last executing test programs: 3.64126104s ago: executing program 0 (id=329): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ehci-pci/unbind\x00', 0x1, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000200)={0x3, 0xb, "6226ba", 0x3, 0x6}) syz_emit_vhci(0x0, 0x7) write(r0, &(0x7f0000000240)='0000:00:1d.7', 0xc) syz_usb_connect(0x0, 0x3f, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/pci/drivers/ehci-pci/bind\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='0000:00:1d.7', 0xc) 3.641039141s ago: executing program 3 (id=330): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f00000001c0)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r1, &(0x7f0000006e80)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000004300)={0x50, 0x0, r2, {0x7, 0x29, 0x0, 0x840120, 0x0, 0x0, 0x57, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0x50) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x280a00, 0x0) file_getattr(r3, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x18, 0x100) read$FUSE(r1, &(0x7f0000004540)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r1, &(0x7f0000002200)={0x10, 0xffffffffffffffda, r4}, 0x10) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r6 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x718bb647156ec3b7) r7 = creat(&(0x7f0000000080)='./file0/file1\x00', 0x90) write$P9_RREADDIR(r7, &(0x7f0000000440)={0xb, 0x29, 0x2, {0x403}}, 0xb) chdir(&(0x7f0000000000)='./bus\x00') linkat(r6, &(0x7f0000000100)='./file1\x00', r6, &(0x7f0000000180)='./file0\x00', 0x1000) open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x190) 3.632034815s ago: executing program 0 (id=331): r0 = socket$inet6(0xa, 0x2, 0x45) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:02.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4020, 0x3, 0x11, r1, 0x0) fcntl$dupfd(r1, 0x0, r0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000004240)=0x40000006, 0x4) unshare(0x22020600) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) sync_file_range(r3, 0x0, 0x0, 0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00001d6000/0x1000)=nil, 0x1000, 0x17) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000280)=ANY=[], 0x8) recvmmsg(r0, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r5 = openat$cgroup_devices(r4, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r5, &(0x7f00000003c0)=ANY=[@ANYBLOB='b 5:'], 0x8) setsockopt$inet6_int(r0, 0x29, 0x8, &(0x7f0000000000)=0x7f, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x20000001, &(0x7f0000000040)={0xa, 0x4e20, 0x5, @empty}, 0x1c) 3.627849043s ago: executing program 3 (id=334): syz_ublk_setup_io_uring(0x58e3, 0x0, &(0x7f0000000140), &(0x7f0000000180), 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000840)={r3, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r5, 0x0, 0x81, &(0x7f00000003c0)={'nat\x00', 0x0, 0x0, 0x0, [0xfffffbff, 0x4, 0x30c7, 0x5, 0xfffffffe, 0x8], 0x3, &(0x7f0000000000)=[{}, {}, {}], 0x0, [{}, {}, {}]}, 0x80) pread64(0xffffffffffffffff, 0x0, 0x0, 0x200) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x1c) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 3.136794423s ago: executing program 0 (id=335): r0 = socket$netlink(0x10, 0x3, 0x4) ioctl$FS_IOC_SETFLAGS(r0, 0x40046602, &(0x7f0000000000)=0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x80, 0x1, 0x4, 0x8001, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x465, 0x0, 0x8, 0x29, 0x0, @local, @empty}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', &(0x7f0000000180)={'gre0\x00', 0x0, 0x80, 0x7, 0x0, 0x2, {{0x5, 0x4, 0x0, 0x25, 0x14, 0x0, 0x0, 0x1, 0x0, 0x0, @dev={0xac, 0x14, 0x14, 0x11}, @empty}}}}) r3 = epoll_create1(0x80000) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000100)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7fff, 0x8}}, './file0\x00'}) connect$can_bcm(r4, &(0x7f00000001c0)={0x1d, r2}, 0x10) io_setup(0x2dd8, &(0x7f00000000c0)=0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x2000, 0x0) acct(&(0x7f0000000040)='./file0\x00') io_submit(r5, 0x1, &(0x7f0000000680)=[&(0x7f0000000300)={0x0, 0x0, 0x0, 0x5, 0x86, r3, 0x0, 0x0, 0x0, 0x0, 0x2}]) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000140)={0x2016}) sendmsg$nl_generic(r0, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x29, 0x1, 0x70bd29, 0x25dfdbfe, {0xf}}, 0x14}, 0x1, 0x0, 0x0, 0x20044084}, 0x20040080) 3.02818745s ago: executing program 0 (id=336): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000400)=ANY=[@ANYRESOCT=r0, @ANYRESHEX=r0], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) sched_setscheduler(r1, 0x1, &(0x7f00000003c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f00000007c0)="6755d7d7969fb9fc1becea875e2f11d27cd624d936e00e9591d0e6add3afff549497460125d514a706536572d8e85457582b518a3e88828de6fefa1fd65795bb2b2d6c69683820ded3ba58dbb55c09d7cf1d1418a28cdf560988a26af009f69abfd9b656a40acd80fc9fab1d5eb220afa398e7cccf9c1f98633237980417acfbe4f0c8c2bfb98622b1ccd04004f6e6e3c840c34ebe49be1e03d1156bc0c79f306c5d9f", 0xa3, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r6 = add_key$user(0x0, &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000980), 0x0, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={r4, r5, r6}, 0x0, 0x0, 0x0) add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135", 0x1b, 0xfffffffffffffffe) syz_open_dev$video4linux(0x0, 0x3, 0x42583) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7}, 0xc) r8 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r8, 0xc004500a, 0x0) ioctl$SNDCTL_DSP_SPEED(r8, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r8, 0xc0045006, &(0x7f0000000040)=0xc) ioctl$SNDCTL_DSP_SETFMT(r8, 0xc0045005, &(0x7f0000000640)=0x10) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@can_newroute={0x26c, 0x18, 0x400, 0x70bd27, 0x25dfdbfd, {0x1d, 0x1, 0x2}, [@CGW_CS_CRC8={0x11e, 0x6, {0x3, 0x1, 0x58, 0x2, 0xff, "71ec6d721744cd5200080000f8cfcad4c4ec6511ec028c5028564abce83afe14c93e15e556c2baed7f897fe841c155a2b2a4b9f3052995cdf66a9c7922ff0300005b6c67281f1519cd7c32c2bf7563b9452575505da99ea128d37616896be8764a2c78edbad5bde7a5e405bdc893770338925f824bd24689c0d11a5568fc3aaa9ad0d7766d8ea8d3bf1006e3df494e2f373148ecb4adafdd39874e9808b118301f1e76054a64c6d243523f5de7b347f3b740e105d0ed18fae7289635301ebd8949268090b3bcd4cbed5f1cfe93cff41a9630802f96defe9e8ea850529827c5e301953a8abaafa1f121e590f74e28233f4129d4587eee87ec5d42c3ef0619022c", 0x0, "5c8d03000000000000002a5e15c8a95d29e5b2ea"}}, @CGW_MOD_XOR={0x15, 0x3, {{{0x3, 0x1}, 0x1, 0x3, 0x0, 0x0, "54831bdbae1d82b3"}, 0x7}}, @CGW_CS_CRC8={0x11e, 0x6, {0x68, 0x54, 0x4a, 0x7, 0x5, "8a388665cfcca9da80edb4587441fe0a3d745d8d13130acc700cffc5c3b25d3f64cbdaae5689d141afded883d81e28d66069be57ba20b1f0b58ba2e1e25580dc18093963b772cafe2d430e7cf22d4f9dd1adba562330a7b7c3e2dbbc68b189eb634bda2a9f11362b70e006f3cd6e07057229dd1d71c2836dc707b11cd99f7a63871934d20008f8f4a6afe4749971eb03680f4aebb09f4f55346ed9fec42de931fa563cbf5457b9db628f8944d9176f991154ae7f1e7c99a8a495d2f76095809ae45ee8f70607aff1cbab71c22dee480d82c2ca611dcf04b6cf48414777dd23f227683239dbc1aecbd5e30a88a6711f765d125955db4720cd36535e35b7241541", 0x1, "798088d20d3f2464edba999c4ae849b3a80d5b48"}}]}, 0x26c}}, 0x240448c8) 2.075847739s ago: executing program 0 (id=340): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) chdir(&(0x7f00000000c0)='./bus\x00') r1 = creat(&(0x7f0000000440)='./bus\x00', 0xf2) open_by_handle_at(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000f800000000000000fb150605a8371f2efe088557001f00000000006f4e680f4f17dab197a66e3a88c97bb9c255a631a03ab0a2a7f3ee8184482fc18ad5770848cc67cc576c921e8275d1c8cd00fff8fdcad2beea8677e9f673696c933196566c3ec8fef41850fc85fef64c84343547d26a66322dfef5ec5e323617bc5aaff7c27900000000bfcbbb15bf90bc240dfdecfd77569560c741a2639763d31bad5f699636c38d67825b196d9db309a3e691cf60"], 0x5f1502) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000001180)=0xe) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004"], 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, &(0x7f0000000040)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x15) remap_file_pages(&(0x7f000021d000/0x3000)=nil, 0x3000, 0x8, 0x8ea, 0x20) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r0, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r0, 0x5008, 0x0) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) ioctl$SNDCTL_DSP_GETOSPACE(r0, 0x8010500c, &(0x7f00000000c0)) ioctl$BTRFS_IOC_SUBVOL_SYNC_WAIT(r0, 0x40109441, &(0x7f0000000080)={0xb, 0x4, 0x2bca}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 2.045257606s ago: executing program 3 (id=341): openat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x2d41, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x42, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x400c4d00, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x1, 0x394, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@remote, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0x6, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x2, &(0x7f0000000480)={&(0x7f00000008c0)=@newsa={0x138, 0x18, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x2, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@empty, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@policy={0x0, 0x7, {{@in6=@private2, @in6=@remote, 0x4e24, 0x6, 0x4e22, 0x4, 0xa, 0x20, 0x20, 0x67}, {0x3, 0x4a, 0x7191, 0xc61f, 0x3, 0x975, 0x8, 0x82df}, {0x7fffffff, 0xfffffffffffffffb, 0x5, 0x9}, 0x101, 0x6e6bb5, 0x1, 0x0, 0x2, 0x2}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@ipv4_newaddr={0x20, 0x14, 0x601, 0x0, 0x0, {0x23, 0x0, 0x0, 0x0, r5}, [@IFA_LOCAL={0x8, 0x2, @empty=0x4000000}]}, 0x20}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=@getqdisc={0x2c, 0x26, 0x100, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x5, 0x2}, {0x6, 0x1}, {0x1, 0x8}}, [{0x4}, {0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000000}, 0x20040000) r7 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200), 0xa2442, 0x0) write$dsp(r7, &(0x7f00000004c0)='\x00', 0x1) ioctl$SNDCTL_DSP_SYNC(r7, 0x5001, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r7, 0x800c5012, &(0x7f00000000c0)) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x3, 0x6, 0xfffffffb}, 0x1}}, @TCA_MIRRED_PARMS={0x20, 0x4, {{0xf7dff7e8, 0x0, 0x3, 0x0, 0x1}, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000240)={0x50, 0x0, r9, {0x7, 0x1f, 0x1, 0x40020000, 0x0, 0x0, 0x5}}, 0x50) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="0407ff00aaaaaaaaaa10d0312588e6fe9cbedfaa51b080088dc5fe77f1f39d000a276270f19c06c30ba7401d3f9e639bf1627904c1841126082db3df6bd39736cf8be3ee01b4539e9fc10cb7519addc7e06bffff15514f77c618df8c6da005fad2f5c5cc556775498b60cce461b2a9fde146d22200808ba97fb1bcef7ca0bd3212bdb0637eda766ea63d85c59738c2eddadf900b10c323bd69c3d1aace2c4a0364e9aca34ae3df33594a4bdaa4082270935c014917bd30071fc876d82a2b00b78c84f198c65cb514902f66a8f53b518e66dff52ea0b2cbff3dba61f57483c623eb496c7a6115489c8db5662f3859105eead97eddb6ae4759ab12e0a9bb7bcf7c208f"], 0x102) socket$nl_route(0x10, 0x3, 0x0) 2.042339897s ago: executing program 2 (id=342): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) lsetxattr$trusted_overlay_redirect(&(0x7f0000000100)='./sys\x00', &(0x7f0000000140), &(0x7f0000000240)='\x00', 0x1, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)="1cd5d7fd4334b8de2aa836336b1f8749990f7affd346d9a5dfcc907b2430df804c584e3cb7b344680ea2e260db064c6da6dd6cc0ab06aeccb3b8ffbcc02c3641070b4dd0500a13dbb135547a9e5c67f3542e47", 0xb7) write(r1, &(0x7f0000000500), 0x0) write(r1, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r3, &(0x7f00000007c0)='active', 0x6) r4 = openat$vcs(0xffffff9c, &(0x7f0000001d00), 0x80000, 0x0) preadv(r4, &(0x7f0000001f00)=[{&(0x7f0000001d80)=""/159, 0x9f}], 0x1, 0x5, 0x8) r5 = socket$nl_route(0x10, 0x3, 0x0) listen(r4, 0x1) sendmsg$nl_route(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000370400000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="8b24040000000012800800016cb576e14b3ebe44283eed48353c000669740004000280544012a96b0b7f6bc4947bca4c2e53e4bd9abc8f3021e267c164ed62628d403b1b19b842fb00fcbfc6ee8c9a1c307363791baf10de8af0765c2bede6b7856700654541b2d16e17db96611dab44dbb46f9a8f6ea947c0032f3d3b105963316a3517903dc77314ae67f7d8c802658d33069962bcb991b0"], 0x30}, 0x1, 0x0, 0x0, 0x4001}, 0x0) 1.920901397s ago: executing program 2 (id=343): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@gettaction={0x108, 0x32, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_gd=@TCA_ACT_TAB={0x70, 0x1, [{0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3ff}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7fff}}, {0x10, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0x10, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0x10, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x3c, 0x1, [{0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8a}}, {0x10, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}]}, @action_gd=@TCA_ACT_TAB={0x34, 0x1, [{0x10, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xd84}]}, 0x108}, 0x1, 0x0, 0x0, 0x20000041}, 0x800) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f00000003c0)={'syz_tun\x00', {0x2, 0x4e21, @loopback}}) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_DMA(0xffffffffffffffff, 0xc0286429, &(0x7f0000000180)={r2, 0x3, &(0x7f0000000080)=[0x8, 0x7, 0x0], &(0x7f00000000c0)=[0x7, 0x9, 0x4, 0x6], 0x3, 0x1, 0xe580, &(0x7f0000000100)=[0x7f], &(0x7f0000000140)=[0x1000, 0x8]}) 1.920617722s ago: executing program 2 (id=344): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) recvfrom$inet(r0, &(0x7f0000000780)=""/123, 0x7b, 0x10000, &(0x7f0000000800)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bbr', 0x3) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) socket$inet_tcp(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) fsopen(&(0x7f0000000140)='cifs\x00', 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000780)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newtfilter={0x4c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6}]}}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x1}]}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x89901) unshare(0x24020400) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x81802) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000480)) r5 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r5, 0x0, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x5, 0x33e}, &(0x7f0000000900)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x2000, 0x10000805, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed80, 0x1, 0x0, 0x3b8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf913, 0x0, 0x3, 0x401f0, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x400, 0x0, 0x367, 0x0, r4}}], 0x1, &(0x7f0000000880)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) shutdown(r0, 0x1) 1.319609233s ago: executing program 3 (id=345): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000400)=ANY=[@ANYRESOCT=r0, @ANYRESHEX=r0], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) sched_setscheduler(r1, 0x1, &(0x7f00000003c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f00000007c0)="6755d7d7969fb9fc1becea875e2f11d27cd624d936e00e9591d0e6add3afff549497460125d514a706536572d8e85457582b518a3e88828de6fefa1fd65795bb2b2d6c69683820ded3ba58dbb55c09d7cf1d1418a28cdf560988a26af009f69abfd9b656a40acd80fc9fab1d5eb220afa398e7cccf9c1f98633237980417acfbe4f0c8c2bfb98622b1ccd04004f6e6e3c840c34ebe49be1e03d1156bc0c79f306c5d9f", 0xa3, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r6 = add_key$user(0x0, &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000980), 0x0, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={r4, r5, r6}, 0x0, 0x0, 0x0) add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135", 0x1b, 0xfffffffffffffffe) syz_open_dev$video4linux(0x0, 0x3, 0x42583) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7}, 0xc) r8 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r8, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r8, 0xc0045002, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r8, 0xc0045006, &(0x7f0000000040)=0xc) ioctl$SNDCTL_DSP_SETFMT(r8, 0xc0045005, &(0x7f0000000640)=0x10) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@can_newroute={0x26c, 0x18, 0x400, 0x70bd27, 0x25dfdbfd, {0x1d, 0x1, 0x2}, [@CGW_CS_CRC8={0x11e, 0x6, {0x3, 0x1, 0x58, 0x2, 0xff, "71ec6d721744cd5200080000f8cfcad4c4ec6511ec028c5028564abce83afe14c93e15e556c2baed7f897fe841c155a2b2a4b9f3052995cdf66a9c7922ff0300005b6c67281f1519cd7c32c2bf7563b9452575505da99ea128d37616896be8764a2c78edbad5bde7a5e405bdc893770338925f824bd24689c0d11a5568fc3aaa9ad0d7766d8ea8d3bf1006e3df494e2f373148ecb4adafdd39874e9808b118301f1e76054a64c6d243523f5de7b347f3b740e105d0ed18fae7289635301ebd8949268090b3bcd4cbed5f1cfe93cff41a9630802f96defe9e8ea850529827c5e301953a8abaafa1f121e590f74e28233f4129d4587eee87ec5d42c3ef0619022c", 0x0, "5c8d03000000000000002a5e15c8a95d29e5b2ea"}}, @CGW_MOD_XOR={0x15, 0x3, {{{0x3, 0x1}, 0x1, 0x3, 0x0, 0x0, "54831bdbae1d82b3"}, 0x7}}, @CGW_CS_CRC8={0x11e, 0x6, {0x68, 0x54, 0x4a, 0x7, 0x5, "8a388665cfcca9da80edb4587441fe0a3d745d8d13130acc700cffc5c3b25d3f64cbdaae5689d141afded883d81e28d66069be57ba20b1f0b58ba2e1e25580dc18093963b772cafe2d430e7cf22d4f9dd1adba562330a7b7c3e2dbbc68b189eb634bda2a9f11362b70e006f3cd6e07057229dd1d71c2836dc707b11cd99f7a63871934d20008f8f4a6afe4749971eb03680f4aebb09f4f55346ed9fec42de931fa563cbf5457b9db628f8944d9176f991154ae7f1e7c99a8a495d2f76095809ae45ee8f70607aff1cbab71c22dee480d82c2ca611dcf04b6cf48414777dd23f227683239dbc1aecbd5e30a88a6711f765d125955db4720cd36535e35b7241541", 0x1, "798088d20d3f2464edba999c4ae849b3a80d5b48"}}]}, 0x26c}}, 0x240448c8) 1.319121818s ago: executing program 1 (id=346): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000"], 0x7c}}, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000580)={0x2c, 0x17, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8115}, 0x200000c0) 1.250112086s ago: executing program 1 (id=347): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) r2 = dup3(r1, r0, 0x0) r3 = epoll_create(0x8001) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000440)={0x2}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x1500, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 1.249780082s ago: executing program 1 (id=348): socket$l2tp6(0xa, 0x2, 0x73) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="56c78e3c733d76696e65459beb1fb664f6ce6c0c7274696f7874656e642c6163638173733d616e792c63616368653d66736361636865"]) chdir(&(0x7f0000000080)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x181242, 0x148) socket$nl_route(0x10, 0x3, 0x0) setns(0xc9, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x7, @rand_addr=' \x01\x00', 0x2}, 0x32) r1 = socket$inet6(0xa, 0x2, 0x3a) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socket(0x10, 0x80002, 0x4) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a3000000000080041007369770014003300776c616e30000000000000000000000012e0531f7ad3f42c20e32eb771db8200a8a19e6053163f3d42"], 0x38}}, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="30000000490002002bbd7000fcdbdf250a001f00", @ANYRES32=0x0, @ANYBLOB="02001c35c9461377c1dc5000001400010000000000000000"], 0x30}}, 0xeb64d656201f6fb2) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000580)=@urb_type_iso={0x0, {0xc, 0x1}, 0x80, 0x80, &(0x7f0000000480)="a13eca", 0x3, 0x800, 0x9, 0xd, 0xffff0000, 0x7fff, &(0x7f0000000540)="8543708a62ac599adcfb826ce2e1c99e5a34dfb04f91e6f2e7d1", [{0x0, 0x1, 0xb6}, {0x6, 0xdbd, 0x2}, {0x7ff, 0xfffffffd, 0x250bc75a}, {0x2, 0x9, 0x80000000}, {0x7ccf, 0x5, 0x6}, {0x0, 0x1, 0x5}, {0x2, 0x8, 0x3}, {0x2, 0x8, 0x4}, {0xffff, 0x8, 0x59b}, {0xdcae, 0x3, 0x6}, {0x941, 0x30, 0xfffffffd}, {0x400, 0x5, 0x2}, {0x4, 0xffffffff, 0x2}]}) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980)}}], 0x1, 0x4000041) read$eventfd(r1, &(0x7f0000000740), 0x8) socket$inet_smc(0x2b, 0x1, 0x0) 1.170129923s ago: executing program 1 (id=349): syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x20b7, 0x10000, 0x2, 0x122}, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r0, r1, r2, &(0x7f0000000280)=@IORING_OP_SOCKET={0x2d, 0x4, 0x0, 0x8, 0x1, 0x0, 0x1, 0x0, 0x1, {0x0, 0x0, 0x9}}) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r4 = gettid() rt_sigtimedwait(&(0x7f0000000000)={[0xe]}, 0x0, 0x0, 0x8) tkill(r4, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x4000) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4) brk(0x556) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, 0x0}) 991.070095ms ago: executing program 2 (id=350): prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000001100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x4, [@var={0x2, 0x0, 0x0, 0x11, 0x3}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}, @func_proto={0x2, 0x0, 0x0, 0xc, 0x2}]}, {0x0, [0x0, 0x61]}}, 0x0, 0x4c, 0x0, 0x2}, 0x20) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_pgetevents(r2, 0x5, 0x5, &(0x7f0000000340)=[{}, {}, {}, {}, {}], &(0x7f0000000000), &(0x7f0000000100)={&(0x7f00000000c0), 0x8}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000080)=@x86={0x7, 0xe, 0x40, 0x0, 0x4, 0x2, 0x0, 0x2, 0x5, 0x6, 0x0, 0xf8, 0x0, 0x1, 0xb, 0x5, 0x9, 0xb, 0x0, '\x00', 0x6, 0x10}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r3, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r3, 0x0, 0x61, &(0x7f00000000c0)=ANY=[@ANYBLOB="66696c74657200000000000000000000000000000000000000000000000000003d0000000bd7f6398ba146836317bab72558cab2d0dc4f44e672dc5a09ad8a16ec4b4ddab704b9003e17258f2fb5f073f114cfd55dddaf051cd1e343c7e22d9bbf"], 0x0) io_pgetevents(r2, 0x5, 0xa, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x0, &(0x7f0000000040)={&(0x7f0000000280)={[0x7, 0x1ff]}, 0x8}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 759.251182ms ago: executing program 1 (id=351): r0 = socket(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'hsr0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000080)="01154e000100001122334455892f", 0x1a, 0x0, &(0x7f0000000040)={0x11, 0x4, r1, 0x88fb, 0xff, 0x0}, 0x14) 681.098498ms ago: executing program 1 (id=352): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYRESHEX=r1, @ANYRESOCT=r1, @ANYRES32=r0, @ANYRES32=r2, @ANYRES8=r2], 0x60}}, 0x20040000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r5, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0x77dde4e1}) ioctl(0xffffffffffffffff, 0x8b32, &(0x7f0000000740)="3035d5ae53c9fed01069804b467ef8bc4b66c439b4dcd1b64d910ee0bcc9595de651beab9682387659feb658ff9414ad45bfb803e06b044ca246d0a9e9385da0688b39cdfc8244c6ead32d2ef5e4084fdf1d3cf10295bc446eaab597adbfd603000000cacdef016a1fa320016d78aad449473fd96ffb4cf846bbc57b8c30a189f2c2587683c6fd70c150cd9d861442ddaf") ioctl$sock_netdev_private(r5, 0x89fa, &(0x7f0000000300)="4bff9337822725bcf387e581422786f06ccb642caaf19f2a3b4d08773a5c93c4a385060eb7b05381d1677998a90a6afbe32a856b7f932320f69d13709bcaeff875925ad26053a14af39ca803b014c13f6ec02eb3500331e44b3ff3db963200d5381bf9baea8f89b0206452b74c1e75d49ccba6535efae0c2c2255585dc91593e9ef5c32b4d91f3075ad60bba827247e7c4163b1a0df7bebd17501b3cba669b681e7bf14ecd81481fa3f50c7a85c6d04f9696b4b08e5bdcc25542b7791fd33e023e5fc8ead3f7d3980b4436cb2393ea02ab12b72856d303404448e8915474e436edb16a28a46a2505d51ab08370ff692df1fca4") sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r4, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010", @ANYRES8=0x0, @ANYRES8], 0x48}}, 0x0) sendmmsg$alg(r7, &(0x7f00000000c0), 0x492492492492627, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3) sendmsg$NL80211_CMD_NOTIFY_RADAR(r7, &(0x7f0000000640)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x20, r8, 0x200, 0x70bd25, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x15}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x10) close(r6) r9 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x8, @empty, 0x2}, 0x1c) listen(r9, 0x6f6) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r3) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000a1}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="03002000", @ANYRES16=r10, @ANYBLOB="080029bd7000fedbdf2514000000080005000400000008001200ffff0000"], 0x24}}, 0x40) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r11, &(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r11) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010000060000007e137e2c889cb2480001800500020001000d9dd55d0000c52d921ef1f6b8719cc0c3193b687ab6c1182f89b7493b66a4af8cdab56c4ce0da47d04c2ec196c88a02247f3cc86a528eeef2818a1fe0375e31e83082dd16fc2a1a72c0118211509d16085d6f632155e885299c4042646eaa32f05617a08d7afb2c252634f63a73ac72d8a975238076f128f9069f90c7ea597463d791454994d8bfccbb97a334cf5d8690b00ab972f0951f6cff8c56025f1694c10a277f38"], 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) 450.453869ms ago: executing program 0 (id=353): openat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x2d41, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x42, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x400c4d00, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x1, 0x394, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@remote, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0x6, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x2, &(0x7f0000000480)={&(0x7f00000008c0)=@newsa={0x138, 0x18, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x2, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@empty, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@policy={0x0, 0x7, {{@in6=@private2, @in6=@remote, 0x4e24, 0x6, 0x4e22, 0x4, 0xa, 0x20, 0x20, 0x67}, {0x3, 0x4a, 0x7191, 0xc61f, 0x3, 0x975, 0x8, 0x82df}, {0x7fffffff, 0xfffffffffffffffb, 0x5, 0x9}, 0x101, 0x6e6bb5, 0x1, 0x0, 0x2, 0x2}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@ipv4_newaddr={0x20, 0x14, 0x601, 0x0, 0x0, {0x23, 0x0, 0x0, 0x0, r5}, [@IFA_LOCAL={0x8, 0x2, @empty=0x4000000}]}, 0x20}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=@getqdisc={0x2c, 0x26, 0x100, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x5, 0x2}, {0x6, 0x1}, {0x1, 0x8}}, [{0x4}, {0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000000}, 0x20040000) r7 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200), 0xa2442, 0x0) write$dsp(r7, &(0x7f00000004c0)='\x00', 0x1) ioctl$SNDCTL_DSP_SYNC(r7, 0x5001, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r7, 0x800c5012, &(0x7f00000000c0)) socket$nl_route(0x10, 0x3, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000240)={0x50, 0x0, r8, {0x7, 0x1f, 0x1, 0x40020000, 0x0, 0x0, 0x5}}, 0x50) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="0407ff00aaaaaaaaaa10d0312588e6fe9cbedfaa51b080088dc5fe77f1f39d000a276270f19c06c30ba7401d3f9e639bf1627904c1841126082db3df6bd39736cf8be3ee01b4539e9fc10cb7519addc7e06bffff15514f77c618df8c6da005fad2f5c5cc556775498b60cce461b2a9fde146d22200808ba97fb1bcef7ca0bd3212bdb0637eda766ea63d85c59738c2eddadf900b10c323bd69c3d1aace2c4a0364e9aca34ae3df33594a4bdaa4082270935c014917bd30071fc876d82a2b00b78c84f198c65cb514902f66a8f53b518e66dff52ea0b2cbff3dba61f57483c623eb496c7a6115489c8db5662f3859105eead97eddb6ae4759ab12e0a9bb7bcf7c208f"], 0x102) socket$nl_route(0x10, 0x3, 0x0) 240.629023ms ago: executing program 3 (id=354): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) (async) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) read(0xffffffffffffffff, &(0x7f0000000080)=""/70, 0x46) r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.threads\x00', 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 108.543145ms ago: executing program 3 (id=355): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f00000001c0)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r1, &(0x7f0000006e80)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000004300)={0x50, 0x0, r2, {0x7, 0x29, 0x0, 0x840120, 0x0, 0x0, 0x57, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0x50) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x280a00, 0x0) file_getattr(r3, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x18, 0x100) read$FUSE(r1, &(0x7f0000004540)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r1, &(0x7f0000002200)={0x10, 0xffffffffffffffda, r4}, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r5 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x718bb647156ec3b7) r6 = creat(&(0x7f0000000080)='./file0/file1\x00', 0x90) write$P9_RREADDIR(r6, &(0x7f0000000440)={0xb, 0x29, 0x2, {0x403}}, 0xb) chdir(&(0x7f0000000000)='./bus\x00') linkat(r5, &(0x7f0000000100)='./file1\x00', r5, &(0x7f0000000180)='./file0\x00', 0x1000) open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x190) 931.222µs ago: executing program 2 (id=356): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000"], 0x7c}}, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000580)={0x2c, 0x17, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8115}, 0x200000c0) 0s ago: executing program 2 (id=357): sendmmsg(0xffffffffffffffff, &(0x7f0000002340), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='sys_link\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='sys_link\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='sys_link/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='0000:00:02.0', 0xc) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) lseek(r1, 0x40, 0x0) r2 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x2730, 0x800, 0x1, 0x82}, &(0x7f0000000180)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000240)=0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f00000005c0)=[{0x0}, {&(0x7f00000000c0)=""/250, 0xfa}], 0x2}}], 0x1, 0x34000, 0x0) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000040)={0x30, 0x0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_clone3(&(0x7f0000000600)={0x40000000, &(0x7f00000001c0), &(0x7f0000000280), &(0x7f0000000340)=0x0, {0x2}, &(0x7f00000003c0)=""/39, 0x27, &(0x7f0000000440)=""/107, &(0x7f00000004c0)=[0xffffffffffffffff, 0xffffffffffffffff], 0x2, {r1}}, 0x58) ptrace(0x8, r6) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r2}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r7 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x4844c1) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) userfaultfd(0x800) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) r8 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='sys_link/bus/pci/drivers/dwc2-pci/bind\x00', 0x1, 0x0) write(r8, &(0x7f0000000b00)='0000:00:02.0\x00', 0xd) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:57874' (ED25519) to the list of known hosts. [ 42.635884][ T5711] cgroup: Unknown subsys name 'net' [ 42.801495][ T5711] cgroup: Unknown subsys name 'cpuset' [ 42.805992][ T5711] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 43.971764][ T5711] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 48.029844][ T5740] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 48.032466][ T5741] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 48.033429][ T5740] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 48.037539][ T5741] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 48.041568][ T5740] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 48.041757][ T5741] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 48.044449][ T5740] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 48.047548][ T5741] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 48.050426][ T5740] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 48.053489][ T5741] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 48.054674][ T5740] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 48.056771][ T5741] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 48.059397][ T5740] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 48.062063][ T5744] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 48.062924][ T5741] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 48.063444][ T5741] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 48.064400][ T5747] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 48.067353][ T64] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 48.067427][ T5747] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 48.079092][ T64] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 48.659328][ T5743] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.662900][ T5743] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.665948][ T5743] bridge_slave_0: entered allmulticast mode [ 48.670142][ T5743] bridge_slave_0: entered promiscuous mode [ 48.705532][ T5743] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.709102][ T5743] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.711369][ T5743] bridge_slave_1: entered allmulticast mode [ 48.714681][ T5743] bridge_slave_1: entered promiscuous mode [ 48.793289][ T5743] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.817940][ T5743] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.882906][ T5730] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.886127][ T5730] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.889544][ T5730] bridge_slave_0: entered allmulticast mode [ 48.893582][ T5730] bridge_slave_0: entered promiscuous mode [ 48.900918][ T5730] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.904105][ T5730] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.907223][ T5730] bridge_slave_1: entered allmulticast mode [ 48.911370][ T5730] bridge_slave_1: entered promiscuous mode [ 48.916831][ T5743] team0: Port device team_slave_0 added [ 48.922230][ T5743] team0: Port device team_slave_1 added [ 48.982670][ T5730] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.025881][ T5730] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.029485][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.031722][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.039412][ T5743] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.043796][ T5731] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.046248][ T5731] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.048747][ T5731] bridge_slave_0: entered allmulticast mode [ 49.051441][ T5731] bridge_slave_0: entered promiscuous mode [ 49.055493][ T5731] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.058209][ T5731] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.060713][ T5731] bridge_slave_1: entered allmulticast mode [ 49.063492][ T5731] bridge_slave_1: entered promiscuous mode [ 49.079278][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.081609][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.090079][ T5743] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.124012][ T5730] team0: Port device team_slave_0 added [ 49.129058][ T5730] team0: Port device team_slave_1 added [ 49.167897][ T5731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.187199][ T5731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.208532][ T5743] hsr_slave_0: entered promiscuous mode [ 49.210911][ T5743] hsr_slave_1: entered promiscuous mode [ 49.213567][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.216186][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.224292][ T5730] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.233676][ T5735] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.237043][ T5735] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.239735][ T5735] bridge_slave_0: entered allmulticast mode [ 49.243344][ T5735] bridge_slave_0: entered promiscuous mode [ 49.253926][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.256279][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.265110][ T5730] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.269800][ T5731] team0: Port device team_slave_0 added [ 49.273219][ T5731] team0: Port device team_slave_1 added [ 49.275226][ T5735] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.277983][ T5735] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.280425][ T5735] bridge_slave_1: entered allmulticast mode [ 49.283276][ T5735] bridge_slave_1: entered promiscuous mode [ 49.340110][ T5735] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.348100][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.351057][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.362054][ T5731] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.374412][ T5735] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.381878][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.384640][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.394254][ T5731] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.422258][ T5730] hsr_slave_0: entered promiscuous mode [ 49.424951][ T5730] hsr_slave_1: entered promiscuous mode [ 49.427146][ T5730] debugfs: 'hsr0' already exists in 'hsr' [ 49.429081][ T5730] Cannot create hsr debugfs directory [ 49.443560][ T5735] team0: Port device team_slave_0 added [ 49.452814][ T5735] team0: Port device team_slave_1 added [ 49.487365][ T5735] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.489709][ T5735] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.497720][ T5735] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.509482][ T5731] hsr_slave_0: entered promiscuous mode [ 49.511680][ T5731] hsr_slave_1: entered promiscuous mode [ 49.513847][ T5731] debugfs: 'hsr0' already exists in 'hsr' [ 49.515679][ T5731] Cannot create hsr debugfs directory [ 49.544674][ T5735] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.546914][ T5735] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.554927][ T5735] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.653228][ T5735] hsr_slave_0: entered promiscuous mode [ 49.655620][ T5735] hsr_slave_1: entered promiscuous mode [ 49.658665][ T5735] debugfs: 'hsr0' already exists in 'hsr' [ 49.660631][ T5735] Cannot create hsr debugfs directory [ 49.804205][ T5743] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 49.818284][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.843453][ T5743] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 49.851502][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.871637][ T5743] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 49.878466][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.882340][ T5743] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 49.890881][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.951520][ T5730] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 49.956884][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.964790][ T5730] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 49.970564][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.973367][ T5730] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 49.979213][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.982911][ T5730] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 49.992690][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.053030][ T5731] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 50.061707][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 50.065235][ T5731] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 50.072947][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 50.076448][ T5731] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 50.085071][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 50.089055][ T5731] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 50.095926][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.129202][ T64] Bluetooth: hci0: command tx timeout [ 50.137893][ T5744] Bluetooth: hci3: command tx timeout [ 50.139590][ T64] Bluetooth: hci1: command tx timeout [ 50.140251][ T5734] Bluetooth: hci2: command tx timeout [ 50.162506][ T5735] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 50.167150][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 50.171569][ T5735] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 50.178228][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 50.188770][ T5735] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 50.193700][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 50.202924][ T5735] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 50.207326][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.238662][ T5743] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.255572][ T5730] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.284305][ T5743] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.293895][ T5730] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.307280][ T1155] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.310412][ T1155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.318258][ T1155] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.321014][ T1155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.333166][ T1155] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.335875][ T1155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.350841][ T5731] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.353913][ T1155] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.356239][ T1155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.396702][ T5731] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.419632][ T1156] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.421993][ T1156] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.438353][ T1156] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.440730][ T1156] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.462988][ T5735] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.486152][ T5735] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.496477][ T99] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.499422][ T99] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.512400][ T99] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.514669][ T99] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.710276][ T5730] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.733863][ T5743] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.740723][ T5731] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.751972][ T5730] veth0_vlan: entered promiscuous mode [ 50.767396][ T5730] veth1_vlan: entered promiscuous mode [ 50.814117][ T5731] veth0_vlan: entered promiscuous mode [ 50.820790][ T5743] veth0_vlan: entered promiscuous mode [ 50.823074][ T5730] veth0_macvtap: entered promiscuous mode [ 50.828891][ T5735] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.832866][ T5731] veth1_vlan: entered promiscuous mode [ 50.838701][ T5730] veth1_macvtap: entered promiscuous mode [ 50.850146][ T5743] veth1_vlan: entered promiscuous mode [ 50.859637][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.871103][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.898709][ T5808] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.909433][ T5731] veth0_macvtap: entered promiscuous mode [ 50.928910][ T5731] veth1_macvtap: entered promiscuous mode [ 50.946387][ T5743] veth0_macvtap: entered promiscuous mode [ 50.961261][ T5743] veth1_macvtap: entered promiscuous mode [ 50.965355][ T5735] veth0_vlan: entered promiscuous mode [ 50.983766][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.989953][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.990319][ T5735] veth1_vlan: entered promiscuous mode [ 50.993184][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.010655][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.021482][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 51.036003][ T1156] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.036050][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.041695][ T1156] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.080671][ T5735] veth0_macvtap: entered promiscuous mode [ 51.113713][ T5735] veth1_macvtap: entered promiscuous mode [ 51.122811][ T5730] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 51.137715][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.138201][ T5730] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 51.146856][ T1155] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.148321][ T5730] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 51.150171][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.154337][ T1155] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.155806][ T5730] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 51.177130][ T5735] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 51.178308][ T5730] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 51.201765][ T5735] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.205764][ T1156] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.210399][ T1156] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.254286][ T1155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.257180][ T1155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.279134][ T1156] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.281822][ T1156] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.287681][ T5808] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.292089][ T5808] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.313762][ T1156] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.317955][ T1156] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.341274][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.344701][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.378825][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.381651][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.384466][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.387221][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.393242][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.457791][ T5812] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.460864][ T5812] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.528097][ T5812] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.549050][ T5808] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.552100][ T5808] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.598036][ T5812] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.625069][ T5896] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 52.208611][ T5734] Bluetooth: hci2: command tx timeout [ 52.208735][ T64] Bluetooth: hci0: command tx timeout [ 52.208781][ T64] Bluetooth: hci1: command tx timeout [ 52.217698][ T5744] Bluetooth: hci3: command tx timeout [ 52.474009][ T5903] binder: 5902:5903 unknown command 0 [ 52.479853][ T5903] binder: 5902:5903 ioctl c0306201 800004c0 returned -22 [ 52.766542][ T5892] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 53.042093][ T42] audit: type=1326 audit(1786334655.920:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5889 comm="syz.0.1" exe="/syz-executor" sig=31 arch=40000003 syscall=20 compat=1 ip=0xf700efec code=0x0 [ 53.427141][ T5911] ceph: Path missing in source [ 53.679841][ T5913] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input5 [ 54.287942][ T5744] Bluetooth: hci2: command tx timeout [ 54.291112][ T64] Bluetooth: hci0: command tx timeout [ 54.297597][ T64] Bluetooth: hci3: command tx timeout [ 54.303371][ T5744] Bluetooth: hci1: command tx timeout [ 54.332277][ T5920] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 54.334438][ T5920] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 54.338640][ T5920] vhci_hcd vhci_hcd.0: Device attached [ 54.667628][ T60] usb 38-1: SetAddress Request (2) to port 0 [ 54.670450][ T60] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 54.975547][ T5931] mmap: syz.3.11 (5931) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 54.981258][ T5921] vhci_hcd: connection reset by peer [ 54.991223][ T5812] vhci_hcd vhci_hcd.0: stop threads [ 54.997915][ T5812] vhci_hcd vhci_hcd.0: release socket [ 55.003271][ T5812] vhci_hcd vhci_hcd.0: disconnect device [ 55.653460][ T5935] pim6reg: entered allmulticast mode [ 55.739740][ T5940] netlink: 'syz.1.15': attribute type 1 has an invalid length. [ 55.751745][ T5940] netlink: 28 bytes leftover after parsing attributes in process `syz.1.15'. [ 55.753408][ T5935] pim6reg: left allmulticast mode [ 55.880392][ T5940] team0: entered promiscuous mode [ 55.882091][ T5940] team_slave_0: entered promiscuous mode [ 55.887380][ T5940] team_slave_1: entered promiscuous mode [ 55.891491][ T5940] team0: entered allmulticast mode [ 55.893233][ T5940] team_slave_0: entered allmulticast mode [ 55.895184][ T5940] team_slave_1: entered allmulticast mode [ 55.909660][ T5947] bridge1: entered promiscuous mode [ 55.912734][ T5947] bridge1: entered allmulticast mode [ 55.917274][ T5947] team0: Port device bridge1 added [ 56.407652][ T64] Bluetooth: hci3: command tx timeout [ 56.409451][ T64] Bluetooth: hci1: command tx timeout [ 56.411196][ T64] Bluetooth: hci0: command tx timeout [ 56.413043][ T64] Bluetooth: hci2: command tx timeout [ 56.511534][ T5961] netlink: 'syz.2.20': attribute type 1 has an invalid length. [ 56.515257][ T5961] netlink: 224 bytes leftover after parsing attributes in process `syz.2.20'. [ 56.519623][ T5941] overlayfs: statfs failed on './file0' [ 56.681630][ T5969] ehci-pci 0000:00:1d.7: remove, state 1 [ 56.685461][ T5969] usb usb1: USB disconnect, device number 1 [ 56.688639][ T5969] usb 1-1: USB disconnect, device number 2 [ 56.837032][ T5962] netlink: 68 bytes leftover after parsing attributes in process `syz.2.20'. [ 57.369261][ T5982] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(8) [ 57.372018][ T5982] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 57.386750][ T5982] vhci_hcd vhci_hcd.0: Device attached [ 57.625225][ T5969] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 58.152056][ T5992] capability: warning: `syz.2.24' uses deprecated v2 capabilities in a way that may be insecure [ 58.207622][ T5826] usb 44-1: SetAddress Request (2) to port 0 [ 58.210805][ T5826] usb 44-1: new SuperSpeed USB device number 2 using vhci_hcd [ 58.327690][ T29] usb 2-1: new full-speed USB device number 2 using uhci_hcd [ 58.408106][ T9] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 58.492876][ T5995] netlink: 'syz.1.25': attribute type 11 has an invalid length. [ 58.524222][ T29] usb 2-1: not running at top speed; connect to a high speed hub [ 58.528913][ T29] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 58.550958][ T29] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 58.554568][ T29] usb 2-1: Product: QEMU USB Tablet [ 58.556483][ T29] usb 2-1: Manufacturer: QEMU [ 58.557567][ T9] usb 7-1: Using ep0 maxpacket: 8 [ 58.558607][ T29] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 58.561422][ T9] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 58.574726][ T9] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 58.577524][ T9] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 58.582727][ T9] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 58.585883][ T9] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 58.589529][ T9] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 58.594201][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 58.629424][ T29] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0002/input/input6 [ 58.660254][ T29] hid-generic 0003:0627:0001.0002: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 58.670775][ T5983] vhci_hcd: connection reset by peer [ 58.673481][ T5808] vhci_hcd vhci_hcd.3: stop threads [ 58.681287][ T5808] vhci_hcd vhci_hcd.3: release socket [ 58.692960][ T5970] usb 2-1: USB disconnect, device number 2 [ 58.706841][ T5808] vhci_hcd vhci_hcd.3: disconnect device [ 58.835703][ T9] usb 7-1: usb_control_msg returned -32 [ 58.837705][ T9] usbtmc 7-1:16.0: can't read capabilities [ 58.944907][ T5997] fido_id[5997]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 59.021115][ T5970] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 59.032122][ T5970] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 59.039880][ T5970] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 59.057697][ T5970] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 59.064349][ T5970] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 59.073410][ T5970] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 59.076995][ T5970] usb usb1: Product: EHCI Host Controller [ 59.079474][ T5970] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 59.082214][ T5970] usb usb1: SerialNumber: 0000:00:1d.7 [ 59.101676][ T5970] hub 1-0:1.0: USB hub found [ 59.105860][ T5970] hub 1-0:1.0: 6 ports detected [ 59.153522][ T5970] hub 2-0:1.0: USB hub found [ 59.156362][ T5970] hub 2-0:1.0: 2 ports detected [ 59.193978][ T5970] hub 3-0:1.0: USB hub found [ 59.196635][ T5970] hub 3-0:1.0: 2 ports detected [ 59.239810][ T5970] hub 4-0:1.0: USB hub found [ 59.243763][ T5970] hub 4-0:1.0: 2 ports detected [ 59.397997][ T61] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 59.402647][ T5841] usb 7-1: USB disconnect, device number 2 [ 59.607026][ T6008] ntfs3(nullb0): Primary boot signature is not NTFS. [ 59.607256][ T61] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 59.614092][ T6008] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 59.628180][ T61] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 59.631519][ T61] usb 1-1: Product: QEMU USB Tablet [ 59.633742][ T61] usb 1-1: Manufacturer: QEMU [ 59.635615][ T61] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 59.676061][ T6010] Unknown vers= option specified: 3.0/ [ 59.676061][ T6010] [ 59.676580][ T61] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0003/input/input7 [ 59.679643][ T6010] CIFS: VFS: Unknown vers= option specified: 3.0/ [ 59.691306][ T61] hid-generic 0003:0627:0001.0003: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 59.737805][ T60] usb 38-1: device descriptor read/8, error -110 [ 59.955442][ T42] audit: type=1326 audit(1786334662.830:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.0.29" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 59.966610][ T42] audit: type=1326 audit(1786334662.830:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.0.29" exe="/syz-executor" sig=0 arch=40000003 syscall=286 compat=1 ip=0xf700efec code=0x7ffc0000 [ 59.973537][ T6020] netlink: 'syz.2.30': attribute type 1 has an invalid length. [ 59.978778][ T6020] netlink: 756 bytes leftover after parsing attributes in process `syz.2.30'. [ 59.987579][ T42] audit: type=1326 audit(1786334662.830:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.0.29" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 59.994485][ T42] audit: type=1326 audit(1786334662.830:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.0.29" exe="/syz-executor" sig=0 arch=40000003 syscall=283 compat=1 ip=0xf700efec code=0x7ffc0000 [ 60.004975][ T42] audit: type=1326 audit(1786334662.830:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.0.29" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 60.008282][ T61] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 60.027595][ T42] audit: type=1326 audit(1786334662.830:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.0.29" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf700efec code=0x7ffc0000 [ 60.040923][ T42] audit: type=1326 audit(1786334662.830:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.0.29" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 60.053528][ T42] audit: type=1326 audit(1786334662.840:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.0.29" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf700efec code=0x7ffc0000 [ 60.062382][ T42] audit: type=1326 audit(1786334662.840:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.0.29" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 60.071556][ T42] audit: type=1326 audit(1786334662.840:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6016 comm="syz.0.29" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf700efec code=0x7ffc0000 [ 60.148131][ T60] usb usb38-port1: attempt power cycle [ 60.153160][ T6020] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 60.177613][ T61] usb 8-1: Using ep0 maxpacket: 16 [ 60.182868][ T61] usb 8-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 60.191717][ T61] usb 8-1: config 128 has an invalid descriptor of length 128, skipping remainder of the config [ 60.195228][ T61] usb 8-1: config 128 has 0 interfaces, different from the descriptor's value: 1 [ 60.202177][ T61] usb 8-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 60.204890][ T61] usb 8-1: Product: syz [ 60.206371][ T61] usb 8-1: Manufacturer: syz [ 60.208035][ T61] usb 8-1: SerialNumber: syz [ 60.433620][ T6005] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 60.442785][ T6005] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 60.468094][ T61] usb 8-1: USB disconnect, device number 2 [ 60.577639][ T5809] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 60.728068][ T5809] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 60.728643][ T60] usb usb38-port1: unable to enumerate USB device [ 60.735138][ T5809] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 60.749892][ T5809] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 60.755727][ T5809] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 60.759596][ T5809] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 60.764315][ T5809] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 60.770614][ T5809] usb 7-1: config 0 descriptor?? [ 60.800897][ T6051] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 60.823531][ T6051] IPv6: addrconf: prefix option has invalid lifetime [ 60.901142][ T6057] qrtr: Invalid version 0 [ 60.928656][ T6057] syz.0.34 uses obsolete (PF_INET,SOCK_PACKET) [ 60.932128][ T6057] syzkaller1: entered promiscuous mode [ 60.934798][ T6057] syzkaller1: entered allmulticast mode [ 61.526552][ T6066] program syz.0.36 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 61.937136][ T5809] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 63.248682][ T5826] usb 44-1: device descriptor read/8, error -110 [ 63.312357][ T6088] syz.0.41: vmalloc error: size 34359742464, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 63.319012][ T6088] CPU: 2 UID: 0 PID: 6088 Comm: syz.0.41 Tainted: G L syzkaller #0 PREEMPT(full) [ 63.319045][ T6088] Tainted: [L]=SOFTLOCKUP [ 63.319050][ T6088] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 63.319066][ T6088] Call Trace: [ 63.319079][ T6088] [ 63.319085][ T6088] dump_stack_lvl+0x100/0x190 [ 63.319227][ T6088] warn_alloc.cold+0x94/0xa8 [ 63.319253][ T6088] ? __pfx_warn_alloc+0x10/0x10 [ 63.319291][ T6088] ? kasan_save_stack+0x3f/0x50 [ 63.319309][ T6088] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 63.319322][ T6088] ? xskq_create+0x52/0x1d0 [ 63.319397][ T6088] ? xsk_setsockopt+0x56f/0xab0 [ 63.319411][ T6088] ? do_sock_setsockopt+0xf3/0x1d0 [ 63.319468][ T6088] ? __sys_setsockopt+0x119/0x190 [ 63.319484][ T6088] ? __ia32_sys_setsockopt+0xbc/0x160 [ 63.319501][ T6088] ? __do_fast_syscall_32+0xe7/0x970 [ 63.319519][ T6088] ? do_fast_syscall_32+0x32/0x70 [ 63.319542][ T6088] ? xskq_create+0xfb/0x1d0 [ 63.319557][ T6088] __vmalloc_node_range_noprof+0x136c/0x1630 [ 63.319584][ T6088] ? xskq_create+0xfb/0x1d0 [ 63.319600][ T6088] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 63.319620][ T6088] ? kasan_save_track+0x14/0x30 [ 63.319634][ T6088] ? __kasan_kmalloc+0xaa/0xb0 [ 63.319648][ T6088] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 63.319659][ T6088] ? xskq_create+0xfb/0x1d0 [ 63.319672][ T6088] vmalloc_user_noprof+0x9e/0xe0 [ 63.319689][ T6088] ? xskq_create+0xfb/0x1d0 [ 63.319702][ T6088] xskq_create+0xfb/0x1d0 [ 63.319717][ T6088] xsk_setsockopt+0x56f/0xab0 [ 63.319730][ T6088] ? __pfx_xsk_setsockopt+0x10/0x10 [ 63.319745][ T6088] ? __pfx_xsk_setsockopt+0x10/0x10 [ 63.319760][ T6088] ? __pfx_xsk_setsockopt+0x10/0x10 [ 63.319773][ T6088] do_sock_setsockopt+0xf3/0x1d0 [ 63.319792][ T6088] __sys_setsockopt+0x119/0x190 [ 63.319810][ T6088] __ia32_sys_setsockopt+0xbc/0x160 [ 63.319824][ T6088] ? __do_fast_syscall_32+0x98/0x970 [ 63.319840][ T6088] ? lockdep_hardirqs_on+0x78/0x100 [ 63.319855][ T6088] __do_fast_syscall_32+0xe7/0x970 [ 63.319871][ T6088] ? lockdep_hardirqs_on+0x78/0x100 [ 63.319886][ T6088] do_fast_syscall_32+0x32/0x70 [ 63.319902][ T6088] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 63.319918][ T6088] RIP: 0023:0xf700efec [ 63.319933][ T6088] Code: Unable to access opcode bytes at 0xf700efc2. [ 63.319945][ T6088] RSP: 002b:00000000f53dc50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 63.319958][ T6088] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 000000000000011b [ 63.319966][ T6088] RDX: 0000000000000002 RSI: 0000000080000080 RDI: 000000000000001c [ 63.319974][ T6088] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 63.319986][ T6088] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 63.319994][ T6088] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 63.320009][ T6088] [ 63.320038][ T6088] Mem-Info: [ 63.333560][ T5882] usb 7-1: USB disconnect, device number 3 [ 63.333826][ T6088] active_anon:7241 inactive_anon:443 isolated_anon:0 [ 63.333826][ T6088] active_file:131 inactive_file:53427 isolated_file:0 [ 63.333826][ T6088] unevictable:1000 dirty:425 writeback:0 [ 63.333826][ T6088] slab_reclaimable:8882 slab_unreclaimable:51017 [ 63.333826][ T6088] mapped:25109 shmem:4393 pagetables:1012 [ 63.333826][ T6088] sec_pagetables:294 bounce:0 [ 63.333826][ T6088] kernel_misc_reclaimable:0 [ 63.333826][ T6088] free:41105 free_pcp:14181 free_cma:0 [ 63.445263][ T6088] Node 0 active_anon:76kB inactive_anon:20kB active_file:524kB inactive_file:0kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:40kB dirty:48kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8288kB pagetables:1400kB sec_pagetables:1132kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 63.456867][ T6088] Node 1 active_anon:28816kB inactive_anon:1756kB active_file:0kB inactive_file:213708kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:100376kB dirty:1652kB writeback:0kB shmem:15504kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:4764kB pagetables:2656kB sec_pagetables:44kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 63.468757][ T6088] Node 0 DMA free:1864kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:388kB local_pcp:48kB free_cma:0kB [ 63.478326][ T6088] lowmem_reserve[]: 0 280 280 280 280 [ 63.480813][ T6088] Node 0 DMA32 free:16308kB boost:10240kB min:23016kB low:26208kB high:29400kB reserved_highatomic:0KB free_highatomic:0KB active_anon:76kB inactive_anon:20kB active_file:524kB inactive_file:0kB unevictable:2000kB writepending:48kB zspages:0kB present:1032196kB managed:287068kB mlocked:0kB bounce:0kB free_pcp:10596kB local_pcp:1108kB free_cma:0kB [ 63.491210][ T6088] lowmem_reserve[]: 0 0 0 0 0 [ 63.493686][ T6088] Node 1 DMA32 free:145272kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:28816kB inactive_anon:1756kB active_file:0kB inactive_file:213708kB unevictable:2000kB writepending:1652kB zspages:2872kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:46804kB local_pcp:11344kB free_cma:0kB [ 63.506207][ T6088] lowmem_reserve[]: 0 0 0 0 0 [ 63.507950][ T6088] Node 0 DMA: 22*4kB (U) 4*8kB (UM) 5*16kB (UM) 4*32kB (UM) 2*64kB (U) 1*128kB (M) 1*256kB (M) 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 1864kB [ 63.512577][ T6088] Node 0 DMA32: 25*4kB (U) 64*8kB (UME) 75*16kB (UME) 89*32kB (UME) 62*64kB (UME) 26*128kB (UME) 9*256kB (ME) 4*512kB (ME) 0*1024kB 0*2048kB 0*4096kB = 16308kB [ 63.520118][ T6088] Node 1 DMA32: 114*4kB (UME) 148*8kB (UME) 215*16kB (UME) 100*32kB (UM) 43*64kB (UME) 24*128kB (UME) 26*256kB (UM) 5*512kB (UME) 3*1024kB (UME) 2*2048kB (U) 28*4096kB (M) = 145176kB [ 63.525854][ T6088] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 63.529105][ T6088] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 63.533433][ T6088] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 63.537981][ T6088] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 63.542123][ T6088] 58647 total pagecache pages [ 63.544050][ T6088] 552 pages in swap cache [ 63.545663][ T6088] Free swap = 116184kB [ 63.547103][ T6088] Total swap = 124996kB [ 63.548983][ T6088] 524155 pages RAM [ 63.550410][ T6088] 0 pages HighMem/MovableOnly [ 63.551953][ T6088] 211495 pages reserved [ 63.553293][ T6088] 0 pages cma reserved [ 63.639417][ T5826] usb usb44-port1: attempt power cycle [ 63.939385][ T60] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 63.958214][ T5882] usb 8-1: new full-speed USB device number 3 using dummy_hcd [ 63.975233][ T6095] loop0: detected capacity change from 0 to 32768 [ 64.050578][ T6098] fuse: Bad value for 'user_id' [ 64.052895][ T6098] fuse: Bad value for 'user_id' [ 64.082996][ T6095] device-mapper: thin: Data device (loop1) discard unsupported: Disabling discard passdown. [ 64.109061][ T5882] usb 8-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 64.113050][ T5882] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 64.116459][ T5882] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 64.121994][ T5882] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 64.124572][ T5882] usb 8-1: Product: syz [ 64.126225][ T5882] usb 8-1: Manufacturer: syz [ 64.128478][ T5882] usb 8-1: SerialNumber: syz [ 64.140408][ T5882] usb 8-1: config 0 descriptor?? [ 64.144584][ T5882] hub 8-1:0.0: bad descriptor, ignoring hub [ 64.146521][ T5882] hub 8-1:0.0: probe with driver hub failed with error -5 [ 64.151337][ T5882] input: syz syz as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/input/input9 [ 64.206005][ T6103] netlink: 'syz.1.46': attribute type 12 has an invalid length. [ 64.209498][ T6103] netlink: 'syz.1.46': attribute type 29 has an invalid length. [ 64.213642][ T6103] netlink: 148 bytes leftover after parsing attributes in process `syz.1.46'. [ 64.217010][ T6103] netlink: 'syz.1.46': attribute type 1 has an invalid length. [ 64.219666][ T6103] netlink: 32 bytes leftover after parsing attributes in process `syz.1.46'. [ 64.220360][ T60] usb 7-1: Using ep0 maxpacket: 32 [ 64.226206][ T5826] usb usb44-port1: unable to enumerate USB device [ 64.229924][ T60] usb 7-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 64.237416][ T60] usb 7-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 64.241416][ T60] usb 7-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 64.246210][ T60] usb 7-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 64.250711][ T60] usb 7-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 64.258667][ T60] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 64.262165][ T60] usb 7-1: Product: syz [ 64.264503][ T60] usb 7-1: Manufacturer: syz [ 64.266426][ T60] usb 7-1: SerialNumber: syz [ 64.276941][ C1] imon 7-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 64.283880][ T60] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:155.0/input/input10 [ 64.518369][ T6109] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 64.578305][ T60] imon 7-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 64.584373][ T60] (id 0x00) [ 64.637512][ T60] rc_core: IR keymap rc-imon-pad not found [ 64.639465][ T60] Registered IR keymap rc-empty [ 64.641127][ T60] imon 7-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 64.644455][ T60] imon 7-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 64.678823][ T5826] IPVS: starting estimator thread 0... [ 64.751400][ T60] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:155.0/rc/rc0 [ 64.788860][ T6112] IPVS: using max 44 ests per chain, 105600 per kthread [ 64.789438][ T60] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:155.0/rc/rc0/input11 [ 64.816397][ T60] imon 7-1:155.0: iMON device (15c2:ffdc, intf0) on usb<7:4> initialized [ 65.099930][ T42] kauditd_printk_skb: 30 callbacks suppressed [ 65.099949][ T42] audit: type=1804 audit(1786334667.980:43): pid=6117 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.43" name="/newroot/11/bus/bus" dev="overlay" ino=86 res=1 errno=0 [ 65.148790][ T6116] overlayfs: statfs failed on './file0' [ 66.707682][ T6092] imon:send_packet: task interrupted [ 66.709990][ T6092] imon:send_packet: packet tx failed (-512) [ 66.712656][ T6092] imon:vfd_write: send packet #0 failed [ 66.725582][ T5809] usb 7-1: USB disconnect, device number 4 [ 67.140922][ T1479] usb 8-1: USB disconnect, device number 3 [ 68.416607][ T6158] pimreg: entered allmulticast mode [ 68.429672][ T6158] pimreg: left allmulticast mode [ 68.713514][ T42] audit: type=1800 audit(1786334671.590:44): pid=6170 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.66" name="file0" dev="overlay" ino=141 res=0 errno=0 [ 68.865979][ T6170] uhci_hcd 0000:00:1d.0: remove, state 4 [ 68.872936][ T6170] usb usb2: USB disconnect, device number 1 [ 69.238186][ T6170] uhci_hcd 0000:00:1d.0: USB bus 2 deregistered [ 69.272743][ T6179] vxcan1: tx drop: invalid da for name 0x0000000000000003 [ 69.405840][ T6178] pci 0000:00:1d.0: [8086:2934] type 00 class 0x0c0300 conventional PCI endpoint [ 69.412045][ T6178] pci 0000:00:1d.0: BAR 4 [io 0xc0e0-0xc0ff] [ 69.424839][ T6178] pci 0000:00:1d.0: Adding to iommu group 7 [ 69.438489][ T6178] pci 0000:00:1d.0: BAR 4 [io 0x2000-0x201f]: assigned [ 69.499093][ T6178] pci 0000:00:1d.0: quirk_usb_early_handoff+0x0/0x1360 took 55863 usecs [ 69.520710][ T6184] wlan0 speed is unknown, defaulting to 1000 [ 69.522829][ T6184] wlan0 speed is unknown, defaulting to 1000 [ 69.530929][ T6184] wlan0 speed is unknown, defaulting to 1000 [ 69.535524][ T6178] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 69.538693][ T6184] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 69.545199][ T6184] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 69.553717][ T6184] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 69.556876][ T6178] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 2 [ 69.562680][ T6184] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 69.567808][ T6184] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 69.569160][ T6178] uhci_hcd 0000:00:1d.0: detected 2 ports [ 69.608729][ T6184] wlan0 speed is unknown, defaulting to 1000 [ 69.614137][ T6184] wlan0 speed is unknown, defaulting to 1000 [ 69.619391][ T6178] uhci_hcd 0000:00:1d.0: irq 16, io port 0x00002000 [ 69.623909][ T6184] wlan0 speed is unknown, defaulting to 1000 [ 69.629389][ T6178] usb usb2: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 69.632755][ T6184] wlan0 speed is unknown, defaulting to 1000 [ 69.640033][ T6178] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 69.647259][ T6178] usb usb2: Product: UHCI Host Controller [ 69.649882][ T6178] usb usb2: Manufacturer: Linux syzkaller uhci_hcd [ 69.652040][ T6178] usb usb2: SerialNumber: 0000:00:1d.0 [ 69.834935][ T6178] hub 2-0:1.0: USB hub found [ 69.852533][ T6178] hub 2-0:1.0: 2 ports detected [ 70.007405][ T6191] netlink: 40 bytes leftover after parsing attributes in process `syz.2.69'. [ 70.777426][ T5744] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 70.780983][ T5744] CPU: 1 UID: 0 PID: 5744 Comm: kworker/u34:6 Tainted: G L syzkaller #0 PREEMPT(full) [ 70.781003][ T5744] Tainted: [L]=SOFTLOCKUP [ 70.781008][ T5744] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.781024][ T5744] Workqueue: hci3 hci_rx_work [ 70.781066][ T5744] Call Trace: [ 70.781070][ T5744] [ 70.781076][ T5744] dump_stack_lvl+0x100/0x190 [ 70.781094][ T5744] sysfs_warn_dup.cold+0x1c/0x28 [ 70.781113][ T5744] sysfs_create_dir_ns+0x24b/0x2b0 [ 70.781172][ T5744] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 70.781189][ T5744] ? find_held_lock+0x2b/0x80 [ 70.781217][ T5744] ? kobject_add_internal+0x25f/0x930 [ 70.781230][ T5744] ? kobject_add_internal+0x25f/0x930 [ 70.781244][ T5744] ? do_raw_spin_unlock+0x145/0x1e0 [ 70.781259][ T5744] kobject_add_internal+0x2c8/0x930 [ 70.781273][ T5744] kobject_add+0x16a/0x1e0 [ 70.781285][ T5744] ? __pfx_kobject_add+0x10/0x10 [ 70.781306][ T5744] device_add+0x294/0x1970 [ 70.781340][ T5744] ? __pfx_dev_set_name+0x10/0x10 [ 70.781354][ T5744] ? __pfx_device_add+0x10/0x10 [ 70.781364][ T5744] ? mgmt_send_event_skb+0x2fb/0x460 [ 70.781385][ T5744] hci_conn_add_sysfs+0x1a3/0x260 [ 70.781404][ T5744] le_conn_complete_evt+0x11eb/0x1f60 [ 70.781423][ T5744] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 70.781439][ T5744] ? irqentry_exit+0x24d/0xa00 [ 70.781454][ T5744] ? lockdep_hardirqs_on+0x78/0x100 [ 70.781471][ T5744] hci_le_conn_complete_evt+0x23c/0x3a0 [ 70.781491][ T5744] ? skb_pull_data+0x15f/0x1e0 [ 70.781507][ T5744] hci_le_meta_evt+0x34a/0x5f0 [ 70.781523][ T5744] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 70.781540][ T5744] hci_event_packet+0x51c/0xcd0 [ 70.781556][ T5744] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 70.781573][ T5744] ? __pfx_hci_event_packet+0x10/0x10 [ 70.781589][ T5744] ? kcov_remote_start+0x384/0x670 [ 70.781606][ T5744] ? lockdep_hardirqs_on+0x78/0x100 [ 70.781623][ T5744] hci_rx_work+0x451/0xfc0 [ 70.781640][ T5744] process_one_work+0xa23/0x1940 [ 70.781662][ T5744] ? __pfx_process_one_work+0x10/0x10 [ 70.781682][ T5744] ? __pfx_hci_rx_work+0x10/0x10 [ 70.781697][ T5744] worker_thread+0x5ef/0xe50 [ 70.781718][ T5744] ? kthread+0x13a/0x450 [ 70.781732][ T5744] ? __pfx_worker_thread+0x10/0x10 [ 70.781747][ T5744] kthread+0x370/0x450 [ 70.781761][ T5744] ? __pfx_kthread+0x10/0x10 [ 70.781776][ T5744] ret_from_fork+0x72b/0xd50 [ 70.781792][ T5744] ? __pfx_ret_from_fork+0x10/0x10 [ 70.781806][ T5744] ? __switch_to+0x800/0x10f0 [ 70.781816][ T5744] ? __pfx_kthread+0x10/0x10 [ 70.781831][ T5744] ret_from_fork_asm+0x1a/0x30 [ 70.781853][ T5744] [ 70.781912][ T5744] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 70.875568][ T6196] netlink: 16 bytes leftover after parsing attributes in process `syz.3.71'. [ 70.879682][ T5744] Bluetooth: hci3: failed to register connection device [ 70.930358][ T1434] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.108369][ T5841] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 71.268545][ T5841] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 71.288056][ T5841] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 71.291678][ T5841] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 71.296895][ T5841] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 71.302584][ T5841] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 71.317175][ T5841] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 71.334253][ T5841] usb 5-1: Product: syz [ 71.340305][ T5841] usb 5-1: Manufacturer: syz [ 71.369429][ T6214] lo speed is unknown, defaulting to 1000 [ 71.372291][ T6214] lo speed is unknown, defaulting to 1000 [ 71.386045][ T6214] lo speed is unknown, defaulting to 1000 [ 71.401752][ T6214] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 71.407218][ T6214] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 71.426807][ T6214] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 71.495256][ T6214] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 71.534950][ T5841] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 71.771408][ T6214] lo speed is unknown, defaulting to 1000 [ 71.781786][ T6214] lo speed is unknown, defaulting to 1000 [ 71.790207][ T6214] lo speed is unknown, defaulting to 1000 [ 71.844029][ T6214] lo speed is unknown, defaulting to 1000 [ 72.288702][ T6210] smbdirect: ib_dev[syz0] removed [ 72.400088][ T5841] usb 5-1: USB disconnect, device number 2 [ 72.463946][ T6225] vivid-000: ================= START STATUS ================= [ 72.466898][ T6225] vivid-000: Test Pattern: 75% Colorbar [ 72.469198][ T6225] vivid-000: Fill Percentage of Frame: 100 [ 72.471506][ T6225] vivid-000: Horizontal Movement: No Movement [ 72.473396][ T6225] vivid-000: Vertical Movement: No Movement [ 72.475437][ T6225] vivid-000: OSD Text Mode: All [ 72.477022][ T6225] vivid-000: Show Border: false [ 72.478895][ T6225] vivid-000: Show Square: false [ 72.480404][ T6225] vivid-000: Sensor Flipped Horizontally: false [ 72.492440][ T6225] vivid-000: Sensor Flipped Vertically: false [ 72.499692][ T6225] vivid-000: Insert SAV Code in Image: false [ 72.506030][ T6225] vivid-000: Insert EAV Code in Image: false [ 72.508169][ T6225] vivid-000: Insert Video Guard Band: false [ 72.510015][ T6225] vivid-000: Reduced Framerate: false [ 72.511676][ T6225] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 72.514043][ T6225] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 72.521911][ T6225] vivid-000: Enable Capture Cropping: true grabbed [ 72.523913][ T6225] vivid-000: Enable Capture Composing: true grabbed [ 72.531772][ T6225] vivid-000: Enable Capture Scaler: true grabbed [ 72.535604][ T6225] vivid-000: Timestamp Source: End of Frame [ 72.538393][ T6225] vivid-000: Colorspace: sRGB [ 72.540067][ T6225] vivid-000: Transfer Function: Default [ 72.544163][ T6225] vivid-000: Y'CbCr Encoding: Default [ 72.548439][ T6225] vivid-000: HSV Encoding: Hue 0-179 [ 72.551338][ T6225] vivid-000: Quantization: Default [ 72.554305][ T6225] vivid-000: Apply Alpha To Red Only: false [ 72.557713][ T6225] vivid-000: Standard Aspect Ratio: 4x3 [ 72.559861][ T6225] vivid-000: DV Timings Signal Mode: Current DV Timings inactive [ 72.562226][ T6225] vivid-000: DV Timings: 4096x2160p60 inactive [ 72.564154][ T6225] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 72.566410][ T6225] vivid-000: Maximum EDID Blocks: 2 [ 72.568293][ T6225] vivid-000: Limited RGB Range (16-235): false [ 72.570273][ T6225] vivid-000: Rx RGB Quantization Range: RGB Full Range (0-255) [ 72.572644][ T6225] vivid-000: Power Present: 0x00000001 [ 72.574367][ T6225] tpg source WxH: 320x240 (Y'CbCr) [ 72.575989][ T6225] tpg field: 1 [ 72.577218][ T6225] tpg crop: (0,0)/320x240 [ 72.581104][ T6225] tpg compose: (0,0)/320x240 [ 72.582944][ T6225] tpg colorspace: 8 [ 72.584633][ T6225] tpg transfer function: 0/2 [ 72.586575][ T6225] tpg Y'CbCr encoding: 0/1 [ 72.588572][ T6225] tpg quantization: 0/2 [ 72.590401][ T6225] tpg RGB range: 0/2 [ 72.592052][ T6225] vivid-000: ================== END STATUS ================== [ 74.559274][ T5809] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 74.707642][ T5809] usb 8-1: Using ep0 maxpacket: 32 [ 74.717054][ T5809] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 74.806234][ T5809] usb 8-1: config index 0 descriptor too short (expected 13339, got 27) [ 74.837421][ T5809] usb 8-1: config 108 has an invalid descriptor of length 32, skipping remainder of the config [ 74.865316][ T5809] usb 8-1: config 108 has 0 interfaces, different from the descriptor's value: 32 [ 74.932406][ T6290] ehci-pci 0000:00:1d.7: remove, state 1 [ 74.934441][ T6290] usb usb1: USB disconnect, device number 1 [ 74.937035][ T6290] usb 1-1: USB disconnect, device number 2 [ 74.942206][ T5809] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 74.954665][ T5809] usb 8-1: Product: syz [ 74.969393][ T5809] usb 8-1: Manufacturer: syz [ 74.980733][ T5809] usb 8-1: SerialNumber: syz [ 75.520439][ T64] Bluetooth: hci3: command 0x0406 tx timeout [ 75.553926][ T6290] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 75.817847][ T5988] usb 2-1: new full-speed USB device number 2 using uhci_hcd [ 76.044085][ T5988] usb 2-1: not running at top speed; connect to a high speed hub [ 76.292965][ T6297] loop2: detected capacity change from 0 to 7 [ 76.306379][ T6297] Dev loop2: unable to read RDB block 7 [ 76.308434][ T6297] loop2: unable to read partition table [ 76.310321][ T6297] loop2: partition table beyond EOD, truncated [ 76.312305][ T6297] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 76.417004][ T5988] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 76.766725][ T5988] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 76.771320][ T5988] usb 2-1: Product: QEMU USB Tablet [ 76.774032][ T5988] usb 2-1: Manufacturer: QEMU [ 76.775915][ T5988] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 76.820968][ T5988] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0005/input/input12 [ 76.962445][ T5988] hid-generic 0003:0627:0001.0005: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 77.004215][ T6292] usb 2-1: USB disconnect, device number 2 [ 77.413916][ T6353] fido_id[6353]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/2-1/report_descriptor': No such file or directory [ 77.529258][ T5809] usb 8-1: USB disconnect, device number 4 [ 77.556987][ T6292] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 77.638411][ T6292] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 77.674772][ T6292] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 77.707631][ T6292] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 77.741989][ T6292] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 77.770839][ T6292] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 77.775685][ T6292] usb usb1: Product: EHCI Host Controller [ 77.796651][ T6292] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 77.806217][ T6292] usb usb1: SerialNumber: 0000:00:1d.7 [ 77.833707][ T6292] hub 1-0:1.0: USB hub found [ 77.847758][ T6292] hub 1-0:1.0: 6 ports detected [ 77.929869][ T6292] hub 3-0:1.0: USB hub found [ 77.937816][ T6292] hub 3-0:1.0: 2 ports detected [ 78.017970][ T6377] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 78.026602][ T6292] hub 4-0:1.0: USB hub found [ 78.032021][ T6292] hub 4-0:1.0: 2 ports detected [ 78.040193][ T6377] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 78.081631][ T6292] hub 2-0:1.0: USB hub found [ 78.083495][ T6292] hub 2-0:1.0: 2 ports detected [ 78.187546][ T5809] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 78.269684][ T6380] jffs2: notice: (6380) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 78.337606][ T9] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 78.368498][ T5809] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 78.385339][ T5809] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 78.388623][ T5809] usb 1-1: Product: QEMU USB Tablet [ 78.390711][ T5809] usb 1-1: Manufacturer: QEMU [ 78.392571][ T5809] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 78.420570][ T5809] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0006/input/input13 [ 78.491173][ T9] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 78.494280][ T5809] hid-generic 0003:0627:0001.0006: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 78.495572][ T9] usb 8-1: config index 0 descriptor too short (expected 39, got 27) [ 78.501271][ T9] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 78.505368][ T9] usb 8-1: config 0 interface 0 has no altsetting 0 [ 78.511186][ T9] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 78.514645][ T9] usb 8-1: Product: syz [ 78.516427][ T9] usb 8-1: Manufacturer: syz [ 78.518242][ T9] usb 8-1: SerialNumber: syz [ 78.527121][ T9] usb 8-1: config 0 descriptor?? [ 78.531834][ T9] hub 8-1:0.0: bad descriptor, ignoring hub [ 78.534998][ T9] hub 8-1:0.0: probe with driver hub failed with error -5 [ 78.541801][ T9] usb 8-1: selecting invalid altsetting 0 [ 78.641795][ T6386] netlink: 'syz.0.95': attribute type 1 has an invalid length. [ 78.649513][ T6386] netlink: 224 bytes leftover after parsing attributes in process `syz.0.95'. [ 79.031515][ T6393] netlink: 4 bytes leftover after parsing attributes in process `syz.2.97'. [ 79.038948][ T6393] netlink: 72 bytes leftover after parsing attributes in process `syz.2.97'. [ 79.130522][ T6393] netlink: 'syz.2.97': attribute type 2 has an invalid length. [ 79.186413][ T6397] netlink: 'syz.2.97': attribute type 4 has an invalid length. [ 79.309373][ T6391] process 'syz.1.96' launched './file2' with NULL argv: empty string added [ 79.439335][ T6374] usb 8-1: reset high-speed USB device number 5 using dummy_hcd [ 79.598487][ T6374] usb 8-1: device firmware changed [ 79.605254][ T9] usb 8-1: USB disconnect, device number 5 [ 79.790502][ T9] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 80.227991][ T9] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice= 8.00 [ 80.232275][ T9] usb 8-1: config index 0 descriptor too short (expected 39, got 27) [ 80.235052][ T9] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 80.238289][ T9] usb 8-1: config 0 interface 0 has no altsetting 0 [ 80.241274][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=2 [ 80.243856][ T9] usb 8-1: SerialNumber: syz [ 80.246615][ T9] usb 8-1: config 0 descriptor?? [ 80.250705][ T9] hub 8-1:0.0: bad descriptor, ignoring hub [ 80.252856][ T9] hub 8-1:0.0: probe with driver hub failed with error -5 [ 80.256584][ T9] usb 8-1: selecting invalid altsetting 0 [ 80.330467][ T6410] netlink: 256 bytes leftover after parsing attributes in process `syz.1.100'. [ 80.333482][ T6410] unsupported nlmsg_type 40 [ 80.556590][ T6411] netlink: 4 bytes leftover after parsing attributes in process `syz.1.100'. [ 80.560930][ T6411] bridge_slave_1: left allmulticast mode [ 80.562978][ T6411] bridge_slave_1: left promiscuous mode [ 80.569154][ T6411] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.054308][ T6411] bridge_slave_0: left allmulticast mode [ 81.058712][ T6411] bridge_slave_0: left promiscuous mode [ 81.067670][ T6411] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.473801][ T34] cfg80211: failed to load regulatory.db [ 81.618141][ T5882] usb 8-1: USB disconnect, device number 6 [ 81.797254][ T6443] netlink: 132 bytes leftover after parsing attributes in process `syz.2.108'. [ 82.019392][ T6445] fuse: Bad value for 'user_id' [ 82.020989][ T6445] fuse: Bad value for 'user_id' [ 82.351775][ T6452] netlink: 28 bytes leftover after parsing attributes in process `syz.0.110'. [ 82.367578][ T5882] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 82.529666][ T5882] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 82.534545][ T5882] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 82.538450][ T5882] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 82.542896][ T5882] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 82.546073][ T5882] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 82.556562][ T5882] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 82.559563][ T5882] usb 7-1: Product: syz [ 82.560891][ T5882] usb 7-1: Manufacturer: syz [ 82.573747][ T6461] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 82.573772][ T5882] cdc_wdm 7-1:1.0: probe with driver cdc_wdm failed with error -22 [ 82.678226][ T6458] overlayfs: statfs failed on './file0' [ 82.830637][ T6468] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 83.201686][ T5882] usb 7-1: USB disconnect, device number 5 [ 83.448233][ T5841] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 83.677631][ T5841] usb 5-1: Using ep0 maxpacket: 32 [ 83.681904][ T5841] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 83.687662][ T5841] usb 5-1: config index 0 descriptor too short (expected 13339, got 27) [ 83.690576][ T5841] usb 5-1: config 108 has an invalid descriptor of length 32, skipping remainder of the config [ 83.693769][ T5841] usb 5-1: config 108 has 0 interfaces, different from the descriptor's value: 32 [ 83.709660][ T5841] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 83.714235][ T5841] usb 5-1: Product: syz [ 83.715620][ T5841] usb 5-1: Manufacturer: syz [ 83.717712][ T5841] usb 5-1: SerialNumber: syz [ 83.777852][ T5882] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 83.948436][ T5882] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 83.953932][ T5882] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 83.959002][ T5882] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 83.963292][ T5882] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 83.966942][ T5882] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 84.214872][ T5882] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 84.217415][ T5882] usb 6-1: Product: syz [ 84.218892][ T5882] usb 6-1: Manufacturer: syz [ 84.222944][ T5882] cdc_wdm 6-1:1.0: probe with driver cdc_wdm failed with error -22 [ 84.689284][ T5882] usb 6-1: USB disconnect, device number 2 [ 84.740699][ T5841] usb 5-1: USB disconnect, device number 3 [ 85.294965][ T6530] syzkaller0: entered promiscuous mode [ 85.296878][ T6530] syzkaller0: entered allmulticast mode [ 85.331189][ T6530] 8021q: adding VLAN 0 to HW filter on device bond1 [ 85.333071][ T6533] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 86.504473][ T6553] FAULT_INJECTION: forcing a failure. [ 86.504473][ T6553] name failslab, interval 1, probability 0, space 0, times 1 [ 86.508626][ T6553] CPU: 1 UID: 0 PID: 6553 Comm: syz.3.134 Tainted: G L syzkaller #0 PREEMPT(full) [ 86.508643][ T6553] Tainted: [L]=SOFTLOCKUP [ 86.508647][ T6553] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.508654][ T6553] Call Trace: [ 86.508658][ T6553] [ 86.508662][ T6553] dump_stack_lvl+0x100/0x190 [ 86.508680][ T6553] should_fail_ex.cold+0x5/0xa [ 86.508694][ T6553] should_failslab+0xc2/0x120 [ 86.508712][ T6553] __kmalloc_noprof+0xfc/0x820 [ 86.508726][ T6553] ? __kvmalloc_node_noprof+0x36d/0x970 [ 86.508738][ T6553] ? nla_strscpy+0x181/0x1a0 [ 86.508782][ T6553] ? nft_trans_alloc+0x1d/0x2d0 [ 86.508805][ T6553] nft_trans_alloc+0x1d/0x2d0 [ 86.508817][ T6553] nf_tables_addchain.constprop.0+0xafa/0x1ca0 [ 86.508832][ T6553] ? nft_chain_lookup+0x59c/0xa60 [ 86.508847][ T6553] ? __pfx_nf_tables_addchain.constprop.0+0x10/0x10 [ 86.508871][ T6553] ? nla_strcmp+0xff/0x130 [ 86.508883][ T6553] ? nft_table_lookup.part.0+0x1e3/0x230 [ 86.508896][ T6553] nf_tables_newchain+0x17c3/0x2d30 [ 86.508911][ T6553] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 86.508928][ T6553] ? __nla_validate_parse+0x1e7/0x28b0 [ 86.508942][ T6553] ? __pfx_nf_tables_newchain+0x10/0x10 [ 86.508953][ T6553] ? __pfx___nla_validate_parse+0x10/0x10 [ 86.508970][ T6553] ? __nla_parse+0x40/0x60 [ 86.508983][ T6553] nfnetlink_rcv_batch+0x1410/0x2880 [ 86.509006][ T6553] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 86.509022][ T6553] ? find_held_lock+0x2b/0x80 [ 86.509037][ T6553] ? __local_bh_enable_ip+0x9e/0x120 [ 86.509051][ T6553] ? lockdep_hardirqs_on+0x78/0x100 [ 86.509072][ T6553] ? __dev_queue_xmit+0xa12/0x4970 [ 86.509103][ T6553] ? __nla_parse+0x40/0x60 [ 86.509117][ T6553] nfnetlink_rcv+0x3bd/0x440 [ 86.509132][ T6553] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 86.509151][ T6553] netlink_unicast+0x585/0x850 [ 86.509166][ T6553] ? __pfx_netlink_unicast+0x10/0x10 [ 86.509182][ T6553] netlink_sendmsg+0x8b0/0xda0 [ 86.509196][ T6553] ? __pfx_netlink_sendmsg+0x10/0x10 [ 86.509211][ T6553] ? apparmor_socket_sendmsg+0x15b/0x270 [ 86.509236][ T6553] ____sys_sendmsg+0xa4d/0xbe0 [ 86.509247][ T6553] ? __pfx_netlink_sendmsg+0x10/0x10 [ 86.509261][ T6553] ? __pfx_____sys_sendmsg+0x10/0x10 [ 86.509278][ T6553] ___sys_sendmsg+0x190/0x1e0 [ 86.509291][ T6553] ? __pfx____sys_sendmsg+0x10/0x10 [ 86.509309][ T6553] ? find_held_lock+0x2b/0x80 [ 86.509330][ T6553] __sys_sendmsg+0x160/0x210 [ 86.509346][ T6553] ? __pfx___sys_sendmsg+0x10/0x10 [ 86.509365][ T6553] ? __pfx_ksys_write+0x10/0x10 [ 86.509380][ T6553] __do_fast_syscall_32+0xe7/0x970 [ 86.509395][ T6553] ? lockdep_hardirqs_on+0x78/0x100 [ 86.509411][ T6553] do_fast_syscall_32+0x32/0x70 [ 86.509427][ T6553] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 86.509440][ T6553] RIP: 0023:0xf707efec [ 86.509454][ T6553] Code: Unable to access opcode bytes at 0xf707efc2. [ 86.509459][ T6553] RSP: 002b:00000000f546d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 86.509470][ T6553] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 86.509477][ T6553] RDX: 0000000004000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 86.509483][ T6553] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 86.509488][ T6553] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.509494][ T6553] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 86.509507][ T6553] [ 86.638369][ T6557] wlan0 speed is unknown, defaulting to 1000 [ 86.644018][ T6557] wlan0 speed is unknown, defaulting to 1000 [ 86.658883][ T6557] wlan0 speed is unknown, defaulting to 1000 [ 86.673793][ T6559] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 86.687861][ T6557] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 86.692742][ T6563] FAULT_INJECTION: forcing a failure. [ 86.692742][ T6563] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 86.692807][ T6563] CPU: 0 UID: 0 PID: 6563 Comm: syz.1.138 Tainted: G L syzkaller #0 PREEMPT(full) [ 86.692822][ T6563] Tainted: [L]=SOFTLOCKUP [ 86.692825][ T6563] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.692832][ T6563] Call Trace: [ 86.692835][ T6563] [ 86.692839][ T6563] dump_stack_lvl+0x100/0x190 [ 86.692857][ T6563] should_fail_ex.cold+0x5/0xa [ 86.692868][ T6563] ? prepare_alloc_pages+0x16d/0x5f0 [ 86.692886][ T6563] should_fail_alloc_page+0xeb/0x140 [ 86.692902][ T6563] prepare_alloc_pages+0x1f0/0x5f0 [ 86.692920][ T6563] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 86.692934][ T6563] ? __lock_acquire+0x49f/0x1a40 [ 86.692949][ T6563] ? __lock_acquire+0x49f/0x1a40 [ 86.692959][ T6563] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 86.692971][ T6563] ? find_held_lock+0x2b/0x80 [ 86.692988][ T6563] ? __set_page_owner+0x423/0x540 [ 86.693013][ T6563] ? __lock_acquire+0x49f/0x1a40 [ 86.693035][ T6563] ? lock_acquire+0x1b9/0x370 [ 86.693050][ T6563] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 86.693074][ T6563] ? policy_nodemask+0xed/0x4f0 [ 86.693098][ T6563] alloc_pages_mpol+0x1fb/0x540 [ 86.693116][ T6563] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 86.693135][ T6563] folio_alloc_mpol_noprof+0x36/0x260 [ 86.693147][ T6563] vma_alloc_folio_noprof+0xed/0x1d0 [ 86.693157][ T6563] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 86.693171][ T6563] do_anonymous_page+0xb2b/0x2080 [ 86.693182][ T6563] ? rcu_read_unlock+0x2d/0xb0 [ 86.693197][ T6563] __handle_mm_fault+0x1d2c/0x2a00 [ 86.693209][ T6563] ? mt_find+0x45e/0x8e0 [ 86.693220][ T6563] ? __pfx___handle_mm_fault+0x10/0x10 [ 86.693230][ T6563] ? __pfx_mt_find+0x10/0x10 [ 86.693247][ T6563] ? find_vma+0xbf/0x140 [ 86.693260][ T6563] ? __pfx_find_vma+0x10/0x10 [ 86.693275][ T6563] handle_mm_fault+0x37b/0xa30 [ 86.693288][ T6563] do_user_addr_fault+0x74c/0x12f0 [ 86.693307][ T6563] exc_page_fault+0x6f/0xd0 [ 86.693322][ T6563] asm_exc_page_fault+0x26/0x30 [ 86.693333][ T6563] RIP: 0010:_copy_to_user+0x9f/0xd0 [ 86.693361][ T6563] Code: 89 ee 48 89 ef e8 91 3a ee fc 4d 85 ff 75 26 e8 a7 40 ee fc 89 de 4c 89 e7 e8 6d da 5d fd 0f 01 cb 48 89 d9 48 89 ef 4c 89 e6 a4 0f 1f 00 0f 01 ca 48 89 cb e8 81 40 ee fc 48 89 d8 5b 5d 41 [ 86.693371][ T6563] RSP: 0018:ffffc90002d97a38 EFLAGS: 00050246 [ 86.693380][ T6563] RAX: 0000000000000001 RBX: 0000000000008000 RCX: 0000000000001300 [ 86.693387][ T6563] RDX: 0000000000000001 RSI: ffff88805f35ed00 RDI: 0000000080008000 [ 86.693393][ T6563] RBP: 0000000080001300 R08: 0000000000000000 R09: ffffed100be6bfff [ 86.693399][ T6563] R10: ffff88805f35ffff R11: 0000000000000000 R12: ffff88805f358000 [ 86.693405][ T6563] R13: 0000000080009300 R14: 00007ffffffff000 R15: 0000000000000000 [ 86.693417][ T6563] ? _copy_to_user+0x93/0xd0 [ 86.693433][ T6563] semctl_main+0xa5a/0x2b20 [ 86.693461][ T6563] ? __pfx_semctl_main+0x10/0x10 [ 86.693493][ T6563] ? ksys_write+0x190/0x250 [ 86.693503][ T6563] ? ksys_write+0x190/0x250 [ 86.693516][ T6563] compat_ksys_semctl+0x228/0x360 [ 86.693529][ T6563] ? __pfx_compat_ksys_semctl+0x10/0x10 [ 86.693544][ T6563] ? __fget_files+0x21f/0x3d0 [ 86.693559][ T6563] ? ksys_write+0x1ac/0x250 [ 86.693568][ T6563] ? __pfx_ksys_write+0x10/0x10 [ 86.693581][ T6563] __do_fast_syscall_32+0xe7/0x970 [ 86.693596][ T6563] ? lockdep_hardirqs_on+0x78/0x100 [ 86.693611][ T6563] do_fast_syscall_32+0x32/0x70 [ 86.693627][ T6563] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 86.693640][ T6563] RIP: 0023:0xf7fb4fec [ 86.693652][ T6563] Code: Unable to access opcode bytes at 0xf7fb4fc2. [ 86.693657][ T6563] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 000000000000018a [ 86.693666][ T6563] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 86.693671][ T6563] RDX: 000000000000000d RSI: 0000000080001300 RDI: 0000000000000000 [ 86.693677][ T6563] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 86.693683][ T6563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.693688][ T6563] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 86.693701][ T6563] [ 86.750974][ T6559] IPv6: addrconf: prefix option has invalid lifetime [ 86.763704][ T6557] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 86.878133][ T6557] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 86.888470][ T6557] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 86.916110][ T6557] wlan0 speed is unknown, defaulting to 1000 [ 86.921691][ T6557] wlan0 speed is unknown, defaulting to 1000 [ 86.925673][ T6557] wlan0 speed is unknown, defaulting to 1000 [ 86.929728][ T6557] wlan0 speed is unknown, defaulting to 1000 [ 87.641257][ T6592] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 87.649708][ T6592] IPv6: addrconf: prefix option has invalid lifetime [ 87.703432][ T6596] netlink: 'syz.3.151': attribute type 23 has an invalid length. [ 87.759684][ T6597] loop5: detected capacity change from 0 to 7 [ 87.769216][ C3] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 87.772278][ C3] Buffer I/O error on dev loop5, logical block 0, async page read [ 87.776053][ C3] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 87.778998][ C3] Buffer I/O error on dev loop5, logical block 0, async page read [ 87.782330][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 87.785714][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 87.788522][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 87.791554][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 87.794879][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 87.797955][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 87.800623][ C2] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 87.803695][ C2] Buffer I/O error on dev loop5, logical block 0, async page read [ 87.806419][ C3] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 87.809560][ C3] Buffer I/O error on dev loop5, logical block 0, async page read [ 87.812950][ T6597] ldm_validate_partition_table(): Disk read failed. [ 87.815643][ C3] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 87.818689][ C3] Buffer I/O error on dev loop5, logical block 0, async page read [ 87.821413][ C3] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 87.824324][ C3] Buffer I/O error on dev loop5, logical block 0, async page read [ 87.827128][ C3] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 87.830195][ C3] Buffer I/O error on dev loop5, logical block 0, async page read [ 87.832968][ T6597] Dev loop5: unable to read RDB block 0 [ 87.836661][ T6597] loop5: unable to read partition table [ 87.838631][ T6597] loop5: partition table beyond EOD, truncated [ 87.840624][ T6597] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 88.004123][ T6603] XFS (nbd3): SB validate failed with error -5. [ 88.353360][ T6620] 9pnet: p9_errstr2errno: server reported unknown error ./file0 [ 88.611188][ T5744] Bluetooth: hci0: command 0x0406 tx timeout [ 88.777150][ T6638] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 88.783296][ T6638] IPv6: addrconf: prefix option has invalid lifetime [ 88.951186][ T6640] overlayfs: statfs failed on './file0' [ 89.430117][ T6655] ip6_tunnel: non-ECT from fc01:0000:0000:0000:0000:0000:00fb:a200 with DS=0x5 [ 89.432952][ T6655] ip6_tunnel: non-ECT from fc01:0000:0000:0000:0000:0000:00fb:a200 with DS=0x5 [ 89.435587][ T6655] ip6_tunnel: non-ECT from fc01:0000:0000:0000:0000:0000:00fb:a200 with DS=0x5 [ 89.438303][ T6655] ip6_tunnel: non-ECT from fc01:0000:0000:0000:0000:0000:00fb:a200 with DS=0x5 [ 89.441037][ T6655] ip6_tunnel: non-ECT from fc01:0000:0000:0000:0000:0000:00fb:a200 with DS=0x5 [ 89.443600][ T6655] ip6_tunnel: non-ECT from fc01:0000:0000:0000:0000:0000:00fb:a200 with DS=0x5 [ 89.446225][ T6655] ip6_tunnel: non-ECT from fc01:0000:0000:0000:0000:0000:00fb:a200 with DS=0x5 [ 89.495091][ T6645] overlayfs: statfs failed on './file0' [ 89.763919][ T42] audit: type=1804 audit(1786334692.640:45): pid=6664 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.170" name="/newroot/46/file0" dev="fuse" ino=1 res=1 errno=0 [ 89.837735][ T6670] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 89.853543][ T6664] bond0: entered allmulticast mode [ 89.855297][ T6664] bond_slave_0: entered allmulticast mode [ 89.857167][ T6664] bond_slave_1: entered allmulticast mode [ 89.918885][ T6681] netlink: 4 bytes leftover after parsing attributes in process `syz.1.172'. [ 89.923944][ T6681] tipc: Started in network mode [ 89.926866][ T6681] tipc: Node identity fe800000000000000000000000000014, cluster identity 4711 [ 89.933628][ T6681] tipc: Enabled bearer , priority 10 [ 89.937549][ T5826] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 90.115910][ T5826] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 90.145262][ T5826] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 90.155841][ T5826] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 90.166249][ T5826] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 90.175368][ T6693] fuse: Unknown parameter 'fd0x0000000000000004' [ 90.193206][ T5826] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 90.215231][ T5826] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 90.221008][ T5826] usb 7-1: Product: syz [ 90.223181][ T5826] usb 7-1: Manufacturer: syz [ 90.293348][ T5826] cdc_wdm 7-1:1.0: probe with driver cdc_wdm failed with error -22 [ 90.300517][ T6696] netlink: 4 bytes leftover after parsing attributes in process `syz.3.179'. [ 90.308203][ T6696] netlink: 72 bytes leftover after parsing attributes in process `syz.3.179'. [ 90.416551][ T6700] netlink: 'syz.3.179': attribute type 2 has an invalid length. [ 90.477130][ T6701] netlink: 'syz.3.179': attribute type 4 has an invalid length. [ 90.799017][ T1479] usb 7-1: USB disconnect, device number 6 [ 90.907088][ T6709] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 91.056657][ T6719] netlink: 16 bytes leftover after parsing attributes in process `syz.3.184'. [ 91.084471][ T34] tipc: Node number set to 4269801492 [ 91.411562][ T64] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 91.415330][ T64] Bluetooth: hci1: Injecting HCI hardware error event [ 91.422712][ T64] Bluetooth: hci1: hardware error 0x00 [ 91.946619][ T6741] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 92.090592][ T6753] netlink: 24 bytes leftover after parsing attributes in process `syz.1.193'. [ 92.115751][ T6753] warning: `syz.1.193' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 92.811907][ T6777] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 92.821350][ T6777] net_ratelimit: 3322 callbacks suppressed [ 92.821373][ T6777] IPv6: addrconf: prefix option has invalid lifetime [ 92.887741][ T1033] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 93.038191][ T1033] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 93.042034][ T1033] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 93.044715][ T1033] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 93.048035][ T1033] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 93.050816][ T1033] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 93.056061][ T1033] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 93.058621][ T1033] usb 6-1: Product: syz [ 93.059890][ T1033] usb 6-1: Manufacturer: syz [ 93.066471][ T1033] cdc_wdm 6-1:1.0: probe with driver cdc_wdm failed with error -22 [ 93.474301][ T6801] netlink: 24 bytes leftover after parsing attributes in process `syz.3.209'. [ 93.488869][ T64] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 93.583462][ T34] usb 6-1: USB disconnect, device number 3 [ 93.641199][ T6811] FAULT_INJECTION: forcing a failure. [ 93.641199][ T6811] name failslab, interval 1, probability 0, space 0, times 0 [ 93.646424][ T6811] CPU: 1 UID: 0 PID: 6811 Comm: syz.2.212 Tainted: G L syzkaller #0 PREEMPT(full) [ 93.646442][ T6811] Tainted: [L]=SOFTLOCKUP [ 93.646446][ T6811] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.646459][ T6811] Call Trace: [ 93.646470][ T6811] [ 93.646475][ T6811] dump_stack_lvl+0x100/0x190 [ 93.646510][ T6811] should_fail_ex.cold+0x5/0xa [ 93.646529][ T6811] should_failslab+0xc2/0x120 [ 93.646561][ T6811] __kmalloc_noprof+0xfc/0x820 [ 93.646576][ T6811] ? ovl_cache_entry_new+0x64/0x9d0 [ 93.646618][ T6811] ovl_cache_entry_new+0x64/0x9d0 [ 93.646629][ T6811] ? fast_dput+0x494/0x6d0 [ 93.646646][ T6811] ovl_fill_merge+0x4a1/0x1000 [ 93.646659][ T6811] ? __pfx_ovl_fill_merge+0x10/0x10 [ 93.646669][ T6811] ? _raw_spin_unlock+0x28/0x50 [ 93.646684][ T6811] ? fast_dput+0x168/0x6d0 [ 93.646698][ T6811] ? __pfx_ovl_fill_merge+0x10/0x10 [ 93.646709][ T6811] offset_readdir+0x2c3/0x780 [ 93.646721][ T6811] ? apparmor_file_permission+0x13f/0x1c0 [ 93.646759][ T6811] iterate_dir+0x296/0xae0 [ 93.646776][ T6811] ovl_dir_read_merged+0x558/0x790 [ 93.646788][ T6811] ? __pfx_ovl_dir_read_merged+0x10/0x10 [ 93.646816][ T6811] ? __pfx_ovl_fill_merge+0x10/0x10 [ 93.646834][ T6811] ? ovl_iterate+0xa74/0x10d0 [ 93.646847][ T6811] ovl_iterate+0xb2a/0x10d0 [ 93.646859][ T6811] ? __pfx_down_read_killable+0x10/0x10 [ 93.646878][ T6811] ? __pfx_ovl_iterate+0x10/0x10 [ 93.646888][ T6811] wrap_directory_iterator+0xa2/0xe0 [ 93.646905][ T6811] iterate_dir+0x296/0xae0 [ 93.646922][ T6811] __ia32_sys_getdents64+0x13a/0x2c0 [ 93.646944][ T6811] ? __pfx___ia32_sys_getdents64+0x10/0x10 [ 93.646961][ T6811] ? __pfx_filldir64+0x10/0x10 [ 93.646976][ T6811] ? ksys_write+0x1ac/0x250 [ 93.646987][ T6811] ? __pfx_ksys_write+0x10/0x10 [ 93.646999][ T6811] __do_fast_syscall_32+0xe7/0x970 [ 93.647015][ T6811] ? lockdep_hardirqs_on+0x78/0x100 [ 93.647031][ T6811] do_fast_syscall_32+0x32/0x70 [ 93.647047][ T6811] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 93.647061][ T6811] RIP: 0023:0xf7f38fec [ 93.647075][ T6811] Code: Unable to access opcode bytes at 0xf7f38fc2. [ 93.647087][ T6811] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 00000000000000dc [ 93.647099][ T6811] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000500 [ 93.647106][ T6811] RDX: 0000000000000095 RSI: 0000000000000000 RDI: 0000000000000000 [ 93.647111][ T6811] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 93.647117][ T6811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.647123][ T6811] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 93.647137][ T6811] [ 93.880736][ T6821] bond1 (unregistering): Released all slaves [ 94.028016][ T6815] nvme_fc: nvme_fc_create_ctrl: nn-0x3333333333333333:pn-0x4444444444444444 - nn-0x1111111111111111:pn-0x2222222222222222 combination not found [ 94.412196][ T6841] FAULT_INJECTION: forcing a failure. [ 94.412196][ T6841] name failslab, interval 1, probability 0, space 0, times 0 [ 94.416208][ T6841] CPU: 3 UID: 0 PID: 6841 Comm: syz.2.220 Tainted: G L syzkaller #0 PREEMPT(full) [ 94.416226][ T6841] Tainted: [L]=SOFTLOCKUP [ 94.416230][ T6841] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.416236][ T6841] Call Trace: [ 94.416240][ T6841] [ 94.416245][ T6841] dump_stack_lvl+0x100/0x190 [ 94.416263][ T6841] should_fail_ex.cold+0x5/0xa [ 94.416277][ T6841] should_failslab+0xc2/0x120 [ 94.416293][ T6841] __kmalloc_cache_noprof+0x91/0x6c0 [ 94.416304][ T6841] ? lockdep_set_lock_cmp_fn+0x80/0xe0 [ 94.416317][ T6841] ? alloc_netdev_mqs+0xe3c/0x15c0 [ 94.416375][ T6841] alloc_netdev_mqs+0xe3c/0x15c0 [ 94.416394][ T6841] rtnl_create_link+0xc13/0xf80 [ 94.416414][ T6841] rtnl_newlink+0x13bd/0x2380 [ 94.416434][ T6841] ? __pfx_rtnl_newlink+0x10/0x10 [ 94.416450][ T6841] ? rcu_is_watching+0x12/0xc0 [ 94.416464][ T6841] ? kasan_quarantine_put+0x104/0x240 [ 94.416480][ T6841] ? kfree_skbmem+0x19a/0x210 [ 94.416494][ T6841] ? kmem_cache_free+0x127/0x6b0 [ 94.416524][ T6841] ? find_held_lock+0x2b/0x80 [ 94.416551][ T6841] ? find_held_lock+0x2b/0x80 [ 94.416569][ T6841] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 94.416591][ T6841] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 94.416611][ T6841] ? __pfx_rtnl_newlink+0x10/0x10 [ 94.416627][ T6841] rtnetlink_rcv_msg+0x95e/0xe90 [ 94.416644][ T6841] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 94.416664][ T6841] ? ref_tracker_free+0x37e/0x6c0 [ 94.416689][ T6841] netlink_rcv_skb+0x159/0x420 [ 94.416709][ T6841] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 94.416726][ T6841] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 94.416743][ T6841] ? netlink_deliver_tap+0x1ae/0xcc0 [ 94.416757][ T6841] netlink_unicast+0x585/0x850 [ 94.416771][ T6841] ? __pfx_netlink_unicast+0x10/0x10 [ 94.416787][ T6841] netlink_sendmsg+0x8b0/0xda0 [ 94.416801][ T6841] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.416815][ T6841] ? apparmor_socket_sendmsg+0x15b/0x270 [ 94.416829][ T6841] ____sys_sendmsg+0xa4d/0xbe0 [ 94.416840][ T6841] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.416853][ T6841] ? __pfx_____sys_sendmsg+0x10/0x10 [ 94.416870][ T6841] ___sys_sendmsg+0x190/0x1e0 [ 94.416882][ T6841] ? __pfx____sys_sendmsg+0x10/0x10 [ 94.416900][ T6841] ? find_held_lock+0x2b/0x80 [ 94.416922][ T6841] __sys_sendmsg+0x160/0x210 [ 94.416937][ T6841] ? __pfx___sys_sendmsg+0x10/0x10 [ 94.416956][ T6841] ? __pfx_ksys_write+0x10/0x10 [ 94.416969][ T6841] __do_fast_syscall_32+0xe7/0x970 [ 94.416986][ T6841] ? lockdep_hardirqs_on+0x78/0x100 [ 94.417001][ T6841] do_fast_syscall_32+0x32/0x70 [ 94.417018][ T6841] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 94.417032][ T6841] RIP: 0023:0xf7f38fec [ 94.417047][ T6841] Code: Unable to access opcode bytes at 0xf7f38fc2. [ 94.417052][ T6841] RSP: 002b:00000000f53d550c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 94.417062][ T6841] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800006c0 [ 94.417069][ T6841] RDX: 0000000020000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 94.417075][ T6841] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 94.417080][ T6841] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 94.417086][ T6841] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 94.417099][ T6841] [ 95.039312][ T6846] capability: warning: `syz.3.221' uses 32-bit capabilities (legacy support in use) [ 95.102193][ T6848] FAULT_INJECTION: forcing a failure. [ 95.102193][ T6848] name failslab, interval 1, probability 0, space 0, times 0 [ 95.108912][ T6848] CPU: 2 UID: 0 PID: 6848 Comm: syz.0.222 Tainted: G L syzkaller #0 PREEMPT(full) [ 95.108930][ T6848] Tainted: [L]=SOFTLOCKUP [ 95.108934][ T6848] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.108940][ T6848] Call Trace: [ 95.108944][ T6848] [ 95.108949][ T6848] dump_stack_lvl+0x100/0x190 [ 95.108967][ T6848] should_fail_ex.cold+0x5/0xa [ 95.108980][ T6848] should_failslab+0xc2/0x120 [ 95.108996][ T6848] __kmalloc_cache_noprof+0x91/0x6c0 [ 95.109009][ T6848] ? ima_inode_setxattr+0x4b0/0x5f0 [ 95.109024][ T6848] ima_inode_setxattr+0x4b0/0x5f0 [ 95.109036][ T6848] security_inode_setxattr+0x299/0x560 [ 95.109071][ T6848] __vfs_setxattr_locked+0xad/0x2b0 [ 95.109086][ T6848] vfs_setxattr+0x14a/0x390 [ 95.109099][ T6848] ? __pfx_vfs_setxattr+0x10/0x10 [ 95.109110][ T6848] ? mnt_get_write_access+0x52/0x2f0 [ 95.109126][ T6848] ? mnt_get_write_access+0x52/0x2f0 [ 95.109142][ T6848] do_setxattr+0x145/0x180 [ 95.109155][ T6848] filename_setxattr+0x167/0x1d0 [ 95.109167][ T6848] ? __pfx_filename_setxattr+0x10/0x10 [ 95.109180][ T6848] ? do_getname+0x191/0x390 [ 95.109195][ T6848] path_setxattrat+0x1ff/0x3b0 [ 95.109208][ T6848] ? __pfx_path_setxattrat+0x10/0x10 [ 95.109222][ T6848] ? rcu_read_lock_any_held+0x6a/0xa0 [ 95.109236][ T6848] ? find_held_lock+0x2b/0x80 [ 95.109262][ T6848] ? fput+0x79/0x100 [ 95.109274][ T6848] ? ksys_write+0x1ac/0x250 [ 95.109286][ T6848] __ia32_sys_setxattr+0xc4/0x140 [ 95.109298][ T6848] ? __do_fast_syscall_32+0x98/0x970 [ 95.109315][ T6848] ? lockdep_hardirqs_on+0x78/0x100 [ 95.109329][ T6848] __do_fast_syscall_32+0xe7/0x970 [ 95.109345][ T6848] ? lockdep_hardirqs_on+0x78/0x100 [ 95.109360][ T6848] do_fast_syscall_32+0x32/0x70 [ 95.109376][ T6848] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 95.109390][ T6848] RIP: 0023:0xf700efec [ 95.109403][ T6848] Code: Unable to access opcode bytes at 0xf700efc2. [ 95.109408][ T6848] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 00000000000000e2 [ 95.109419][ T6848] RAX: ffffffffffffffda RBX: 0000000080000180 RCX: 00000000800000c0 [ 95.109426][ T6848] RDX: 00000000800002c0 RSI: 0000000000000002 RDI: 0000000000000000 [ 95.109432][ T6848] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 95.109437][ T6848] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 95.109443][ T6848] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 95.109456][ T6848] [ 95.468610][ T6874] bridge1: entered promiscuous mode [ 95.791141][ T6887] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 95.794007][ T6887] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 95.846918][ T6889] netlink: 20 bytes leftover after parsing attributes in process `syz.0.232'. [ 96.107885][ T34] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 96.257523][ T34] usb 5-1: Using ep0 maxpacket: 16 [ 96.260154][ T34] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 96.265193][ T34] usb 5-1: config 1 has an invalid descriptor of length 101, skipping remainder of the config [ 96.268474][ T34] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 96.272857][ T34] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.275329][ T34] usb 5-1: Product: syz [ 96.276635][ T34] usb 5-1: Manufacturer: syz [ 96.278117][ T34] usb 5-1: SerialNumber: syz [ 96.289307][ T34] usb 5-1: 0:2 : does not exist [ 96.291349][ T34] usb 5-1: unit 9 not found! [ 96.439031][ T6895] netlink: 4 bytes leftover after parsing attributes in process `syz.3.234'. [ 96.837717][ T5102] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 96.952469][ T6910] netlink: 16 bytes leftover after parsing attributes in process `syz.2.240'. [ 96.960125][ T6910] netlink: 60 bytes leftover after parsing attributes in process `syz.2.240'. [ 96.988662][ T5102] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 96.994292][ T5102] usb 8-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 96.997094][ T5102] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 97.003545][ T5102] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 97.006563][ T5102] usb 8-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 97.014290][ T5102] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 97.018176][ T34] usb 5-1: 4:0: cannot get min/max values for control 1 (id 4) [ 97.021186][ T5102] usb 8-1: Product: syz [ 97.022985][ T5102] usb 8-1: Manufacturer: syz [ 97.030068][ T34] usb 5-1: 4:0: cannot get min/max values for control 2 (id 4) [ 97.034377][ T5102] cdc_wdm 8-1:1.0: probe with driver cdc_wdm failed with error -22 [ 97.042795][ T34] usb 5-1: 4:0: cannot get min/max values for control 3 (id 4) [ 97.048176][ T34] usb 5-1: 4:0: cannot get min/max values for control 4 (id 4) [ 97.055048][ T34] usb 5-1: 4:0: cannot get min/max values for control 5 (id 4) [ 97.060287][ T34] usb 5-1: 4:0: cannot get min/max values for control 6 (id 4) [ 97.084561][ T34] usb 5-1: USB disconnect, device number 4 [ 97.469633][ T5827] usb 8-1: USB disconnect, device number 7 [ 98.120593][ T6934] netlink: 12 bytes leftover after parsing attributes in process `syz.3.247'. [ 98.160726][ T6936] netlink: 8 bytes leftover after parsing attributes in process `syz.3.248'. [ 98.985598][ T6964] netlink: 12 bytes leftover after parsing attributes in process `syz.2.256'. [ 99.299494][ T5988] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 99.480091][ T5988] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 99.487188][ T5988] usb 8-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 99.491606][ T5988] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 99.495771][ T5988] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 99.501012][ T5988] usb 8-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 99.515975][ T5988] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 99.519249][ T5988] usb 8-1: Product: syz [ 99.520742][ T5988] usb 8-1: Manufacturer: syz [ 99.573573][ T5988] cdc_wdm 8-1:1.0: probe with driver cdc_wdm failed with error -22 [ 99.841404][ T6988] netlink: 76 bytes leftover after parsing attributes in process `syz.1.261'. [ 99.888253][ T6983] overlayfs: statfs failed on './file0' [ 99.923538][ T34] usb 8-1: USB disconnect, device number 8 [ 100.036881][ T6995] Zero length message leads to an empty skb [ 100.330148][ T7001] netlink: 12 bytes leftover after parsing attributes in process `syz.2.266'. [ 100.639527][ T7022] netlink: 4 bytes leftover after parsing attributes in process `syz.3.272'. [ 100.779018][ T7029] netlink: 'syz.3.272': attribute type 2 has an invalid length. [ 100.835485][ T7022] netlink: 'syz.3.272': attribute type 4 has an invalid length. [ 101.366254][ T7035] ======================================================= [ 101.366254][ T7035] WARNING: The mand mount option has been deprecated and [ 101.366254][ T7035] and is ignored by this kernel. Remove the mand [ 101.366254][ T7035] option from the mount to silence this warning. [ 101.366254][ T7035] ======================================================= [ 101.380827][ T7035] /dev/loop1: Can't open blockdev [ 101.406965][ T7037] FAULT_INJECTION: forcing a failure. [ 101.406965][ T7037] name failslab, interval 1, probability 0, space 0, times 0 [ 101.415724][ T7037] CPU: 1 UID: 0 PID: 7037 Comm: syz.0.275 Tainted: G L syzkaller #0 PREEMPT(full) [ 101.415742][ T7037] Tainted: [L]=SOFTLOCKUP [ 101.415746][ T7037] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.415758][ T7037] Call Trace: [ 101.415768][ T7037] [ 101.415772][ T7037] dump_stack_lvl+0x100/0x190 [ 101.415868][ T7037] should_fail_ex.cold+0x5/0xa [ 101.415891][ T7037] should_failslab+0xc2/0x120 [ 101.415943][ T7037] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 101.415961][ T7037] ? __d_alloc+0x35/0xa50 [ 101.415977][ T7037] __d_alloc+0x35/0xa50 [ 101.415990][ T7037] d_alloc+0x4a/0x1e0 [ 101.416003][ T7037] lookup_one_qstr_excl+0x171/0x250 [ 101.416017][ T7037] ? mnt_want_write+0x161/0x410 [ 101.416034][ T7037] filename_create+0x1cf/0x400 [ 101.416050][ T7037] ? __pfx_filename_create+0x10/0x10 [ 101.416068][ T7037] ? find_held_lock+0x2b/0x80 [ 101.416096][ T7037] filename_symlinkat+0xe1/0x560 [ 101.416131][ T7037] ? __pfx_filename_symlinkat+0x10/0x10 [ 101.416145][ T7037] ? strncpy_from_user+0x19d/0x2d0 [ 101.416193][ T7037] ? do_getname+0x191/0x390 [ 101.416208][ T7037] __ia32_sys_symlinkat+0x9b/0xe0 [ 101.416222][ T7037] __do_fast_syscall_32+0xe7/0x970 [ 101.416281][ T7037] ? lockdep_hardirqs_on+0x78/0x100 [ 101.416297][ T7037] do_fast_syscall_32+0x32/0x70 [ 101.416312][ T7037] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 101.416327][ T7037] RIP: 0023:0xf700efec [ 101.416340][ T7037] Code: Unable to access opcode bytes at 0xf700efc2. [ 101.416351][ T7037] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000130 [ 101.416362][ T7037] RAX: ffffffffffffffda RBX: 0000000080000200 RCX: 00000000ffffff9c [ 101.416368][ T7037] RDX: 0000000080000240 RSI: 0000000000000000 RDI: 0000000000000000 [ 101.416374][ T7037] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 101.416379][ T7037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.416385][ T7037] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 101.416399][ T7037] [ 101.658944][ T7051] FAULT_INJECTION: forcing a failure. [ 101.658944][ T7051] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 101.667351][ T7051] CPU: 1 UID: 0 PID: 7051 Comm: syz.2.280 Tainted: G L syzkaller #0 PREEMPT(full) [ 101.667381][ T7051] Tainted: [L]=SOFTLOCKUP [ 101.667387][ T7051] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.667415][ T7051] Call Trace: [ 101.667421][ T7051] [ 101.667428][ T7051] dump_stack_lvl+0x100/0x190 [ 101.667458][ T7051] should_fail_ex.cold+0x5/0xa [ 101.667480][ T7051] __kvm_read_guest_page+0x186/0x250 [ 101.667504][ T7051] kvm_fetch_guest_virt+0x128/0x1a0 [ 101.667538][ T7051] __do_insn_fetch_bytes+0x5e2/0x7b0 [ 101.667565][ T7051] ? __pfx___do_insn_fetch_bytes+0x10/0x10 [ 101.667591][ T7051] ? __lock_acquire+0x49f/0x1a40 [ 101.667615][ T7051] x86_decode_insn+0x3ca/0x6da0 [ 101.667646][ T7051] ? __pfx_x86_decode_insn+0x10/0x10 [ 101.667663][ T7051] ? vmx_is_valid_debugctl+0x5a0/0x640 [ 101.667684][ T7051] ? init_decode_cache+0xd/0x2b0 [ 101.667700][ T7051] ? init_emulate_ctxt+0x43c/0x700 [ 101.667727][ T7051] ? __pfx_init_emulate_ctxt+0x10/0x10 [ 101.667760][ T7051] ? kvm_multiple_exception+0x5b0/0x710 [ 101.667796][ T7051] x86_emulate_instruction+0x1052/0x1df0 [ 101.667824][ T7051] ? __pfx_emulator_get_segment+0x10/0x10 [ 101.667847][ T7051] handle_ud+0x100/0x5b0 [ 101.667869][ T7051] ? __pfx_handle_ud+0x10/0x10 [ 101.667889][ T7051] ? rcu_qs+0x2a/0xe0 [ 101.667909][ T7051] ? rcu_note_context_switch+0x174/0x19c0 [ 101.667932][ T7051] ? __lock_acquire+0x49f/0x1a40 [ 101.667949][ T7051] ? __vmx_complete_interrupts+0x129/0x570 [ 101.667973][ T7051] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 101.668004][ T7051] handle_exception_nmi+0xd0c/0x1af0 [ 101.668029][ T7051] ? __pfx_handle_exception_nmi+0x10/0x10 [ 101.668053][ T7051] vmx_handle_exit+0x4d6/0x1ef0 [ 101.668080][ T7051] vcpu_run+0x35ab/0x5de0 [ 101.668101][ T7051] ? vmx_vcpu_load_vmcs+0x21d/0x760 [ 101.668166][ T7051] ? __pfx_vcpu_run+0x10/0x10 [ 101.668194][ T7051] ? complete_emulated_mmio+0x102/0x710 [ 101.668223][ T7051] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 101.668245][ T7051] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 101.668276][ T7051] kvm_vcpu_ioctl+0x730/0x1700 [ 101.668296][ T7051] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 101.668314][ T7051] ? tomoyo_path_number_perm+0x188/0x580 [ 101.668372][ T7051] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 101.668394][ T7051] ? get_pid_task+0x106/0x250 [ 101.668425][ T7051] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 101.668453][ T7051] ? do_vfs_ioctl+0x226/0x13e0 [ 101.668480][ T7051] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 101.668516][ T7051] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 101.668536][ T7051] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 101.668555][ T7051] ? __fget_files+0x21f/0x3d0 [ 101.668577][ T7051] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 101.668595][ T7051] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 101.668624][ T7051] __do_fast_syscall_32+0xe7/0x970 [ 101.668652][ T7051] ? lockdep_hardirqs_on+0x78/0x100 [ 101.668678][ T7051] do_fast_syscall_32+0x32/0x70 [ 101.668704][ T7051] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 101.668727][ T7051] RIP: 0023:0xf7f38fec [ 101.668747][ T7051] Code: Unable to access opcode bytes at 0xf7f38fc2. [ 101.668755][ T7051] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 101.668772][ T7051] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 101.668783][ T7051] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 101.668798][ T7051] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 101.668808][ T7051] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.668817][ T7051] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 101.668841][ T7051] [ 101.726913][ T7059] __nla_validate_parse: 1 callbacks suppressed [ 101.726936][ T7059] netlink: 20 bytes leftover after parsing attributes in process `syz.1.281'. [ 102.080902][ T5826] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 102.377551][ T5826] usb 6-1: Using ep0 maxpacket: 16 [ 102.587389][ T7074] FAULT_INJECTION: forcing a failure. [ 102.587389][ T7074] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 102.592926][ T7074] CPU: 3 UID: 0 PID: 7074 Comm: syz.3.286 Tainted: G L syzkaller #0 PREEMPT(full) [ 102.592945][ T7074] Tainted: [L]=SOFTLOCKUP [ 102.592948][ T7074] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.592954][ T7074] Call Trace: [ 102.592959][ T7074] [ 102.592963][ T7074] dump_stack_lvl+0x100/0x190 [ 102.592981][ T7074] should_fail_ex.cold+0x5/0xa [ 102.592993][ T7074] _copy_from_user+0x2e/0xd0 [ 102.593022][ T7074] do_ip_vs_set_ctl+0x53c/0xc90 [ 102.593092][ T7074] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 102.593108][ T7074] ? rcu_is_watching+0x12/0xc0 [ 102.593125][ T7074] ? find_held_lock+0x2b/0x80 [ 102.593138][ T7074] ? nf_sockopt_find.isra.0+0x222/0x290 [ 102.593159][ T7074] ? nf_sockopt_find.isra.0+0x222/0x290 [ 102.593177][ T7074] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 102.593203][ T7074] ? nf_setsockopt+0x8d/0xf0 [ 102.593215][ T7074] nf_setsockopt+0x8d/0xf0 [ 102.593230][ T7074] ip_setsockopt+0xcb/0xf0 [ 102.593247][ T7074] raw_setsockopt+0x60/0x1b0 [ 102.593264][ T7074] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 102.593285][ T7074] do_sock_setsockopt+0xf3/0x1d0 [ 102.593304][ T7074] __sys_setsockopt+0x119/0x190 [ 102.593322][ T7074] __ia32_sys_setsockopt+0xbc/0x160 [ 102.593337][ T7074] ? __do_fast_syscall_32+0x98/0x970 [ 102.593353][ T7074] ? lockdep_hardirqs_on+0x78/0x100 [ 102.593372][ T7074] __do_fast_syscall_32+0xe7/0x970 [ 102.593387][ T7074] ? lockdep_hardirqs_on+0x78/0x100 [ 102.593403][ T7074] do_fast_syscall_32+0x32/0x70 [ 102.593419][ T7074] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 102.593433][ T7074] RIP: 0023:0xf707efec [ 102.593447][ T7074] Code: Unable to access opcode bytes at 0xf707efc2. [ 102.593451][ T7074] RSP: 002b:00000000f546d50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 102.593462][ T7074] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000000000 [ 102.593468][ T7074] RDX: 000000000000048c RSI: 00000000800011c0 RDI: 0000000000000018 [ 102.593474][ T7074] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 102.593480][ T7074] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.593488][ T7074] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 102.593501][ T7074] [ 102.746985][ T5826] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 102.812426][ T5826] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 102.817082][ T5826] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 102.821556][ T5826] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.824180][ T5826] usb 6-1: Product: syz [ 102.825532][ T5826] usb 6-1: Manufacturer: syz [ 102.827033][ T5826] usb 6-1: SerialNumber: syz [ 102.842844][ T5826] usb 6-1: 0:2 : does not exist [ 102.845575][ T5826] usb 6-1: unit 9 not found! [ 102.879331][ T7077] lo speed is unknown, defaulting to 1000 [ 102.882787][ T7077] wlan0 speed is unknown, defaulting to 1000 [ 102.929053][ T7087] netlink: 4 bytes leftover after parsing attributes in process `syz.3.289'. [ 102.935089][ T7087] netlink: 72 bytes leftover after parsing attributes in process `syz.3.289'. [ 103.038653][ T7087] netlink: 'syz.3.289': attribute type 2 has an invalid length. [ 103.063883][ T5102] usb 6-1: USB disconnect, device number 4 [ 103.097193][ T7093] netlink: 'syz.3.289': attribute type 4 has an invalid length. [ 103.264576][ T7095] netlink: 4 bytes leftover after parsing attributes in process `syz.0.290'. [ 103.270612][ T7095] netlink: 72 bytes leftover after parsing attributes in process `syz.0.290'. [ 103.350934][ T7095] netlink: 'syz.0.290': attribute type 2 has an invalid length. [ 103.408739][ T7100] netlink: 'syz.0.290': attribute type 4 has an invalid length. [ 103.724177][ T7105] netlink: 8 bytes leftover after parsing attributes in process `syz.3.291'. [ 104.010638][ T42] audit: type=1326 audit(1786334706.890:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.0.293" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 104.020706][ T42] audit: type=1326 audit(1786334706.890:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.0.293" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 104.033721][ T42] audit: type=1326 audit(1786334706.890:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.0.293" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf700efec code=0x7ffc0000 [ 104.033777][ T42] audit: type=1326 audit(1786334706.890:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.0.293" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 104.033824][ T42] audit: type=1326 audit(1786334706.890:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.0.293" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 104.033923][ T42] audit: type=1326 audit(1786334706.890:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.0.293" exe="/syz-executor" sig=0 arch=40000003 syscall=354 compat=1 ip=0xf700efec code=0x7ffc0000 [ 104.034050][ T42] audit: type=1326 audit(1786334706.890:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.0.293" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 104.034191][ T42] audit: type=1326 audit(1786334706.890:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.0.293" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 104.034214][ T42] audit: type=1326 audit(1786334706.890:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.0.293" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf700efec code=0x7ffc0000 [ 104.034503][ T42] audit: type=1326 audit(1786334706.890:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7106 comm="syz.0.293" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 105.008736][ T7121] fuse: Bad value for 'fd' [ 105.041168][ T7126] netlink: 4 bytes leftover after parsing attributes in process `syz.2.299'. [ 105.046162][ T7126] netlink: 72 bytes leftover after parsing attributes in process `syz.2.299'. [ 105.145443][ T7126] netlink: 'syz.2.299': attribute type 2 has an invalid length. [ 105.206336][ T7129] netlink: 'syz.2.299': attribute type 4 has an invalid length. [ 105.729768][ T64] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 105.732217][ T5744] Bluetooth: hci4: command 0x1003 tx timeout [ 106.250395][ T7163] netlink: 4 bytes leftover after parsing attributes in process `syz.1.309'. [ 106.274453][ T7163] netlink: 72 bytes leftover after parsing attributes in process `syz.1.309'. [ 106.439456][ T7167] netlink: 'syz.1.309': attribute type 2 has an invalid length. [ 106.524317][ T7171] netlink: 'syz.1.309': attribute type 4 has an invalid length. [ 106.806467][ T7180] netlink: 44 bytes leftover after parsing attributes in process `syz.0.313'. [ 106.819218][ T7180] netlink: 32 bytes leftover after parsing attributes in process `syz.0.313'. [ 107.597697][ T7201] netlink: 44 bytes leftover after parsing attributes in process `syz.0.320'. [ 107.605182][ T7201] netlink: 32 bytes leftover after parsing attributes in process `syz.0.320'. [ 107.735442][ T7206] netlink: 4 bytes leftover after parsing attributes in process `syz.3.322'. [ 107.743925][ T7206] netlink: 72 bytes leftover after parsing attributes in process `syz.3.322'. [ 107.844113][ T7203] FAULT_INJECTION: forcing a failure. [ 107.844113][ T7203] name failslab, interval 1, probability 0, space 0, times 0 [ 107.857276][ T7203] CPU: 3 UID: 0 PID: 7203 Comm: syz.0.320 Tainted: G L syzkaller #0 PREEMPT(full) [ 107.857296][ T7203] Tainted: [L]=SOFTLOCKUP [ 107.857300][ T7203] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 107.857307][ T7203] Call Trace: [ 107.857311][ T7203] [ 107.857315][ T7203] dump_stack_lvl+0x100/0x190 [ 107.857336][ T7203] should_fail_ex.cold+0x5/0xa [ 107.857348][ T7203] ? do_raw_spin_unlock+0x145/0x1e0 [ 107.857363][ T7203] should_failslab+0xc2/0x120 [ 107.857380][ T7203] __kmalloc_cache_noprof+0x91/0x6c0 [ 107.857393][ T7203] ? e1000_set_rx_mode+0x67/0xc90 [ 107.857444][ T7203] e1000_set_rx_mode+0x67/0xc90 [ 107.857473][ T7203] e1000_configure+0x44/0xda0 [ 107.857485][ T7203] ? e1000_down+0x677/0x810 [ 107.857499][ T7203] e1000_up+0x1a/0x190 [ 107.857510][ T7203] e1000_reinit_locked+0xcd/0xe0 [ 107.857522][ T7203] e1000_ioctl+0x43e/0x710 [ 107.857538][ T7203] dev_eth_ioctl+0x164/0x370 [ 107.857560][ T7203] dev_ifsioc+0x180/0x1f10 [ 107.857579][ T7203] ? __pfx_dev_ifsioc+0x10/0x10 [ 107.857593][ T7203] ? __pfx___mutex_lock+0x10/0x10 [ 107.857618][ T7203] ? dev_load+0x8e/0x240 [ 107.857632][ T7203] ? dev_load+0x8e/0x240 [ 107.857650][ T7203] dev_ioctl+0x342/0x1070 [ 107.857667][ T7203] sock_do_ioctl+0x1a0/0x280 [ 107.857686][ T7203] ? __pfx_sock_do_ioctl+0x10/0x10 [ 107.857707][ T7203] ? do_vfs_ioctl+0x226/0x13e0 [ 107.857724][ T7203] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 107.857741][ T7203] compat_sock_ioctl+0x568/0x760 [ 107.857756][ T7203] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 107.857769][ T7203] ? hook_file_ioctl_common+0x140/0x440 [ 107.857795][ T7203] ? __fget_files+0x21f/0x3d0 [ 107.857808][ T7203] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 107.857821][ T7203] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 107.857840][ T7203] __do_fast_syscall_32+0xe7/0x970 [ 107.857857][ T7203] ? lockdep_hardirqs_on+0x78/0x100 [ 107.857874][ T7203] do_fast_syscall_32+0x32/0x70 [ 107.857890][ T7203] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 107.857905][ T7203] RIP: 0023:0xf700efec [ 107.857918][ T7203] Code: Unable to access opcode bytes at 0xf700efc2. [ 107.857923][ T7203] RSP: 002b:00000000f53dc50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 107.857935][ T7203] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000000008949 [ 107.857942][ T7203] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 107.857948][ T7203] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 107.857954][ T7203] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 107.857961][ T7203] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 107.857975][ T7203] [ 107.866379][ T7213] netlink: 'syz.3.322': attribute type 2 has an invalid length. [ 107.922402][ T5827] e1000 0000:00:06.0 eth0: Reset adapter [ 108.130037][ T7211] netlink: 'syz.3.322': attribute type 4 has an invalid length. [ 108.337302][ T7248] ehci-pci 0000:00:1d.7: remove, state 1 [ 108.342090][ T7248] usb usb1: USB disconnect, device number 1 [ 108.344191][ T7248] usb 1-1: USB disconnect, device number 2 [ 108.391265][ T7248] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 108.428110][ T34] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 108.588366][ T34] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 108.592609][ T34] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 108.595438][ T34] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 108.599625][ T34] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 108.602936][ T34] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 108.608739][ T34] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 108.611340][ T34] usb 6-1: Product: syz [ 108.612667][ T34] usb 6-1: Manufacturer: syz [ 108.618555][ T34] cdc_wdm 6-1:1.0: probe with driver cdc_wdm failed with error -22 [ 108.668358][ T5988] usb 2-1: new full-speed USB device number 3 using uhci_hcd [ 108.833355][ T5988] usb 2-1: not running at top speed; connect to a high speed hub [ 108.836146][ T5988] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 108.859884][ T5988] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 108.863472][ T5988] usb 2-1: Product: QEMU USB Tablet [ 108.865700][ T5988] usb 2-1: Manufacturer: QEMU [ 108.867995][ T5988] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 108.889621][ T5988] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0007/input/input14 [ 108.960871][ T5988] hid-generic 0003:0627:0001.0007: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 108.979327][ T7251] usb 2-1: USB disconnect, device number 3 [ 109.012902][ T7257] fido_id[7257]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/2-1/report_descriptor': No such file or directory [ 109.035982][ T5827] usb 6-1: USB disconnect, device number 5 [ 109.069676][ T7251] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 109.073649][ T7251] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 109.080961][ T7251] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 109.097756][ T7251] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 109.102701][ T7251] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 109.107241][ T7251] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 109.109891][ T7251] usb usb1: Product: EHCI Host Controller [ 109.111671][ T7251] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 109.113737][ T7251] usb usb1: SerialNumber: 0000:00:1d.7 [ 109.124923][ T7251] hub 1-0:1.0: USB hub found [ 109.127446][ T7251] hub 1-0:1.0: 6 ports detected [ 109.172804][ T7251] hub 3-0:1.0: USB hub found [ 109.175918][ T7251] hub 3-0:1.0: 2 ports detected [ 109.212507][ T7251] hub 4-0:1.0: USB hub found [ 109.214381][ T7251] hub 4-0:1.0: 2 ports detected [ 109.249725][ T7251] hub 2-0:1.0: USB hub found [ 109.252199][ T7251] hub 2-0:1.0: 2 ports detected [ 109.407816][ T9] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 109.588370][ T9] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 109.605092][ T9] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 109.609840][ T9] usb 1-1: Product: QEMU USB Tablet [ 109.612104][ T9] usb 1-1: Manufacturer: QEMU [ 109.614102][ T9] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 109.639622][ T9] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0008/input/input15 [ 109.705424][ T9] hid-generic 0003:0627:0001.0008: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 110.218442][ T5827] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX [ 110.297617][ T64] Bluetooth: hci3: command 0x0406 tx timeout [ 110.297653][ T7245] Bluetooth: hci3: Opcode 0x0401 failed: -110 [ 118.461834][ T5827] lo speed is unknown, defaulting to 1000 [ 118.782192][ T7284] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 118.787193][ T7284] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 118.791771][ T7284] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 118.797568][ T7284] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 118.808757][ T7284] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 118.813930][ T7284] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 118.818553][ T7284] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 118.823826][ T7284] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 118.830103][ T7284] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 118.834411][ T7284] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 119.752353][ T7326] netlink: 4 bytes leftover after parsing attributes in process `syz.3.341'. [ 119.758456][ T7326] netlink: 72 bytes leftover after parsing attributes in process `syz.3.341'. [ 119.771638][ T7328] netlink: 16 bytes leftover after parsing attributes in process `syz.2.342'. [ 119.846820][ T7326] netlink: 'syz.3.341': attribute type 2 has an invalid length. [ 119.903849][ T7339] netlink: 'syz.3.341': attribute type 4 has an invalid length. [ 119.987591][ T5988] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 120.160014][ T5988] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 120.164264][ T5988] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 120.172363][ T5988] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 120.175898][ T5988] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 120.191039][ T5988] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 120.205990][ T5988] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 120.211684][ T5988] usb 5-1: Product: syz [ 120.213408][ T5988] usb 5-1: Manufacturer: syz [ 120.236913][ T5988] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 120.341834][ T7318] overlayfs: statfs failed on './file0' [ 120.741453][ T5988] usb 5-1: USB disconnect, device number 5 [ 121.290354][ T7367] netlink: 4 bytes leftover after parsing attributes in process `syz.0.353'. [ 121.294687][ T7367] netlink: 72 bytes leftover after parsing attributes in process `syz.0.353'. [ 121.382858][ T7367] netlink: 'syz.0.353': attribute type 2 has an invalid length. [ 121.774801][ T7383] e1000e 0000:00:02.0 eth1: removed PHC [ 121.933573][ T7383] ------------[ cut here ]------------ [ 121.936646][ T7383] remove_proc_entry: removing non-empty directory 'irq/31', leaking at least 'pcmmio' [ 121.940082][ T7383] WARNING: fs/proc/generic.c:747 at remove_proc_entry+0x4e7/0x610, CPU#0: syz.2.357/7383 [ 121.943582][ T7383] Modules linked in: [ 121.944998][ T7383] CPU: 0 UID: 0 PID: 7383 Comm: syz.2.357 Tainted: G L syzkaller #0 PREEMPT(full) [ 121.948651][ T7383] Tainted: [L]=SOFTLOCKUP [ 121.950055][ T7383] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 121.953203][ T7383] RIP: 0010:remove_proc_entry+0x4f5/0x610 [ 121.955016][ T7383] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 c7 00 00 00 48 8d 3d a9 34 6d 0e 49 8b 95 d0 00 00 00 48 c7 c6 80 fa e9 8b <67> 48 0f b9 3a e9 2a fe ff ff e8 cc c3 4e ff 48 8d 7d 18 48 b8 00 [ 121.961574][ T7383] RSP: 0018:ffffc9000449f678 EFLAGS: 00010246 [ 121.964069][ T7383] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffff88804ffc7edc [ 121.966584][ T7383] RDX: ffff88801cfce5dc RSI: ffffffff8be9fa80 RDI: ffffffff91284060 [ 121.970123][ T7383] RBP: ffff88804ffc7eb8 R08: ffff88805077e35c R09: ffffed1009ff8fc3 [ 121.972628][ T7383] R10: ffff88804ffc7e1b R11: 0000000000000000 R12: ffff88804ffc7e00 [ 121.975106][ T7383] R13: ffff88801cfce500 R14: ffff88805077e338 R15: dffffc0000000000 [ 121.977902][ T7383] FS: 0000000000000000(0000) GS:ffff888096bf3000(0063) knlGS:00000000f53f6b40 [ 121.980811][ T7383] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 121.982869][ T7383] CR2: 00007fb3483a6e9c CR3: 0000000047d3e000 CR4: 0000000000352ef0 [ 121.985345][ T7383] Call Trace: [ 121.986406][ T7383] [ 121.987349][ T7383] ? __pfx_remove_proc_entry+0x10/0x10 [ 121.989133][ T7383] ? mtree_load+0x32d/0xa90 [ 121.990584][ T7383] ? __pfx_mtree_load+0x10/0x10 [ 121.992125][ T7383] unregister_irq_proc+0x206/0x2a0 [ 121.993727][ T7383] ? __pfx_unregister_irq_proc+0x10/0x10 [ 121.995488][ T7383] free_desc+0x89/0x330 [ 121.996808][ T7383] ? __pfx_free_desc+0x10/0x10 [ 121.998407][ T7383] ? kasan_quarantine_put+0x104/0x240 [ 122.000095][ T7383] ? lockdep_hardirqs_on+0x78/0x100 [ 122.001720][ T7383] irq_free_descs+0x84/0xc0 [ 122.003203][ T7383] irq_domain_free_irqs+0x46a/0x5c0 [ 122.004880][ T7383] msi_domain_free_locked.part.0+0x524/0x6b0 [ 122.006760][ T7383] ? __pfx_msi_domain_free_locked.part.0+0x10/0x10 [ 122.008939][ T7383] ? msi_get_device_domain+0x115/0x1f0 [ 122.010661][ T7383] msi_domain_free_irqs_all_locked+0x11d/0x170 [ 122.012635][ T7383] ? __pfx_msi_domain_free_irqs_all_locked+0x10/0x10 [ 122.014736][ T7383] ? pci_msix_shutdown+0x3a3/0x500 [ 122.016376][ T7383] ? __pfx_pci_msix_shutdown+0x10/0x10 [ 122.018175][ T7383] pci_msi_teardown_msi_irqs+0xb3/0xd0 [ 122.019886][ T7383] pci_free_msi_irqs+0x1f/0xa0 [ 122.021406][ T7383] pci_disable_msix+0xcf/0x100 [ 122.022913][ T7383] e1000_remove+0x1a3/0x560 [ 122.024368][ T7383] pci_device_remove+0xb2/0x1d0 [ 122.025940][ T7383] ? __pfx_pci_device_remove+0x10/0x10 [ 122.027742][ T7383] device_remove+0xcb/0x180 [ 122.029229][ T7383] device_release_driver_internal+0x44e/0x620 [ 122.031145][ T7383] unbind_store+0xf8/0x110 [ 122.032602][ T7383] ? __pfx_unbind_store+0x10/0x10 [ 122.034183][ T7383] drv_attr_store+0x74/0xb0 [ 122.035644][ T7383] ? __pfx_drv_attr_store+0x10/0x10 [ 122.037290][ T7383] sysfs_kf_write+0xf2/0x150 [ 122.038861][ T7383] kernfs_fop_write_iter+0x3e0/0x5f0 [ 122.040530][ T7383] ? __pfx_sysfs_kf_write+0x10/0x10 [ 122.042165][ T7383] vfs_write+0x6ac/0x1050 [ 122.043526][ T7383] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 122.045390][ T7383] ? __pfx_vfs_write+0x10/0x10 [ 122.046895][ T7383] ? find_held_lock+0x2b/0x80 [ 122.048504][ T7383] ksys_write+0x12a/0x250 [ 122.049883][ T7383] ? __pfx_ksys_write+0x10/0x10 [ 122.051431][ T7383] __do_fast_syscall_32+0xe7/0x970 [ 122.053068][ T7383] do_fast_syscall_32+0x32/0x70 [ 122.054601][ T7383] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 122.056601][ T7383] RIP: 0023:0xf7f38fec [ 122.058093][ T7383] Code: Unable to access opcode bytes at 0xf7f38fc2. [ 122.060798][ T7383] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 122.064274][ T7383] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000500 [ 122.067976][ T7383] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 122.071237][ T7383] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 122.074515][ T7383] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 122.078175][ T7383] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 122.081526][ T7383] [ 122.082822][ T7383] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 122.085924][ T7383] CPU: 0 UID: 0 PID: 7383 Comm: syz.2.357 Tainted: G L syzkaller #0 PREEMPT(full) [ 122.090336][ T7383] Tainted: [L]=SOFTLOCKUP [ 122.092144][ T7383] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.096238][ T7383] Call Trace: [ 122.097639][ T7383] [ 122.098875][ T7383] dump_stack_lvl+0x100/0x190 [ 122.100869][ T7383] vpanic+0x552/0x970 [ 122.102585][ T7383] ? __pfx_vpanic+0x10/0x10 [ 122.104559][ T7383] panic+0xd1/0xe0 [ 122.106216][ T7383] ? __pfx_panic+0x10/0x10 [ 122.108119][ T7383] check_panic_on_warn.cold+0x19/0x34 [ 122.110371][ T7383] ? remove_proc_entry+0x4e7/0x610 [ 122.112472][ T7383] __warn.cold+0x191/0x318 [ 122.113889][ T7383] __report_bug+0x30f/0x440 [ 122.115358][ T7383] ? remove_proc_entry+0x4e7/0x610 [ 122.116991][ T7383] ? __pfx___report_bug+0x10/0x10 [ 122.118600][ T7383] ? do_raw_spin_lock+0x128/0x260 [ 122.120187][ T7383] ? find_held_lock+0x2b/0x80 [ 122.121671][ T7383] ? proc_entry_rundown+0x158/0x1e0 [ 122.123306][ T7383] ? proc_entry_rundown+0x158/0x1e0 [ 122.124974][ T7383] report_bug_entry+0xe1/0x290 [ 122.126485][ T7383] ? remove_proc_entry+0x4f5/0x610 [ 122.128282][ T7383] handle_bug+0x1cd/0x2a0 [ 122.130083][ T7383] exc_invalid_op+0x17/0x50 [ 122.131926][ T7383] asm_exc_invalid_op+0x1a/0x20 [ 122.133910][ T7383] RIP: 0010:remove_proc_entry+0x4f5/0x610 [ 122.136249][ T7383] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 c7 00 00 00 48 8d 3d a9 34 6d 0e 49 8b 95 d0 00 00 00 48 c7 c6 80 fa e9 8b <67> 48 0f b9 3a e9 2a fe ff ff e8 cc c3 4e ff 48 8d 7d 18 48 b8 00 [ 122.143915][ T7383] RSP: 0018:ffffc9000449f678 EFLAGS: 00010246 [ 122.146434][ T7383] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffff88804ffc7edc [ 122.149691][ T7383] RDX: ffff88801cfce5dc RSI: ffffffff8be9fa80 RDI: ffffffff91284060 [ 122.152861][ T7383] RBP: ffff88804ffc7eb8 R08: ffff88805077e35c R09: ffffed1009ff8fc3 [ 122.155980][ T7383] R10: ffff88804ffc7e1b R11: 0000000000000000 R12: ffff88804ffc7e00 [ 122.159207][ T7383] R13: ffff88801cfce500 R14: ffff88805077e338 R15: dffffc0000000000 [ 122.162480][ T7383] ? remove_proc_entry+0x478/0x610 [ 122.164642][ T7383] ? __pfx_remove_proc_entry+0x10/0x10 [ 122.166908][ T7383] ? mtree_load+0x32d/0xa90 [ 122.168754][ T7383] ? __pfx_mtree_load+0x10/0x10 [ 122.170612][ T7383] unregister_irq_proc+0x206/0x2a0 [ 122.172753][ T7383] ? __pfx_unregister_irq_proc+0x10/0x10 [ 122.175101][ T7383] free_desc+0x89/0x330 [ 122.176848][ T7383] ? __pfx_free_desc+0x10/0x10 [ 122.178840][ T7383] ? kasan_quarantine_put+0x104/0x240 [ 122.180976][ T7383] ? lockdep_hardirqs_on+0x78/0x100 [ 122.182937][ T7383] irq_free_descs+0x84/0xc0 [ 122.184703][ T7383] irq_domain_free_irqs+0x46a/0x5c0 [ 122.186650][ T7383] msi_domain_free_locked.part.0+0x524/0x6b0 [ 122.188740][ T7383] ? __pfx_msi_domain_free_locked.part.0+0x10/0x10 [ 122.190783][ T7383] ? msi_get_device_domain+0x115/0x1f0 [ 122.192503][ T7383] msi_domain_free_irqs_all_locked+0x11d/0x170 [ 122.194439][ T7383] ? __pfx_msi_domain_free_irqs_all_locked+0x10/0x10 [ 122.196567][ T7383] ? pci_msix_shutdown+0x3a3/0x500 [ 122.198183][ T7383] ? __pfx_pci_msix_shutdown+0x10/0x10 [ 122.199893][ T7383] pci_msi_teardown_msi_irqs+0xb3/0xd0 [ 122.201608][ T7383] pci_free_msi_irqs+0x1f/0xa0 [ 122.203114][ T7383] pci_disable_msix+0xcf/0x100 [ 122.204635][ T7383] e1000_remove+0x1a3/0x560 [ 122.206112][ T7383] pci_device_remove+0xb2/0x1d0 [ 122.207643][ T7383] ? __pfx_pci_device_remove+0x10/0x10 [ 122.209356][ T7383] device_remove+0xcb/0x180 [ 122.210802][ T7383] device_release_driver_internal+0x44e/0x620 [ 122.212731][ T7383] unbind_store+0xf8/0x110 [ 122.214145][ T7383] ? __pfx_unbind_store+0x10/0x10 [ 122.215755][ T7383] drv_attr_store+0x74/0xb0 [ 122.217208][ T7383] ? __pfx_drv_attr_store+0x10/0x10 [ 122.218843][ T7383] sysfs_kf_write+0xf2/0x150 [ 122.220326][ T7383] kernfs_fop_write_iter+0x3e0/0x5f0 [ 122.221978][ T7383] ? __pfx_sysfs_kf_write+0x10/0x10 [ 122.223618][ T7383] vfs_write+0x6ac/0x1050 [ 122.225208][ T7383] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 122.227388][ T7383] ? __pfx_vfs_write+0x10/0x10 [ 122.228974][ T7383] ? find_held_lock+0x2b/0x80 [ 122.230487][ T7383] ksys_write+0x12a/0x250 [ 122.231865][ T7383] ? __pfx_ksys_write+0x10/0x10 [ 122.233409][ T7383] __do_fast_syscall_32+0xe7/0x970 [ 122.235052][ T7383] do_fast_syscall_32+0x32/0x70 [ 122.236595][ T7383] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 122.238571][ T7383] RIP: 0023:0xf7f38fec [ 122.239872][ T7383] Code: Unable to access opcode bytes at 0xf7f38fc2. [ 122.241950][ T7383] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 122.244541][ T7383] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000500 [ 122.247034][ T7383] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 122.249477][ T7383] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 122.251944][ T7383] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 122.254403][ T7383] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 122.256910][ T7383] [ 122.258503][ T7383] Kernel Offset: disabled [ 122.259865][ T7383] Rebooting in 86400 seconds..