253][ T9173] hub 4-0:1.0: USB hub found [ 286.192785][ T9173] hub 4-0:1.0: 2 ports detected [ 286.268513][ T5851] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 286.452881][ T5851] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 286.455585][ T5851] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 286.461164][ T5851] usb 1-1: Product: QEMU USB Tablet [ 286.462861][ T5851] usb 1-1: Manufacturer: QEMU [ 286.464274][ T5851] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 286.471867][ T9195] netlink: 16 bytes leftover after parsing attributes in process `syz.0.781'. [ 286.491279][ T5851] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.004B/input/input91 [ 286.513967][ T9196] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 286.515869][ T9196] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 286.530003][ T9196] vhci_hcd vhci_hcd.0: Device attached [ 286.549214][ T55] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 286.557739][ T5851] hid-generic 0003:0627:0001.004B: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 286.728525][ T55] usb 8-1: Using ep0 maxpacket: 16 [ 286.734899][ T55] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 286.747839][ T55] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 286.753656][ T55] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 286.761336][ T55] usb 8-1: Product: syz [ 286.765792][ T55] usb 8-1: Manufacturer: syz [ 286.769776][ T55] usb 8-1: SerialNumber: syz [ 286.778958][ T55] usb 8-1: config 0 descriptor?? [ 286.786832][ T55] em28xx 8-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 286.795768][ T55] em28xx 8-1:0.0: DVB interface 0 found: bulk [ 287.164114][ T9197] vhci_hcd: connection closed [ 287.164358][ T5819] vhci_hcd vhci_hcd.2: stop threads [ 287.169579][ T5819] vhci_hcd vhci_hcd.2: release socket [ 287.171741][ T5819] vhci_hcd vhci_hcd.2: disconnect device [ 287.396076][ T55] em28xx 8-1:0.0: unknown em28xx chip ID (0) [ 287.499036][ T5992] usb 42-1: device descriptor read/8, error -110 [ 287.526850][ T9211] ehci-pci 0000:00:1d.7: remove, state 1 [ 287.532367][ T9211] usb usb1: USB disconnect, device number 1 [ 287.536209][ T9211] usb 1-1: USB disconnect, device number 2 [ 287.627922][ T9211] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 287.670462][ T9213] netlink: 'syz.0.784': attribute type 3 has an invalid length. [ 287.675549][ T9213] netlink: 24 bytes leftover after parsing attributes in process `syz.0.784'. [ 288.023454][ T9212] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 288.050837][ T9212] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 288.060967][ T9212] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 288.078744][ T9212] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 288.095792][ T9212] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 288.099870][ T9212] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 288.102954][ T9212] usb usb1: Product: EHCI Host Controller [ 288.105347][ T9212] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 288.107580][ T9212] usb usb1: SerialNumber: 0000:00:1d.7 [ 288.127096][ T9212] hub 1-0:1.0: USB hub found [ 288.131433][ T9212] hub 1-0:1.0: 6 ports detected [ 288.207998][ T9212] hub 2-0:1.0: USB hub found [ 288.211676][ T9212] hub 2-0:1.0: 2 ports detected [ 288.322156][ T9212] hub 3-0:1.0: USB hub found [ 288.326615][ T9212] hub 3-0:1.0: 2 ports detected [ 288.384348][ T9212] hub 4-0:1.0: USB hub found [ 288.388078][ T9212] hub 4-0:1.0: 2 ports detected [ 288.432544][ T9] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 288.561649][ T5992] usb usb42-port1: attempt power cycle [ 288.624310][ T9] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 288.627710][ T9] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 288.631324][ T9] usb 1-1: Product: QEMU USB Tablet [ 288.633494][ T9] usb 1-1: Manufacturer: QEMU [ 288.635400][ T9] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 288.762542][ T9] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.004C/input/input92 [ 288.850108][ T9] hid-generic 0003:0627:0001.004C: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 289.041531][ T55] em28xx 8-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 289.056226][ T55] em28xx 8-1:0.0: board has no eeprom [ 289.062896][ T9190] em28xx 8-1:0.0: reading from i2c device at 0xe failed (error=-5) [ 289.208483][ T55] em28xx 8-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 289.211902][ T55] em28xx 8-1:0.0: dvb set to bulk mode. [ 289.226721][ T3980] em28xx 8-1:0.0: Binding DVB extension [ 289.242974][ T55] usb 8-1: USB disconnect, device number 5 [ 289.264306][ T55] em28xx 8-1:0.0: Disconnecting em28xx [ 289.280361][ T3980] em28xx 8-1:0.0: Registering input extension [ 289.283968][ T55] em28xx 8-1:0.0: Closing input extension [ 289.335041][ T55] em28xx 8-1:0.0: Freeing device [ 289.452945][ T9224] netlink: 6208 bytes leftover after parsing attributes in process `syz.0.785'. [ 289.604109][ T5992] usb usb42-port1: unable to enumerate USB device [ 291.038695][ T6543] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 291.174310][ T9243] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 291.190316][ T6543] usb 9-1: config index 0 descriptor too short (expected 23569, got 27) [ 291.195889][ T6543] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 291.209082][ T6543] usb 9-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 291.214921][ T6543] usb 9-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 291.223377][ T6543] usb 9-1: Manufacturer: syz [ 291.233648][ T6543] usb 9-1: config 0 descriptor?? [ 291.239203][ T9243] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 291.248201][ T9243] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 291.288565][ T6543] rc_core: IR keymap rc-hauppauge not found [ 291.292918][ T6543] Registered IR keymap rc-empty [ 291.299285][ T6543] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 291.306138][ T6543] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input94 [ 291.384085][ T9246] syz.2.792 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 291.442109][ T9241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 291.445495][ T9241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 291.462233][ T149] usb 9-1: USB disconnect, device number 2 [ 292.041347][ T9251] netlink: 96 bytes leftover after parsing attributes in process `syz.4.794'. [ 292.083762][ T9251] netlink: 56 bytes leftover after parsing attributes in process `syz.4.794'. [ 292.094942][ T9251] netlink: 56 bytes leftover after parsing attributes in process `syz.4.794'. [ 292.936299][ T9269] fuse: Bad value for 'fd' [ 293.028205][ T9271] netlink: 16 bytes leftover after parsing attributes in process `syz.4.800'. [ 293.107482][ T9276] input: syz0 as /devices/virtual/input/input95 [ 294.009808][ T149] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 294.125556][ T9295] se_dev->se_dev_ptr already set for storage object [ 294.255912][ T9302] fuse: Bad value for 'fd' [ 294.375225][ T9309] se_dev->se_dev_ptr already set for storage object [ 294.377923][ T9309] FAULT_INJECTION: forcing a failure. [ 294.377923][ T9309] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 294.387257][ T9309] CPU: 3 UID: 0 PID: 9309 Comm: syz.4.811 Not tainted syzkaller #0 PREEMPT(full) [ 294.387272][ T9309] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 294.387280][ T9309] Call Trace: [ 294.387284][ T9309] [ 294.387288][ T9309] dump_stack_lvl+0x100/0x190 [ 294.387310][ T9309] should_fail_ex.cold+0x5/0xa [ 294.387323][ T9309] _copy_to_user+0x32/0xd0 [ 294.387355][ T9309] simple_read_from_buffer+0xcb/0x170 [ 294.387375][ T9309] proc_fail_nth_read+0x1af/0x230 [ 294.387391][ T9309] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 294.387407][ T9309] ? rw_verify_area+0xce/0x6d0 [ 294.387423][ T9309] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 294.387438][ T9309] vfs_read+0x1e4/0xb40 [ 294.387458][ T9309] ? __pfx_vfs_read+0x10/0x10 [ 294.387486][ T9309] ? find_held_lock+0x2b/0x80 [ 294.387501][ T9309] ? __fget_files+0x215/0x3d0 [ 294.387514][ T9309] ? __fget_files+0x21f/0x3d0 [ 294.387528][ T9309] ksys_read+0x12a/0x250 [ 294.387538][ T9309] ? __pfx_ksys_read+0x10/0x10 [ 294.387551][ T9309] do_int80_emulation+0x14b/0x720 [ 294.387568][ T9309] asm_int80_emulation+0x1a/0x20 [ 294.387579][ T9309] RIP: 0023:0xf71b72eb [ 294.387588][ T9309] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 294.387599][ T9309] RSP: 002b:00000000f546d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 294.387610][ T9309] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f546d5d0 [ 294.387617][ T9309] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 294.387623][ T9309] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 294.387629][ T9309] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 294.387635][ T9309] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 294.387649][ T9309] [ 294.452440][ T9311] input: syz0 as /devices/virtual/input/input96 [ 305.288813][ T5741] Bluetooth: hci2: unexpected event for opcode 0x202d [ 305.295235][ T5741] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 305.368594][ T5741] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 305.568443][ T9352] netlink: 16 bytes leftover after parsing attributes in process `syz.3.815'. [ 306.242190][ T9362] ehci-pci 0000:00:1d.7: remove, state 1 [ 306.244897][ T9362] usb usb1: USB disconnect, device number 1 [ 306.247520][ T9362] usb 1-1: USB disconnect, device number 2 [ 306.359195][ T9364] netlink: 'syz.2.816': attribute type 3 has an invalid length. [ 306.373833][ T9364] netlink: 24 bytes leftover after parsing attributes in process `syz.2.816'. [ 306.722819][ T9369] fuse: Bad value for 'fd' [ 306.784488][ T9373] input: syz0 as /devices/virtual/input/input97 [ 306.954501][ T9362] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 307.270151][ T5992] usb 2-1: new full-speed USB device number 49 using uhci_hcd [ 307.436453][ T5992] usb 2-1: not running at top speed; connect to a high speed hub [ 307.485746][ T5992] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 307.514019][ T5992] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 307.535022][ T5992] usb 2-1: Product: QEMU USB Tablet [ 307.542149][ T5992] usb 2-1: Manufacturer: QEMU [ 307.545883][ T5992] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 307.805252][ T9394] netlink: 16 bytes leftover after parsing attributes in process `syz.4.825'. [ 307.808553][ T5992] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.004D/input/input98 [ 307.875136][ T5992] hid-generic 0003:0627:0001.004D: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 307.956568][ T9363] usb 2-1: USB disconnect, device number 49 [ 308.147521][ T5741] Bluetooth: hci0: unexpected event for opcode 0x202d [ 308.150788][ T5741] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 308.165288][ T9403] netlink: 'syz.0.826': attribute type 3 has an invalid length. [ 308.189561][ T9403] netlink: 24 bytes leftover after parsing attributes in process `syz.0.826'. [ 308.213485][ T5741] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 308.523364][ T9400] fido_id[9400]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 308.553879][ T9363] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 308.568694][ T9363] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 308.573986][ T9363] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 308.687836][ T5741] Bluetooth: hci2: unexpected event for opcode 0x202d [ 308.695212][ T5741] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 308.768637][ T9363] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 308.774900][ T9363] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 308.777861][ T9363] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 308.780678][ T9363] usb usb1: Product: EHCI Host Controller [ 308.782491][ T9363] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 308.785029][ T9363] usb usb1: SerialNumber: 0000:00:1d.7 [ 308.826414][ T5741] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 308.974719][ T9363] hub 1-0:1.0: USB hub found [ 308.976688][ T9363] hub 1-0:1.0: 6 ports detected [ 309.011933][ T9363] hub 2-0:1.0: USB hub found [ 309.013871][ T9363] hub 2-0:1.0: 2 ports detected [ 309.052035][ T9363] hub 3-0:1.0: USB hub found [ 309.054516][ T9363] hub 3-0:1.0: 2 ports detected [ 309.103645][ T9363] hub 4-0:1.0: USB hub found [ 309.105490][ T9363] hub 4-0:1.0: 2 ports detected [ 309.112339][ T9398] ehci-pci 0000:00:1d.7: remove, state 1 [ 309.114161][ T9398] usb usb1: USB disconnect, device number 1 [ 309.172721][ T9398] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 309.448614][ T55] usb 2-1: new full-speed USB device number 50 using uhci_hcd [ 309.653646][ T55] usb 2-1: not running at top speed; connect to a high speed hub [ 309.674049][ T55] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 309.677973][ T55] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 309.681620][ T55] usb 2-1: Product: QEMU USB Tablet [ 309.683438][ T55] usb 2-1: Manufacturer: QEMU [ 309.685061][ T55] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 309.708676][ T55] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.004E/input/input99 [ 309.804107][ T55] hid-generic 0003:0627:0001.004E: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 309.826493][ T9399] usb 2-1: USB disconnect, device number 50 [ 309.980733][ T9426] fido_id[9426]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 310.003299][ T9399] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 310.019015][ T9399] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 310.029459][ T9399] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 310.048788][ T9399] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 310.053768][ T9399] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 310.057544][ T9399] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 310.062121][ T9399] usb usb1: Product: EHCI Host Controller [ 310.064492][ T9399] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 310.067093][ T9399] usb usb1: SerialNumber: 0000:00:1d.7 [ 310.078899][ T9399] hub 1-0:1.0: USB hub found [ 310.081241][ T9399] hub 1-0:1.0: 6 ports detected [ 310.127060][ T9399] hub 2-0:1.0: USB hub found [ 310.137839][ T9399] hub 2-0:1.0: 2 ports detected [ 310.179902][ T9399] hub 3-0:1.0: USB hub found [ 310.183960][ T9399] hub 3-0:1.0: 2 ports detected [ 310.220511][ T9399] hub 4-0:1.0: USB hub found [ 310.225488][ T9399] hub 4-0:1.0: 2 ports detected [ 310.238457][ T5818] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 310.378554][ T24] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 310.388752][ T5818] usb 8-1: Using ep0 maxpacket: 32 [ 310.392984][ T5818] usb 8-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 310.396699][ T5818] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 310.402323][ T5818] usb 8-1: config 0 descriptor?? [ 310.563085][ T24] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 310.566646][ T24] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 310.578486][ T24] usb 1-1: Product: QEMU USB Tablet [ 310.580787][ T24] usb 1-1: Manufacturer: QEMU [ 310.582673][ T24] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 310.615937][ T24] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.004F/input/input100 [ 310.622529][ T5818] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 310.629297][ T5818] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 310.632466][ T24] hid-generic 0003:0627:0001.004F: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 310.635145][ T5818] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 310.647195][ T5818] usb 8-1: media controller created [ 310.661813][ T5818] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 310.748491][ T6062] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 310.885036][ T9444] netlink: 20 bytes leftover after parsing attributes in process `syz.3.833'. [ 310.900004][ T6062] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 310.908483][ T6062] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 310.912590][ T6062] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 310.916453][ T6062] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 310.926387][ T6062] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 310.939470][ T6062] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 310.943140][ T6062] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 310.946314][ T6062] usb 5-1: Product: syz [ 310.948004][ T6062] usb 5-1: Manufacturer: syz [ 310.964730][ T6062] cdc_wdm 5-1:1.0: skipping garbage [ 310.969084][ T6062] cdc_wdm 5-1:1.0: skipping garbage [ 310.974752][ T6062] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 310.978947][ T6062] cdc_wdm 5-1:1.0: Unknown control protocol [ 310.985369][ T5818] az6027: usb out operation failed. (-71) [ 310.993378][ T5818] az6027: usb out operation failed. (-71) [ 310.997351][ T5818] stb0899_attach: Driver disabled by Kconfig [ 311.000464][ T5818] az6027: no front-end attached [ 311.000464][ T5818] [ 311.003171][ T5818] az6027: usb out operation failed. (-71) [ 311.005021][ T5818] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 311.008697][ T5818] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb8/8-1/input/input101 [ 311.015421][ T5818] dvb-usb: schedule remote query interval to 400 msecs. [ 311.018112][ T5818] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 311.024724][ T5818] usb 8-1: USB disconnect, device number 6 [ 311.055384][ T5818] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 311.191529][ T5110] usb 5-1: USB disconnect, device number 3 [ 311.498765][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 311.669863][ T9449] ehci-pci 0000:00:1d.7: remove, state 1 [ 311.672143][ T9449] usb usb1: USB disconnect, device number 1 [ 311.674642][ T9449] usb 1-1: USB disconnect, device number 2 [ 311.777407][ T5741] Bluetooth: hci2: unexpected event for opcode 0x202d [ 311.789736][ T5741] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 311.848165][ T5741] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 311.922357][ T5741] Bluetooth: hci3: unexpected event for opcode 0x202d [ 311.926528][ T5741] Bluetooth: hci3: SCO packet for unknown connection handle 201 [ 312.000345][ T9457] netlink: 'syz.3.837': attribute type 3 has an invalid length. [ 312.038888][ T9457] netlink: 24 bytes leftover after parsing attributes in process `syz.3.837'. [ 312.040139][ T9449] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 312.042302][ T5741] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 312.377084][ T9450] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 312.382400][ T9450] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 312.391129][ T9450] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 312.419853][ T9450] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 312.423550][ T9450] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 312.426439][ T9450] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 312.429926][ T9450] usb usb1: Product: EHCI Host Controller [ 312.432470][ T9450] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 312.435170][ T9450] usb usb1: SerialNumber: 0000:00:1d.7 [ 312.450414][ T9450] hub 1-0:1.0: USB hub found [ 312.453000][ T9450] hub 1-0:1.0: 6 ports detected [ 312.501213][ T9450] hub 2-0:1.0: USB hub found [ 312.503231][ T9450] hub 2-0:1.0: 2 ports detected [ 312.552708][ T9450] hub 3-0:1.0: USB hub found [ 312.555329][ T9450] hub 3-0:1.0: 2 ports detected [ 312.591397][ T9450] hub 4-0:1.0: USB hub found [ 312.594982][ T9450] hub 4-0:1.0: 2 ports detected [ 312.728520][ T24] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 312.838442][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 312.930198][ T24] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 312.945751][ T24] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 312.962993][ T24] usb 1-1: Product: QEMU USB Tablet [ 312.965339][ T24] usb 1-1: Manufacturer: QEMU [ 312.986784][ T24] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 313.037980][ T24] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0050/input/input102 [ 313.118980][ T24] hid-generic 0003:0627:0001.0050: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 313.612243][ T5741] Bluetooth: hci2: unexpected event for opcode 0x202d [ 313.620412][ T5741] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 313.673213][ T5741] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 314.371835][ T9490] NILFS (loop3): device size too small [ 314.942503][ T9504] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 314.944877][ T9504] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 314.956348][ T9504] vhci_hcd vhci_hcd.0: Device attached [ 315.228519][ T55] usb 38-1: SetAddress Request (26) to port 0 [ 315.230861][ T55] usb 38-1: new SuperSpeed USB device number 26 using vhci_hcd [ 315.643257][ T9] kernel write not supported for file /radio9 (pid: 9 comm: kworker/0:0) [ 315.673588][ T9505] vhci_hcd: connection reset by peer [ 315.681187][ T5849] vhci_hcd vhci_hcd.0: stop threads [ 315.687425][ T5849] vhci_hcd vhci_hcd.0: release socket [ 315.695934][ T5849] vhci_hcd vhci_hcd.0: disconnect device [ 315.754956][ T9517] FAULT_INJECTION: forcing a failure. [ 315.754956][ T9517] name failslab, interval 1, probability 0, space 0, times 0 [ 315.759751][ T9517] CPU: 1 UID: 0 PID: 9517 Comm: syz.2.850 Not tainted syzkaller #0 PREEMPT(full) [ 315.759778][ T9517] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 315.759785][ T9517] Call Trace: [ 315.759790][ T9517] [ 315.759794][ T9517] dump_stack_lvl+0x100/0x190 [ 315.759812][ T9517] should_fail_ex.cold+0x5/0xa [ 315.759825][ T9517] should_failslab+0xc2/0x120 [ 315.759842][ T9517] __kmalloc_node_track_caller_noprof+0xf9/0x830 [ 315.759858][ T9517] ? gadget_dev_desc_UDC_store+0x51/0x2e0 [ 315.759890][ T9517] kstrdup+0x51/0xe0 [ 315.759904][ T9517] gadget_dev_desc_UDC_store+0x51/0x2e0 [ 315.759921][ T9517] configfs_write_iter+0x302/0x4e0 [ 315.759935][ T9517] vfs_write+0x6ac/0x1050 [ 315.759947][ T9517] ? __pfx_configfs_write_iter+0x10/0x10 [ 315.759959][ T9517] ? __pfx_vfs_write+0x10/0x10 [ 315.759968][ T9517] ? find_held_lock+0x2b/0x80 [ 315.759992][ T9517] ksys_write+0x12a/0x250 [ 315.760002][ T9517] ? __pfx_ksys_write+0x10/0x10 [ 315.760013][ T9517] ? rcu_is_watching+0x12/0xc0 [ 315.760029][ T9517] __do_fast_syscall_32+0xe7/0x970 [ 315.760044][ T9517] ? lockdep_hardirqs_on+0x78/0x100 [ 315.760058][ T9517] do_fast_syscall_32+0x32/0x70 [ 315.760072][ T9517] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 315.760087][ T9517] RIP: 0023:0xf703efec [ 315.760100][ T9517] Code: Unable to access opcode bytes at 0xf703efc2. [ 315.760105][ T9517] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 315.760116][ T9517] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000d00 [ 315.760123][ T9517] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 315.760129][ T9517] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 315.760136][ T9517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 315.760142][ T9517] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 315.760156][ T9517] [ 315.912175][ T9519] netlink: 8 bytes leftover after parsing attributes in process `syz.4.852'. [ 315.917148][ T9519] netlink: 8 bytes leftover after parsing attributes in process `syz.4.852'. [ 315.948562][ T9519] macsec1: entered promiscuous mode [ 315.948600][ T9519] dummy0: entered promiscuous mode [ 315.950642][ T9519] macsec1: entered allmulticast mode [ 315.950678][ T9519] dummy0: entered allmulticast mode [ 316.459222][ T5741] Bluetooth: hci3: unexpected event for opcode 0x202d [ 316.489408][ T5741] Bluetooth: hci3: SCO packet for unknown connection handle 201 [ 316.610078][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.616853][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.791256][ T5741] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 317.483139][ T5741] Bluetooth: hci0: unexpected event for opcode 0x202d [ 317.486255][ T5741] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 317.522827][ T9527] netlink: 8 bytes leftover after parsing attributes in process `syz.2.855'. [ 317.529455][ T9527] openvswitch: netlink: Flow key attr not present in new flow. [ 317.562124][ T5741] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 317.609602][ T9531] ehci-pci 0000:00:1d.7: remove, state 1 [ 317.612033][ T9531] usb usb1: USB disconnect, device number 1 [ 317.614617][ T9531] usb 1-1: USB disconnect, device number 2 [ 317.776157][ T9534] netlink: 'syz.4.856': attribute type 3 has an invalid length. [ 317.798241][ T9534] netlink: 24 bytes leftover after parsing attributes in process `syz.4.856'. [ 318.006832][ T9531] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 318.268614][ T3980] usb 2-1: new full-speed USB device number 51 using uhci_hcd [ 318.445746][ T3980] usb 2-1: not running at top speed; connect to a high speed hub [ 318.469817][ T3980] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 318.476964][ T3980] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 318.484413][ T3980] usb 2-1: Product: QEMU USB Tablet [ 318.486171][ T3980] usb 2-1: Manufacturer: QEMU [ 318.492643][ T3980] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 318.516348][ T3980] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0051/input/input103 [ 318.602168][ T3980] hid-generic 0003:0627:0001.0051: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 318.622204][ T9532] usb 2-1: USB disconnect, device number 51 [ 318.638743][ T5741] Bluetooth: hci0: unexpected event for opcode 0x202d [ 318.640993][ T5741] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 318.711299][ T5741] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 318.725792][ T9542] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 318.727856][ T9542] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 318.741918][ T9542] vhci_hcd vhci_hcd.0: Device attached [ 318.833084][ T9545] fido_id[9545]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 318.899322][ T9532] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 318.912134][ T9532] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 318.917240][ T9547] netlink: 12 bytes leftover after parsing attributes in process `syz.2.855'. [ 318.926973][ T9532] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 318.949726][ T9532] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 318.951270][ T9532] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 318.951287][ T9532] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 318.951297][ T9532] usb usb1: Product: EHCI Host Controller [ 318.951306][ T9532] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 318.951315][ T9532] usb usb1: SerialNumber: 0000:00:1d.7 [ 318.960715][ T9532] hub 1-0:1.0: USB hub found [ 318.960980][ T9532] hub 1-0:1.0: 6 ports detected [ 319.002422][ T9532] hub 2-0:1.0: USB hub found [ 319.002583][ T9532] hub 2-0:1.0: 2 ports detected [ 319.029707][ T3980] usb 42-1: SetAddress Request (30) to port 0 [ 319.029806][ T3980] usb 42-1: new SuperSpeed USB device number 30 using vhci_hcd [ 319.040920][ T9532] hub 3-0:1.0: USB hub found [ 319.042801][ T9532] hub 3-0:1.0: 2 ports detected [ 319.082568][ T9532] hub 4-0:1.0: USB hub found [ 319.084662][ T9532] hub 4-0:1.0: 2 ports detected [ 319.238525][ T5828] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 319.275495][ T9543] vhci_hcd: connection reset by peer [ 319.281345][ T5849] vhci_hcd vhci_hcd.2: stop threads [ 319.283638][ T5849] vhci_hcd vhci_hcd.2: release socket [ 319.286076][ T5849] vhci_hcd vhci_hcd.2: disconnect device [ 319.433061][ T5828] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 319.436530][ T5828] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 319.439377][ T5828] usb 1-1: Product: QEMU USB Tablet [ 319.441565][ T5828] usb 1-1: Manufacturer: QEMU [ 319.443122][ T5828] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 319.468178][ T5828] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0052/input/input104 [ 319.532252][ T5828] hid-generic 0003:0627:0001.0052: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 319.561450][ T9553] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 319.563480][ T9553] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 319.567488][ T9553] vhci_hcd vhci_hcd.0: Device attached [ 319.868555][ T5992] usb 46-1: SetAddress Request (10) to port 0 [ 319.870567][ T5992] usb 46-1: new SuperSpeed USB device number 10 using vhci_hcd [ 320.004513][ T9563] netlink: 24 bytes leftover after parsing attributes in process `syz.0.862'. [ 320.057886][ T9554] vhci_hcd: connection reset by peer [ 320.066049][ T5849] vhci_hcd vhci_hcd.4: stop threads [ 320.070218][ T5849] vhci_hcd vhci_hcd.4: release socket [ 320.077815][ T5849] vhci_hcd vhci_hcd.4: disconnect device [ 320.130525][ T5741] Bluetooth: hci1: unexpected event for opcode 0x202d [ 320.143231][ T5741] Bluetooth: hci1: SCO packet for unknown connection handle 201 [ 320.185850][ T5741] Bluetooth: hci3: unexpected event for opcode 0x202d [ 320.196877][ T9568] tc action pedit offset 132 out of bounds [ 320.200063][ T9568] tc action pedit offset 132 out of bounds [ 320.202339][ T9568] tc action pedit offset 132 out of bounds [ 320.204122][ T9568] tc action pedit offset 132 out of bounds [ 320.206441][ T9568] tc action pedit offset 132 out of bounds [ 320.208502][ T9568] tc action pedit offset 132 out of bounds [ 320.210409][ T9568] tc action pedit offset 132 out of bounds [ 320.212748][ T9568] tc action pedit offset 132 out of bounds [ 320.214693][ T9568] tc action pedit offset 132 out of bounds [ 320.216735][ T9568] tc action pedit offset 132 out of bounds [ 320.219113][ T9568] 0: reclassify loop, rule prio 0, protocol 800 [ 320.292385][ T55] usb 38-1: device descriptor read/8, error -110 [ 320.293405][ T5741] Bluetooth: hci3: SCO packet for unknown connection handle 201 [ 320.301121][ T5741] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 320.547665][ T9575] ehci-pci 0000:00:1d.7: remove, state 1 [ 320.550660][ T9575] usb usb1: USB disconnect, device number 1 [ 320.553918][ T9575] usb 1-1: USB disconnect, device number 2 [ 320.687648][ T9577] netlink: 'syz.3.866': attribute type 3 has an invalid length. [ 320.697895][ T9577] netlink: 24 bytes leftover after parsing attributes in process `syz.3.866'. [ 321.068288][ T5741] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 321.559817][ T9575] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 321.687258][ T9587] FAULT_INJECTION: forcing a failure. [ 321.687258][ T9587] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 321.694782][ T55] usb usb38-port1: attempt power cycle [ 321.713874][ T9587] CPU: 1 UID: 0 PID: 9587 Comm: syz.4.869 Not tainted syzkaller #0 PREEMPT(full) [ 321.713899][ T9587] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 321.713909][ T9587] Call Trace: [ 321.713915][ T9587] [ 321.713922][ T9587] dump_stack_lvl+0x100/0x190 [ 321.713946][ T9587] should_fail_ex.cold+0x5/0xa [ 321.713967][ T9587] _copy_from_user+0x2e/0xd0 [ 321.713992][ T9587] drm_ioctl+0x520/0xc60 [ 321.714018][ T9587] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 321.714040][ T9587] ? __pfx_drm_ioctl+0x10/0x10 [ 321.714081][ T9587] drm_compat_ioctl+0x386/0x4c0 [ 321.714110][ T9587] ? __pfx_drm_compat_ioctl+0x10/0x10 [ 321.714136][ T9587] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 321.714165][ T9587] __do_fast_syscall_32+0xe7/0x970 [ 321.714189][ T9587] ? lockdep_hardirqs_on+0x78/0x100 [ 321.714227][ T9587] do_fast_syscall_32+0x32/0x70 [ 321.714250][ T9587] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 321.714272][ T9587] RIP: 0023:0xf707efec [ 321.714292][ T9587] Code: Unable to access opcode bytes at 0xf707efc2. [ 321.714300][ T9587] RSP: 002b:00000000f546d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 321.714318][ T9587] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c06864a2 [ 321.714329][ T9587] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 321.714340][ T9587] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 321.714351][ T9587] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 321.714361][ T9587] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 321.714384][ T9587] [ 321.838564][ T5851] usb 2-1: new full-speed USB device number 52 using uhci_hcd [ 322.269011][ T55] usb usb38-port1: unable to enumerate USB device [ 322.458514][ T5851] usb 2-1: not running at top speed; connect to a high speed hub [ 322.778313][ T5851] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 322.787757][ T5851] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 322.791628][ T5851] usb 2-1: Product: QEMU USB Tablet [ 322.793321][ T5851] usb 2-1: Manufacturer: QEMU [ 322.794877][ T5851] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 322.820508][ T5851] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0053/input/input105 [ 322.890794][ T5851] hid-generic 0003:0627:0001.0053: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 322.904148][ T9576] usb 2-1: USB disconnect, device number 52 [ 323.158962][ T9599] ip6gretap0: entered promiscuous mode [ 323.202383][ T9576] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 323.211837][ T9601] fido_id[9601]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 323.219503][ T9576] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 323.236795][ T9576] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 323.266848][ T9576] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 323.298729][ T9576] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 323.302547][ T9576] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 323.305994][ T9576] usb usb1: Product: EHCI Host Controller [ 323.308523][ T9576] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 323.311327][ T9576] usb usb1: SerialNumber: 0000:00:1d.7 [ 323.573151][ T9576] hub 1-0:1.0: USB hub found [ 323.647934][ T9576] hub 1-0:1.0: 6 ports detected [ 323.713030][ T5741] Bluetooth: hci2: unexpected event for opcode 0x202d [ 323.729647][ T5741] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 323.782984][ T5741] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 323.799936][ T9576] hub 2-0:1.0: USB hub found [ 323.802712][ T9576] hub 2-0:1.0: 2 ports detected [ 323.850001][ T9576] hub 3-0:1.0: USB hub found [ 323.852824][ T9576] hub 3-0:1.0: 2 ports detected [ 323.902959][ T9576] hub 4-0:1.0: USB hub found [ 323.958863][ T9576] hub 4-0:1.0: 2 ports detected [ 324.018933][ T6543] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 324.128877][ T3980] usb 42-1: device descriptor read/8, error -110 [ 324.143079][ T9614] input: syz0 as /devices/virtual/input/input106 [ 324.236048][ T6543] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 324.245810][ T6543] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 324.258542][ T6543] usb 1-1: Product: QEMU USB Tablet [ 324.261567][ T6543] usb 1-1: Manufacturer: QEMU [ 324.263997][ T6543] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 324.350091][ T6543] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0054/input/input107 [ 324.385876][ T9622] netlink: 16 bytes leftover after parsing attributes in process `syz.3.878'. [ 324.424966][ T6543] hid-generic 0003:0627:0001.0054: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 324.528932][ T3980] usb usb42-port1: attempt power cycle [ 325.093701][ T9629] netlink: 4 bytes leftover after parsing attributes in process `syz.2.880'. [ 325.471883][ T5992] usb 46-1: device descriptor read/8, error -110 [ 325.897159][ T3980] usb usb42-port1: unable to enumerate USB device [ 325.962676][ T9638] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 325.964712][ T9638] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 325.975257][ T9638] vhci_hcd vhci_hcd.0: Device attached [ 326.246059][ T9650] Invalid ELF header magic: != ELF [ 326.542969][ T149] usb 42-1: SetAddress Request (34) to port 0 [ 326.545416][ T149] usb 42-1: new SuperSpeed USB device number 34 using vhci_hcd [ 326.882039][ T5992] usb usb46-port1: attempt power cycle [ 326.981962][ T9653] ehci-pci 0000:00:1d.7: remove, state 1 [ 326.984379][ T9653] usb usb1: USB disconnect, device number 1 [ 326.986890][ T9653] usb 1-1: USB disconnect, device number 2 [ 327.141115][ T9639] vhci_hcd: connection reset by peer [ 327.144524][ T5849] vhci_hcd vhci_hcd.2: stop threads [ 327.152045][ T5849] vhci_hcd vhci_hcd.2: release socket [ 327.157367][ T5849] vhci_hcd vhci_hcd.2: disconnect device [ 327.159074][ T9655] netlink: 'syz.0.884': attribute type 3 has an invalid length. [ 327.181313][ T9655] netlink: 24 bytes leftover after parsing attributes in process `syz.0.884'. [ 327.243681][ T9653] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 327.449450][ T5992] usb usb46-port1: unable to enumerate USB device [ 327.508518][ T5971] usb 2-1: new full-speed USB device number 53 using uhci_hcd [ 327.696253][ T5971] usb 2-1: not running at top speed; connect to a high speed hub [ 327.731359][ T5971] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 327.740544][ T5971] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 327.755729][ T5971] usb 2-1: Product: QEMU USB Tablet [ 327.761526][ T5971] usb 2-1: Manufacturer: QEMU [ 327.767333][ T5971] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 327.815673][ T5971] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0055/input/input108 [ 327.896779][ T5971] hid-generic 0003:0627:0001.0055: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 327.933301][ T9654] usb 2-1: USB disconnect, device number 53 [ 328.087803][ T9664] fido_id[9664]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 328.202741][ T9654] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 328.211636][ T9654] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 328.237002][ T9654] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 328.269643][ T9654] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 328.282358][ T9654] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 328.295854][ T9654] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 328.314345][ T9654] usb usb1: Product: EHCI Host Controller [ 328.319083][ T9654] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 328.332304][ T9654] usb usb1: SerialNumber: 0000:00:1d.7 [ 328.362320][ T9654] hub 1-0:1.0: USB hub found [ 328.369078][ T9654] hub 1-0:1.0: 6 ports detected [ 328.432016][ T9654] hub 2-0:1.0: USB hub found [ 328.438344][ T9654] hub 2-0:1.0: 2 ports detected [ 328.479818][ T9654] hub 3-0:1.0: USB hub found [ 328.486362][ T9654] hub 3-0:1.0: 2 ports detected [ 328.512202][ T9670] netlink: 16 bytes leftover after parsing attributes in process `syz.4.888'. [ 328.530854][ T9654] hub 4-0:1.0: USB hub found [ 328.540002][ T9654] hub 4-0:1.0: 2 ports detected [ 328.690319][ T5992] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 328.894123][ T5992] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 328.905458][ T5992] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 328.923760][ T5992] usb 1-1: Product: QEMU USB Tablet [ 328.928807][ T5992] usb 1-1: Manufacturer: QEMU [ 328.937412][ T5992] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 329.003308][ T5992] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0056/input/input109 [ 329.081630][ T5992] hid-generic 0003:0627:0001.0056: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 329.207911][ T9679] netlink: 20 bytes leftover after parsing attributes in process `syz.2.891'. [ 329.279263][ T9] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 329.428748][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 329.432529][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 329.443388][ T9] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 329.448548][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 329.452085][ T9] usb 5-1: Product: syz [ 329.456355][ T9] usb 5-1: Manufacturer: syz [ 329.462195][ T9] usb 5-1: SerialNumber: syz [ 329.465563][ T9] usb 5-1: config 0 descriptor?? [ 329.473301][ T9] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 329.478765][ T9] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 329.945205][ T9684] input: syz0 as /devices/virtual/input/input110 [ 330.001258][ T5741] Bluetooth: hci3: unexpected event for opcode 0x202d [ 330.004871][ T5741] Bluetooth: hci3: SCO packet for unknown connection handle 201 [ 330.063126][ T5741] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 330.139885][ T9] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 330.573360][ T9] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 330.576226][ T9] em28xx 5-1:0.0: board has no eeprom [ 331.288846][ T5739] ffs_data_put(): freeing [ 331.568515][ T149] usb 42-1: device descriptor read/8, error -110 [ 331.734971][ T9675] em28xx 5-1:0.0: reading from i2c device at 0xe failed (error=-5) [ 331.788542][ T9] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 331.791214][ T9] em28xx 5-1:0.0: dvb set to bulk mode. [ 331.795797][ T5820] em28xx 5-1:0.0: Binding DVB extension [ 331.801966][ T5828] usb 5-1: USB disconnect, device number 4 [ 331.808947][ T5828] em28xx 5-1:0.0: Disconnecting em28xx [ 331.843783][ T5820] em28xx 5-1:0.0: Registering input extension [ 331.853018][ T5828] em28xx 5-1:0.0: Closing input extension [ 331.875765][ T5828] em28xx 5-1:0.0: Freeing device [ 331.878488][ T9720] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 331.880506][ T9720] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 331.884209][ T9720] vhci_hcd vhci_hcd.0: Device attached [ 332.128469][ T5992] usb 43-1: new high-speed USB device number 2 using vhci_hcd [ 332.218543][ T5820] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 332.329741][ T9721] vhci_hcd: connection reset by peer [ 332.339761][ T9255] vhci_hcd vhci_hcd.3: stop threads [ 332.341995][ T9255] vhci_hcd vhci_hcd.3: release socket [ 332.345893][ T9255] vhci_hcd vhci_hcd.3: disconnect device [ 332.384237][ T9729] FAULT_INJECTION: forcing a failure. [ 332.384237][ T9729] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 332.384268][ T9729] CPU: 0 UID: 0 PID: 9729 Comm: syz.0.904 Not tainted syzkaller #0 PREEMPT(full) [ 332.384281][ T9729] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 332.384287][ T9729] Call Trace: [ 332.384291][ T9729] [ 332.384295][ T9729] dump_stack_lvl+0x100/0x190 [ 332.384311][ T9729] should_fail_ex.cold+0x5/0xa [ 332.384324][ T9729] _copy_to_user+0x32/0xd0 [ 332.384342][ T9729] simple_read_from_buffer+0xcb/0x170 [ 332.384362][ T9729] proc_fail_nth_read+0x1af/0x230 [ 332.384377][ T9729] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 332.384393][ T9729] ? rw_verify_area+0xce/0x6d0 [ 332.384409][ T9729] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 332.384424][ T9729] vfs_read+0x1e4/0xb40 [ 332.384443][ T9729] ? __pfx_vfs_read+0x10/0x10 [ 332.384460][ T9729] ? find_held_lock+0x2b/0x80 [ 332.384474][ T9729] ? __fget_files+0x215/0x3d0 [ 332.384486][ T9729] ? __fget_files+0x21f/0x3d0 [ 332.384500][ T9729] ksys_read+0x12a/0x250 [ 332.384510][ T9729] ? __pfx_ksys_read+0x10/0x10 [ 332.384523][ T9729] do_int80_emulation+0x14b/0x720 [ 332.384547][ T9729] asm_int80_emulation+0x1a/0x20 [ 332.384558][ T9729] RIP: 0023:0xf71f72eb [ 332.384567][ T9729] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 332.384578][ T9729] RSP: 002b:00000000f54ad4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 332.384589][ T9729] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54ad5d0 [ 332.384595][ T9729] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 332.384602][ T9729] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 332.384608][ T9729] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 332.384614][ T9729] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 332.384628][ T9729] [ 332.388564][ T5820] usb 9-1: Using ep0 maxpacket: 16 [ 332.389964][ T5820] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 332.391533][ T5820] usb 9-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 332.391549][ T5820] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 332.391559][ T5820] usb 9-1: Product: syz [ 332.391567][ T5820] usb 9-1: Manufacturer: syz [ 332.391575][ T5820] usb 9-1: SerialNumber: syz [ 332.393195][ T5820] usb 9-1: config 0 descriptor?? [ 332.397500][ T5820] em28xx 9-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 332.397525][ T5820] em28xx 9-1:0.0: DVB interface 0 found: bulk [ 332.443082][ T36] Bluetooth: hci4: Frame reassembly failed (-84) [ 332.549401][ T149] usb usb42-port1: attempt power cycle [ 332.604822][ T64] Bluetooth: hci3: unexpected event for opcode 0x202d [ 332.607720][ T64] Bluetooth: hci3: SCO packet for unknown connection handle 201 [ 332.663804][ T64] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 333.004745][ T5820] em28xx 9-1:0.0: unknown em28xx chip ID (0) [ 333.129439][ T149] usb usb42-port1: unable to enumerate USB device [ 333.264047][ T5739] ffs_data_put(): freeing [ 333.436809][ T5820] em28xx 9-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 333.442793][ T5820] em28xx 9-1:0.0: board has no eeprom [ 333.489611][ T9725] em28xx 9-1:0.0: reading from i2c device at 0xe failed (error=-5) [ 333.578507][ T55] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 333.609065][ T5820] em28xx 9-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 333.611531][ T5820] em28xx 9-1:0.0: dvb set to bulk mode. [ 333.616338][ T9] em28xx 9-1:0.0: Binding DVB extension [ 333.624948][ T5820] usb 9-1: USB disconnect, device number 3 [ 333.627762][ T5820] em28xx 9-1:0.0: Disconnecting em28xx [ 333.659403][ T9] em28xx 9-1:0.0: Registering input extension [ 333.661723][ T5820] em28xx 9-1:0.0: Closing input extension [ 333.708664][ T5820] em28xx 9-1:0.0: Freeing device [ 333.728654][ T55] usb 8-1: device descriptor read/64, error -71 [ 333.887783][ T9749] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 334.193365][ T9757] netlink: 4 bytes leftover after parsing attributes in process `syz.4.913'. [ 334.258284][ T9757] bond2: (slave bond_slave_1): Device is not our slave [ 334.261364][ T9757] bond2: option active_slave: invalid value (bond_slave_1) [ 334.266494][ T9757] bond2 (unregistering): Released all slaves [ 334.450651][ T64] Bluetooth: hci4: command 0x1003 tx timeout [ 334.454768][ T5741] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 334.529723][ T9763] FAULT_INJECTION: forcing a failure. [ 334.529723][ T9763] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 334.534750][ T9763] CPU: 2 UID: 0 PID: 9763 Comm: syz.4.914 Not tainted syzkaller #0 PREEMPT(full) [ 334.534773][ T9763] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 334.534784][ T9763] Call Trace: [ 334.534790][ T9763] [ 334.534798][ T9763] dump_stack_lvl+0x100/0x190 [ 334.534822][ T9763] should_fail_ex.cold+0x5/0xa [ 334.534843][ T9763] _copy_from_iter+0x1f4/0x1690 [ 334.534873][ T9763] ? __asan_memset+0x23/0x50 [ 334.534892][ T9763] ? __pfx__copy_from_iter+0x10/0x10 [ 334.534917][ T9763] ? __pfx___alloc_skb+0x10/0x10 [ 334.534949][ T9763] netlink_sendmsg+0x808/0xda0 [ 334.534971][ T9763] ? __pfx_netlink_sendmsg+0x10/0x10 [ 334.534999][ T9763] ? apparmor_socket_sendmsg+0x15b/0x270 [ 334.535023][ T9763] ____sys_sendmsg+0xa4d/0xbe0 [ 334.535038][ T9763] ? __pfx_netlink_sendmsg+0x10/0x10 [ 334.535058][ T9763] ? __pfx_____sys_sendmsg+0x10/0x10 [ 334.535087][ T9763] ___sys_sendmsg+0x190/0x1e0 [ 334.535107][ T9763] ? __pfx____sys_sendmsg+0x10/0x10 [ 334.535137][ T9763] ? find_held_lock+0x2b/0x80 [ 334.535176][ T9763] __sys_sendmsg+0x160/0x210 [ 334.535200][ T9763] ? __pfx___sys_sendmsg+0x10/0x10 [ 334.535230][ T9763] ? __pfx_ksys_write+0x10/0x10 [ 334.535252][ T9763] __do_fast_syscall_32+0xe7/0x970 [ 334.535274][ T9763] ? lockdep_hardirqs_on+0x78/0x100 [ 334.535296][ T9763] do_fast_syscall_32+0x32/0x70 [ 334.535317][ T9763] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 334.535339][ T9763] RIP: 0023:0xf707efec [ 334.535358][ T9763] Code: Unable to access opcode bytes at 0xf707efc2. [ 334.535366][ T9763] RSP: 002b:00000000f546d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 334.535383][ T9763] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000440 [ 334.535394][ T9763] RDX: 0000000000004000 RSI: 0000000000000000 RDI: 0000000000000000 [ 334.535404][ T9763] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 334.535413][ T9763] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 334.535439][ T9763] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 334.535462][ T9763] [ 334.537326][ T55] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 334.725870][ T9771] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 334.950491][ T55] usb 8-1: device descriptor read/64, error -71 [ 335.059230][ T55] usb usb8-port1: attempt power cycle [ 335.079599][ T5741] Bluetooth: hci2: unexpected event for opcode 0x202d [ 335.086057][ T5741] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 335.198485][ T5741] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 335.409999][ T55] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 335.661007][ T55] usb 8-1: device descriptor read/8, error -71 [ 335.665770][ T9782] bridge1: left promiscuous mode [ 335.671351][ T9782] bridge2: left promiscuous mode [ 335.694058][ T9786] afs: Unknown parameter 'euid>00000000000000000000' [ 335.775996][ T9788] FAULT_INJECTION: forcing a failure. [ 335.775996][ T9788] name failslab, interval 1, probability 0, space 0, times 0 [ 335.781293][ T9788] CPU: 3 UID: 0 PID: 9788 Comm: syz.0.923 Not tainted syzkaller #0 PREEMPT(full) [ 335.781309][ T9788] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 335.781316][ T9788] Call Trace: [ 335.781320][ T9788] [ 335.781325][ T9788] dump_stack_lvl+0x100/0x190 [ 335.781342][ T9788] should_fail_ex.cold+0x5/0xa [ 335.781355][ T9788] should_failslab+0xc2/0x120 [ 335.781371][ T9788] kmem_cache_alloc_noprof+0x91/0x6a0 [ 335.781386][ T9788] ? dst_alloc+0x99/0x1a0 [ 335.781408][ T9788] dst_alloc+0x99/0x1a0 [ 335.781423][ T9788] rt_dst_alloc+0x35/0x3a0 [ 335.781436][ T9788] ip_route_output_key_hash_rcu+0x87a/0x2870 [ 335.781457][ T9788] ip_route_output_key_hash+0x118/0x2b0 [ 335.781474][ T9788] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 335.781491][ T9788] ? bpf_ksym_find+0x124/0x1c0 [ 335.781506][ T9788] ? kernel_text_address+0x8d/0x100 [ 335.781526][ T9788] tcp_v4_connect+0x86b/0x1b40 [ 335.781546][ T9788] ? __pfx_tcp_v4_connect+0x10/0x10 [ 335.781562][ T9788] ? __lock_acquire+0x49f/0x1a40 [ 335.781609][ T9788] ? __lock_acquire+0x49f/0x1a40 [ 335.781630][ T9788] __inet_stream_connect+0x208/0xfa0 [ 335.781660][ T9788] ? __pfx___inet_stream_connect+0x10/0x10 [ 335.781675][ T9788] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 335.781691][ T9788] ? __local_bh_enable_ip+0x9e/0x120 [ 335.781705][ T9788] inet_stream_connect+0x57/0xa0 [ 335.781720][ T9788] kernel_connect+0x107/0x160 [ 335.781737][ T9788] ? __pfx_kernel_connect+0x10/0x10 [ 335.781760][ T9788] ? __local_bh_enable_ip+0x9e/0x120 [ 335.781774][ T9788] smc_connect+0x394/0x750 [ 335.781789][ T9788] ? __pfx_smc_connect+0x10/0x10 [ 335.781800][ T9788] __sys_connect_file+0x141/0x1a0 [ 335.781814][ T9788] __sys_connect+0x141/0x170 [ 335.781827][ T9788] ? __pfx___sys_connect+0x10/0x10 [ 335.781839][ T9788] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 335.781859][ T9788] ? ksys_write+0x1ac/0x250 [ 335.781870][ T9788] ? __pfx_ksys_write+0x10/0x10 [ 335.781881][ T9788] __ia32_sys_connect+0x71/0xb0 [ 335.781894][ T9788] ? lockdep_hardirqs_on+0x78/0x100 [ 335.781907][ T9788] __do_fast_syscall_32+0xe7/0x970 [ 335.781920][ T9788] ? lockdep_hardirqs_on+0x78/0x100 [ 335.781933][ T9788] do_fast_syscall_32+0x32/0x70 [ 335.781948][ T9788] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 335.781963][ T9788] RIP: 0023:0xf70befec [ 335.781977][ T9788] Code: Unable to access opcode bytes at 0xf70befc2. [ 335.781982][ T9788] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 000000000000016a [ 335.781993][ T9788] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 335.782001][ T9788] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 335.782007][ T9788] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 335.782013][ T9788] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 335.782019][ T9788] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 335.782033][ T9788] [ 335.908707][ T55] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 335.939664][ T55] usb 8-1: device descriptor read/8, error -71 [ 336.049413][ T55] usb usb8-port1: unable to enumerate USB device [ 336.304574][ T9797] ehci-pci 0000:00:1d.7: remove, state 1 [ 336.306499][ T9797] usb usb1: USB disconnect, device number 1 [ 336.308734][ T9797] usb 1-1: USB disconnect, device number 2 [ 336.491414][ T9797] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 336.554628][ T9796] netlink: 'syz.2.925': attribute type 3 has an invalid length. [ 336.562004][ T9796] netlink: 24 bytes leftover after parsing attributes in process `syz.2.925'. [ 336.630515][ T9805] typec_fusb302 0-0022: supply vbus not found, using dummy regulator [ 336.650631][ T9807] typec_fusb302 1-0022: I2C/SMBus block functionality not supported! [ 336.664303][ T9805] typec_fusb302 0-0022: failed to request gpio_int_n [ 336.678745][ T9807] i2c i2c-1: new_device: Instantiated device typec_fusb302 at 0x22 [ 336.725893][ T9805] typec_fusb302 0-0022: probe with driver typec_fusb302 failed with error -2 [ 336.744995][ T9805] i2c i2c-0: new_device: Instantiated device typec_fusb302 at 0x22 [ 336.768529][ T55] usb 2-1: new full-speed USB device number 54 using uhci_hcd [ 336.869115][ T9811] netlink: 16 bytes leftover after parsing attributes in process `syz.3.929'. [ 336.944127][ T55] usb 2-1: not running at top speed; connect to a high speed hub [ 336.965870][ T55] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 336.969257][ T55] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 336.971776][ T55] usb 2-1: Product: QEMU USB Tablet [ 336.973464][ T55] usb 2-1: Manufacturer: QEMU [ 336.974990][ T55] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 337.000678][ T55] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0057/input/input113 [ 337.072280][ T55] hid-generic 0003:0627:0001.0057: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 337.096116][ T9800] usb 2-1: USB disconnect, device number 54 [ 337.205665][ T9816] fido_id[9816]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 337.248498][ T5992] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 337.288963][ T9800] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 337.294882][ T9800] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 337.302441][ T9800] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 337.862584][ T9819] loop8: detected capacity change from 0 to 7 [ 337.876461][ T9819] Dev loop8: unable to read RDB block 7 [ 337.879010][ T9819] loop8: unable to read partition table [ 337.882255][ T9819] loop8: partition table beyond EOD, truncated [ 337.884769][ T9819] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 337.980501][ T9800] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 337.991391][ T9800] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 337.994929][ T9800] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 337.997670][ T9800] usb usb1: Product: EHCI Host Controller [ 338.001186][ T9800] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 338.005119][ T9800] usb usb1: SerialNumber: 0000:00:1d.7 [ 338.017043][ T9800] hub 1-0:1.0: USB hub found [ 338.022533][ T9800] hub 1-0:1.0: 6 ports detected [ 338.076546][ T9800] hub 2-0:1.0: USB hub found [ 338.083506][ T9800] hub 2-0:1.0: 2 ports detected [ 338.092964][ T9827] 9pnet_fd: p9_fd_create_tcp (9827): problem connecting socket to 127.0.0.1 [ 338.163618][ T9800] hub 3-0:1.0: USB hub found [ 338.171039][ T9800] hub 3-0:1.0: 2 ports detected [ 338.232846][ T9800] hub 4-0:1.0: USB hub found [ 338.241859][ T9800] hub 4-0:1.0: 2 ports detected [ 338.307690][ T9828] e1000e 0000:00:02.0 eth1: removed PHC [ 338.308522][ T24] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 338.491822][ T9828] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 338.499584][ T24] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 338.503418][ T24] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 338.506654][ T24] usb 1-1: Product: QEMU USB Tablet [ 338.508871][ T24] usb 1-1: Manufacturer: QEMU [ 338.510751][ T24] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 338.553356][ T24] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0058/input/input114 [ 338.620844][ T24] hid-generic 0003:0627:0001.0058: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 338.751030][ T9837] netlink: 8 bytes leftover after parsing attributes in process `syz.2.935'. [ 338.801042][ T5741] Bluetooth: hci1: unexpected event for opcode 0x202d [ 338.829455][ T5741] Bluetooth: hci1: SCO packet for unknown connection handle 201 [ 338.840551][ T9829] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 338.899961][ T9829] pci 0000:00:01.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 338.902225][ T5741] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 338.915670][ T9829] pci 0000:00:01.0: BAR 2 [mem 0xfeaf4000-0xfeaf4fff] [ 338.938735][ T9829] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 338.951282][ T9829] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 339.062927][ T9829] pci 0000:00:01.0: Adding to iommu group 1 [ 339.129036][ T9829] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 339.131973][ T9829] pci 0000:00:01.0: vgaarb: bridge control possible [ 339.134544][ T9829] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 339.163580][ T9829] pci 0000:00:02.0: [8086:10d3] type 00 class 0x020000 PCIe Root Complex Integrated Endpoint [ 339.181355][ T9829] pci 0000:00:02.0: BAR 0 [mem 0xfea80000-0xfea9ffff] [ 339.184958][ T9829] pci 0000:00:02.0: BAR 1 [mem 0xfeaa0000-0xfeabffff] [ 339.188989][ T9829] pci 0000:00:02.0: BAR 2 [io 0xc080-0xc09f] [ 339.193585][ T9829] pci 0000:00:02.0: BAR 3 [mem 0xfeaf0000-0xfeaf3fff] [ 339.197182][ T9829] pci 0000:00:02.0: ROM [mem 0xfea00000-0xfea3ffff pref] [ 339.199099][ T9878] netlink: 16 bytes leftover after parsing attributes in process `syz.2.939'. [ 339.203882][ T9829] pci 0000:00:02.0: enabling Extended Tags [ 339.231415][ T9829] pci 0000:00:02.0: Adding to iommu group 2 [ 339.266822][ T9829] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 339.274229][ T9829] pci 0000:00:02.0: ROM [mem 0x81000000-0x8103ffff pref]: assigned [ 339.277371][ T9829] pci 0000:00:02.0: BAR 0 [mem 0x81040000-0x8105ffff]: assigned [ 339.281556][ T9829] pci 0000:00:02.0: BAR 1 [mem 0x81060000-0x8107ffff]: assigned [ 339.285730][ T9829] pci 0000:00:02.0: BAR 3 [mem 0x81080000-0x81083fff]: assigned [ 339.290004][ T9829] pci 0000:00:01.0: BAR 2 [mem 0x81084000-0x81084fff]: assigned [ 339.294523][ T9829] pci 0000:00:02.0: BAR 2 [io 0x2000-0x201f]: assigned [ 339.310464][ T9829] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 339.354857][ T9829] [drm] Found bochs VGA, ID 0xb0c5. [ 339.360094][ T9829] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81084000. [ 339.405660][ T9829] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 339.493935][ T9829] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 339.626402][ T9829] e1000e 0000:00:02.0: Interrupt Throttling Rate (ints/sec) set to dynamic conservative mode [ 339.715408][ T9829] e1000e 0000:00:02.0 0000:00:02.0 (uninitialized): registered PHC clock [ 339.887770][ T9829] e1000e 0000:00:02.0 eth1: (PCI Express:2.5GT/s:Width x1) 52:54:00:12:34:56 [ 339.903529][ T9829] e1000e 0000:00:02.0 eth1: Intel(R) PRO/1000 Network Connection [ 339.908336][ T9829] e1000e 0000:00:02.0 eth1: MAC: 3, PHY: 8, PBA No: 000000-000 [ 340.193084][ T9905] 8021q: adding VLAN 0 to HW filter on device bond1 [ 340.370885][ T9914] ehci-pci 0000:00:1d.7: remove, state 1 [ 340.373000][ T9914] usb usb1: USB disconnect, device number 1 [ 340.375050][ T9914] usb 1-1: USB disconnect, device number 2 [ 340.405990][ T5453] 8021q: adding VLAN 0 to HW filter on device eth1 [ 340.505506][ T9918] netlink: 'syz.2.943': attribute type 3 has an invalid length. [ 340.521432][ T9918] netlink: 24 bytes leftover after parsing attributes in process `syz.2.943'. [ 340.652154][ T9914] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 341.345267][ T9915] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 341.353554][ T9915] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 341.362592][ T9915] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 341.379222][ T9915] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 341.383986][ T9915] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 341.387408][ T5851] e1000e 0000:00:02.0 eth1: NIC Link is Up 1000 Mbps Full Duplex, Flow Control: Rx/Tx [ 341.388139][ T9915] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 341.398086][ T9915] usb usb1: Product: EHCI Host Controller [ 341.408106][ T9915] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 341.413338][ T9915] usb usb1: SerialNumber: 0000:00:1d.7 [ 341.433903][ T9915] hub 1-0:1.0: USB hub found [ 341.451246][ T9915] hub 1-0:1.0: 6 ports detected [ 341.541277][ T9915] hub 2-0:1.0: USB hub found [ 341.552217][ T9915] hub 2-0:1.0: 2 ports detected [ 341.720017][ T9915] hub 3-0:1.0: USB hub found [ 341.728138][ T9915] hub 3-0:1.0: 2 ports detected [ 341.774454][ T9915] hub 4-0:1.0: USB hub found [ 341.782147][ T9915] hub 4-0:1.0: 2 ports detected [ 341.848490][ T5820] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 342.036271][ T5820] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 342.044111][ T5820] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 342.053254][ T5820] usb 1-1: Product: QEMU USB Tablet [ 342.054816][ T5820] usb 1-1: Manufacturer: QEMU [ 342.059278][ T9939] syzkaller0: entered promiscuous mode [ 342.060977][ T9939] syzkaller0: entered allmulticast mode [ 342.068686][ T5820] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 342.082159][ T9939] Mass Storage Function, version: 2009/09/11 [ 342.084188][ T9939] LUN: removable file: (no medium) [ 342.091392][ T9939] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 342.094123][ T9939] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 342.096974][ T9939] ================================================================== [ 342.099511][ T9939] BUG: KASAN: slab-out-of-bounds in dummy_free_request+0x8a/0x90 [ 342.102092][ T9939] Read of size 8 at addr ffff88804c395df0 by task syz.0.948/9939 [ 342.105809][ T9939] [ 342.107062][ T9939] CPU: 3 UID: 0 PID: 9939 Comm: syz.0.948 Not tainted syzkaller #0 PREEMPT(full) [ 342.107084][ T9939] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 342.107095][ T9939] Call Trace: [ 342.107101][ T9939] [ 342.107108][ T9939] dump_stack_lvl+0x100/0x190 [ 342.107146][ T9939] print_report+0x13d/0x4b0 [ 342.107469][ T9939] ? __virt_addr_valid+0x239/0x430 [ 342.107484][ T9939] ? dummy_free_request+0x8a/0x90 [ 342.107505][ T9939] kasan_report+0xdf/0x1c0 [ 342.107530][ T9939] ? dummy_free_request+0x8a/0x90 [ 342.107559][ T9939] dummy_free_request+0x8a/0x90 [ 342.107585][ T9939] uvc_function_bind+0x181a/0x1939 [ 342.107605][ T9939] ? __pfx_uvc_function_bind+0x10/0x10 [ 342.107622][ T9939] usb_add_function+0x219/0x890 [ 342.107649][ T9939] configfs_composite_bind+0xd83/0x1960 [ 342.107677][ T9939] gadget_bind_driver+0x28c/0xbf0 [ 342.107694][ T9939] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 342.107718][ T9939] ? __pfx_gadget_bind_driver+0x10/0x10 [ 342.107736][ T9939] really_probe+0x241/0xa60 [ 342.107791][ T9939] __driver_probe_device+0x20e/0x450 [ 342.107815][ T9939] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 342.107840][ T9939] driver_probe_device+0x4a/0x140 [ 342.107862][ T9939] __driver_attach+0x21f/0x5b0 [ 342.107884][ T9939] ? __pfx___driver_attach+0x10/0x10 [ 342.107905][ T9939] bus_for_each_dev+0x13e/0x1d0 [ 342.107922][ T9939] ? __pfx_bus_for_each_dev+0x10/0x10 [ 342.107938][ T9939] ? bus_add_driver+0x2b5/0x5b0 [ 342.107959][ T9939] bus_add_driver+0x305/0x5b0 [ 342.107979][ T9939] driver_register+0x1e2/0x360 [ 342.108003][ T9939] usb_gadget_register_driver_owner+0x132/0x210 [ 342.108023][ T9939] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 342.108046][ T9939] configfs_write_iter+0x302/0x4e0 [ 342.108064][ T9939] vfs_write+0x6ac/0x1050 [ 342.108080][ T9939] ? __pfx_configfs_write_iter+0x10/0x10 [ 342.108096][ T9939] ? __pfx_vfs_write+0x10/0x10 [ 342.108110][ T9939] ? find_held_lock+0x2b/0x80 [ 342.108137][ T9939] ksys_write+0x12a/0x250 [ 342.108152][ T9939] ? __pfx_ksys_write+0x10/0x10 [ 342.108170][ T9939] __do_fast_syscall_32+0xe7/0x970 [ 342.108190][ T9939] ? lockdep_hardirqs_on+0x78/0x100 [ 342.108209][ T9939] do_fast_syscall_32+0x32/0x70 [ 342.108230][ T9939] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 342.108250][ T9939] RIP: 0023:0xf70befec [ 342.108269][ T9939] Code: Unable to access opcode bytes at 0xf70befc2. [ 342.108277][ T9939] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 342.108293][ T9939] RAX: ffffffffffffffda RBX: 000000000000000d RCX: 0000000080000d00 [ 342.108303][ T9939] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 342.108313][ T9939] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 342.108323][ T9939] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 342.108334][ T9939] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 342.108351][ T9939] [ 342.108357][ T9939] [ 342.121632][ T5820] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0059/input/input115 [ 342.122439][ T9939] Allocated by task 7141: [ 342.198108][ T5820] hid-generic 0003:0627:0001.0059: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 342.198484][ T9939] kasan_save_stack+0x30/0x50 [ 342.198516][ T9939] kasan_save_track+0x14/0x30 [ 342.198539][ T9939] __kasan_kmalloc+0xaa/0xb0 [ 342.236518][ T9939] __kmalloc_noprof+0x322/0x820 [ 342.238519][ T9939] tomoyo_get_name+0x240/0x4b0 [ 342.240677][ T9939] tomoyo_parse_name_union+0xc0/0x160 [ 342.242867][ T9939] tomoyo_write_file+0x4c4/0x8e0 [ 342.244903][ T9939] tomoyo_write_domain2+0x13a/0x200 [ 342.247021][ T9939] tomoyo_supervisor+0x9e2/0x1340 [ 342.249123][ T9939] tomoyo_path_permission+0x270/0x3b0 [ 342.251242][ T9939] tomoyo_path_perm+0x364/0x460 [ 342.253283][ T9939] security_inode_getattr+0x116/0x280 [ 342.255734][ T9939] vfs_statx+0x11f/0x3f0 [ 342.257488][ T9939] vfs_fstatat+0x77/0xe0 [ 342.259119][ T9939] __do_sys_newfstatat+0x9d/0x120 [ 342.261161][ T9939] do_syscall_64+0x115/0x840 [ 342.263092][ T9939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.265283][ T9939] [ 342.266199][ T9939] The buggy address belongs to the object at ffff88804c395d00 [ 342.266199][ T9939] which belongs to the cache kmalloc-128 of size 128 [ 342.271976][ T9939] The buggy address is located 119 bytes to the right of [ 342.271976][ T9939] allocated 121-byte region [ffff88804c395d00, ffff88804c395d79) [ 342.277727][ T9939] [ 342.278738][ T9939] The buggy address belongs to the physical page: [ 342.281361][ T9939] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4c395 [ 342.284864][ T9939] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 342.288046][ T9939] page_type: f5(slab) [ 342.289713][ T9939] raw: 04fff00000000000 ffff88801bc42a00 dead000000000100 dead000000000122 [ 342.293112][ T9939] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 342.296466][ T9939] page dumped because: kasan: bad access detected [ 342.299078][ T9939] page_owner tracks the page as allocated [ 342.301389][ T9939] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6285, tgid 6285 (udevd), ts 155966401913, free_ts 133381873156 [ 342.309494][ T9939] post_alloc_hook+0xfd/0x120 [ 342.311317][ T9939] get_page_from_freelist+0xf48/0x3530 [ 342.313623][ T9939] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 342.316014][ T9939] new_slab+0xa2/0x650 [ 342.317722][ T9939] refill_objects+0xe3/0x410 [ 342.319650][ T9939] __pcs_replace_empty_main+0x376/0x680 [ 342.321972][ T9939] __kmalloc_cache_noprof+0x479/0x6c0 [ 342.324056][ T9939] kernfs_fop_open+0x9fa/0xd50 [ 342.326212][ T9939] do_dentry_open+0x6ab/0x14d0 [ 342.328195][ T9939] vfs_open+0x82/0x3f0 [ 342.329900][ T9939] path_openat+0x2873/0x4280 [ 342.331827][ T9939] do_file_open+0x20e/0x430 [ 342.333683][ T9939] do_sys_openat2+0x10f/0x1e0 [ 342.335639][ T9939] __x64_sys_openat+0x12d/0x210 [ 342.337708][ T9939] do_syscall_64+0x115/0x840 [ 342.339634][ T9939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.342114][ T9939] page last free pid 149 tgid 149 stack trace: [ 342.344832][ T9939] __free_frozen_pages+0x79f/0x1090 [ 342.347008][ T9939] kasan_depopulate_vmalloc_pte+0x5d/0x80 [ 342.349369][ T9939] __apply_to_page_range+0xb1d/0x1520 [ 342.351606][ T9939] __kasan_release_vmalloc+0xd7/0xe0 [ 342.353826][ T9939] purge_vmap_node+0x210/0xb40 [ 342.355816][ T9939] __purge_vmap_area_lazy+0x90a/0xc00 [ 342.358044][ T9939] drain_vmap_area_work+0x27/0x40 [ 342.360120][ T9939] process_one_work+0xa23/0x1940 [ 342.362214][ T9939] worker_thread+0x5ef/0xe50 [ 342.364139][ T9939] kthread+0x370/0x450 [ 342.366035][ T9939] ret_from_fork+0x72b/0xd50 [ 342.367913][ T9939] ret_from_fork_asm+0x1a/0x30 [ 342.369993][ T9939] [ 342.371007][ T9939] Memory state around the buggy address: [ 342.373222][ T9939] ffff88804c395c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 342.376287][ T9939] ffff88804c395d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 [ 342.379594][ T9939] >ffff88804c395d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 342.382859][ T9939] ^ [ 342.385867][ T9939] ffff88804c395e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 342.389336][ T9939] ffff88804c395e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 342.392602][ T9939] ================================================================== [ 342.398853][ T9939] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 342.401858][ T9939] CPU: 3 UID: 0 PID: 9939 Comm: syz.0.948 Not tainted syzkaller #0 PREEMPT(full) [ 342.405579][ T9939] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 342.409704][ T9939] Call Trace: [ 342.411341][ T9939] [ 342.412585][ T9939] dump_stack_lvl+0x100/0x190 [ 342.414570][ T9939] vpanic+0x552/0x970 [ 342.416246][ T9939] ? __pfx_vpanic+0x10/0x10 [ 342.418157][ T9939] ? dummy_free_request+0x8a/0x90 [ 342.420253][ T9939] panic+0xd1/0xe0 [ 342.421850][ T9939] ? __pfx_panic+0x10/0x10 [ 342.423705][ T9939] ? dummy_free_request+0x8a/0x90 [ 342.425834][ T9939] ? preempt_schedule_common+0x42/0xc0 [ 342.428114][ T9939] check_panic_on_warn.cold+0x19/0x34 [ 342.430344][ T9939] end_report.part.0+0x3a/0x90 [ 342.432339][ T9939] kasan_report.cold+0xe/0x18 [ 342.434331][ T9939] ? dummy_free_request+0x8a/0x90 [ 342.436594][ T9939] dummy_free_request+0x8a/0x90 [ 342.438632][ T9939] uvc_function_bind+0x181a/0x1939 [ 342.440714][ T9939] ? __pfx_uvc_function_bind+0x10/0x10 [ 342.442899][ T9939] usb_add_function+0x219/0x890 [ 342.444712][ T9939] configfs_composite_bind+0xd83/0x1960 [ 342.446405][ T9939] gadget_bind_driver+0x28c/0xbf0 [ 342.447969][ T9939] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 342.449752][ T9939] ? __pfx_gadget_bind_driver+0x10/0x10 [ 342.451461][ T9939] really_probe+0x241/0xa60 [ 342.452866][ T9939] __driver_probe_device+0x20e/0x450 [ 342.454958][ T9939] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 342.457386][ T9939] driver_probe_device+0x4a/0x140 [ 342.459266][ T9939] __driver_attach+0x21f/0x5b0 [ 342.460949][ T9939] ? __pfx___driver_attach+0x10/0x10 [ 342.462576][ T9939] bus_for_each_dev+0x13e/0x1d0 [ 342.464072][ T9939] ? __pfx_bus_for_each_dev+0x10/0x10 [ 342.465713][ T9939] ? bus_add_driver+0x2b5/0x5b0 [ 342.467226][ T9939] bus_add_driver+0x305/0x5b0 [ 342.468714][ T9939] driver_register+0x1e2/0x360 [ 342.470275][ T9939] usb_gadget_register_driver_owner+0x132/0x210 [ 342.472208][ T9939] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 342.474024][ T9939] configfs_write_iter+0x302/0x4e0 [ 342.475573][ T9939] vfs_write+0x6ac/0x1050 [ 342.476907][ T9939] ? __pfx_configfs_write_iter+0x10/0x10 [ 342.478652][ T9939] ? __pfx_vfs_write+0x10/0x10 [ 342.480174][ T9939] ? find_held_lock+0x2b/0x80 [ 342.481677][ T9939] ksys_write+0x12a/0x250 [ 342.483046][ T9939] ? __pfx_ksys_write+0x10/0x10 [ 342.484615][ T9939] __do_fast_syscall_32+0xe7/0x970 [ 342.486407][ T9939] ? lockdep_hardirqs_on+0x78/0x100 [ 342.488101][ T9939] do_fast_syscall_32+0x32/0x70 [ 342.489709][ T9939] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 342.491721][ T9939] RIP: 0023:0xf70befec [ 342.493024][ T9939] Code: Unable to access opcode bytes at 0xf70befc2. [ 342.495112][ T9939] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 342.497727][ T9939] RAX: ffffffffffffffda RBX: 000000000000000d RCX: 0000000080000d00 [ 342.500361][ T9939] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 342.502851][ T9939] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 342.505324][ T9939] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 342.507794][ T9939] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 342.510273][ T9939] [ 342.512204][ T9939] Kernel Offset: disabled [ 342.514212][ T9939] Rebooting in 86400 seconds.. VM DIAGNOSIS: 02:54:21 Registers: info registers vcpu 0 CPU#0 RAX=dffffc0000000000 RBX=ffffc90004cfecb8 RCX=ffffffff91d45f68 RDX=ffffc90004cfea48 RSI=ffffc90004cfec88 RDI=ffffc90004cfea48 RBP=ffffc90004cf8000 RSP=ffffc90004cfe9c8 R8 =0000000000000001 R9 =0000000000000007 R10=0000000000000200 R11=00000000000183e5 R12=ffffc90004cfea88 R13=ffffc90004cfea38 R14=ffffc90004cfecb8 R15=ffffc90004cfea6c RIP=ffffffff81b819b9 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096be6000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f7238950 CR3=0000000056adb000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=00000000013e9a5b RBX=ffff88801cb52540 RCX=ffffffff8bb832d5 RDX=0000000000000000 RSI=ffffffff8e1a7b8e RDI=ffffffff8c400880 RBP=ffffed100396a4a8 RSP=ffffc9000046fe00 R8 =0000000000000001 R9 =ffffed100566678d R10=ffff88802b333c6b R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff9200008dfc4 R15=dffffc0000000000 RIP=ffffffff8bb8189f RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096ce6000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000000000000 CR3=00000000509ca000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2323232323232323 2323232323232323 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffff000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=ffffffffffffff81 RBX=ffff8880250afa40 RCX=000000000000002e RDX=ffffea0000942bc0 RSI=ffffffff8e181ee6 RDI=ffff8880250afa40 RBP=ffff88801d6ff540 RSP=ffffc9000392fd60 R8 =0000000000000001 R9 =000000000000001e R10=0000000000000200 R11=0000000000000000 R12=ffff8880250afa40 R13=0000000000000200 R14=ffffffff828d95bd R15=0000000000000000 RIP=ffffffff82790657 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f7c912a9880 ffffffff 00c00000 GS =0000 ffff888096de6000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00005560e0bcd000 CR3=000000002a3f1000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000fc900200 Opmask01=0000000000000000 Opmask02=00000000ffff7fdf Opmask03=0000000082000020 Opmask04=00000000ffffefff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055a7b4f37eb0 000055a78292d040 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055a7b4f37eb0 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055a7b4ee7190 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055a7b4ee1520 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7c90bf1b20 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000ff00 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 20fcfd2061905c81 737326d19de6d2ef ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 7373737373737152 7373737373737373 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 737365636f727020 756c6c2520716573 006e6f6974697472 6170006b636f6c62 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 312d312f31627375 2f372e64313a3030 3a303030302f3030 3a30303030696370 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00393530302e3130 30303a373236303a 333030302f302e31 3a312d312f312d31 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2f316273752f372e 64313a30303a3030 30302f30303a3030 30306963702f7365 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000031 000055a7b4ecbc30 0000000000000000 307761726469682f ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 516e76633a302e30 312d3533712d6370 7276703a29393030 322c394843492b35 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3351284350647261 646e6174536e703a 554d45516e76733a 302e3072623a3431 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 30322f31302f3430 64623a322d332e36 312e312d6e616962 65642d332e36312e ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 323032302c313032 302c394631302c32 4331302c38423130 2c464131302c4541 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000001 RBX=ffff88802b533c68 RCX=0000000000000002 RDX=0000000000000000 RSI=ffffffff8c400800 RDI=ffffffff8e46b938 RBP=0000000000000003 RSP=ffffc90002def578 R8 =0000000000000000 R9 =0000000000000000 R10=ffff88802fe79000 R11=000000000000249a R12=0000000000000002 R13=0000000000000000 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff81edccc2 RFL=00000082 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096ee6000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f72de853 CR3=000000004c7c7000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2323232323232323 2323232323232323 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffff000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000