last executing test programs: 1m19.400361508s ago: executing program 3 (id=545): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1df) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mkdir(&(0x7f0000000000)='myproc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='myproc\x00', &(0x7f0000000300)='proc\x00', 0x18c40ce, 0x0) read(0xffffffffffffffff, &(0x7f0000000500), 0xfa0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) openat(0xffffffffffffff9c, &(0x7f00000001c0)='myproc\x00', 0x280, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/midi.usb0/id\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='Mid', 0x3) 1m19.321163521s ago: executing program 3 (id=547): write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000400), 0x0) r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write(r0, &(0x7f0000000500)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys,data_digest', 0x46) 1m19.25141632s ago: executing program 3 (id=550): r0 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r1, @ANYBLOB="0200000001"], 0x48) r3 = fsmount(r0, 0x1, 0xe) fchdir(r3) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)=@generic={0x0, r2}, 0x14) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x3f00, 0x0) 1m19.131418944s ago: executing program 3 (id=551): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000040), 0x2, 0x2) ioctl$VIDIOC_S_INPUT(r1, 0xc0045627, &(0x7f0000000480)) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0x3, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x6, 0x2, 0x80, 0x0, 0x1, 0x91b1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000400}, 0x24000000) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c49f8f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x1) 1m19.131021137s ago: executing program 3 (id=553): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 1m19.05163047s ago: executing program 3 (id=555): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x58, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x585d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @private2}]}]}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x840}, 0x0) 1m3.721427707s ago: executing program 32 (id=555): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x58, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x585d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @private2}]}]}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x840}, 0x0) 1.468122421s ago: executing program 4 (id=1367): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000100)) r1 = syz_open_pts(r0, 0x8000) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl(r2, 0x8914, &(0x7f0000000400)) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000803)=0xc0) 1.321217599s ago: executing program 0 (id=1370): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'hsr0\x00'}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB], 0x2c}}, 0x800) recvmmsg(r1, &(0x7f0000007700), 0x318, 0xfc0, 0x0) 1.321004197s ago: executing program 0 (id=1371): r0 = syz_open_dev$usbfs(0x0, 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r0, 0xc0105500, &(0x7f0000000000)={0x80, 0x8, 0x303, 0xfd, 0x0, 0x0, 0x0}) 1.320857408s ago: executing program 4 (id=1372): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="05000000080000003a3a9b00000008000300", @ANYRES32=r5, @ANYBLOB="11002a00dd0b6162636465666768696a6b00000010002d80"], 0x40}}, 0x0) 1.257276009s ago: executing program 0 (id=1373): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f0000000000)={0x5, 0x0, [{0x814, 0x0, 0xc41eeb7}, {0xab6, 0x0, 0x400000}, {0x7ba983eddf06ca8, 0x0, 0xc}, {0xb76}, {0x91a, 0x0, 0x5}]}) sendmsg$nl_route(r0, 0x0, 0x4040) pipe2$watch_queue(0x0, 0x80) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="9001010000000000240012800b00010062726964676500001400028008001d000700000008001c0009000000"], 0x44}}, 0x800) socketpair(0x26, 0x100000005, 0x0, &(0x7f0000000000)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x600000, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000c400)=[{{0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f0000000a00)="52973bffae9619ad9a57b2c2c09c72dd0d7c95d5ab5fca8f30411377f1921ab11b9b706ccc3fe4c1f8d2013f9e318fe09e800b015f3443c5a688095c96ee2ec1dea3e3a6f69e432b4256cf7ad4d94957ae826b2cfbcf27ab6260d2e1ccbcd4251b82b6c6ecd51fa54074ac2dc259fe842bfe39949a454b13512dde", 0x7b}, {&(0x7f0000000a80)="2242cffaf92c57b02b679d1c2282415c2191be37d4d2480f5a067e593c3a8c2b8409306ff909b3150d01d0ca82dffd1c0ff22eacdf2d644c7204d62a54fdf43e93eba236d522e80c5a72e52cc535dbe363514aa22598795207f474b74733ddc0781a492319a2f3dbcfc05427663d07d92d5ba6b2c213c8e01bba0fe542ed727ca50c446d7f09b7bfae25aca40f4a150c4643c9e9f9050b19760bd57c5d979ef7d9a8b3e510e653d88ff336e83aae60b52c4102aab0558219007a8852781285c68a423f165f26ccd1947d8c4bb6b7d68d0212a43c541f07e281f7d2", 0xdb}], 0x2, &(0x7f0000000e00)=[@cred={{0x18}}, @cred={{0x18}}, @rights={{0x10, 0x1, 0x1, [r3]}}], 0x40, 0x4080}}, {{0x0, 0x0, &(0x7f0000005f00)=[{&(0x7f0000004580)="ae017579034f09f9fa2b94", 0xb}, {&(0x7f0000004e80)="a6f93b8431a4e835806ec98df29440bb45bfc75e0d8f5bfb7c17e4a79f9e0cf2b00139f6a69641bd873dcef9624c1c4bf19e91978b3ea4019e626fdc99db004d61412401eff4d363c76b3787fb08dce3706436c50aa8083801443a2b85f653144409f174e67ae52808775b51d77b2187399f827200baa8ba823b9347541cbd24288d06fb3f8c3c3593feb5af38d312dc2f86a48e40d8dff33b8a0befa71c560539e0d4a36318187465eacc0fe1f0ae27156184564e4320a51004b2001617bdc7eec134f8d846ad071e90bba2143d2c98d900da946aa854faa37506749e19dda511abc274e45cf331df66b25e31088fc2ba66bcc2f9b547c73e81b3de245e5db7b3af6c0e86699ae47f6b9fe1626ac00152eeb4f2e85f8c9d78c3e9c4ac7bcdc3794739169cf326b9b1e243a3db72d4df6495c8ea85e3d5fc8883b6ded59348b0b2a1a7735151fec8a88992e00e033e1484fc5de8a8af0ed35b8b46333633de77a5cecc5f05b7594532c37089389704b7f6eafb9d27fb89445996926643b9c89e25ae94a4e7f559839443c41f2f9a7716eff030816ea90a5c54a5bf4d1aab297425129639d4de0e5ad6daba55689fafb1d548f906b3a0fdf79c7e8990494d74c0ebf7e4b79a65d3abfd918968a2ab3283e8e9652a2253d5d51ba28761b21e030502d17fa4fb7ae7cef532732cd665a0d6585c28c53b51c04958e1247450598ab1dbae773b25f030362e91b36e3d94b176159d87d8084aefd15da438735594d916fbdfe70c38c319296312d1321f3ae3d888840b1221bbc191c7a10bc649900d2b1306dd14f58353164016a823f4c1916dbc61a31ced55a107c2a2b4267c2b42e50dbf818e8d91e58f42241939c876ee23366d2ddaee60b3d55d176a1027448ab4b92fe1a23368b81081278ff5b26005ba3cb74620e38bf7f8e5041f5efa30e8d95714f21f75420cd1c88c2cba56f78f99d95cd7a0e2dc16109e11063f4bbbb3f4bbc7bce08098c9056ef8d0600c6bd4ad5f6e69e471422056e691d9de8460d05b10eee4a5b75f8869d3d051bf35c4fa338ca75fc07cda6d235800221b492d6ad9b62cff8bde54c5253424f00565ff80a0135f05c57e4595413ae092ca85fb5ca03749955f1fb5520e6219474cb1812cb316d67351b48dbebd9f6987704bfddff4834bf9ef6f14eda0f77a003dced952c791cfc8d6ca3c4b9198f4f4cc815178451d28702a8687392173618317903d2c95d4c1b269ee192e5d532ce8c6b59639686b7083c9cd151a65b7a0ba4682fb23ee4a811a67850964409438066589fa11b85be42a9872e2549f8177e42e6139446cd5b5fd9bcf8416675d0fc062ed346e3568a5bbdc583b2248d40f9b3ed75073aadfb664e3db09dd229c015e141ad509f95bf41351dacbc6b499abb00878fc76c04c406f534ec1bcdd0e921e6c6b5e38204522e0339e8b3444fe13558abbf9de4022b032b22cdb4b62a4bdb53952d9bf6c97f7179f2b52f093d2c4483576b87f44899d74b8b2f58a6db0e97bf96bb5872e84967a6fcb9c5bb3f013965dd5ecd33850ab1034412f5e46821bee5196598b2d76090beec7fb7279234b62326133c88ee2a4017875755997c5abd4d9ab69532774bbcdea2d07439170245f0800986ec2ed7783a4858ea7e106c36704d6902737f528960fead820a5563c5bfa271a68cd19fe0118ed13ea1642369e6059a41f512c57448a2cb414598c764889d8dc58a5a29580aa3d0b107f5f3e1fc28361042cdac058984c931a5e4a2bf61174208f46b0a114f6ddd1c3abb8b909ab3861d5ced53e60e5955b92846a3a4c7463faf8127c1dc2c310b49bd3560552a1466fed9a07de91b34bf6e1ba5a741dc2a526871fda01dc89e24ba8d725aba2cd9546148f336e432b173b5e5e3e01a9b0be66e813d6e456f64939c0b4b4122fe08a40c68a655037ee880655926b7221545017f99e8d7ccf89335d3cad59b515e82ebed3ffd77704202ec783bbb10cf7865ad71d6afee80d8277ebc5e3fbf894ab05e08df20ee667f2b8722f9e5b070035dd2958b907beff604c356ab89a4b09dd4c9f5f86f6892987a027355d77c64d2e9e8539f313dec032a35a126786753cfd1f1244c316255f4dbf5870c8201a85a2bea7504fadf527dea2b1d4ae975091800c86d8eb2adb3986d9317145239de76be57cceab83d2d92f6aabc3ef942a9c3aa9d23060b737f91bfe33fd6fe2f14329f1b919cd506cc26cbc28187dbbb9883897ae20e314ed52b754a8004182d5b41bca0b0760cfa3c191ecd3196cf15c6d140ff7862e35b718f5827e7ebfc70a9cead96980e83b980364cad468f94f20ac732e10839196a51bfadb24f10f71a2ea8ba0ad025d9d4b2fb615b93533a52c06633be206a2007858d91fd29fb5f692556a97d919de9e1e1aa82217b8b2ba4a58978f6956cec212acc75bbfae8d04fd7d6b11152d412af7019efcf9befa084b9ff898f1adaeafe0c9ed3ae7ec838ce57d3d968ed5323b99cae5dc6639778b871f5b32e5de4678440412b7c2572aeaf34bb89a7554f1e92bf4279ac347b47bc2fe400f04cefa02c75d06e47e044f66ddb375160177d2f638e137260fb25dae01b4c78bf6e5f38da8050f00d78762a9b2cafd5827f4d18529e42f891853b9fb8b81ed7da0dadc9e2f8856ed7f5883a63ed1d10f0709024bf87a28a91d51d4c419ace259c70388c6cc4b4f5aab8ec36d6de3519ab5305e93732efd4684fb16bb14707fd2b43c36cbe07646f2731773354edcc4c923f5dc86576fa212df8754c82672e0aa5d647e2fd50da3af77a92424db9fa9ae8907e44a919be024986c08431ae6ab29e41505b82e182f657fb4700700d2fad0b65cac96bc6340d9ffcae87b2190831e2380e318a28c83570c05957e8cbdfd858a9ee50477a45148217af175f4d09858fafb4a7b13b2944ed021be7bc9f09cc648f8e1d8c3fa0161f7e68ac4a3dbd3885bc58ef85585a18f97d7d27833a3726edc4693e8b587a7c1d4851eb33a32d78330121fadbfb0bd60fa5d7756e2f666694b4b5daf785ff302b06fedad43787aa33f67c13a4413785ba68d33c507439d9c739454f48939087873294a7cf5a57a00ba98444ce52a83a546c67deb6f2f3a8bda150cd98c72631a0be009d0a263ebbc4f512a949e4cf120909f4e5e64114c4a2b459f16323ad8771870f944d14fcdba311a9d89668b770415a7deab2da586592c41b251e7e52ee99bb35a9c0e630dddd7585d24ef96821378b5c17ad18b275d37021f02334aaf9a10bec0e0d7234c66db5961f7b13e0011f6af7feff35fe2ad853b26427cb1af8d0dcb290a1bc1898e74f6a7c2a2b034e84d7a736f42e171615e8d0027c23b6208c90e635a978fd6584c22bed7edc73e6a18ff7012fff2cd4cd722fc4ba1e64b81a8afd9395423066b38454e250c7f447106ffd6ca61b98f7b1b125df91c7b39880e043b357acecf94826722fdfa9939dfffd6d2fd47f3fea2f58c1d6d3115b39bf9ffc1096d5cacdb65b6b43c62e35fe2738e8748a17472f3c5529d230ec7f60f726563680a476b144eb30c6c6182948406dbde662823e982ea90ae11b863d1fb002b62f21cad783b96620d93c82ed7a1000ee8a878d32c31d2b4deb49491a8629acc7de7edb13685c1b631f510d7fa274334e39c7f81d1d66dc0a4f2939163987efff299d59f88c7c28bf4545bac172e427dd22adc15923fea208d6425e28933b235f69400c60095e241a6a2b446926f0d5e8def17941461f73227357c3f0f5fe50a7564e3984ac747229d0ffe35341ba2662aa22af1ea4f63191e111f0de03b5890c479a53441ea41a90ab37fbd0ad15fe17c6fd9ec3dabda164fd784a15a0e651e890c301e762fb41439dc1eef76aef97156a400d4c6f726c3652c9c55e51052613bcac11c17b25a868ce13687239d9ca62b6baba8e4dea8a2a895a56afa07ad5158d40ca223a41b2edc933b3b0918c17e17d22256395250a33b99052b49e2820adf8b0b648f7c83fd487d0186b13901e92be2f93afc61ca61cc642fe84e12973d79b4eb4d3b03f10b490a7e0a9678405cab203f5cf8b40975dcdc3a8995b2e29c19e18ee9f2699847457cfaa8f602e974b0c720282338980244d9ed63e0a32dcd3f651264faf0ba5829d8747d50060e64f968c3c545d0036d651ac0adc242e6cc704564b47f5e460bdcc0c253f52eb6cb00075b17959f7741d1cdeee1c5d3dfc23b13feb04589ce98ee3d9fc20b720dd53089fffd6b4d51b05fdac269701e5dd2ababc70640fe3d75e972ace0c7eb10282b9c84509832c4b87fa85d700f32a1d8dba53a7b3d6645cba0a22fde49fadd7f4ea0c70a451831389c0da9eed603188287842ecf329f0904df9d7c650ebd71095281ff7e5754ce20205644f795239e65513529644e4a15d6cd2ee6c46c54ee76a3a1d8d5cf25939f1c016e500596a4a34fc7cdb7988f161608a50b122b96c0ca4592b4bb1bc51d76fcda0da30b91ce665c9e7956ade4eec9f754b0e78b24d8116abfe6e33a68b05f4abd69d716ce0601fdcf084b8c085cf8c2c0c7d7dc05c0b9f64d5bf6f3697fd37002a34c87a864ad6001cd5cad78e11de385138151d3326db253a812113cbcf5ce6a7caf22f07d8239132149c5b370efc05d10f78413858774d59cb156a3185b86087f8d1c1f7cd4a1d1d1c63ad9dbcf6cfe6668416f131d47b5917727177c95a2244489ecaf18678c7ebf3d39f92d6a15bafd209dd0746e268859f4c658636f317cf36275601eacd4139d1730b2db5b0257dd689432cacad0fdde0d42f7edbe6c7298e0cb1aa5464ab044fb7aea547033583d7868c714bc75711e070ae83252af0dd054f4ada1a05650f744379ec265f4fd60bfdd0d7af94855d875b87746bb2d263dfffa236152c6560c21e62c74fa6ac9c70050562bb1213c2b00ff957d38d5fd495d89bea1da9a85374e608bb1c4506aaa994e711d14748129f194457a25f7d1e9f4257ea172d2c4b8a203cc94e6cd42e8cdb6315577ebfcd9671ac820d50a800bd33a6adff6cdd9891b0f9caff51c485c75bbd2eb7ddcfde96766b11aac9d5be02c3c21324f304565d701f5b06bd242e750fbfa8449f18b7c2a8b8baa8c45d8246d3efaa21f19ee8f99f304cd4ce1de5cba4e8588494958643549f46a5b035fc7ec9a360aa56f0b781b7488c28d619b51e2daa999f4e612ba8914ab23f17ddc47147b81499c41a34050a613ed11f02c72df1165b6f42156cf4f9906bee3bc38f4f6e37c72cb2f72b926c0ce4e13e913ebaa54e89905f49e2bdb477acb90fcd819cd96f4fa7a78eff4c49016ab85dde00f74f44a89e66c4f4052137d02ad9e5e0db62a1dd779b2eed7d6d6830e717aa8b97418fe900b31b8a8f30bb32bdfa3371afe9cbd325246f348656f76c1e395d258e7d8fa23d64328d07d858f701ff7bf95e41e1f7f4b7eaa5996df47cffe32b1dc31ff6f8ee4a3d8587713bdea7fd64ff20a41797dbd5d12d541ddfb7b6aea55d0a880c38217f4b69fe53d0c605455606b79d9ca5a2a1b1b1e9e0f25c4d75a6ac8095cad53515b01829f33f11d65b2a5253e91f3112572a550f483411638ac7bfce4e4eff070249a9807a809821f8ee38fe7402f128a08be6dff017461c03a99a18928ad4643c80e80fc1dae8cbb8682f4b7c4fa2fe4b53999a6c69ceafee939518294abb16fec96f6feacc2685b92ae35042296eae037649378f0d6e3f6aaff1eebc3a51720ce8b64904e1c3e3c98b7a7b3977a5056613eda8f1f7fae96a8", 0x1000}, {&(0x7f0000005e80)="55c86e538e72f448faecaf96e0df30e2a67ad4bd5b7a7630093653c08aa259e3563b34f4cca89beedb5a6dc6cf1ba502b0a1e160a95b7b5b43a7a3b7c2be1da83b96f068ba3679ef0afed086ebf5290a1260ba4ff07ed1af81ed017c9db2d6264bc4483628048284502a", 0x6a}], 0x3, &(0x7f000000c140)=[@rights={{0x10, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x18}}, @cred={{0x18}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r3]}}, @cred={{0x18}}, @cred={{0x18}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r4]}}], 0xac, 0x8000}}, {{&(0x7f000000c240)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f000000c3c0)=[{&(0x7f000000c2c0)="b40df7fd4aacc8942acec7e540ae506349088a7c198c5c41be38dad6ebc080", 0x1f}, {&(0x7f000000c300)="5fccd73e48c22000813bce18d76a23484a633051e93dab3d234662735821e35192b230f45c4b6dc24e8fcdfd14a1118724b6468336c3e7d2ac2cfd84df1ef6788236719bde89bfdd97e8d2a872fef787aeb7cef33be5ad7e865a4b677c36480a7d4891dea80e1f6b4629deb264daee33b8fc0e9b9210830ed6a99774249c76f41f9b660f37f49c2a1fc1321ac64038477132fa594e34cea2bdfa5d4a730fd71abd8ef5b050b727bdf8c394", 0xab}], 0x2, 0x0, 0x0, 0x4000}}], 0x3, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000009c0)=[{{&(0x7f0000000540)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000640)=""/200, 0xc8}, {&(0x7f0000000740)=""/76, 0x4c}, {&(0x7f00000007c0)=""/128, 0x80}], 0x3, &(0x7f0000000940)=""/107, 0x6b}, 0x3}], 0x1, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r4, r4, 0x0, 0x20000005) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendfile(r5, r4, 0x0, 0x1002000ff) fcntl$dupfd(r5, 0x0, r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000004c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c00000010000100297000fadbdf250000000000", @ANYRES32=r7, @ANYBLOB="1380000023b205003c00128009000100626f6e64000000002c0002800800070081000000080003"], 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0xc094) 1.256696224s ago: executing program 4 (id=1374): close(0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$inet6(0xa, 0x1, 0x0) socket$igmp6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r3, 0x29, 0x39, 0x0, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x27}, 0x3}, 0x1c) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x3ff}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7c, &(0x7f00000000c0), &(0x7f0000000180)=0x8) sendmmsg$inet6(r3, &(0x7f0000002940), 0x40000000000017d, 0x811) 1.045777651s ago: executing program 1 (id=1381): r0 = syz_open_dev$usbfs(0x0, 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r0, 0xc0105500, &(0x7f0000000000)={0x80, 0x8, 0x303, 0xfd, 0x0, 0x0, 0x0}) 850.598322ms ago: executing program 1 (id=1383): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x48, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_USERDATA={0xa, 0xd, 0x1, 0x0, "c71266c3cdbc"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 780.802918ms ago: executing program 1 (id=1384): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="05000000080000003a3a9b00000008000300", @ANYRES32=r4, @ANYBLOB="11002a00dd0b6162636465666768696a6b00000010002d80"], 0x40}}, 0x0) 680.708957ms ago: executing program 1 (id=1385): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) r1 = dup2(r0, 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, 0x0, 0x3c) 680.563985ms ago: executing program 1 (id=1386): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280), 0x0) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(0xffffffffffffffff, 0xaf01, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x3, &(0x7f0000000680)=@framed={{0x18, 0x8}}, &(0x7f0000000000)='GPL\x00', 0x4}, 0x94) 611.136238ms ago: executing program 1 (id=1387): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port1\x00', 0xe3, 0x1b1c07}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = dup3(r0, r1, 0x0) read$FUSE(r2, &(0x7f00000024c0)={0x2020}, 0x2020) 221.16157ms ago: executing program 2 (id=1390): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'hsr0\x00'}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x2c}}, 0x800) recvmmsg(r1, &(0x7f0000007700), 0x318, 0xfc0, 0x0) 220.879363ms ago: executing program 2 (id=1391): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r0, 0xc138fd09, &(0x7f0000000300)="0400000032000000000000008a0100003801000001000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141000000000000000008000000000000000000000000000000726169640000000000000000") 150.615586ms ago: executing program 2 (id=1392): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_TMR_START(r0, 0x5402) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f0000000100)={0x1d, r2}, 0x10) sendmmsg$sock(r1, &(0x7f0000001000)=[{{0x0, 0x0, &(0x7f0000002100)=[{&(0x7f0000003100)="0100000003000000640000000000000000000000000000000000000000000000000000000000000001000000000000000200000001000000020000000100"/72, 0x48}], 0x1}}], 0x1, 0x0) close(r0) 150.273343ms ago: executing program 4 (id=1393): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="05000000080000003a3a9b00000008000300", @ANYRES32=r4, @ANYBLOB="11002a00dd0b6162636465666768696a6b00000010002d80"], 0x40}}, 0x0) 87.399908ms ago: executing program 2 (id=1394): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000100)) r1 = syz_open_pts(r0, 0x8000) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl(r2, 0x8914, &(0x7f0000000400)='sl0\x00\x00\x00\x00\x00\x00') ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000803)=0xc0) 86.685278ms ago: executing program 0 (id=1395): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280), 0x0) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(0xffffffffffffffff, 0xaf01, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x3, &(0x7f0000000680)=@framed={{0x18, 0x8}}, &(0x7f0000000000)='GPL\x00', 0x4}, 0x94) 84.744638ms ago: executing program 4 (id=1396): mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x21c0, 0x103) 80.788131ms ago: executing program 0 (id=1397): capset(&(0x7f0000a31000)={0x20071026}, &(0x7f0000000080)={0x0, 0x5}) r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x4a38, 0x201) ioctl$SG_IO(r0, 0x2285, &(0x7f00000002c0)={0x53, 0x7ffffffffffffffe, 0x6, 0xb4, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000400)="1e29e7dada72", 0x0, 0x2, 0x10000, 0xfffffffe, 0x0}) 79.078412ms ago: executing program 4 (id=1398): socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8c}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) setns(0xc9, 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) 49.13162ms ago: executing program 0 (id=1399): unshare(0x6a060000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$l2tp6(0xa, 0x2, 0x73) syz_init_net_socket$llc(0x1a, 0x1, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x200000000000000) 389.987µs ago: executing program 2 (id=1400): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r0, 0xc138fd09, &(0x7f0000000300)="0400000032000000000000008a0100003801000001000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141000000000000000008000000000000000000000000000000726169640000000000000000") 0s ago: executing program 2 (id=1401): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x60, r4, 0x405, 0x70bd27, 0x25dfdbff, {}, [{{0x8, 0x1, r5}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4c004) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmsg$kcm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480f0000005e140602000000000e000a001000000002800000121f", 0x2e}], 0x1}, 0x800) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x7, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}, @IFLA_MASTER={0x8}]}, 0x3c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000440)={0x0, 0xa1ff, &(0x7f0000000400)={&(0x7f0000000280)={0x34, r1, 0x1, 0x0, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0x0, 0x0, @l2={'eth', 0x3a, 'team0\x00'}}}}}, 0x34}}, 0x0) kernel console output (not intermixed with test programs): c 0x0c03 length: 249 > 1 [ 120.485729][ T65] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 120.489593][ T65] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 120.497177][ T65] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 120.497778][ T65] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 120.818845][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.915084][ T7879] fuse: Unknown parameter '0x0000000000000004' [ 120.967988][ T7881] binder: 7880:7881 ioctl c0306201 0 returned -14 [ 121.011058][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.084472][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.364892][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.566977][ T1480] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 121.745116][ T1480] usb 5-1: not running at top speed; connect to a high speed hub [ 121.745148][ T1480] usb 5-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 121.746172][ T1480] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 121.746212][ T1480] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 121.748668][ T1480] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.748688][ T1480] usb 5-1: Product: syz [ 121.748702][ T1480] usb 5-1: Manufacturer: syz [ 121.748716][ T1480] usb 5-1: SerialNumber: syz [ 121.789342][ T1480] oti6858 5-1:1.0: required endpoints missing [ 121.830806][ T7856] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.830854][ T7856] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.830910][ T7856] bridge_slave_0: entered allmulticast mode [ 121.839590][ T7856] bridge_slave_0: entered promiscuous mode [ 121.844103][ T7856] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.844145][ T7856] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.844224][ T7856] bridge_slave_1: entered allmulticast mode [ 121.857596][ T7856] bridge_slave_1: entered promiscuous mode [ 121.913822][ T7905] fuse: Unknown parameter '0x0000000000000004' [ 121.931926][ T7856] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 121.957568][ T7856] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 122.066364][ T12] bridge_slave_1: left allmulticast mode [ 122.066423][ T12] bridge_slave_1: left promiscuous mode [ 122.069356][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.089714][ T12] bridge_slave_0: left allmulticast mode [ 122.089740][ T12] bridge_slave_0: left promiscuous mode [ 122.089945][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 122.576962][ T65] Bluetooth: hci4: command tx timeout [ 122.594646][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 122.602912][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 122.606049][ T12] bond0 (unregistering): Released all slaves [ 122.627391][ T7856] team0: Port device team_slave_0 added [ 122.629873][ T7856] team0: Port device team_slave_1 added [ 122.658636][ T5453] 8021q: adding VLAN 0 to HW filter on device eth2 [ 122.729632][ T7856] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 122.729647][ T7856] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 122.729665][ T7856] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 122.730992][ T7856] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 122.731002][ T7856] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 122.731019][ T7856] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 122.812583][ T7935] netlink: 'syz.2.738': attribute type 6 has an invalid length. [ 123.089033][ T7856] hsr_slave_0: entered promiscuous mode [ 123.092269][ T7856] hsr_slave_1: entered promiscuous mode [ 123.092563][ T7856] debugfs: 'hsr0' already exists in 'hsr' [ 123.092573][ T7856] Cannot create hsr debugfs directory [ 123.216223][ T7941] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 123.270464][ T7941] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 123.271437][ T7941] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 123.337890][ T5453] 8021q: adding VLAN 0 to HW filter on device eth3 [ 123.394361][ T25] usb 5-1: USB disconnect, device number 12 [ 123.785036][ T12] hsr_slave_0: left promiscuous mode [ 123.787124][ T12] hsr_slave_1: left promiscuous mode [ 123.788115][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 123.788151][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 123.818448][ T12] veth1_macvtap: left promiscuous mode [ 123.818578][ T12] veth0_macvtap: left promiscuous mode [ 123.818733][ T12] veth1_vlan: left promiscuous mode [ 123.818861][ T12] veth0_vlan: left promiscuous mode [ 124.181915][ T12] team0 (unregistering): Port device team_slave_1 removed [ 124.190803][ T12] team0 (unregistering): Port device team_slave_0 removed [ 124.304024][ T5453] 8021q: adding VLAN 0 to HW filter on device eth4 [ 124.360094][ T7856] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 124.379174][ T7856] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 124.379700][ T7856] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 124.381321][ T7856] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 124.383741][ T7856] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 124.392393][ T7856] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 124.393077][ T7856] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 124.420703][ T7856] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 124.500958][ T7856] 8021q: adding VLAN 0 to HW filter on device bond0 [ 124.506954][ T5846] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 124.507674][ T7856] 8021q: adding VLAN 0 to HW filter on device team0 [ 124.510817][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state [ 124.510861][ T1165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 124.514665][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 124.514708][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 124.627267][ T5453] 8021q: adding VLAN 0 to HW filter on device eth5 [ 124.647117][ T65] Bluetooth: hci4: command tx timeout [ 124.781127][ T7995] netlink: 'syz.1.750': attribute type 6 has an invalid length. [ 124.798542][ T5846] usb 5-1: unable to get BOS descriptor or descriptor too short [ 124.800512][ T5846] usb 5-1: New USB device found, idVendor=056a, idProduct=00d8, bcdDevice= 0.40 [ 124.801114][ T5846] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 124.801131][ T5846] usb 5-1: can't read configurations, error -71 [ 124.981548][ T7856] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 125.166910][ T42] usb 7-1: new full-speed USB device number 10 using dummy_hcd [ 125.225033][ T8019] fuse: Unknown parameter 'fd0x0000000000000004' [ 125.328387][ T42] usb 7-1: not running at top speed; connect to a high speed hub [ 125.328416][ T42] usb 7-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 125.329864][ T42] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 125.329901][ T42] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 125.332591][ T42] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.332611][ T42] usb 7-1: Product: syz [ 125.332623][ T42] usb 7-1: Manufacturer: syz [ 125.332634][ T42] usb 7-1: SerialNumber: syz [ 125.350590][ T8024] __nla_validate_parse: 3 callbacks suppressed [ 125.350606][ T8024] netlink: 4 bytes leftover after parsing attributes in process `syz.1.755'. [ 125.353448][ T8025] device-mapper: table: 248:0: raid: Unrecognised raid_type (-EINVAL) [ 125.353462][ T8025] device-mapper: ioctl: error adding target to table [ 125.376189][ T7856] veth0_vlan: entered promiscuous mode [ 125.380120][ T7856] veth1_vlan: entered promiscuous mode [ 125.398725][ T42] oti6858 7-1:1.0: required endpoints missing [ 125.432327][ T7856] veth0_macvtap: entered promiscuous mode [ 125.437611][ T7856] veth1_macvtap: entered promiscuous mode [ 125.454688][ T7856] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 125.463127][ T7856] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 125.474979][ T8029] netlink: 28 bytes leftover after parsing attributes in process `syz.0.757'. [ 125.475028][ T8029] netlink: 28 bytes leftover after parsing attributes in process `syz.0.757'. [ 125.558075][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.563993][ T8029] netlink: 28 bytes leftover after parsing attributes in process `syz.0.757'. [ 125.564084][ T8029] netlink: 28 bytes leftover after parsing attributes in process `syz.0.757'. [ 125.574954][ T1165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.574968][ T1165] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.587031][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.587070][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.587098][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.611930][ T8029] netlink: 28 bytes leftover after parsing attributes in process `syz.0.757'. [ 125.612004][ T8029] netlink: 28 bytes leftover after parsing attributes in process `syz.0.757'. [ 125.620297][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.620315][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.976381][ T8047] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 125.976406][ T8047] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 125.976680][ T8047] vhci_hcd vhci_hcd.0: Device attached [ 126.010949][ T57] usb 7-1: USB disconnect, device number 10 [ 126.167362][ T5886] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 126.169107][ T8052] bridge3: entered promiscuous mode [ 126.236960][ T5886] usb 45-1: new full-speed USB device number 2 using vhci_hcd [ 126.267495][ T8053] netlink: 24 bytes leftover after parsing attributes in process `syz.1.762'. [ 126.729024][ T8061] netlink: 28 bytes leftover after parsing attributes in process `syz.2.765'. [ 126.729098][ T8061] netlink: 28 bytes leftover after parsing attributes in process `syz.2.765'. [ 126.737361][ T65] Bluetooth: hci4: command tx timeout [ 126.878629][ T8069] fuse: Unknown parameter 'fd0x0000000000000004' [ 127.486968][ T5846] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 127.638051][ T5846] usb 6-1: not running at top speed; connect to a high speed hub [ 127.638078][ T5846] usb 6-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 127.638958][ T5846] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 127.638993][ T5846] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 127.640820][ T5846] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.640838][ T5846] usb 6-1: Product: syz [ 127.640852][ T5846] usb 6-1: Manufacturer: syz [ 127.640863][ T5846] usb 6-1: SerialNumber: syz [ 127.647632][ T5846] oti6858 6-1:1.0: required endpoints missing [ 127.986736][ T5846] usb 6-1: USB disconnect, device number 16 [ 128.146288][ T8102] bridge4: entered promiscuous mode [ 128.813213][ T65] Bluetooth: hci4: command tx timeout [ 128.977799][ T8048] vhci_hcd: connection reset by peer [ 128.977956][ T12] vhci_hcd vhci_hcd.4: stop threads [ 128.977977][ T12] vhci_hcd vhci_hcd.4: release socket [ 128.978020][ T12] vhci_hcd vhci_hcd.4: disconnect device [ 129.020433][ T8121] binder: 8120:8121 ioctl 4018620d 0 returned -22 [ 129.496602][ T8135] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 130.007156][ T42] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 130.063230][ T8151] FAULT_INJECTION: forcing a failure. [ 130.063230][ T8151] name failslab, interval 1, probability 0, space 0, times 0 [ 130.063251][ T8151] CPU: 0 UID: 0 PID: 8151 Comm: syz.1.796 Not tainted syzkaller #0 PREEMPT(full) [ 130.063264][ T8151] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 130.063271][ T8151] Call Trace: [ 130.063275][ T8151] [ 130.063279][ T8151] dump_stack_lvl+0x100/0x190 [ 130.063297][ T8151] should_fail_ex.cold+0x5/0xa [ 130.063313][ T8151] should_failslab+0xc2/0x120 [ 130.063328][ T8151] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 130.063342][ T8151] ? find_held_lock+0x2b/0x80 [ 130.063354][ T8151] ? sock_alloc_inode+0x26/0x2c0 [ 130.063371][ T8151] ? __pfx_sock_alloc_inode+0x10/0x10 [ 130.063388][ T8151] sock_alloc_inode+0x26/0x2c0 [ 130.063404][ T8151] ? __pfx_sock_alloc_inode+0x10/0x10 [ 130.063419][ T8151] alloc_inode+0x68/0x250 [ 130.063435][ T8151] sock_alloc+0x44/0x280 [ 130.063450][ T8151] ? security_socket_create+0x7f/0x250 [ 130.063465][ T8151] __sock_create+0xc2/0x860 [ 130.063478][ T8151] __sys_socket+0x14d/0x260 [ 130.063488][ T8151] ? fput+0x7c/0x100 [ 130.063501][ T8151] ? __pfx___sys_socket+0x10/0x10 [ 130.063512][ T8151] ? ksys_write+0x1ac/0x250 [ 130.063523][ T8151] ? __pfx_ksys_write+0x10/0x10 [ 130.063536][ T8151] __ia32_sys_socket+0x72/0xb0 [ 130.063547][ T8151] ? lockdep_hardirqs_on+0x7d/0x110 [ 130.063563][ T8151] __do_fast_syscall_32+0x13a/0x8b0 [ 130.063582][ T8151] do_fast_syscall_32+0x32/0x70 [ 130.063599][ T8151] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 130.063612][ T8151] RIP: 0023:0xf7f56fec [ 130.063625][ T8151] Code: Unable to access opcode bytes at 0xf7f56fc2. [ 130.063630][ T8151] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 130.063642][ T8151] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 0000000000000003 [ 130.063649][ T8151] RDX: 0000000000000014 RSI: 0000000000000000 RDI: 0000000000000000 [ 130.063655][ T8151] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 130.063661][ T8151] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 130.063667][ T8151] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 130.063681][ T8151] [ 130.063686][ T8151] socket: no more sockets [ 130.156963][ T42] usb 7-1: Using ep0 maxpacket: 32 [ 130.162907][ T42] usb 7-1: unable to get BOS descriptor or descriptor too short [ 130.162948][ T42] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 130.170127][ T42] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 130.170148][ T42] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 130.170164][ T42] usb 7-1: config 14 has no interface number 0 [ 130.170178][ T42] usb 7-1: config 14 has no interface number 1 [ 130.170222][ T42] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 130.170241][ T42] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 130.170261][ T42] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 130.170282][ T42] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 130.170303][ T42] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 130.170324][ T42] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 130.170345][ T42] usb 7-1: config 14 interface 57 has no altsetting 0 [ 130.170358][ T42] usb 7-1: config 14 interface 228 has no altsetting 0 [ 130.172681][ T8154] bridge1: entered promiscuous mode [ 130.177129][ T42] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.177148][ T42] usb 7-1: Product: syz [ 130.177159][ T42] usb 7-1: Manufacturer: syz [ 130.177172][ T42] usb 7-1: SerialNumber: syz [ 130.408772][ T8160] __nla_validate_parse: 6 callbacks suppressed [ 130.408795][ T8160] netlink: 48 bytes leftover after parsing attributes in process `syz.1.799'. [ 130.595853][ T42] legousbtower 7-1:14.57: interrupt endpoints not found [ 130.805530][ T42] legousbtower 7-1:14.228: get version request failed: -71 [ 130.805670][ T42] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 130.810831][ T42] usb 7-1: USB disconnect, device number 11 [ 130.940857][ T8165] netlink: 4 bytes leftover after parsing attributes in process `syz.1.801'. [ 131.312563][ T8168] geneve0: entered promiscuous mode [ 131.377014][ T5886] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 131.440256][ T8175] FAULT_INJECTION: forcing a failure. [ 131.440256][ T8175] name failslab, interval 1, probability 0, space 0, times 0 [ 131.440286][ T8175] CPU: 3 UID: 0 PID: 8175 Comm: syz.2.805 Not tainted syzkaller #0 PREEMPT(full) [ 131.440307][ T8175] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 131.440319][ T8175] Call Trace: [ 131.440325][ T8175] [ 131.440333][ T8175] dump_stack_lvl+0x100/0x190 [ 131.440363][ T8175] should_fail_ex.cold+0x5/0xa [ 131.440389][ T8175] should_failslab+0xc2/0x120 [ 131.440415][ T8175] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 131.440437][ T8175] ? find_held_lock+0x2b/0x80 [ 131.440456][ T8175] ? sock_alloc_inode+0x26/0x2c0 [ 131.440486][ T8175] ? __pfx_sock_alloc_inode+0x10/0x10 [ 131.440515][ T8175] sock_alloc_inode+0x26/0x2c0 [ 131.440543][ T8175] ? __pfx_sock_alloc_inode+0x10/0x10 [ 131.440569][ T8175] alloc_inode+0x68/0x250 [ 131.440597][ T8175] sock_alloc+0x44/0x280 [ 131.440622][ T8175] ? security_socket_create+0x7f/0x250 [ 131.440648][ T8175] __sock_create+0xc2/0x860 [ 131.440671][ T8175] __sys_socket+0x14d/0x260 [ 131.440689][ T8175] ? xfd_validate_state+0x129/0x190 [ 131.440717][ T8175] ? __pfx___sys_socket+0x10/0x10 [ 131.440744][ T8175] __ia32_sys_socket+0x72/0xb0 [ 131.440762][ T8175] ? lockdep_hardirqs_on+0x7d/0x110 [ 131.440790][ T8175] __do_fast_syscall_32+0x13a/0x8b0 [ 131.440823][ T8175] do_fast_syscall_32+0x32/0x70 [ 131.440876][ T8175] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 131.440901][ T8175] RIP: 0023:0xf6ffefec [ 131.440921][ T8175] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 131.440929][ T8175] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 131.440948][ T8175] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 0000000000000003 [ 131.440965][ T8175] RDX: 0000000000000014 RSI: 0000000000000000 RDI: 0000000000000000 [ 131.440976][ T8175] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 131.440986][ T8175] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 131.440997][ T8175] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 131.441023][ T8175] [ 131.441062][ T8175] socket: no more sockets [ 131.798298][ T8187] netlink: 'syz.2.808': attribute type 1 has an invalid length. [ 131.875690][ T8191] bridge4: entered promiscuous mode [ 131.958405][ T8192] netlink: 24 bytes leftover after parsing attributes in process `syz.1.811'. [ 132.410002][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.410034][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.781847][ T8204] bridge0: port 3(syz_tun) entered blocking state [ 132.781939][ T8204] bridge0: port 3(syz_tun) entered disabled state [ 132.782179][ T8204] syz_tun: entered allmulticast mode [ 132.786012][ T8204] syz_tun: entered promiscuous mode [ 132.788142][ T8204] bridge0: port 3(syz_tun) entered blocking state [ 132.788400][ T8204] bridge0: port 3(syz_tun) entered forwarding state [ 132.893475][ T8209] netlink: 4 bytes leftover after parsing attributes in process `syz.0.817'. [ 133.020395][ T8211] netlink: 24 bytes leftover after parsing attributes in process `syz.2.820'. [ 133.064348][ T8214] netlink: 28 bytes leftover after parsing attributes in process `syz.4.819'. [ 133.064402][ T8214] netlink: 28 bytes leftover after parsing attributes in process `syz.4.819'. [ 133.092029][ T8214] netlink: 28 bytes leftover after parsing attributes in process `syz.4.819'. [ 133.092081][ T8214] netlink: 28 bytes leftover after parsing attributes in process `syz.4.819'. [ 133.152835][ T8220] FAULT_INJECTION: forcing a failure. [ 133.152835][ T8220] name failslab, interval 1, probability 0, space 0, times 0 [ 133.152855][ T8220] CPU: 1 UID: 0 PID: 8220 Comm: syz.2.822 Not tainted syzkaller #0 PREEMPT(full) [ 133.152868][ T8220] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 133.152874][ T8220] Call Trace: [ 133.152878][ T8220] [ 133.152883][ T8220] dump_stack_lvl+0x100/0x190 [ 133.152917][ T8220] should_fail_ex.cold+0x5/0xa [ 133.152951][ T8220] should_failslab+0xc2/0x120 [ 133.152967][ T8220] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 133.152981][ T8220] ? find_held_lock+0x2b/0x80 [ 133.152994][ T8220] ? sock_alloc_inode+0x26/0x2c0 [ 133.153013][ T8220] ? __pfx_sock_alloc_inode+0x10/0x10 [ 133.153029][ T8220] sock_alloc_inode+0x26/0x2c0 [ 133.153045][ T8220] ? __pfx_sock_alloc_inode+0x10/0x10 [ 133.153060][ T8220] alloc_inode+0x68/0x250 [ 133.153076][ T8220] sock_alloc+0x44/0x280 [ 133.153091][ T8220] ? security_socket_create+0x7f/0x250 [ 133.153106][ T8220] __sock_create+0xc2/0x860 [ 133.153119][ T8220] __sys_socket+0x14d/0x260 [ 133.153129][ T8220] ? xfd_validate_state+0x129/0x190 [ 133.153145][ T8220] ? __pfx___sys_socket+0x10/0x10 [ 133.153160][ T8220] __ia32_sys_socket+0x72/0xb0 [ 133.153171][ T8220] ? lockdep_hardirqs_on+0x7d/0x110 [ 133.153188][ T8220] __do_fast_syscall_32+0x13a/0x8b0 [ 133.153207][ T8220] do_fast_syscall_32+0x32/0x70 [ 133.153223][ T8220] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 133.153237][ T8220] RIP: 0023:0xf6ffefec [ 133.153250][ T8220] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 133.153254][ T8220] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 133.153265][ T8220] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 0000000000000003 [ 133.153272][ T8220] RDX: 0000000000000014 RSI: 0000000000000000 RDI: 0000000000000000 [ 133.153278][ T8220] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 133.153284][ T8220] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 133.153290][ T8220] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 133.153303][ T8220] [ 133.153309][ T8220] socket: no more sockets [ 133.155310][ T8214] netlink: 28 bytes leftover after parsing attributes in process `syz.4.819'. [ 133.388150][ T8229] netlink: 'syz.2.823': attribute type 1 has an invalid length. [ 133.538227][ T8234] ieee802154 phy0 wpan0: encryption failed: -126 [ 134.027005][ T5886] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 134.190860][ T5886] usb 5-1: Using ep0 maxpacket: 32 [ 134.193399][ T5886] usb 5-1: unable to get BOS descriptor or descriptor too short [ 134.193438][ T5886] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 134.194645][ T5886] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 134.194667][ T5886] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 134.194685][ T5886] usb 5-1: config 14 has no interface number 0 [ 134.194700][ T5886] usb 5-1: config 14 has no interface number 1 [ 134.194748][ T5886] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 134.194769][ T5886] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 134.194790][ T5886] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 134.194813][ T5886] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 134.194836][ T5886] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 134.194858][ T5886] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 134.194880][ T5886] usb 5-1: config 14 interface 57 has no altsetting 0 [ 134.194895][ T5886] usb 5-1: config 14 interface 228 has no altsetting 0 [ 134.196342][ T8252] device-mapper: table: 248:0: raid: No arguments (-EINVAL) [ 134.196362][ T8252] device-mapper: ioctl: error adding target to table [ 134.198026][ T5886] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.198050][ T5886] usb 5-1: Product: syz [ 134.198064][ T5886] usb 5-1: Manufacturer: syz [ 134.198077][ T5886] usb 5-1: SerialNumber: syz [ 134.309171][ T8255] FAULT_INJECTION: forcing a failure. [ 134.309171][ T8255] name failslab, interval 1, probability 0, space 0, times 0 [ 134.309204][ T8255] CPU: 2 UID: 0 PID: 8255 Comm: syz.2.836 Not tainted syzkaller #0 PREEMPT(full) [ 134.309228][ T8255] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.309239][ T8255] Call Trace: [ 134.309245][ T8255] [ 134.309253][ T8255] dump_stack_lvl+0x100/0x190 [ 134.309284][ T8255] should_fail_ex.cold+0x5/0xa [ 134.309309][ T8255] should_failslab+0xc2/0x120 [ 134.309336][ T8255] kmem_cache_alloc_noprof+0x92/0x6a0 [ 134.309358][ T8255] ? __up_read+0x333/0x980 [ 134.309414][ T8255] ? prepare_creds+0x2c/0x950 [ 134.309442][ T8255] prepare_creds+0x2c/0x950 [ 134.309467][ T8255] prepare_exec_creds+0x10/0x240 [ 134.309492][ T8255] bprm_execve+0xc0/0x1940 [ 134.309511][ T8255] ? do_raw_spin_lock+0x128/0x260 [ 134.309541][ T8255] ? alloc_bprm+0x54e/0x9e0 [ 134.309557][ T8255] ? alloc_bprm+0x54e/0x9e0 [ 134.309582][ T8255] ? __pfx_bprm_execve+0x10/0x10 [ 134.309601][ T8255] ? copy_string_kernel+0x339/0x3f0 [ 134.309642][ T8255] do_execveat_common.isra.0+0x4a5/0x580 [ 134.309667][ T8255] __ia32_compat_sys_execveat+0xe4/0x130 [ 134.309693][ T8255] __do_fast_syscall_32+0x13a/0x8b0 [ 134.309728][ T8255] do_fast_syscall_32+0x32/0x70 [ 134.309758][ T8255] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 134.309782][ T8255] RIP: 0023:0xf6ffefec [ 134.309803][ T8255] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 134.309812][ T8255] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000166 [ 134.309831][ T8255] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 134.309844][ T8255] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000001000 [ 134.309855][ T8255] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 134.309866][ T8255] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 134.309878][ T8255] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 134.309904][ T8255] [ 134.404341][ T8260] FAULT_INJECTION: forcing a failure. [ 134.404341][ T8260] name fail_futex, interval 1, probability 0, space 0, times 0 [ 134.404373][ T8260] CPU: 3 UID: 0 PID: 8260 Comm: syz.4.838 Not tainted syzkaller #0 PREEMPT(full) [ 134.404396][ T8260] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.404407][ T8260] Call Trace: [ 134.404414][ T8260] [ 134.404422][ T8260] dump_stack_lvl+0x100/0x190 [ 134.404452][ T8260] should_fail_ex.cold+0x5/0xa [ 134.404476][ T8260] get_futex_key+0x1d0/0x14f0 [ 134.404511][ T8260] ? __pfx_get_futex_key+0x10/0x10 [ 134.404538][ T8260] ? kasan_save_free_info+0x3b/0x70 [ 134.404569][ T8260] ? kfree+0x22b/0x6d0 [ 134.404598][ T8260] ? __ia32_sys_mount+0x239/0x310 [ 134.404621][ T8260] ? __do_fast_syscall_32+0x13a/0x8b0 [ 134.404648][ T8260] ? do_fast_syscall_32+0x32/0x70 [ 134.404674][ T8260] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 134.404706][ T8260] futex_wake+0xf4/0x5e0 [ 134.404732][ T8260] ? __pfx_futex_wake+0x10/0x10 [ 134.404784][ T8260] do_futex+0x2b2/0x440 [ 134.404804][ T8260] ? __pfx_do_futex+0x10/0x10 [ 134.404823][ T8260] ? kasan_quarantine_put+0x104/0x240 [ 134.404846][ T8260] ? lockdep_hardirqs_on+0x7d/0x110 [ 134.404880][ T8260] __ia32_sys_futex_time32+0x2f4/0x470 [ 134.404907][ T8260] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 134.404929][ T8260] ? __pfx___ia32_sys_mount+0x10/0x10 [ 134.404964][ T8260] __do_fast_syscall_32+0x13a/0x8b0 [ 134.404996][ T8260] do_fast_syscall_32+0x32/0x70 [ 134.405025][ T8260] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 134.405049][ T8260] RIP: 0023:0xf7ff5fec [ 134.405070][ T8260] Code: Unable to access opcode bytes at 0xf7ff5fc2. [ 134.405078][ T8260] RSP: 002b:00000000f54b65cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 134.405096][ T8260] RAX: ffffffffffffffda RBX: 00000000f74b4f8c RCX: 0000000000000081 [ 134.405109][ T8260] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 134.405122][ T8260] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 134.405134][ T8260] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 134.405147][ T8260] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 134.405172][ T8260] [ 134.510963][ T8266] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 134.528300][ T8266] wlan1: associating to AP 50:50:50:50:50:50 with corrupt beacon [ 134.528365][ T8266] wlan1: No basic rates, using min rate instead [ 134.609614][ T5886] legousbtower 5-1:14.57: interrupt endpoints not found [ 134.815781][ T5886] legousbtower 5-1:14.228: get version request failed: -71 [ 134.815852][ T5886] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -71 [ 134.819442][ T5886] usb 5-1: USB disconnect, device number 15 [ 135.476971][ T1480] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 135.491439][ T8309] device-mapper: table: 248:0: raid: No arguments (-EINVAL) [ 135.491458][ T8309] device-mapper: ioctl: error adding target to table [ 135.628078][ T1480] usb 9-1: not running at top speed; connect to a high speed hub [ 135.628104][ T1480] usb 9-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 135.628964][ T1480] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 135.628987][ T1480] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 135.633729][ T1480] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.633752][ T1480] usb 9-1: Product: syz [ 135.633764][ T1480] usb 9-1: Manufacturer: syz [ 135.633776][ T1480] usb 9-1: SerialNumber: syz [ 135.644330][ T1480] oti6858 9-1:1.0: oti6858 converter detected [ 135.652850][ T1480] usb 9-1: oti6858 converter now attached to ttyUSB0 [ 135.759178][ T8320] __nla_validate_parse: 4 callbacks suppressed [ 135.759197][ T8320] netlink: 8 bytes leftover after parsing attributes in process `syz.2.855'. [ 135.957348][ T8293] oti6858 ttyUSB0: oti6858_open(): usb_submit_urb() failed with error -90 [ 136.015461][ T70] usb 9-1: USB disconnect, device number 2 [ 136.020374][ T70] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 136.020672][ T70] oti6858 9-1:1.0: device disconnected [ 136.066992][ T42] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 136.216966][ T42] usb 5-1: Using ep0 maxpacket: 16 [ 136.217778][ T42] usb 5-1: New USB device found, idVendor=14f7, idProduct=0500, bcdDevice=44.85 [ 136.221235][ T42] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.221249][ T42] usb 5-1: Product: syz [ 136.221257][ T42] usb 5-1: Manufacturer: syz [ 136.221265][ T42] usb 5-1: SerialNumber: syz [ 136.223288][ T42] usb 5-1: config 0 descriptor?? [ 136.226354][ T42] usb 5-1: selecting invalid altsetting 1 [ 136.226370][ T42] technisat-usb2: could not set alternate setting to 0 [ 136.428736][ T42] technisat-usb2: firmware version: 0.0 [ 136.428768][ T42] dvb-usb: found a 'Technisat SkyStar USB HD (DVB-S/S2)' in warm state. [ 136.646980][ T8354] netlink: 8 bytes leftover after parsing attributes in process `syz.4.866'. [ 136.787026][ T5886] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 136.835295][ T42] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 136.836333][ T42] dvbdev: DVB: registering new adapter (Technisat SkyStar USB HD (DVB-S/S2)) [ 136.836357][ T42] usb 5-1: media controller created [ 136.836380][ T42] technisat-usb2: i2c-error: out failed 53 = -22 [ 136.836398][ T42] dvb-usb: MAC address reading failed. [ 136.845793][ T42] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 136.867883][ T42] DVB: Unable to find symbol stv090x_attach() [ 136.868146][ T42] dvb-usb: no frontend was attached by 'Technisat SkyStar USB HD (DVB-S/S2)' [ 136.916993][ T42] rc_core: IR keymap rc-technisat-usb2 not found [ 136.917018][ T42] Registered IR keymap rc-empty [ 136.917923][ T42] rc rc0: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.0/usb5/5-1/rc/rc0 [ 136.920133][ T42] input: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.0/usb5/5-1/rc/rc0/input18 [ 136.921734][ T42] dvb-usb: schedule remote query interval to 100 msecs. [ 136.922230][ T42] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully initialized and connected. [ 136.924023][ T42] usb 5-1: USB disconnect, device number 16 [ 136.946302][ T42] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully deinitialized and disconnected. [ 136.951167][ T5886] usb 6-1: not running at top speed; connect to a high speed hub [ 136.951194][ T5886] usb 6-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 136.952342][ T5886] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 136.952364][ T5886] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 136.955216][ T5886] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.955235][ T5886] usb 6-1: Product: syz [ 136.955246][ T5886] usb 6-1: Manufacturer: syz [ 136.955256][ T5886] usb 6-1: SerialNumber: syz [ 136.984231][ T5886] oti6858 6-1:1.0: oti6858 converter detected [ 136.988786][ T5886] usb 6-1: oti6858 converter now attached to ttyUSB0 [ 137.297263][ T8352] oti6858 ttyUSB0: oti6858_open(): usb_submit_urb() failed with error -90 [ 137.376436][ T57] usb 6-1: USB disconnect, device number 17 [ 137.382346][ T57] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 137.382716][ T57] oti6858 6-1:1.0: device disconnected [ 137.644968][ T8384] netlink: 4 bytes leftover after parsing attributes in process `syz.0.876'. [ 138.064737][ T8394] bridge_slave_0: left allmulticast mode [ 138.064764][ T8394] bridge_slave_0: left promiscuous mode [ 138.064939][ T8394] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.093466][ T8394] bridge_slave_1: left allmulticast mode [ 138.093492][ T8394] bridge_slave_1: left promiscuous mode [ 138.093724][ T8394] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.105031][ T8394] bond0: (slave bond_slave_0): Releasing backup interface [ 138.110567][ T8394] bond0: (slave bond_slave_1): Releasing backup interface [ 138.114034][ T8399] netlink: 'syz.2.882': attribute type 63 has an invalid length. [ 138.114867][ T8394] team0: Port device team_slave_0 removed [ 138.117690][ T8394] team0: Port device team_slave_1 removed [ 138.118069][ T8394] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 138.118079][ T8394] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 138.131131][ T8394] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 138.131151][ T8394] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 138.132138][ T8394] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 138.135049][ T8397] team0: Mode changed to "broadcast" [ 138.183478][ T8394] netlink: 'syz.1.881': attribute type 10 has an invalid length. [ 138.231862][ T8394] bond0: (slave bridge0): Enslaving as an active interface with a down link [ 138.263952][ T8394] netlink: 'syz.1.881': attribute type 10 has an invalid length. [ 138.288630][ T8394] 8021q: adding VLAN 0 to HW filter on device bond0 [ 138.290466][ T8394] team0: Port device bond0 added [ 138.298383][ T8394] vlan0: entered promiscuous mode [ 138.302083][ T8394] team0: Port device vlan0 added [ 138.311999][ T8394] tipc: Started in network mode [ 138.312018][ T8394] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 138.312319][ T8394] tipc: Enabled bearer , priority 0 [ 138.484125][ T8411] rdma_rxe: rxe_newlink: failed to add syz_tun [ 138.656926][ T42] usb 7-1: new full-speed USB device number 12 using dummy_hcd [ 138.808242][ T42] usb 7-1: not running at top speed; connect to a high speed hub [ 138.808273][ T42] usb 7-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 138.809981][ T42] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 138.810001][ T42] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 138.812204][ T42] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.812223][ T42] usb 7-1: Product: syz [ 138.812236][ T42] usb 7-1: Manufacturer: syz [ 138.812247][ T42] usb 7-1: SerialNumber: syz [ 138.817796][ T42] oti6858 7-1:1.0: oti6858 converter detected [ 138.838213][ T42] usb 7-1: oti6858 converter now attached to ttyUSB0 [ 138.850574][ T8423] netlink: 'syz.0.892': attribute type 6 has an invalid length. [ 138.850587][ T8423] netlink: 12 bytes leftover after parsing attributes in process `syz.0.892'. [ 139.127516][ T8409] oti6858 ttyUSB0: oti6858_open(): usb_submit_urb() failed with error -90 [ 139.315525][ T8436] netlink: 4 bytes leftover after parsing attributes in process `syz.0.896'. [ 139.428878][ T70] tipc: Node number set to 11578026 [ 139.448225][ T1031] usb 7-1: USB disconnect, device number 12 [ 139.472036][ T1031] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 139.472510][ T1031] oti6858 7-1:1.0: device disconnected [ 139.476267][ T8440] netlink: 'syz.1.897': attribute type 1 has an invalid length. [ 139.610295][ T8445] rdma_rxe: rxe_newlink: failed to add syz_tun [ 139.666125][ T8450] netlink: 'syz.4.901': attribute type 6 has an invalid length. [ 139.666141][ T8450] netlink: 12 bytes leftover after parsing attributes in process `syz.4.901'. [ 139.701119][ T8452] binder: 8451:8452 ioctl c0306201 0 returned -14 [ 140.134625][ T8479] ata1.00: invalid multi_count 128 ignored [ 140.470069][ T8494] netlink: 'syz.1.912': attribute type 6 has an invalid length. [ 140.470085][ T8494] netlink: 12 bytes leftover after parsing attributes in process `syz.1.912'. [ 140.527705][ T57] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 140.687155][ T57] usb 7-1: Using ep0 maxpacket: 8 [ 140.696971][ T70] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 141.060834][ T57] usb 7-1: unable to get BOS descriptor or descriptor too short [ 141.060874][ T57] usb 7-1: New USB device found, idVendor=1164, idProduct=1edc, bcdDevice=32.e2 [ 141.061574][ T57] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 141.061591][ T57] usb 7-1: can't read configurations, error -71 [ 141.215027][ T8506] netlink: 4 bytes leftover after parsing attributes in process `syz.4.916'. [ 141.263400][ T70] usb 5-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 141.265312][ T70] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 141.265349][ T70] usb 5-1: can't read configurations, error -71 [ 141.618591][ T8516] netlink: 'syz.1.919': attribute type 1 has an invalid length. [ 141.914372][ T8525] netlink: 28 bytes leftover after parsing attributes in process `syz.0.924'. [ 141.914428][ T8525] netlink: 28 bytes leftover after parsing attributes in process `syz.0.924'. [ 141.995591][ T8525] netlink: 28 bytes leftover after parsing attributes in process `syz.0.924'. [ 141.995667][ T8525] netlink: 28 bytes leftover after parsing attributes in process `syz.0.924'. [ 142.047418][ T8525] netlink: 28 bytes leftover after parsing attributes in process `syz.0.924'. [ 142.047469][ T8525] netlink: 28 bytes leftover after parsing attributes in process `syz.0.924'. [ 142.154513][ T8537] syz.4.928: vmalloc error: size 57344, failed to allocate pages, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 142.154556][ T8537] CPU: 1 UID: 0 PID: 8537 Comm: syz.4.928 Not tainted syzkaller #0 PREEMPT(full) [ 142.154568][ T8537] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 142.154575][ T8537] Call Trace: [ 142.154579][ T8537] [ 142.154584][ T8537] dump_stack_lvl+0x100/0x190 [ 142.154602][ T8537] warn_alloc.cold+0x9e/0xb2 [ 142.154615][ T8537] ? __pfx_warn_alloc+0x10/0x10 [ 142.154626][ T8537] ? policy_nodemask+0xed/0x4f0 [ 142.154642][ T8537] ? alloc_pages_mpol+0x260/0x550 [ 142.154658][ T8537] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 142.154674][ T8537] ? rcu_read_unlock+0x17/0x60 [ 142.154693][ T8537] __vmalloc_node_range_noprof+0x111c/0x1420 [ 142.154714][ T8537] ? bpf_check+0x112/0xa980 [ 142.154730][ T8537] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 142.154745][ T8537] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 142.154762][ T8537] ? rcu_is_watching+0x13/0xc0 [ 142.154776][ T8537] __kvmalloc_node_noprof+0x3da/0x9b0 [ 142.154789][ T8537] ? bpf_check+0x112/0xa980 [ 142.154804][ T8537] ? ktime_get+0x22c/0x320 [ 142.154819][ T8537] ? bpf_check+0x112/0xa980 [ 142.154836][ T8537] bpf_check+0x112/0xa980 [ 142.154851][ T8537] ? __css_rstat_updated+0x1ce/0x590 [ 142.154866][ T8537] ? __lock_acquire+0x5c0/0x1f40 [ 142.154881][ T8537] ? __pfx___css_rstat_updated+0x10/0x10 [ 142.154900][ T8537] ? __lock_acquire+0x5c0/0x1f40 [ 142.154916][ T8537] ? __mod_memcg_state+0x12b/0x500 [ 142.154931][ T8537] ? __pfx_bpf_check+0x10/0x10 [ 142.154946][ T8537] ? lock_acquire+0x1d1/0x380 [ 142.154960][ T8537] ? bpf_prog_load+0x1a09/0x2a80 [ 142.154976][ T8537] ? find_held_lock+0x2b/0x80 [ 142.154987][ T8537] ? bpf_prog_load+0x1a09/0x2a80 [ 142.155004][ T8537] ? __asan_memset+0x23/0x50 [ 142.155017][ T8537] ? bpf_prog_load+0x1ac3/0x2a80 [ 142.155032][ T8537] bpf_prog_load+0x1ac3/0x2a80 [ 142.155054][ T8537] ? __pfx_bpf_prog_load+0x10/0x10 [ 142.155068][ T8537] ? lock_acquire+0x1d1/0x380 [ 142.155093][ T8537] __sys_bpf+0x1f46/0x4a30 [ 142.155108][ T8537] ? __pfx___sys_bpf+0x10/0x10 [ 142.155118][ T8537] ? find_held_lock+0x2b/0x80 [ 142.155129][ T8537] ? futex_wake+0x4ea/0x5e0 [ 142.155151][ T8537] ? do_vfs_ioctl+0x226/0x13e0 [ 142.155176][ T8537] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 142.155189][ T8537] ? xfd_validate_state+0x129/0x190 [ 142.155208][ T8537] ? __ia32_sys_bpf+0xcc/0x170 [ 142.155221][ T8537] __ia32_sys_bpf+0xcc/0x170 [ 142.155239][ T8537] ? __do_fast_syscall_32+0xb3/0x8b0 [ 142.155262][ T8537] __do_fast_syscall_32+0x13a/0x8b0 [ 142.155285][ T8537] do_fast_syscall_32+0x32/0x70 [ 142.155306][ T8537] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 142.155327][ T8537] RIP: 0023:0xf7ff5fec [ 142.155342][ T8537] Code: Unable to access opcode bytes at 0xf7ff5fc2. [ 142.155347][ T8537] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 142.155357][ T8537] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000440 [ 142.155364][ T8537] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 142.155371][ T8537] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 142.155377][ T8537] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 142.155383][ T8537] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 142.155396][ T8537] [ 142.155400][ T8537] Mem-Info: [ 142.155406][ T8537] active_anon:1228 inactive_anon:5187 isolated_anon:0 [ 142.155406][ T8537] active_file:14802 inactive_file:11202 isolated_file:0 [ 142.155406][ T8537] unevictable:1000 dirty:187 writeback:0 [ 142.155406][ T8537] slab_reclaimable:6408 slab_unreclaimable:55241 [ 142.155406][ T8537] mapped:24248 shmem:1378 pagetables:1337 [ 142.155406][ T8537] sec_pagetables:301 bounce:0 [ 142.155406][ T8537] kernel_misc_reclaimable:0 [ 142.155406][ T8537] free:58217 free_pcp:17585 free_cma:0 [ 142.155432][ T8537] Node 0 active_anon:24kB inactive_anon:8kB active_file:28kB inactive_file:376kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:36kB dirty:4kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8384kB pagetables:1320kB sec_pagetables:1120kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 142.155459][ T8537] Node 1 active_anon:4888kB inactive_anon:20740kB active_file:59180kB inactive_file:44432kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:96956kB dirty:744kB writeback:0kB shmem:3512kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5528kB pagetables:4028kB sec_pagetables:84kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 142.155486][ T8537] Node 0 DMA free:2572kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:48kB local_pcp:0kB free_cma:0kB [ 142.155515][ T8537] lowmem_reserve[]: 0 277 277 277 277 [ 142.155533][ T8537] Node 0 DMA32 free:15660kB boost:0kB min:12628kB low:15784kB high:18940kB reserved_highatomic:0kB free_highatomic:0kB active_anon:24kB inactive_anon:8kB active_file:28kB inactive_file:376kB unevictable:2000kB writepending:4kB zspages:8kB present:1032196kB managed:284568kB mlocked:0kB bounce:0kB free_pcp:11944kB local_pcp:3000kB free_cma:0kB [ 142.155565][ T8537] lowmem_reserve[]: 0 0 0 0 0 [ 142.155583][ T8537] Node 1 DMA32 free:214636kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0kB free_highatomic:0kB active_anon:4888kB inactive_anon:20740kB active_file:59180kB inactive_file:44432kB unevictable:2000kB writepending:744kB zspages:2144kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:58348kB local_pcp:23564kB free_cma:0kB [ 142.155612][ T8537] lowmem_reserve[]: 0 0 0 0 0 [ 142.155630][ T8537] Node 0 DMA: 53*4kB (U) 9*8kB (UM) 9*16kB (UM) 11*32kB (UM) 8*64kB (UM) 0*128kB 1*256kB (M) 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 2572kB [ 142.155701][ T8537] Node 0 DMA32: 273*4kB (UE) 55*8kB (UE) 11*16kB (UME) 154*32kB (UME) 45*64kB (UME) 16*128kB (UME) 4*256kB (UM) 2*512kB (UM) 0*1024kB 1*2048kB (M) 0*4096kB = 15660kB [ 142.155777][ T8537] Node 1 DMA32: 1440*4kB (UME) 1005*8kB (UME) 651*16kB (UME) 535*32kB (UME) 446*64kB (UME) 125*128kB (UME) 79*256kB (UME) 46*512kB (UME) 35*1024kB (UM) 16*2048kB (UM) 4*4096kB (UM) = 214648kB [ 142.155859][ T8537] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 142.155868][ T8537] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 142.155876][ T8537] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 142.155884][ T8537] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 142.155892][ T8537] 27835 total pagecache pages [ 142.155896][ T8537] 457 pages in swap cache [ 142.155900][ T8537] Free swap = 119724kB [ 142.155904][ T8537] Total swap = 124996kB [ 142.155907][ T8537] 524155 pages RAM [ 142.155911][ T8537] 0 pages HighMem/MovableOnly [ 142.155914][ T8537] 212121 pages reserved [ 142.155918][ T8537] 0 pages cma reserved [ 142.516963][ T1480] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 142.517083][ T70] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 142.551599][ T8555] netlink: 28 bytes leftover after parsing attributes in process `syz.2.936'. [ 142.551652][ T8555] netlink: 28 bytes leftover after parsing attributes in process `syz.2.936'. [ 142.576436][ T8555] netlink: 28 bytes leftover after parsing attributes in process `syz.2.936'. [ 142.657668][ T8564] syz1: rxe_newlink: already configured on syz_tun [ 142.667041][ T70] usb 5-1: Using ep0 maxpacket: 32 [ 142.667157][ T1480] usb 9-1: Using ep0 maxpacket: 8 [ 142.672688][ T70] usb 5-1: unable to get BOS descriptor or descriptor too short [ 142.672727][ T70] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 142.676113][ T70] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 142.676134][ T70] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 142.676152][ T70] usb 5-1: config 14 has no interface number 0 [ 142.676165][ T70] usb 5-1: config 14 has no interface number 1 [ 142.676260][ T70] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 142.676283][ T70] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 142.676303][ T70] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 142.676324][ T70] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 142.676346][ T70] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 142.676429][ T70] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 142.676452][ T70] usb 5-1: config 14 interface 57 has no altsetting 0 [ 142.676467][ T70] usb 5-1: config 14 interface 228 has no altsetting 0 [ 142.687912][ T70] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.687935][ T70] usb 5-1: Product: syz [ 142.687948][ T70] usb 5-1: Manufacturer: syz [ 142.688048][ T70] usb 5-1: SerialNumber: syz [ 142.736373][ T8568] netlink: 'syz.2.939': attribute type 1 has an invalid length. [ 142.739499][ T8570] FAULT_INJECTION: forcing a failure. [ 142.739499][ T8570] name failslab, interval 1, probability 0, space 0, times 0 [ 142.739518][ T8570] CPU: 3 UID: 0 PID: 8570 Comm: syz.1.941 Not tainted syzkaller #0 PREEMPT(full) [ 142.739531][ T8570] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 142.739537][ T8570] Call Trace: [ 142.739541][ T8570] [ 142.739546][ T8570] dump_stack_lvl+0x100/0x190 [ 142.739563][ T8570] should_fail_ex.cold+0x5/0xa [ 142.739577][ T8570] should_failslab+0xc2/0x120 [ 142.739593][ T8570] __kmalloc_cache_noprof+0x91/0x6d0 [ 142.739610][ T8570] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 142.739627][ T8570] ? nfs_alloc_fhandle+0x3b/0x90 [ 142.739643][ T8570] nfs_alloc_fhandle+0x3b/0x90 [ 142.739655][ T8570] nfs_init_fs_context+0x65/0x1510 [ 142.739671][ T8570] alloc_fs_context+0x60c/0xf40 [ 142.739688][ T8570] __ia32_sys_fsopen+0xef/0x230 [ 142.739721][ T8570] __do_fast_syscall_32+0x13a/0x8b0 [ 142.739741][ T8570] do_fast_syscall_32+0x32/0x70 [ 142.739757][ T8570] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 142.739772][ T8570] RIP: 0023:0xf7f56fec [ 142.739785][ T8570] Code: Unable to access opcode bytes at 0xf7f56fc2. [ 142.739789][ T8570] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 00000000000001ae [ 142.739801][ T8570] RAX: ffffffffffffffda RBX: 0000000080000100 RCX: 0000000000000000 [ 142.739808][ T8570] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 142.739815][ T8570] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 142.739821][ T8570] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 142.739828][ T8570] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 142.739843][ T8570] [ 142.886267][ T1480] usb 9-1: unable to get BOS descriptor or descriptor too short [ 142.886294][ T1480] usb 9-1: New USB device found, idVendor=1164, idProduct=1edc, bcdDevice=32.e2 [ 142.888917][ T1480] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 142.888936][ T1480] usb 9-1: can't read configurations, error -71 [ 143.097948][ T70] legousbtower 5-1:14.57: interrupt endpoints not found [ 143.304234][ T70] legousbtower 5-1:14.228: get version request failed: -71 [ 143.304308][ T70] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -71 [ 143.309424][ T70] usb 5-1: USB disconnect, device number 19 [ 143.751083][ T8603] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 143.751099][ T8603] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 143.751202][ T8603] vhci_hcd vhci_hcd.0: Device attached [ 143.927137][ T1757] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 143.946986][ T57] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 143.962613][ T8615] netlink: 'syz.4.956': attribute type 1 has an invalid length. [ 143.987033][ T1757] usb 41-1: new full-speed USB device number 4 using vhci_hcd [ 144.116970][ T57] usb 6-1: Using ep0 maxpacket: 8 [ 144.168879][ T42] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 144.368375][ T57] usb 6-1: unable to get BOS descriptor or descriptor too short [ 144.368401][ T57] usb 6-1: New USB device found, idVendor=1164, idProduct=1edc, bcdDevice=32.e2 [ 144.369026][ T57] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 144.369042][ T57] usb 6-1: can't read configurations, error -71 [ 144.537430][ T42] usb 5-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 144.538114][ T42] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 144.538136][ T42] usb 5-1: can't read configurations, error -71 [ 144.922497][ T8629] syz1: rxe_newlink: already configured on syz_tun [ 145.897573][ T8677] netlink: 'syz.0.979': attribute type 6 has an invalid length. [ 146.746288][ T8696] bridge2: entered promiscuous mode [ 146.756674][ T8604] vhci_hcd: connection reset by peer [ 146.757616][ T5788] vhci_hcd vhci_hcd.2: stop threads [ 146.757631][ T5788] vhci_hcd vhci_hcd.2: release socket [ 146.757851][ T5788] vhci_hcd vhci_hcd.2: disconnect device [ 146.834713][ T8697] __nla_validate_parse: 22 callbacks suppressed [ 146.834725][ T8697] netlink: 24 bytes leftover after parsing attributes in process `syz.4.985'. [ 146.858245][ T8699] rdma_rxe: rxe_newlink: failed to add syz_tun [ 147.128683][ T8705] netlink: 'syz.2.988': attribute type 1 has an invalid length. [ 147.308681][ T8711] bridge0: port 1(syz_tun) entered blocking state [ 147.308761][ T8711] bridge0: port 1(syz_tun) entered disabled state [ 147.308915][ T8711] syz_tun: entered allmulticast mode [ 147.313131][ T8711] syz_tun: entered promiscuous mode [ 147.318071][ T8711] bridge0: port 1(syz_tun) entered blocking state [ 147.318118][ T8711] bridge0: port 1(syz_tun) entered forwarding state [ 147.348306][ T8711] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 147.556157][ T8718] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 147.556174][ T8718] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 147.556243][ T8718] vhci_hcd vhci_hcd.0: Device attached [ 147.737986][ T5843] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 147.797086][ T5843] usb 37-1: new full-speed USB device number 2 using vhci_hcd [ 147.929932][ T8737] wlan1: No basic rates, using min rate instead [ 147.931773][ T8737] wlan1: authenticate with 50:50:50:50:50:50 (local address=08:02:11:00:00:01) [ 147.931789][ T8737] wlan1: send auth to 50:50:50:50:50:50 (try 1/3) [ 147.932324][ T1166] wlan1: send auth to 50:50:50:50:50:50 (try 2/3) [ 147.932639][ T1166] wlan1: send auth to 50:50:50:50:50:50 (try 3/3) [ 147.933609][ T8737] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 147.985554][ T8737] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 147.986676][ T8737] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 148.058474][ T8742] bridge5: entered promiscuous mode [ 148.133946][ T8743] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1003'. [ 148.587025][ T1480] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 148.737011][ T1480] usb 6-1: Using ep0 maxpacket: 32 [ 148.739421][ T1480] usb 6-1: unable to get BOS descriptor or descriptor too short [ 148.739459][ T1480] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 148.740551][ T1480] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 148.740569][ T1480] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 148.740585][ T1480] usb 6-1: config 14 has no interface number 0 [ 148.740598][ T1480] usb 6-1: config 14 has no interface number 1 [ 148.740640][ T1480] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 148.740657][ T1480] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 148.740676][ T1480] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 148.740694][ T1480] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 148.740714][ T1480] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 148.740733][ T1480] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 148.740752][ T1480] usb 6-1: config 14 interface 57 has no altsetting 0 [ 148.740765][ T1480] usb 6-1: config 14 interface 228 has no altsetting 0 [ 148.742905][ T1480] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.742922][ T1480] usb 6-1: Product: syz [ 148.742933][ T1480] usb 6-1: Manufacturer: syz [ 148.742945][ T1480] usb 6-1: SerialNumber: syz [ 148.758069][ T8750] netlink: 'syz.4.1006': attribute type 1 has an invalid length. [ 149.117430][ T1757] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 149.165181][ T1480] legousbtower 6-1:14.57: interrupt endpoints not found [ 149.274723][ T8757] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1009'. [ 149.274737][ T8757] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1009'. [ 149.375270][ T1480] legousbtower 6-1:14.228: get version request failed: -71 [ 149.375343][ T1480] legousbtower 6-1:14.228: probe with driver legousbtower failed with error -71 [ 149.396079][ T1480] usb 6-1: USB disconnect, device number 20 [ 149.457489][ T76] wlan1: authentication with 50:50:50:50:50:50 timed out [ 149.632241][ T8767] batman_adv: batadv0: Adding interface: syzkaller0 [ 149.632253][ T8767] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 149.632269][ T8767] batman_adv: batadv0: Interface activated: syzkaller0 [ 149.635468][ T8766] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 149.663115][ T8766] batman_adv: batadv0: Removing interface: syzkaller0 [ 150.049788][ T8777] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1017'. [ 150.551476][ T8719] vhci_hcd: connection reset by peer [ 150.554596][ T5788] vhci_hcd vhci_hcd.0: stop threads [ 150.554620][ T5788] vhci_hcd vhci_hcd.0: release socket [ 150.555563][ T5788] vhci_hcd vhci_hcd.0: disconnect device [ 151.018316][ T8802] bridge5: entered promiscuous mode [ 151.114737][ T8803] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1027'. [ 151.166989][ T5815] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 151.328757][ T5815] usb 9-1: Using ep0 maxpacket: 32 [ 151.335453][ T5815] usb 9-1: unable to get BOS descriptor or descriptor too short [ 151.335482][ T5815] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 151.337095][ T5815] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 151.337116][ T5815] usb 9-1: config 14 has an invalid interface number: 228 but max is 1 [ 151.337132][ T5815] usb 9-1: config 14 has no interface number 0 [ 151.337144][ T5815] usb 9-1: config 14 has no interface number 1 [ 151.337184][ T5815] usb 9-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 151.337202][ T5815] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 151.337221][ T5815] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 151.337242][ T5815] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 151.337263][ T5815] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 151.337360][ T5815] usb 9-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 151.337381][ T5815] usb 9-1: config 14 interface 57 has no altsetting 0 [ 151.337394][ T5815] usb 9-1: config 14 interface 228 has no altsetting 0 [ 151.340627][ T5815] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.340650][ T5815] usb 9-1: Product: syz [ 151.340663][ T5815] usb 9-1: Manufacturer: syz [ 151.340674][ T5815] usb 9-1: SerialNumber: syz [ 151.494838][ T8810] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 151.494857][ T8810] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 151.494968][ T8810] vhci_hcd vhci_hcd.0: Device attached [ 151.679035][ T8819] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1033'. [ 151.679525][ T8819] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1033'. [ 151.679835][ T8819] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1033'. [ 151.680048][ T8819] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1033'. [ 151.767949][ T5815] legousbtower 9-1:14.57: interrupt endpoints not found [ 151.971777][ C1] raw-gadget.0 gadget.4: ignoring, device is not running [ 151.973375][ T5815] legousbtower 9-1:14.228: get version request failed: -71 [ 151.973443][ T5815] legousbtower 9-1:14.228: probe with driver legousbtower failed with error -71 [ 151.983554][ T5815] usb 9-1: USB disconnect, device number 5 [ 152.189870][ T8828] syz.1.1037 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 152.189894][ T8828] CPU: 0 UID: 0 PID: 8828 Comm: syz.1.1037 Not tainted syzkaller #0 PREEMPT(full) [ 152.189908][ T8828] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 152.189916][ T8828] Call Trace: [ 152.189921][ T8828] [ 152.189926][ T8828] dump_stack_lvl+0x100/0x190 [ 152.189947][ T8828] dump_header+0xfb/0x606 [ 152.189962][ T8828] oom_kill_process.cold+0xd/0x380 [ 152.189976][ T8828] out_of_memory+0x340/0x14f0 [ 152.189995][ T8828] ? __pfx_out_of_memory+0x10/0x10 [ 152.190014][ T8828] mem_cgroup_out_of_memory+0xc6/0x130 [ 152.190028][ T8828] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 152.190039][ T8828] ? find_held_lock+0x2b/0x80 [ 152.190054][ T8828] ? do_raw_spin_unlock+0x145/0x1e0 [ 152.190064][ T8828] ? _raw_spin_unlock+0x28/0x50 [ 152.190079][ T8828] try_charge_memcg+0x783/0xf60 [ 152.190099][ T8828] ? __pfx_try_charge_memcg+0x10/0x10 [ 152.190115][ T8828] ? find_held_lock+0x2b/0x80 [ 152.190126][ T8828] ? rcu_read_unlock+0x17/0x60 [ 152.190142][ T8828] ? rcu_read_unlock+0x17/0x60 [ 152.190162][ T8828] __memcg_slab_post_alloc_hook+0x4a1/0x1270 [ 152.190184][ T8828] ? kasan_save_track+0x14/0x30 [ 152.190198][ T8828] kmem_cache_alloc_lru_noprof+0x4f6/0x6a0 [ 152.190212][ T8828] ? alloc_inode+0x183/0x250 [ 152.190231][ T8828] alloc_inode+0x183/0x250 [ 152.190247][ T8828] iget_locked+0x1d9/0x6d0 [ 152.190263][ T8828] ? __pfx_iget_locked+0x10/0x10 [ 152.190278][ T8828] ? kernfs_root+0xee/0x2a0 [ 152.190290][ T8828] ? kernfs_root+0xee/0x2a0 [ 152.190306][ T8828] kernfs_get_inode+0x46/0x470 [ 152.190318][ T8828] kernfs_iop_lookup+0x1a7/0x2d0 [ 152.190332][ T8828] ? __pfx_kernfs_iop_lookup+0x10/0x10 [ 152.190346][ T8828] lookup_open+0xa79/0x1990 [ 152.190368][ T8828] path_openat+0xa2c/0x2440 [ 152.190383][ T8828] ? __pfx_path_openat+0x10/0x10 [ 152.190401][ T8828] do_file_open+0x20e/0x430 [ 152.190414][ T8828] ? __pfx_do_file_open+0x10/0x10 [ 152.190446][ T8828] ? _raw_spin_unlock+0x28/0x50 [ 152.190460][ T8828] ? alloc_fd+0x471/0x7a0 [ 152.190477][ T8828] do_sys_openat2+0x10f/0x1e0 [ 152.190494][ T8828] ? __pfx_do_sys_openat2+0x10/0x10 [ 152.190516][ T8828] __ia32_compat_sys_openat+0x12d/0x210 [ 152.190551][ T8828] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 152.190576][ T8828] __do_fast_syscall_32+0x13a/0x8b0 [ 152.190597][ T8828] do_fast_syscall_32+0x32/0x70 [ 152.190614][ T8828] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 152.190630][ T8828] RIP: 0023:0xf7f56fec [ 152.190645][ T8828] Code: Unable to access opcode bytes at 0xf7f56fc2. [ 152.190650][ T8828] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 152.190661][ T8828] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000380 [ 152.190668][ T8828] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 152.190674][ T8828] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 152.190680][ T8828] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 152.190687][ T8828] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 152.190701][ T8828] [ 152.191182][ T8828] memory: usage 8kB, limit 8kB, failcnt 21 [ 152.191193][ T8828] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 152.191200][ T8828] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 152.191207][ T8828] Memory cgroup stats for /syz1/test: [ 152.191301][ T8828] cache 0 [ 152.191306][ T8828] rss 0 [ 152.191310][ T8828] rss_huge 0 [ 152.191314][ T8828] shmem 0 [ 152.191318][ T8828] mapped_file 0 [ 152.191322][ T8828] dirty 0 [ 152.191326][ T8828] writeback 0 [ 152.191330][ T8828] workingset_refault_anon 0 [ 152.191334][ T8828] workingset_refault_file 0 [ 152.191338][ T8828] swap 0 [ 152.191342][ T8828] swapcached 0 [ 152.191346][ T8828] pgpgin 0 [ 152.191350][ T8828] pgpgout 0 [ 152.191354][ T8828] pgfault 0 [ 152.191358][ T8828] pgmajfault 0 [ 152.191362][ T8828] inactive_anon 0 [ 152.191366][ T8828] active_anon 0 [ 152.191370][ T8828] inactive_file 0 [ 152.191374][ T8828] active_file 0 [ 152.191377][ T8828] unevictable 0 [ 152.191381][ T8828] hierarchical_memory_limit 8192 [ 152.191385][ T8828] hierarchical_memsw_limit 9223372036854771712 [ 152.191390][ T8828] total_cache 0 [ 152.191394][ T8828] total_rss 0 [ 152.191397][ T8828] total_rss_huge 0 [ 152.191401][ T8828] total_shmem 0 [ 152.191404][ T8828] total_mapped_file 0 [ 152.191408][ T8828] total_dirty 0 [ 152.191412][ T8828] total_writeback 0 [ 152.191416][ T8828] total_workingset_refault_anon 0 [ 152.191420][ T8828] total_workingset_refault_file 0 [ 152.191424][ T8828] total_swap 0 [ 152.191434][ T8828] total_swapcached 0 [ 152.191439][ T8828] total_pgpgin 0 [ 152.191443][ T8828] total_pgpgout 0 [ 152.191447][ T8828] total_pgfault 0 [ 152.191452][ T8828] total_pgmajfault 0 [ 152.191455][ T8828] total_inactive_anon 0 [ 152.191460][ T8828] total_active_anon 0 [ 152.191464][ T8828] total_inactive_file 0 [ 152.191468][ T8828] total_active_file 0 [ 152.191473][ T8828] total_unevictable 0 [ 152.191478][ T8828] anon_cost 0 [ 152.191482][ T8828] file_cost 0 [ 152.191486][ T8828] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.1037,pid=8827,uid=0 [ 152.191694][ T8828] Memory cgroup out of memory: Killed process 8827 (syz.1.1037) total-vm:102028kB, anon-rss:880kB, file-rss:22952kB, shmem-rss:0kB, UID:0 pgtables:112kB oom_score_adj:1000 [ 152.253477][ T8830] syz.1.1038 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=2, oom_score_adj=1000 [ 152.253501][ T8830] CPU: 1 UID: 0 PID: 8830 Comm: syz.1.1038 Not tainted syzkaller #0 PREEMPT(full) [ 152.253515][ T8830] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 152.253522][ T8830] Call Trace: [ 152.253527][ T8830] [ 152.253532][ T8830] dump_stack_lvl+0x100/0x190 [ 152.253550][ T8830] dump_header+0xfb/0x606 [ 152.253563][ T8830] oom_kill_process.cold+0xd/0x380 [ 152.253579][ T8830] out_of_memory+0x340/0x14f0 [ 152.253598][ T8830] ? __pfx_out_of_memory+0x10/0x10 [ 152.253616][ T8830] mem_cgroup_out_of_memory+0xc6/0x130 [ 152.253629][ T8830] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 152.253640][ T8830] ? find_held_lock+0x2b/0x80 [ 152.253654][ T8830] ? do_raw_spin_unlock+0x145/0x1e0 [ 152.253665][ T8830] ? _raw_spin_unlock+0x28/0x50 [ 152.253683][ T8830] try_charge_memcg+0x783/0xf60 [ 152.253712][ T8830] ? __pfx_try_charge_memcg+0x10/0x10 [ 152.253734][ T8830] ? find_held_lock+0x2b/0x80 [ 152.253749][ T8830] ? rcu_read_unlock+0x17/0x60 [ 152.253773][ T8830] ? rcu_read_unlock+0x17/0x60 [ 152.253805][ T8830] __memcg_slab_post_alloc_hook+0x4a1/0x1270 [ 152.253838][ T8830] ? kasan_unpoison+0x27/0x60 [ 152.253858][ T8830] __kvmalloc_node_noprof+0x750/0x9b0 [ 152.253883][ T8830] ? bpf_stack_liveness_init+0x29/0xd0 [ 152.253906][ T8830] bpf_stack_liveness_init+0x29/0xd0 [ 152.253927][ T8830] bpf_check+0x7b83/0xa980 [ 152.253959][ T8830] ? __css_rstat_updated+0x1ce/0x590 [ 152.253983][ T8830] ? __lock_acquire+0x5c0/0x1f40 [ 152.254008][ T8830] ? __pfx___css_rstat_updated+0x10/0x10 [ 152.254047][ T8830] ? __pfx_bpf_check+0x10/0x10 [ 152.254071][ T8830] ? lock_acquire+0x1d1/0x380 [ 152.254095][ T8830] ? find_held_lock+0x2b/0x80 [ 152.254114][ T8830] ? bpf_prog_load+0x1a09/0x2a80 [ 152.254138][ T8830] ? __asan_memset+0x23/0x50 [ 152.254156][ T8830] ? bpf_prog_load+0x1ac3/0x2a80 [ 152.254177][ T8830] bpf_prog_load+0x1ac3/0x2a80 [ 152.254203][ T8830] ? __pfx_bpf_prog_load+0x10/0x10 [ 152.254223][ T8830] ? lock_acquire+0x1d1/0x380 [ 152.254267][ T8830] __sys_bpf+0x1f46/0x4a30 [ 152.254293][ T8830] ? __pfx___sys_bpf+0x10/0x10 [ 152.254310][ T8830] ? find_held_lock+0x2b/0x80 [ 152.254324][ T8830] ? futex_wake+0x4ea/0x5e0 [ 152.254357][ T8830] ? __lock_acquire+0x5c0/0x1f40 [ 152.254377][ T8830] ? ksys_write+0x190/0x250 [ 152.254393][ T8830] ? ksys_write+0x190/0x250 [ 152.254428][ T8830] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 152.254447][ T8830] ? __ia32_sys_futex_time32+0x2fd/0x470 [ 152.254465][ T8830] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 152.254486][ T8830] ? __ia32_sys_bpf+0xcc/0x170 [ 152.254505][ T8830] __ia32_sys_bpf+0xcc/0x170 [ 152.254527][ T8830] ? __do_fast_syscall_32+0xb3/0x8b0 [ 152.254552][ T8830] __do_fast_syscall_32+0x13a/0x8b0 [ 152.254577][ T8830] do_fast_syscall_32+0x32/0x70 [ 152.254604][ T8830] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 152.254623][ T8830] RIP: 0023:0xf7f56fec [ 152.254640][ T8830] Code: Unable to access opcode bytes at 0xf7f56fc2. [ 152.254645][ T8830] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 152.254657][ T8830] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000440 [ 152.254665][ T8830] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 152.254673][ T8830] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 152.254680][ T8830] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 152.254687][ T8830] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 152.254700][ T8830] [ 152.254705][ T8830] memory: usage 88kB, limit 96kB, failcnt 62 [ 152.254712][ T8830] memory+swap: usage 88kB, limit 9007199254740988kB, failcnt 0 [ 152.254718][ T8830] kmem: usage 80kB, limit 9007199254740988kB, failcnt 0 [ 152.254725][ T8830] Memory cgroup stats for /syz1/test: [ 152.254830][ T8830] cache 0 [ 152.255590][ T8830] rss 0 [ 152.255597][ T8830] rss_huge 0 [ 152.255600][ T8830] shmem 0 [ 152.255604][ T8830] mapped_file 0 [ 152.255608][ T8830] dirty 0 [ 152.255612][ T8830] writeback 0 [ 152.255616][ T8830] workingset_refault_anon 0 [ 152.255621][ T8830] workingset_refault_file 0 [ 152.255625][ T8830] swap 0 [ 152.255629][ T8830] swapcached 0 [ 152.255632][ T8830] pgpgin 0 [ 152.255637][ T8830] pgpgout 0 [ 152.255641][ T8830] pgfault 0 [ 152.255645][ T8830] pgmajfault 0 [ 152.255649][ T8830] inactive_anon 0 [ 152.255653][ T8830] active_anon 0 [ 152.255656][ T8830] inactive_file 0 [ 152.255660][ T8830] active_file 0 [ 152.255664][ T8830] unevictable 0 [ 152.255668][ T8830] hierarchical_memory_limit 98304 [ 152.255673][ T8830] hierarchical_memsw_limit 9223372036854771712 [ 152.255678][ T8830] total_cache 0 [ 152.255681][ T8830] total_rss 0 [ 152.255685][ T8830] total_rss_huge 0 [ 152.255689][ T8830] total_shmem 0 [ 152.255693][ T8830] total_mapped_file 0 [ 152.255699][ T8830] total_dirty 0 [ 152.255704][ T8830] total_writeback 0 [ 152.255709][ T8830] total_workingset_refault_anon 0 [ 152.255715][ T8830] total_workingset_refault_file 0 [ 152.255720][ T8830] total_swap 0 [ 152.255725][ T8830] total_swapcached 0 [ 152.255730][ T8830] total_pgpgin 0 [ 152.255735][ T8830] total_pgpgout 0 [ 152.255740][ T8830] total_pgfault 0 [ 152.255745][ T8830] total_pgmajfault 0 [ 152.255750][ T8830] total_inactive_anon 0 [ 152.255756][ T8830] total_active_anon 0 [ 152.255762][ T8830] total_inactive_file 0 [ 152.255768][ T8830] total_active_file 0 [ 152.255773][ T8830] total_unevictable 0 [ 152.255776][ T8830] anon_cost 0 [ 152.255780][ T8830] file_cost 0 [ 152.255784][ T8830] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.1038,pid=8829,uid=0 [ 152.256036][ T8830] Memory cgroup out of memory: Killed process 8829 (syz.1.1038) total-vm:102028kB, anon-rss:888kB, file-rss:22888kB, shmem-rss:0kB, UID:0 pgtables:112kB oom_score_adj:1000 [ 152.343648][ T8834] syzkaller0: entered promiscuous mode [ 152.343668][ T8834] syzkaller0: entered allmulticast mode [ 152.357780][ T12] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 152.357820][ T12] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 152.357849][ T12] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 152.357884][ T12] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 152.540570][ T8842] netlink: 'syz.1.1043': attribute type 1 has an invalid length. [ 152.591337][ T8845] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 152.857712][ T8856] __nla_validate_parse: 1 callbacks suppressed [ 152.857730][ T8856] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1049'. [ 153.200163][ T8874] batman_adv: batadv0: Adding interface: syzkaller0 [ 153.200175][ T8874] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 153.200191][ T8874] batman_adv: batadv0: Interface activated: syzkaller0 [ 153.217098][ T5788] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 153.217137][ T5788] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 153.217164][ T5788] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 153.217190][ T5788] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 153.486913][ T1031] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 153.566928][ T63] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 153.637559][ T1031] usb 7-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 153.638393][ T1031] usb 7-1: config 1 has an invalid interface number: 3 but max is 0 [ 153.638406][ T1031] usb 7-1: config 1 has no interface number 0 [ 153.639950][ T1031] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.639962][ T1031] usb 7-1: Product: syz [ 153.639970][ T1031] usb 7-1: Manufacturer: syz [ 153.639977][ T1031] usb 7-1: SerialNumber: syz [ 153.650945][ T1031] usb 7-1: 3:1 : does not exist [ 153.650963][ T1031] usb 7-1: 3:2 : does not exist [ 153.678101][ T8881] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1062'. [ 153.678583][ T8881] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1062'. [ 153.678739][ T8881] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1062'. [ 153.679628][ T8881] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1062'. [ 153.679722][ T8881] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1062'. [ 153.717046][ T63] usb 6-1: Using ep0 maxpacket: 8 [ 153.811790][ T8886] sl0: header compression turned on [ 153.852940][ T1031] usb 7-1: USB disconnect, device number 15 [ 154.002754][ T63] usb 6-1: unable to get BOS descriptor or descriptor too short [ 154.002781][ T63] usb 6-1: New USB device found, idVendor=1164, idProduct=1edc, bcdDevice=32.e2 [ 154.004072][ T63] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 154.004088][ T63] usb 6-1: can't read configurations, error -71 [ 154.197152][ T42] usb 9-1: new full-speed USB device number 6 using dummy_hcd [ 154.387538][ T42] usb 9-1: unable to get BOS descriptor or descriptor too short [ 154.388165][ T42] usb 9-1: New USB device found, idVendor=056a, idProduct=00d8, bcdDevice= 0.40 [ 154.388815][ T42] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 154.388831][ T42] usb 9-1: can't read configurations, error -71 [ 154.492917][ T8811] vhci_hcd: connection reset by peer [ 154.493198][ T5788] vhci_hcd vhci_hcd.0: stop threads [ 154.493213][ T5788] vhci_hcd vhci_hcd.0: release socket [ 154.493328][ T5788] vhci_hcd vhci_hcd.0: disconnect device [ 154.541391][ T8912] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 154.557437][ T5843] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 154.594439][ T8917] bridge6: entered promiscuous mode [ 154.598653][ T8912] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 154.601267][ T8912] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 154.668946][ T8918] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1070'. [ 155.475190][ T8934] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 155.475208][ T8934] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 155.475391][ T8934] vhci_hcd vhci_hcd.0: Device attached [ 155.657358][ T5843] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 155.716929][ T5843] usb 41-1: new full-speed USB device number 5 using vhci_hcd [ 155.954445][ T8947] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(9) [ 156.862169][ T8974] device-mapper: table: 248:0: zero-length target [ 156.862180][ T8974] device-mapper: ioctl: error adding target to table [ 157.246931][ T25] usb 6-1: new full-speed USB device number 23 using dummy_hcd [ 157.398999][ T25] usb 6-1: not running at top speed; connect to a high speed hub [ 157.399018][ T25] usb 6-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 157.400030][ T25] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 157.401707][ T25] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.401719][ T25] usb 6-1: Product: syz [ 157.401726][ T25] usb 6-1: Manufacturer: syz [ 157.401733][ T25] usb 6-1: SerialNumber: syz [ 157.405843][ T25] oti6858 6-1:1.0: oti6858 converter detected [ 157.410688][ T25] usb 6-1: oti6858 converter now attached to ttyUSB0 [ 157.952911][ T25] usb 6-1: USB disconnect, device number 23 [ 157.959182][ T25] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 157.959503][ T25] oti6858 6-1:1.0: device disconnected [ 158.253425][ T9002] device-mapper: table: 248:0: zero-length target [ 158.253441][ T9002] device-mapper: ioctl: error adding target to table [ 158.470682][ T8935] vhci_hcd: connection reset by peer [ 158.473740][ T5830] vhci_hcd vhci_hcd.2: stop threads [ 158.473763][ T5830] vhci_hcd vhci_hcd.2: release socket [ 158.473808][ T5830] vhci_hcd vhci_hcd.2: disconnect device [ 158.519448][ T9023] device-mapper: table: 248:0: zero-length target [ 158.519459][ T9023] device-mapper: ioctl: error adding target to table [ 158.538506][ T9024] netlink: 'syz.4.1111': attribute type 1 has an invalid length. [ 159.494899][ T9043] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 159.494916][ T9043] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 159.494993][ T9043] vhci_hcd vhci_hcd.0: Device attached [ 159.607079][ T9053] netlink: 'syz.4.1124': attribute type 1 has an invalid length. [ 159.677217][ T1480] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 159.737006][ T25] usb 7-1: new full-speed USB device number 16 using dummy_hcd [ 159.737156][ T1480] usb 39-1: new full-speed USB device number 2 using vhci_hcd [ 159.907871][ T25] usb 7-1: not running at top speed; connect to a high speed hub [ 159.907890][ T25] usb 7-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 159.908766][ T25] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 159.910265][ T25] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.910278][ T25] usb 7-1: Product: syz [ 159.910285][ T25] usb 7-1: Manufacturer: syz [ 159.910292][ T25] usb 7-1: SerialNumber: syz [ 159.917071][ T25] oti6858 7-1:1.0: oti6858 converter detected [ 159.919156][ T25] usb 7-1: oti6858 converter now attached to ttyUSB0 [ 160.452863][ T8879] usb 7-1: USB disconnect, device number 16 [ 160.457965][ T8879] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 160.458295][ T8879] oti6858 7-1:1.0: device disconnected [ 160.796961][ T5843] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 161.664588][ T9078] FAULT_INJECTION: forcing a failure. [ 161.664588][ T9078] name failslab, interval 1, probability 0, space 0, times 0 [ 161.664609][ T9078] CPU: 3 UID: 0 PID: 9078 Comm: syz.0.1132 Not tainted syzkaller #0 PREEMPT(full) [ 161.664623][ T9078] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 161.664630][ T9078] Call Trace: [ 161.664634][ T9078] [ 161.664639][ T9078] dump_stack_lvl+0x100/0x190 [ 161.664657][ T9078] should_fail_ex.cold+0x5/0xa [ 161.664672][ T9078] should_failslab+0xc2/0x120 [ 161.664688][ T9078] kmem_cache_alloc_noprof+0x92/0x6a0 [ 161.664701][ T9078] ? __up_read+0x333/0x980 [ 161.664717][ T9078] ? prepare_creds+0x2c/0x950 [ 161.664734][ T9078] prepare_creds+0x2c/0x950 [ 161.664749][ T9078] prepare_exec_creds+0x10/0x240 [ 161.664788][ T9078] bprm_execve+0xc0/0x1940 [ 161.664841][ T9078] ? do_raw_spin_lock+0x128/0x260 [ 161.664862][ T9078] ? alloc_bprm+0x54e/0x9e0 [ 161.664872][ T9078] ? alloc_bprm+0x54e/0x9e0 [ 161.664884][ T9078] ? __pfx_bprm_execve+0x10/0x10 [ 161.664895][ T9078] ? copy_string_kernel+0x339/0x3f0 [ 161.664910][ T9078] do_execveat_common.isra.0+0x4a5/0x580 [ 161.664925][ T9078] __ia32_compat_sys_execveat+0xe4/0x130 [ 161.664940][ T9078] __do_fast_syscall_32+0x13a/0x8b0 [ 161.664967][ T9078] do_fast_syscall_32+0x32/0x70 [ 161.664984][ T9078] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 161.664999][ T9078] RIP: 0023:0xf70befec [ 161.665013][ T9078] Code: Unable to access opcode bytes at 0xf70befc2. [ 161.665019][ T9078] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000166 [ 161.665030][ T9078] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 161.665037][ T9078] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000001000 [ 161.665043][ T9078] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 161.665049][ T9078] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 161.665056][ T9078] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 161.665069][ T9078] [ 161.720146][ T9080] bridge7: entered promiscuous mode [ 161.794997][ T9081] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1133'. [ 162.157031][ T1757] usb 7-1: new full-speed USB device number 17 using dummy_hcd [ 162.308267][ T1757] usb 7-1: not running at top speed; connect to a high speed hub [ 162.308300][ T1757] usb 7-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 162.309820][ T1757] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 162.312290][ T1757] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.312309][ T1757] usb 7-1: Product: syz [ 162.312319][ T1757] usb 7-1: Manufacturer: syz [ 162.312330][ T1757] usb 7-1: SerialNumber: syz [ 162.322827][ T1757] oti6858 7-1:1.0: oti6858 converter detected [ 162.325966][ T1757] usb 7-1: oti6858 converter now attached to ttyUSB0 [ 162.491834][ T9044] vhci_hcd: connection reset by peer [ 162.492221][ T5788] vhci_hcd vhci_hcd.1: stop threads [ 162.492242][ T5788] vhci_hcd vhci_hcd.1: release socket [ 162.492324][ T5788] vhci_hcd vhci_hcd.1: disconnect device [ 162.566312][ T9094] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1138'. [ 162.567371][ T9094] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1138'. [ 162.979242][ T5815] usb 7-1: USB disconnect, device number 17 [ 162.984979][ T5815] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 162.985361][ T5815] oti6858 7-1:1.0: device disconnected [ 163.089278][ T9126] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 163.089303][ T9126] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 163.089436][ T9126] vhci_hcd vhci_hcd.0: Device attached [ 163.176932][ T70] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 163.326974][ T70] usb 5-1: Using ep0 maxpacket: 8 [ 163.686886][ T0] NOHZ tick-stop error: local softirq work is pending, handler #102!!! [ 163.766358][ T70] usb 5-1: unable to get BOS descriptor or descriptor too short [ 163.766383][ T70] usb 5-1: New USB device found, idVendor=1164, idProduct=1edc, bcdDevice=32.e2 [ 163.772548][ T70] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 163.772568][ T70] usb 5-1: can't read configurations, error -71 [ 163.886932][ T9] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 164.036914][ T9] usb 7-1: Using ep0 maxpacket: 32 [ 164.039200][ T9] usb 7-1: unable to get BOS descriptor or descriptor too short [ 164.039237][ T9] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 164.040284][ T9] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 164.040304][ T9] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 164.040319][ T9] usb 7-1: config 14 has no interface number 0 [ 164.040333][ T9] usb 7-1: config 14 has no interface number 1 [ 164.040377][ T9] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 164.040395][ T9] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 164.040415][ T9] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 164.040435][ T9] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 164.040456][ T9] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 164.040476][ T9] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 164.040497][ T9] usb 7-1: config 14 interface 57 has no altsetting 0 [ 164.040510][ T9] usb 7-1: config 14 interface 228 has no altsetting 0 [ 164.042611][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.042628][ T9] usb 7-1: Product: syz [ 164.042639][ T9] usb 7-1: Manufacturer: syz [ 164.042651][ T9] usb 7-1: SerialNumber: syz [ 164.454026][ T9] legousbtower 7-1:14.57: interrupt endpoints not found [ 164.666539][ T9] legousbtower 7-1:14.228: get version request failed: -71 [ 164.666613][ T9] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 164.672532][ T9] usb 7-1: USB disconnect, device number 18 [ 165.131419][ T9155] device-mapper: table: 248:0: zero-length target [ 165.131429][ T9155] device-mapper: ioctl: error adding target to table [ 165.220541][ T5099] Bluetooth: hci3: command 0x0406 tx timeout [ 165.342030][ T9167] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1161'. [ 165.470572][ T9172] netlink: 'syz.4.1162': attribute type 1 has an invalid length. [ 166.091500][ T9127] vhci_hcd: connection reset by peer [ 166.092590][ T12] vhci_hcd vhci_hcd.1: stop threads [ 166.092605][ T12] vhci_hcd vhci_hcd.1: release socket [ 166.092680][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 166.156956][ T1480] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 166.218243][ T9174] ftl_cs: FTL header not found. [ 166.254617][ T9174] debugfs: out of free dentries, can not create file 'busy' [ 166.306329][ T9174] debugfs: out of free dentries, can not create file 'sched_tags' [ 166.357544][ T9174] debugfs: out of free dentries, can not create directory 'cpu0' [ 166.399940][ T9174] debugfs: out of free dentries, can not create directory 'cpu5' [ 166.499332][ T9174] debugfs: out of free dentries, can not create directory '31:1' [ 166.505598][ T9174] block2mtd: mtd1: [/dev/loop0] erase_size = 4KiB [4096] [ 166.558924][ T9194] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1170'. [ 167.090235][ T9201] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 167.139942][ T9203] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 167.139959][ T9203] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 167.142509][ T9203] vhci_hcd vhci_hcd.0: Device attached [ 167.326980][ T57] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 167.396967][ T57] usb 45-1: new full-speed USB device number 3 using vhci_hcd [ 167.492864][ T9216] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(9) [ 167.574404][ T9219] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1179'. [ 167.576356][ T9219] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1179'. [ 168.510386][ T9232] batman_adv: batadv0: Adding interface: syzkaller0 [ 168.510398][ T9232] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 168.510755][ T9232] batman_adv: batadv0: Interface activated: syzkaller0 [ 168.668137][ T9240] netlink: 'syz.1.1187': attribute type 1 has an invalid length. [ 169.380323][ T9246] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 169.432982][ T9246] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 169.434254][ T9246] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 169.887072][ T63] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 170.001338][ T9262] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1197'. [ 170.002282][ T9262] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1197'. [ 170.002460][ T9262] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1197'. [ 170.002845][ T9262] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1197'. [ 170.003220][ T9262] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1197'. [ 170.057300][ T63] usb 6-1: Using ep0 maxpacket: 32 [ 170.061091][ T63] usb 6-1: unable to get BOS descriptor or descriptor too short [ 170.061117][ T63] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 170.061879][ T63] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 170.061892][ T63] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 170.061902][ T63] usb 6-1: config 14 has no interface number 0 [ 170.061910][ T63] usb 6-1: config 14 has no interface number 1 [ 170.061935][ T63] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 170.061948][ T63] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 170.061960][ T63] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 170.061973][ T63] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 170.061985][ T63] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 170.061998][ T63] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 170.062011][ T63] usb 6-1: config 14 interface 57 has no altsetting 0 [ 170.062020][ T63] usb 6-1: config 14 interface 228 has no altsetting 0 [ 170.063556][ T63] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.063568][ T63] usb 6-1: Product: syz [ 170.063576][ T63] usb 6-1: Manufacturer: syz [ 170.063583][ T63] usb 6-1: SerialNumber: syz [ 170.145461][ T9204] vhci_hcd: connection reset by peer [ 170.147623][ T12] vhci_hcd vhci_hcd.4: stop threads [ 170.147639][ T12] vhci_hcd vhci_hcd.4: release socket [ 170.147667][ T12] vhci_hcd vhci_hcd.4: disconnect device [ 170.194929][ T9278] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01) [ 170.194955][ T9278] wlan1: send auth to 08:02:11:00:00:00 (try 1/3) [ 170.198399][ T9278] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 170.202524][ T9280] FAULT_INJECTION: forcing a failure. [ 170.202524][ T9280] name failslab, interval 1, probability 0, space 0, times 0 [ 170.202555][ T9280] CPU: 2 UID: 0 PID: 9280 Comm: syz.2.1204 Not tainted syzkaller #0 PREEMPT(full) [ 170.202578][ T9280] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 170.202590][ T9280] Call Trace: [ 170.202597][ T9280] [ 170.202606][ T9280] dump_stack_lvl+0x100/0x190 [ 170.202637][ T9280] should_fail_ex.cold+0x5/0xa [ 170.202664][ T9280] should_failslab+0xc2/0x120 [ 170.202691][ T9280] __kmalloc_cache_noprof+0x91/0x6d0 [ 170.202718][ T9280] ? lockdep_init_map_type+0x5c/0x250 [ 170.202743][ T9280] ? fuse_pqueue_alloc+0x44/0xe0 [ 170.202770][ T9280] fuse_pqueue_alloc+0x44/0xe0 [ 170.202795][ T9280] fuse_dev_chan_new+0x2a/0x2b0 [ 170.202815][ T9280] ? kobject_get_unless_zero+0x156/0x200 [ 170.202836][ T9280] cuse_channel_open+0x1f/0x8f0 [ 170.202859][ T9280] ? __pfx_cuse_channel_open+0x10/0x10 [ 170.202883][ T9280] misc_open+0x26d/0x450 [ 170.202905][ T9280] ? __pfx_misc_open+0x10/0x10 [ 170.202926][ T9280] chrdev_open+0x234/0x6a0 [ 170.202947][ T9280] ? __pfx_apparmor_file_open+0x10/0x10 [ 170.202976][ T9280] ? __pfx_chrdev_open+0x10/0x10 [ 170.202996][ T9280] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 170.203025][ T9280] do_dentry_open+0x6ab/0x14d0 [ 170.203046][ T9280] ? __pfx_chrdev_open+0x10/0x10 [ 170.203073][ T9280] vfs_open+0x82/0x3f0 [ 170.203102][ T9280] path_openat+0x19fa/0x2440 [ 170.203129][ T9280] ? __pfx_path_openat+0x10/0x10 [ 170.203150][ T9280] do_file_open+0x20e/0x430 [ 170.203172][ T9280] ? __pfx_do_file_open+0x10/0x10 [ 170.203213][ T9280] ? _raw_spin_unlock+0x28/0x50 [ 170.203236][ T9280] ? alloc_fd+0x471/0x7a0 [ 170.203265][ T9280] do_sys_openat2+0x10f/0x1e0 [ 170.203291][ T9280] ? __pfx_do_sys_openat2+0x10/0x10 [ 170.203325][ T9280] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 170.203381][ T9280] __ia32_compat_sys_openat+0x12d/0x210 [ 170.203412][ T9280] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 170.203449][ T9280] __do_fast_syscall_32+0x13a/0x8b0 [ 170.203482][ T9280] do_fast_syscall_32+0x32/0x70 [ 170.203512][ T9280] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 170.203536][ T9280] RIP: 0023:0xf6ffefec [ 170.203557][ T9280] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 170.203564][ T9280] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 170.203580][ T9280] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000080 [ 170.203590][ T9280] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 170.203598][ T9280] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 170.203607][ T9280] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 170.203617][ T9280] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 170.203641][ T9280] [ 170.250264][ T1165] wlan1: authenticated [ 170.250550][ T9278] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 170.257891][ T1165] wlan1: associate with 08:02:11:00:00:00 (try 1/3) [ 170.299445][ T9284] device-mapper: table: 248:0: zero-length target [ 170.299455][ T9284] device-mapper: ioctl: error adding target to table [ 170.367786][ T37] wlan1: associate with 08:02:11:00:00:00 (try 2/3) [ 170.476806][ T63] legousbtower 6-1:14.57: interrupt endpoints not found [ 170.477069][ T1165] wlan1: associate with 08:02:11:00:00:00 (try 3/3) [ 170.506984][ T5815] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 170.586998][ T1165] wlan1: association with 08:02:11:00:00:00 timed out [ 170.657771][ T5815] usb 5-1: Using ep0 maxpacket: 8 [ 170.882270][ T63] legousbtower 6-1:14.228: get version request failed: -32 [ 170.882396][ T63] legousbtower 6-1:14.228: probe with driver legousbtower failed with error -32 [ 170.936520][ T5815] usb 5-1: unable to get BOS descriptor or descriptor too short [ 170.936547][ T5815] usb 5-1: New USB device found, idVendor=1164, idProduct=1edc, bcdDevice=32.e2 [ 170.937287][ T5815] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 170.937315][ T5815] usb 5-1: can't read configurations, error -71 [ 171.255032][ T9306] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 171.255056][ T9306] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 171.255191][ T9306] vhci_hcd vhci_hcd.0: Device attached [ 171.414354][ T9318] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 172.259456][ T9348] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1230'. [ 172.259512][ T9348] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1230'. [ 172.298947][ T9351] device-mapper: table: 248:0: zero-length target [ 172.298957][ T9351] device-mapper: ioctl: error adding target to table [ 172.354606][ T9353] device-mapper: table: 248:0: rai: unknown target type [ 172.354619][ T9353] device-mapper: ioctl: error adding target to table [ 172.391092][ T9356] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 172.652555][ T1480] usb 6-1: USB disconnect, device number 24 [ 172.707672][ T9358] syz.1.1234: vmalloc error: size 4096, failed to allocate pages, mode:0x500dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 172.707738][ T9358] CPU: 2 UID: 0 PID: 9358 Comm: syz.1.1234 Not tainted syzkaller #0 PREEMPT(full) [ 172.707772][ T9358] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 172.707783][ T9358] Call Trace: [ 172.707790][ T9358] [ 172.707796][ T9358] dump_stack_lvl+0x100/0x190 [ 172.707824][ T9358] warn_alloc.cold+0x9e/0xb2 [ 172.707843][ T9358] ? __pfx_warn_alloc+0x10/0x10 [ 172.707860][ T9358] ? policy_nodemask+0xed/0x4f0 [ 172.707884][ T9358] ? alloc_pages_mpol+0x260/0x550 [ 172.707907][ T9358] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 172.707935][ T9358] ? __get_vm_area_node+0x22b/0x350 [ 172.707962][ T9358] __vmalloc_node_range_noprof+0x111c/0x1420 [ 172.707994][ T9358] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 172.708021][ T9358] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 172.708046][ T9358] ? rcu_is_watching+0x13/0xc0 [ 172.708063][ T9358] ? trace_hrtimer_start+0x77/0x220 [ 172.708084][ T9358] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 172.708105][ T9358] __vmalloc_node_noprof+0xad/0xf0 [ 172.708128][ T9358] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 172.708152][ T9358] __vmalloc_noprof+0xa3/0x120 [ 172.708175][ T9358] ? __pfx___vmalloc_noprof+0x10/0x10 [ 172.708195][ T9358] ? rcu_is_watching+0x13/0xc0 [ 172.708214][ T9358] ? rcu_is_watching+0x13/0xc0 [ 172.708230][ T9358] ? apparmor_capable+0x1d7/0x4d0 [ 172.708254][ T9358] bpf_prog_alloc_no_stats+0x58/0x690 [ 172.708275][ T9358] ? security_capable+0x80/0x260 [ 172.708298][ T9358] bpf_prog_alloc+0x3b/0x200 [ 172.708318][ T9358] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 172.708343][ T9358] bpf_prog_load+0x49e/0x2a80 [ 172.708366][ T9358] ? __lock_acquire+0x5c0/0x1f40 [ 172.708392][ T9358] ? __pfx_bpf_prog_load+0x10/0x10 [ 172.708413][ T9358] ? lock_acquire+0x1d1/0x380 [ 172.708453][ T9358] __sys_bpf+0x1f46/0x4a30 [ 172.708477][ T9358] ? __pfx___sys_bpf+0x10/0x10 [ 172.708492][ T9358] ? find_held_lock+0x2b/0x80 [ 172.708508][ T9358] ? futex_wake+0x4ea/0x5e0 [ 172.708542][ T9358] ? __lock_acquire+0x5c0/0x1f40 [ 172.708565][ T9358] ? ksys_write+0x190/0x250 [ 172.708583][ T9358] ? ksys_write+0x190/0x250 [ 172.708614][ T9358] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 172.708634][ T9358] ? xfd_validate_state+0x129/0x190 [ 172.708662][ T9358] ? __ia32_sys_bpf+0xcc/0x170 [ 172.708681][ T9358] __ia32_sys_bpf+0xcc/0x170 [ 172.708701][ T9358] ? __do_fast_syscall_32+0xb3/0x8b0 [ 172.708730][ T9358] __do_fast_syscall_32+0x13a/0x8b0 [ 172.708753][ T9358] do_fast_syscall_32+0x32/0x70 [ 172.708770][ T9358] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 172.708784][ T9358] RIP: 0023:0xf7f56fec [ 172.708798][ T9358] Code: Unable to access opcode bytes at 0xf7f56fc2. [ 172.708803][ T9358] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 172.708813][ T9358] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000440 [ 172.708821][ T9358] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 172.708827][ T9358] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 172.708833][ T9358] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 172.708840][ T9358] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 172.708853][ T9358] [ 172.708904][ T9358] Mem-Info: [ 172.708910][ T9358] active_anon:1091 inactive_anon:5379 isolated_anon:0 [ 172.708910][ T9358] active_file:20406 inactive_file:6666 isolated_file:0 [ 172.708910][ T9358] unevictable:1004 dirty:266 writeback:0 [ 172.708910][ T9358] slab_reclaimable:6457 slab_unreclaimable:55244 [ 172.708910][ T9358] mapped:24285 shmem:1373 pagetables:1321 [ 172.708910][ T9358] sec_pagetables:302 bounce:0 [ 172.708910][ T9358] kernel_misc_reclaimable:0 [ 172.708910][ T9358] free:55467 free_pcp:19167 free_cma:0 [ 172.708942][ T9358] Node 0 active_anon:24kB inactive_anon:8kB active_file:32kB inactive_file:372kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:36kB dirty:4kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8384kB pagetables:1320kB sec_pagetables:1120kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 172.708969][ T9358] Node 1 active_anon:4340kB inactive_anon:21508kB active_file:81592kB inactive_file:26292kB unevictable:2016kB isolated(anon):0kB isolated(file):0kB mapped:97104kB dirty:1060kB writeback:0kB shmem:3492kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5640kB pagetables:3964kB sec_pagetables:88kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 172.708997][ T9358] Node 0 DMA free:2572kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:56kB local_pcp:52kB free_cma:0kB [ 172.709026][ T9358] lowmem_reserve[]: 0 277 277 277 277 [ 172.709044][ T9358] Node 0 DMA32 free:15660kB boost:0kB min:12628kB low:15784kB high:18940kB reserved_highatomic:0kB free_highatomic:0kB active_anon:24kB inactive_anon:8kB active_file:32kB inactive_file:372kB unevictable:2000kB writepending:4kB zspages:8kB present:1032196kB managed:284568kB mlocked:0kB bounce:0kB free_pcp:12492kB local_pcp:3856kB free_cma:0kB [ 172.709074][ T9358] lowmem_reserve[]: 0 0 0 0 0 [ 172.709091][ T9358] Node 1 DMA32 free:203636kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0kB free_highatomic:0kB active_anon:4340kB inactive_anon:21508kB active_file:81592kB inactive_file:26292kB unevictable:2016kB writepending:1060kB zspages:2144kB present:1048432kB managed:948208kB mlocked:16kB bounce:0kB free_pcp:64120kB local_pcp:12896kB free_cma:0kB [ 172.709121][ T9358] lowmem_reserve[]: 0 0 0 0 0 [ 172.709138][ T9358] Node 0 DMA: 53*4kB (U) 9*8kB (UM) 9*16kB (UM) 11*32kB (UM) 8*64kB (UM) 0*128kB 1*256kB (M) 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 2572kB [ 172.709228][ T9358] Node 0 DMA32: 273*4kB (UE) 55*8kB (UE) 11*16kB (UME) 154*32kB (UME) 45*64kB (UME) 16*128kB (UME) 4*256kB (UM) 2*512kB (UM) 0*1024kB 1*2048kB (M) 0*4096kB = 15660kB [ 172.709304][ T9358] Node 1 DMA32: 2235*4kB (UME) 1505*8kB (UME) 628*16kB (UME) 357*32kB (UME) 358*64kB (UME) 200*128kB (UME) 90*256kB (UME) 51*512kB (UME) 40*1024kB (UM) 9*2048kB (UM) 1*4096kB (M) = 203604kB [ 172.709388][ T9358] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 172.709397][ T9358] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 172.709405][ T9358] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 172.709413][ T9358] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 172.709421][ T9358] 28898 total pagecache pages [ 172.709424][ T9358] 457 pages in swap cache [ 172.709428][ T9358] Free swap = 119724kB [ 172.709434][ T9358] Total swap = 124996kB [ 172.709438][ T9358] 524155 pages RAM [ 172.709441][ T9358] 0 pages HighMem/MovableOnly [ 172.709445][ T9358] 212121 pages reserved [ 172.709448][ T9358] 0 pages cma reserved [ 172.997659][ T9372] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(9) [ 173.247111][ T1480] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 173.368629][ T9394] device-mapper: table: 248:0: r: unknown target type [ 173.368642][ T9394] device-mapper: ioctl: error adding target to table [ 173.400512][ T9397] device-mapper: table: 248:0: zero-length target [ 173.400521][ T9397] device-mapper: ioctl: error adding target to table [ 173.418149][ T1480] usb 6-1: Using ep0 maxpacket: 32 [ 173.420055][ T1480] usb 6-1: unable to get BOS descriptor or descriptor too short [ 173.420088][ T1480] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 173.420946][ T1480] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 173.420965][ T1480] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 173.420980][ T1480] usb 6-1: config 14 has no interface number 0 [ 173.420992][ T1480] usb 6-1: config 14 has no interface number 1 [ 173.421037][ T1480] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 173.421055][ T1480] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 173.421075][ T1480] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 173.421095][ T1480] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 173.421115][ T1480] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 173.421136][ T1480] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 173.421155][ T1480] usb 6-1: config 14 interface 57 has no altsetting 0 [ 173.421169][ T1480] usb 6-1: config 14 interface 228 has no altsetting 0 [ 173.422948][ T1480] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 173.422966][ T1480] usb 6-1: Product: syz [ 173.422977][ T1480] usb 6-1: Manufacturer: syz [ 173.422988][ T1480] usb 6-1: SerialNumber: syz [ 173.830159][ T1480] legousbtower 6-1:14.57: interrupt endpoints not found [ 174.232866][ T1480] legousbtower 6-1:14.228: get version request failed: -32 [ 174.232941][ T1480] legousbtower 6-1:14.228: probe with driver legousbtower failed with error -32 [ 174.243333][ T9307] vhci_hcd: connection reset by peer [ 174.243670][ T5788] vhci_hcd vhci_hcd.4: stop threads [ 174.243692][ T5788] vhci_hcd vhci_hcd.4: release socket [ 174.248252][ T5788] vhci_hcd vhci_hcd.4: disconnect device [ 174.317041][ T57] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 174.348921][ T9413] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1256'. [ 174.349506][ T9413] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1256'. [ 174.385519][ T9411] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1258'. [ 174.462305][ T9418] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1260'. [ 174.462358][ T9418] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1260'. [ 174.490405][ T9418] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1260'. [ 174.490469][ T9418] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1260'. [ 174.540670][ T9418] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1260'. [ 174.540723][ T9418] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1260'. [ 174.569211][ T5843] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 174.669879][ T9428] netlink: 'syz.4.1262': attribute type 1 has an invalid length. [ 174.738830][ T5843] usb 7-1: Using ep0 maxpacket: 8 [ 175.168718][ T9431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1263'. [ 175.200240][ T9433] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 175.200256][ T9433] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 175.200504][ T9433] vhci_hcd vhci_hcd.0: Device attached [ 175.377105][ T57] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 175.436962][ T57] usb 37-1: new full-speed USB device number 3 using vhci_hcd [ 175.687316][ T9448] program syz.4.1270 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 175.717783][ T9450] device-mapper: table: 248:0: raid: No arguments (-EINVAL) [ 175.717798][ T9450] device-mapper: ioctl: error adding target to table [ 176.006576][ T1480] usb 6-1: USB disconnect, device number 25 [ 176.496938][ T1480] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 176.626913][ T8879] usb 6-1: new full-speed USB device number 26 using dummy_hcd [ 176.658185][ T1480] usb 9-1: Using ep0 maxpacket: 32 [ 176.659920][ T1480] usb 9-1: unable to get BOS descriptor or descriptor too short [ 176.659956][ T1480] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 176.660820][ T1480] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 176.660840][ T1480] usb 9-1: config 14 has an invalid interface number: 228 but max is 1 [ 176.660855][ T1480] usb 9-1: config 14 has no interface number 0 [ 176.660867][ T1480] usb 9-1: config 14 has no interface number 1 [ 176.660909][ T1480] usb 9-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 176.660927][ T1480] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 176.660946][ T1480] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 176.660966][ T1480] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 176.660986][ T1480] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 176.661006][ T1480] usb 9-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 176.661025][ T1480] usb 9-1: config 14 interface 57 has no altsetting 0 [ 176.661039][ T1480] usb 9-1: config 14 interface 228 has no altsetting 0 [ 176.662694][ T1480] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.662706][ T1480] usb 9-1: Product: syz [ 176.662713][ T1480] usb 9-1: Manufacturer: syz [ 176.662725][ T1480] usb 9-1: SerialNumber: syz [ 176.791681][ T8879] usb 6-1: unable to get BOS descriptor or descriptor too short [ 176.792542][ T8879] usb 6-1: New USB device found, idVendor=056a, idProduct=00d8, bcdDevice= 0.40 [ 176.793926][ T8879] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 176.793995][ T8879] usb 6-1: can't read configurations, error -71 [ 177.068855][ T1480] legousbtower 9-1:14.57: interrupt endpoints not found [ 177.319882][ T5843] usb 7-1: unable to get BOS descriptor or descriptor too short [ 177.319908][ T5843] usb 7-1: New USB device found, idVendor=1164, idProduct=1edc, bcdDevice=32.e2 [ 177.322826][ T5843] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 177.322845][ T5843] usb 7-1: can't read configurations, error -71 [ 177.471441][ T1480] legousbtower 9-1:14.228: get version request failed: -32 [ 177.471529][ T1480] legousbtower 9-1:14.228: probe with driver legousbtower failed with error -32 [ 177.509637][ T9513] device-mapper: table: 248:0: raid: Unrecognised raid_type (-EINVAL) [ 177.509658][ T9513] device-mapper: ioctl: error adding target to table [ 177.957025][ T5843] usb 7-1: new full-speed USB device number 20 using dummy_hcd [ 178.122896][ T5843] usb 7-1: unable to get BOS descriptor or descriptor too short [ 178.123682][ T5843] usb 7-1: New USB device found, idVendor=056a, idProduct=00d8, bcdDevice= 0.40 [ 178.126093][ T5843] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 178.126119][ T5843] usb 7-1: can't read configurations, error -71 [ 178.126341][ T5843] usb usb7-port1: attempt power cycle [ 178.199337][ T9434] vhci_hcd: connection reset by peer [ 178.199662][ T5830] vhci_hcd vhci_hcd.0: stop threads [ 178.199683][ T5830] vhci_hcd vhci_hcd.0: release socket [ 178.200904][ T5830] vhci_hcd vhci_hcd.0: disconnect device [ 178.477505][ T10] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 178.621932][ T9536] device-mapper: table: 248:0: raid: Unrecognised raid_type (-EINVAL) [ 178.621946][ T9536] device-mapper: ioctl: error adding target to table [ 178.627015][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 179.063547][ T9566] device-mapper: table: 248:0: raid: Unrecognised raid_type (-EINVAL) [ 179.063562][ T9566] device-mapper: ioctl: error adding target to table [ 179.257454][ T1757] usb 9-1: USB disconnect, device number 8 [ 179.337022][ T5843] usb 6-1: new full-speed USB device number 28 using dummy_hcd [ 179.496070][ T5843] usb 6-1: unable to get BOS descriptor or descriptor too short [ 179.498099][ T5843] usb 6-1: New USB device found, idVendor=056a, idProduct=00d8, bcdDevice= 0.40 [ 179.498843][ T5843] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 179.498874][ T5843] usb 6-1: can't read configurations, error -71 [ 179.741638][ T9586] device-mapper: table: 248:0: raid: Cannot understand number of raid parameters (-EINVAL) [ 179.741654][ T9586] device-mapper: ioctl: error adding target to table [ 179.775797][ T9589] __nla_validate_parse: 12 callbacks suppressed [ 179.775855][ T9589] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1329'. [ 179.775902][ T9589] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1329'. [ 179.801432][ T9589] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1329'. [ 179.801488][ T9589] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1329'. [ 179.849042][ T9589] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1329'. [ 179.849096][ T9589] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1329'. [ 180.006972][ T5531] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 180.035477][ T9603] netlink: 'syz.4.1332': attribute type 1 has an invalid length. [ 180.133472][ T9605] bridge7: entered promiscuous mode [ 180.156956][ T5531] usb 7-1: Using ep0 maxpacket: 32 [ 180.159763][ T5531] usb 7-1: unable to get BOS descriptor or descriptor too short [ 180.159787][ T5531] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 180.160625][ T5531] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 180.160638][ T5531] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 180.160648][ T5531] usb 7-1: config 14 has no interface number 0 [ 180.160656][ T5531] usb 7-1: config 14 has no interface number 1 [ 180.160681][ T5531] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 180.160692][ T5531] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 180.160704][ T5531] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 180.160717][ T5531] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 180.160730][ T5531] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 180.160743][ T5531] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 180.160755][ T5531] usb 7-1: config 14 interface 57 has no altsetting 0 [ 180.160764][ T5531] usb 7-1: config 14 interface 228 has no altsetting 0 [ 180.163211][ T5531] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.163231][ T5531] usb 7-1: Product: syz [ 180.163243][ T5531] usb 7-1: Manufacturer: syz [ 180.163256][ T5531] usb 7-1: SerialNumber: syz [ 180.216662][ T9606] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1334'. [ 180.557977][ T57] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 180.580073][ T5531] legousbtower 7-1:14.57: interrupt endpoints not found [ 180.982068][ T5531] legousbtower 7-1:14.228: get version request failed: -32 [ 180.982146][ T5531] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -32 [ 180.991338][ T9611] device-mapper: table: 248:0: raid: Cannot understand number of raid parameters (-EINVAL) [ 180.991360][ T9611] device-mapper: ioctl: error adding target to table [ 181.270748][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 181.270776][ T10] usb 5-1: New USB device found, idVendor=1164, idProduct=1edc, bcdDevice=32.e2 [ 181.271453][ T10] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 181.271470][ T10] usb 5-1: can't read configurations, error -71 [ 181.449306][ T9630] device-mapper: table: 248:0: raid: Cannot understand number of raid parameters (-EINVAL) [ 181.449321][ T9630] device-mapper: ioctl: error adding target to table [ 181.531928][ T9634] device-mapper: table: 248:0: raid: Cannot understand number of raid devices parameters (-EINVAL) [ 181.531943][ T9634] device-mapper: ioctl: error adding target to table [ 181.935913][ T9654] syz_tun: left allmulticast mode [ 181.935929][ T9654] syz_tun: left promiscuous mode [ 181.936041][ T9654] bridge0: port 1(syz_tun) entered disabled state [ 181.945123][ T9654] bond0: (slave bridge0): Releasing backup interface [ 181.956794][ T9654] team0: Port device bond0 removed [ 181.961529][ T9654] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 181.972018][ T9654] team0: No ports can be present during mode change [ 181.972545][ T9654] netlink: 'syz.1.1353': attribute type 10 has an invalid length. [ 181.976142][ T9654] bond0: (slave bridge0): Enslaving as an active interface with a down link [ 181.977073][ T9654] netlink: 'syz.1.1353': attribute type 10 has an invalid length. [ 181.980801][ T9654] 8021q: adding VLAN 0 to HW filter on device bond0 [ 181.988344][ T9654] team0: Port device bond0 added [ 181.989617][ T9654] tipc: Enabling of bearer rejected, already enabled [ 182.034679][ T9660] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1356'. [ 182.401183][ T9689] bridge_slave_0: left allmulticast mode [ 182.401207][ T9689] bridge_slave_0: left promiscuous mode [ 182.401405][ T9689] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.404148][ T9689] bridge_slave_1: left allmulticast mode [ 182.404164][ T9689] bridge_slave_1: left promiscuous mode [ 182.404261][ T9689] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.422781][ T9689] bond0: (slave bond_slave_0): Releasing backup interface [ 182.426167][ T9689] bond0: (slave bond_slave_1): Releasing backup interface [ 182.440640][ T9689] team0: Port device team_slave_0 removed [ 182.446324][ T9689] team0: Port device team_slave_1 removed [ 182.452415][ T9689] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 182.452434][ T9689] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 182.453841][ T9689] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 182.453858][ T9689] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 182.459415][ T9689] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 182.482543][ T9689] team0: Mode changed to "broadcast" [ 182.483255][ T9689] netlink: 'syz.0.1364': attribute type 10 has an invalid length. [ 182.500713][ T9689] bond0: (slave bridge0): Enslaving as an active interface with a down link [ 182.507254][ T9689] netlink: 'syz.0.1364': attribute type 10 has an invalid length. [ 182.530200][ T9689] 8021q: adding VLAN 0 to HW filter on device bond0 [ 182.531363][ T9689] team0: Port device bond0 added [ 182.535883][ T9689] tipc: Started in network mode [ 182.535903][ T9689] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 182.536029][ T9689] tipc: Enabled bearer , priority 0 [ 182.766712][ T9716] bridge8: entered promiscuous mode [ 182.776156][ T57] usb 7-1: USB disconnect, device number 22 [ 182.861034][ T9729] netlink: zone id is out of range [ 182.861044][ T9729] netlink: get zone limit has 4 unknown bytes [ 182.927191][ T9731] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1373'. [ 182.948820][ T9735] FAULT_INJECTION: forcing a failure. [ 182.948820][ T9735] name failslab, interval 1, probability 0, space 0, times 0 [ 182.948852][ T9735] CPU: 3 UID: 0 PID: 9735 Comm: syz.1.1379 Not tainted syzkaller #0 PREEMPT(full) [ 182.948874][ T9735] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 182.948885][ T9735] Call Trace: [ 182.948892][ T9735] [ 182.948899][ T9735] dump_stack_lvl+0x100/0x190 [ 182.948931][ T9735] should_fail_ex.cold+0x5/0xa [ 182.948956][ T9735] should_failslab+0xc2/0x120 [ 182.948983][ T9735] __kmalloc_noprof+0xfc/0x840 [ 182.949006][ T9735] ? tomoyo_encode2+0xfb/0x3c0 [ 182.949032][ T9735] tomoyo_encode2+0xfb/0x3c0 [ 182.949055][ T9735] tomoyo_encode+0x29/0x50 [ 182.949073][ T9735] tomoyo_realpath_from_path+0x18c/0x690 [ 182.949098][ T9735] tomoyo_mkdev_perm+0x231/0x570 [ 182.949123][ T9735] ? tomoyo_mkdev_perm+0x21d/0x570 [ 182.949178][ T9735] ? __pfx_tomoyo_mkdev_perm+0x10/0x10 [ 182.949207][ T9735] ? do_raw_spin_lock+0x128/0x260 [ 182.949245][ T9735] ? do_raw_spin_unlock+0x145/0x1e0 [ 182.949282][ T9735] ? simple_lookup+0xfc/0x1d0 [ 182.949309][ T9735] tomoyo_path_mknod+0xe2/0x190 [ 182.949332][ T9735] ? __pfx_tomoyo_path_mknod+0x10/0x10 [ 182.949355][ T9735] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 182.949384][ T9735] security_path_mknod+0x161/0x300 [ 182.949407][ T9735] filename_mknodat+0x241/0x7f0 [ 182.949435][ T9735] ? __pfx_filename_mknodat+0x10/0x10 [ 182.949458][ T9735] ? strncpy_from_user+0x19d/0x2d0 [ 182.949488][ T9735] ? do_getname+0x191/0x390 [ 182.949518][ T9735] __ia32_sys_mknodat+0xb4/0xf0 [ 182.949543][ T9735] __do_fast_syscall_32+0x13a/0x8b0 [ 182.949577][ T9735] do_fast_syscall_32+0x32/0x70 [ 182.949607][ T9735] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 182.949632][ T9735] RIP: 0023:0xf7f56fec [ 182.949653][ T9735] Code: Unable to access opcode bytes at 0xf7f56fc2. [ 182.949662][ T9735] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000129 [ 182.949680][ T9735] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000100 [ 182.949699][ T9735] RDX: 00000000000021c0 RSI: 0000000000000103 RDI: 0000000000000000 [ 182.949711][ T9735] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 182.949722][ T9735] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 182.949733][ T9735] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 182.949760][ T9735] [ 182.949780][ T9735] ERROR: Out of memory at tomoyo_realpath_from_path. [ 183.134506][ T9742] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1382'. [ 183.536986][ T10] tipc: Node number set to 11578026 [ 183.760102][ T9761] device-mapper: table: 248:0: raid: Cannot understand number of raid devices parameters (-EINVAL) [ 183.760119][ T9761] device-mapper: ioctl: error adding target to table [ 183.847798][ T9766] device-mapper: table: 248:0: raid: No arguments (-EINVAL) [ 183.847813][ T9766] device-mapper: ioctl: error adding target to table [ 183.982442][ T9780] capability: warning: `syz.0.1397' uses deprecated v2 capabilities in a way that may be insecure [ 184.025095][ T9784] device-mapper: table: 248:0: raid: No arguments (-EINVAL) [ 184.025110][ T9784] device-mapper: ioctl: error adding target to table [ 184.071733][ T9786] bridge_slave_0: left allmulticast mode [ 184.071751][ T9786] bridge_slave_0: left promiscuous mode [ 184.071866][ T9786] bridge0: port 1(bridge_slave_0) entered disabled state [ 184.072176][ T9786] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI [ 184.081924][ T9786] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] [ 184.084869][ T9786] CPU: 3 UID: 0 PID: 9786 Comm: syz.2.1401 Not tainted syzkaller #0 PREEMPT(full) [ 184.087732][ T9786] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 184.090884][ T9786] RIP: 0010:br_del_frame+0x106/0x1a0 [ 184.092561][ T9786] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 87 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 65 18 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 76 49 89 1c 24 48 85 db 74 24 e8 c6 21 6b f7 48 8d [ 184.098506][ T9786] RSP: 0000:ffffc90024cd6ed0 EFLAGS: 00010a06 [ 184.100488][ T9786] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90024351000 [ 184.101722][ T9779] infiniband syz0: set down [ 184.101737][ T9779] infiniband syz0: added bond0 [ 184.105869][ T9786] RDX: 1bd5a00000000024 RSI: ffffffff8aa03f9f RDI: ffffffff914730b8 [ 184.108247][ T9786] RBP: ffffffff914730a0 R08: 0000000055474603 R09: 000000000000002c [ 184.110724][ T9786] R10: 0000000000000200 R11: 0000000000000001 R12: dead000000000122 SYZFAIL: failed to recv rpc [ 184.113788][ T9786] R13: ffff888024853000 R14: 000000000000001c R15: ffff888024853000 [ 184.116953][ T9786] FS: 0000000000000000(0000) GS:ffff888096c60000(0063) knlGS:00000000f53edb40 [ 184.119966][ T9786] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 184.120907][ T9779] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 184.120937][ T9779] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 184.120971][ T9779] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 184.135144][ T9786] CR2: 00000000f721eaa8 CR3: 000000005267b000 CR4: 0000000000352ef0 [ 184.137746][ T9786] Call Trace: [ 184.139153][ T9786] [ 184.140417][ T9786] mep_delete_implementation+0x292/0x340 [ 184.142830][ T9786] br_cfm_port_del+0x14f/0x1e0 [ 184.144859][ T9786] ? __pfx_br_del_slave+0x10/0x10 [ 184.146976][ T9786] del_nbp+0x168/0xd50 [ 184.148704][ T9786] ? __pfx_br_del_slave+0x10/0x10 [ 184.150799][ T9786] br_del_if+0xe0/0x260 [ 184.152594][ T9786] do_set_master+0x172/0x730 [ 184.154565][ T9786] do_setlink.isra.0+0xb2b/0x3e60 [ 184.156695][ T9786] ? stack_trace_save+0x8e/0xc0 [ 184.158770][ T9786] ? is_bpf_text_address+0x25/0x1a0 [ 184.160974][ T9786] ? __pfx_do_setlink.isra.0+0x10/0x10 [ 184.163290][ T9786] ? __lock_acquire+0x5c0/0x1f40 [ 184.164858][ T9786] ? kasan_save_track+0x14/0x30 [ 184.166378][ T9786] ? __kasan_kmalloc+0xaa/0xb0 [ 184.167879][ T9786] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 184.169681][ T9786] ? rtnl_newlink+0x139/0x2620 [ 184.171512][ T9786] ? rtnetlink_rcv_msg+0x95e/0xe90 [ 184.173334][ T9786] ? netlink_rcv_skb+0x159/0x420 [ 184.174928][ T9786] ? netlink_unicast+0x585/0x850 fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 184.176545][ T9786] ? netlink_sendmsg+0x8b0/0xda0 [ 184.178359][ T9786] ? ____sys_sendmsg+0xa4d/0xbe0 [ 184.180126][ T9786] ? ___sys_sendmsg+0x190/0x1e0 [ 184.182047][ T9786] ? lock_acquire+0x1d1/0x380 [ 184.183535][ T9786] ? rtnl_newlink+0xac3/0x2620 [ 184.183707][ T9779] RDS/IB: syz0: added [ 184.183725][ T9779] smc: adding ib device syz0 with port count 1 [ 184.183733][ T9779] smc: ib device syz0 port 1 has no pnetid [ 184.190335][ T9786] ? rcu_is_watching+0x13/0xc0 [ 184.192244][ T9786] ? trace_contention_end+0x126/0x160 [ 184.193960][ T9786] ? __mutex_lock+0x26c/0x1bd0 [ 184.195458][ T9786] ? rtnl_newlink+0xac3/0x2620 [ 184.196965][ T9786] ? __nla_validate_parse+0x1e7/0x28b0 [ 184.198697][ T9786] ? __pfx___mutex_lock+0x10/0x10 [ 184.200324][ T9786] ? rcu_is_watching+0x13/0xc0 [ 184.201861][ T9786] ? apparmor_capable+0x1d7/0x4d0 [ 184.203437][ T9786] rtnl_newlink+0x1dc4/0x2620 [ 184.204920][ T9786] ? __pfx_rtnl_newlink+0x10/0x10 [ 184.206500][ T9786] ? rcu_is_watching+0x13/0xc0 [ 184.208003][ T9786] ? kasan_quarantine_put+0x104/0x240 [ 184.209737][ T9786] ? lockdep_hardirqs_on+0x7d/0x110 [ 184.211415][ T9786] ? __lock_acquire+0x5c0/0x1f40 [ 184.213016][ T9786] ? find_held_lock+0x2b/0x80 [ 184.214755][ T9786] ? lock_acquire+0x1d1/0x380 [ 184.216721][ T9786] ? rtnetlink_rcv_msg+0x1f6/0xe90 [ 184.218737][ T9786] ? find_held_lock+0x2b/0x80 [ 184.220622][ T9786] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 184.222734][ T9786] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 184.224896][ T9786] ? __pfx_rtnl_newlink+0x10/0x10 [ 184.227080][ T9786] rtnetlink_rcv_msg+0x95e/0xe90 [ 184.229297][ T9786] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 184.231069][ T9786] ? ref_tracker_free+0x37e/0x6c0 [ 184.232710][ T9786] netlink_rcv_skb+0x159/0x420 [ 184.234251][ T9786] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 184.236163][ T9786] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 184.237936][ T9786] ? netlink_deliver_tap+0x1ae/0xcc0 [ 184.239575][ T9786] netlink_unicast+0x585/0x850 [ 184.241082][ T9786] ? __pfx_netlink_unicast+0x10/0x10 [ 184.247054][ T9786] netlink_sendmsg+0x8b0/0xda0 [ 184.248621][ T9786] ? __pfx_netlink_sendmsg+0x10/0x10 [ 184.250340][ T9786] ? apparmor_socket_sendmsg+0x165/0x280 [ 184.252163][ T9786] ____sys_sendmsg+0xa4d/0xbe0 [ 184.253766][ T9786] ? __pfx_netlink_sendmsg+0x10/0x10 [ 184.255498][ T9786] ? __pfx_____sys_sendmsg+0x10/0x10 [ 184.257198][ T9786] ___sys_sendmsg+0x190/0x1e0 [ 184.258725][ T9786] ? __pfx____sys_sendmsg+0x10/0x10 [ 184.260561][ T9786] ? futex_wait+0x11e/0x370 [ 184.262065][ T9786] ? find_held_lock+0x2b/0x80 [ 184.263650][ T9786] __sys_sendmsg+0x160/0x210 [ 184.265172][ T9786] ? __pfx___sys_sendmsg+0x10/0x10 [ 184.266825][ T9786] __do_fast_syscall_32+0x13a/0x8b0 [ 184.268493][ T9786] ? lockdep_hardirqs_on+0x7d/0x110 [ 184.270180][ T9786] do_fast_syscall_32+0x32/0x70 [ 184.271765][ T9786] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 184.273854][ T9786] RIP: 0023:0xf6ffefec [ 184.275201][ T9786] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 184.277309][ T9786] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 184.279874][ T9786] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000280 [ 184.282467][ T9786] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 184.285026][ T9786] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 184.287556][ T9786] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 184.290206][ T9786] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 184.292771][ T9786] [ 184.293801][ T9786] Modules linked in: [ 184.295658][ T9786] ---[ end trace 0000000000000000 ]--- [ 184.301162][ T9786] RIP: 0010:br_del_frame+0x106/0x1a0 [ 184.301188][ T9786] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 87 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 65 18 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 76 49 89 1c 24 48 85 db 74 24 e8 c6 21 6b f7 48 8d [ 184.301200][ T9786] RSP: 0000:ffffc90024cd6ed0 EFLAGS: 00010a06 [ 184.301209][ T9786] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90024351000 [ 184.301217][ T9786] RDX: 1bd5a00000000024 RSI: ffffffff8aa03f9f RDI: ffffffff914730b8 [ 184.301223][ T9786] RBP: ffffffff914730a0 R08: 0000000055474603 R09: 000000000000002c [ 184.301230][ T9786] R10: 0000000000000200 R11: 0000000000000001 R12: dead000000000122 [ 184.301236][ T9786] R13: ffff888024853000 R14: 000000000000001c R15: ffff888024853000 [ 184.301244][ T9786] FS: 0000000000000000(0000) GS:ffff888096b60000(0063) knlGS:00000000f53edb40 [ 184.301268][ T9786] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 184.301277][ T9786] CR2: 00000000f7278c10 CR3: 000000005267b000 CR4: 0000000000352ef0 [ 184.301285][ T9786] Kernel panic - not syncing: Fatal exception [ 184.333342][ T9786] Kernel Offset: disabled [ 184.334711][ T9786] Rebooting in 86400 seconds..