last executing test programs: 7m18.636400881s ago: executing program 0 (id=505): open(&(0x7f00000000c0)='./bus\x00', 0x18d03e, 0x0) ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f0000000380)={0x280, 0x78, 0x3f, 0x0, 0x1, 0x0, 0x1, 0x0, {0x0, 0xffff}, {}, {}, {}, 0x0, 0x80, 0x0, 0x2, 0x1, 0x0, 0x0, 0x20000006, 0x0, 0x0, 0x8, 0x0, 0x0, 0x200, 0x3}) open(&(0x7f00000004c0)='./bus\x00', 0xc2802, 0x181) quotactl_fd$Q_SETINFO(0xffffffffffffffff, 0xffffffff80000600, 0x0, 0x0) socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB="0180c200000000000000000008004500001c0000000010029078ac1e0001e000000111009078e0000001144a1ba2"], 0x0) prlimit64(0x0, 0xc, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$packet(0x11, 0x3, 0x300) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) connect$packet(r1, &(0x7f0000000200)={0x1f, 0xf8, 0x0, 0x1, 0x2}, 0x14) shutdown(r1, 0x1) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_FILTER(r2, 0x6b, 0x1, &(0x7f0000000000)=[{0xfffffffffffffffa, 0x2, {0x1, 0xff, 0x1}, {0x1, 0x0, 0x1}, 0xff, 0x1}], 0x1c) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x23, 0x8, 0xc, 0x80000000, 0x1}, 0x50) syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYRES8=0x0, @ANYRES8=0x0, @ANYRES64=0x0], 0x14}, 0x1, 0x40030000000000}, 0x4000) 7m17.120010939s ago: executing program 0 (id=513): move_pages(0x0, 0x5, &(0x7f00000001c0)=[&(0x7f0000d13000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000582000/0x2000)=nil, &(0x7f0000542000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil], 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) membarrier(0x10, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x4c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x2c, 0x2) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x9, 0x4c032, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000004700)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0xc011}, 0x24004014) openat$apparmor_thread_current(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='2', 0x1, 0x4fed0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="01002abd7000fedbdf252a75dc1436cba09b5cba832ed0960c217e6e04ead2872a780ab968518f06390a00000057d701823fd4d40153ec9b86ebdbdcca201e1e62a5ffadeca9c71f4315af20edac0ef8bc4a9cccb06af10b70eed6"], 0x14}, 0x1, 0x0, 0x0, 0x8805}, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r5, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00P3', @ANYRES16, @ANYBLOB="00032bbd7000fcdbdf25770000000500ee00640000000800ef000e0000000500ee00800000000800ef000e0000000500ee00ff000000"], 0x3c}, 0x1, 0x0, 0x0, 0x810}, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f00000000c0)) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x2001, 0x0) pwrite64(r6, 0x0, 0x0, 0x6) pread64(r4, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) 7m16.911037552s ago: executing program 0 (id=514): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) sched_setscheduler(r1, 0x1, &(0x7f0000000000)=0x40) r2 = syz_open_dev$sndmidi(&(0x7f0000000200), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, &(0x7f0000000240)={0x1, 0x1ff}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r6 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000080)="aefdda9d240103005a90f57f02703aeff0f64eb9ee07962c220852f426072a00"/42, 0x2a}], 0x1) poll(&(0x7f0000000140)=[{r6, 0x44}], 0x1, 0xe6) mremap(&(0x7f0000097000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x2, 0x4, 0xfff, 0x7}, 0x50) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x3, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x83}, @NFTA_EXTHDR_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xcc}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/module/acpi/parameters/debug_layer\x00', 0x2, 0x0) read$proc_mixer(r8, &(0x7f0000000300)=""/253, 0xfd) 7m14.734893223s ago: executing program 0 (id=519): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz0\x00', {0x2, 0x10, 0x2, 0x4}, 0x48, [0x0, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0xffff, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1, 0x0, 0x0, 0x0, 0x2000, 0xfa, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x8000, 0x2, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200, 0x7, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xfffffffc, 0x2, 0xd, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0xfffffffe, 0x9, 0x0, 0x200, 0x0, 0x2, 0x0, 0x3, 0x5, 0xfffffffd, 0x4000000, 0xfffffffd, 0x0, 0x0, 0xfffffffe, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x2aa6, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x4, 0xfffffffe, 0x0, 0x0, 0x0, 0xb, 0x1, 0x3fffffe, 0x0, 0x1, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x797, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x4, 0x0, 0x6, 0x28e, 0x0, 0xbda6, 0xe, 0x0, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x20, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6, 0x40, 0x0, 0x0, 0xbd, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x800, 0xff, 0x80000020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5cb9, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x8, 0x0, 0x0, 0x4]}, 0x45c) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='!t', 0x2) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r0, 0x5501) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYRES16=0x0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0xd, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = syz_open_dev$hidraw(&(0x7f0000000140), 0x200, 0x400000) ioctl$HIDIOCGRAWINFO(r5, 0x80084803, &(0x7f0000000180)=""/31) sendmmsg$inet(r2, &(0x7f0000004840)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000100)='\a', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000002a80)=[{&(0x7f0000002800)="c9", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000002c00)="18", 0x1}, {&(0x7f0000000580)="ee9c2c3b65f73731509a8232e6f4a3f0cd2cba4749cee5c72eb7b52bbedc6e5ff1be36cd3436bf1f13ad4f315e8b1c24199ed8bbedd43f", 0x37}], 0x2}}], 0x3, 0x40480c0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000200)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000040)='/', &(0x7f0000000080)='./file0\x00', 0x0, 0x197841, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0xc) r7 = socket(0x2d, 0x2, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a74000000060a0b04000000000000000002000000480004802800018011000100666c6f77100002800900010073797a30000000001c0001800a00010072656469720000000c00028008000140000000100900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x9c}, 0x1, 0x0, 0x0, 0x2000094}, 0x80) bind$xdp(r7, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) close_range(r6, 0xffffffffffffffff, 0x2000000000000000) 7m14.342179005s ago: executing program 0 (id=524): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x101280, 0x2) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6(0xa, 0x3, 0x5) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) dup2(r1, r2) mkdir(&(0x7f0000000400)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./tracefs\x00', &(0x7f0000000480)='tracefs\x00', 0x0, 0x0) io_setup(0x8, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeed, 0x100010, r1, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r4, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r4, 0x5001, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x35, 0x800000000004, @thr={&(0x7f0000000640)="70d8314af1196660faab72190981d8af3d775055641d93db4c6965d6fd676d525a500e8a3693dbf57b5d3d8b2db546b32c7ae1b3be878aca623128376dc7c112c56f1a108b6b1b978dfebcf006000000596f182d26ba83dcbc81207d62c65e49cf5f39c9d27f470ca1dbc68ed9136d06ea76e3f48fd6b603be05c86f484c3d3235e884626ca0d49e3135c730d1c04b2d5b7cef2ceed6ae101fee912a69d1671db3b1d5000000a27f5b890932c82ede72", &(0x7f00000005c0)="7c4e451e6936a0101cb7f7c3dc2e68b6a9a66db0f189ad72b4cd0b2fa175775a"}}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r4, 0xc0045009, &(0x7f0000000040)=0x2fff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) syz_open_dev$video(0x0, 0xffffffc9, 0x2942) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./tracefs/events/xhci-hcd/xhci_portsc_writel/format\x00', 0x0, 0x0) 7m13.952515479s ago: executing program 0 (id=525): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x80, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x60, 0x30, 0xb, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x1}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x80, 0x8, 0x8, 0x8, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x60}}, 0x44) write(0xffffffffffffffff, &(0x7f0000000240)="14000000140005b7ffccca38b9000000060860eb", 0x14) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000100), 0x2, 0x0) write$nci(r4, &(0x7f00000005c0)=ANY=[@ANYBLOB="e87d1120c34370074c8c3159e585e1e7d9d64a51aed756c6943ef9fd32f2845cbdf2adf9b97e6be3d8dea2bee1471e88037c2ffb589116b46549ed728fa80200000000000000565d0879d80203c98a72320180f58b97c9e7006bc20e6abd9264e308eca7ef78d98a2d6b410d2b15e6e085cca6a169fd5801b79b5e5dd5ca55277a42df43f04fb6a3bcc1a6632b89f49f93df860cfc"], 0x4) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r6 = inotify_init() inotify_add_watch(r6, &(0x7f0000000540)='.\x00', 0x850003d1) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) 7m13.885910895s ago: executing program 32 (id=525): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x80, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x60, 0x30, 0xb, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x1}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x80, 0x8, 0x8, 0x8, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x60}}, 0x44) write(0xffffffffffffffff, &(0x7f0000000240)="14000000140005b7ffccca38b9000000060860eb", 0x14) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000100), 0x2, 0x0) write$nci(r4, &(0x7f00000005c0)=ANY=[@ANYBLOB="e87d1120c34370074c8c3159e585e1e7d9d64a51aed756c6943ef9fd32f2845cbdf2adf9b97e6be3d8dea2bee1471e88037c2ffb589116b46549ed728fa80200000000000000565d0879d80203c98a72320180f58b97c9e7006bc20e6abd9264e308eca7ef78d98a2d6b410d2b15e6e085cca6a169fd5801b79b5e5dd5ca55277a42df43f04fb6a3bcc1a6632b89f49f93df860cfc"], 0x4) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r6 = inotify_init() inotify_add_watch(r6, &(0x7f0000000540)='.\x00', 0x850003d1) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) 5m0.124308972s ago: executing program 1 (id=1192): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$kcm(0xa, 0x1, 0x106) setsockopt$sock_attach_bpf(r1, 0x29, 0x4b, 0x0, 0x4) r2 = getpgid(0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000640)=""/207, &(0x7f0000000740)=0xcf) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) memfd_create(&(0x7f00000003c0)='%\x00\xae\xdb\xb8\x18\xc1\xecWbNO\xde^\xff\x19\x17QE{*X\xe3\xe2\x06\x00\x00\x00\xcc\xf6\xc0H\xa2\x83?\xe7\x89*\xf1\xc5b\v\xec\xe4\xb0\xa2\xc5\xee\x04\x98\xa9\xb9\xe5\x8c\xc3\x97B\xaa+\xf2o\xf6k\xcc\xf7\x057\x8d\xb1\xa0\x86\xe8\xda\x90\xc2\x1e\x15\x11\x92\x9d\xc1M\xe5@\v\x001\xae\x19$\xf8\x96\x81\xcbR\xae`\xd3\xf8_R~7\xf5\x1c\xc8\xf9\xe2z\x00<\xdc\x11\x89\xc9&f\x00\x00\x00\xe2\x83\xf1\x0eg\a\xec\xac\xa5\x94~v\x80P5\xf9/$', 0x4) r6 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[], 0x10}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x4, [@var={0x2, 0x0, 0x0, 0x11, 0x3, 0xffffffff}, @func_proto={0x2, 0x0, 0x0, 0x8, 0x2}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x38}, 0x28) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000000f000000050030000000000005002f000000000008000300", @ANYRES32=r9], 0x2c}}, 0x4000000) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=ANY=[@ANYBLOB="440000001000030425bd7000ffffffff00000000", @ANYRES32=0x0, @ANYBLOB="40450000000000001c0012800b00010067726574617000000c00028008000400b227000008000a00", @ANYRES32=r9, @ANYBLOB="2594b77208b6179db35c42f8f51296d8bdbac036bf3c9c3b80bc98dcc0d4285b604a74175c3a22ff01456569ef480b956f99c0b13f40340dcc6478566a23a5"], 0x44}, 0x1, 0x0, 0x0, 0x4000881}, 0x48004) r10 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_lsm={0x1d, 0x18, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x97, 0x0, 0x0, 0x0, 0x8}, {}, {}, [@map_idx={0x18, 0x2, 0x5, 0x0, 0xa}, @tail_call, @map_val={0x18, 0x7, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000480)='syzkaller\x00', 0x3, 0x4c, &(0x7f00000004c0)=""/76, 0x0, 0x70, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000540)={0x0, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r11) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r10, 0x4048587b, &(0x7f0000000c40)={{0xffffffffffffffff, &(0x7f0000000780)='\x00', 0x109e40, &(0x7f0000000880)={@align=0x3, {0x8000, 0x6, 0xfffffffb, 0xa1}}, 0x3, 0x0, &(0x7f0000000900)=0x9}, 0x0, &(0x7f0000000bc0)}) bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r6, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) sendmmsg(r6, &(0x7f0000007fc0), 0x800001d, 0x0) 4m58.424925847s ago: executing program 1 (id=1195): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, &(0x7f00000014c0)=ANY=[@ANYBLOB="18010000756c6c2500000000002020207b1af8ff00000000bfa1000000000000070100001cfeffffb702000008000000b7"], &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) sched_setscheduler(r1, 0x1, &(0x7f0000000000)=0x40) r2 = syz_open_dev$sndmidi(&(0x7f0000000200), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, &(0x7f0000000240)={0x1, 0x1ff}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r6 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000080)="aefdda9d240103005a90f57f02703aeff0f64eb9ee07962c220852f426072a00"/42, 0x2a}], 0x1) poll(&(0x7f0000000140)=[{r6, 0x44}], 0x1, 0xe6) mremap(&(0x7f0000097000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x2, 0x4, 0xfff, 0x7}, 0x50) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x3, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x83}, @NFTA_EXTHDR_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xcc}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/module/acpi/parameters/debug_layer\x00', 0x2, 0x0) read$proc_mixer(r8, &(0x7f0000000300)=""/253, 0xfd) 4m57.811827238s ago: executing program 1 (id=1204): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0x88) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) getdents64(r0, &(0x7f0000000000)=""/134, 0x86) 4m57.758242052s ago: executing program 1 (id=1205): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) r0 = accept4(0xffffffffffffffff, &(0x7f0000000380)=@vsock={0x28, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x80800) sendmsg$OSF_MSG_REMOVE(r0, &(0x7f0000000980)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000940)={&(0x7f0000000480)={0x4bc, 0x1, 0x5, 0x101, 0x0, 0x0, {0x7, 0x0, 0x1}, [{{0x254, 0x1, {{0x0, 0x7fffffff}, 0x2, 0x31, 0x1, 0x1, 0x6, 'syz0\x00', "3f3dc8de89a0fdd75584f7853c2ccba43675a00469b4e9ce561e2a5f6ee7842b", "ffbe46cc321af43e4f5809f086de62956e094a46b9b2c217b30674e842755360", [{0x167c, 0x0, {0x2, 0x6}}, {0xfffd, 0x100, {0x3, 0x8001}}, {0x8000, 0xe6d5, {0x3, 0x9}}, {0x32a1, 0x1, {0x1, 0x7}}, {0x7, 0x1000, {0x3, 0xfffffff9}}, {0x4, 0x81, {0x3, 0x5}}, {0x7ff, 0xf, {0x2, 0x8}}, {0x401, 0xe229, {0x0, 0x483}}, {0x1, 0x9, {0x2, 0x2}}, {0x401, 0xfffb, {0x3, 0x8}}, {0x1000, 0x24}, {0x8, 0x7, {0x2, 0x3}}, {0xb, 0x0, {0x2, 0x8000}}, {0x3ff, 0x7, {0x3, 0xa91}}, {0x28, 0x2, {0x0, 0x78d}}, {0x4, 0xa, {0x0, 0xa5}}, {0x5, 0x9, {0x0, 0xb7}}, {0x3, 0x1ff, {0x1, 0x401}}, {0x3, 0x2, {0x1, 0x5}}, {0xce27, 0x8}, {0x4, 0x9, {0x2, 0xfffffffc}}, {0x5c00, 0x2, {0x3, 0x4}}, {0x1000, 0x76f, {0x1, 0x81}}, {0x9, 0x401, {0x0, 0x5}}, {0x3, 0xa, {0x1, 0x2}}, {0xfff9, 0xfe78, {0x3, 0x1dde}}, {0x2b8, 0x4, {0x1, 0xcf}}, {0x8, 0x2, {0x1, 0x411}}, {0x6, 0xc, {0x2, 0x9}}, {0x3, 0x5, {0x0, 0x10000}}, {0x6, 0x6, {0x3, 0xb83}}, {0x6, 0x9, {0x2, 0x9}}, {0xef8e, 0xfffb, {0x1, 0xffff}}, {0x6, 0xd519, {0x3}}, {0x1, 0x8, {0x1, 0x4}}, {0x2, 0x6, {0x0, 0x80}}, {0x5, 0x1, {0x1, 0x969}}, {0x7, 0x9, {0x3, 0x4}}, {0xf, 0xe0b, {0x0, 0x8b}}, {0x5, 0xaa3c, {0x0, 0x2}}]}}}, {{0x254, 0x1, {{0x2, 0x2}, 0x3, 0x9, 0x4, 0x8, 0x27, 'syz0\x00', "2cbd8ff7ee1f79bc8e4e947da3c620ffca3cd9c6c84193d0327c360a6fc86a45", "ecb24079b306a40d31f6c009bd7b2576fbfd36c5a259952ac1e5f28f414cef29", [{0x4, 0x2, {0x0, 0x2}}, {0x7ff, 0x5, {0x0, 0x66}}, {0x8, 0x9, {0x1, 0x6}}, {0x2, 0x8001, {0x1, 0x1}}, {0x53, 0x9, {0x3, 0x7f}}, {0x238, 0x8, {0x3, 0x5}}, {0x8, 0x9, {0x0, 0x5}}, {0xffff, 0x7fff, {0x0, 0x2}}, {0x50c, 0xfcd, {0x2, 0xffffff33}}, {0x1, 0x4, {0x3, 0x7}}, {0xf01, 0x0, {0x0, 0x9}}, {0x1, 0x1, {0x3, 0x9}}, {0x2, 0x81, {0x3}}, {0x9, 0x6e, {0x2, 0x6}}, {0x80, 0x1, {0x2, 0x7}}, {0xf, 0x1, {0x2, 0x6}}, {0x4, 0x4, {0x2, 0x5}}, {0xfff9, 0x9, {0x3, 0x1}}, {0x5d21, 0x1e88, {0x2, 0x3}}, {0xbc15, 0x6, {0x3, 0xfffffffc}}, {0x3d04, 0x8, {0x3, 0x8000}}, {0x14, 0x40, {0x0, 0x48}}, {0xed8, 0xc, {0x0, 0x8}}, {0xfffb, 0x7}, {0x6, 0x3ff, {0x1, 0x6}}, {0x3, 0x7, {0x3, 0xfffffffc}}, {0x1, 0x0, {0x3, 0x62b728b2}}, {0x2, 0x4, {0x3, 0x71fe}}, {0x8, 0x7, {0x1, 0xe814}}, {0x8, 0x4, {0x1, 0x8e}}, {0x6, 0x2, {0x1, 0x7fff}}, {0x0, 0x200, {0x1, 0xffff0000}}, {0xfffa, 0x0, {0x3, 0x858}}, {0x9, 0x8001, {0x1, 0x7}}, {0x0, 0x3, {0x1, 0x7}}, {0x9, 0xcfb, {0x3, 0x3341ce0a}}, {0x6, 0x73, {0x0, 0xf}}, {0x79, 0x482, {0x3, 0xe1c}}, {0x4, 0x5, {0x0, 0x3}}, {0x24, 0x5, {0x3, 0x6}}]}}}]}, 0x4bc}, 0x1, 0x0, 0x0, 0x880}, 0x20004085) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x58, 0x1, 0x4, 0x201, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0xa6}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x1000}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0xf2b}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x5}, @NFULA_CFG_MODE={0xa, 0x2, {0x7ff, 0x2}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x9b141d1}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000080}, 0x4000) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0x88) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)) syz_emit_ethernet(0x4a, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f00000000c0)='./file0/../file0\x00') mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x2acd0da, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000100010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000000000000000010000000900020073797a32000000000900"], 0xec}, 0x1, 0x0, 0x0, 0x24004005}, 0x20004004) getdents64(r2, &(0x7f0000000000)=""/134, 0x86) 4m57.613318217s ago: executing program 1 (id=1206): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$alg(0x26, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, 0x0) chdir(&(0x7f0000000100)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x10000, 0xcf) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f00000002c0)=[{0x0}], 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000340)={0xffffffffffffffff, r4, 0x25, 0x0, @val=@iter={0x0}}, 0x20) syz_emit_ethernet(0x11e05, &(0x7f0000000880)=ANY=[@ANYRES16=r1, @ANYRES64=r2, @ANYBLOB="11132c253464863d0e7d5e93ed2696a932a9b0ca701aba2874b535dbbeac57f31824347cecadd2d9c8bd3bab15d42895b13ba5a2bc45f9c568e53f3bdfef2838abc78124bd35b32ce1c3f9d623f4041a98112d2c90ad012e70128541b7cf5dabf00216f849502dbcc1ccaf01291af91bec6375c4e6cc736d3cfad83af015e72048b4cf8f6f651356daa121b673e63002a4679465817c7db5e81733142a948025c2c0d87769099e2cea557e41ca5249b678d5cabbd6d4919855d7da58f84b714ccd1c36eebfd7f306d1f58bd6c6e4b2d8505eebbdf9d80564088690d93f1e73c747b6a0b5b3fd99ab787211153c6ff7ad5a11285c6c514aa9272cf23201d5c4d72c97063fee941cd6e7cd55e1d375b072e81a40ef9eaaaa583dab152dd8a3f2518d020450f544480cb0aad221209b740c1a9f97b46204069a4ac14dcdd89cdaf7db38044b2629c2c46ca4013ca0cb1da4035020bc12b36f3e7c3f3fbd08ad5bd427a6e9544d9d6b36e0bde76eb94e6ce9c930cbe8704f0a49e83b4fc575d0f8f73b0b1b16e5a791b3516581b6f861af28e9e88b9058f72f11d12ed24012d103270457f4e0c8b8c1d393401cb1ebbf89c16a374dfd6f582bfd6d8914068c39875f662da6f1798ce0a0cfe2a991be66f152377e159b9abaa1358493be4441f1e85a4fc6fe894915a0a9e998d69ceb397358630f5c0851503574dafdfa10bcb239dbaff23d43f640a64d28ba93c5feb1e0d2ddb828f32a7e22bfb2bb4d7d8369f85a6dfa058c8de47feb3cfe6e13a5bc1b7c4c41cf82631d0ffab18bd1638b5dd7e27573aceb6804a4e10125ad634b871fb18033d011bb7cb409db77ad10cd3f162eb72f75552099f17ebbdad32de49f568e7ed770596e08c5e0eb1699a51a1142850efeadb7964229d20723e7649a9d65aa33e0aed85cdf6df99990a161a5219a5aef6a0d49c60c2410d4ca05f63416eb9c393184858ecae631e61881d481496b7ac38030964e9d14ecc91c8a3e21865574c2dcf18cbdedfa1c9ba81c99a7a6873907060d8500ad107bd7a64a312a71f38cc2e42c7f05c7cb88c11cac00306b5f36183c86c611f07d1fc9583ec5620668b1b179ae131788d8fb2502128c1070fdadee13a6e8ca1d84f3b53d911461354148b958b8fe6592488871cdd7ae3118846233ecf78380fdc9876cc3a10ed3820b31f39ecf183cb3aecb0ef458af38105e4c498773bfa5d7529cd6305880867eb2fe48f71e14ffcbf22f29d008abd0d7f0e4908228669db615768bbe37b9418f1d5c24a5b20fbb9cdc739454f1bf00759541e3372cd5011ea4d99d9acc412cc2c59eab10271ffd354aa05014880da390eb13422285d222f900c7eecd873b23ed3235aa8f69a0e658e7fd2818e2ff0f1a7d9080def2d7344ea14b821d5e15fb56cf70229397667d2fbee1aaa9e65d022d99f7e4b7c4f438c79a5ec9ddce98c0ba2dca6d6539f51e3dedeaa8de5fcbfeea66cfdf576a28a0f729a8dece94d1f302c3342b04af40a26c5309877381d205498f900fb7e20114063b31204769c3e8a571e8718ff548d3b671a48467d35ec00c5eba2430e1c659e301d786a2ba576019e23b04727a9d3dc797055724addbe97ed81ff94d84abf97eb62e2d98e3ad68ec543d255f058b84adb0c6025c21c316197293d0d0901b145f7ede9942b73c461f261574b348e752b5287f504aab9a8142f17dce206548b8eeb4067b23416cadf91e69ebb27cf3dbe8daecdd8773a24c657341345746ffe3102bee200f7c7c9d74c5b0712eb64eb6a1473adb237e043696b1bedb2fdd5d72a14093acaf9f1a74eecad229693c52be1ff880774ab24fe12b34f14b9dfc8793332ab606331d8151535e29abd0e427169a14c550fa683b787a3ccb3b3989afeeb2e72aafd2a4ac44f9d651743b37e7c9df8efc4ecc489a2e47db8924f855063951d63bfdc32c356429bd0f33d344f84f31de26da982fcac75ec7d14fab5a45bbc2bb4c43e9380f102bc79178b14cea3e410627fb054715c6ec4e872a1ce386884e341d8aa36af445224b6531a0e9cdcec32b8dd3f1f1f04da56c6f9ce873eebfa452feafa8cb311833413974ec356513aa1dddd684cf12449dddafec13191aaaf05f65ab1541b5326ac298e6e667019cbf83c04312cf7df132b6a8e89e04b76d5b7be5d5a765aac6fc345ccf024eda93bd4290a734bd43ab5f010cf5af3c5e4cbfe6e74efe86d53d1460df80b43de3e07a3052cfe8332c9bcfe4de089ea81875b7e596e2ae0f649247eb5e5ed2a006dfac9392d49530a7daddf1bb08392f6fae633e58da1d6408545b1248ef5eee7444263b7f1a5c8e2b1fcbf99d679efce4f078d9bcf56e6a22cd8a93f3d5feecfcb10ecb43c0c5bb3e599fbbd6495ab260f07973266f65c82fba38d5c0161f65b73cfaf2b8855d012b00a4dd6f95126642b0cf9ab1308d48520a2fe170e21785b0b656aaaa235d83b5b0f0523a87f9982ee4c9d94b75ba3237fe98db030ff19f9dc75bb761c1ccd857cea4fd926877027c611a9e1c02fb4e159c18482a5c3085566d95dacb2f8041e6edb779027c354b07c947c4beb3e9a16a3dc9c9edbe71a3174726abc46fc2a1d33bb0559437c6b320f30c6951624c65d0a1607f560dbfed5fbabdf2c0b960b246fb4306c68d3b3013a81f3f3f4274b0a496a4b01b25448cee8fa7e4b5a28c6c4634894c5de6ebe681a76edd41b237dde07f7ef4a56d4bc5127e043d2ab75eaae29d0955cf2c5eaedaae99387a166571003730f0301181427c407f76c2f3b7fff77795c1f9b86c269f081236ef7cb2936654beb41143da0bb5748ff674495f580fb0d100301c3c5c407371a3ed935b6d93e07782cbecd3e3d670ebf1d450bcd0f9244d1f0620f27728ebfb7841052cc11e7a19092f325244d03f8ca8720df3ec9bbb0988e513cf1f45fbc0948a74fbb25a192ff1eeefb29b5eb2e6259b4283fbe5081a78b500d88b4d07a78c56d9b077d33efd493c7b9fc850e076ccac6332c95603570968f411765bba35a2c7681e0a7942309fd6c9dc16c3d1ebafe774ffb75b0498b0a5ca61a3d8ad768f33b42962aa5b9568cc1224cfc6fbd7c1ad2ae56479af645cfc4316633bca639b1fd8c7c33c298967b4a2cd658d87422b0c10470d4bdd29ebf96941f1f0e07ed750df58c0535389deb158a6e06ac54392514c0addb3314d5b1baf3fbefb2e4e4cebe3b382259a44c4d62f08380d4f3eb563b24e99c6339b4ecc259f34d450e312603919ec8a31f90d362586a9b422deb4fe9f0657c1c357899f419995f5a0da3dd8ff5645f6cb9c796afc9880d59ba56ab7e8f7b0634a6c6979e788e07f288b329b5675bbfa7de41e87a69f7553a8be084d23b20845773c90b1b37d1b296b7f93cea8b248666e4c8265987a68e4f19500d248aa05f731bb321c0b15e3df0b95a963d1156af425cd856f176d78eaff593afef555fc9e5bb12aa093c645c2d2652924f990b605da2fba69bb31751ef8bd24547f8b0dbe7f3050f5efd2e00dacc7826d80c0eca3f08e44103df62f8098c4347add4c9ff5dca0e7c49c3e2888d9a385448929eb5d3226f2c96775523c006c78034a8d961f2ff013f135dde2e7a687b9ccc9244ed1f623cc604d671b7554c7a6051838106320f3f3c5a24c25b1c759cd30b0336dab807768cc794d4e0a84964f87375866f6c8cccc95a658d9f3473e93fd13558b90dbcd37564ccb5f516b195f8258266edf479dea3e791ec8614e21000d79e4d1825f816bc304f74e5bb613f1a1c2944e036ff6319535b8bf64a5851f74cdfa041e2623a922cea77395c53030ece6cdfb730f9d838647a3ba80918baf14af6c283b9ba4eda53f5b1626399e128c56c3e6ba5ce397ae7b328c30539a858d738a0550ee1e061ad10596b1f95baef66d381bf03ca0340e72e0cfddf627f8e8a340f6fa8a456df9e96b0424609a51b02aeda39ac18e2236dfcab01da09b8b51ca0dcac0a897a4b5be9a6b692ad294ca13d6702cfae21c36a13e58fbf42b17855dd98c63edffa44b6c83b7ebf459aa193b8ee69ef9dc93180c37487d58d182333bb97e013a8da2fc9edf662932fca2454cad1cbe2c299a5df581a0b0357d7a999c44b1a0d954d310c523d3eb3f031f9f14d1a694dae820ad5c9aedef36f3ebf1f7078b199fe9612d2eb58d5a090f3d076c7e5d4f8b909c91abaf269b20f7cc8761a1c778572d252a26bdf6633f9ad9d3c7b7b2a0772c56a0235b8581a5cc6dba3e9e2a5506de493029e4177dc5546ccd377982360c213a112fb4e4a146a2bf800cd82c41bec1104b7beacbcf363126ed3ea0de51abb4e500c02e2ed78989be4a40e0f27dc97cf8de6755e9a9dac4f00bddd8cb49f0f98c94879fa81730ac40158aff7a60bb3ef35a2cd1bff1c028a6f5d1fccf6904d4c44089940b908e7a9d334326eb18c4eca5fa8d5f7449e9d1d4cdc1d1d9adf14e7fd7da80c70db1ecc96c6a9b7e13e2f989e7c410f7f477db8293d2aca8d293cd1a765cead49a440d34d0d2817d270c42b59afaaba47186857b23495efe53e56b7e078608a9d4999c0d515df70f381dc2e6e95d0a0091b5807a24add0810f15416c9f48ee1e45843fa853b7983a1121e2ef5a9872b63b94976d2f4f8da1994c37737fe8e848bc03e4c93ac83b97a959b64409b9a24aaad2778ea64d074b3bde414758ef366b5d5ae545d55a67dc7af5985a255cd65467769b16140e279b4f61612a7411f4853c435f526496e228b968f6135d9a1d50a173dfa3ae4da6efb601ef4d653bfbaeb518b8114a35c7f75aaf71ceadac8eb96c2be02ac820e7c1ada7e72285c53e7c14e575239fda8b91824495033e7245eaf1e045b6dc42dac879f5ff2f2b261d0beb1f8e60e06c5f1095d1371887f913d5c9f4ef27705eb92076039f5bc2d14328fd4208b9b6ddc85f39e188681ce7ec31dbd13ce259fe79b63c62b71fdc6afdba350f2f1a16695f705b63e95231c21cd95e48a4dfbc245e2c14fa428f4cf48561ed2f80886537daa64083ad65a234754252cc41ec35b8258b2339f647efb8df3e6aa29efef0471580a369046b6e15e59aaaf834b80c8d0d0753a74b397e80e158fa33e35655b3387ca12eab91545828724a90b02d89dd181934dba20842117fbf97443260af877ae7ae77123bc95007cae4e63fa64feb1419a30e95718edbdb6642f5e92b6ba813648b29a0c68adbaee757d9d6800078a5d4827bd02a8bdd1a5c1b9e205b40dbbd3a83b7e9595bfce50ecb14c68432dd3cc814699678a21c05a4644392226b9749d2e562a99ae821468c12cf17d67a88b6755087605f429daefae2c79aa84cf57d8c9835eb9fe4ec62f1321091c2edc3113104287e5fae1c97b71e6b7d74b13ea2853857b0dc8af799f7e773aaa3d2c4352e8cac01b5ebaadd4adcefd992492dc75ea8e520dfa5fab871f3eb1dc2acc1c92495e5d5a4b45c342b1fe9a08870a4c71f293696a6d2f0371ced91a112a5e254d2c9d8a22a793ca1e5752f59eaf5c575c173eb1fabc1e45b2a910fd2d9adb7d2b6c6f0bf6a2affbb6425ca2c1400b7c78e0e3b69bacd642f42dcde0bfe39924363c6ec5414d77e60ea2ab72b3a16e3a15f3c788e2ec4a92dbcd0fb42cfa9e7cb733c72054f9557aa9b27842510baf9d496788637432531d571cf446e5a435258f77acc852e5f269d5a7287f2b7b0051a38bae68b9ed28788a0da287d76eb27bdf682976417c601f84d11c171722f4cd4a6023b410658c2f160ab0d92edd26b5e1888d8b272ae", @ANYRES64], 0x0) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r5, &(0x7f00000065c0)={0x0, 0x0, &(0x7f0000006580)={&(0x7f0000006080)={0x28, 0x14, 0x211, 0x0, 0x0, {0x28}, [@INET_DIAG_REQ_BYTECODE={0x11, 0xfa, "4ac2411e47060aefadfa617ab9"}]}, 0x28}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bond={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0xe}, @IFLA_BOND_ARP_IP_TARGET={0x4}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x40004) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0xc0001, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f00000001c0)=0x15) ioctl$TCSETS(r7, 0x40384708, &(0x7f0000000040)={0x4, 0x1, 0xe, 0x5, 0x11, "3e0000000100"}) chroot(0x0) 4m57.369679908s ago: executing program 1 (id=1209): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) fanotify_init(0x4, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x400001, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_pidfd_open(0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0xef) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc01c5869, &(0x7f0000000500)={r2, &(0x7f0000000240)='-{$%}\x88:@^d(*!\x00', 0x400800, &(0x7f0000000440)={@align=0x3, {0x2, 0x4, 0x1, 0x502}}, 0x6, &(0x7f0000000480)={@_ha_fsid}, &(0x7f00000004c0)=0xe}) openat(r3, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c1.1\x00', 0x2c02, 0x160) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/configs/c1.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r4 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) copy_file_range(r4, 0x0, r4, &(0x7f0000000080)=0x8800000, 0x1, 0x0) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/configs/c1.1/hid.usb0\x00') write(0xffffffffffffffff, &(0x7f0000001600)='dummy_udc.0', 0xb) unlink(&(0x7f0000000140)='./config/usb_gadget/g1/configs/c1.1/hid.usb0\x00') r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write(r5, &(0x7f0000000180)='transport=tcp,traddr=.27.0.0.1,trsvcid=4420,nqn=nqn.2014-08.org.nvmexpress:uu', 0x4d) openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) 4m57.305472058s ago: executing program 33 (id=1209): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) fanotify_init(0x4, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x400001, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_pidfd_open(0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0xef) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc01c5869, &(0x7f0000000500)={r2, &(0x7f0000000240)='-{$%}\x88:@^d(*!\x00', 0x400800, &(0x7f0000000440)={@align=0x3, {0x2, 0x4, 0x1, 0x502}}, 0x6, &(0x7f0000000480)={@_ha_fsid}, &(0x7f00000004c0)=0xe}) openat(r3, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c1.1\x00', 0x2c02, 0x160) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/configs/c1.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r4 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) copy_file_range(r4, 0x0, r4, &(0x7f0000000080)=0x8800000, 0x1, 0x0) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/configs/c1.1/hid.usb0\x00') write(0xffffffffffffffff, &(0x7f0000001600)='dummy_udc.0', 0xb) unlink(&(0x7f0000000140)='./config/usb_gadget/g1/configs/c1.1/hid.usb0\x00') r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write(r5, &(0x7f0000000180)='transport=tcp,traddr=.27.0.0.1,trsvcid=4420,nqn=nqn.2014-08.org.nvmexpress:uu', 0x4d) openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) 46.389502856s ago: executing program 3 (id=2653): mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x70bd2a, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x42, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x1, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x9, 0x0, 0x10000000, 0xfffffffe}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x24c4436d5a174b6d, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x4004000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) openat$comedi(0xffffff9c, &(0x7f0000003880)='/dev/comedi3\x00', 0x103000, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x2bd}, &(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080)) kexec_load(0x5, 0x3, &(0x7f0000001080), 0x3e0000) r5 = socket$netlink(0x10, 0x3, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg$nl_route_sched(r5, 0x0, 0x3000c81c) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x4e24, 0x6bb, @ipv4={'\x00', '\xff\xff', @local}, 0x5}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f0000000540), 0x3) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f00000004c0)=@gcm_256={{0x303, 0x3a}, "569142cc91061c00", "a8ef1a3a33071799b7bbebfa6dc371290d0e3808802000", "336819df", "4008000000008700"}, 0x38) write(r6, &(0x7f0000000040)="0400002d35556df668b03d33a4975b", 0xfde5) 43.789138834s ago: executing program 3 (id=2661): r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x94) mkdirat(r0, 0x0, 0x19c) r1 = add_key$keyring(&(0x7f0000000540), 0x0, 0x0, 0x0, 0xffffffffffffffff) rt_sigsuspend(0x0, 0x0) keyctl$invalidate(0x15, r1) mount(0x0, &(0x7f0000000040)='./sys\x00', 0x0, 0x0, 0x0) socket(0x27, 0x6, 0x40) bind$alg(r0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="140001800800010000000100050006"], 0x2c}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000800)=@bpf_lsm={0x8, 0x4, 0x0, &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x5, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_open_dev$dri(&(0x7f00000002c0), 0x66, 0x80400) ioctl$KVM_SET_VAPIC_ADDR(r6, 0x4008ae93, &(0x7f0000000040)=0x4) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000440)={[0x3ff, 0x3, 0x3, 0x7fffffffffffffff, 0x58f24867, 0x0, 0x7f, 0x2, 0x200009, 0x0, 0x6, 0xffffffffffffffff, 0x2, 0x4, 0x8, 0xffffffffffffffff], 0x54000, 0x19f204}) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x3, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed33226a8d1c8e17", 0x0, 0xb2}) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4400ae8f, &(0x7f0000000140)=@x86={0x7, 0xc, 0xc5, 0x0, 0x6, 0x9, 0x4, 0x6, 0x1, 0xf8, 0x0, 0x1, 0x0, 0x3, 0x439, 0x6, 0x9, 0x4, 0x8, '\x00', 0x4, 0x4}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="640100001900010000000000040000001d0100001500040001000080fe02000031171e44b2b50e8f040000001e010600f8"], 0x164}}, 0x0) r8 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0xc0001, 0x0) write$proc_mixer(r8, &(0x7f0000000580)=ANY=[@ANYBLOB="4d49430a494741494e202753796e74682043617074757265205377697460dcd8fdfbd1e7f120d2436368"], 0x3c) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000000300)={{@local, 0x31c}, @hyper, 0x0, 0x3ca, 0xea, 0x1000000, 0x6, 0x2, 0xb}) close(r8) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000240)={0x4, 0x0, [{0x2f9, 0x0, 0x7b}, {0x21e, 0x0, 0x7f}, {0xbb2, 0x0, 0xfffffffffffffff3}, {0x2c9, 0x0, 0x7fffffff}]}) 42.251986618s ago: executing program 3 (id=2667): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r4 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x6, 0x5, 0x4, 0x0, 0x8, 0xa5b4}}, {0x4}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x40001}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xc, 0x15, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x84, 0x0, 0x0, 0x0, 0x30000}, [@ringbuf_output={{0x18, 0x5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x15}}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x100}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, &(0x7f0000000580)=ANY=[@ANYBLOB="74f5026e733d76697274696f2c70726976706f72742c646972656374696f2c63616368653d6c6f6f73652c6d73697a653d307830303030303030303030303031303030"]) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x7, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x255fdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0x2, 0xb}, {0x1, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x2}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e1}, 0x4890) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r8, 0x0, 0x0, 0x4, &(0x7f0000000140)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @multicast}, 0x14) 41.82532691s ago: executing program 3 (id=2670): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x117) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x103090, 0x0) mount$bind(&(0x7f0000001900)='.\x00', &(0x7f0000000380)='./file0/file0\x00', 0x0, 0x2a05004, 0x0) umount2(&(0x7f0000000340)='./file0\x00', 0x1) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) fsync(r1) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newtfilter={0x44, 0x2c, 0xc3f, 0x70bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r3, {0x3, 0x2}, {}, {0x7, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8100}, @TCA_FLOWER_KEY_VLAN_ETH_TYPE={0x6, 0x19, 0x8864}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000810}, 0x20084084) 41.409082025s ago: executing program 3 (id=2673): openat$vimc1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_wakeup_irq', 0x80240, 0x31840384d1ba4a81) finit_module(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x4, 0x6}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000805000100070000000900020073797a30000000001400078008001240001500000500150000100000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}, 0x1, 0x0, 0x0, 0x24046850}, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x2099, 0x3, 0x20000006, 0x7ffffff9}, 0x10) memfd_create(&(0x7f0000000540)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\nh<\x99\xaa\xe1\xf3\xb8Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev<\x97\x1a2_\x82\xfa\x15h$\x01\xdd\xe5\xceC\x19\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xb2\xf5\x1e5.\xc1\xa1\x05\x92\x82d\x0e\xf5PMjIt\xc5u~Tw\xbeNg\xb5\xeeP\x9c\xce\xfaS\xa7\xec0\xf4\xd2\xc2+@\x12=\xaa\b\xd2&\x19k6\xc7\xa6+\x04V\xc3\xe1\xd3\fZZ\x1cJo\xa5(& \r\xf1\xa4\xb8\xc23\x16\xc3\xaejA/', 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r2, 0x3) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100"], 0x16) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f00000002c0)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000080), 0x208e24b) lseek(r4, 0x0, 0x4) 40.298729447s ago: executing program 3 (id=2678): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r4 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x6, 0x5, 0x4, 0x0, 0x8, 0xa5b4}}, {0x4}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x40001}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xc, 0x15, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x84, 0x0, 0x0, 0x0, 0x30000}, [@ringbuf_output={{0x18, 0x5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x15}}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x100}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, &(0x7f0000000580)=ANY=[@ANYBLOB="74f5026e733d76697274696f2c70726976706f72742c646972656374696f2c63616368653d6c6f6f73652c6d73697a653d307830303030303030303030303031303030"]) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x7, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x255fdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0x2, 0xb}, {0x1, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x2}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e1}, 0x4890) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r8, 0x0, 0x0, 0x4, &(0x7f0000000140)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @multicast}, 0x14) 39.397137139s ago: executing program 34 (id=2678): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r4 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x6, 0x5, 0x4, 0x0, 0x8, 0xa5b4}}, {0x4}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x40001}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xc, 0x15, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x84, 0x0, 0x0, 0x0, 0x30000}, [@ringbuf_output={{0x18, 0x5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x15}}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x100}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, &(0x7f0000000580)=ANY=[@ANYBLOB="74f5026e733d76697274696f2c70726976706f72742c646972656374696f2c63616368653d6c6f6f73652c6d73697a653d307830303030303030303030303031303030"]) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x7, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x255fdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0x2, 0xb}, {0x1, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x2}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e1}, 0x4890) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r8, 0x0, 0x0, 0x4, &(0x7f0000000140)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @multicast}, 0x14) 8.421896044s ago: executing program 2 (id=2785): pipe(&(0x7f0000000040)={0xffffffffffffffff}) io_setup(0x7f, &(0x7f0000000940)=0x0) io_submit(r1, 0xfdef, &(0x7f00000002c0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000080)="c3", 0x1}]) io_destroy(r1) 8.132028158s ago: executing program 5 (id=2787): move_pages(0x0, 0x5, &(0x7f00000001c0)=[&(0x7f0000d13000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000582000/0x2000)=nil, &(0x7f0000542000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil], 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) membarrier(0x10, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x4c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x2c, 0x2) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x9, 0x4c032, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000004700)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0xc011}, 0x24004014) openat$apparmor_thread_current(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='2', 0x1, 0x4fed0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="01002abd7000fedbdf252a75dc1436cba09b5cba832ed0960c217e6e04ead2872a780ab968518f06390a00000057d701823fd4d40153ec9b86ebdbdcca201e1e62a5ffadeca9c71f4315af20edac0ef8bc4a9cccb06af10b70eed6"], 0x14}, 0x1, 0x0, 0x0, 0x8805}, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r5, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00P3', @ANYRES16=r6, @ANYBLOB="00032bbd7000fcdbdf25770000000500ee00640000000800ef000e0000000500ee00800000000800ef000e0000000500ee00ff"], 0x3c}, 0x1, 0x0, 0x0, 0x810}, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f00000000c0)) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x2001, 0x0) pwrite64(r7, 0x0, 0x0, 0x6) pread64(r4, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) 8.059447065s ago: executing program 5 (id=2789): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfffd, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r2, &(0x7f0000002840)=[{{0x0, 0x0, 0x0}, 0xc}], 0x1, 0x60, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r2) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2) r4 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r4, &(0x7f0000000140)={0xc, &(0x7f0000000000)={0x0, 0x9, 0x8d, {0x8d, 0xb, "15ba50adb5753346ec4653b53f798f8fa72dc74f51ed972629450f5ab316c3357c840c5e89d0416d8b8c90cb8ae27c1436a749af06b8507f3dc2220f3313e4669a83b602d8f8307f0d9ba6a432b145b61cd280ab784e70535e140626c25d86ca7cb382dc3365f2b83895cfcf804c8adbbc0a602521c11a9865629fa73d3fbeca5fc54db2d3d6650bc02fb7"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2809}}}, &(0x7f0000000340)={0x18, &(0x7f0000000180)={0x0, 0x6, 0x8a, "fb2613a613ed6777d549763cb2de80695025e4d7877510a9d01d41a25398e2bef3d4f52c6496219312234979df6d131c081954d70bb0661b73cf6d9e15e999a04aba71cfe745319c797b41ff120d27b4d4d9544c9f7e641579d763d9dc8e63e977514956ef38817e727810bdee2e6cc5d308a3bcaa28c1cfbaca7b659df4953d252502632fba7364caf2"}, &(0x7f0000000240)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0x7}, &(0x7f00000002c0)={0xc0, 0x5, 0x6, "c6a4bbdc08d5"}, &(0x7f0000000300)={0x40, 0x5, 0x2, "a902"}}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$XFS_IOC_SCRUB_METADATA(r5, 0x40045b17, 0x0) 7.080863476s ago: executing program 2 (id=2791): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x800) fanotify_init(0x4, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c3"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0xfffffffffffffffc, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) r3 = mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x9c, 0x0, &(0x7f00000000c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x39, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fda={0x66646185, 0x7, 0x2, 0x38}, @flat=@binder={0x73622a85, 0x1, 0x3}, @fda={0x66646185, 0x9, 0x2, 0xa}}, &(0x7f0000000080)={0x0, 0x1c, 0x34}}}, @dead_binder_done, @dead_binder_done, @increfs_done, @free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x3}, @increfs_done={0x40106308, 0x3}, @enter_looper], 0xb5, 0x0, &(0x7f00000003c0)="391819a5aff962d65afe6ff45faa8af6b47fe75e8bc1faeb84c23f634512e00913521fb4756fd3420db5eae103507bc41f36a15045f09c89a9a960fb9c327b17536dbdbb44a86fad5859303b3bd79650621eb42c11d11e3af3665be7f488ef782fc2eecf5d910a90ee5e469d8bf61f4f244b4962647fe2b4736dbcad341602330e50e138e269cde0f645953940b4060a11f1a1d8ab8748d1b56b49907162431fd9a8791d5f31a21923e74265799ca952bed8167fa6"}) 5.900402064s ago: executing program 2 (id=2794): openat$vimc1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_wakeup_irq', 0x80240, 0x31840384d1ba4a81) finit_module(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x4, 0x6}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000805000100070000000900020073797a30000000001400078008001240001500000500150000100000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}, 0x1, 0x0, 0x0, 0x24046850}, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x2099, 0x3, 0x20000006, 0x7ffffff9}, 0x10) memfd_create(&(0x7f0000000540)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\nh<\x99\xaa\xe1\xf3\xb8Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev<\x97\x1a2_\x82\xfa\x15h$\x01\xdd\xe5\xceC\x19\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xb2\xf5\x1e5.\xc1\xa1\x05\x92\x82d\x0e\xf5PMjIt\xc5u~Tw\xbeNg\xb5\xeeP\x9c\xce\xfaS\xa7\xec0\xf4\xd2\xc2+@\x12=\xaa\b\xd2&\x19k6\xc7\xa6+\x04V\xc3\xe1\xd3\fZZ\x1cJo\xa5(& \r\xf1\xa4\xb8\xc23\x16\xc3\xaejA/', 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100"], 0x16) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 5.551761526s ago: executing program 2 (id=2796): socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, 0x0, 0x41) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) llistxattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)=""/63, 0x3f) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000240)=@req={0x3fc, 0x0, 0x0, 0x1}, 0x10) mkdir(&(0x7f0000000100)='mnt\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='devtmpfs\x00', &(0x7f0000000300)='mnt\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040a00e58684000010203010902270001010080320904000003ff000000070581024000000705020240000007058303"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000400)='mnt/ttyUSB0\x00', 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) capget(&(0x7f0000000040)={0x20071026}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r3) socket$nl_route(0x10, 0x3, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x288082, 0x52) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$SNDCTL_SYNTH_ID(r4, 0xc08c5114, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x48, &(0x7f0000000400)={0x0, 0xf20f, 0x40, 0x3, 0x1b}, 0x0, &(0x7f0000000200), 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) 4.514568026s ago: executing program 4 (id=2800): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r4 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x6, 0x5, 0x4, 0x0, 0x8, 0xa5b4}}, {0x4}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x40001}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xc, 0x15, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x84, 0x0, 0x0, 0x0, 0x30000}, [@ringbuf_output={{0x18, 0x5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x15}}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x100}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, &(0x7f0000000580)=ANY=[@ANYBLOB="74f5026e733d76697274696f2c70726976706f72742c646972656374696f2c63616368653d6c6f6f73652c6d73697a653d307830303030303030303030303031303030"]) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x7, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x255fdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0x2, 0xb}, {0x1, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x2}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e1}, 0x4890) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r8, &(0x7f00000002c0)="05031c3fd3fc141100004788031c", 0xe, 0x4, &(0x7f0000000140)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @multicast}, 0x14) 4.364070212s ago: executing program 6 (id=2801): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0186405, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCL_UNBLANKSCREEN(r1, 0x541c, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_ADD_RULE(r2, &(0x7f0000000d40)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000d00)={&(0x7f0000000d80)=ANY=[@ANYBLOB="24040000f303000228bd7000fedbdf2510000000000000002700000005000000080000000008000004000000ffffffff05000000040000000d0000000000010006000000ff7f00000000010008000000010000000100010009000000ba000000fcffffff000000000100000003000000c80000000800000000000000010000000100000003000000e0f4ffff4000000000040000fdffffff05000000080000000500000001000000ff0000000500000080ffffffff0300009600000002000000080000000300000068010000946d00001f0b0000080000000002000004000000ffffff7f0700000002000000030000008300000006000000070000001e0b00000300000007000000ffff0000260e0000ff0000000000000005000000030000001604000008000000000400000000008000000100ff0700000400000006000000010000000e000000050000005edcbe6106000000080000000500000000080000080000000600000001000000000b0000de940000feffffffc8000000faffffff5538000000000000000000000400000001000000f0070000f98effff0400000003000000ff000000040000000400000096a100000600000002000000ff7f0000020000005f860000100000000c000000080000000200000009000000ff000000580d00007f00000004000000000000a0ffffff7fff000000fdffffffff01000004000000000100000400000005000000050000000100000000000000935e2baa4d6b1d429f17cb39423203000000ffffff7f090000000000000005000000768700007400000008000000ff070000b97800000400000008000000040000000800000003000000000000000300000002000000310d00004e0d0000ffff000000040000040000007f0000007f000000ff00000004000000a7ffffff7a020000df6be75902000000ff0f07000000ff7f00009fff0000001000000900000020840000000000000f00000000000000020000000900000000001c00090000000900000000000080f8ffffff8efb000005000000fbffffff8600000007000000090000000600000005000000060000000b000000b300000000000000030000009761000002000000da00000002000000ff070000060000003d0c0000050000009a030000060000000100008009000000ff0100000100000007000000000000000400000004000000c5c100000300000020000000ae02000001000000040000000700000003000000010000000200000008000000030000009bf1000007000000810e0000836b000001000000ffff000000fcffff010000000400000002000000000800000e00000087000000fbffffff040000007ecd0000d6780000010000000100008009000000040000000100000003000000fe3ec6d1e6de5f7bda3e9be210d390000000000100000008000000040000000101000001000080610000d70e213134e69dd90aeea790557fb6bb67d9fab0c8655eba753be97a1a6c48c0691575b24e62095564f70d71d41e648d5e1f144a72b98962a06f15893c10a2991e35c1b180fba696e2a18700fabc003e52143c960244d59f1843756cedf0ec03e6d4d7689783d38ac0c036e63a88e41d7265c68978f803aa0ab27b8d"], 0x424}, 0x1, 0x0, 0x0, 0x4}, 0x4000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r3) keyctl$reject(0x13, 0x0, 0x20007, 0x4007, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) listen(r4, 0x0) chdir(&(0x7f0000000080)='./file0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', &(0x7f0000000140)={0x474082, 0x5c, 0x8}, 0x18) write$binfmt_elf64(r5, 0x0, 0x146) close(r5) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000040)='\x00', &(0x7f00000000c0)=')\x00', 0x0) 4.357348239s ago: executing program 4 (id=2802): r0 = openat$nvram(0xffffff9c, &(0x7f00000000c0), 0xc8841, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000140)={0x7, 0x7e, 0xc6c0, {0x2, 0x1}, 0xfff, 0x741c}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x7, &(0x7f0000000340)=ANY=[@ANYBLOB="850000001800ca00186600000a000000000000001df6ffffa486020004000000184a0000fbffffff0000000700000000c4a9c03808000000930bd7055f903b80a75ed8e213dd7c54c355e63b49e409fa78cc606f006624bad6648059c180d6c6d4bde04010befc224022756cdeddf9c6fba7a9f2cb49e696c082c02699eab5eba5d9346ae3bcda652909a421eb331e8f6440249db71a0dbaee0a4674c6b479a854d1c5087aa5243cd8f96c4f89ec8ca15555485a1fc2c78984403e258b62f0f1190a42c2875477d7396421a0bfc643c7ab9c40d0f7252d69a92a99fb864f33ca729669"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) socket$kcm(0x21, 0x7, 0x2) r2 = socket$packet(0x11, 0x2, 0x300) close(r2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) socket$key(0xf, 0x3, 0x2) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0xb3b54c18e0590239, 0x0, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x40000, 0x2, 0x158}, 0x0, &(0x7f0000000280), &(0x7f0000000140)) ioctl$MON_IOCX_MFETCH(0xffffffffffffffff, 0xc00c9207, 0x0) mount(0x0, 0x0, &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000140), 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r4) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @empty}, 0x1c) sendto$inet6(r5, &(0x7f0000000180)="1a", 0x1, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r5, &(0x7f0000000c80)="7cffa9061b2f8b082b6f69ae50430c8a8b6aa3162ba083c4a52e1ab0ac50ed4a19b1a69988000d5bed4433daaa4932dbb1cb3550dee8b23579d76ce37d574b43fca1eed8ebd38d1303240ed0d84517692128dd5aef5c4d60a6659952a1437c6f0ac3ed75806011ccbaa504f41a7e0abcf8823bc4a71ef8c52c2b297b539eaf752c56ebfe9b0542543069257dafcbf76c958d4cbf4eaaa67c5c2bd9e6518be34b56add7613ab83d389724b664e62c154e1a5aac073a53a0e8cadcf51ef495ebbcc77d5e36ff24c3f282289cc077374b714e08fbfecbdc8f14ef3fd409af4caf6fcb7d663beab335f239a1e93b399c93d7c036e1b39a7c477945f82b6dde53b1c21b590a58ba688ac4fb530d2c5b1195a127d2eaec840ab59f090d7047c278611e080cebe7b28588c11a44be99fe6f88c73441bf625b70565669997f4c3cda5afe1d6429908a69a459d35ba8c2f28076d8711f2667de749a783fac94ebd02680f20fb723c35c287a1f45064846385750665ffa74579083fbb1b1d6b7c90168252b1c5313544569203e7adb8e271a94f7413e5cfd6aa3157c4fc29bddba3683fcd032aecb513b2f27530fbefa0000000000000003c058e812d8db87de5e3eceae268b91f7d59daf77646fa4df99877dd5a9540934c7af91b96486eea62897be6acbe1bae8e46b112f1385e7cea9e4daccc6f1b98ce3b4322af8299a45ddcb5be8d3e469fdde9896ca324a2f3c88c616a7dccde331698ce2d39f96220251011b4dfbec953b5c30e94adb5586cec0af234859805bb7df1101ae80318ff127e913178d79cfa918d54585b6184255e872e2dc33a5c7c30a756bbd63c32a3e6a22863781747d185acb64583976c4289394d642b07d18e2932d0a78bd2ccf92b3e94e82f1e9239fa272402f4c9efcf068709a44d6f652a4f23df89f9a15e6bf0c7e65d8f3e32c35e83d30298074d16cb5ff4ded1df81009bbae888fceb9a8109ba319605e1776e52d2069b5cd7de07cf8dc488ba6a9c7559ff49674a490991f323736f302004007d0ccf2e5eaceac6b56f48f2b00592d7a378f118d8b3e5ecd2035c8252374c91bc79cf26ac11ddffe2c09e1aa032da0713732387f950e3f4e301eb1d26e5a2b19318e50d555c832e279894d8c9b03e8940738c0fe391b29907d0d5f9214d6e697a19247f4e8221aca2ac47debd7c45b8344941cbecbaf44af343b24a4f88caf207d72002fb8b7d156997cb7275f535e6a9d6480046246e60bea0cf6f54abc69ff9418b6cb9301eb6890227215b633a886fb13c89698e51e482c42ca99613b20e22e5ce15272f5bda8b18cf53d49130a94135dd8a9692c", 0x34000, 0xbcff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='127.0.0.1:12345:/\x00', &(0x7f0000000100)='./mnt\x00', &(0x7f0000000200)='ceph\x00', 0x0, &(0x7f0000000300)='mount_timeout=0\x00') bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="0000000000000000000051229dc9", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.898835356s ago: executing program 5 (id=2803): r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') syz_genetlink_get_family_id$nfc(&(0x7f0000000480), 0xffffffffffffffff) bind$inet(r2, 0x0, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r3, 0x6, 0x1, &(0x7f0000019080)={0x0, 0x354, 0xf2, 0x9, 0xe1, 0x1, 0xc}, 0xc) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="ac0000000206010200000000000000000000000305000500000000005c0007801800028014000240fe8000000000000000000000005ded8e184469edbe50323df6c8130000bb08000a40000000741800028014000240fc020000000000000000000000000001080009400000000f0500140009000000050015000400000005001500080000000900020073797a3200000000050004000000000015000300686173683a69702c706f72742c6e"], 0xac}, 0x1, 0x0, 0x0, 0x840}, 0x0) sendmsg$NFC_CMD_FW_DOWNLOAD(0xffffffffffffffff, &(0x7f0000019100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, 0x0}, 0x4004) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec02010902"], 0x0) sendmsg$nl_generic(r0, 0x0, 0xc000) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x20a02, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000061100000000000001d400500000000004704000001ed00000f030000000000001d44000000000000620a5cfe000000007203000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e4b2b9275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf138f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87acbeb48949b63b045313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65039cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x40801, 0x0) ioctl$TIOCSSOFTCAR(r5, 0x5453, 0x0) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x8, 0x3, 0x0, @random="58ec07e4203a"}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) 3.427641669s ago: executing program 6 (id=2804): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x20a02, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x5453, 0x0) 2.687873801s ago: executing program 6 (id=2805): openat$vimc1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_wakeup_irq', 0x80240, 0x31840384d1ba4a81) finit_module(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x4, 0x6}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000805000100070000000900020073797a30000000001400078008001240001500000500150000100000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}, 0x1, 0x0, 0x0, 0x24046850}, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x2099, 0x3, 0x20000006, 0x7ffffff9}, 0x10) memfd_create(&(0x7f0000000540)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\nh<\x99\xaa\xe1\xf3\xb8Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev<\x97\x1a2_\x82\xfa\x15h$\x01\xdd\xe5\xceC\x19\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xb2\xf5\x1e5.\xc1\xa1\x05\x92\x82d\x0e\xf5PMjIt\xc5u~Tw\xbeNg\xb5\xeeP\x9c\xce\xfaS\xa7\xec0\xf4\xd2\xc2+@\x12=\xaa\b\xd2&\x19k6\xc7\xa6+\x04V\xc3\xe1\xd3\fZZ\x1cJo\xa5(& \r\xf1\xa4\xb8\xc23\x16\xc3\xaejA/', 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(0xffffffffffffffff, 0x3) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100"], 0x16) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 2.309512245s ago: executing program 2 (id=2806): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r4 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x6, 0x5, 0x4, 0x0, 0x8, 0xa5b4}}, {0x4}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x40001}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xc, 0x15, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x84, 0x0, 0x0, 0x0, 0x30000}, [@ringbuf_output={{0x18, 0x5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x15}}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x100}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, &(0x7f0000000580)=ANY=[@ANYBLOB="74f5026e733d76697274696f2c70726976706f72742c646972656374696f2c63616368653d6c6f6f73652c6d73697a653d307830303030303030303030303031303030"]) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x7, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x255fdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0x2, 0xb}, {0x1, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x2}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e1}, 0x4890) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r8, &(0x7f00000002c0)="05031c3fd3fc141100004788031c0910", 0x10, 0x4, &(0x7f0000000140)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.995136832s ago: executing program 4 (id=2807): move_pages(0x0, 0x5, &(0x7f00000001c0)=[&(0x7f0000d13000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000582000/0x2000)=nil, &(0x7f0000542000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil], 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) membarrier(0x10, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x4c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x2c, 0x2) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x9, 0x4c032, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000004700)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0xc011}, 0x24004014) openat$apparmor_thread_current(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='2', 0x1, 0x4fed0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="01002abd7000fedbdf252a75dc1436cba09b5cba832ed0960c217e6e04ead2872a780ab968518f06390a00000057d701823fd4d40153ec9b86ebdbdcca201e1e62a5ffadeca9c71f4315af20edac0ef8bc4a9cccb06af10b70eed6"], 0x14}, 0x1, 0x0, 0x0, 0x8805}, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r5, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00P3', @ANYRES16=r6, @ANYBLOB="00032bbd7000fcdbdf25770000000500ee00640000000800ef000e0000000500ee00800000000800ef000e0000000500ee00ff0000"], 0x3c}, 0x1, 0x0, 0x0, 0x810}, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f00000000c0)) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x2001, 0x0) pwrite64(r7, 0x0, 0x0, 0x6) pread64(r4, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) 1.837034948s ago: executing program 6 (id=2808): mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x100) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[], &(0x7f0000000180), 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0xf2) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x14d802, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x402c5839, &(0x7f0000000080)={0x0, 0x1, 0x4e2c, 0x8000000009a87}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x158) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}]}) setxattr$trusted_overlay_origin(&(0x7f0000000040)='./file0/file1\x00', &(0x7f0000000100), 0x0, 0x0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='0000:00:03.0\x00', 0xd) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='pch_udc\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/pch_udc/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='0000:00:03.0\x00', 0xd) close(r3) openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/pci/devices/0000:00:03.0/driver\x00', 0x0, 0x0) signalfd(r0, &(0x7f0000000180)={[0x0, 0x7]}, 0x8) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='nfs4\x00', 0x0, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', &(0x7f0000000b80), 0x1804008, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 1.782520608s ago: executing program 4 (id=2809): openat$vimc1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_wakeup_irq', 0x80240, 0x31840384d1ba4a81) finit_module(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x4, 0x6}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000805000100070000000900020073797a30000000001400078008001240001500000500150000100000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}, 0x1, 0x0, 0x0, 0x24046850}, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x2099, 0x3, 0x20000006, 0x7ffffff9}, 0x10) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r2, 0x3) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100"], 0x16) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f00000002c0)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) 1.742799105s ago: executing program 2 (id=2810): syz_usb_connect(0x0, 0xb9, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280), 0x24002, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000380)={0x0, @in6={{0xa, 0x4e21, 0xfffffff3, @mcast2, 0x8}}, 0xffffffff, 0x9, 0x0, 0x1, 0x2e, 0xffffc7c5, 0xf}, &(0x7f0000000440)=0x9c) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000480)=@sack_info={r3, 0x2, 0x4}, 0xc) sendfile(r0, r1, 0x0, 0xfffe82) mkdir(&(0x7f0000000180)='./sys_mount\x00', 0x1ff) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_FIOSETOWN(r4, 0x8901, &(0x7f0000000040)=r5) ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f0000000580)) mount(0x0, &(0x7f00000000c0)='./sys_mount\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) chdir(&(0x7f0000000140)='./file1\x00') r6 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys_mount/block/nullb0/queue/scheduler\x00', 0x2, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r7 = socket$inet6(0xa, 0x3, 0x2) setsockopt$inet6_buf(r7, 0x29, 0x39, &(0x7f00000001c0)="002204ffa4ffffebfffffffeffffff0706000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) r8 = syz_create_resource$binfmt(0x0) openat$binfmt(0xffffffffffffff9c, r8, 0x42, 0x1ff) write(r6, &(0x7f0000000200)='bfq', 0x3) r9 = open(&(0x7f00000001c0)='./file0/file0\x00', 0x1802, 0x40) ioctl$KVM_CAP_X86_USER_SPACE_MSR(0xffffffffffffffff, 0x4068aea3, &(0x7f00000004c0)={0xbc, 0x0, 0x6}) ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f0000000000)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r9, 0xc010640b, &(0x7f0000000080)={r10}) r11 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) r12 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendfile(r11, r12, 0x0, 0xfffe82) 1.569707283s ago: executing program 6 (id=2811): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x800) fanotify_init(0x4, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c30000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0xfffffffffffffffc, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) r3 = mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x9c, 0x0, &(0x7f00000000c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x39, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fda={0x66646185, 0x7, 0x2, 0x38}, @flat=@binder={0x73622a85, 0x1, 0x3}, @fda={0x66646185, 0x9, 0x2, 0xa}}, &(0x7f0000000080)={0x0, 0x1c, 0x34}}}, @dead_binder_done, @dead_binder_done, @increfs_done, @free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x3}, @increfs_done={0x40106308, 0x3}, @enter_looper], 0xb5, 0x0, &(0x7f00000003c0)="391819a5aff962d65afe6ff45faa8af6b47fe75e8bc1faeb84c23f634512e00913521fb4756fd3420db5eae103507bc41f36a15045f09c89a9a960fb9c327b17536dbdbb44a86fad5859303b3bd79650621eb42c11d11e3af3665be7f488ef782fc2eecf5d910a90ee5e469d8bf61f4f244b4962647fe2b4736dbcad341602330e50e138e269cde0f645953940b4060a11f1a1d8ab8748d1b56b49907162431fd9a8791d5f31a21923e74265799ca952bed8167fa6"}) 1.564987754s ago: executing program 4 (id=2812): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) r0 = accept4(0xffffffffffffffff, &(0x7f0000000380)=@vsock={0x28, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x80800) sendmsg$OSF_MSG_REMOVE(r0, &(0x7f0000000980)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000940)={&(0x7f0000000480)={0x4bc, 0x1, 0x5, 0x101, 0x0, 0x0, {0x7, 0x0, 0x1}, [{{0x254, 0x1, {{0x0, 0x7fffffff}, 0x2, 0x31, 0x1, 0x1, 0x6, 'syz0\x00', "3f3dc8de89a0fdd75584f7853c2ccba43675a00469b4e9ce561e2a5f6ee7842b", "ffbe46cc321af43e4f5809f086de62956e094a46b9b2c217b30674e842755360", [{0x167c, 0x0, {0x2, 0x6}}, {0xfffd, 0x100, {0x3, 0x8001}}, {0x8000, 0xe6d5, {0x3, 0x9}}, {0x32a1, 0x1, {0x1, 0x7}}, {0x7, 0x1000, {0x3, 0xfffffff9}}, {0x4, 0x81, {0x3, 0x5}}, {0x7ff, 0xf, {0x2, 0x8}}, {0x401, 0xe229, {0x0, 0x483}}, {0x1, 0x9, {0x2, 0x2}}, {0x401, 0xfffb, {0x3, 0x8}}, {0x1000, 0x24}, {0x8, 0x7, {0x2, 0x3}}, {0xb, 0x0, {0x2, 0x8000}}, {0x3ff, 0x7, {0x3, 0xa91}}, {0x28, 0x2, {0x0, 0x78d}}, {0x4, 0xa, {0x0, 0xa5}}, {0x5, 0x9, {0x0, 0xb7}}, {0x3, 0x1ff, {0x1, 0x401}}, {0x3, 0x2, {0x1, 0x5}}, {0xce27, 0x8}, {0x4, 0x9, {0x2, 0xfffffffc}}, {0x5c00, 0x2, {0x3, 0x4}}, {0x1000, 0x76f, {0x1, 0x81}}, {0x9, 0x401, {0x0, 0x5}}, {0x3, 0xa, {0x1, 0x2}}, {0xfff9, 0xfe78, {0x3, 0x1dde}}, {0x2b8, 0x4, {0x1, 0xcf}}, {0x8, 0x2, {0x1, 0x411}}, {0x6, 0xc, {0x2, 0x9}}, {0x3, 0x5, {0x0, 0x10000}}, {0x6, 0x6, {0x3, 0xb83}}, {0x6, 0x9, {0x2, 0x9}}, {0xef8e, 0xfffb, {0x1, 0xffff}}, {0x6, 0xd519, {0x3}}, {0x1, 0x8, {0x1, 0x4}}, {0x2, 0x6, {0x0, 0x80}}, {0x5, 0x1, {0x1, 0x969}}, {0x7, 0x9, {0x3, 0x4}}, {0xf, 0xe0b, {0x0, 0x8b}}, {0x5, 0xaa3c, {0x0, 0x2}}]}}}, {{0x254, 0x1, {{0x2, 0x2}, 0x3, 0x9, 0x4, 0x8, 0x27, 'syz0\x00', "2cbd8ff7ee1f79bc8e4e947da3c620ffca3cd9c6c84193d0327c360a6fc86a45", "ecb24079b306a40d31f6c009bd7b2576fbfd36c5a259952ac1e5f28f414cef29", [{0x4, 0x2, {0x0, 0x2}}, {0x7ff, 0x5, {0x0, 0x66}}, {0x8, 0x9, {0x1, 0x6}}, {0x2, 0x8001, {0x1, 0x1}}, {0x53, 0x9, {0x3, 0x7f}}, {0x238, 0x8, {0x3, 0x5}}, {0x8, 0x9, {0x0, 0x5}}, {0xffff, 0x7fff, {0x0, 0x2}}, {0x50c, 0xfcd, {0x2, 0xffffff33}}, {0x1, 0x4, {0x3, 0x7}}, {0xf01, 0x0, {0x0, 0x9}}, {0x1, 0x1, {0x3, 0x9}}, {0x2, 0x81, {0x3}}, {0x9, 0x6e, {0x2, 0x6}}, {0x80, 0x1, {0x2, 0x7}}, {0xf, 0x1, {0x2, 0x6}}, {0x4, 0x4, {0x2, 0x5}}, {0xfff9, 0x9, {0x3, 0x1}}, {0x5d21, 0x1e88, {0x2, 0x3}}, {0xbc15, 0x6, {0x3, 0xfffffffc}}, {0x3d04, 0x8, {0x3, 0x8000}}, {0x14, 0x40, {0x0, 0x48}}, {0xed8, 0xc, {0x0, 0x8}}, {0xfffb, 0x7}, {0x6, 0x3ff, {0x1, 0x6}}, {0x3, 0x7, {0x3, 0xfffffffc}}, {0x1, 0x0, {0x3, 0x62b728b2}}, {0x2, 0x4, {0x3, 0x71fe}}, {0x8, 0x7, {0x1, 0xe814}}, {0x8, 0x4, {0x1, 0x8e}}, {0x6, 0x2, {0x1, 0x7fff}}, {0x0, 0x200, {0x1, 0xffff0000}}, {0xfffa, 0x0, {0x3, 0x858}}, {0x9, 0x8001, {0x1, 0x7}}, {0x0, 0x3, {0x1, 0x7}}, {0x9, 0xcfb, {0x3, 0x3341ce0a}}, {0x6, 0x73, {0x0, 0xf}}, {0x79, 0x482, {0x3, 0xe1c}}, {0x4, 0x5, {0x0, 0x3}}, {0x24, 0x5, {0x3, 0x6}}]}}}]}, 0x4bc}, 0x1, 0x0, 0x0, 0x880}, 0x20004085) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x58, 0x1, 0x4, 0x201, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0xa6}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x1000}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0xf2b}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x5}, @NFULA_CFG_MODE={0xa, 0x2, {0x7ff, 0x2}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x9b141d1}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000080}, 0x4000) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0x88) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r3, 0xc01064b3, &(0x7f00000001c0)) syz_emit_ethernet(0x4a, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f00000000c0)='./file0/../file0\x00') mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x2acd0da, 0x0) pivot_root(0x0, &(0x7f0000000240)='./file0/../file0\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000100010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000000000000000010000000900020073797a32000000000900"], 0xec}, 0x1, 0x0, 0x0, 0x24004005}, 0x20004004) getdents64(r2, &(0x7f0000000000)=""/134, 0x86) 1.111838839s ago: executing program 5 (id=2813): r0 = openat$nvram(0xffffff9c, &(0x7f00000000c0), 0xc8841, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000140)={0x7, 0x7e, 0xc6c0, {0x2, 0x1}, 0xfff, 0x741c}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x7, &(0x7f0000000340)=ANY=[@ANYBLOB="850000001800ca00186600000a000000000000001df6ffffa486020004000000184a0000fbffffff0000000700000000c4a9c03808000000930bd7055f903b80a75ed8e213dd7c54c355e63b49e409fa78cc606f006624bad6648059c180d6c6d4bde04010befc224022756cdeddf9c6fba7a9f2cb49e696c082c02699eab5eba5d9346ae3bcda652909a421eb331e8f6440249db71a0dbaee0a4674c6b479a854d1c5087aa5243cd8f96c4f89ec8ca15555485a1fc2c78984403e258b62f0f1190a42c2875477d7396421a0bfc643c7ab9c40d0f7252d69a92a99fb864f33ca729669"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) socket$kcm(0x21, 0x7, 0x2) r2 = socket$packet(0x11, 0x2, 0x300) close(r2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) socket$key(0xf, 0x3, 0x2) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0xb3b54c18e0590239, 0x0, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x40000, 0x2, 0x158}, 0x0, &(0x7f0000000280), &(0x7f0000000140)) ioctl$MON_IOCX_MFETCH(0xffffffffffffffff, 0xc00c9207, 0x0) mount(0x0, 0x0, &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000140), 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r4) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @empty}, 0x1c) sendto$inet6(r5, &(0x7f0000000180)="1a", 0x1, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r5, &(0x7f0000000c80)="7cffa9061b2f8b082b6f69ae50430c8a8b6aa3162ba083c4a52e1ab0ac50ed4a19b1a69988000d5bed4433daaa4932dbb1cb3550dee8b23579d76ce37d574b43fca1eed8ebd38d1303240ed0d84517692128dd5aef5c4d60a6659952a1437c6f0ac3ed75806011ccbaa504f41a7e0abcf8823bc4a71ef8c52c2b297b539eaf752c56ebfe9b0542543069257dafcbf76c958d4cbf4eaaa67c5c2bd9e6518be34b56add7613ab83d389724b664e62c154e1a5aac073a53a0e8cadcf51ef495ebbcc77d5e36ff24c3f282289cc077374b714e08fbfecbdc8f14ef3fd409af4caf6fcb7d663beab335f239a1e93b399c93d7c036e1b39a7c477945f82b6dde53b1c21b590a58ba688ac4fb530d2c5b1195a127d2eaec840ab59f090d7047c278611e080cebe7b28588c11a44be99fe6f88c73441bf625b70565669997f4c3cda5afe1d6429908a69a459d35ba8c2f28076d8711f2667de749a783fac94ebd02680f20fb723c35c287a1f45064846385750665ffa74579083fbb1b1d6b7c90168252b1c5313544569203e7adb8e271a94f7413e5cfd6aa3157c4fc29bddba3683fcd032aecb513b2f27530fbefa0000000000000003c058e812d8db87de5e3eceae268b91f7d59daf77646fa4df99877dd5a9540934c7af91b96486eea62897be6acbe1bae8e46b112f1385e7cea9e4daccc6f1b98ce3b4322af8299a45ddcb5be8d3e469fdde9896ca324a2f3c88c616a7dccde331698ce2d39f96220251011b4dfbec953b5c30e94adb5586cec0af234859805bb7df1101ae80318ff127e913178d79cfa918d54585b6184255e872e2dc33a5c7c30a756bbd63c32a3e6a22863781747d185acb64583976c4289394d642b07d18e2932d0a78bd2ccf92b3e94e82f1e9239fa272402f4c9efcf068709a44d6f652a4f23df89f9a15e6bf0c7e65d8f3e32c35e83d30298074d16cb5ff4ded1df81009bbae888fceb9a8109ba319605e1776e52d2069b5cd7de07cf8dc488ba6a9c7559ff49674a490991f323736f302004007d0ccf2e5eaceac6b56f48f2b00592d7a378f118d8b3e5ecd2035c8252374c91bc79cf26ac11ddffe2c09e1aa032da0713732387f950e3f4e301eb1d26e5a2b19318e50d555c832e279894d8c9b03e8940738c0fe391b29907d0d5f9214d6e697a19247f4e8221aca2ac47debd7c45b8344941cbecbaf44af343b24a4f88caf207d72002fb8b7d156997cb7275f535e6a9d6480046246e60bea0cf6f54abc69ff9418b6cb9301eb6890227215b633a886fb13c89698e51e482c42ca99613b20e22e5ce15272f5bda8b18cf53d49130a94135dd8a9692c", 0x34000, 0xbcff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='127.0.0.1:12345:/\x00', &(0x7f0000000100)='./mnt\x00', &(0x7f0000000200)='ceph\x00', 0x0, &(0x7f0000000300)='mount_timeout=0\x00') bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="0000000000000000000051229dc9", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 432.534242ms ago: executing program 6 (id=2814): socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, 0x0, 0x41) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) llistxattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)=""/63, 0x3f) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000240)=@req={0x3fc, 0x0, 0x0, 0x1}, 0x10) mkdir(&(0x7f0000000100)='mnt\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='devtmpfs\x00', &(0x7f0000000300)='mnt\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040a00e58684000010203010902270001010080320904000003ff000000070581024000000705020240000007058303"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000400)='mnt/ttyUSB0\x00', 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) capget(&(0x7f0000000040)={0x20071026}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r3) socket$nl_route(0x10, 0x3, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x288082, 0x52) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$SNDCTL_SYNTH_ID(r4, 0xc08c5114, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x48, &(0x7f0000000400)={0x0, 0xf20f, 0x40, 0x3, 0x1b}, 0x0, &(0x7f0000000200), 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) 380.699349ms ago: executing program 4 (id=2815): socket(0x40000000015, 0x5, 0x0) setxattr$incfs_metadata(0x0, 0x0, 0x0, 0x0, 0x1) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) chdir(0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x100000e, 0x66032, 0xffffffffffffffff, 0x40000000) get_mempolicy(0x0, 0x0, 0x6, &(0x7f0000006000/0x2000)=nil, 0x3) 217.256101ms ago: executing program 5 (id=2816): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r4 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x6, 0x5, 0x4, 0x0, 0x8, 0xa5b4}}, {0x4}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x40001}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xc, 0x15, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x84, 0x0, 0x0, 0x0, 0x30000}, [@ringbuf_output={{0x18, 0x5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x15}}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x100}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, &(0x7f0000000580)=ANY=[@ANYBLOB="74f5026e733d76697274696f2c70726976706f72742c646972656374696f2c63616368653d6c6f6f73652c6d73697a653d307830303030303030303030303031303030"]) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x7, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x255fdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0x2, 0xb}, {0x1, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x2}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e1}, 0x4890) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r8, &(0x7f00000002c0)="05031c3fd3fc141100004788031c09102c", 0x11, 0x4, &(0x7f0000000140)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @multicast}, 0x14) 0s ago: executing program 5 (id=2817): r0 = openat$nvram(0xffffff9c, &(0x7f00000000c0), 0xc8841, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000140)={0x7, 0x7e, 0xc6c0, {0x2, 0x1}, 0xfff, 0x741c}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x7, &(0x7f0000000340)=ANY=[@ANYBLOB="850000001800ca00186600000a000000000000001df6ffffa486020004000000184a0000fbffffff0000000700000000c4a9c03808000000930bd7055f903b80a75ed8e213dd7c54c355e63b49e409fa78cc606f006624bad6648059c180d6c6d4bde04010befc224022756cdeddf9c6fba7a9f2cb49e696c082c02699eab5eba5d9346ae3bcda652909a421eb331e8f6440249db71a0dbaee0a4674c6b479a854d1c5087aa5243cd8f96c4f89ec8ca15555485a1fc2c78984403e258b62f0f1190a42c2875477d7396421a0bfc643c7ab9c40d0f7252d69a92a99fb864f33ca729669"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) socket$kcm(0x21, 0x7, 0x2) r2 = socket$packet(0x11, 0x2, 0x300) close(r2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={0x0, 0x10}}, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0xb3b54c18e0590239, 0x0, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x40000, 0x2, 0x158}, 0x0, &(0x7f0000000280), &(0x7f0000000140)) ioctl$MON_IOCX_MFETCH(0xffffffffffffffff, 0xc00c9207, 0x0) mount(0x0, 0x0, &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000140), 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r4) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @empty}, 0x1c) sendto$inet6(r5, &(0x7f0000000180)="1a", 0x1, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r5, &(0x7f0000000c80)="7cffa9061b2f8b082b6f69ae50430c8a8b6aa3162ba083c4a52e1ab0ac50ed4a19b1a69988000d5bed4433daaa4932dbb1cb3550dee8b23579d76ce37d574b43fca1eed8ebd38d1303240ed0d84517692128dd5aef5c4d60a6659952a1437c6f0ac3ed75806011ccbaa504f41a7e0abcf8823bc4a71ef8c52c2b297b539eaf752c56ebfe9b0542543069257dafcbf76c958d4cbf4eaaa67c5c2bd9e6518be34b56add7613ab83d389724b664e62c154e1a5aac073a53a0e8cadcf51ef495ebbcc77d5e36ff24c3f282289cc077374b714e08fbfecbdc8f14ef3fd409af4caf6fcb7d663beab335f239a1e93b399c93d7c036e1b39a7c477945f82b6dde53b1c21b590a58ba688ac4fb530d2c5b1195a127d2eaec840ab59f090d7047c278611e080cebe7b28588c11a44be99fe6f88c73441bf625b70565669997f4c3cda5afe1d6429908a69a459d35ba8c2f28076d8711f2667de749a783fac94ebd02680f20fb723c35c287a1f45064846385750665ffa74579083fbb1b1d6b7c90168252b1c5313544569203e7adb8e271a94f7413e5cfd6aa3157c4fc29bddba3683fcd032aecb513b2f27530fbefa0000000000000003c058e812d8db87de5e3eceae268b91f7d59daf77646fa4df99877dd5a9540934c7af91b96486eea62897be6acbe1bae8e46b112f1385e7cea9e4daccc6f1b98ce3b4322af8299a45ddcb5be8d3e469fdde9896ca324a2f3c88c616a7dccde331698ce2d39f96220251011b4dfbec953b5c30e94adb5586cec0af234859805bb7df1101ae80318ff127e913178d79cfa918d54585b6184255e872e2dc33a5c7c30a756bbd63c32a3e6a22863781747d185acb64583976c4289394d642b07d18e2932d0a78bd2ccf92b3e94e82f1e9239fa272402f4c9efcf068709a44d6f652a4f23df89f9a15e6bf0c7e65d8f3e32c35e83d30298074d16cb5ff4ded1df81009bbae888fceb9a8109ba319605e1776e52d2069b5cd7de07cf8dc488ba6a9c7559ff49674a490991f323736f302004007d0ccf2e5eaceac6b56f48f2b00592d7a378f118d8b3e5ecd2035c8252374c91bc79cf26ac11ddffe2c09e1aa032da0713732387f950e3f4e301eb1d26e5a2b19318e50d555c832e279894d8c9b03e8940738c0fe391b29907d0d5f9214d6e697a19247f4e8221aca2ac47debd7c45b8344941cbecbaf44af343b24a4f88caf207d72002fb8b7d156997cb7275f535e6a9d6480046246e60bea0cf6f54abc69ff9418b6cb9301eb6890227215b633a886fb13c89698e51e482c42ca99613b20e22e5ce15272f5bda8b18cf53d49130a94135dd8a9692c", 0x34000, 0xbcff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='127.0.0.1:12345:/\x00', &(0x7f0000000100)='./mnt\x00', &(0x7f0000000200)='ceph\x00', 0x0, &(0x7f0000000300)='mount_timeout=0\x00') bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="0000000000000000000051229dc9", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) kernel console output (not intermixed with test programs): e: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 567.751428][T14482] Call Trace: [ 567.751436][T14482] [ 567.751444][T14482] dump_stack_lvl+0x100/0x190 [ 567.751474][T14482] should_fail_ex.cold+0x5/0xa [ 567.751497][T14482] should_failslab+0xc2/0x120 [ 567.751525][T14482] kmem_cache_alloc_noprof+0x91/0x6a0 [ 567.751551][T14482] ? do_getname+0x35/0x390 [ 567.751580][T14482] do_getname+0x35/0x390 [ 567.751606][T14482] do_sys_openat2+0xc7/0x1e0 [ 567.751632][T14482] ? __pfx_do_sys_openat2+0x10/0x10 [ 567.751659][T14482] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 567.751693][T14482] __ia32_compat_sys_openat+0x12d/0x210 [ 567.751726][T14482] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 567.751751][T14482] ? fput+0x79/0x100 [ 567.751772][T14482] ? ksys_write+0x1ac/0x250 [ 567.751791][T14482] ? __pfx_ksys_write+0x10/0x10 [ 567.751815][T14482] __do_fast_syscall_32+0xe7/0x970 [ 567.751841][T14482] ? lockdep_hardirqs_on+0x78/0x100 [ 567.751868][T14482] do_fast_syscall_32+0x32/0x70 [ 567.751895][T14482] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 567.751918][T14482] RIP: 0023:0xf7f07fec [ 567.751943][T14482] Code: Unable to access opcode bytes at 0xf7f07fc2. [ 567.751954][T14482] RSP: 002b:00000000f53a550c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 567.751972][T14482] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000400 [ 567.751984][T14482] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 567.751996][T14482] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 567.752006][T14482] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 567.752017][T14482] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 567.752043][T14482] [ 567.927427][ T24] usb 9-1: new high-speed USB device number 43 using dummy_hcd [ 568.036062][ T10] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 568.107263][ T24] usb 9-1: Using ep0 maxpacket: 16 [ 568.111937][ T24] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 568.119961][ T24] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 568.126394][ T24] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 568.134783][ T24] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 568.141930][ T24] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 568.148884][ T24] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 568.154132][ T24] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 568.161678][ T24] usb 9-1: Manufacturer: syz [ 568.169126][ T24] usb 9-1: config 0 descriptor?? [ 568.325041][T14508] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 568.378668][T14503] ceph: No mds server is up or the cluster is laggy [ 568.446611][ T24] rc_core: IR keymap rc-hauppauge not found [ 568.449635][ T24] Registered IR keymap rc-empty [ 568.455286][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 568.489764][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 568.509260][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 568.516852][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input107 [ 568.527023][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 568.548191][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 568.567558][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 568.587287][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 568.589705][T14502] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2370'. [ 568.608378][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 568.622503][T14502] bond24: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 568.627408][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 568.630504][T14502] bond24 (unregistering): Released all slaves [ 568.647735][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 568.667959][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 568.689000][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 568.717388][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 568.738202][ T24] mceusb 9-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 568.741918][ T24] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 568.747755][ T24] usb 9-1: USB disconnect, device number 43 [ 568.761007][T14522] netlink: 'syz.5.2372': attribute type 1 has an invalid length. [ 568.773226][T14522] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2372'. [ 568.798028][T14518] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 569.338301][T14528] siw: device registration error -23 [ 569.411605][T14539] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2377'. [ 569.422328][T14535] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 570.066735][ T24] usb 8-1: USB disconnect, device number 74 [ 570.071889][ T24] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 570.074791][ T24] oti6858 8-1:1.0: device disconnected [ 570.545966][ T29] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 570.833473][ T29] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 570.955921][T14553] ceph: No mds server is up or the cluster is laggy [ 571.084895][T14563] bond14: Removing last arp target with arp_interval on [ 571.087557][T14563] bond14: entered promiscuous mode [ 571.089306][T14563] bond14: entered allmulticast mode [ 571.091123][T14563] 8021q: adding VLAN 0 to HW filter on device bond14 [ 571.385727][ T29] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 571.391400][T14552] ceph: No mds server is up or the cluster is laggy [ 571.571314][ T5094] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 571.579769][ T5094] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 571.584584][ T5094] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 571.587933][ T5094] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 571.590886][ T5094] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 571.984629][T14589] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2387'. [ 572.617388][T14574] bridge0: port 1(bridge_slave_0) entered blocking state [ 572.619863][T14574] bridge0: port 1(bridge_slave_0) entered disabled state [ 572.622503][T14574] bridge_slave_0: entered allmulticast mode [ 572.626910][T14574] bridge_slave_0: entered promiscuous mode [ 572.632173][T14574] bridge0: port 2(bridge_slave_1) entered blocking state [ 572.635318][T14574] bridge0: port 2(bridge_slave_1) entered disabled state [ 572.638583][T14574] bridge_slave_1: entered allmulticast mode [ 572.642706][T14574] bridge_slave_1: entered promiscuous mode [ 572.668307][T14574] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 572.675121][T14574] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 572.682722][T14615] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2389'. [ 572.730530][T14574] team0: Port device team_slave_0 added [ 572.736227][T14574] team0: Port device team_slave_1 added [ 572.767773][T14574] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 572.770695][T14574] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 572.779856][T14574] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 572.784305][T14574] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 572.784323][T14622] jffs2: notice: (14622) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 572.786498][T14574] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 572.786519][T14574] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 572.846455][T14574] hsr_slave_0: entered promiscuous mode [ 572.852017][T14574] hsr_slave_1: entered promiscuous mode [ 572.856418][T14574] debugfs: 'hsr0' already exists in 'hsr' [ 572.862221][T14574] Cannot create hsr debugfs directory [ 572.870234][T14622] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2390'. [ 572.970494][T14631] syzkaller0: entered promiscuous mode [ 572.972798][T14631] syzkaller0: entered allmulticast mode [ 573.033224][T14574] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.056607][T14633] 9pnet_virtio: no channels available for device syz [ 573.062024][T14633] syzkaller0: entered promiscuous mode [ 573.064394][T14633] syzkaller0: entered allmulticast mode [ 573.069043][T14635] 9pnet_virtio: no channels available for device syz [ 573.204987][T14574] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.281094][T14574] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.356559][T14574] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.547917][T14574] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 573.552524][T14574] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 573.555549][T14574] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 573.561343][T14574] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 573.564283][T14574] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 573.572994][T14574] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 573.576908][T14574] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 573.580572][T14641] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2395'. [ 573.585823][T14574] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 573.598847][T14641] bond8: entered promiscuous mode [ 573.601019][T14641] 8021q: adding VLAN 0 to HW filter on device bond8 [ 573.639956][ T5094] Bluetooth: hci4: command tx timeout [ 573.685456][T14574] 8021q: adding VLAN 0 to HW filter on device bond0 [ 573.759147][T14574] 8021q: adding VLAN 0 to HW filter on device team0 [ 573.785148][T14574] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 573.788570][T14574] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 573.823798][ T1157] bridge0: port 1(bridge_slave_0) entered blocking state [ 573.826909][ T1157] bridge0: port 1(bridge_slave_0) entered forwarding state [ 573.865093][ T1157] bridge0: port 2(bridge_slave_1) entered blocking state [ 573.867617][ T1157] bridge0: port 2(bridge_slave_1) entered forwarding state [ 573.934143][ T10] usb 8-1: new high-speed USB device number 75 using dummy_hcd [ 573.965969][T14655] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2397'. [ 574.130582][ T10] usb 8-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 574.133517][ T10] usb 8-1: config 1 descriptor has 1 excess byte, ignoring [ 574.135797][ T10] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 574.153046][T14574] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 574.175278][T14574] veth0_vlan: entered promiscuous mode [ 574.184957][T14574] veth1_vlan: entered promiscuous mode [ 574.206207][T14574] veth0_macvtap: entered promiscuous mode [ 574.210839][T14574] veth1_macvtap: entered promiscuous mode [ 574.225989][T14574] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 574.232847][T14574] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 574.307493][T10284] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.311212][T10284] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.397647][T10065] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.401404][T10065] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.563223][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 574.571350][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 574.594264][ T75] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 574.596789][ T75] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 574.820474][T14675] gretap1: entered promiscuous mode [ 574.824308][T14675] batman_adv: batadv0: Adding interface: gretap1 [ 574.827399][T14675] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 574.835179][T14675] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 574.871689][ T10] usb 8-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 574.914548][ T10] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 574.921728][ T10] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 574.924713][ T10] usb 8-1: Product: syz [ 574.926295][ T10] usb 8-1: Manufacturer: syz [ 574.934233][ T10] cdc_wdm 8-1:1.0: skipping garbage [ 574.936929][ T10] cdc_wdm 8-1:1.0: probe with driver cdc_wdm failed with error -22 [ 575.098608][T14686] syzkaller0: entered promiscuous mode [ 575.101396][T14686] syzkaller0: entered allmulticast mode [ 575.259797][ T10] usb 8-1: USB disconnect, device number 75 [ 575.600708][T14689] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 575.717340][ T5094] Bluetooth: hci4: command tx timeout [ 575.739745][T14692] syzkaller1: entered promiscuous mode [ 575.741676][T14692] syzkaller1: entered allmulticast mode [ 575.909347][T14695] FAULT_INJECTION: forcing a failure. [ 575.909347][T14695] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 575.915212][T14695] CPU: 3 UID: 0 PID: 14695 Comm: syz.2.2403 Tainted: G L syzkaller #0 PREEMPT(full) [ 575.915242][T14695] Tainted: [L]=SOFTLOCKUP [ 575.915249][T14695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 575.915260][T14695] Call Trace: [ 575.915268][T14695] [ 575.915276][T14695] dump_stack_lvl+0x100/0x190 [ 575.915306][T14695] should_fail_ex.cold+0x5/0xa [ 575.915332][T14695] ? prepare_alloc_pages+0x16d/0x5f0 [ 575.915365][T14695] should_fail_alloc_page+0xeb/0x140 [ 575.915396][T14695] prepare_alloc_pages+0x1f0/0x5f0 [ 575.915427][T14695] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 575.915451][T14695] ? vfs_write+0x6ac/0x1050 [ 575.915472][T14695] ? do_fast_syscall_32+0x32/0x70 [ 575.915502][T14695] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 575.915540][T14695] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 575.915577][T14695] ? trace_kmalloc+0xeb/0x110 [ 575.915604][T14695] ? __kasan_kmalloc+0xaa/0xb0 [ 575.915629][T14695] ? __kmalloc_node_track_caller_noprof+0x34f/0x830 [ 575.915655][T14695] ? __kasan_slab_alloc+0x89/0x90 [ 575.915681][T14695] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 575.915727][T14695] ? policy_nodemask+0xed/0x4f0 [ 575.915759][T14695] alloc_pages_mpol+0x1fb/0x540 [ 575.915786][T14695] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 575.915812][T14695] ? __alloc_skb+0x5b7/0x710 [ 575.915840][T14695] ? __pfx___alloc_skb+0x10/0x10 [ 575.915869][T14695] alloc_pages_noprof+0x1a/0x160 [ 575.915890][T14695] alloc_skb_with_frags+0x4e7/0x760 [ 575.915926][T14695] sock_alloc_send_pskb+0x801/0x980 [ 575.915953][T14695] ? _copy_from_iter+0x270/0x1690 [ 575.915990][T14695] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 575.916015][T14695] ? _parse_integer_limit+0x1ac/0x220 [ 575.916042][T14695] ? iov_iter_advance+0xac/0x6d0 [ 575.916072][T14695] tun_get_user+0x904/0x3c20 [ 575.916150][T14695] ? __pfx_tun_get_user+0x10/0x10 [ 575.916173][T14695] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 575.916204][T14695] ? find_held_lock+0x2b/0x80 [ 575.916227][T14695] ? tun_get+0x191/0x370 [ 575.916247][T14695] ? tun_get+0x191/0x370 [ 575.916275][T14695] tun_chr_write_iter+0xdc/0x200 [ 575.916300][T14695] vfs_write+0x6ac/0x1050 [ 575.916327][T14695] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 575.916353][T14695] ? __pfx_vfs_write+0x10/0x10 [ 575.916371][T14695] ? find_held_lock+0x2b/0x80 [ 575.916409][T14695] ksys_write+0x12a/0x250 [ 575.916430][T14695] ? __pfx_ksys_write+0x10/0x10 [ 575.916449][T14695] ? ksys_write+0x1ac/0x250 [ 575.916466][T14695] ? __pfx_ksys_write+0x10/0x10 [ 575.916491][T14695] __do_fast_syscall_32+0xe7/0x970 [ 575.916518][T14695] ? lockdep_hardirqs_on+0x78/0x100 [ 575.916546][T14695] do_fast_syscall_32+0x32/0x70 [ 575.916575][T14695] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 575.916599][T14695] RIP: 0023:0xf6ffefec [ 575.916625][T14695] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 575.916634][T14695] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 575.916652][T14695] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000380 [ 575.916665][T14695] RDX: 000000000000fdef RSI: 0000000000000000 RDI: 0000000000000000 [ 575.916675][T14695] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 575.916686][T14695] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 575.916696][T14695] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 575.916721][T14695] [ 576.239090][T14683] ceph: No mds server is up or the cluster is laggy [ 576.305227][T14703] jffs2: notice: (14703) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 576.322293][T14700] siw: device registration error -23 [ 576.361032][T14703] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2407'. [ 576.403365][ T42] kauditd_printk_skb: 85 callbacks suppressed [ 576.403391][ T42] audit: type=1326 audit(1786174672.282:2184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14706 comm="syz.4.2408" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 576.420192][T14707] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 576.429193][ T42] audit: type=1326 audit(1786174672.282:2185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14706 comm="syz.4.2408" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 576.446474][ T42] audit: type=1326 audit(1786174672.302:2186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14706 comm="syz.4.2408" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 576.457208][ T42] audit: type=1326 audit(1786174672.302:2187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14706 comm="syz.4.2408" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 576.472460][ T42] audit: type=1326 audit(1786174672.302:2188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14706 comm="syz.4.2408" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 576.489867][ T42] audit: type=1326 audit(1786174672.302:2189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14706 comm="syz.4.2408" exe="/syz-executor" sig=0 arch=40000003 syscall=146 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 576.505368][ T42] audit: type=1326 audit(1786174672.302:2190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14706 comm="syz.4.2408" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 576.522316][ T42] audit: type=1326 audit(1786174672.302:2191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14706 comm="syz.4.2408" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 576.534213][ T42] audit: type=1326 audit(1786174672.302:2192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14706 comm="syz.4.2408" exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71274eb code=0x7ffc0000 [ 576.547330][ T42] audit: type=1326 audit(1786174672.302:2193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14706 comm="syz.4.2408" exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71274eb code=0x7ffc0000 [ 576.561157][T14716] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2411'. [ 577.074252][T14729] exFAT-fs (nbd2): unable to read boot sector [ 577.076654][T14729] exFAT-fs (nbd2): failed to read boot sector [ 577.083789][T14729] exFAT-fs (nbd2): failed to recognize exfat type [ 577.477384][ T10] usb 9-1: new high-speed USB device number 44 using dummy_hcd [ 577.482758][T14719] ceph: No mds server is up or the cluster is laggy [ 577.578694][T14737] jffs2: notice: (14737) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 577.593736][T14737] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2417'. [ 577.657284][ T10] usb 9-1: Using ep0 maxpacket: 16 [ 577.667627][ T10] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 577.675857][ T10] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 577.684362][ T10] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 577.691506][ T10] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 577.700527][ T10] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 577.711067][ T10] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 577.715494][ T10] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 577.720923][ T10] usb 9-1: Manufacturer: syz [ 577.727577][ T10] usb 9-1: config 0 descriptor?? [ 577.807719][ T5094] Bluetooth: hci4: command tx timeout [ 577.987773][ T10] rc_core: IR keymap rc-hauppauge not found [ 577.989655][ T10] Registered IR keymap rc-empty [ 577.992398][ T10] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 577.998685][T14747] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 578.017884][ T10] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 578.048729][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 578.053781][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input108 [ 578.065110][ T10] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 578.097944][ T10] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 578.121493][ T10] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 578.135177][T14724] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 578.139417][T14724] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 578.148094][ T10] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 578.148481][T14724] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2413'. [ 578.170636][ T10] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 578.180882][T14724] bond24: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 578.198193][ T10] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 578.208285][T14724] bond24 (unregistering): Released all slaves [ 578.227836][ T10] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 578.257982][ T10] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 578.289590][ T10] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 578.308773][ T10] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 578.338859][ T10] mceusb 9-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 578.346653][ T10] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 578.443504][ T6381] usb 9-1: USB disconnect, device number 44 [ 578.795059][T14769] jffs2: notice: (14769) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 578.813445][T14769] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2426'. [ 579.514657][T14781] bridge0: port 2(bridge_slave_1) entered disabled state [ 579.517570][T14781] bridge0: port 1(bridge_slave_0) entered disabled state [ 579.770376][T14781] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 579.780236][T14781] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 579.879711][ T5094] Bluetooth: hci4: command tx timeout [ 579.971452][T14808] FAULT_INJECTION: forcing a failure. [ 579.971452][T14808] name failslab, interval 1, probability 0, space 0, times 0 [ 580.008112][T14808] CPU: 1 UID: 0 PID: 14808 Comm: syz.3.2435 Tainted: G L syzkaller #0 PREEMPT(full) [ 580.008147][T14808] Tainted: [L]=SOFTLOCKUP [ 580.008153][T14808] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 580.008164][T14808] Call Trace: [ 580.008171][T14808] [ 580.008180][T14808] dump_stack_lvl+0x100/0x190 [ 580.008211][T14808] should_fail_ex.cold+0x5/0xa [ 580.008235][T14808] should_failslab+0xc2/0x120 [ 580.008262][T14808] __kmalloc_noprof+0xfc/0x820 [ 580.008285][T14808] ? rcu_is_watching+0x12/0xc0 [ 580.008326][T14808] ? tomoyo_realpath_from_path+0xb6/0x690 [ 580.008369][T14808] tomoyo_realpath_from_path+0xb6/0x690 [ 580.008402][T14808] tomoyo_path_number_perm+0x23c/0x580 [ 580.008424][T14808] ? tomoyo_path_number_perm+0x22e/0x580 [ 580.008449][T14808] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 580.008473][T14808] ? get_pid_task+0x106/0x250 [ 580.008538][T14808] ? find_held_lock+0x2b/0x80 [ 580.008562][T14808] ? __fget_files+0x215/0x3d0 [ 580.008589][T14808] ? hook_file_ioctl_common+0x140/0x440 [ 580.008613][T14808] ? __fget_files+0x215/0x3d0 [ 580.008634][T14808] ? __fget_files+0x21f/0x3d0 [ 580.008662][T14808] security_file_ioctl_compat+0xd3/0x230 [ 580.008700][T14808] __ia32_compat_sys_ioctl+0xc2/0x360 [ 580.008734][T14808] __do_fast_syscall_32+0xe7/0x970 [ 580.008762][T14808] ? lockdep_hardirqs_on+0x78/0x100 [ 580.008790][T14808] do_fast_syscall_32+0x32/0x70 [ 580.008817][T14808] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 580.008841][T14808] RIP: 0023:0xf7f07fec [ 580.008864][T14808] Code: Unable to access opcode bytes at 0xf7f07fc2. [ 580.008873][T14808] RSP: 002b:00000000f538450c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 580.008893][T14808] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 00000000400455c8 [ 580.008905][T14808] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 580.008915][T14808] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 580.008925][T14808] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 580.008936][T14808] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 580.008960][T14808] [ 580.008969][T14808] ERROR: Out of memory at tomoyo_realpath_from_path. [ 580.117872][ T13] netdevsim netdevsim5 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 580.124233][ T13] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.134218][T14801] siw: device registration error -23 [ 580.140551][T14799] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2435'. [ 580.151751][T14797] syzkaller0: entered promiscuous mode [ 580.154021][T14797] syzkaller0: entered allmulticast mode [ 580.210899][T14811] jffs2: notice: (14811) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 580.228634][T14811] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2436'. [ 580.237490][ T13] netdevsim netdevsim5 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 580.241055][ T13] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.244518][ T13] netdevsim netdevsim5 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 580.248891][ T13] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.252516][ T13] netdevsim netdevsim5 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 580.255856][ T13] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.389925][ T37] Bluetooth: hci2: Frame reassembly failed (-84) [ 580.436870][T14809] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 581.034114][T14822] siw: device registration error -23 [ 581.637484][T14826] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 581.841403][T14835] 9pnet_virtio: no channels available for device syz [ 582.444637][ T5094] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 582.447981][ T5746] Bluetooth: hci2: command 0x1003 tx timeout [ 582.835318][T14850] No source specified [ 582.989849][T14850] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2445'. [ 583.227441][T14845] ceph: No mds server is up or the cluster is laggy [ 583.245583][ T42] kauditd_printk_skb: 36 callbacks suppressed [ 583.245595][ T42] audit: type=1326 audit(1786174679.122:2230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14852 comm="syz.3.2447" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f07fec code=0x7ffc0000 [ 583.257013][ T42] audit: type=1326 audit(1786174679.132:2231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14852 comm="syz.3.2447" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f07fec code=0x7ffc0000 [ 583.264885][ T42] audit: type=1326 audit(1786174679.142:2232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14852 comm="syz.3.2447" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f07fec code=0x7ffc0000 [ 583.277530][ T42] audit: type=1326 audit(1786174679.142:2233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14852 comm="syz.3.2447" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f07fec code=0x7ffc0000 [ 583.284195][ T42] audit: type=1326 audit(1786174679.142:2234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14852 comm="syz.3.2447" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f07fec code=0x7ffc0000 [ 583.290951][ T42] audit: type=1326 audit(1786174679.152:2235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14852 comm="syz.3.2447" exe="/syz-executor" sig=0 arch=40000003 syscall=146 compat=1 ip=0xf7f07fec code=0x7ffc0000 [ 583.297751][ T42] audit: type=1326 audit(1786174679.152:2236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14852 comm="syz.3.2447" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f07fec code=0x7ffc0000 [ 583.304348][ T42] audit: type=1326 audit(1786174679.152:2237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14852 comm="syz.3.2447" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f07fec code=0x7ffc0000 [ 583.311250][ T42] audit: type=1326 audit(1786174679.152:2238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14852 comm="syz.3.2447" exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71074eb code=0x7ffc0000 [ 583.318691][ T42] audit: type=1326 audit(1786174679.152:2239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14852 comm="syz.3.2447" exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71074eb code=0x7ffc0000 [ 583.380062][T14857] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2446'. [ 583.419233][T14855] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2446'. [ 583.541718][T14862] 9pnet_virtio: no channels available for device syz [ 583.556256][T14859] syzkaller0: entered promiscuous mode [ 583.557736][ T5746] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 583.563042][T14859] syzkaller0: entered allmulticast mode [ 583.570756][T14862] syzkaller0: entered promiscuous mode [ 583.576283][T14862] syzkaller0: entered allmulticast mode [ 583.578444][ T5746] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 583.584687][ T5746] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 583.588739][ T5746] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 583.597317][ T5746] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 583.808668][T14883] No source specified [ 583.834387][T14883] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2455'. [ 584.357041][T14896] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 585.141502][T14905] ceph: No mds server is up or the cluster is laggy [ 585.214998][T14865] bridge0: port 1(bridge_slave_0) entered blocking state [ 585.220534][T14865] bridge0: port 1(bridge_slave_0) entered disabled state [ 585.222859][T14865] bridge_slave_0: entered allmulticast mode [ 585.225608][T14865] bridge_slave_0: entered promiscuous mode [ 585.229099][T14865] bridge0: port 2(bridge_slave_1) entered blocking state [ 585.232871][T14865] bridge0: port 2(bridge_slave_1) entered disabled state [ 585.237389][T14865] bridge_slave_1: entered allmulticast mode [ 585.243800][T14865] bridge_slave_1: entered promiscuous mode [ 585.296173][T14865] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 585.310298][T14865] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 585.356078][T14865] team0: Port device team_slave_0 added [ 585.391993][T14865] team0: Port device team_slave_1 added [ 585.478437][T14865] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 585.481226][T14865] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 585.489898][T14865] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 585.499590][T14865] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 585.502671][T14865] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 585.511755][T14865] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 585.560825][T14922] No source specified [ 585.604387][T10065] team0: Port device xfrm0 removed [ 585.605262][T14922] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2463'. [ 585.648030][ T5746] Bluetooth: hci2: command tx timeout [ 585.675231][T10065] batman_adv: batadv0: Removing interface: gretap1 [ 585.755167][T10065] bond0 (unregistering): Released all slaves [ 585.776384][T10065] bond1 (unregistering): Released all slaves [ 585.792399][T10065] bond2 (unregistering): Released all slaves [ 585.811349][T10065] bond3 (unregistering): Released all slaves [ 585.829604][T10065] bond4 (unregistering): Released all slaves [ 585.845030][T10065] bond5 (unregistering): Released all slaves [ 585.853792][T10065] bond6 (unregistering): Released all slaves [ 585.864234][T10065] bond7 (unregistering): Released all slaves [ 585.872847][T10065] bond8 (unregistering): Released all slaves [ 585.883629][T10065] bond9 (unregistering): Released all slaves [ 585.892357][T10065] bond10 (unregistering): Released all slaves [ 585.903448][T10065] bond11 (unregistering): Released all slaves [ 585.918746][T10065] bond12 (unregistering): Released all slaves [ 585.932163][T10065] bond13 (unregistering): Released all slaves [ 585.945192][T10065] bond14 (unregistering): Released all slaves [ 585.963471][T14923] syzkaller0: entered promiscuous mode [ 585.965876][T14923] syzkaller0: entered allmulticast mode [ 586.033403][T14865] hsr_slave_0: entered promiscuous mode [ 586.046329][T14865] hsr_slave_1: entered promiscuous mode [ 586.052108][T14865] debugfs: 'hsr0' already exists in 'hsr' [ 586.055306][T14865] Cannot create hsr debugfs directory [ 586.130641][T10065] : left promiscuous mode [ 586.245120][ T5446] 8021q: adding VLAN 0 to HW filter on device eth11 [ 586.340016][T10065] tipc: Disabling bearer [ 586.343144][T10065] tipc: Left network mode [ 586.423725][ T5446] 8021q: adding VLAN 0 to HW filter on device eth12 [ 586.768013][ T5845] usb 7-1: new full-speed USB device number 66 using dummy_hcd [ 586.961514][ T5845] usb 7-1: not running at top speed; connect to a high speed hub [ 586.965053][ T5845] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 586.968833][ T5845] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 586.974306][ T5845] usb 7-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 586.977355][ T5845] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 586.979941][ T5845] usb 7-1: Product: syz [ 586.981298][ T5845] usb 7-1: Manufacturer: syz [ 586.982768][ T5845] usb 7-1: SerialNumber: syz [ 586.999786][ T5845] oti6858 7-1:1.0: oti6858 converter detected [ 587.003501][ T5845] usb 7-1: oti6858 converter now attached to ttyUSB0 [ 587.327311][T10065] hsr_slave_0: left promiscuous mode [ 587.335493][T10065] hsr_slave_1: left promiscuous mode [ 587.345055][T14947] oti6858 ttyUSB0: oti6858_open(): usb_submit_urb() failed with error -90 [ 587.717382][ T5746] Bluetooth: hci2: command tx timeout [ 587.846391][ T5746] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 587.972154][T14959] ceph: No mds server is up or the cluster is laggy [ 588.024511][T14980] loop5: detected capacity change from 0 to 7 [ 588.029842][ C2] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 588.033029][ C2] Buffer I/O error on dev loop5, logical block 0, async page read [ 588.060552][ C2] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 588.064387][ C2] Buffer I/O error on dev loop5, logical block 0, async page read [ 588.067815][ C2] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 588.071636][ C2] Buffer I/O error on dev loop5, logical block 0, async page read [ 588.076554][ C2] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 588.080324][ C2] Buffer I/O error on dev loop5, logical block 0, async page read [ 588.083883][ C2] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 588.087296][ C2] Buffer I/O error on dev loop5, logical block 0, async page read [ 588.101731][ C2] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 588.104951][ C2] Buffer I/O error on dev loop5, logical block 0, async page read [ 588.114139][ C2] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 588.117347][ C2] Buffer I/O error on dev loop5, logical block 0, async page read [ 588.121829][T14980] ldm_validate_partition_table(): Disk read failed. [ 588.126429][ C2] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 588.129597][ C2] Buffer I/O error on dev loop5, logical block 0, async page read [ 588.143020][ C2] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 588.146594][ C2] Buffer I/O error on dev loop5, logical block 0, async page read [ 588.150596][ C3] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 588.153910][ C3] Buffer I/O error on dev loop5, logical block 0, async page read [ 588.157120][T14980] Dev loop5: unable to read RDB block 0 [ 588.176060][T14980] loop5: unable to read partition table [ 588.182218][T14980] loop5: partition table beyond EOD, truncated [ 588.184513][T14980] loop_reread_partitions: partition scan of loop5 (úù) failed (rc=-5) [ 588.228984][T14983] loop5: detected capacity change from 7 to 0 [ 588.330328][T14987] binder: 14985:14987 ioctl 400c620e 0 returned -14 [ 589.416858][ T5845] usb 7-1: USB disconnect, device number 66 [ 589.490276][ T5845] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 589.495867][ T5845] oti6858 7-1:1.0: device disconnected [ 589.576797][T14998] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2476'. [ 589.653908][T14865] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 589.685281][T15000] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 589.685670][T14865] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 589.697907][T14865] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 589.720088][T14865] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 589.728891][T14865] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 589.747527][T14865] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 589.752381][T14865] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 589.776318][T14865] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 589.798817][ T5746] Bluetooth: hci2: command tx timeout [ 589.876041][T14865] 8021q: adding VLAN 0 to HW filter on device bond0 [ 589.894240][T10065] IPVS: stop unused estimator thread 0... [ 589.908913][T14865] 8021q: adding VLAN 0 to HW filter on device team0 [ 589.933510][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 589.935854][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 589.962530][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 589.965200][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 590.368538][T14865] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 590.392506][T14865] veth0_vlan: entered promiscuous mode [ 590.400346][T14865] veth1_vlan: entered promiscuous mode [ 590.426832][T14865] veth0_macvtap: entered promiscuous mode [ 590.431909][T14865] veth1_macvtap: entered promiscuous mode [ 590.450220][T14865] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 590.464995][T14865] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 590.618245][ T5816] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.643781][ T5816] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.788520][T15033] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2483'. [ 590.803189][ T8269] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 590.806393][ T8269] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 590.852602][ T8269] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 590.865191][ T8269] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 590.879377][ T9254] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.883234][ T9254] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.441473][ T5823] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 591.788220][ T24] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 591.878432][ T5746] Bluetooth: hci2: command tx timeout [ 592.954079][ T24] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 593.079139][T15049] ceph: No mds server is up or the cluster is laggy [ 593.194212][T15058] bond1: Removing last arp target with arp_interval on [ 593.201114][T15058] bond1: entered promiscuous mode [ 593.204715][T15058] bond1: entered allmulticast mode [ 593.206752][T15058] 8021q: adding VLAN 0 to HW filter on device bond1 [ 593.348247][T15066] netlink: 100 bytes leftover after parsing attributes in process `syz.2.2491'. [ 593.420159][T15069] syzkaller0: entered promiscuous mode [ 593.422012][T15069] syzkaller0: entered allmulticast mode [ 593.540662][T15073] 9pnet_virtio: no channels available for device syz [ 594.293127][T15089] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2498'. [ 594.917590][T15102] syzkaller0: entered promiscuous mode [ 594.920254][T15102] syzkaller0: entered allmulticast mode [ 595.035901][T15104] 9pnet_virtio: no channels available for device syz [ 595.165023][T15105] bond2: Removing last arp target with arp_interval on [ 595.168522][T15105] bond2: entered promiscuous mode [ 595.170681][T15105] bond2: entered allmulticast mode [ 595.173082][T15105] 8021q: adding VLAN 0 to HW filter on device bond2 [ 595.353665][T15108] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2502'. [ 596.852699][T15095] siw: device registration error -23 [ 596.929126][T15139] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 596.988209][T15146] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2515'. [ 597.506179][T15154] syzkaller0: entered promiscuous mode [ 597.508724][T15154] syzkaller0: entered allmulticast mode [ 597.517241][ T9] usb 8-1: new high-speed USB device number 76 using dummy_hcd [ 597.667745][ T9] usb 8-1: Using ep0 maxpacket: 16 [ 597.672262][ T9] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 597.681176][ T9] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 597.684685][T15136] ceph: No mds server is up or the cluster is laggy [ 597.690357][ T9] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 597.696570][ T9] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 597.703798][ T9] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 597.713335][ T9] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 597.717480][ T9] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 597.723748][ T9] usb 8-1: Manufacturer: syz [ 597.744597][ T9] usb 8-1: config 0 descriptor?? [ 597.824848][T15157] FAULT_INJECTION: forcing a failure. [ 597.824848][T15157] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 597.829942][T15157] CPU: 3 UID: 0 PID: 15157 Comm: syz.5.2521 Tainted: G L syzkaller #0 PREEMPT(full) [ 597.829972][T15157] Tainted: [L]=SOFTLOCKUP [ 597.829978][T15157] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 597.829991][T15157] Call Trace: [ 597.829997][T15157] [ 597.830004][T15157] dump_stack_lvl+0x100/0x190 [ 597.830035][T15157] should_fail_ex.cold+0x5/0xa [ 597.830060][T15157] _copy_to_user+0x32/0xd0 [ 597.830091][T15157] simple_read_from_buffer+0xcb/0x170 [ 597.830132][T15157] proc_fail_nth_read+0x1af/0x230 [ 597.830185][T15157] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 597.830212][T15157] ? rw_verify_area+0xce/0x6d0 [ 597.830240][T15157] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 597.830266][T15157] vfs_read+0x1e4/0xb40 [ 597.830287][T15157] ? __pfx_vfs_read+0x10/0x10 [ 597.830303][T15157] ? find_held_lock+0x2b/0x80 [ 597.830330][T15157] ? __fget_files+0x215/0x3d0 [ 597.830352][T15157] ? __fget_files+0x21f/0x3d0 [ 597.830379][T15157] ksys_read+0x12a/0x250 [ 597.830396][T15157] ? __pfx_ksys_read+0x10/0x10 [ 597.830421][T15157] do_int80_emulation+0x14b/0x720 [ 597.830452][T15157] asm_int80_emulation+0x1a/0x20 [ 597.830472][T15157] RIP: 0023:0xf71e74eb [ 597.830487][T15157] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 597.830503][T15157] RSP: 002b:00000000f54a64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 597.830523][T15157] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000f54a65d0 [ 597.830534][T15157] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 597.830553][T15157] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 597.830566][T15157] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 597.830578][T15157] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 597.830602][T15157] [ 597.924744][T15155] siw: device registration error -23 [ 598.027293][ T9] rc_core: IR keymap rc-hauppauge not found [ 598.029411][ T9] Registered IR keymap rc-empty [ 598.031141][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 598.042597][T15158] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 598.048166][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 598.068263][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0 [ 598.075291][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0/input109 [ 598.107402][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 598.127436][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 598.150567][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 598.167439][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 598.186126][T15150] overlayfs: missing 'lowerdir' [ 598.187917][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 598.207843][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 598.212852][T15150] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2518'. [ 598.227556][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 598.243933][T15150] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 598.247887][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 598.254146][T15150] bond3 (unregistering): Released all slaves [ 598.268161][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 598.287356][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 598.308546][ T9] mceusb 8-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 598.313226][ T9] mceusb 8-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 598.419918][ T9] usb 8-1: USB disconnect, device number 76 [ 598.890292][T15177] jffs2: notice: (15177) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 598.901295][T15169] ceph: No mds server is up or the cluster is laggy [ 599.037775][T15186] cgroup: Need name or subsystem set [ 599.111116][T15186] random: crng reseeded on system resumption [ 599.130431][T15186] input: syz0 as /devices/virtual/input/input110 [ 599.245683][T15177] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 599.367305][ T1356] usb 8-1: new high-speed USB device number 77 using dummy_hcd [ 599.528676][ T1356] usb 8-1: config index 0 descriptor too short (expected 39, got 27) [ 599.532169][ T1356] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 599.535525][ T1356] usb 8-1: config 0 interface 0 has no altsetting 0 [ 599.541687][ T1356] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 599.544737][ T1356] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 599.548297][ T1356] usb 8-1: Product: syz [ 599.549917][ T1356] usb 8-1: Manufacturer: syz [ 599.551649][ T1356] usb 8-1: SerialNumber: syz [ 599.559659][ T1356] usb 8-1: config 0 descriptor?? [ 599.564580][ T1356] hub 8-1:0.0: bad descriptor, ignoring hub [ 599.566593][ T1356] hub 8-1:0.0: probe with driver hub failed with error -5 [ 599.584308][ T1356] usb 8-1: selecting invalid altsetting 0 [ 600.070381][T15205] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2530'. [ 600.497009][T15200] ceph: No mds server is up or the cluster is laggy [ 600.625568][ T9] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 600.626361][T15216] xt_HMARK: proto mask must be zero with L3 mode [ 600.638477][T15216] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2532'. [ 600.651961][T15216] vlan2: entered allmulticast mode [ 600.653657][T15216] dummy0: entered allmulticast mode [ 600.657123][T15216] bridge0: port 3(vlan2) entered blocking state [ 600.660375][T15216] bridge0: port 3(vlan2) entered disabled state [ 600.664854][T15216] vlan2: entered promiscuous mode [ 600.667044][T15216] dummy0: entered promiscuous mode [ 600.908200][ T10] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 601.107240][ T9] usb 9-1: new full-speed USB device number 45 using dummy_hcd [ 601.130694][T15212] ceph: No mds server is up or the cluster is laggy [ 601.278672][ T9] usb 9-1: not running at top speed; connect to a high speed hub [ 601.283291][ T9] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 601.288057][ T9] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 601.295229][ T9] usb 9-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 601.299080][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 601.302311][ T9] usb 9-1: Product: syz [ 601.303749][ T9] usb 9-1: Manufacturer: syz [ 601.305641][ T9] usb 9-1: SerialNumber: syz [ 601.316946][ T9] oti6858 9-1:1.0: oti6858 converter detected [ 601.328031][ T9] usb 9-1: oti6858 converter now attached to ttyUSB0 [ 601.708218][T15227] oti6858 ttyUSB0: oti6858_open(): usb_submit_urb() failed with error -90 [ 601.772106][T15247] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 602.044385][ T24] usb 8-1: USB disconnect, device number 77 [ 602.109217][ T42] kauditd_printk_skb: 35 callbacks suppressed [ 602.109231][ T42] audit: type=1326 audit(1786174697.992:2275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15250 comm="syz.3.2540" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cefec code=0x7ffc0000 [ 602.130999][ T42] audit: type=1326 audit(1786174698.002:2276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15250 comm="syz.3.2540" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf70cefec code=0x7ffc0000 [ 602.144557][ T42] audit: type=1326 audit(1786174698.002:2277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15250 comm="syz.3.2540" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cefec code=0x7ffc0000 [ 602.160267][ T42] audit: type=1326 audit(1786174698.002:2278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15250 comm="syz.3.2540" exe="/syz-executor" sig=0 arch=40000003 syscall=146 compat=1 ip=0xf70cefec code=0x7ffc0000 [ 602.174797][ T42] audit: type=1326 audit(1786174698.002:2279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15250 comm="syz.3.2540" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cefec code=0x7ffc0000 [ 602.181791][ T42] audit: type=1326 audit(1786174698.002:2280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15250 comm="syz.3.2540" exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf72074eb code=0x7ffc0000 [ 602.223580][ T42] audit: type=1326 audit(1786174698.002:2281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15250 comm="syz.3.2540" exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf72074eb code=0x7ffc0000 [ 602.261276][ T42] audit: type=1326 audit(1786174698.002:2282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15250 comm="syz.3.2540" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf70cefec code=0x7ffc0000 [ 602.302098][ T42] audit: type=1326 audit(1786174698.002:2283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15250 comm="syz.3.2540" exe="/syz-executor" sig=0 arch=40000003 syscall=91 compat=1 ip=0xf70cefec code=0x7ffc0000 [ 602.340606][ T42] audit: type=1326 audit(1786174698.002:2284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15250 comm="syz.3.2540" exe="/syz-executor" sig=0 arch=40000003 syscall=91 compat=1 ip=0xf70cefec code=0x7ffc0000 [ 602.583751][T15260] 9pnet_virtio: no channels available for device syz [ 602.933749][T15258] FAULT_INJECTION: forcing a failure. [ 602.933749][T15258] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 602.940266][T15258] CPU: 3 UID: 0 PID: 15258 Comm: syz.2.2543 Tainted: G L syzkaller #0 PREEMPT(full) [ 602.940298][T15258] Tainted: [L]=SOFTLOCKUP [ 602.940305][T15258] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 602.940318][T15258] Call Trace: [ 602.940325][T15258] [ 602.940332][T15258] dump_stack_lvl+0x100/0x190 [ 602.940361][T15258] should_fail_ex.cold+0x5/0xa [ 602.940383][T15258] _copy_from_iter+0x1f4/0x1690 [ 602.940415][T15258] ? __pfx__copy_from_iter+0x10/0x10 [ 602.940438][T15258] ? trace_kmalloc+0xeb/0x110 [ 602.940464][T15258] ? __kasan_kmalloc+0xaa/0xb0 [ 602.940486][T15258] ? __kmalloc_noprof+0x343/0x820 [ 602.940532][T15258] ? kernfs_fop_write_iter+0x26a/0x5f0 [ 602.940562][T15258] kernfs_fop_write_iter+0x186/0x5f0 [ 602.940584][T15258] vfs_write+0x6ac/0x1050 [ 602.940596][T15258] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 602.940612][T15258] ? __pfx_vfs_write+0x10/0x10 [ 602.940622][T15258] ? find_held_lock+0x2b/0x80 [ 602.940648][T15258] ksys_write+0x12a/0x250 [ 602.940659][T15258] ? __pfx_ksys_write+0x10/0x10 [ 602.940669][T15258] ? ksys_write+0x1ac/0x250 [ 602.940680][T15258] ? __pfx_ksys_write+0x10/0x10 [ 602.940693][T15258] __do_fast_syscall_32+0xe7/0x970 [ 602.940712][T15258] ? lockdep_hardirqs_on+0x78/0x100 [ 602.940729][T15258] do_fast_syscall_32+0x32/0x70 [ 602.940746][T15258] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 602.940762][T15258] RIP: 0023:0xf6ffefec [ 602.940778][T15258] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 602.940783][T15258] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 602.940795][T15258] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800002c0 [ 602.940802][T15258] RDX: 0000000000000020 RSI: 0000000000000000 RDI: 0000000000000000 [ 602.940809][T15258] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 602.940815][T15258] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 602.940822][T15258] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 602.940850][T15258] [ 603.421946][T15271] gretap1: entered promiscuous mode [ 603.425395][T15271] batman_adv: batadv0: Adding interface: gretap1 [ 603.428535][T15271] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 603.436440][T15271] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 603.801642][ T24] usb 9-1: USB disconnect, device number 45 [ 603.869173][ T24] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 603.876317][ T24] oti6858 9-1:1.0: device disconnected [ 604.172274][T15272] siw: device registration error -23 [ 604.189100][T15287] netlink: 'syz.4.2551': attribute type 10 has an invalid length. [ 604.371460][T15288] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 604.861367][T15279] ceph: No mds server is up or the cluster is laggy [ 605.812978][T15310] bond1: Removing last arp target with arp_interval on [ 605.816905][T15310] bond1: entered promiscuous mode [ 605.818698][T15310] bond1: entered allmulticast mode [ 605.821462][T15310] 8021q: adding VLAN 0 to HW filter on device bond1 [ 605.844192][T15309] siw: device registration error -23 [ 605.928451][T15312] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 605.951744][T15316] 9pnet_virtio: no channels available for device syz [ 606.067207][T15318] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2560'. [ 606.355932][T15328] 9pnet_virtio: no channels available for device syz [ 607.490515][T15343] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 607.951551][T15354] jffs2: notice: (15354) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 608.095775][T15354] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2570'. [ 608.200844][T15357] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2571'. [ 608.474292][T15363] bond24: Removing last arp target with arp_interval on [ 608.477470][T15363] bond24: entered promiscuous mode [ 608.479239][T15363] bond24: entered allmulticast mode [ 608.482314][T15363] 8021q: adding VLAN 0 to HW filter on device bond24 [ 609.275129][T15374] FAULT_INJECTION: forcing a failure. [ 609.275129][T15374] name failslab, interval 1, probability 0, space 0, times 0 [ 609.280385][T15374] CPU: 2 UID: 0 PID: 15374 Comm: syz.2.2576 Tainted: G L syzkaller #0 PREEMPT(full) [ 609.280405][T15374] Tainted: [L]=SOFTLOCKUP [ 609.280410][T15374] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 609.280417][T15374] Call Trace: [ 609.280422][T15374] [ 609.280426][T15374] dump_stack_lvl+0x100/0x190 [ 609.280447][T15374] should_fail_ex.cold+0x5/0xa [ 609.280462][T15374] should_failslab+0xc2/0x120 [ 609.280480][T15374] __kmalloc_noprof+0xfc/0x820 [ 609.280496][T15374] ? tomoyo_encode2+0xfb/0x3c0 [ 609.280517][T15374] tomoyo_encode2+0xfb/0x3c0 [ 609.280536][T15374] tomoyo_encode+0x29/0x50 [ 609.280557][T15374] tomoyo_realpath_from_path+0x18c/0x690 [ 609.280578][T15374] tomoyo_path_number_perm+0x23c/0x580 [ 609.280592][T15374] ? tomoyo_path_number_perm+0x22e/0x580 [ 609.280607][T15374] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 609.280622][T15374] ? get_pid_task+0x106/0x250 [ 609.280653][T15374] ? find_held_lock+0x2b/0x80 [ 609.280668][T15374] ? __fget_files+0x215/0x3d0 [ 609.280679][T15374] ? hook_file_ioctl_common+0x140/0x440 [ 609.280709][T15374] ? __fget_files+0x215/0x3d0 [ 609.280722][T15374] ? __fget_files+0x21f/0x3d0 [ 609.280735][T15374] security_file_ioctl_compat+0xd3/0x230 [ 609.280765][T15374] __ia32_compat_sys_ioctl+0xc2/0x360 [ 609.280786][T15374] __do_fast_syscall_32+0xe7/0x970 [ 609.280807][T15374] ? lockdep_hardirqs_on+0x78/0x100 [ 609.280824][T15374] do_fast_syscall_32+0x32/0x70 [ 609.280841][T15374] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 609.280856][T15374] RIP: 0023:0xf6ffefec [ 609.280869][T15374] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 609.280875][T15374] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 609.280887][T15374] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000002286 [ 609.280895][T15374] RDX: 0000000080000c00 RSI: 0000000000000000 RDI: 0000000000000000 [ 609.280902][T15374] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 609.280908][T15374] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 609.280916][T15374] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 609.280930][T15374] [ 609.281282][T15374] ERROR: Out of memory at tomoyo_realpath_from_path. [ 609.408384][T15376] jffs2: notice: (15376) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 609.440049][T15376] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2578'. [ 609.596159][T15383] jffs2: notice: (15383) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 609.609480][T15383] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2580'. [ 609.763821][T15386] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 609.903248][T15390] syzkaller0: entered promiscuous mode [ 609.905307][T15390] syzkaller0: entered allmulticast mode [ 610.057791][ T24] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 610.212662][ T24] usb 10-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 610.216005][ T24] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 610.219742][ T24] usb 10-1: Product: syz [ 610.221421][ T24] usb 10-1: Manufacturer: syz [ 610.223458][ T24] usb 10-1: SerialNumber: syz [ 610.269415][T15398] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2584'. [ 610.464229][T15394] IPVS: Error connecting to the multicast addr [ 610.494747][ T24] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 610.506659][ T24] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 610.511221][ T24] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 610.524725][ T24] lan78xx 10-1:1.0: probe with driver lan78xx failed with error -71 [ 610.542475][ T24] usb 10-1: USB disconnect, device number 17 [ 611.088625][ T1356] usb 9-1: new full-speed USB device number 46 using dummy_hcd [ 611.264136][ T1356] usb 9-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 611.269972][ T1356] usb 9-1: config 0 interface 0 altsetting 1 endpoint 0x89 has an invalid bInterval 0, changing to 10 [ 611.274098][ T1356] usb 9-1: config 0 interface 0 altsetting 1 endpoint 0x89 has invalid wMaxPacketSize 0 [ 611.277867][ T1356] usb 9-1: config 0 interface 0 has no altsetting 0 [ 611.291075][ T1356] usb 9-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 611.296220][ T1356] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 611.299728][ T1356] usb 9-1: Product: syz [ 611.301267][ T1356] usb 9-1: Manufacturer: syz [ 611.302937][ T1356] usb 9-1: SerialNumber: syz [ 611.315293][T15409] siw: device registration error -23 [ 611.352187][ T1356] usb 9-1: config 0 descriptor?? [ 611.677945][ T1356] input: syz syz as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/input/input111 [ 611.716119][ T5128] synaptics_usb 9-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 611.748196][T15416] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 611.763481][ T5128] synaptics_usb 9-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 611.808732][ T5128] synaptics_usb 9-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 611.851070][ T5128] synaptics_usb 9-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 611.951159][T15406] synaptics_usb 9-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 611.993800][T15420] syzkaller0: entered promiscuous mode [ 611.999617][T15420] syzkaller0: entered allmulticast mode [ 612.001053][ T5823] usb 9-1: USB disconnect, device number 46 [ 612.705287][T15433] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2595'. [ 613.088804][T15436] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 613.090935][T15436] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 613.103866][T15436] vhci_hcd vhci_hcd.0: Device attached [ 613.377436][ T9] usb 44-1: SetAddress Request (10) to port 0 [ 613.379523][ T10] usb 7-1: new high-speed USB device number 67 using dummy_hcd [ 613.383514][ T9] usb 44-1: new SuperSpeed USB device number 10 using vhci_hcd [ 613.432272][T15439] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 613.435283][T15442] vhci_hcd: connection reset by peer [ 613.444121][T10865] vhci_hcd vhci_hcd.3: stop threads [ 613.446129][T10865] vhci_hcd vhci_hcd.3: release socket [ 613.448395][T10865] vhci_hcd vhci_hcd.3: disconnect device [ 613.539805][ T10] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 613.542785][ T10] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 613.547259][ T10] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 613.550589][ T10] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 613.565010][ T10] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 613.568236][ T10] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 613.572169][ T10] usb 7-1: Product: syz [ 613.575878][ T10] usb 7-1: Manufacturer: syz [ 613.604959][ T10] cdc_wdm 7-1:1.0: probe with driver cdc_wdm failed with error -22 [ 613.775316][T15450] jffs2: notice: (15450) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 613.795016][T15450] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2599'. [ 614.396766][T15457] bond9: Removing last arp target with arp_interval on [ 614.404731][T15457] bond9: entered promiscuous mode [ 614.407059][T15457] bond9: entered allmulticast mode [ 614.409827][T15457] 8021q: adding VLAN 0 to HW filter on device bond9 [ 614.844708][T15452] ceph: No mds server is up or the cluster is laggy [ 615.226333][T15464] siw: device registration error -23 [ 615.312858][T15463] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 615.382303][ T5823] usb 7-1: USB disconnect, device number 67 [ 615.406643][T15470] overlay: ./file0 is not a directory [ 615.544354][T15474] overlay: ./file0 is not a directory [ 615.706607][T15476] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2605'. [ 616.492740][T15491] 9pnet_virtio: no channels available for device syz [ 616.603450][T15493] bond10: Removing last arp target with arp_interval on [ 616.613457][T15493] bond10: entered promiscuous mode [ 616.622585][T15493] bond10: entered allmulticast mode [ 616.629260][T15493] 8021q: adding VLAN 0 to HW filter on device bond10 [ 616.801592][T15497] jffs2: notice: (15497) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 618.098841][T15511] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2615'. [ 618.448592][ T9] usb 44-1: device descriptor read/8, error -110 [ 619.019479][T15526] jffs2: notice: (15526) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 619.070356][T15526] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2620'. [ 619.329175][ T9] usb usb44-port1: attempt power cycle [ 619.487636][ T1034] usb 10-1: new high-speed USB device number 18 using dummy_hcd [ 619.755767][T15541] bond2: Removing last arp target with arp_interval on [ 619.773821][T15541] bond2: entered promiscuous mode [ 619.776255][T15541] bond2: entered allmulticast mode [ 619.783233][T15541] 8021q: adding VLAN 0 to HW filter on device bond2 [ 619.787223][ T5838] usb 9-1: new full-speed USB device number 47 using dummy_hcd [ 619.791829][T15542] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2624'. [ 619.948011][ T9] usb usb44-port1: unable to enumerate USB device [ 620.154072][T15548] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2625'. [ 620.301072][ T5838] usb 9-1: not running at top speed; connect to a high speed hub [ 620.371819][ T5838] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 620.381036][ T5838] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 620.387027][ T5838] usb 9-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 620.390964][ T1034] usb 10-1: Using ep0 maxpacket: 16 [ 620.392955][ T5838] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.395632][ T5838] usb 9-1: Product: syz [ 620.396999][ T5838] usb 9-1: Manufacturer: syz [ 620.398693][ T5838] usb 9-1: SerialNumber: syz [ 620.413358][ T5838] oti6858 9-1:1.0: oti6858 converter detected [ 620.419241][ T5838] usb 9-1: oti6858 converter now attached to ttyUSB0 [ 620.428014][ T1034] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 620.431324][ T1034] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 620.434827][ T1034] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 620.438835][ T1034] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 620.441796][ T1034] usb 10-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 620.448892][ T1034] usb 10-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 620.451756][ T1034] usb 10-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 620.454266][ T1034] usb 10-1: Manufacturer: syz [ 620.457650][ T1034] usb 10-1: config 0 descriptor?? [ 620.780424][T15557] siw: device registration error -23 [ 620.861873][T15563] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 620.887325][ T1034] rc_core: IR keymap rc-hauppauge not found [ 620.889885][ T1034] Registered IR keymap rc-empty [ 620.892913][ T1034] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 620.917382][ T1034] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 620.928741][T15533] oti6858 ttyUSB0: oti6858_open(): usb_submit_urb() failed with error -90 [ 620.938361][ T1034] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb10/10-1/10-1:0.0/rc/rc0 [ 620.946524][ T1034] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb10/10-1/10-1:0.0/rc/rc0/input112 [ 620.955891][ T1034] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 620.981319][ T1034] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 621.019209][ T1034] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 621.036864][T15532] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2619'. [ 621.037663][ T1034] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 621.062429][T15532] bond11: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 621.079336][T15532] bond11 (unregistering): Released all slaves [ 621.088742][ T1034] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 621.128582][ T1034] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 621.151064][ T1034] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 621.173938][ T1034] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 621.208351][ T1034] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 621.238643][ T1034] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 621.295632][ T1034] mceusb 10-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 621.300081][ T1034] mceusb 10-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 621.355357][ T1034] usb 10-1: USB disconnect, device number 18 [ 622.079199][T15576] i2c i2c-0: new_device: Instantiated device rt1719 at 0x49 [ 622.097745][T15576] wusb3801 0-004a: supply vbus not found, using dummy regulator [ 622.244340][ T5823] usb 9-1: USB disconnect, device number 47 [ 622.272231][T15583] sg_write: data in/out 1265126/1 bytes for SCSI command 0x32-- guessing data in; [ 622.272231][T15583] program syz.2.2634 not setting count and/or reply_len properly [ 622.279564][ T5823] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 622.298410][ T5823] oti6858 9-1:1.0: device disconnected [ 622.304612][T15576] i2c i2c-0: new_device: Instantiated device wusb3801 at 0x4a [ 622.443849][T15589] jffs2: notice: (15589) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 622.559515][T15589] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2636'. [ 622.656470][T15585] bond25: Removing last arp target with arp_interval on [ 622.672073][T15585] bond25: entered promiscuous mode [ 622.674315][T15585] bond25: entered allmulticast mode [ 622.678728][T15585] 8021q: adding VLAN 0 to HW filter on device bond25 [ 623.237426][ T9] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 623.559556][ T9] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 623.838359][T15600] ceph: No mds server is up or the cluster is laggy [ 623.886458][ T1432] ieee802154 phy0 wpan0: encryption failed: -22 [ 623.891111][ T1432] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.027099][T15614] 9pnet_virtio: no channels available for device syz [ 625.660718][ T29] usb 7-1: new high-speed USB device number 68 using dummy_hcd [ 625.817441][ T29] usb 7-1: Using ep0 maxpacket: 16 [ 625.824929][ T29] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 625.834362][ T29] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 625.845397][ T29] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 625.850741][ T29] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 625.854969][ T29] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 625.863145][ T29] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 625.869012][ T29] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 625.872900][ T29] usb 7-1: Manufacturer: syz [ 625.885450][ T29] usb 7-1: config 0 descriptor?? [ 626.139624][ T5746] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 626.197332][ T29] rc_core: IR keymap rc-hauppauge not found [ 626.199504][ T29] Registered IR keymap rc-empty [ 626.201346][ T29] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 626.218614][ T29] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 626.238834][ T29] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0 [ 626.245884][ T29] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0/input113 [ 626.256278][ T29] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 626.277452][ T29] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 626.297401][ T29] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 626.317607][ T29] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 626.337312][ T29] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 626.341864][T15629] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2645'. [ 626.357390][ T29] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 626.377640][ T29] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 626.397372][ T29] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 626.427396][ T29] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 626.454048][ T29] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 626.482209][ T29] mceusb 7-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 626.486680][ T29] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 626.489728][T15629] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 626.503691][T15629] bond3 (unregistering): Released all slaves [ 626.557301][ T9] usb 8-1: new high-speed USB device number 78 using dummy_hcd [ 626.707374][ T9] usb 8-1: Using ep0 maxpacket: 16 [ 626.715098][ T9] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 626.719611][ T9] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 626.729532][ T9] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 626.730580][ T1034] usb 7-1: USB disconnect, device number 68 [ 626.736103][ T9] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 626.741286][ T9] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 626.748939][ T9] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 626.751829][ T9] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 626.754434][ T9] usb 8-1: Manufacturer: syz [ 626.758733][ T9] usb 8-1: config 0 descriptor?? [ 627.018832][ T9] rc_core: IR keymap rc-hauppauge not found [ 627.022530][ T9] Registered IR keymap rc-empty [ 627.024351][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 627.039756][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 627.058261][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0 [ 627.066997][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0/input114 [ 627.079898][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 627.097324][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 627.117313][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 627.137296][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 627.157383][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 627.178007][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 627.197318][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 627.200591][T15640] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2648'. [ 627.217534][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 627.225195][T15640] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 627.235169][T15640] bond3 (unregistering): Released all slaves [ 627.237624][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 627.259047][ T9] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 627.282872][ T9] mceusb 8-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 627.289476][ T9] mceusb 8-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 627.534172][ T9] usb 8-1: USB disconnect, device number 78 [ 629.479926][ T29] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 629.751476][ T29] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 630.278356][T15676] ceph: No mds server is up or the cluster is laggy [ 630.281382][ T29] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 630.800554][T15679] kexec: Could not allocate control_code_buffer [ 630.813752][T15689] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2659'. [ 631.889721][ T5746] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 632.205980][T15702] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2661'. [ 632.298333][ T42] kauditd_printk_skb: 30 callbacks suppressed [ 632.298348][ T42] audit: type=1326 audit(1786174728.182:2315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15708 comm="syz.5.2665" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 632.309187][ T42] audit: type=1326 audit(1786174728.182:2316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15708 comm="syz.5.2665" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 632.318398][ T42] audit: type=1326 audit(1786174728.182:2317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15708 comm="syz.5.2665" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 632.327031][ T42] audit: type=1326 audit(1786174728.182:2318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15708 comm="syz.5.2665" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 632.336545][ T42] audit: type=1326 audit(1786174728.182:2319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15708 comm="syz.5.2665" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 632.345526][ T42] audit: type=1326 audit(1786174728.182:2320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15708 comm="syz.5.2665" exe="/syz-executor" sig=0 arch=40000003 syscall=146 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 632.352311][ T42] audit: type=1326 audit(1786174728.182:2321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15708 comm="syz.5.2665" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 632.360669][ T42] audit: type=1326 audit(1786174728.182:2322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15708 comm="syz.5.2665" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 632.367788][ T42] audit: type=1326 audit(1786174728.182:2323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15708 comm="syz.5.2665" exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71e74eb code=0x7ffc0000 [ 632.374804][ T42] audit: type=1326 audit(1786174728.192:2324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15708 comm="syz.5.2665" exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71e74eb code=0x7ffc0000 [ 632.680361][T15715] syzkaller0: entered promiscuous mode [ 632.685560][T15717] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2668'. [ 632.689687][T15715] syzkaller0: entered allmulticast mode [ 632.878834][T15698] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 633.335382][T15726] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 633.602740][T15733] xt_cluster: you have exceeded the maximum number of cluster nodes (37482740 > 32) [ 634.699791][T15745] bond26: Removing last arp target with arp_interval on [ 634.703444][T15745] bond26: entered promiscuous mode [ 634.705702][T15745] bond26: entered allmulticast mode [ 634.709403][T15745] 8021q: adding VLAN 0 to HW filter on device bond26 [ 635.339744][T15754] jffs2: notice: (15754) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 635.340892][T10284] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 635.355893][T15750] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2679'. [ 635.360106][T15754] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2682'. [ 635.458988][T15698] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 635.472743][T15698] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 635.476839][T15698] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 635.481909][T15698] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 635.486361][T15698] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 635.611107][T10284] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 635.664103][T15765] kvm: requested 46933 ns i8254 timer period limited to 200000 ns [ 635.747173][T15765] kvm: pic: level sensitive irq not supported [ 635.748093][T15765] kvm: pic: non byte read [ 635.754892][T15765] kvm: pic: level sensitive irq not supported [ 635.755312][T15765] kvm: pic: non byte read [ 635.772256][T10284] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 635.866301][T15777] xt_cluster: you have exceeded the maximum number of cluster nodes (37482740 > 32) [ 635.943704][T15780] overlay: ./file0 is not a directory [ 635.955496][T10284] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 635.982005][T15780] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 635.986210][T15780] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 636.505225][T15787] bond3: Removing last arp target with arp_interval on [ 636.508171][T15787] bond3: entered promiscuous mode [ 636.509935][T15787] bond3: entered allmulticast mode [ 636.511913][T15787] 8021q: adding VLAN 0 to HW filter on device bond3 [ 636.564587][T10284] bridge_slave_1: left allmulticast mode [ 636.566410][T10284] bridge_slave_1: left promiscuous mode [ 636.572799][T10284] bridge0: port 2(bridge_slave_1) entered disabled state [ 636.593036][T10284] bridge_slave_0: left allmulticast mode [ 636.600745][T10284] bridge_slave_0: left promiscuous mode [ 636.602731][T10284] bridge0: port 1(bridge_slave_0) entered disabled state [ 636.736831][T10284] batman_adv: batadv0: Removing interface: gretap1 [ 636.784881][T10284] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 636.791917][T10284] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 636.795850][T10284] bond0 (unregistering): Released all slaves [ 636.801346][T10284] bond1 (unregistering): Released all slaves [ 636.809463][T10284] bond2 (unregistering): Released all slaves [ 637.085455][ T5446] 8021q: adding VLAN 0 to HW filter on device eth11 [ 637.133363][T15756] bridge0: port 1(bridge_slave_0) entered blocking state [ 637.135745][T15756] bridge0: port 1(bridge_slave_0) entered disabled state [ 637.138620][T15756] bridge_slave_0: entered allmulticast mode [ 637.141457][T15756] bridge_slave_0: entered promiscuous mode [ 637.163443][T15756] bridge0: port 2(bridge_slave_1) entered blocking state [ 637.164713][T15807] netlink: 'syz.4.2689': attribute type 4 has an invalid length. [ 637.165800][T15756] bridge0: port 2(bridge_slave_1) entered disabled state [ 637.165969][T15756] bridge_slave_1: entered allmulticast mode [ 637.166810][T15756] bridge_slave_1: entered promiscuous mode [ 637.169118][T15807] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2689'. [ 637.186781][T15756] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 637.203751][T15756] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 637.226421][ T5094] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 637.287718][T15756] team0: Port device team_slave_0 added [ 637.291712][T15756] team0: Port device team_slave_1 added [ 637.311899][T15756] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 637.315880][T15756] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 637.327127][T15756] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 637.332363][T15812] jffs2: notice: (15812) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 637.343986][T15756] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 637.348862][T15756] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 637.366369][T15756] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 637.374493][T15812] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2690'. [ 637.488184][ T6381] usb 9-1: new high-speed USB device number 48 using dummy_hcd [ 637.491776][T15756] hsr_slave_0: entered promiscuous mode [ 637.502363][T15756] hsr_slave_1: entered promiscuous mode [ 637.507231][T15756] debugfs: 'hsr0' already exists in 'hsr' [ 637.511412][T15756] Cannot create hsr debugfs directory [ 637.588605][T10284] hsr_slave_0: left promiscuous mode [ 637.591291][T10284] hsr_slave_1: left promiscuous mode [ 637.596018][T10284] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 637.601253][T10284] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 637.608540][T10284] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 637.615913][T10284] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 637.638245][ T5094] Bluetooth: hci0: command tx timeout [ 637.654099][T10284] veth1_macvtap: left promiscuous mode [ 637.656170][T10284] veth0_macvtap: left promiscuous mode [ 637.660898][T10284] veth1_vlan: left promiscuous mode [ 637.661896][ T6381] usb 9-1: Using ep0 maxpacket: 32 [ 637.662764][T10284] veth0_vlan: left promiscuous mode [ 637.672351][ T6381] usb 9-1: config 0 has no interfaces? [ 637.692708][ T6381] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 637.723632][ T6381] usb 9-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 637.726653][ T6381] usb 9-1: Product: syz [ 637.728685][ T6381] usb 9-1: Manufacturer: syz [ 637.734536][ T6381] usb 9-1: SerialNumber: syz [ 637.934703][ T6381] usb 9-1: config 0 descriptor?? [ 638.296926][T10284] team0 (unregistering): Port device team_slave_1 removed [ 638.359068][T10284] team0 (unregistering): Port device team_slave_0 removed [ 638.487131][ T5446] 8021q: adding VLAN 0 to HW filter on device eth12 [ 638.550468][ T6381] usb 9-1: USB disconnect, device number 48 [ 638.782262][T15756] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 638.799699][T15756] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 638.810077][T15756] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 638.849809][T15756] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 638.853594][ T5446] 8021q: adding VLAN 0 to HW filter on device eth13 [ 638.856861][T15756] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 638.862385][T15756] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 638.870508][T15756] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 638.878175][T15756] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 638.973733][T15756] 8021q: adding VLAN 0 to HW filter on device bond0 [ 639.009927][T15756] 8021q: adding VLAN 0 to HW filter on device team0 [ 639.021768][ T1159] bridge0: port 1(bridge_slave_0) entered blocking state [ 639.024057][ T1159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 639.030365][ T1159] bridge0: port 2(bridge_slave_1) entered blocking state [ 639.032664][ T1159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 639.053653][ T5446] 8021q: adding VLAN 0 to HW filter on device eth14 [ 639.232774][T15859] Invalid logical block size (16) [ 639.261877][T15859] netlink: 'syz.4.2695': attribute type 11 has an invalid length. [ 639.341828][T15859] veth1_macvtap: entered promiscuous mode [ 639.352375][T15859] batman_adv: batadv0: Interface activated: gretap1 [ 639.369848][T15859] 8021q: adding VLAN 0 to HW filter on device eth0 [ 639.374000][T15859] 8021q: adding VLAN 0 to HW filter on device eth1 [ 639.377537][T15859] 8021q: adding VLAN 0 to HW filter on device eth2 [ 639.381351][T15859] 8021q: adding VLAN 0 to HW filter on device eth3 [ 639.389616][T15859] 8021q: adding VLAN 0 to HW filter on device bond19 [ 639.393148][T15859] bond19: entered allmulticast mode [ 639.394877][T15859] bridge1: entered allmulticast mode [ 639.397400][T15859] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 639.400560][T15859] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 639.403354][T15859] bridge1: entered promiscuous mode [ 639.437669][T15867] mac80211_hwsim hwsim11 wlan0: entered promiscuous mode [ 639.439998][T15867] mac80211_hwsim hwsim11 wlan0: entered allmulticast mode [ 639.572121][T15756] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 639.649122][T15872] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2696'. [ 639.727471][ T5094] Bluetooth: hci0: command tx timeout [ 639.842506][T15756] veth0_vlan: entered promiscuous mode [ 639.852832][T15756] veth1_vlan: entered promiscuous mode [ 639.952122][T15756] veth0_macvtap: entered promiscuous mode [ 640.086545][T15881] bond27: Removing last arp target with arp_interval on [ 640.100299][T15881] bond27: entered promiscuous mode [ 640.102421][T15881] bond27: entered allmulticast mode [ 640.107350][T15881] 8021q: adding VLAN 0 to HW filter on device bond27 [ 640.149623][T15756] veth1_macvtap: entered promiscuous mode [ 640.216826][T15756] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 640.247477][T15756] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 640.337333][T10284] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 640.342079][T10284] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 640.357955][T10065] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 640.361080][T10065] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 640.448571][ T1157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 640.452470][ T1157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 640.546691][ T1157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 640.552150][ T1157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 640.674543][T15888] netlink: 72 bytes leftover after parsing attributes in process `syz.6.2680'. [ 640.794607][T15891] 9pnet_virtio: no channels available for device syz [ 641.116530][T15892] bond1: Removing last arp target with arp_interval on [ 641.144363][T15892] bond1: entered promiscuous mode [ 641.151203][T15892] bond1: entered allmulticast mode [ 641.158122][T15892] 8021q: adding VLAN 0 to HW filter on device bond1 [ 641.301861][T15897] jffs2: notice: (15897) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 641.338290][T15897] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2699'. [ 641.799183][ T5094] Bluetooth: hci0: command tx timeout [ 642.219006][T15914] bond4: Removing last arp target with arp_interval on [ 642.228543][T15914] bond4: entered promiscuous mode [ 642.230421][T15914] bond4: entered allmulticast mode [ 642.235000][T15914] 8021q: adding VLAN 0 to HW filter on device bond4 [ 643.127594][T15922] syzkaller0: entered promiscuous mode [ 643.129366][T15922] syzkaller0: entered allmulticast mode [ 643.294375][ T5094] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 643.878570][ T5094] Bluetooth: hci0: command tx timeout [ 644.001905][ T5094] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 644.981435][T15947] overlay: ./file0 is not a directory [ 644.991991][T15947] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 644.998387][T15947] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 646.590043][ T60] usb 9-1: new high-speed USB device number 49 using dummy_hcd [ 646.751256][ T60] usb 9-1: Using ep0 maxpacket: 32 [ 646.756527][ T60] usb 9-1: config 0 has no interfaces? [ 646.791178][ T60] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 646.795065][ T60] usb 9-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 646.804707][ T60] usb 9-1: Product: syz [ 646.806530][ T60] usb 9-1: Manufacturer: syz [ 646.826052][ T60] usb 9-1: SerialNumber: syz [ 646.935838][ T60] usb 9-1: config 0 descriptor?? [ 648.173841][T11665] usb 9-1: USB disconnect, device number 49 [ 648.248053][ T41] usb 11-1: new full-speed USB device number 2 using dummy_hcd [ 648.398243][T16001] dlm: no local IP address has been set [ 648.400264][T16001] dlm: cannot start dlm midcomms -107 [ 648.427763][ T41] usb 11-1: not running at top speed; connect to a high speed hub [ 648.444386][ T41] usb 11-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 648.449158][ T41] usb 11-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 648.464217][ T41] usb 11-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 648.468895][ T41] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 648.472285][ T41] usb 11-1: Product: syz [ 648.474120][ T41] usb 11-1: Manufacturer: syz [ 648.480274][ T41] usb 11-1: SerialNumber: syz [ 648.491576][ T41] oti6858 11-1:1.0: oti6858 converter detected [ 648.510779][ T41] usb 11-1: oti6858 converter now attached to ttyUSB0 [ 648.840746][T15989] oti6858 ttyUSB0: oti6858_open(): usb_submit_urb() failed with error -90 [ 648.910144][T16010] overlay: ./file0 is not a directory [ 649.099593][T16010] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 649.123740][T16010] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 649.132759][T16015] overlay: ./file0 is not a directory [ 650.095225][T15698] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 651.051198][ T42] kauditd_printk_skb: 34 callbacks suppressed [ 651.051221][ T42] audit: type=1326 audit(1786174746.932:2359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16052 comm="syz.4.2727" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 651.077663][ T42] audit: type=1326 audit(1786174746.932:2360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16052 comm="syz.4.2727" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 651.090654][ T41] usb 11-1: USB disconnect, device number 2 [ 651.092344][ T42] audit: type=1326 audit(1786174746.952:2361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16052 comm="syz.4.2727" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 651.111002][ T42] audit: type=1326 audit(1786174746.952:2362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16052 comm="syz.4.2727" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 651.122085][ T42] audit: type=1326 audit(1786174746.952:2363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16052 comm="syz.4.2727" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 651.132823][ T42] audit: type=1326 audit(1786174746.952:2364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16052 comm="syz.4.2727" exe="/syz-executor" sig=0 arch=40000003 syscall=146 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 651.135382][ T41] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 651.141983][ T42] audit: type=1326 audit(1786174746.952:2365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16052 comm="syz.4.2727" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 651.155764][ T41] oti6858 11-1:1.0: device disconnected [ 651.165959][ T42] audit: type=1326 audit(1786174746.952:2366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16052 comm="syz.4.2727" exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71274eb code=0x7ffc0000 [ 651.204708][ T42] audit: type=1326 audit(1786174746.952:2367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16052 comm="syz.4.2727" exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71274eb code=0x7ffc0000 [ 651.235232][ T42] audit: type=1326 audit(1786174746.952:2368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16052 comm="syz.4.2727" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 651.368400][T16028] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 651.477409][T16028] Bluetooth: hci0: command 0x0406 tx timeout [ 651.518531][T16067] xt_cluster: you have exceeded the maximum number of cluster nodes (37482740 > 32) [ 651.669194][ T5094] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 651.690839][ T5094] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 652.355525][T16086] gretap1: entered promiscuous mode [ 652.368967][T16086] batman_adv: batadv0: Adding interface: gretap1 [ 652.371933][T16086] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 652.380550][T16086] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 652.700736][T16092] overlay: ./file0 is not a directory [ 652.771008][T16092] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 652.852519][T16094] siw: device registration error -23 [ 652.883523][T16092] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 652.928893][T16097] overlay: ./file0 is not a directory [ 652.936218][T16090] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 653.425000][T16109] tipc: Enabled bearer , priority 0 [ 654.417699][ T41] tipc: Node number set to 2035774871 [ 654.517871][ T6015] usb 9-1: new high-speed USB device number 50 using dummy_hcd [ 654.687803][ T6015] usb 9-1: Using ep0 maxpacket: 16 [ 654.692135][ T6015] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 654.702340][ T6015] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 654.713547][ T6015] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 654.724757][ T6015] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 654.730443][ T6015] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 654.763836][ T10] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 654.788446][T16136] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2748'. [ 654.871438][ T6015] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 655.029266][ T10] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 655.043452][ T6015] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 655.046241][ T6015] usb 9-1: Manufacturer: syz [ 655.050125][ T6015] usb 9-1: config 0 descriptor?? [ 655.311106][T16148] bond11: Removing last arp target with arp_interval on [ 655.315646][T16148] bond11: entered promiscuous mode [ 655.318055][T16148] bond11: entered allmulticast mode [ 655.321628][T16148] 8021q: adding VLAN 0 to HW filter on device bond11 [ 655.481363][T16129] ceph: No mds server is up or the cluster is laggy [ 655.507534][ T6015] rc_core: IR keymap rc-hauppauge not found [ 655.512606][ T6015] Registered IR keymap rc-empty [ 655.514760][ T6015] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 655.539780][ T6015] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 655.566887][ T5746] Bluetooth: hci4: command 0x0406 tx timeout [ 655.589847][ T6015] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 655.599177][ T6015] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input115 [ 655.610972][ T6015] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 655.618734][T16155] overlay: ./file0 is not a directory [ 655.627395][ T6015] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 655.635295][T16124] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2745'. [ 655.635361][T16155] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 655.643542][T16155] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 655.649474][ T6015] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 655.658267][T16124] bond28: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 655.665793][T16124] bond28 (unregistering): Released all slaves [ 655.680236][ T6015] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 655.708067][ T6015] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 655.729712][ T6015] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 655.748021][ T6015] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 655.767692][ T6015] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 655.792659][ T6015] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 655.809720][ T6015] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 655.826629][T16155] overlay: ./file0 is not a directory [ 655.829072][ T6015] mceusb 9-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 655.839059][ T6015] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 655.849660][ T6015] usb 9-1: USB disconnect, device number 50 [ 657.270192][T16173] xt_cluster: you have exceeded the maximum number of cluster nodes (37482740 > 32) [ 657.279885][T16173] binder: BINDER_SET_CONTEXT_MGR already set [ 657.282071][T16173] binder: 16172:16173 ioctl 4018620d 80000040 returned -16 [ 657.470811][T16179] syzkaller0: entered promiscuous mode [ 657.473119][T16179] syzkaller0: entered allmulticast mode [ 657.484177][T16179] tipc: Started in network mode [ 657.486292][T16179] tipc: Node identity deac43f80677, cluster identity 4711 [ 657.489774][T16179] tipc: Enabled bearer , priority 0 [ 657.495556][T16179] tipc: Resetting bearer [ 657.503368][T16178] tipc: Resetting bearer [ 657.526458][T16178] tipc: Disabling bearer [ 657.645845][T16181] syzkaller0: entered promiscuous mode [ 657.648110][T16181] syzkaller0: entered allmulticast mode [ 657.930744][T16183] binder: 16182:16183 ioctl c00c620f 800003c0 returned -22 [ 658.258883][T16191] netlink: 'syz.4.2763': attribute type 4 has an invalid length. [ 658.262332][T16191] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2763'. [ 658.537633][T11665] usb 9-1: new high-speed USB device number 51 using dummy_hcd [ 658.687459][T11665] usb 9-1: Using ep0 maxpacket: 32 [ 658.694653][T11665] usb 9-1: config 0 has no interfaces? [ 658.706089][T11665] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 658.709856][T11665] usb 9-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 658.713882][T11665] usb 9-1: Product: syz [ 658.715589][T11665] usb 9-1: Manufacturer: syz [ 658.720455][T11665] usb 9-1: SerialNumber: syz [ 658.760536][T11665] usb 9-1: config 0 descriptor?? [ 659.749140][ T42] kauditd_printk_skb: 38 callbacks suppressed [ 659.749154][ T42] audit: type=1326 audit(1786174755.632:2407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16196 comm="syz.5.2766" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 659.765387][ T42] audit: type=1326 audit(1786174755.642:2408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16196 comm="syz.5.2766" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 659.775283][ T42] audit: type=1326 audit(1786174755.642:2409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16196 comm="syz.5.2766" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 659.788286][ T42] audit: type=1326 audit(1786174755.642:2410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16196 comm="syz.5.2766" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 659.797454][ T42] audit: type=1326 audit(1786174755.642:2411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16196 comm="syz.5.2766" exe="/syz-executor" sig=0 arch=40000003 syscall=146 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 659.797623][ T5746] Bluetooth: hci0: command 0x0406 tx timeout [ 659.817259][ T42] audit: type=1326 audit(1786174755.642:2412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16196 comm="syz.5.2766" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 659.825030][ T42] audit: type=1326 audit(1786174755.642:2413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16196 comm="syz.5.2766" exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71e74eb code=0x7ffc0000 [ 659.836900][ T42] audit: type=1326 audit(1786174755.642:2414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16196 comm="syz.5.2766" exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71e74eb code=0x7ffc0000 [ 659.849247][ T42] audit: type=1326 audit(1786174755.642:2415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16196 comm="syz.5.2766" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 659.861760][ T42] audit: type=1326 audit(1786174755.642:2416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16196 comm="syz.5.2766" exe="/syz-executor" sig=0 arch=40000003 syscall=91 compat=1 ip=0xf7fe4fec code=0x7ffc0000 [ 659.929816][T16028] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 659.974103][T11665] usb 9-1: USB disconnect, device number 51 [ 660.248003][ T9527] batman_adv: batadv0: Removing interface: gretap1 [ 660.283793][T16203] netlink: 'syz.6.2765': attribute type 4 has an invalid length. [ 660.286795][T16203] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2765'. [ 660.406972][ T9527] bond0 (unregistering): Released all slaves [ 660.417753][ T9527] bond1 (unregistering): Released all slaves [ 660.432534][ T9527] bond2 (unregistering): Released all slaves [ 660.450658][ T9527] bond3 (unregistering): Released all slaves [ 660.458446][ T9527] bond4 (unregistering): Released all slaves [ 660.465984][ T9527] bond5 (unregistering): Released all slaves [ 660.473563][ T9527] bond6 (unregistering): Released all slaves [ 660.480980][ T9527] bond7 (unregistering): Released all slaves [ 660.489434][ T9527] bond8 (unregistering): Released all slaves [ 660.502298][ T9527] bond9 (unregistering): Released all slaves [ 660.522813][ T9527] bond10 (unregistering): Released all slaves [ 660.556734][ T9527] bond11 (unregistering): Released all slaves [ 660.591236][ T9527] bond12 (unregistering): Released all slaves [ 660.603905][ T9527] bond13 (unregistering): Released all slaves [ 660.676235][ T9527] bond14 (unregistering): Released all slaves [ 660.696305][ T9527] bond15 (unregistering): Released all slaves [ 660.723802][ T9527] bond16 (unregistering): Released all slaves [ 660.737324][ T5925] usb 11-1: new high-speed USB device number 3 using dummy_hcd [ 660.742711][ T9527] bond17 (unregistering): Released all slaves [ 660.757941][ T9527] bond18 (unregistering): Released all slaves [ 660.921978][ T5925] usb 11-1: Using ep0 maxpacket: 32 [ 660.930526][ T5925] usb 11-1: config 0 has no interfaces? [ 660.968948][ T5925] usb 11-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 660.972132][ T5925] usb 11-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 660.985255][ T5925] usb 11-1: Product: syz [ 660.989647][ T5925] usb 11-1: Manufacturer: syz [ 661.002582][ T5925] usb 11-1: SerialNumber: syz [ 661.016134][ T5925] usb 11-1: config 0 descriptor?? [ 661.056592][ T9527] tipc: Disabling bearer [ 661.134084][ T9527] tipc: Left network mode [ 661.141252][T16208] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 661.271647][T16215] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2771'. [ 661.391867][ T24] usb 11-1: USB disconnect, device number 3 [ 661.719172][ T9527] hsr_slave_0: left promiscuous mode [ 661.722155][ T9527] hsr_slave_1: left promiscuous mode [ 661.727570][T16222] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 661.735165][ T9527] veth0_macvtap: left promiscuous mode [ 661.739604][ T9527] veth0_vlan: left promiscuous mode [ 662.045066][T16233] siw: device registration error -23 [ 662.128664][T16239] scsi host6: ib_srp: Connection 0/4 to 0.0.0.0 failed [ 662.345868][ T1157] smc: removing ib device syz0 [ 662.967945][ T1157] smbdirect: ib_dev[syz0] removed [ 663.254423][T16256] netlink: 'syz.5.2779': attribute type 4 has an invalid length. [ 663.257109][T16256] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2779'. [ 663.557482][T11665] usb 10-1: new high-speed USB device number 19 using dummy_hcd [ 663.647309][ T60] usb 11-1: new full-speed USB device number 4 using dummy_hcd [ 663.798852][ T60] usb 11-1: not running at top speed; connect to a high speed hub [ 663.805312][ T60] usb 11-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 663.818114][ T60] usb 11-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 663.826301][ T60] usb 11-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 663.836078][ T60] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 663.838962][ T60] usb 11-1: Product: syz [ 663.840369][ T60] usb 11-1: Manufacturer: syz [ 663.852212][ T60] usb 11-1: SerialNumber: syz [ 663.883475][ T60] oti6858 11-1:1.0: oti6858 converter detected [ 663.907882][ T60] usb 11-1: oti6858 converter now attached to ttyUSB0 [ 664.198518][T11665] usb 10-1: Using ep0 maxpacket: 32 [ 664.275152][T16260] oti6858 ttyUSB0: oti6858_open(): usb_submit_urb() failed with error -90 [ 664.283186][T11665] usb 10-1: config 0 has no interfaces? [ 664.400777][T11665] usb 10-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 664.405217][ T9527] IPVS: stop unused estimator thread 0... [ 664.416063][T11665] usb 10-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 664.423782][T11665] usb 10-1: Product: syz [ 664.425213][T11665] usb 10-1: Manufacturer: syz [ 664.431324][T11665] usb 10-1: SerialNumber: syz [ 664.614289][T11665] usb 10-1: config 0 descriptor?? [ 664.941306][T11665] usb 10-1: USB disconnect, device number 19 [ 665.052931][T16280] jffs2: notice: (16280) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 665.092300][T16280] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2781'. [ 665.469759][T16290] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2782'. [ 665.589960][T16293] xt_cluster: you have exceeded the maximum number of cluster nodes (37482740 > 32) [ 666.409096][T16028] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 666.553400][ T10] usb 11-1: USB disconnect, device number 4 [ 666.563731][ T10] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 666.567098][ T10] oti6858 11-1:1.0: device disconnected [ 666.687875][T16324] bond2: Removing last arp target with arp_interval on [ 666.693891][T16324] bond2: entered promiscuous mode [ 666.696182][T16324] bond2: entered allmulticast mode [ 666.699846][T16324] 8021q: adding VLAN 0 to HW filter on device bond2 [ 666.857270][T15886] usb 9-1: new high-speed USB device number 52 using dummy_hcd [ 667.007340][T15886] usb 9-1: Using ep0 maxpacket: 16 [ 667.013865][T15886] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 667.018792][T15886] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 667.025231][T15886] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 667.030689][T15886] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 667.035565][T15886] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 667.044360][T15886] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 667.047776][T15886] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 667.052224][T15886] usb 9-1: Manufacturer: syz [ 667.057371][T15886] usb 9-1: config 0 descriptor?? [ 667.457378][ T5823] usb 10-1: new high-speed USB device number 20 using dummy_hcd [ 667.548188][T15886] rc_core: IR keymap rc-hauppauge not found [ 667.552843][T15886] Registered IR keymap rc-empty [ 667.554938][T15886] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 667.580518][T15886] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 667.608050][T15886] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 667.636625][T15886] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input116 [ 667.683939][T16322] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2790'. [ 667.705116][T15886] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 667.728378][T16322] bond28: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 667.728480][T15886] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 667.747487][T16322] bond28 (unregistering): Released all slaves [ 667.760967][T15886] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 667.802220][T15886] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 667.817786][T15886] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 667.848580][T15886] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 667.869676][T15886] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 667.887742][T15886] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 667.917819][T15886] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 667.938657][T15886] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 667.983341][T15886] mceusb 9-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 667.987084][T15886] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 668.031440][T15886] usb 9-1: USB disconnect, device number 52 [ 668.088247][ T5823] usb 10-1: Using ep0 maxpacket: 8 [ 668.414989][ T5823] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 668.417729][ T5823] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 668.420740][ T5823] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 668.423741][ T5823] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 668.732432][ T5823] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 668.738741][ T5823] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 668.743600][ T5823] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.978055][T16028] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 669.061686][ T5823] usb 10-1: GET_CAPABILITIES returned 0 [ 669.063649][ T5823] usbtmc 10-1:16.0: can't read capabilities [ 669.109866][T16028] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 669.497238][ T60] usb 7-1: new full-speed USB device number 69 using dummy_hcd [ 669.548738][ T10] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 669.658558][ T60] usb 7-1: not running at top speed; connect to a high speed hub [ 669.663020][ T60] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 669.669072][ T60] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 669.675113][ T60] usb 7-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 669.679210][ T60] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 669.682458][ T60] usb 7-1: Product: syz [ 669.684140][ T60] usb 7-1: Manufacturer: syz [ 669.685999][ T60] usb 7-1: SerialNumber: syz [ 669.713953][ T60] oti6858 7-1:1.0: oti6858 converter detected [ 669.723213][ T60] usb 7-1: oti6858 converter now attached to ttyUSB0 [ 669.813078][ T10] libceph: mon0 (1)127.0.0.1:12345 socket error on write [ 669.972919][T16369] overlay: ./file0 is not a directory [ 669.983241][T16369] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 669.985808][T16369] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 670.088917][T16351] oti6858 ttyUSB0: oti6858_open(): usb_submit_urb() failed with error -90 [ 670.121511][T16370] overlay: ./file0 is not a directory [ 670.232745][T16361] ceph: No mds server is up or the cluster is laggy [ 670.326136][T16374] 9pnet_virtio: no channels available for device syz [ 670.755960][ T5889] usb 10-1: USB disconnect, device number 20 [ 670.872860][T16378] netlink: 'syz.5.2803': attribute type 4 has an invalid length. [ 670.875976][T16378] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2803'. [ 671.477405][ T5889] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 672.198282][ T5889] usb 10-1: Using ep0 maxpacket: 32 [ 672.304108][ T60] usb 7-1: USB disconnect, device number 69 [ 672.406516][ T60] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 672.430319][ T60] oti6858 7-1:1.0: device disconnected [ 672.489092][T16383] ceph: No mds server is up or the cluster is laggy [ 672.642020][ T5746] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 672.681398][ T5889] usb 10-1: config 0 has no interfaces? [ 672.708689][ T5889] usb 10-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 672.711696][ T5889] usb 10-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 672.714350][ T5889] usb 10-1: Product: syz [ 672.715722][ T5889] usb 10-1: Manufacturer: syz [ 672.717498][ T5889] usb 10-1: SerialNumber: syz [ 672.720481][ T5889] usb 10-1: config 0 descriptor?? [ 672.785141][T16395] syzkaller0: entered promiscuous mode [ 672.792890][T16395] syzkaller0: entered allmulticast mode [ 672.886022][T16402] overlay: ./file0 is not a directory [ 672.907655][T16402] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 672.910686][T16402] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 672.954261][ T41] usb 10-1: USB disconnect, device number 21 [ 673.050417][T16402] overlay: ./file0 is not a directory [ 673.168455][T16408] jffs2: notice: (16408) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 673.190249][T16408] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2812'. [ 674.389280][T16417] ceph: No mds server is up or the cluster is laggy [ 674.515565][T16432] syzkaller0: entered promiscuous mode [ 674.517766][T16432] syzkaller0: entered allmulticast mode [ 674.677660][ T5889] usb 11-1: new full-speed USB device number 5 using dummy_hcd [ 674.892178][ T5889] usb 11-1: not running at top speed; connect to a high speed hub [ 675.019487][T10079] ================================================================== [ 675.021991][T10079] BUG: KASAN: slab-use-after-free in _raw_spin_lock_bh+0x33/0x40 [ 675.024390][T10079] Read of size 1 at addr ffff88802a3325a0 by task syz.4.1117/10079 [ 675.027025][T10079] [ 675.028652][T10079] CPU: 1 UID: 0 PID: 10079 Comm: syz.4.1117 Tainted: G L syzkaller #0 PREEMPT(full) [ 675.028671][T10079] Tainted: [L]=SOFTLOCKUP [ 675.028675][T10079] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 675.028683][T10079] Call Trace: [ 675.028688][T10079] [ 675.028693][T10079] dump_stack_lvl+0x100/0x190 [ 675.028714][T10079] print_report+0x13d/0x4b0 [ 675.028745][T10079] ? __virt_addr_valid+0x239/0x430 [ 675.028766][T10079] ? _raw_spin_lock_bh+0x33/0x40 [ 675.028780][T10079] kasan_report+0xdf/0x1c0 [ 675.028799][T10079] ? _raw_spin_lock_bh+0x33/0x40 [ 675.028813][T10079] ? _raw_spin_lock_bh+0x33/0x40 [ 675.028826][T10079] __kasan_check_byte+0x36/0x50 [ 675.028842][T10079] lock_acquire+0x132/0x370 [ 675.028853][T10079] ? do_raw_spin_lock+0x128/0x260 [ 675.028866][T10079] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 675.028879][T10079] _raw_spin_lock_bh+0x33/0x40 [ 675.028892][T10079] ? bt_accept_unlink+0x64/0x370 [ 675.028934][T10079] bt_accept_unlink+0x64/0x370 [ 675.028947][T10079] ? __local_bh_enable_ip+0x9e/0x120 [ 675.028962][T10079] l2cap_sock_teardown_cb+0x1a3/0x3f0 [ 675.028983][T10079] l2cap_chan_del+0xa6/0x920 [ 675.028996][T10079] l2cap_conn_del+0x34f/0x6b0 [ 675.029010][T10079] ? __pfx_l2cap_disconn_cfm+0x10/0x10 [ 675.029042][T10079] l2cap_disconn_cfm+0x9f/0x100 [ 675.029055][T10079] hci_conn_hash_flush+0x10e/0x280 [ 675.029076][T10079] hci_dev_close_sync+0x5cf/0x13c0 [ 675.029099][T10079] ? find_held_lock+0x2b/0x80 [ 675.029115][T10079] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 675.029127][T10079] hci_dev_do_close+0x2e/0xb0 [ 675.029144][T10079] hci_unregister_dev+0x23f/0x690 [ 675.029161][T10079] vhci_release+0x17d/0x230 [ 675.029200][T10079] ? __pfx_vhci_release+0x10/0x10 [ 675.029213][T10079] __fput+0x3ff/0xb50 [ 675.029231][T10079] task_work_run+0x150/0x240 [ 675.029248][T10079] ? __pfx_task_work_run+0x10/0x10 [ 675.029267][T10079] do_exit+0x951/0x2ae0 [ 675.029284][T10079] ? __pfx_do_exit+0x10/0x10 [ 675.029299][T10079] ? cgroup_update_frozen_flag+0x125/0x240 [ 675.029316][T10079] ? find_held_lock+0x2b/0x80 [ 675.029333][T10079] ? get_signal+0x184f/0x21e0 [ 675.029347][T10079] do_group_exit+0xd5/0x2a0 [ 675.029364][T10079] get_signal+0x1ec7/0x21e0 [ 675.029378][T10079] ? __pfx_get_signal+0x10/0x10 [ 675.029390][T10079] ? __pfx_hrtimer_nanosleep+0x10/0x10 [ 675.029416][T10079] arch_do_signal_or_restart+0x91/0x7a0 [ 675.029436][T10079] ? get_old_timespec32+0xda/0x130 [ 675.029454][T10079] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 675.029467][T10079] ? __ia32_sys_clock_nanosleep_time32+0x363/0x480 [ 675.029487][T10079] exit_to_user_mode_loop+0x139/0x6f0 [ 675.029500][T10079] ? rcu_is_watching+0x12/0xc0 [ 675.029515][T10079] do_int80_emulation+0x513/0x720 [ 675.029535][T10079] asm_int80_emulation+0x1a/0x20 [ 675.029547][T10079] RIP: 0023:0xf71274eb [ 675.029556][T10079] Code: Unable to access opcode bytes at 0xf71274c1. [ 675.029562][T10079] RSP: 002b:00000000f53dd3ac EFLAGS: 00000246 ORIG_RAX: 000000000000010b [ 675.029574][T10079] RAX: fffffffffffffdfc RBX: 0000000000000000 RCX: 0000000000000000 [ 675.029582][T10079] RDX: 00000000f53dd444 RSI: 00000000f53dd43c RDI: 0000000000000000 [ 675.029589][T10079] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 675.029595][T10079] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 675.029602][T10079] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 675.029612][T10079] [ 675.029617][T10079] [ 675.132988][T10079] Allocated by task 60: [ 675.134289][T10079] kasan_save_stack+0x30/0x50 [ 675.135777][T10079] kasan_save_track+0x14/0x30 [ 675.137284][T10079] __kasan_kmalloc+0xaa/0xb0 [ 675.138741][T10079] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 675.140600][T10079] tty_register_device_attr+0x221/0x7f0 [ 675.142427][T10079] usb_serial_device_probe+0x187/0x3e0 [ 675.144165][T10079] really_probe+0x241/0xa60 [ 675.145604][T10079] __driver_probe_device+0x20e/0x450 [ 675.147173][T10079] driver_probe_device+0x4a/0x140 [ 675.148681][T10079] __device_attach_driver+0x1df/0x320 [ 675.150318][T10079] bus_for_each_drv+0x159/0x1e0 [ 675.151853][T10079] __device_attach+0x1e4/0x4d0 [ 675.153369][T10079] device_initial_probe+0xaf/0xd0 [ 675.154991][T10079] bus_probe_device+0x64/0x160 [ 675.156500][T10079] device_add+0x121d/0x1970 [ 675.157938][T10079] usb_serial_probe.cold+0x257e/0x29f8 [ 675.159563][T10079] usb_probe_interface+0x303/0x8f0 [ 675.161165][T10079] really_probe+0x241/0xa60 [ 675.162607][T10079] __driver_probe_device+0x20e/0x450 [ 675.164193][T10079] driver_probe_device+0x4a/0x140 [ 675.165771][T10079] __device_attach_driver+0x1df/0x320 [ 675.167462][T10079] bus_for_each_drv+0x159/0x1e0 [ 675.168983][T10079] __device_attach+0x1e4/0x4d0 [ 675.170440][T10079] device_initial_probe+0xaf/0xd0 [ 675.171952][T10079] bus_probe_device+0x64/0x160 [ 675.173444][T10079] device_add+0x121d/0x1970 [ 675.174868][T10079] usb_set_configuration+0xd97/0x1c60 [ 675.176543][T10079] usb_generic_driver_probe+0xa1/0xe0 [ 675.178246][T10079] usb_probe_device+0xef/0x400 [ 675.179972][T10079] really_probe+0x241/0xa60 [ 675.181442][T10079] __driver_probe_device+0x20e/0x450 [ 675.183108][T10079] driver_probe_device+0x4a/0x140 [ 675.184690][T10079] __device_attach_driver+0x1df/0x320 [ 675.186384][T10079] bus_for_each_drv+0x159/0x1e0 [ 675.187922][T10079] __device_attach+0x1e4/0x4d0 [ 675.189359][T10079] device_initial_probe+0xaf/0xd0 [ 675.190934][T10079] bus_probe_device+0x64/0x160 [ 675.192447][T10079] device_add+0x121d/0x1970 [ 675.193882][T10079] usb_new_device.cold+0x685/0x115c [ 675.195514][T10079] hub_event+0x30a3/0x4a60 [ 675.197002][T10079] process_one_work+0xa23/0x1940 [ 675.198636][T10079] worker_thread+0x5ef/0xe50 [ 675.200100][T10079] kthread+0x370/0x450 [ 675.201404][T10079] ret_from_fork+0x72b/0xd50 [ 675.202866][T10079] ret_from_fork_asm+0x1a/0x30 [ 675.204357][T10079] [ 675.205123][T10079] Freed by task 60: [ 675.206328][T10079] kasan_save_stack+0x30/0x50 [ 675.207831][T10079] kasan_save_track+0x14/0x30 [ 675.209247][T10079] kasan_save_free_info+0x3b/0x70 [ 675.210803][T10079] __kasan_slab_free+0x5f/0x80 [ 675.212275][T10079] kfree+0x22b/0x6c0 [ 675.213506][T10079] device_release+0xd2/0x270 [ 675.214963][T10079] kobject_put+0x1f7/0x640 [ 675.216381][T10079] device_unregister+0x2f/0xe0 [ 675.217923][T10079] device_destroy+0x99/0xe0 [ 675.219358][T10079] tty_unregister_device+0x82/0x1c0 [ 675.221001][T10079] usb_serial_device_remove+0xc9/0x1a0 [ 675.222725][T10079] device_remove+0xcb/0x180 [ 675.224168][T10079] device_release_driver_internal+0x44e/0x620 [ 675.226062][T10079] bus_remove_device+0x2bc/0x560 [ 675.227637][T10079] device_del+0x376/0x9b0 [ 675.228976][T10079] usb_serial_disconnect+0x21e/0x490 [ 675.230518][T10079] usb_unbind_interface+0x1dd/0x9e0 [ 675.232072][T10079] device_remove+0x12a/0x180 [ 675.233461][T10079] device_release_driver_internal+0x44e/0x620 [ 675.235329][T10079] bus_remove_device+0x2bc/0x560 [ 675.236901][T10079] device_del+0x376/0x9b0 [ 675.238266][T10079] usb_disable_device+0x367/0x810 [ 675.239872][T10079] usb_disconnect+0x2e2/0x9a0 [ 675.241361][T10079] hub_event+0x1c4f/0x4a60 [ 675.242742][T10079] process_one_work+0xa23/0x1940 [ 675.244312][T10079] worker_thread+0x5ef/0xe50 [ 675.245776][T10079] kthread+0x370/0x450 [ 675.247084][T10079] ret_from_fork+0x72b/0xd50 [ 675.248535][T10079] ret_from_fork_asm+0x1a/0x30 [ 675.250062][T10079] [ 675.250829][T10079] The buggy address belongs to the object at ffff88802a332000 [ 675.250829][T10079] which belongs to the cache kmalloc-2k of size 2048 [ 675.255080][T10079] The buggy address is located 1440 bytes inside of [ 675.255080][T10079] freed 2048-byte region [ffff88802a332000, ffff88802a332800) [ 675.259335][T10079] [ 675.260134][T10079] The buggy address belongs to the physical page: [ 675.262117][T10079] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802a332000 pfn:0x2a330 [ 675.265221][T10079] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 675.267845][T10079] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 675.270451][T10079] page_type: f5(slab) [ 675.271712][T10079] raw: 00fff00000000240 ffff88801bc42f00 ffffea000050dc10 ffffea00004eb210 [ 675.274365][T10079] raw: ffff88802a332000 0000000800080006 00000000f5000000 0000000000000000 [ 675.277058][T10079] head: 00fff00000000240 ffff88801bc42f00 ffffea000050dc10 ffffea00004eb210 [ 675.279723][T10079] head: ffff88802a332000 0000000800080006 00000000f5000000 0000000000000000 [ 675.282407][T10079] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 675.285094][T10079] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 675.287756][T10079] page dumped because: kasan: bad access detected [ 675.289746][T10079] page_owner tracks the page as allocated [ 675.291513][T10079] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5132, tgid 5132 (klogd), ts 78894875603, free_ts 49225804303 [ 675.297775][T10079] post_alloc_hook+0xfd/0x120 [ 675.299213][T10079] get_page_from_freelist+0xf48/0x3530 [ 675.300887][T10079] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 675.302749][T10079] new_slab+0xa2/0x640 [ 675.304041][T10079] refill_objects+0xe3/0x410 [ 675.305503][T10079] __pcs_replace_empty_main+0x376/0x680 [ 675.307272][T10079] __kmalloc_cache_noprof+0x479/0x6c0 [ 675.308979][T10079] syslog_print+0xf8/0x620 [ 675.310444][T10079] do_syslog+0x5bd/0x6d0 [ 675.311783][T10079] __x64_sys_syslog+0x74/0xb0 [ 675.313325][T10079] do_syscall_64+0x115/0x840 [ 675.314791][T10079] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.316638][T10079] page last free pid 5141 tgid 5141 stack trace: [ 675.318617][T10079] __free_frozen_pages+0x79f/0x1090 [ 675.320254][T10079] qlist_free_all+0x47/0xf0 [ 675.321704][T10079] kasan_quarantine_reduce+0x1a0/0x1f0 [ 675.323420][T10079] __kasan_slab_alloc+0x69/0x90 [ 675.324954][T10079] __kmalloc_flags_noprof+0x30d/0x8b0 [ 675.326618][T10079] __pcs_replace_empty_main+0x41a/0x680 [ 675.328268][T10079] kmem_cache_alloc_noprof+0x46e/0x6a0 [ 675.329928][T10079] ima_inode_get+0x11f/0x580 [ 675.331354][T10079] process_measurement+0x575/0x2350 [ 675.332925][T10079] ima_bprm_check+0x116/0x180 [ 675.334343][T10079] security_bprm_check+0xd7/0x1e0 [ 675.335914][T10079] bprm_execve+0x84b/0x1730 [ 675.337359][T10079] do_execveat_common.isra.0+0x4a5/0x580 [ 675.339108][T10079] __x64_sys_execve+0x93/0xd0 [ 675.340588][T10079] do_syscall_64+0x115/0x840 [ 675.342059][T10079] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.343913][T10079] [ 675.344677][T10079] Memory state around the buggy address: [ 675.346435][T10079] ffff88802a332480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 675.348906][T10079] ffff88802a332500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 675.351417][T10079] >ffff88802a332580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 675.353895][T10079] ^ [ 675.355491][T10079] ffff88802a332600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 675.357972][T10079] ffff88802a332680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 675.360473][T10079] ================================================================== [ 675.363112][T10079] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 675.365366][T10079] CPU: 1 UID: 0 PID: 10079 Comm: syz.4.1117 Tainted: G L syzkaller #0 PREEMPT(full) [ 675.368740][T10079] Tainted: [L]=SOFTLOCKUP SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 675.370115][T10079] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 675.373392][T10079] Call Trace: [ 675.374449][T10079] [ 675.375388][T10079] dump_stack_lvl+0x100/0x190 [ 675.376869][T10079] vpanic+0x552/0x970 [ 675.378140][T10079] ? __pfx_vpanic+0x10/0x10 [ 675.379575][T10079] ? mark_held_locks+0x40/0x70 [ 675.381120][T10079] ? irqentry_exit+0x24d/0xa00 [ 675.382627][T10079] ? _raw_spin_lock_bh+0x33/0x40 [ 675.384410][T10079] panic+0xd1/0xe0 [ 675.385753][T10079] ? __pfx_panic+0x10/0x10 [ 675.387165][T10079] ? check_panic_on_warn+0x1f/0x90 [ 675.388795][T10079] check_panic_on_warn.cold+0x19/0x34 [ 675.390504][T10079] end_report.part.0+0x3a/0x90 [ 675.392021][T10079] kasan_report.cold+0xe/0x18 [ 675.393522][T10079] ? _raw_spin_lock_bh+0x33/0x40 [ 675.395077][T10079] ? _raw_spin_lock_bh+0x33/0x40 [ 675.396634][T10079] __kasan_check_byte+0x36/0x50 [ 675.398225][T10079] lock_acquire+0x132/0x370 [ 675.399661][T10079] ? do_raw_spin_lock+0x128/0x260 [ 675.401190][T10079] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 675.402872][T10079] _raw_spin_lock_bh+0x33/0x40 [ 675.404382][T10079] ? bt_accept_unlink+0x64/0x370 [ 675.405937][T10079] bt_accept_unlink+0x64/0x370 [ 675.407490][T10079] ? __local_bh_enable_ip+0x9e/0x120 [ 675.409153][T10079] l2cap_sock_teardown_cb+0x1a3/0x3f0 [ 675.410871][T10079] l2cap_chan_del+0xa6/0x920 [ 675.412334][T10079] l2cap_conn_del+0x34f/0x6b0 [ 675.413819][T10079] ? __pfx_l2cap_disconn_cfm+0x10/0x10 [ 675.415528][T10079] l2cap_disconn_cfm+0x9f/0x100 [ 675.417149][T10079] hci_conn_hash_flush+0x10e/0x280 [ 675.418770][T10079] hci_dev_close_sync+0x5cf/0x13c0 [ 675.420377][T10079] ? find_held_lock+0x2b/0x80 [ 675.421909][T10079] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 675.423603][T10079] hci_dev_do_close+0x2e/0xb0 [ 675.425004][T10079] hci_unregister_dev+0x23f/0x690 [ 675.426528][T10079] vhci_release+0x17d/0x230 [ 675.427950][T10079] ? __pfx_vhci_release+0x10/0x10 [ 675.429506][T10079] __fput+0x3ff/0xb50 [ 675.430719][T10079] task_work_run+0x150/0x240 [ 675.432077][T10079] ? __pfx_task_work_run+0x10/0x10 [ 675.433583][T10079] do_exit+0x951/0x2ae0 [ 675.434808][T10079] ? __pfx_do_exit+0x10/0x10 [ 675.436166][T10079] ? cgroup_update_frozen_flag+0x125/0x240 [ 675.437894][T10079] ? find_held_lock+0x2b/0x80 [ 675.439285][T10079] ? get_signal+0x184f/0x21e0 [ 675.440697][T10079] do_group_exit+0xd5/0x2a0 [ 675.442080][T10079] get_signal+0x1ec7/0x21e0 [ 675.443443][T10079] ? __pfx_get_signal+0x10/0x10 [ 675.444888][T10079] ? __pfx_hrtimer_nanosleep+0x10/0x10 [ 675.446504][T10079] arch_do_signal_or_restart+0x91/0x7a0 [ 675.448133][T10079] ? get_old_timespec32+0xda/0x130 [ 675.449683][T10079] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 675.451498][T10079] ? __ia32_sys_clock_nanosleep_time32+0x363/0x480 [ 675.453419][T10079] exit_to_user_mode_loop+0x139/0x6f0 [ 675.455007][T10079] ? rcu_is_watching+0x12/0xc0 [ 675.456444][T10079] do_int80_emulation+0x513/0x720 [ 675.457963][T10079] asm_int80_emulation+0x1a/0x20 [ 675.459469][T10079] RIP: 0023:0xf71274eb [ 675.460689][T10079] Code: Unable to access opcode bytes at 0xf71274c1. [ 675.462710][T10079] RSP: 002b:00000000f53dd3ac EFLAGS: 00000246 ORIG_RAX: 000000000000010b [ 675.465190][T10079] RAX: fffffffffffffdfc RBX: 0000000000000000 RCX: 0000000000000000 [ 675.467513][T10079] RDX: 00000000f53dd444 RSI: 00000000f53dd43c RDI: 0000000000000000 [ 675.469889][T10079] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 675.472209][T10079] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 675.474541][T10079] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 675.476871][T10079] [ 675.478497][T10079] Kernel Offset: disabled [ 675.479815][T10079] Rebooting in 86400 seconds.. VM DIAGNOSIS: 07:39:31 Registers: info registers vcpu 0 CPU#0 RAX=0000000000dfae35 RBX=ffffffff8e891480 RCX=ffffffff8bb81335 RDX=0000000000000000 RSI=ffffffff8e1a2693 RDI=ffffffff8c3fe580 RBP=fffffbfff1d12290 RSP=ffffffff8e807e10 R8 =0000000000000001 R9 =ffffed100564678d R10=ffff88802b233c6b R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffffffff1d00fc6 R15=dffffc0000000000 RIP=ffffffff8bb7f8ff RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096bf3000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000080c64000 CR3=0000000000dce000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000a000000000 0000000200000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=dffffc0000000060 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd RSI=ffffffff85a0deb0 RDI=ffffffff9b9e3520 RBP=ffffffff9b9e34e0 RSP=ffffc90006e57070 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3230383838666666 R12=0000000000000000 R13=0000000000000060 R14=fffffbfff373c6f6 R15=dffffc0000000000 RIP=ffffffff85a0ded7 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096cf3000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f51acf49 CR3=0000000000dce000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000005000000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=ffffffff9b724600 RBX=ffffe8ffac247fc0 RCX=ffffc9000cf41000 RDX=0000000000080000 RSI=ffffffff82023a7e RDI=0000000000000001 RBP=ffff88806ccb6000 RSP=ffffc90002e6f788 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000003 R11=0000000000000000 R12=00000000000023a6 R13=0000000000000002 R14=ffffffff9121eb84 R15=ffff888027e4cbb8 RIP=ffffffff81d4cfbc RFL=00000086 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096df3000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000080002000 CR3=0000000057332000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000005000000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=00000000012cfa4d RBX=ffff88801c7f2540 RCX=ffffffff8bb81335 RDX=0000000000000000 RSI=ffffffff8e1a2693 RDI=ffffffff8c3fe580 RBP=ffffed10038fe4a8 RSP=ffffc9000048fe00 R8 =0000000000000001 R9 =ffffed10056a678d R10=ffff88802b533c6b R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff92000091fc4 R15=dffffc0000000000 RIP=ffffffff8bb7f8ff RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096ef3000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f7268b50 CR3=0000000057332000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000008 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000003800000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000