last executing test programs: 4.519087939s ago: executing program 0 (id=281): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x3, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="18020000fcffffff0000000003000008850000002800000085000000a000000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000000)={0xf, r0, 0x4b36baea9e1c7e99}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="000126bd700001b133d62ec562bab7670a5b99ea33d7"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x20048004) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fd, 0x0, 0x3, 0x3}, 0x10) recvmmsg(r3, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)=""/36, 0x24}], 0x1}, 0x4}], 0x1, 0x400101a0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) r5 = syz_io_uring_setup(0x34b8, &(0x7f0000000500)={0x0, 0x12d9, 0x20, 0x3, 0xe9}, &(0x7f0000000300)=0x0, 0x0, &(0x7f0000000400)=0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x34000, 0x0) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000040)={0x30, 0x0}) syz_io_uring_submit(r6, 0x0, r7, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r5}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r8 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r8, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x121302, 0x0) write$binfmt_register(r9, &(0x7f0000000040)={0x3a, 'syz2', 0x3a, 'E', 0x3a, 0x0, 0x3a, 'tracefs\x00', 0x3a, '*:@{\':', 0x3a, './trace'}, 0x35) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) 3.679821556s ago: executing program 1 (id=286): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x1e, r0, 0xfffffffffffffffe, r0, 0x0) 3.589850131s ago: executing program 1 (id=287): sendmsg$AUDIT_DEL_RULE(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)={0x420, 0x3f4, 0x10, 0x70bd2b, 0x25dfdbfd, {0x5, 0x0, 0x28, [0xffff, 0x8, 0x0, 0xe, 0x5, 0x401, 0xf7fc, 0xc7, 0xac, 0x3, 0xd, 0x1, 0x39, 0x2, 0x9, 0x7fffffff, 0x55ea, 0x7, 0x401, 0xf2, 0x4, 0x3, 0x7, 0xd, 0x0, 0x1, 0x3, 0x3, 0x9, 0x2, 0x5, 0x1, 0x0, 0x4, 0x7f, 0x0, 0x400, 0x1, 0x1, 0x7fff, 0x7, 0x3, 0x1, 0x1, 0xb, 0x0, 0x8, 0x5, 0x8, 0x401, 0xd, 0x800, 0x1, 0x3, 0x101, 0x0, 0x3, 0x7, 0x0, 0x8, 0xca5, 0x6d0, 0x0, 0x2], [0x9, 0x5, 0x8, 0x9, 0x8000, 0x6, 0xc6, 0x8, 0x2, 0xe, 0x7fff, 0xb6d5, 0x23af, 0x20, 0x7, 0x58, 0x5, 0xffffffff, 0x4, 0x100, 0x7f, 0x6, 0x8, 0x3, 0xc17, 0x0, 0x2, 0x5, 0x5, 0x7ff, 0x8, 0x9, 0x85b4, 0x8, 0xffff, 0x6, 0x2, 0x1000, 0x6, 0x0, 0x3, 0x6a3, 0x2, 0x8000, 0x6, 0x5, 0xbb, 0x1, 0x2, 0x1, 0x10000, 0x2008000, 0x1, 0x6, 0x1000, 0x5, 0x7, 0x2, 0xf, 0x4, 0x4, 0x8, 0x7f, 0x80], [0x1, 0x2, 0x1, 0x7, 0x2, 0x1, 0xfffffffd, 0xfffffffe, 0x3, 0x101, 0x1, 0xfffffffa, 0x3, 0x3, 0xfffffffd, 0x800, 0x2, 0xc, 0x8, 0x0, 0x2244fb8d, 0xaba00000, 0x8, 0x9, 0x401, 0x4, 0x8, 0x0, 0x0, 0x80000001, 0x5, 0x80000000, 0x100, 0x5, 0x7ff, 0x0, 0x827, 0x3, 0xc7, 0x4, 0xa8bc00, 0x81, 0x8001, 0x674, 0x1, 0x1, 0x8001, 0x6, 0x5, 0xfff, 0x0, 0xae9f, 0x6f, 0x0, 0x80, 0x1ff, 0x9, 0x2, 0xfffffffc, 0x7fff, 0x7, 0x0, 0xf, 0x9], [0x5, 0x4, 0x802, 0xfffff800, 0x7f, 0xedb, 0x0, 0x1, 0xfffffffa, 0x40000, 0x7, 0x9, 0x14d98, 0x0, 0x4, 0x4, 0xffffff01, 0x8000, 0x2, 0x7, 0xfffffc01, 0x400, 0x1, 0x1, 0x9, 0x9, 0xed62, 0xa8, 0x6, 0x2, 0x6b2, 0x0, 0x8001, 0x6, 0x6, 0x81, 0xb6e, 0x6e506360, 0x5, 0x2, 0xed, 0x1b, 0xfffffe01, 0x401, 0x3, 0xa61, 0x7fffffff, 0x4, 0x5, 0x5, 0x80, 0x2, 0x4, 0xffff0000, 0x2, 0x1e2, 0x0, 0x30d, 0xfff, 0xfffffffb, 0x7ff, 0x9, 0x6, 0x3]}}, 0x420}}, 0x4000) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4800000041000501010000000000000003010000000000001c0001000600060086dd0000100007"], 0x48}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x40c042, 0x0) gettid() mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_int(r2, &(0x7f0000000700)='notify_on_release\x00', 0x2, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write(r4, &(0x7f0000000040)="2e000000010040", 0x7) write$cgroup_int(r3, &(0x7f00000003c0)=0x1ff, 0x12) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x13) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0x5e}, 0x1c) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000240)={0x10000, 0x3, 0x6000, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) bind$netlink(0xffffffffffffffff, &(0x7f0000001600)={0x10, 0x0, 0x25dfdbff}, 0xc) r5 = socket$inet6(0xa, 0x800, 0x0) setsockopt$sock_linger(r5, 0x1, 0x3c, &(0x7f0000000180)={0x23, 0xffffffff}, 0x8) syz_usb_connect$uac1(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102000000203e1315084000010203010902600003010710050904000000010100000a240175450a0002010209040100000102000009040101010102000009050109100004083c0725010c0308000904020000010200000904024101010200000905820910000de20d07250104090300"], &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat(0xffffffffffffff9c, 0x0, 0x8840, 0xa2) mount(0x0, 0x0, &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0042, 0x0) syz_emit_ethernet(0xae, &(0x7f0000000240)={@random="05b1ff035660", @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x78, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1803"}, {0x0, 0x1, "000001000000000000000000"}, {0x18, 0x1, "fe906d26efe3"}]}}}}}}, 0x0) copy_file_range(r6, &(0x7f0000000000)=0x1, r6, &(0x7f0000000040)=0x8, 0x2, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000e00)={0xfc, {"a2e3ad09ed0d09f91b5e071887f70e09d038e7ff7fc6e5539b0d3f0a8b089b3f383163030890e0879b0a71c6e70a9b336c959b669a242f0a0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d0773090acd3b78130daa61d8e804e000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae13f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c30900000000000000752716286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4402bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea77b5602984e4de7c6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cff7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96050000000000000080f146684078416d59fdee5325928974d12dad99dac44c3f0008047096ac4002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999b596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efe5496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5ca00000000000000008734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebd078ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0003f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e36b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce212659414900005b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c2769310123cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1de51f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72932b99b380000000000000006859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002601e87b162dadc600", 0x1000}}, 0x1006) 3.465342301s ago: executing program 0 (id=288): ioctl$int_out(0xffffffffffffffff, 0x0, &(0x7f0000000840)) 3.369543299s ago: executing program 0 (id=289): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x21, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000f7ffffff000000000800000018110000", @ANYRES32=0x1, @ANYRES32, @ANYBLOB="000000000900000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000185000000d0000000000000000000000df92f0fff0ffffffbf91000000000000b702000001000031d0d6a7a5c80f5000b7000000000000009500000000000000"], &(0x7f00000005c0)='syzkaller\x00', 0x8000, 0xf3, &(0x7f0000000600)=""/243, 0x41100, 0x40, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000700)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000740)={0x4, 0x1, 0x1, 0x3ff}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x5, &(0x7f0000000780)=[0xffffffffffffffff, 0xffffffffffffffff, 0x1], &(0x7f00000007c0)=[{0x0, 0x5, 0x10}, {0x0, 0x2, 0x10, 0xc}, {0x1, 0x3, 0x2, 0x6}, {0x4, 0x3, 0x0, 0x8}, {0x0, 0x3, 0x4, 0x8}], 0x10, 0x8}, 0x94) r2 = openat$cgroup_root(0xffffff9c, &(0x7f0000000900)='./cgroup.net/syz0\x00', 0x200002, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000940)={r1, r2, 0x7, 0x0, @void}, 0x10) read$FUSE(r0, &(0x7f000000b1c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r0, &(0x7f00000042c0)="9ab1446569aa24b774753c9e994c09c24df9d42fa5a228e469b44cecf6f9f5ce5f77c93b1895aaac9cf34b37415f11fe22d6fa0162aa743b242e8fe0a8659e32fb543d7969d6513136a9f332a8074f8ee1e445277ddd5859eb5ac3321eb710be880a441031da9b31f791d54fb3c97cd8ee92b00cbf962be8eb5fd0b7cab207645f59cf87a8c41e2739dd8386b6bb84b627cbf5e09bac876ad4b215f0e510a853c5e8b9f7822b26771d72972290a1f9a6f0a46942be0d0eb7aa5145ff368863b14e9845926088f9f92d554e572926290dc6e6b574aea8c500fbe5697f881c0cec48282c6d07619248da0c3b9aa6f7c778525d1760051e4ba8ef31d3c8d3e1d4214ffa5261ce1fdbc12eba889968137f5c06fea233000296cf18df494b4e7b1bee7dc2f3751c37415d46f6d7ffb3d0f788f2100ee41266e6fba75b61af22e1d7b286507ff100cc34ed28d5a2c8be3231446874bbbde6f3c367ca802d64192ffcce1ea41b2cbc57f7500fc4f8f12fe02690c1c9785bbc35542b59d05600783cf4f4633b374101d8ed395303392b238d198f9f68c8ae928cbf3b558deec6d38ebaa526e749ac4e47dd5b838ec34f2820a1134252ae60159d4e030cf5e5d6f8de799a31e12ae57cfe5a1a3ded525c6e71271271d35a0056265362387a361f21ea0f4b6d46f6a83a8512687e43b31e11b1396d6e9e49cf42b693732e226b55d21a1203022f6be9f8ecccb68de3bf4ce99689514bd752f4e60bd2f8e376d7fae5b5fc8db0f53db8c52746671e361b9319419c1b3f3168b4797ebd2d118ee42dda4bc59dd0251236195c8cdafc0546354eeb28f4c7e71e8245a6ccaddfb858f61039c0ccf5acd924680aab38dd061fc7b123f24ac7f3d3c0cee43b61045bb1efea25af86088a0591f166e2f11ea4089860893b17ca5e3d99ec75131268e2e4e290c2bf15e4dde23284e4bdf6e549c096ce221d9c8a6c0fc78aa6a1c8b547c0e10738de2a1e8663e03ab0ce4594e244989f75b6672de1eee97ba7e6467a0da51c0e75d5866c405b03c4744d8d3fbb01eddba5a0361662269154c2f0e61a9433982eb904ff562896cbfa692eb1e6c644fcf6cbc103a76b712af706a47608d3e2f5d54d47d8e9906ab37ddf04004d32ce00200fc3c274666aeb618b27424d87b6a4b0262de4436b9e6f150bc798394c298b25a2c318fbe786185464057c0bcfcd1917230d78ee1a49eca12068fa676852c1099096c6cb98dfda27fedac41826516e42cc116f0cbb68f0f810418258dc5a65c0e1ada296176e17f8d762894c80542a79383cc1674a4f3d6520633ce80baba214c20628899f9ac826484c887713aed9c5caf13b40a598cb1e81f7b18dae39efc22dc99ff497e11f158edc2716ebe3bcd593691aa26523efc168e1394ab439c9a9270575ef34eeee9084b0a31b2d81d47c964ac61e600f75d9321d7474dde45bb8d0cc46510488ab68486d3ba6cc9c3ddb6f66f2e5d251ee285121e1645a2f5167fc5fb8ac4491c0d9d0423c7a8452efea2f5a30096a0fa47173f3a68500a5c755ea939c838d3be126a87ff6baa5a1fba638a5c64767d17f04201b935fcb1cb6afa175594f410f2ff773194c703e623876051e46bb0850a5016e65f8fa34b96bafdfe851a0756fe26fb63d52113c0935b0867f7dc8a94d887484b15e8f92b6a316a22c04a985cc94e432cd43f44001bcdbd48efcd463c402d3d181298e96db60fdb714b82e146567af5ae3fc0c3f9d241471b4d129f928d286f780facb1e84434610ab3379dfff0f64d57b4a1c2e96c98b693de952d26773d24e7a95eddbc450f79932d5332d27991c7bfbd3bc35bfeb9496fbebccb5e4c35c368e021dea643cb292d794d3d3bbcc960f989bef09763dc73d83cbf907485635265e81f87b712d958a66719230fc6466615a0e3bb998d48159e9e9c51959354a545966bcffa298c7673b4d32b991c886a997236642c0f104f6795feab9f48d0ffc74667f3f3e82473ac892ad25f4b13029b0b27fb1d86991ddc42bbc3fe584ed364e769f3bc72ed8749e7a654ec1a2ec7a01bd2d5caccdc6241a1b1ef2726db54d2c34ab47020b4c729b5994b43deb00ad959950e0051d2c0f27217397055e78f1dd3bd867a45e06c2134ae8981021aae881cc7b2049fe7c82d2127ec81d6430c8116355c8d0ab8b9291c688ed9b8dbb1ed6f1a99bb58a1be8d5737acbf9461b142c8982f52481195d35ef82aed4fa52385ea4ed00a739d01cad7af9f7c27d357748e24f28d22065ccb37300e8f5d8dae5ca79af7a50edc3e05184d1a2a6d59784d5ceeb1f1550a44ea03bee4dc5c27eb78f0032593c7d082e59211f83a8b91aa78bfb7e959328ee63af26a37b79ce5e5139eeebd12e28b2a26ad2fcbdca652524d036b324782d54247a48b9f8200b2d6d2c091c41366d677e3be6e136cec6c3080d608849135c6e3c7d695d2e226ae1ce999d730d7f79116ab85762e55a3e5a66a690ce0a4bb4fd1560c796e2797414b544ef78e29d55e4853fdbf3362085a65c46105f32c360a0a9867b984a5d0297fe0b06a45684ac801a8e66294cef6e5f3c48648884fbb2422fa00488df33a9a0ff1039c81f1939f2cd2f5fe8aa805af2d2332ac37244ed4a7b50265af8062752b0c16511e5f25e8aa2b60645675bc826557bb75474ca4787f6b584b2f83bc25192579104aa0baae79f396df0d31121f90db9acea9695ee0fe0c22df4db503ec8b2437b05f5d35a65722fa82eebd2aff4bcd3316a5cffc4b31913fd02f82130c77f320bf04bf8fa873d0e3f62122d6a5f87d3e908bedafed4a3cb6d9f73ff546f5a2b74a2493b1753e89b682352bb3166563518dcb190c7b3d9fd667c57978a670b192641a674dc92c2401d067b6767aa632ce32a401175c98200a52ab5d80dffa719746d0bff8a84bac4a56e0ab8124fc332b64ea662d01e1b73231a6638f01cf4d699448da228c16951149c8d3dab9a7e3be9a16c7d1ffb061818f8f9cb2b42739fae4a0d70c0701c8dceee785d36ef6413162de1917df01c693ef3e1f517e7fc46245209fee52f5c6a2f50ab3f56d67d1cd987282b24071d8ebb1bc5cd635957b2a7ad92d0650abd5bbc24b75885b6119592a3d715392718e52f9124c4ac95be3582abba4ac3a4049ee49fa8ceb9b59d4e1e2a069c9d482879fd8d27d5ac22ef870542453be22c2ec4ebf1472c19fbfb56aa0a3671297b020e3fe49d201a82a04420e90bda43691dacf92347bcbcae3742cc4abad4c8010c0afa15278795d4d76c482461ae78f30569e1dcf87b9b150d07a2bd81676ec6022422d490759ae1e861a6c4cd1f733bd772d60975a59356c385a4a390429f3d2131e7f616015261df6db3cc3ec261a53be10c4f197e71878984fee00e6d1069f79825194b7af434fb6bb86db18e11977f82928be35054543060cea94ebb4015d061f20f8454e056e7b6e4f9a1621ef2377d77659c20bf358c817519f1801be15ae3b5b42adfab367777a6789635a0dcdd1f2b97edecea0210768af67601d1b95a8850dddb6b1f4b0c2f52c835b0833d81966ad19e49ceb9dc9c729cd8334bc3ee5bb8c74186f5cc3e765b9fdd91d79baaab3d2ab64c15d655d1af7de9cf8d5d7c1baef24577843ce142331743b45b06104b6d0d4392e61ca8c07507ff5f831bbf720854db4debf64182aaebf899ba57626a48748fc2dcf016013d575595d24d383eef2da0ff0c9f6fe9c64b186cd4617e3f37635d7dacb58ec297f3ddb48ce4a5e00cc127267e18a1fdf209e098f2cb2e9c0630d15ec9b867b2b95ecf82ad2c0ba39df9c4d36d492bc9a55c4b767da966e4fd7f4d2fef5e91d0575177c05d240b50757031c76333d43bcc828ab2f0376e29d12d1261ce104a8ea488091326bc451c120c8c04d3e64835c893f55b312e248ad8fc1c32429d68e6b67bf45ab8a1cc3db22f9f01a2266b8349046d3d3e081eaa7f7020c73c0762d11a33b517b8f081da3c61ef63e1d40cd87d69c7ac7491fb61bb57c1fe2d218aff6d39b3e1fc847f0ed894e2f0b4d6a4ad03ba42e28bb1dfab645081f548e64ceb8ce15d2214bd66a14fe594aa447c3537eb493299fef0f9326236ea5dae44e23b34801fe06ee16c79545feaf2528421d6e7f9a256a7914d86bd053dc33c8c2043ba73714f5ff5f0507097a56c40b2190e77877d43be849ee2ac129e582930ced06d359eebb49eda4edb13819f91cecc449c9613d9659906179f8fefa34fecb7d21cdaf09a1ce8d094421da80796c97c02fc56171aaba53fd8a7f55de059044717df164f3571028f16995d51fc8829534cdf58dd134def1e43a34e4f5f372fa8e19d3b85881e99ecd45faa4fccfdb47e094ab06955f3960fac71294dd965f24a97cff36b9966cf1a4c3e96c3e14a3951dcc8a3e9371f7e1ae9df77ddb1a99172174adbee8ea57a0c9872a6d677c2875da88a6a7234bebf68a3cc0532a9809a4de4b4d419bff67b0ba825a7ae6e999087155378357ae67e2dd98697f1d10ffa4497dde6582571670456db995228b97d0ecb2fb30c2ba6c16038c40059815c56b35666cc1c5090f6c38e0f4c12abf79919951b85a2734d32dd12b239912d541f9163387a4aa0be0b7a12d9c6b56dbcf1e9aadcfd72e2664a84d6c5147c72bffe7c3560ccd8c447b748dcd26cc9ca2a85cded742a8dccdfd8e78c96e78d405a19faab9e57183b37583f94b3d416b2920c6b746427ed75c08dc3be02720c1edc4743229153c48f1239b222b9fe2e21c0ae28122bc44f9dc78a59f3485ac8057eb21f0857bcfea2d9ebbbcc197e7880d81515bb1cb7192d97c4258c09926d137e245977db40812b253f99a504bb68137d8d73ca4e7c808d50f1dcc600e6a6db90238ff44e075932fe668c066e6988a6a8b4a8485120c8e4d6511268a75d8f9b0f06689aac8cd621e90c62af1e59aa9efe928e9ea098661b408a2825c4f9aac1efd9d54d163a651054b9ab32719d2be3b176f6795ddad0f1310b9237181689f2f9dd34a41d4d4cd2d7569bf56e6a80bc24d90df3bdde0f9649e699f4ef70c4f3faf9553a231215416bba26c29f17861e0f265e9641b2307ed43d6fde23a378669f4ade874e54c20a5e902205dcaa79a3e8584a3f78a86e703451115a1717df882507c607297afac0a056a0f3509a57502fd2ffff6035d04b91f72f5e1a69ddafaf80f7b2f7a13f38c683988436585e6bc7fc2da328449675c234ec0acf5294ce06c72442beba15e65d6a3e1b5dc3c8f115e1005798383f79b0194f6b7d4b1b32371acbf22340af6e5ee3ea840f7ed451226daef3041fc194e051af2fb450022b394c774273b9575c974c324ecd7268435176ee28c54bb54c8e829232ca636f3bdef60ed460b5ff425936626dd16a3f436f08a863582a79f393378f60f6c8ecdd13d83073bfda2e9f8d0c74a841021cbb8c148e70bfc585627449cdd9fb3045db3ea08a96108b52ee8a4f5048a5d910355789f4bb85c1362955e267e719581c38a2648eaa0b516db6277d2ee3c6e1e1090df3f53a31b747d99887e337dadddab16a297d9e56797007a3d18ce333311c70bb1bf45bdae517ffc589419af643773bb30a1fbff7ecd4a8ae7456a608fe73547c2eda4f070d57dc70b65d867526c946a435ea581497da18646ce569eaf6ccf3474cd6e7aa3d6d4732836ff4167c9153757ce58a34864be6d479f7b4ea1d6480b9ac16c5bff346a74e74133234744df867e16b3d2f1f7db4b21b89019b520917ef863e60f52999d6946b9e09cb60054f49d8a255f02e4b62fff6e6adb9a167ea70a177d00b26f56e29b63138a2ebc30b956161a4ab25d5da1c207c3f762714f651341ae771e17d84fa1c86685f2fcb0a128c2e1208d1930e7ff0d8d55299154112af574b881be8b69cc1721d548ad4dc02632e184c47f9b394bf4a834e60fbead8c8bfbf5087f8454513b0b086ac97bbbb9aa342af9def758fe88f1e4570e65f93fd4a9868665d08fac0cf6ebde786995c433504ca01cdf83311aaae20cc76f819a4344a8ee4e26c1094cb00d2c8a67c733fffcd89e97534cacb08a64d75e8594fa31f0dcfcafb0d1bc184c7067fec6a48ddefd580d4d9a4128d8f70f6fc6562da683904766e982ecd0286064db6844131bb7962a0a497f7b97fefad88a0b128bdf8cca774b1c32cb4af259bfebccda036e7e4ea8962838dbb5c04ffab0a2f1481848a27f06171645daf5246a2e563f3ed60097a9d7023d6ba5c8a58d39f733b12baf0863d82c427460f51cf9e3f77281a42221725b7bb75c2116ab31f704661f090d3eeddd2aa6efc619946b4933c398b635fd04ba3758294965c568997e1ef44b0562804e6c64558f6cfa87662a988c321a856ead51c848528a4954f9ff1948d517d67bc11db66801648848bfb7ee12296428bc3ffec863e9c77ff31ee386197679adab2a0e93bbe0c66ffe9c4b09b636f6216faa373aa8271678cc57ad46898222df7e2d8b14a5b70130596c0430997c4c04d9b5187fd9bb26b71fd19aacc8e08a3239f0eebca7b2873062a19f327a4a282012ebf9898a5ab6310b8623c864d4dada3ded00ad201ce8f3973f90396f5edc1ba466e16247fe6b0ee98acfd53792cc0fea33647b841596655b8d9efbc14b50fe0b588e4c41e2cbd0a700529e7ca91122d3d1b26e52bf44a0c9fe37cdbc352357f13b2adc68e78a00f6dc88a8e6ea54bd0b2c8276f9e1bfebc8655a1f47b72c25ffa97f4463630cc21428ca3bb381a6d3171d28bb946f746f820247bf3f7bb69caaeb5c47026ca9997e586e657a9e1569312bb443299ef4cfeacc9aaf4fc3aaa4a77a21579234d2aab6fd0234398ae07ca7c57ac6d6a51e025744b1430abce27f7f9b0d0e45c051e34d20db95cadcc0e4e327dbd979166b33e39a3951d0b8dd62c0d1542b69583cfc07b127243cac4b052cb29ccb3592972698fa4cd84633d222d78b8741d5f903f8636d95cddfe2ef13829df9ce32705edfda51ded2f0ef38f60a33a2e00373107eef56a01acb5e05d849279b5987343c8bbc73ea660ceaf7c9b90c0a8e1412ff3f517cef8fe604d7a26e085170a76e1bf43f5d1bb77ee771fe841d59fe2cc2874d25bf991b4af6bf9ffe1bfbf3a5587006b60bab5bdfd5a3192e82d474ecab0ab656967856c84cba9469c5823c1d1bf104d2a21c071bb08b2a137883dd9c8f545d6958db8efa45263ae303de76e70f2f6a10e1858e6654004f2a099dc31950ee730c465e0a1822935e309d41650fba489aa3050eedbf3f058d24d1f04fc340966e42d72052d84a66789ccf75000c3fc83b8842badd6b22ddaaaf53ed34e25c1b638e3630d66a7903405052902cf8e7395d54679e2f4a2bf7c8c89b0dc38969376ea164fe97b37b1172e6e8f05a929aa373108e891a64e38e18b432a115a44d754811e03c4f4ae7c525a6b9b92aab0d16967ee1a64eeeb2207c094f6aa96f126d058eff22435a4ae76c31f888ee13b327d2cab4ab5a56abf4cae88c583dd67129271708aa17f4f10886ead0e12734314bd4a49e64349beba4abdf94a1fb23a72cf7e16b5af2f1706d9646a5ff7dbf5c7b1cb2c3781346167b15d4625841d9f3d14392db1d39101d37175c42c522229db0708544058d75cebf3e399cd443d1b943c6f3017a898bd49836a8d92519deb810712aed76602682ef0df2be270734eeda7f289a76f4684baf75702a1ac3da005e62b83f794b934cf882db5d50e5ed4aca868e300d690c0b10daf0a47486e9f49d1b08eac6cf5090ddd2443b1459b2df86ab3447b2b5c6afe8aadb410de6a84b640e326eb882832d1a9cb12e0b8f13aef579f404af8631cdd5a30a031dad19cdf247575dd223229330f19fe4d88c51242217397acf66b86c743de283d5df7212fce59af17eb702eccab192f56f054a33709d41841e4a39638e02b4210559593f9b5c44fd22d9da637ef1a3a0a41c40469990dc4beec30a05b67931c0560d9a59fa875f3e26fd1eb32655aa30c7a1cd3d541716fdaacdda206328f3cbc8f16fc2be26690f18963a16febbaf2cb6c199330579ca067c60b54cbdd211c1350e066448fb50ae28ed58788ac98f0ded3414c8735ab90639916e26ab29102cc2609035e56d9b9d2dbc98118835bcf0e437c77052efe2293d9f19b7197aa1b94b10997b0b1efdef251de8945a97fec885f032c3bee2447335230b866d7aef515b04664d0c59e18233f9a229969e3e17d69716413ca3bc55f5959e340627ea803f7b26f4a74295b295344a3685287093998a1ce75b1ed5d730c9aec812617b4c200a0250c9ef8ef7d2fcfc59ef97422eca746bc6451a5b77307d14c1cfa0ea2c8eb7cf7819644577a6456efec0af058a0e3c8ec371019009462bfe174a11368b57fbe3090208a57b2236b97edc32cda5c6fc988cbaaf91c4020a06a7ad45519eaa761e045fc84d3219b287206282347a031ef1e7b7dbc67de738fa8f9fe71c44201fd1d548f8aebe93bf502d64d4b5f470a419e3fcd87f0616b9813048311ed20ac2efd7f18dcd6889542208b50c28c8c0700f73fa33a964e38d699819cab2098c6ff081266721cdced87ff41948c84037485f30d38a99eeeb3ff4c3049742a29eb09bb35c358e732546267c165a62fee9e25abdafdb8a48785bd432d160797e7a41d580f59d7d8e59b3e6b954d39f86db33b8f7cabde43e8e04cac1fcf9aa6fdbe4326e0d9c782d9a630055b36f85c2b8efebf18f42ef14ee5eb1d33ca322db69704f8bb90bf30eb05908b8d8ed169580923f53a6539cc3b55baa47718053d2ff103c23d90f9cb49ddc7d759950f605bafabcb7953c042c0523b84da994529a87ad68fc6f0709fd7af5fc20e53a17d3f5fd4d25fc5ff6598c6ddfc34668a08ee5e066d81a65e7979c50c08febf76dc5a3a405f551bb8449d94ea0dfdad6dd6dd6d6e4486f4ae1d2523c05f46198d8af4da12873ebdf7d6b5f2d0f1b2d29759ab0d78e34ae6f17b7ab83518cf8b18836ea5630ee934e5ecc123f0d3fe6b803ae1f735d65dcadcaaf6660e02ecad0290f6ead0594733a10b2b1654a44244424fa8b3180b551ac401828203e61603b017106e2256f01b9f26db33897167d9defb54ddfe49334150574493895370bad46cc658667aa9a8ed333c86f112b2a542936af92e2f933254b6fb0b1a599eec3bf2e476ae6714e2486dd31b29e4d26838d84bd7a62c62beab3ba71642278ecaf2e50d70670d9fdff105019791d36321bc57fdfd8f65f2ea1cb188035ecabf6140e777b7e6d2177ac29e9a1a2f87dd54d96184bb1a855bd9efdadfc606f13621f40e07cd8be9c2435c8c90b4ccba5eb7ddcf8cf1f76617c9a9e011abf4a63ffe31df63ecacb8b1d2d653e613cb399ce079392f9ca2e226c60b6e8103447c24c1f80d42e1ee747997602ae3ccff8f9f98ce9b56f6f3e3c0ba507df8b2169539cfc946c42da72644feb9b3b582ce332f8b2eda02192958194903d17b3e9b4bd60d08cd9a7989d946ece6d8dc01d6b66a7851bb11e4b075d38081d3ce7bf1875fec9daf47a589abdb72763c9747b83a28389238b0279c8e41db6521130420851acac463664a97be2190aff921923475f2c1f8a87d1169229e5f10dd0a92221e61358b156020f2c9ca2cb6580743a8d5e3c59e6fd97a7a246211450c7c62f1891cedb434102f8794d81c1caf2c1b4ae18b7c4b9c88de5c51da33e3343cef76da0d00341c2e60c4562c162e41a7efa8290cc9061f3d6a592d5f104c5018f31bcaf912bdd37370fbf8fedf0aa9026c1142299197d67ab026756927b5864ea42c45a82c23c275697d31a1b7900670c9a3c967d12974543c11f20c367a336bea9b9ebe480f9c806528138dff35c5f56b1199b75748e9c5cf50e6a32397dc3eeb04c3636c0848a5e13df8a9758bacea231f34cba13b466360b0dec69f74f8bf9a2dcf3dd94fa3a7d27e8caae00240559d75875ef9c619416593ca0072e7f38caae5a530c62dbe00e38c12cb8b924d63fca4d5c3a4c8f50e8f4f86fc1fe2b163219c46c21eb783e587e18e07ab7e1927a646c4f154c5000cb65ce9528457c3c66f43d9ab7d61580df0ecfb31cb38e4cbcdc3dafcca57311abec6b74048c8b74505ba678a4db07ed7243c70a821aee66a487bf91fd273418f8ef657d1eeb9ea6f095d47641e9f9fa30599e8b9c6b4453a1a5e8afd86fcafb46dd095fa4a98a2b26470e2c799b08c6000f5c3c4e28961463724377f37813f3922484fda986eb7c93ae8365baf648acbb344ca7e044d7ba93e7ba35c31085f3f99c5fdb2f9f2845f00b8590395e8ff730b86f5dd7f52297b8ecd5d5a6bb452bcd12b98d6adb27e7ef0e84b9567c66093ca3edab7e64ac4f56360501d81823ea2b1595f934c5f61c8558304c16154109a983a2af8725c7af91b5bc57e555768aa8115236a6ccc921d472b608eb6b82c4ba3747d79027d7856fae5369aa325df6a76138a5b41a94377eeeb251087e0b8510d8890e3f7a0cffaeddb9d2c29bc89f952489f82ee2e2b485cd297e6d30683701623cf73ee9ee606baeae9c3afba287eff57731b9cfaf034b1f56c8b31a32a1078c4fcab298c3f925a8e7cacceb9edf7ba2e54d31033a25462021e4a3c0bf5af341b462ee4417024da7c12c7f385de3af129aef1338a9c1fd68323d07ff47ec8bcca66b44300624d02c9202a2d093c3c85fd922b57b3bd14162c8ca5690734b7e4e4b8980b73a8e9908a9fa3dd508b30e3b1e1fd4ec388affa27c4bc26ca2820e0a902d51ff94984e8894fa5fca7b8704b7600ca6d6b1b1527ea999fcdf8fe3b290ec0036cad222f92cf8a5a54d0fa91de6e74ef61f60a233c9f15fdc86226c3f688de15ed8f0c3f1bc3afcad87cee47a19384afc6a804f197339ebce4aca211dbe0504a000755d18f20c4ecacd4123acdff7653cbb26456499495662508c8186afb883f5481c6bdf88cf137e263bde9d62f054573e0d1454cc119c95d4d9011332bd77682f79debcf5c21f0be7e9a83a58cec34e7cfb17a8122e030669228e4d3d9e274a678c5b77e6180aacc2fa8eb9952c5b04de6b2c7bee591badab96a3c3248c275b5b8faf5394eacc427a840570033be5006c33ce2d2c6e54f08681c3f74ad2fe54bca6dc62a9d84f6c58509c1e5dd5cfcc7a358493d428de48dfc1bc3f74154801c97e6aae38445045320b4cf66c1e56eb6ea2c1218de65f120b463c5cfb9255b3a25eb6e848cbd977f0605d71c561c2a754f5761c31f84101ee8178782cc8cf70b41a2204c5cb2f3134d572327fe4bbc1792249dfcf0ae7ba5d81fb5ae4a7978d044085f3b7f2e398c05733e2bf456cae898f8b5a81e9c79179bb5ca716713fce643dabe21eaee4386e646e25ad3adc5a4ad40f9bd6743f5f742efb1a674ffdbd2ced56c646ae590eb8f10283b47f57e6f96ad76adebecb24df74020b096fdee3c8d780d563a915f73c8b0246b861cd3a8580d5cf75798e8cf1c5875724661a39277e7165fe48ed8d5e6a20d68239f626fe8ea434a4e6e03ea434ec68c4b92a0fc2af15a135d6cbaeeca39a0c1896dab33daac", 0x2000, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905811765"], 0x0) r8 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xbda8ee4cc7852c63, 0x204031, 0xffffffffffffffff, 0x42791000) readv(r8, &(0x7f00000004c0)=[{&(0x7f0000000040)=""/113, 0x71}], 0x1) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffff7f}]}) close_range(r9, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r7, 0x84, 0x7, &(0x7f0000000040)={0x80}, 0x4) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000002c0)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="5800000013000100000000000000000007000000", @ANYRES32=r10, @ANYBLOB="000000000000000038001a8006000000020000"], 0x58}}, 0x0) write$FUSE_INIT(r0, &(0x7f0000000400)={0x50, 0x0, r3, {0x7, 0x2b, 0x10, 0x1c20040, 0x0, 0x0, 0xc0000000, 0x1, 0x0, 0x0, 0x100}}, 0x50) syz_fuse_handle_req(r0, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0xffffffffffffffff, {0x1, 0x0, 0x0, 0x8, 0x80001, 0x5, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x6000, 0xd, r4, 0x0, 0x800000}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x2, {0x2, 0x0, 0x1a00000000000000, 0x7f, 0x6, 0x101000, {0x0, 0xa, 0xfffffffffffffffd, 0x2, 0x4, 0x6, 0x4, 0x4, 0x4, 0x2000, 0x101, r4, r5, 0xf0ee, 0x9c}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="63202a3a2af5c253b51154351ed3ce0d20727700"], 0x9) openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0/file0\x00', 0x40000, 0x2) 2.928412448s ago: executing program 2 (id=292): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000001c0), 0xc8c00, 0x0) dup2(r0, 0xffffffffffffffff) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f00000000c0)=0x5) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0xffffffff, @remote}}}, 0x108) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_linger(r4, 0x1, 0xd, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'veth1_to_hsr\x00', 0x0}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000080)=0xf3f, 0x4) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f0302e90302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 2.928048399s ago: executing program 2 (id=293): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r0, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x200442, 0x5a) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x100007) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2001, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) pipe2(0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x6e, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)="aad4984fbc1a5100cc7c530100200000bc00000004008ad1b779000600000000000000", &(0x7f00000003c0)="7c4760d8dd77ce15d9157019cf097f648d3983d1df9d45aad5ed123527452539c849f468a7bfa049787fba3c8b4f7eded7849d77933254f83f678a5252e16f6c3a9fd7795d5d5dc08aa639c1159ea1be5dea36b17af52721f347412b7179f1de5e1ab1cdec62a3a97c1ceb27490888100939379a03f70d35fcc24bf45a7fafc57bf6d3d9f591c1ac9558672f46a54dc96307be26565f544d94f2fa27f42d79637581", 0x3, r2}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={&(0x7f0000000000), &(0x7f0000000040)=""/213, &(0x7f0000000140), &(0x7f0000000180), 0x3, r3}, 0x38) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x62, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x4) ioctl$TIOCVHANGUP(r4, 0x5437, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x20}}}, &(0x7f0000000140)) 2.348580294s ago: executing program 0 (id=294): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)={0xfffffffffffffe7a, r1, 0x1, 0x70bd28, 0x0, {}, [@WGDEVICE_A_PEERS={0x510, 0x8, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0xfff9}]}, {0x4c, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "491bc0be1dc1f88092e741a88b64f6dd9218ad21b44b472e44f1d0807ee6675c"}]}, {0x490, 0x0, 0x0, 0x1, [@WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x3}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x9, 0x7, @empty, 0x3}}, @WGPEER_A_ALLOWEDIPS={0x3b8, 0x9, 0x0, 0x1, [{0xac, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010102}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5, 0x3, 0x2}}]}, {0x40, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @local}, {0x5}}]}, {0x64, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x2}}]}, {0x13c, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @multicast1}}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @remote}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00'}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010100}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x5, 0x3, 0x2}}]}, {0x4}, {0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x5}}]}, {0x40, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x3}}]}, {0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5, 0x3, 0x2}}]}, {0xa0, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @private2}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010101}, {0x5, 0x3, 0x3}}]}]}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e22, @loopback}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "0c000227734136bbd051f5248b73349484079ac37330b66c8c2d38b233240191"}, @WGPEER_A_FLAGS={0xfffffe93, 0x3, 0x5}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "e7ff7701b926810da1b5902e7a364627b7e5194a545926646ae03e188b880fed"}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "67145cfa4d7b699c1e0846a50afd9ba74e30480f6df0e68218cc108c2128c513"}]}]}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e21}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}]}, 0x548}, 0x1, 0x0, 0x0, 0x4004840}, 0x2000000) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040), 0x10) listen(r2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="1900000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000000000000000000000000085000000080000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x1, 0x42, 0x40, 0xc2, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240), &(0x7f0000000640), 0x1003, r4}, 0x38) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r5}, 0xc) r6 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r6, &(0x7f0000000080), 0x10) sendmmsg(r6, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000002080)=[{&(0x7f0000001d80)="16", 0x1}], 0x1}}], 0x1, 0x24008094) 2.303112853s ago: executing program 1 (id=295): bpf$MAP_CREATE(0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x2, @multicast1}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r1, 0x0, 0x12, &(0x7f0000000000)=0x200080, 0x4) recvmmsg(r1, 0x0, 0x0, 0x45833af92e4b39ff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_io_uring_setup(0x8d, &(0x7f0000000380)={0x0, 0x595f, 0x80, 0x0, 0x1053}, &(0x7f0000000140)=0x0, &(0x7f00000000c0)=0x0, 0x0) syz_io_uring_submit(r2, r3, 0x0, &(0x7f0000000280)=@IORING_OP_ASYNC_CANCEL={0xe, 0x4c, 0x0, 0x0, 0x0, 0x12345, 0x0, 0x0, 0x1}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x200000e, 0x401d031, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/kcore\x00', 0x0, 0x0) readv(r4, &(0x7f0000000240)=[{0x0}, {0x0}], 0x2) 2.211003556s ago: executing program 3 (id=296): ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, &(0x7f0000000200)={0x2, 0xc, 0x8, 0x0}) 2.210768049s ago: executing program 0 (id=297): ioctl$int_out(0xffffffffffffffff, 0x0, &(0x7f0000000840)) 2.109684941s ago: executing program 0 (id=298): r0 = syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2379c"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r1, 0xffffffffffffffff, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) 2.039697452s ago: executing program 3 (id=299): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01060000000000000000020000000900010073797a30000000002c0097d76d79b94dc28643d495b4521e681d0000030a01060000000000000000020000000900010073797a30000000000900030073797a300000000044000000090a01060000000000000000020000000900010073797a30000000000900020073797a300000000008000a40000000010800054000000004080003400000001460000000060a01060000000000000000020000000900010073797a30000000000900020073797a300000000034000480300001800b00ec0064796e7365740000200002800900010073797a300000000008000340000000000800042e6cc5bafa462232a0812e"], 0x118}, 0x1, 0x0, 0x0, 0x9801}, 0x0) setns(0xc9, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_GET(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a40)=ANY=[@ANYBLOB="14000000d40f414004ad2ea7cb0d3f37e41057c4f945b95186eb3d0583bfcde87c22333aee279163b48abb4d850b30b4bbc115906e32808f23a3439627c36800a87717bd3750f5e3c6f94c5f848b21e1b2de70d5e2697f52af2957c59d3cfa42e97fd52228f43c23dbe5764b3991f9bf5bcdcc1e1f2587ada31bd3d91a", @ANYRES16=r3, @ANYBLOB="000225bd7000000000000b000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x8000, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r4, &(0x7f0000000000)='3', 0x4e) io_setup(0x7f, &(0x7f0000001440)) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000200)={0x38, r5, 0x1, 0x0, 0xfffffffc, {}, [@ETHTOOL_A_DEBUG_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}, @ETHTOOL_A_DEBUG_MSGMASK={0xc, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x8, 0x3, 0x0, 0x1, [{0x4}]}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='.\x00', 0x50280, 0x1dc) setns(0xc9, 0x0) r7 = socket(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INFO(r7, 0x0, 0x80, &(0x7f0000000000)={'nat\x00', 0x0, 0x0, 0x0, [0x8, 0x4, 0xfff, 0x8, 0x1, 0xec]}, &(0x7f0000000080)=0x78) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r6, 0x400c6615, 0x0) r8 = socket(0x15, 0x5, 0x0) getsockopt(r8, 0x200000000114, 0x2714, 0x0, &(0x7f0000000100)) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r9, @ANYBLOB="01002dbd700000000000100000001800"], 0x34}, 0x1, 0x0, 0x0, 0x20040804}, 0x4044890) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSETELEM={0x38, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xd0}}, 0x10) syz_open_dev$dvb_demux(&(0x7f0000000080), 0x2, 0xc12304) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001980)={0x1, 0x3, &(0x7f00000013c0)=@framed, &(0x7f0000001400)='syzkaller\x00'}, 0x80) bpf$OBJ_PIN_PROG(0x11, &(0x7f0000000240)=@o_path={0x0, r11}, 0x18) 1.958095365s ago: executing program 3 (id=300): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000001c0), 0xc8c00, 0x0) dup2(r0, 0xffffffffffffffff) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f00000000c0)=0x5) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0xffffffff, @remote}}}, 0x108) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_linger(r4, 0x1, 0xd, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'veth1_to_hsr\x00', 0x0}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000080)=0xf3f, 0x4) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f0302e90302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.892905941s ago: executing program 3 (id=301): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000580)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000540)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000800)={0x5, 0x10, 0xfa00, {&(0x7f0000000600), r1}}, 0x18) r2 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x450001, 0x4c) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setrlimit(0x0, &(0x7f0000000280)={0xc800, 0xfffffffe}) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000300)='\x00', &(0x7f0000000340)='\x00', 0x0) listen(r2, 0xfffffff7) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, 0x0, &(0x7f0000000100), 0x80, 0x0) mount$tmpfs(0x0, &(0x7f0000000400)='./file0\x00', 0x0, 0x282422, &(0x7f0000000400)=ANY=[]) r4 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x1e, r4, 0xfffffffffffffffe, r4, 0x0) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000940)={&(0x7f00000009c0)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="100026bd7000fbdbdf250100000014000500fe8000000000000000000000000000bb1400050000000000000000000000000000000001080004000200000014000500fc000000000000000000000000000001080004000300000008000700000000000800040001000000401cbb3a6b9d61d2ab837781fb5ec2a3db8c3fbc890df5f92de9118f90a15fc5148d879f39ddd831a9c7abfa1f8638ac3ac97b059e59fdda5043996084645feafad78cf21f8b82055e37d4d1df087d9750eda55a197af5f89b41cd1f67e9"], 0x70}, 0x1, 0x0, 0x0, 0x20000034}, 0x20008014) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000000500)={0xf, 0x8, 0xfa00, {r5, 0x36222756b3833bfb}}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000001500010300000000000000010c00000008000100", @ANYBLOB='B'], 0x1c}, 0x1, 0x0, 0x0, 0xc001}, 0x4000000) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r7, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x4}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r7, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000140)=[@in6={0xa, 0x4e23, 0x2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x200}], 0x1c) sendmmsg$inet6(r7, &(0x7f0000000880)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @mcast1, 0x1}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000040)="f8", 0x54}], 0x1}}], 0x1, 0x20008889) fsetxattr$security_ima(r7, &(0x7f0000000100), 0x0, 0x0, 0x3) 1.417481796s ago: executing program 1 (id=302): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000100000000000000000000008500000087000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000080)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x41}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=@bridge_delneigh={0x30, 0x1e, 0x1, 0x0, 0x0, {0x7}, [@NDA_CACHEINFO={0x14}]}, 0x30}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f00000000c0)="531f99f76ce0d776e80000000000", 0x0, 0x8da8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@map=0xffffffffffffffff, 0x1e, 0xfb1ad250a3676b73, 0x8000, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, 0x0, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000240)={@fallback=r0, r0, 0x0, 0x1, r0, @void, @value=r0, @void, @void, r3}, 0x20) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r5, 0x81e8943c, &(0x7f0000000780)={0x0, ""/256, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_WAIT_SYNC(r6, 0x40089416, &(0x7f0000000980)=r7) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, &(0x7f0000000840)={{r2}, r7, 0x14, @inherit={0x58, &(0x7f0000000400)={0x1, 0x2, 0x10000, 0x9, {0x2, 0xd2, 0x1, 0x2, 0x22}, [0xffffffff, 0x3]}}, @subvolid=0xad9685}) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_STATION(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)={0x1c, r10, 0xda409aa40cc3acf1, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r11}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4044081}, 0x20008000) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newnexthop={0x1c, 0x68, 0x1, 0x100003, 0x7ffffffd, {}, [@NHA_GROUP={0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) 1.039092672s ago: executing program 3 (id=303): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 922.742498ms ago: executing program 1 (id=304): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x104) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) syz_clone3(0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) write$P9_RVERSION(r0, &(0x7f0000000c40)=ANY=[], 0x13) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f0000000140)=[0x5], &(0x7f0000000180)=[0x2], 0x0, 0x1, 0x1}}, 0x40) 807.211528ms ago: executing program 1 (id=305): bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x1, 0x100008, 0x4, 0x8, 0x1, 0xffffffffffffffff, 0x400000}, 0x50) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000200), 0x0, 0xfffffffffffffffe) syz_usb_connect(0x0, 0x3a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404f1004000001010200010902200001010080320904000002000000000705810200020007050202"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x61, &(0x7f00000004c0)={0x0, 0x9, 0x14, 0x3, 0x1}, 0x8, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0}) 120.023395ms ago: executing program 2 (id=306): r0 = openat$vimc0(0xffffff9c, 0x0, 0x2, 0x0) ioctl$int_out(r0, 0x0, &(0x7f0000000840)) 119.830607ms ago: executing program 2 (id=307): r0 = syz_open_dev$I2C(0x0, 0x1, 0x402) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000200)={0x2, 0xc, 0x8, 0x0}) 69.585308ms ago: executing program 3 (id=308): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x62, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x4) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 69.200851ms ago: executing program 2 (id=309): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="09000000010000000800000008"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000a40)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) ioctl$KDFONTOP_GET(0xffffffffffffffff, 0x4b72, &(0x7f0000000040)={0x1, 0x1, 0x12, 0xc, 0x17d, 0x0}) r2 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB="e0000001ac1414aa0000"], 0x1c) setsockopt$inet_mreqn(r2, 0x0, 0x25, &(0x7f0000000080)={@multicast1, @local}, 0xc) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) unshare(0x24020400) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0xa, &(0x7f0000000040)=@raw=[@jmp={0x5, 0x0, 0x3, 0x0, 0xa, 0x1, 0x4}, @alu={0x0, 0x1, 0xb, 0x3, 0x2, 0x30}, @map_idx={0x18, 0x2, 0x5, 0x0, 0x8}, @ldst={0x3, 0x0, 0x6, 0x1, 0x0, 0x30, 0x4}, @ldst={0x3, 0x1, 0x2, 0x3, 0x9, 0x1, 0x8}, @ringbuf_query], &(0x7f00000000c0)='GPL\x00', 0x1, 0xc1, &(0x7f0000000240)=""/193, 0x40f00, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000380)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f00000003c0)=[{0x1, 0x4, 0x3}, {0x3, 0x3, 0xc, 0xc}], 0x10, 0x7}, 0x94) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f00000005c0)={0x98, r5, 0x405, 0x70bd29, 0x25dfdbfe, {}, [{{0x8, 0x1, r6}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x10}}}, {0x40, 0x16, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4040df5}, 0x4040084) r7 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/netdevsim/new_device\x00', 0x1, 0x1d3) write(r7, &(0x7f0000000000)="313230eb7317c8fc", 0x8) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000bc0)={r1, 0x0, 0x0}, 0x10) 0s ago: executing program 2 (id=310): socket$kcm(0x10, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(0x0, 0x1ff) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89a0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x800005}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x44000) add_key$fscrypt_v1(&(0x7f0000000180), &(0x7f0000000040)={'fscrypt:', @desc2}, &(0x7f0000000100)={0xfe, "de442bfc7910e10ac69ac014b0fa7807b11d2c99ed1f40d47a6edb3367b5cc888e1fd5102ae2d3d05f251f8d49025ceab4152b6e6d87cd6088e97a9d06d29143"}, 0x48, 0xffffffffffffffff) clock_settime(0x5, 0x0) memfd_create(0x0, 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)='3', 0x4e) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @multicast1}}}}) kernel console output (not intermixed with test programs): ? __fget_files+0x34/0x3d0 [ 46.387137][ T6049] ? __pfx_vfs_write+0x10/0x10 [ 46.387153][ T6049] ? find_held_lock+0x2b/0x80 [ 46.387170][ T6049] ? __fget_files+0x215/0x3d0 [ 46.387193][ T6049] ? __fget_files+0x21f/0x3d0 [ 46.387219][ T6049] ksys_write+0x12a/0x250 [ 46.387234][ T6049] ? __pfx_ksys_write+0x10/0x10 [ 46.387246][ T6049] ? ksys_write+0x1ac/0x250 [ 46.387262][ T6049] ? __pfx_ksys_write+0x10/0x10 [ 46.387284][ T6049] __do_fast_syscall_32+0x13a/0x8b0 [ 46.387309][ T6049] ? lockdep_hardirqs_on+0x7d/0x110 [ 46.387335][ T6049] do_fast_syscall_32+0x32/0x70 [ 46.387357][ T6049] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 46.387378][ T6049] RIP: 0023:0xf709efec [ 46.387396][ T6049] Code: Unable to access opcode bytes at 0xf709efc2. [ 46.387404][ T6049] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 46.387420][ T6049] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000140 [ 46.387431][ T6049] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 46.387440][ T6049] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 46.387449][ T6049] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 46.387457][ T6049] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 46.387476][ T6049] [ 46.544080][ T6053] netlink: 'syz.2.23': attribute type 1 has an invalid length. [ 46.544158][ T6053] netlink: 224 bytes leftover after parsing attributes in process `syz.2.23'. [ 47.018261][ T1042] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 47.098726][ T5733] Bluetooth: hci3: command tx timeout [ 47.111682][ T5733] Bluetooth: hci2: command tx timeout [ 47.111712][ T5733] Bluetooth: hci0: command tx timeout [ 47.111734][ T5733] Bluetooth: hci1: command tx timeout [ 47.180348][ T1042] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 47.181405][ T1042] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 47.181425][ T1042] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 47.181439][ T1042] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 47.181469][ T1042] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.183948][ T1042] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 47.183965][ T1042] usb 6-1: Product: syz [ 47.183976][ T1042] usb 6-1: Manufacturer: syz [ 47.204586][ T1042] cdc_wdm 6-1:1.0: skipping garbage [ 47.204603][ T1042] cdc_wdm 6-1:1.0: skipping garbage [ 47.213898][ T1042] cdc_wdm 6-1:1.0: cdc-wdm1: USB WDM device [ 47.213909][ T1042] cdc_wdm 6-1:1.0: Unknown control protocol [ 47.590352][ T30] usb 6-1: USB disconnect, device number 3 [ 47.755048][ T6065] Zero length message leads to an empty skb [ 48.077800][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -1 [ 48.080033][ T5879] usb 5-1: USB disconnect, device number 3 [ 48.228154][ T43] audit: type=1804 audit(1790156807.942:2): pid=6074 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.30" name="/newroot/9/file0" dev="tmpfs" ino=73 res=1 errno=0 [ 48.273524][ T6078] netlink: 72 bytes leftover after parsing attributes in process `syz.0.31'. [ 48.823635][ T5879] libceph: connect (1)[c::]:6789 error -101 [ 48.823758][ T5879] libceph: mon0 (1)[c::]:6789 connect error [ 48.846386][ T6090] ceph: No mds server is up or the cluster is laggy [ 49.722955][ T30] libceph: connect (1)[c::]:6789 error -101 [ 49.723034][ T30] libceph: mon0 (1)[c::]:6789 connect error [ 49.769966][ T6116] ceph: No mds server is up or the cluster is laggy [ 50.391042][ T6141] FAULT_INJECTION: forcing a failure. [ 50.391042][ T6141] name failslab, interval 1, probability 0, space 0, times 0 [ 50.391074][ T6141] CPU: 0 UID: 0 PID: 6141 Comm: syz.2.45 Not tainted syzkaller #0 PREEMPT(full) [ 50.391096][ T6141] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 50.391105][ T6141] Call Trace: [ 50.391111][ T6141] [ 50.391119][ T6141] dump_stack_lvl+0x100/0x190 [ 50.391149][ T6141] should_fail_ex.cold+0x5/0xa [ 50.391173][ T6141] should_failslab+0xc2/0x120 [ 50.391198][ T6141] kmem_cache_alloc_noprof+0x92/0x6a0 [ 50.391217][ T6141] ? lock_acquire+0x1d1/0x380 [ 50.391241][ T6141] ? mpol_new+0x11b/0x2d0 [ 50.391265][ T6141] mpol_new+0x11b/0x2d0 [ 50.391289][ T6141] do_mbind+0x210/0xfd0 [ 50.391312][ T6141] ? __pfx_do_mbind+0x10/0x10 [ 50.391331][ T6141] ? find_held_lock+0x2b/0x80 [ 50.391357][ T6141] ? __pfx_get_nodes+0x10/0x10 [ 50.391379][ T6141] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 50.391407][ T6141] ? __fget_files+0x21f/0x3d0 [ 50.391431][ T6141] kernel_mbind+0x1b7/0x200 [ 50.391450][ T6141] ? __pfx_kernel_mbind+0x10/0x10 [ 50.391467][ T6141] ? ksys_write+0x1ac/0x250 [ 50.391487][ T6141] ? __pfx_ksys_write+0x10/0x10 [ 50.391508][ T6141] __do_fast_syscall_32+0x13a/0x8b0 [ 50.391534][ T6141] ? lockdep_hardirqs_on+0x7d/0x110 [ 50.391562][ T6141] do_fast_syscall_32+0x32/0x70 [ 50.391590][ T6141] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 50.391614][ T6141] RIP: 0023:0xf706efec [ 50.391633][ T6141] Code: Unable to access opcode bytes at 0xf706efc2. [ 50.391641][ T6141] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000112 [ 50.391659][ T6141] RAX: ffffffffffffffda RBX: 00000000800a2000 RCX: 0000000000004000 [ 50.391669][ T6141] RDX: 0000000000004002 RSI: 0000000080000200 RDI: 0000000000000005 [ 50.391681][ T6141] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 [ 50.391692][ T6141] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 50.391702][ T6141] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 50.391724][ T6141] [ 50.518296][ T5813] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 50.582382][ T25] libceph: connect (1)[c::]:6789 error -101 [ 50.582465][ T25] libceph: mon0 (1)[c::]:6789 connect error [ 50.620315][ T6149] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 50.628241][ T6145] ceph: No mds server is up or the cluster is laggy [ 50.768617][ T5813] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 50.860473][ T5813] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 50.860492][ T5813] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 50.860501][ T5813] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 50.860522][ T5813] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 50.860535][ T5813] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59237, setting to 1024 [ 51.080087][ T5813] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 51.080104][ T5813] usb 6-1: Product: syz [ 51.080111][ T5813] usb 6-1: Manufacturer: syz [ 51.414919][ T6139] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 51.518165][ T6162] binder: 6161:6162 ioctl 40046f01 80000180 returned -22 [ 51.565723][ T5813] cdc_wdm 6-1:1.0: skipping garbage [ 51.565736][ T5813] cdc_wdm 6-1:1.0: skipping garbage [ 51.576450][ T5813] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 51.576462][ T5813] cdc_wdm 6-1:1.0: Unknown control protocol [ 51.655727][ C1] wdm_int_callback: 12487 callbacks suppressed [ 51.655745][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 51.655757][ C1] wdm_int_callback: 12487 callbacks suppressed [ 51.655767][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 51.655989][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 51.656004][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 51.656212][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 51.656227][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 51.656443][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 51.656457][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 51.656662][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 51.656677][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 51.656879][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 51.656894][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 51.657095][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 51.657109][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 51.657314][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 51.657335][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 51.657580][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 51.657594][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 51.657796][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 51.657810][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 51.669104][ T6164] FAULT_INJECTION: forcing a failure. [ 51.669104][ T6164] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 51.669130][ T6164] CPU: 0 UID: 0 PID: 6164 Comm: syz.3.53 Not tainted syzkaller #0 PREEMPT(full) [ 51.669149][ T6164] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 51.669158][ T6164] Call Trace: [ 51.669164][ T6164] [ 51.669171][ T6164] dump_stack_lvl+0x100/0x190 [ 51.669197][ T6164] should_fail_ex.cold+0x5/0xa [ 51.669220][ T6164] _copy_from_user+0x2e/0xd0 [ 51.669242][ T6164] get_compat_msghdr+0xb3/0x480 [ 51.669268][ T6164] ? __pfx_get_compat_msghdr+0x10/0x10 [ 51.669301][ T6164] ___sys_sendmsg+0x1b6/0x1e0 [ 51.669320][ T6164] ? __pfx____sys_sendmsg+0x10/0x10 [ 51.669348][ T6164] ? find_held_lock+0x2b/0x80 [ 51.669380][ T6164] __sys_sendmsg+0x160/0x210 [ 51.669402][ T6164] ? __pfx___sys_sendmsg+0x10/0x10 [ 51.669429][ T6164] ? __pfx_ksys_write+0x10/0x10 [ 51.669452][ T6164] __do_fast_syscall_32+0x13a/0x8b0 [ 51.669476][ T6164] ? lockdep_hardirqs_on+0x7d/0x110 [ 51.669500][ T6164] do_fast_syscall_32+0x32/0x70 [ 51.669542][ T6164] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 51.669562][ T6164] RIP: 0023:0xf709efec [ 51.669580][ T6164] Code: Unable to access opcode bytes at 0xf709efc2. [ 51.669588][ T6164] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 51.669604][ T6164] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000180 [ 51.669614][ T6164] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 51.669622][ T6164] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 51.669630][ T6164] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 51.669640][ T6164] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 51.669661][ T6164] [ 51.944891][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -1 [ 51.946133][ T5141] usb 6-1: USB disconnect, device number 4 [ 52.544288][ T6177] xt_TCPMSS: Only works on TCP SYN packets [ 52.662911][ T6183] bridge0: port 3(syz_tun) entered blocking state [ 52.663060][ T6183] bridge0: port 3(syz_tun) entered disabled state [ 52.663237][ T6183] syz_tun: entered allmulticast mode [ 52.664639][ T6183] syz_tun: entered promiscuous mode [ 52.665142][ T6183] bridge0: port 3(syz_tun) entered blocking state [ 52.666116][ T6183] bridge0: port 3(syz_tun) entered forwarding state [ 52.688354][ T64] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 52.730497][ T6186] warning: `syz.1.60' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 52.849865][ T64] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 52.853208][ T64] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 52.853338][ T64] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 52.853372][ T64] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 52.853568][ T64] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 52.857885][ T64] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 52.858047][ T64] usb 7-1: Product: syz [ 52.858155][ T64] usb 7-1: Manufacturer: syz [ 52.924506][ T64] cdc_wdm 7-1:1.0: skipping garbage [ 52.924525][ T64] cdc_wdm 7-1:1.0: skipping garbage [ 52.939461][ T64] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 52.939578][ T64] cdc_wdm 7-1:1.0: Unknown control protocol [ 53.362363][ T5879] usb 7-1: USB disconnect, device number 3 [ 53.654248][ T6201] FAULT_INJECTION: forcing a failure. [ 53.654248][ T6201] name failslab, interval 1, probability 0, space 0, times 0 [ 53.654278][ T6201] CPU: 3 UID: 0 PID: 6201 Comm: syz.2.64 Not tainted syzkaller #0 PREEMPT(full) [ 53.654296][ T6201] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 53.654306][ T6201] Call Trace: [ 53.654312][ T6201] [ 53.654319][ T6201] dump_stack_lvl+0x100/0x190 [ 53.654347][ T6201] should_fail_ex.cold+0x5/0xa [ 53.654369][ T6201] should_failslab+0xc2/0x120 [ 53.654400][ T6201] __kmalloc_noprof+0xfc/0x840 [ 53.654420][ T6201] ? rcu_is_watching+0x13/0xc0 [ 53.654438][ T6201] ? tomoyo_encode2+0xfb/0x3c0 [ 53.654459][ T6201] tomoyo_encode2+0xfb/0x3c0 [ 53.654512][ T6201] tomoyo_encode+0x29/0x50 [ 53.654530][ T6201] tomoyo_realpath_from_path+0x18c/0x690 [ 53.654555][ T6201] tomoyo_mount_acl+0x1b6/0x8b0 [ 53.654579][ T6201] ? is_bpf_text_address+0x8a/0x1a0 [ 53.654602][ T6201] ? is_bpf_text_address+0x8a/0x1a0 [ 53.654626][ T6201] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 53.654649][ T6201] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 53.654672][ T6201] ? kernel_text_address+0x8d/0x100 [ 53.654695][ T6201] ? unwind_get_return_address+0x59/0xa0 [ 53.654716][ T6201] ? arch_stack_walk+0xa6/0xf0 [ 53.654739][ T6201] ? __lock_acquire+0x5c0/0x1f40 [ 53.654771][ T6201] ? tomoyo_mount_permission+0x1f6/0x460 [ 53.654800][ T6201] ? tomoyo_domain+0xb2/0x150 [ 53.654818][ T6201] ? tomoyo_profile+0x47/0x60 [ 53.654840][ T6201] tomoyo_mount_permission+0x214/0x460 [ 53.654863][ T6201] ? tomoyo_mount_permission+0x1f6/0x460 [ 53.654890][ T6201] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 53.654929][ T6201] security_sb_mount+0xdd/0x270 [ 53.654953][ T6201] path_mount+0x158/0x24c0 [ 53.654980][ T6201] ? __pfx_path_mount+0x10/0x10 [ 53.655002][ T6201] ? lockdep_hardirqs_on+0x7d/0x110 [ 53.655030][ T6201] ? putname+0xb1/0x110 [ 53.655050][ T6201] ? kmem_cache_free+0x127/0x6c0 [ 53.655083][ T6201] ? __ia32_sys_mount+0x292/0x310 [ 53.655104][ T6201] __ia32_sys_mount+0x292/0x310 [ 53.655126][ T6201] ? __pfx___ia32_sys_mount+0x10/0x10 [ 53.655156][ T6201] __do_fast_syscall_32+0x13a/0x8b0 [ 53.655185][ T6201] do_fast_syscall_32+0x32/0x70 [ 53.655212][ T6201] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 53.655232][ T6201] RIP: 0023:0xf706efec [ 53.655252][ T6201] Code: Unable to access opcode bytes at 0xf706efc2. [ 53.655259][ T6201] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 53.655278][ T6201] RAX: ffffffffffffffda RBX: 0000000080000040 RCX: 0000000080000100 [ 53.655290][ T6201] RDX: 0000000080000180 RSI: 0000000000208002 RDI: 0000000080000440 [ 53.655301][ T6201] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 53.655310][ T6201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 53.655320][ T6201] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 53.655343][ T6201] [ 53.655542][ T6201] ERROR: Out of memory at tomoyo_realpath_from_path. [ 54.158293][ T35] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 54.159425][ T6210] netlink: 8 bytes leftover after parsing attributes in process `syz.1.68'. [ 54.159453][ T6210] netlink: 8 bytes leftover after parsing attributes in process `syz.1.68'. [ 54.208174][ T5141] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 54.328265][ T35] usb 5-1: Using ep0 maxpacket: 8 [ 54.331051][ T35] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 54.331993][ T35] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 54.332031][ T35] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 54.332052][ T35] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 54.332070][ T35] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 54.332086][ T35] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 54.332114][ T35] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.361771][ T5141] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 54.362838][ T5141] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 54.362855][ T5141] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 54.362872][ T5141] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.366445][ T6207] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 54.380015][ T5141] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 54.483139][ T6213] bridge0: port 3(syz_tun) entered blocking state [ 54.483218][ T6213] bridge0: port 3(syz_tun) entered disabled state [ 54.483301][ T6213] syz_tun: entered allmulticast mode [ 54.484054][ T6213] syz_tun: entered promiscuous mode [ 54.484311][ T6213] bridge0: port 3(syz_tun) entered blocking state [ 54.484349][ T6213] bridge0: port 3(syz_tun) entered forwarding state [ 54.568659][ T6203] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.568882][ T6203] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.575160][ T5141] usb 7-1: USB disconnect, device number 4 [ 54.582947][ T6203] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.583152][ T6203] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.610681][ T6203] loop8: detected capacity change from 0 to 8 [ 54.617157][ T6203] Dev loop8: unable to read RDB block 8 [ 54.617180][ T6203] loop8: unable to read partition table [ 54.617272][ T6203] loop8: partition table beyond EOD, truncated [ 54.617290][ T6203] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 54.634964][ T6203] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.636025][ T6203] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.774452][ T35] usb 5-1: usb_control_msg returned -32 [ 54.774477][ T35] usbtmc 5-1:16.0: can't read capabilities [ 55.054218][ T6230] netlink: 24 bytes leftover after parsing attributes in process `syz.3.73'. [ 55.094598][ T6230] netlink: 'syz.3.73': attribute type 13 has an invalid length. [ 55.613185][ T6234] tipc: Started in network mode [ 55.613200][ T6234] tipc: Node identity 2002a3a, cluster identity 4711 [ 55.613208][ T6234] tipc: Node number set to 33565242 [ 56.478336][ T5879] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 56.629137][ T5879] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 56.630127][ T5879] usb 8-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 56.630149][ T5879] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 56.630163][ T5879] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 56.630195][ T5879] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 56.631540][ T5879] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 56.631561][ T5879] usb 8-1: Product: syz [ 56.631573][ T5879] usb 8-1: Manufacturer: syz [ 56.639449][ T5879] cdc_wdm 8-1:1.0: skipping garbage [ 56.639463][ T5879] cdc_wdm 8-1:1.0: skipping garbage [ 56.641106][ T5879] cdc_wdm 8-1:1.0: cdc-wdm1: USB WDM device [ 56.641119][ T5879] cdc_wdm 8-1:1.0: Unknown control protocol [ 56.842536][ T6241] usbtmc 5-1:16.0: send_request_dev_dep_msg_in returned -90 [ 56.851566][ T35] usb 8-1: USB disconnect, device number 2 [ 56.882652][ T30] usb 5-1: USB disconnect, device number 4 [ 56.930284][ T5879] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 57.258867][ T35] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 57.309338][ T5879] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 57.333209][ T5879] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 57.333226][ T5879] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 57.333236][ T5879] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 57.333257][ T5879] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 57.410423][ T35] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 57.415711][ T35] usb 8-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 57.415855][ T35] usb 8-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 57.415994][ T35] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.426332][ T5879] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 57.426348][ T5879] usb 6-1: Product: syz [ 57.426355][ T5879] usb 6-1: Manufacturer: syz [ 57.449043][ T6250] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 57.486222][ T35] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 58.023426][ T35] usb 8-1: USB disconnect, device number 3 [ 58.103314][ T5879] cdc_wdm 6-1:1.0: skipping garbage [ 58.103326][ T5879] cdc_wdm 6-1:1.0: skipping garbage [ 58.104929][ T5879] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 58.104938][ T5879] cdc_wdm 6-1:1.0: Unknown control protocol [ 58.341406][ T5823] netdevsim netdevsim120 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.426012][ C3] wdm_int_callback: 934 callbacks suppressed [ 58.426029][ C3] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 58.426037][ C3] wdm_int_callback: 934 callbacks suppressed [ 58.426044][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 58.426701][ C3] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 58.426712][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 58.426894][ C3] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 58.426903][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 58.427086][ C3] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 58.427095][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 58.427102][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 58.427113][ T50] usb 6-1: USB disconnect, device number 5 [ 59.035170][ T6283] FAULT_INJECTION: forcing a failure. [ 59.035170][ T6283] name failslab, interval 1, probability 0, space 0, times 0 [ 59.035191][ T6283] CPU: 1 UID: 0 PID: 6283 Comm: syz.2.90 Not tainted syzkaller #0 PREEMPT(full) [ 59.035203][ T6283] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 59.035210][ T6283] Call Trace: [ 59.035215][ T6283] [ 59.035220][ T6283] dump_stack_lvl+0x100/0x190 [ 59.035238][ T6283] should_fail_ex.cold+0x5/0xa [ 59.035253][ T6283] should_failslab+0xc2/0x120 [ 59.035268][ T6283] kmem_cache_alloc_noprof+0x92/0x6a0 [ 59.035281][ T6283] ? __lock_acquire+0x5c0/0x1f40 [ 59.035296][ T6283] ? dst_alloc+0x99/0x1a0 [ 59.035313][ T6283] dst_alloc+0x99/0x1a0 [ 59.035328][ T6283] rt_dst_alloc+0x35/0x3a0 [ 59.035347][ T6283] ip_route_output_key_hash_rcu+0x87a/0x2870 [ 59.035363][ T6283] ip_route_output_key_hash+0x118/0x2b0 [ 59.035375][ T6283] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 59.035390][ T6283] ? __pfx_map_id_range_down+0x10/0x10 [ 59.035407][ T6283] ip_route_output_flow+0x27/0x150 [ 59.035419][ T6283] ipip6_tunnel_bind_dev+0x351/0x640 [ 59.035434][ T6283] ? __pfx_ipip6_tunnel_bind_dev+0x10/0x10 [ 59.035451][ T6283] ? kasan_save_track+0x14/0x30 [ 59.035464][ T6283] ? __kasan_kmalloc+0xaa/0xb0 [ 59.035477][ T6283] ? __pfx_ipip6_tunnel_init+0x10/0x10 [ 59.035490][ T6283] ipip6_tunnel_init+0xaf/0x5b0 [ 59.035506][ T6283] ? __pfx_ipip6_tunnel_init+0x10/0x10 [ 59.035519][ T6283] register_netdevice+0x685/0x25a0 [ 59.035535][ T6283] ? __hw_addr_insert+0x207/0x290 [ 59.035552][ T6283] ? __pfx_register_netdevice+0x10/0x10 [ 59.035569][ T6283] ? dev_addr_mod+0x14f/0x2c0 [ 59.035581][ T6283] ipip6_tunnel_create+0x11d/0x1d0 [ 59.035596][ T6283] ipip6_tunnel_locate+0x5ea/0x880 [ 59.035613][ T6283] ? __pfx_ipip6_tunnel_locate+0x10/0x10 [ 59.035629][ T6283] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 59.035645][ T6283] ipip6_tunnel_ctl+0x44c/0x780 [ 59.035661][ T6283] ip_tunnel_siocdevprivate+0x114/0x1b0 [ 59.035677][ T6283] ? __pfx_ip_tunnel_siocdevprivate+0x10/0x10 [ 59.035695][ T6283] ? __pfx_stack_trace_save+0x10/0x10 [ 59.035709][ T6283] ? stack_depot_save_flags+0x27/0x9f0 [ 59.035725][ T6283] ? __lock_acquire+0x5c0/0x1f40 [ 59.035741][ T6283] ipip6_tunnel_siocdevprivate+0x364/0x16a0 [ 59.035758][ T6283] ? __pfx_ipip6_tunnel_siocdevprivate+0x10/0x10 [ 59.035773][ T6283] ? __ia32_compat_sys_ioctl+0xc2/0x360 [ 59.035790][ T6283] ? __do_fast_syscall_32+0x13a/0x8b0 [ 59.035807][ T6283] ? do_fast_syscall_32+0x32/0x70 [ 59.035823][ T6283] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 59.035846][ T6283] ? lock_acquire+0x1d1/0x380 [ 59.035861][ T6283] ? dev_ioctl+0x6fd/0x1070 [ 59.035878][ T6283] ? rcu_is_watching+0x13/0xc0 [ 59.035889][ T6283] ? full_name_hash+0xbc/0x100 [ 59.035906][ T6283] ? dev_ifsioc+0xc2f/0x1f10 [ 59.035920][ T6283] dev_ifsioc+0xc2f/0x1f10 [ 59.035958][ T6283] ? __pfx_dev_ifsioc+0x10/0x10 [ 59.035978][ T6283] ? __pfx___mutex_lock+0x10/0x10 [ 59.036004][ T6283] ? lock_acquire+0x1d1/0x380 [ 59.036031][ T6283] ? dev_load+0x8e/0x240 [ 59.036053][ T6283] ? dev_load+0x8e/0x240 [ 59.036081][ T6283] dev_ioctl+0x70e/0x1070 [ 59.036108][ T6283] sock_ioctl+0x494/0x6b0 [ 59.036129][ T6283] ? __pfx_sock_ioctl+0x10/0x10 [ 59.036154][ T6283] ? do_vfs_ioctl+0x226/0x13e0 [ 59.036179][ T6283] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 59.036204][ T6283] compat_sock_ioctl+0x400/0x760 [ 59.036226][ T6283] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 59.036243][ T6283] ? hook_file_ioctl_common+0x140/0x440 [ 59.036276][ T6283] ? __fget_files+0x21f/0x3d0 [ 59.036294][ T6283] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 59.036306][ T6283] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 59.036325][ T6283] __do_fast_syscall_32+0x13a/0x8b0 [ 59.036346][ T6283] do_fast_syscall_32+0x32/0x70 [ 59.036362][ T6283] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 59.036376][ T6283] RIP: 0023:0xf706efec [ 59.036390][ T6283] Code: Unable to access opcode bytes at 0xf706efc2. [ 59.036395][ T6283] RSP: 002b:00000000f543c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 59.036406][ T6283] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000000089f1 [ 59.036413][ T6283] RDX: 0000000080000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 59.036420][ T6283] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 59.036427][ T6283] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 59.036433][ T6283] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 59.036447][ T6283] [ 59.049584][ T6286] netlink: 20 bytes leftover after parsing attributes in process `syz.0.92'. [ 59.053452][ T6286] netlink: 8 bytes leftover after parsing attributes in process `syz.0.92'. [ 59.156053][ T6289] FAULT_INJECTION: forcing a failure. [ 59.156053][ T6289] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 59.156072][ T6289] CPU: 3 UID: 0 PID: 6289 Comm: syz.3.93 Not tainted syzkaller #0 PREEMPT(full) [ 59.156084][ T6289] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 59.156091][ T6289] Call Trace: [ 59.156095][ T6289] [ 59.156099][ T6289] dump_stack_lvl+0x100/0x190 [ 59.156117][ T6289] should_fail_ex.cold+0x5/0xa [ 59.156131][ T6289] _copy_from_user+0x2e/0xd0 [ 59.156146][ T6289] move_addr_to_kernel+0x65/0x170 [ 59.156159][ T6289] __sys_bind+0x11d/0x260 [ 59.156170][ T6289] ? __pfx___sys_bind+0x10/0x10 [ 59.156181][ T6289] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 59.156203][ T6289] ? ksys_write+0x1ac/0x250 [ 59.156215][ T6289] ? __pfx_ksys_write+0x10/0x10 [ 59.156227][ T6289] __ia32_sys_bind+0x71/0xb0 [ 59.156238][ T6289] ? lockdep_hardirqs_on+0x7d/0x110 [ 59.156253][ T6289] __do_fast_syscall_32+0x13a/0x8b0 [ 59.156269][ T6289] ? lockdep_hardirqs_on+0x7d/0x110 [ 59.156286][ T6289] do_fast_syscall_32+0x32/0x70 [ 59.156303][ T6289] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 59.156316][ T6289] RIP: 0023:0xf709efec [ 59.156329][ T6289] Code: Unable to access opcode bytes at 0xf709efc2. [ 59.156336][ T6289] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000169 [ 59.156352][ T6289] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 59.156362][ T6289] RDX: 000000000000001c RSI: 0000000000000000 RDI: 0000000000000000 [ 59.156371][ T6289] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 59.156382][ T6289] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 59.156392][ T6289] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 59.156414][ T6289] [ 59.192718][ T6290] input: syz0 as /devices/virtual/input/input5 [ 59.264859][ T6287] netlink: 4 bytes leftover after parsing attributes in process `syz.0.92'. [ 59.264960][ T6293] netlink: 56 bytes leftover after parsing attributes in process `syz.3.94'. [ 59.281053][ T5814] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 59.338594][ T6283] netlink: 'syz.2.90': attribute type 21 has an invalid length. [ 59.338612][ T6283] IPv6: NLM_F_CREATE should be specified when creating new route [ 59.467545][ T5814] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 59.550321][ T5814] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 59.550339][ T5814] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 59.550348][ T5814] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 59.550369][ T5814] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 59.557921][ T6299] FAULT_INJECTION: forcing a failure. [ 59.557921][ T6299] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 59.557944][ T6299] CPU: 3 UID: 0 PID: 6299 Comm: syz.0.96 Not tainted syzkaller #0 PREEMPT(full) [ 59.557959][ T6299] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 59.557966][ T6299] Call Trace: [ 59.557971][ T6299] [ 59.557976][ T6299] dump_stack_lvl+0x100/0x190 [ 59.557996][ T6299] should_fail_ex.cold+0x5/0xa [ 59.558009][ T6299] ? prepare_alloc_pages+0x16d/0x5b0 [ 59.558026][ T6299] should_fail_alloc_page+0xeb/0x140 [ 59.558044][ T6299] prepare_alloc_pages+0x1f0/0x5b0 [ 59.558059][ T6299] ? find_held_lock+0x2b/0x80 [ 59.558074][ T6299] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 59.558108][ T6299] ? is_bpf_text_address+0x94/0x1a0 [ 59.558127][ T6299] ? kernel_text_address+0x8d/0x100 [ 59.558148][ T6299] ? __kernel_text_address+0xd/0x30 [ 59.558164][ T6299] ? unwind_get_return_address+0x59/0xa0 [ 59.558184][ T6299] ? __lock_acquire+0x5c0/0x1f40 [ 59.558204][ T6299] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 59.558222][ T6299] ? look_up_lock_class+0x55/0x120 [ 59.558240][ T6299] ? register_lock_class+0x3f/0x7b0 [ 59.558255][ T6299] ? find_held_lock+0x2b/0x80 [ 59.558267][ T6299] ? ima_match_policy+0x8c4/0x23f0 [ 59.558291][ T6299] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 59.558308][ T6299] ? policy_nodemask+0xed/0x4f0 [ 59.558325][ T6299] alloc_pages_mpol+0x201/0x550 [ 59.558341][ T6299] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 59.558355][ T6299] ? find_held_lock+0x2b/0x80 [ 59.558366][ T6299] ? process_measurement+0x4c8/0x2350 [ 59.558382][ T6299] ? process_measurement+0x4c8/0x2350 [ 59.558397][ T6299] folio_alloc_mpol_noprof+0x36/0x260 [ 59.558414][ T6299] shmem_alloc_folio+0x135/0x160 [ 59.558429][ T6299] shmem_alloc_and_add_folio+0x371/0xd40 [ 59.558449][ T6299] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 59.558465][ T6299] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 59.558485][ T6299] shmem_get_folio_gfp+0x75b/0x1980 [ 59.558504][ T6299] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 59.558522][ T6299] ? filemap_map_pages+0x114a/0x2100 [ 59.558539][ T6299] shmem_fault+0x1fb/0xa30 [ 59.558556][ T6299] ? __pfx_shmem_fault+0x10/0x10 [ 59.558573][ T6299] ? __pfx_filemap_map_pages+0x10/0x10 [ 59.558589][ T6299] ? find_held_lock+0x2b/0x80 [ 59.558602][ T6299] ? __pfx_filemap_map_pages+0x10/0x10 [ 59.558615][ T6299] __do_fault+0x10b/0x440 [ 59.558628][ T6299] do_fault+0xb3f/0x1830 [ 59.558642][ T6299] ? __pfx_do_fault+0x10/0x10 [ 59.558655][ T6299] ? rcu_read_unlock+0x2d/0xb0 [ 59.558670][ T6299] ? rcu_read_unlock+0x2d/0xb0 [ 59.558685][ T6299] ? __pte_offset_map+0x179/0x310 [ 59.558699][ T6299] __handle_mm_fault+0x150b/0x2f60 [ 59.558718][ T6299] ? __pfx___handle_mm_fault+0x10/0x10 [ 59.558733][ T6299] ? __pfx_mt_find+0x10/0x10 [ 59.558750][ T6299] ? find_vma+0xbf/0x140 [ 59.558762][ T6299] ? __pfx_find_vma+0x10/0x10 [ 59.558775][ T6299] handle_mm_fault+0x363/0xa20 [ 59.558793][ T6299] do_user_addr_fault+0x745/0x12f0 [ 59.558809][ T6299] exc_page_fault+0x6f/0xd0 [ 59.558824][ T6299] asm_exc_page_fault+0x26/0x30 [ 59.558835][ T6299] RIP: 0010:__get_user_4+0x14/0x30 [ 59.558849][ T6299] Code: 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 f0 ff ff ff 7f 00 00 48 39 d0 48 0f 47 c2 0f 01 cb <8b> 10 31 c0 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 59.558863][ T6299] RSP: 0018:ffffc9002343feb8 EFLAGS: 00050283 [ 59.558882][ T6299] RAX: 0000000080001440 RBX: ffffc9002343ff48 RCX: ffffc9000cab1000 [ 59.558893][ T6299] RDX: 00007ffffffff000 RSI: ffffffff825fb441 RDI: ffffffff8c622c80 [ 59.558905][ T6299] RBP: 0000000080001440 R08: 0000000000010e42 R09: 00000000000001d4 [ 59.558917][ T6299] R10: 0000000000000200 R11: 0000000000000000 R12: ffff888022568000 [ 59.558928][ T6299] R13: 000000000000007f R14: 0000000000000000 R15: 0000000000000000 [ 59.558945][ T6299] ? __might_fault+0x111/0x140 [ 59.558978][ T6299] __ia32_compat_sys_io_setup+0x72/0x220 [ 59.559003][ T6299] __do_fast_syscall_32+0x13a/0x8b0 [ 59.559019][ T6299] ? lockdep_hardirqs_on+0x7d/0x110 [ 59.559035][ T6299] do_fast_syscall_32+0x32/0x70 [ 59.559052][ T6299] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 59.559066][ T6299] RIP: 0023:0xf7fd7fec [ 59.559078][ T6299] Code: Unable to access opcode bytes at 0xf7fd7fc2. [ 59.559083][ T6299] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 00000000000000f5 [ 59.559092][ T6299] RAX: ffffffffffffffda RBX: 000000000000007f RCX: 0000000080001440 [ 59.559099][ T6299] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 59.559105][ T6299] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 59.559110][ T6299] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 59.559116][ T6299] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 59.559129][ T6299] [ 59.746420][ T5814] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 59.746435][ T5814] usb 6-1: Product: syz [ 59.746443][ T5814] usb 6-1: Manufacturer: syz [ 59.798299][ T5814] cdc_wdm 6-1:1.0: skipping garbage [ 59.798310][ T5814] cdc_wdm 6-1:1.0: skipping garbage [ 59.799473][ T5814] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 59.799487][ T5814] cdc_wdm 6-1:1.0: Unknown control protocol [ 59.913280][ T9] libceph: connect (1)[c::]:6789 error -101 [ 59.913420][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 59.963341][ T6312] ceph: No mds server is up or the cluster is laggy [ 60.030751][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 60.030773][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 60.031035][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 60.031050][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 60.031262][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 60.031278][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 60.031476][ T25] usb 6-1: USB disconnect, device number 6 [ 60.031478][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 60.031508][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 60.031521][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 60.397411][ T6324] FAULT_INJECTION: forcing a failure. [ 60.397411][ T6324] name failslab, interval 1, probability 0, space 0, times 0 [ 60.397432][ T6324] CPU: 0 UID: 0 PID: 6324 Comm: syz.0.103 Not tainted syzkaller #0 PREEMPT(full) [ 60.397457][ T6324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 60.397464][ T6324] Call Trace: [ 60.397468][ T6324] [ 60.397473][ T6324] dump_stack_lvl+0x100/0x190 [ 60.397491][ T6324] should_fail_ex.cold+0x5/0xa [ 60.397506][ T6324] should_failslab+0xc2/0x120 [ 60.397521][ T6324] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 60.397535][ T6324] ? __alloc_skb+0x5b7/0x710 [ 60.397549][ T6324] ? __alloc_skb+0x140/0x710 [ 60.397564][ T6324] __alloc_skb+0x140/0x710 [ 60.397577][ T6324] ? __alloc_skb+0x5b7/0x710 [ 60.397589][ T6324] ? __pfx___alloc_skb+0x10/0x10 [ 60.397606][ T6324] netlink_alloc_large_skb+0x69/0x150 [ 60.397621][ T6324] netlink_sendmsg+0x680/0xda0 [ 60.397636][ T6324] ? __pfx_netlink_sendmsg+0x10/0x10 [ 60.397650][ T6324] ? apparmor_socket_sendmsg+0x165/0x280 [ 60.397667][ T6324] __sys_sendto+0x48b/0x4e0 [ 60.397679][ T6324] ? __pfx_netlink_sendmsg+0x10/0x10 [ 60.397692][ T6324] ? __pfx___sys_sendto+0x10/0x10 [ 60.397715][ T6324] ? fput+0x7c/0x100 [ 60.397731][ T6324] __ia32_sys_sendto+0xdd/0x1b0 [ 60.397744][ T6324] ? __do_fast_syscall_32+0xb3/0x8b0 [ 60.397761][ T6324] ? lockdep_hardirqs_on+0x7d/0x110 [ 60.397777][ T6324] __do_fast_syscall_32+0x13a/0x8b0 [ 60.397793][ T6324] ? lockdep_hardirqs_on+0x7d/0x110 [ 60.397812][ T6324] do_fast_syscall_32+0x32/0x70 [ 60.397829][ T6324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 60.397843][ T6324] RIP: 0023:0xf7fd7fec [ 60.397857][ T6324] Code: Unable to access opcode bytes at 0xf7fd7fc2. [ 60.397862][ T6324] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 60.397872][ T6324] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000600 [ 60.397879][ T6324] RDX: 00000000000000a8 RSI: 0000000000000000 RDI: 0000000000000000 [ 60.397885][ T6324] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 60.397891][ T6324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 60.397897][ T6324] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 60.397910][ T6324] [ 60.586418][ T6332] input: syz1 as /devices/virtual/input/input6 [ 61.498194][ T6322] pci 0000:00:03.0: [1af4:1005] type 00 class 0x00ff00 conventional PCI endpoint [ 61.511173][ T6322] pci 0000:00:03.0: BAR 0 [io 0xc0a0-0xc0bf] [ 61.511232][ T6322] pci 0000:00:03.0: BAR 1 [mem 0xfeaf5000-0xfeaf5fff] [ 61.511408][ T6322] pci 0000:00:03.0: BAR 4 [mem 0xfe200000-0xfe203fff 64bit pref] [ 61.584193][ T6322] pci 0000:00:03.0: Adding to iommu group 3 [ 61.615292][ T6322] pci 0000:00:03.0: BAR 4 [mem 0x580000000-0x580003fff 64bit pref]: assigned [ 61.630116][ T6322] pci 0000:00:03.0: BAR 1 [mem 0x80000000-0x80000fff]: assigned [ 61.643360][ T6322] pci 0000:00:03.0: BAR 0 [io 0x2020-0x203f]: assigned [ 62.078169][ T5822] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 62.241618][ T5822] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 62.252650][ T5822] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 62.252695][ T5822] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 62.252706][ T5822] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 62.252798][ T5822] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 62.252843][ T5822] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59237, setting to 1024 [ 62.266052][ T5822] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 62.266067][ T5822] usb 7-1: Product: syz [ 62.266074][ T5822] usb 7-1: Manufacturer: syz [ 62.318718][ T6352] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 62.505694][ T6364] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 62.506096][ T6364] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 62.507148][ T6364] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 62.509399][ T6364] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 62.519264][ T6364] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 62.520062][ T6364] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 62.521513][ T6364] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 62.522293][ T6364] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 62.523014][ T6364] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 62.523923][ T6364] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 62.750144][ T5822] cdc_wdm 7-1:1.0: skipping garbage [ 62.750157][ T5822] cdc_wdm 7-1:1.0: skipping garbage [ 62.759132][ T5822] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 62.759145][ T5822] cdc_wdm 7-1:1.0: Unknown control protocol [ 63.961428][ T5822] usb 7-1: USB disconnect, device number 5 [ 64.493523][ T6373] FAULT_INJECTION: forcing a failure. [ 64.493523][ T6373] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 64.493555][ T6373] CPU: 2 UID: 0 PID: 6373 Comm: syz.2.115 Not tainted syzkaller #0 PREEMPT(full) [ 64.493575][ T6373] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 64.493586][ T6373] Call Trace: [ 64.493592][ T6373] [ 64.493599][ T6373] dump_stack_lvl+0x100/0x190 [ 64.493644][ T6373] should_fail_ex.cold+0x5/0xa [ 64.493668][ T6373] _copy_from_user+0x2e/0xd0 [ 64.493691][ T6373] io_register_zcrx+0x18d/0x1e20 [ 64.493715][ T6373] ? __might_fault+0xc5/0x140 [ 64.493745][ T6373] ? __pfx_io_register_zcrx+0x10/0x10 [ 64.493769][ T6373] ? lock_acquire+0x1d1/0x380 [ 64.493793][ T6373] ? __do_sys_io_uring_register+0x135/0x1bc0 [ 64.493826][ T6373] ? rcu_is_watching+0x13/0xc0 [ 64.493844][ T6373] ? trace_contention_end+0x126/0x160 [ 64.493874][ T6373] ? get_pid_task+0xfc/0x250 [ 64.493900][ T6373] ? __fget_files+0x215/0x3d0 [ 64.493936][ T6373] __do_sys_io_uring_register+0x1193/0x1bc0 [ 64.493969][ T6373] ? __pfx___do_sys_io_uring_register+0x10/0x10 [ 64.493994][ T6373] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 64.494023][ T6373] ? __fget_files+0x21f/0x3d0 [ 64.494048][ T6373] ? fput+0x7c/0x100 [ 64.494070][ T6373] ? ksys_write+0x1ac/0x250 [ 64.494087][ T6373] ? __pfx_ksys_write+0x10/0x10 [ 64.494110][ T6373] __do_fast_syscall_32+0x13a/0x8b0 [ 64.494137][ T6373] ? lockdep_hardirqs_on+0x7d/0x110 [ 64.494164][ T6373] do_fast_syscall_32+0x32/0x70 [ 64.494192][ T6373] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 64.494214][ T6373] RIP: 0023:0xf706efec [ 64.494234][ T6373] Code: Unable to access opcode bytes at 0xf706efc2. [ 64.494242][ T6373] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 00000000000001ab [ 64.494258][ T6373] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000020 [ 64.494269][ T6373] RDX: 0000000080000100 RSI: 0000000000000001 RDI: 0000000000000000 [ 64.494279][ T6373] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 64.494289][ T6373] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 64.494300][ T6373] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 64.494324][ T6373] [ 64.919787][ T6384] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 64.919847][ T6384] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 65.578197][ T5091] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 65.578245][ T5733] Bluetooth: hci4: command 0x1003 tx timeout [ 65.964933][ T6405] binder: 6402:6405 ioctl c0306201 0 returned -14 [ 66.288362][ T5814] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 66.288726][ C1] raw-gadget.0 gadget.3: ignoring, device is not running [ 66.418445][ T5814] usb 8-1: device descriptor read/64, error -32 [ 66.679474][ T5814] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 66.889555][ T5814] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 66.890382][ T5814] usb 8-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 66.890396][ T5814] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 66.890405][ T5814] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 66.890424][ T5814] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 66.890437][ T5814] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59237, setting to 1024 [ 66.891568][ T5814] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 66.891579][ T5814] usb 8-1: Product: syz [ 66.891587][ T5814] usb 8-1: Manufacturer: syz [ 66.893475][ T6407] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 66.894375][ T5814] cdc_wdm 8-1:1.0: skipping garbage [ 66.894389][ T5814] cdc_wdm 8-1:1.0: skipping garbage [ 66.897075][ T5814] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 66.897085][ T5814] cdc_wdm 8-1:1.0: Unknown control protocol [ 67.112148][ C2] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 67.112172][ C2] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 67.112395][ C2] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 67.112409][ C2] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 67.112615][ C2] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 67.112630][ C2] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 67.112830][ C2] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 67.112844][ C2] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 67.113057][ C2] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 67.113072][ C2] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 67.113283][ C2] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 67.113298][ C2] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 67.113510][ C2] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 67.113524][ C2] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 67.113737][ C2] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 67.113759][ C2] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 67.113983][ C2] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 67.113997][ C2] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 67.114215][ C2] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 67.114228][ C2] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 67.295418][ T50] usb 8-1: USB disconnect, device number 5 [ 67.417797][ T35] libceph: connect (1)[c::]:6789 error -101 [ 67.417919][ T35] libceph: mon0 (1)[c::]:6789 connect error [ 67.462098][ T6426] ceph: No mds server is up or the cluster is laggy [ 68.336026][ T5814] libceph: connect (1)[c::]:6789 error -101 [ 68.359810][ T5814] libceph: mon0 (1)[c::]:6789 connect error [ 68.365167][ T6446] ceph: No mds server is up or the cluster is laggy [ 68.394283][ T5814] libceph: connect (1)[c::]:6789 error -101 [ 68.394967][ T5814] libceph: mon0 (1)[c::]:6789 connect error [ 69.290269][ T6454] FAULT_INJECTION: forcing a failure. [ 69.290269][ T6454] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 69.290290][ T6454] CPU: 3 UID: 0 PID: 6454 Comm: syz.1.136 Not tainted syzkaller #0 PREEMPT(full) [ 69.290302][ T6454] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 69.290309][ T6454] Call Trace: [ 69.290314][ T6454] [ 69.290318][ T6454] dump_stack_lvl+0x100/0x190 [ 69.290336][ T6454] should_fail_ex.cold+0x5/0xa [ 69.290349][ T6454] ? prepare_alloc_pages+0x16d/0x5b0 [ 69.290366][ T6454] should_fail_alloc_page+0xeb/0x140 [ 69.290382][ T6454] prepare_alloc_pages+0x1f0/0x5b0 [ 69.290396][ T6454] ? find_held_lock+0x2b/0x80 [ 69.290420][ T6454] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 69.290433][ T6454] ? is_bpf_text_address+0x94/0x1a0 [ 69.290449][ T6454] ? kernel_text_address+0x8d/0x100 [ 69.290465][ T6454] ? __kernel_text_address+0xd/0x30 [ 69.290478][ T6454] ? unwind_get_return_address+0x59/0xa0 [ 69.290494][ T6454] ? __lock_acquire+0x5c0/0x1f40 [ 69.290510][ T6454] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 69.290526][ T6454] ? look_up_lock_class+0x55/0x120 [ 69.290542][ T6454] ? register_lock_class+0x3f/0x7b0 [ 69.290557][ T6454] ? find_held_lock+0x2b/0x80 [ 69.290568][ T6454] ? ima_match_policy+0x8c4/0x23f0 [ 69.290590][ T6454] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 69.290605][ T6454] ? policy_nodemask+0xed/0x4f0 [ 69.290621][ T6454] alloc_pages_mpol+0x201/0x550 [ 69.290636][ T6454] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 69.290649][ T6454] ? find_held_lock+0x2b/0x80 [ 69.290660][ T6454] ? process_measurement+0x4c8/0x2350 [ 69.290673][ T6454] ? process_measurement+0x4c8/0x2350 [ 69.290688][ T6454] folio_alloc_mpol_noprof+0x36/0x260 [ 69.290707][ T6454] shmem_alloc_folio+0x135/0x160 [ 69.290722][ T6454] shmem_alloc_and_add_folio+0x371/0xd40 [ 69.290741][ T6454] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 69.290758][ T6454] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 69.290777][ T6454] shmem_get_folio_gfp+0x75b/0x1980 [ 69.290796][ T6454] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 69.290816][ T6454] ? filemap_map_pages+0x114a/0x2100 [ 69.290835][ T6454] shmem_fault+0x1fb/0xa30 [ 69.290852][ T6454] ? __pfx_shmem_fault+0x10/0x10 [ 69.290963][ T6454] ? __pfx_filemap_map_pages+0x10/0x10 [ 69.290980][ T6454] ? find_held_lock+0x2b/0x80 [ 69.290994][ T6454] ? __pfx_filemap_map_pages+0x10/0x10 [ 69.291009][ T6454] __do_fault+0x10b/0x440 [ 69.291022][ T6454] do_fault+0xb3f/0x1830 [ 69.291039][ T6454] ? __pfx_do_fault+0x10/0x10 [ 69.291052][ T6454] ? rcu_read_unlock+0x2d/0xb0 [ 69.291068][ T6454] ? rcu_read_unlock+0x2d/0xb0 [ 69.291083][ T6454] ? __pte_offset_map+0x179/0x310 [ 69.291097][ T6454] __handle_mm_fault+0x150b/0x2f60 [ 69.291116][ T6454] ? __pfx___handle_mm_fault+0x10/0x10 [ 69.291131][ T6454] ? __pfx_mt_find+0x10/0x10 [ 69.291148][ T6454] ? find_vma+0xbf/0x140 [ 69.291160][ T6454] ? __pfx_find_vma+0x10/0x10 [ 69.291173][ T6454] handle_mm_fault+0x363/0xa20 [ 69.291191][ T6454] do_user_addr_fault+0x745/0x12f0 [ 69.291207][ T6454] exc_page_fault+0x6f/0xd0 [ 69.291223][ T6454] asm_exc_page_fault+0x26/0x30 [ 69.291234][ T6454] RIP: 0010:__get_user_4+0x14/0x30 [ 69.291247][ T6454] Code: 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 f0 ff ff ff 7f 00 00 48 39 d0 48 0f 47 c2 0f 01 cb <8b> 10 31 c0 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 69.291257][ T6454] RSP: 0018:ffffc900030b7eb8 EFLAGS: 00050283 [ 69.291266][ T6454] RAX: 0000000080001440 RBX: ffffc900030b7f48 RCX: ffffc90025fc1000 [ 69.291273][ T6454] RDX: 00007ffffffff000 RSI: ffffffff825fb441 RDI: ffffffff8c622c80 [ 69.291280][ T6454] RBP: 0000000080001440 R08: 0000000000010e42 R09: 00000000000001d4 [ 69.291286][ T6454] R10: 0000000000000200 R11: 0000000000000000 R12: ffff888028d00000 [ 69.291292][ T6454] R13: 000000000000007f R14: 0000000000000000 R15: 0000000000000000 [ 69.291303][ T6454] ? __might_fault+0x111/0x140 [ 69.291321][ T6454] __ia32_compat_sys_io_setup+0x72/0x220 [ 69.291338][ T6454] __do_fast_syscall_32+0x13a/0x8b0 [ 69.291354][ T6454] ? lockdep_hardirqs_on+0x7d/0x110 [ 69.291370][ T6454] do_fast_syscall_32+0x32/0x70 [ 69.291387][ T6454] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 69.291400][ T6454] RIP: 0023:0xf6feefec [ 69.291417][ T6454] Code: Unable to access opcode bytes at 0xf6feefc2. [ 69.291422][ T6454] RSP: 002b:00000000f53bc50c EFLAGS: 00000292 ORIG_RAX: 00000000000000f5 [ 69.291433][ T6454] RAX: ffffffffffffffda RBX: 000000000000007f RCX: 0000000080001440 [ 69.291440][ T6454] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 69.291447][ T6454] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 69.291454][ T6454] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 69.291461][ T6454] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 69.291475][ T6454] [ 70.048229][ T5814] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 70.200447][ T5814] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 70.206143][ T5814] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 70.206436][ T5814] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 70.206476][ T5814] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 70.206587][ T5814] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 70.215127][ T5814] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 70.215452][ T5814] usb 6-1: Product: syz [ 70.215461][ T5814] usb 6-1: Manufacturer: syz [ 70.290297][ T5814] cdc_wdm 6-1:1.0: skipping garbage [ 70.290342][ T5814] cdc_wdm 6-1:1.0: skipping garbage [ 70.308497][ T5814] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 70.308514][ T5814] cdc_wdm 6-1:1.0: Unknown control protocol [ 70.946516][ T855] cfg80211: failed to load regulatory.db [ 70.948580][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.979543][ T6488] FAULT_INJECTION: forcing a failure. [ 70.979543][ T6488] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 70.979564][ T6488] CPU: 1 UID: 0 PID: 6488 Comm: syz.2.146 Not tainted syzkaller #0 PREEMPT(full) [ 70.979577][ T6488] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.979583][ T6488] Call Trace: [ 70.979588][ T6488] [ 70.979592][ T6488] dump_stack_lvl+0x100/0x190 [ 70.979610][ T6488] should_fail_ex.cold+0x5/0xa [ 70.979623][ T6488] ? prepare_alloc_pages+0x16d/0x5b0 [ 70.979652][ T6488] should_fail_alloc_page+0xeb/0x140 [ 70.979669][ T6488] prepare_alloc_pages+0x1f0/0x5b0 [ 70.979685][ T6488] ? find_held_lock+0x2b/0x80 [ 70.979698][ T6488] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 70.979713][ T6488] ? is_bpf_text_address+0x94/0x1a0 [ 70.979728][ T6488] ? kernel_text_address+0x8d/0x100 [ 70.979742][ T6488] ? __kernel_text_address+0xd/0x30 [ 70.979754][ T6488] ? unwind_get_return_address+0x59/0xa0 [ 70.979769][ T6488] ? __lock_acquire+0x5c0/0x1f40 [ 70.979785][ T6488] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 70.979799][ T6488] ? look_up_lock_class+0x55/0x120 [ 70.979816][ T6488] ? register_lock_class+0x3f/0x7b0 [ 70.979835][ T6488] ? find_held_lock+0x2b/0x80 [ 70.979847][ T6488] ? ima_match_policy+0x8c4/0x23f0 [ 70.979872][ T6488] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 70.979889][ T6488] ? policy_nodemask+0xed/0x4f0 [ 70.979906][ T6488] alloc_pages_mpol+0x201/0x550 [ 70.979923][ T6488] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 70.979937][ T6488] ? find_held_lock+0x2b/0x80 [ 70.979952][ T6488] folio_alloc_mpol_noprof+0x36/0x260 [ 70.979970][ T6488] shmem_alloc_folio+0x135/0x160 [ 70.979986][ T6488] shmem_alloc_and_add_folio+0x371/0xd40 [ 70.980006][ T6488] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 70.980023][ T6488] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 70.980043][ T6488] shmem_get_folio_gfp+0x75b/0x1980 [ 70.980062][ T6488] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 70.980080][ T6488] ? filemap_map_pages+0x114a/0x2100 [ 70.980097][ T6488] shmem_fault+0x1fb/0xa30 [ 70.980114][ T6488] ? __pfx_shmem_fault+0x10/0x10 [ 70.980131][ T6488] ? __pfx_filemap_map_pages+0x10/0x10 [ 70.980151][ T6488] ? find_held_lock+0x2b/0x80 [ 70.980169][ T6488] ? __pfx_filemap_map_pages+0x10/0x10 [ 70.980188][ T6488] __do_fault+0x10b/0x440 [ 70.980208][ T6488] do_fault+0xb3f/0x1830 [ 70.980231][ T6488] ? __pfx_do_fault+0x10/0x10 [ 70.980250][ T6488] ? rcu_read_unlock+0x2d/0xb0 [ 70.980272][ T6488] ? rcu_read_unlock+0x2d/0xb0 [ 70.980288][ T6488] ? __pte_offset_map+0x179/0x310 [ 70.980302][ T6488] __handle_mm_fault+0x150b/0x2f60 [ 70.980322][ T6488] ? __pfx___handle_mm_fault+0x10/0x10 [ 70.980336][ T6488] ? __pfx_mt_find+0x10/0x10 [ 70.980355][ T6488] ? find_vma+0xbf/0x140 [ 70.980366][ T6488] ? __pfx_find_vma+0x10/0x10 [ 70.980379][ T6488] handle_mm_fault+0x363/0xa20 [ 70.980398][ T6488] do_user_addr_fault+0x745/0x12f0 [ 70.980414][ T6488] exc_page_fault+0x6f/0xd0 [ 70.980430][ T6488] asm_exc_page_fault+0x26/0x30 [ 70.980441][ T6488] RIP: 0010:__get_user_4+0x14/0x30 [ 70.980456][ T6488] Code: 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 f0 ff ff ff 7f 00 00 48 39 d0 48 0f 47 c2 0f 01 cb <8b> 10 31 c0 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 70.980466][ T6488] RSP: 0018:ffffc90003377eb8 EFLAGS: 00050283 [ 70.980476][ T6488] RAX: 0000000080001440 RBX: ffffc90003377f48 RCX: ffffc9000c0d1000 [ 70.980483][ T6488] RDX: 00007ffffffff000 RSI: ffffffff825fb441 RDI: ffffffff8c622c80 [ 70.980489][ T6488] RBP: 0000000080001440 R08: 0000000000010e42 R09: 00000000000001d4 [ 70.980496][ T6488] R10: 0000000000000200 R11: 0000000000000000 R12: ffff88802796cb00 [ 70.980502][ T6488] R13: 000000000000007f R14: 0000000000000000 R15: 0000000000000000 [ 70.980513][ T6488] ? __might_fault+0x111/0x140 [ 70.980532][ T6488] __ia32_compat_sys_io_setup+0x72/0x220 [ 70.980550][ T6488] __do_fast_syscall_32+0x13a/0x8b0 [ 70.980568][ T6488] do_fast_syscall_32+0x32/0x70 [ 70.980584][ T6488] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 70.980598][ T6488] RIP: 0023:0xf706efec [ 70.980610][ T6488] Code: Unable to access opcode bytes at 0xf706efc2. [ 70.980615][ T6488] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 00000000000000f5 [ 70.980625][ T6488] RAX: ffffffffffffffda RBX: 000000000000007f RCX: 0000000080001440 [ 70.980631][ T6488] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 70.980637][ T6488] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 70.980643][ T6488] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 70.980649][ T6488] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 70.980663][ T6488] [ 71.099703][ T6486] bridge0: port 3(syz_tun) entered blocking state [ 71.099849][ T6486] bridge0: port 3(syz_tun) entered disabled state [ 71.100022][ T6486] syz_tun: entered allmulticast mode [ 71.102013][ T6486] syz_tun: entered promiscuous mode [ 71.104249][ T6486] bridge0: port 3(syz_tun) entered blocking state [ 71.104785][ T6486] bridge0: port 3(syz_tun) entered forwarding state [ 71.149426][ T855] usb 6-1: USB disconnect, device number 7 [ 71.149580][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 71.307585][ T6500] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(3) [ 71.394800][ T6504] netlink: 16 bytes leftover after parsing attributes in process `syz.1.152'. [ 71.403382][ T6504] syz_tun: left allmulticast mode [ 71.403398][ T6504] syz_tun: left promiscuous mode [ 71.403567][ T6504] bridge0: port 3(syz_tun) entered disabled state [ 71.405287][ T6506] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(3) [ 71.405856][ T6506] FAULT_INJECTION: forcing a failure. [ 71.405856][ T6506] name failslab, interval 1, probability 0, space 0, times 0 [ 71.405877][ T6506] CPU: 1 UID: 0 PID: 6506 Comm: syz.0.153 Not tainted syzkaller #0 PREEMPT(full) [ 71.405893][ T6506] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 71.405901][ T6506] Call Trace: [ 71.405906][ T6506] [ 71.405912][ T6506] dump_stack_lvl+0x100/0x190 [ 71.405937][ T6506] should_fail_ex.cold+0x5/0xa [ 71.405955][ T6506] should_failslab+0xc2/0x120 [ 71.405975][ T6506] __kmalloc_noprof+0xfc/0x840 [ 71.405990][ T6506] ? rcu_is_watching+0x13/0xc0 [ 71.406004][ T6506] ? tomoyo_realpath_from_path+0xb6/0x690 [ 71.406023][ T6506] tomoyo_realpath_from_path+0xb6/0x690 [ 71.406041][ T6506] tomoyo_path_number_perm+0x23c/0x580 [ 71.406060][ T6506] ? tomoyo_path_number_perm+0x22e/0x580 [ 71.406081][ T6506] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 71.406101][ T6506] ? get_pid_task+0x106/0x250 [ 71.406121][ T6506] ? __lock_acquire+0x5c0/0x1f40 [ 71.406149][ T6506] ? __fget_files+0x34/0x3d0 [ 71.406164][ T6506] ? find_held_lock+0x2b/0x80 [ 71.406178][ T6506] ? __fget_files+0x215/0x3d0 [ 71.406191][ T6506] ? hook_file_ioctl_common+0x140/0x440 [ 71.406211][ T6506] ? __fget_files+0x215/0x3d0 [ 71.406229][ T6506] ? __fget_files+0x21f/0x3d0 [ 71.406247][ T6506] security_file_ioctl_compat+0xd3/0x230 [ 71.406269][ T6506] __ia32_compat_sys_ioctl+0xc2/0x360 [ 71.406293][ T6506] __do_fast_syscall_32+0x13a/0x8b0 [ 71.406315][ T6506] ? lockdep_hardirqs_on+0x7d/0x110 [ 71.406336][ T6506] do_fast_syscall_32+0x32/0x70 [ 71.406358][ T6506] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 71.406375][ T6506] RIP: 0023:0xf7fd7fec [ 71.406391][ T6506] Code: Unable to access opcode bytes at 0xf7fd7fc2. [ 71.406397][ T6506] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 71.406411][ T6506] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c138fd06 [ 71.406420][ T6506] RDX: 0000000080003000 RSI: 0000000000000000 RDI: 0000000000000000 [ 71.406428][ T6506] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 71.406436][ T6506] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 71.406444][ T6506] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 71.406463][ T6506] [ 71.406468][ T6506] ERROR: Out of memory at tomoyo_realpath_from_path. [ 71.411391][ T6504] bridge_slave_0: left allmulticast mode [ 71.411411][ T6504] bridge_slave_0: left promiscuous mode [ 71.411949][ T6504] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.421244][ T6504] bridge_slave_1: left allmulticast mode [ 71.421260][ T6504] bridge_slave_1: left promiscuous mode [ 71.421346][ T6504] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.440581][ T6504] bond0: (slave bond_slave_0): Releasing backup interface [ 71.450752][ T6504] bond0: (slave bond_slave_1): Releasing backup interface [ 71.466382][ T6504] team0: Port device team_slave_0 removed [ 71.472975][ T6504] team0: Port device team_slave_1 removed [ 71.473474][ T6504] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 71.473486][ T6504] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 71.477958][ T6504] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 71.477977][ T6504] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 71.482384][ T6504] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 72.622501][ T6524] FAULT_INJECTION: forcing a failure. [ 72.622501][ T6524] name failslab, interval 1, probability 0, space 0, times 0 [ 72.622529][ T6524] CPU: 0 UID: 0 PID: 6524 Comm: syz.3.160 Not tainted syzkaller #0 PREEMPT(full) [ 72.622549][ T6524] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 72.622560][ T6524] Call Trace: [ 72.622566][ T6524] [ 72.622572][ T6524] dump_stack_lvl+0x100/0x190 [ 72.622600][ T6524] should_fail_ex.cold+0x5/0xa [ 72.622624][ T6524] should_failslab+0xc2/0x120 [ 72.622648][ T6524] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 72.622668][ T6524] ? __alloc_skb+0x5b7/0x710 [ 72.622690][ T6524] ? __alloc_skb+0x140/0x710 [ 72.622715][ T6524] __alloc_skb+0x140/0x710 [ 72.622735][ T6524] ? __alloc_skb+0x5b7/0x710 [ 72.622766][ T6524] ? __pfx___alloc_skb+0x10/0x10 [ 72.622793][ T6524] netlink_alloc_large_skb+0x69/0x150 [ 72.622816][ T6524] netlink_sendmsg+0x680/0xda0 [ 72.622840][ T6524] ? __pfx_netlink_sendmsg+0x10/0x10 [ 72.622863][ T6524] ? apparmor_socket_sendmsg+0x165/0x280 [ 72.622890][ T6524] __sys_sendto+0x48b/0x4e0 [ 72.622910][ T6524] ? __pfx_netlink_sendmsg+0x10/0x10 [ 72.622932][ T6524] ? __pfx___sys_sendto+0x10/0x10 [ 72.622968][ T6524] ? fput+0x7c/0x100 [ 72.622991][ T6524] ? ksys_write+0x1ac/0x250 [ 72.623014][ T6524] __ia32_sys_sendto+0xdd/0x1b0 [ 72.623036][ T6524] ? __do_fast_syscall_32+0xb3/0x8b0 [ 72.623063][ T6524] ? lockdep_hardirqs_on+0x7d/0x110 [ 72.623089][ T6524] __do_fast_syscall_32+0x13a/0x8b0 [ 72.623116][ T6524] ? lockdep_hardirqs_on+0x7d/0x110 [ 72.623145][ T6524] do_fast_syscall_32+0x32/0x70 [ 72.623171][ T6524] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 72.623193][ T6524] RIP: 0023:0xf709efec [ 72.623213][ T6524] Code: Unable to access opcode bytes at 0xf709efc2. [ 72.623221][ T6524] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 72.623239][ T6524] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000600 [ 72.623251][ T6524] RDX: 00000000000000a8 RSI: 0000000000000000 RDI: 0000000000000000 [ 72.623261][ T6524] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 72.623271][ T6524] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 72.623281][ T6524] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 72.623304][ T6524] [ 72.768217][ T30] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 72.918614][ T30] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 72.919496][ T30] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 72.919510][ T30] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 72.919519][ T30] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 72.919538][ T30] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 72.919550][ T30] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59237, setting to 1024 [ 72.921541][ T30] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 72.921553][ T30] usb 7-1: Product: syz [ 72.921560][ T30] usb 7-1: Manufacturer: syz [ 72.926244][ T6522] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 72.930015][ T30] cdc_wdm 7-1:1.0: skipping garbage [ 72.930031][ T30] cdc_wdm 7-1:1.0: skipping garbage [ 72.931755][ T30] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 72.931770][ T30] cdc_wdm 7-1:1.0: Unknown control protocol [ 73.038225][ T42] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 73.088267][ T855] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 73.132840][ C2] wdm_int_callback: 884 callbacks suppressed [ 73.132860][ C2] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 73.132868][ C2] wdm_int_callback: 884 callbacks suppressed [ 73.132875][ C2] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 73.133091][ C2] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 73.133105][ C2] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 73.133295][ C2] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 73.133305][ C2] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 73.133490][ C2] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 73.133499][ C2] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 73.133675][ C2] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 73.133684][ C2] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 73.133861][ C2] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 73.133871][ C2] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 73.134062][ C2] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 73.134071][ C2] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 73.134251][ C2] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 73.134261][ C2] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 73.134452][ C2] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 73.134462][ C2] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 73.134634][ C2] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 73.134643][ C2] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 73.188203][ T42] usb 5-1: Using ep0 maxpacket: 8 [ 73.188762][ T42] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 73.191769][ T42] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 73.191782][ T42] usb 5-1: config 179 has no interface number 0 [ 73.191802][ T42] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 73.191815][ T42] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 73.191828][ T42] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 73.191840][ T42] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 18176, setting to 1024 [ 73.191852][ T42] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 73.191865][ T42] usb 5-1: config 179 interface 65 has no altsetting 0 [ 73.191885][ T42] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 73.193761][ T6533] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 73.206406][ T42] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:179.65/input/input7 [ 73.223746][ T9] usb 7-1: USB disconnect, device number 6 [ 73.223875][ C2] cdc_wdm 7-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 73.248443][ T5128] input input7: unable to receive magic message: -110 [ 73.250604][ T855] usb 6-1: Using ep0 maxpacket: 8 [ 73.251212][ T855] usb 6-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 73.252061][ T855] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 73.252074][ T855] usb 6-1: config 179 has no interface number 0 [ 73.252092][ T855] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 73.252105][ T855] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 73.252118][ T855] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 73.252130][ T855] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 18176, setting to 1024 [ 73.252143][ T855] usb 6-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 73.252155][ T855] usb 6-1: config 179 interface 65 has no altsetting 0 [ 73.252170][ T855] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 73.259935][ T5128] input input7: unable to receive magic message: -32 [ 73.265459][ T6535] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 73.271197][ T5128] input input7: unable to receive magic message: -32 [ 73.279607][ C1] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -1 [ 73.286966][ T5128] input input7: unable to receive magic message: -32 [ 73.296030][ T855] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:179.65/input/input8 [ 73.296449][ T5946] input input7: unable to receive magic message: -32 [ 73.338447][ T5128] input input8: unable to receive magic message: -110 [ 73.345616][ T5128] input input8: unable to receive magic message: -32 [ 73.347082][ T5128] input input7: unable to receive magic message: -32 [ 73.350267][ T5128] input input7: unable to receive magic message: -32 [ 73.351680][ T5128] input input8: unable to receive magic message: -32 [ 73.355054][ T5128] input input8: unable to receive magic message: -32 [ 73.359228][ T5128] input input8: unable to receive magic message: -32 [ 73.374695][ T5128] input input8: unable to receive magic message: -32 [ 73.375666][ T5128] input input8: unable to receive magic message: -32 [ 73.383152][ T5128] input input8: unable to receive magic message: -32 [ 73.397427][ T6533] FAULT_INJECTION: forcing a failure. [ 73.397427][ T6533] name failslab, interval 1, probability 0, space 0, times 0 [ 73.397456][ T6533] CPU: 2 UID: 0 PID: 6533 Comm: syz.0.163 Not tainted syzkaller #0 PREEMPT(full) [ 73.397475][ T6533] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 73.397484][ T6533] Call Trace: [ 73.397489][ T6533] [ 73.397495][ T6533] dump_stack_lvl+0x100/0x190 [ 73.397523][ T6533] should_fail_ex.cold+0x5/0xa [ 73.397545][ T6533] should_failslab+0xc2/0x120 [ 73.397567][ T6533] kmem_cache_alloc_noprof+0x92/0x6a0 [ 73.397588][ T6533] ? do_getname+0x35/0x390 [ 73.397615][ T6533] do_getname+0x35/0x390 [ 73.397640][ T6533] do_sys_openat2+0xc7/0x1e0 [ 73.397664][ T6533] ? __pfx_do_sys_openat2+0x10/0x10 [ 73.397688][ T6533] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 73.397716][ T6533] ? __fget_files+0x21f/0x3d0 [ 73.397739][ T6533] __ia32_compat_sys_openat+0x12d/0x210 [ 73.397764][ T6533] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 73.397787][ T6533] ? ksys_write+0x1ac/0x250 [ 73.397812][ T6533] do_int80_emulation+0x166/0x650 [ 73.397840][ T6533] asm_int80_emulation+0x1a/0x20 [ 73.397857][ T6533] RIP: 0023:0xf71d75ab [ 73.397870][ T6533] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 73.397884][ T6533] RSP: 002b:00000000f549603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 73.397901][ T6533] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f5496100 [ 73.397911][ T6533] RDX: 00000000000ac502 RSI: 0000000000000000 RDI: 0000000000000000 [ 73.397921][ T6533] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 73.397931][ T6533] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 73.397941][ T6533] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 73.397963][ T6533] [ 73.401022][ T5822] usb 5-1: USB disconnect, device number 5 [ 73.401287][ C1] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 73.471757][ T6535] input input8: unable to receive magic message: -32 [ 73.481539][ C0] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 73.481558][ T855] usb 6-1: USB disconnect, device number 8 [ 74.310670][ T6552] syzkaller0: entered promiscuous mode [ 74.310690][ T6552] syzkaller0: entered allmulticast mode [ 74.358484][ T6554] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 74.362230][ T6554] netlink: 32 bytes leftover after parsing attributes in process `syz.1.171'. [ 74.689071][ T6561] syzkaller0: entered promiscuous mode [ 74.689085][ T6561] syzkaller0: entered allmulticast mode [ 75.271647][ T6570] netlink: 16 bytes leftover after parsing attributes in process `syz.2.176'. [ 75.300858][ T6570] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 76.028227][ T50] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 76.325217][ T50] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 76.602619][ T50] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 76.602636][ T50] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 76.602645][ T50] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 76.602666][ T50] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 76.602679][ T50] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59237, setting to 1024 [ 76.604974][ T50] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 76.604988][ T50] usb 7-1: Product: syz [ 76.604995][ T50] usb 7-1: Manufacturer: syz [ 76.611762][ T6578] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 76.621952][ T50] cdc_wdm 7-1:1.0: skipping garbage [ 76.621964][ T50] cdc_wdm 7-1:1.0: skipping garbage [ 76.640913][ T50] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 76.640924][ T50] cdc_wdm 7-1:1.0: Unknown control protocol [ 76.946332][ T6598] FAULT_INJECTION: forcing a failure. [ 76.946332][ T6598] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 76.946352][ T6598] CPU: 3 UID: 0 PID: 6598 Comm: syz.3.186 Not tainted syzkaller #0 PREEMPT(full) [ 76.946365][ T6598] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.946371][ T6598] Call Trace: [ 76.946375][ T6598] [ 76.946379][ T6598] dump_stack_lvl+0x100/0x190 [ 76.946396][ T6598] should_fail_ex.cold+0x5/0xa [ 76.946410][ T6598] _copy_from_user+0x2e/0xd0 [ 76.946425][ T6598] get_compat_msghdr+0xb3/0x480 [ 76.946443][ T6598] ? __pfx_get_compat_msghdr+0x10/0x10 [ 76.946465][ T6598] ___sys_sendmsg+0x1b6/0x1e0 [ 76.946477][ T6598] ? __pfx____sys_sendmsg+0x10/0x10 [ 76.946494][ T6598] ? find_held_lock+0x2b/0x80 [ 76.946515][ T6598] __sys_sendmsg+0x160/0x210 [ 76.946529][ T6598] ? __pfx___sys_sendmsg+0x10/0x10 [ 76.946547][ T6598] ? __pfx_ksys_write+0x10/0x10 [ 76.946562][ T6598] __do_fast_syscall_32+0x13a/0x8b0 [ 76.946579][ T6598] ? lockdep_hardirqs_on+0x7d/0x110 [ 76.946595][ T6598] do_fast_syscall_32+0x32/0x70 [ 76.946612][ T6598] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 76.946626][ T6598] RIP: 0023:0xf709efec [ 76.946638][ T6598] Code: Unable to access opcode bytes at 0xf709efc2. [ 76.946643][ T6598] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 76.946654][ T6598] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000240 [ 76.946660][ T6598] RDX: 0000000000004000 RSI: 0000000000000000 RDI: 0000000000000000 [ 76.946666][ T6598] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 76.946672][ T6598] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 76.946678][ T6598] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 76.946691][ T6598] [ 76.950635][ T6597] netlink: 16 bytes leftover after parsing attributes in process `syz.1.185'. [ 76.966091][ T1042] usb 7-1: USB disconnect, device number 7 [ 76.966227][ C2] cdc_wdm 7-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 77.120498][ T43] audit: type=1326 audit(1790156836.842:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6610 comm="syz.2.191" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 77.121305][ T43] audit: type=1326 audit(1790156836.842:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6610 comm="syz.2.191" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 77.121523][ T43] audit: type=1326 audit(1790156836.842:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6610 comm="syz.2.191" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 77.122905][ T6611] FAULT_INJECTION: forcing a failure. [ 77.122905][ T6611] name failslab, interval 1, probability 0, space 0, times 0 [ 77.122933][ T6611] CPU: 1 UID: 0 PID: 6611 Comm: syz.2.191 Not tainted syzkaller #0 PREEMPT(full) [ 77.122953][ T6611] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.122962][ T6611] Call Trace: [ 77.122968][ T6611] [ 77.122975][ T6611] dump_stack_lvl+0x100/0x190 [ 77.123003][ T6611] should_fail_ex.cold+0x5/0xa [ 77.123026][ T6611] should_failslab+0xc2/0x120 [ 77.123050][ T6611] kmem_cache_alloc_noprof+0x92/0x6a0 [ 77.123071][ T6611] ? audit_log_start+0x29d/0x930 [ 77.123097][ T6611] audit_log_start+0x29d/0x930 [ 77.123119][ T6611] ? __pfx_audit_log_start+0x10/0x10 [ 77.123145][ T6611] ? rcu_read_lock_any_held+0x6a/0x90 [ 77.123166][ T6611] ? find_held_lock+0x2b/0x80 [ 77.123187][ T6611] audit_seccomp+0x60/0x190 [ 77.123210][ T6611] __seccomp_filter+0x88c/0x1130 [ 77.123232][ T6611] ? __pfx___seccomp_filter+0x10/0x10 [ 77.123262][ T6611] ? fput+0x7c/0x100 [ 77.123285][ T6611] ? ksys_write+0x1ac/0x250 [ 77.123307][ T6611] __seccomp_permit_syscall+0x207/0x2d0 [ 77.123330][ T6611] __do_fast_syscall_32+0x420/0x8b0 [ 77.123357][ T6611] ? lockdep_hardirqs_on+0x7d/0x110 [ 77.123385][ T6611] do_fast_syscall_32+0x32/0x70 [ 77.123430][ T6611] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 77.123453][ T6611] RIP: 0023:0xf706efec [ 77.123473][ T6611] Code: Unable to access opcode bytes at 0xf706efc2. [ 77.123481][ T6611] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 77.123499][ T6611] RAX: ffffffffffffffda RBX: 000000000000000e RCX: 000000000000ae80 [ 77.123510][ T6611] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 77.123521][ T6611] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 77.123531][ T6611] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 77.123542][ T6611] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 77.123566][ T6611] [ 77.123603][ T6611] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 77.123617][ T6611] audit: out of memory in audit_log_start [ 77.124317][ T43] audit: type=1326 audit(1790156836.842:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6610 comm="syz.2.191" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf706efec code=0x7ffc0000 [ 77.124363][ T43] audit: type=1326 audit(1790156836.842:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6610 comm="syz.2.191" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 77.124397][ T43] audit: type=1326 audit(1790156836.842:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6610 comm="syz.2.191" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71a75ab code=0x7ffc0000 [ 77.124434][ T43] audit: type=1326 audit(1790156836.842:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6610 comm="syz.2.191" exe="/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf71a75ab code=0x7ffc0000 [ 77.191115][ T50] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 77.194458][ T6602] infiniband syz1: set active [ 77.195268][ T6602] infiniband syz1: added syz_tun [ 77.206345][ T6602] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 77.206367][ T6602] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 77.206395][ T6602] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 77.221215][ T6618] 9p: Bad value for 'rfdno' [ 77.261963][ T6602] RDS/IB: syz1: added [ 77.263226][ T6602] smc: adding ib device syz1 with port count 1 [ 77.263319][ T6602] smc: ib device syz1 port 1 has no pnetid [ 77.297705][ T43] audit: type=1326 audit(1790156837.012:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6610 comm="syz.2.191" exe="/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf71a75ab code=0x7ffc0000 [ 77.352997][ T50] usb 8-1: Using ep0 maxpacket: 8 [ 77.353515][ T50] usb 8-1: New USB device found, idVendor=04e7, idProduct=0009, bcdDevice= 0.00 [ 77.408336][ T30] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 77.550940][ T50] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 77.550988][ T50] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.558181][ T30] usb 6-1: Using ep0 maxpacket: 8 [ 77.568398][ T30] usb 6-1: New USB device found, idVendor=04e7, idProduct=0009, bcdDevice= 0.00 [ 77.569260][ T30] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 77.569284][ T30] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.573425][ T30] usb 6-1: config 0 descriptor?? [ 77.575937][ T30] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 77.666104][ T6626] FAULT_INJECTION: forcing a failure. [ 77.666104][ T6626] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 77.666136][ T6626] CPU: 0 UID: 0 PID: 6626 Comm: syz.2.194 Not tainted syzkaller #0 PREEMPT(full) [ 77.666157][ T6626] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.666169][ T6626] Call Trace: [ 77.666175][ T6626] [ 77.666182][ T6626] dump_stack_lvl+0x100/0x190 [ 77.666212][ T6626] should_fail_ex.cold+0x5/0xa [ 77.666237][ T6626] _copy_from_user+0x2e/0xd0 [ 77.666261][ T6626] get_compat_msghdr+0xb3/0x480 [ 77.666291][ T6626] ? __pfx_get_compat_msghdr+0x10/0x10 [ 77.666328][ T6626] ___sys_sendmsg+0x1b6/0x1e0 [ 77.666348][ T6626] ? __pfx____sys_sendmsg+0x10/0x10 [ 77.666378][ T6626] ? find_held_lock+0x2b/0x80 [ 77.666413][ T6626] __sys_sendmsg+0x160/0x210 [ 77.666453][ T6626] ? __pfx___sys_sendmsg+0x10/0x10 [ 77.666484][ T6626] ? __pfx_ksys_write+0x10/0x10 [ 77.666507][ T6626] __do_fast_syscall_32+0x13a/0x8b0 [ 77.666533][ T6626] ? lockdep_hardirqs_on+0x7d/0x110 [ 77.666558][ T6626] do_fast_syscall_32+0x32/0x70 [ 77.666584][ T6626] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 77.666606][ T6626] RIP: 0023:0xf706efec [ 77.666623][ T6626] Code: Unable to access opcode bytes at 0xf706efc2. [ 77.666630][ T6626] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 77.666647][ T6626] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 77.666659][ T6626] RDX: 000000000000c044 RSI: 0000000000000000 RDI: 0000000000000000 [ 77.666671][ T6626] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 77.666682][ T6626] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 77.666692][ T6626] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 77.666717][ T6626] [ 78.316274][ T50] usb 8-1: config 0 descriptor?? [ 78.868975][ T50] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 78.948798][ T50] usb 8-1: USB disconnect, device number 6 [ 79.040273][ T9] usb 6-1: USB disconnect, device number 9 [ 79.455951][ T6638] FAULT_INJECTION: forcing a failure. [ 79.455951][ T6638] name failslab, interval 1, probability 0, space 0, times 0 [ 79.456060][ T6638] CPU: 1 UID: 0 PID: 6638 Comm: syz.3.198 Not tainted syzkaller #0 PREEMPT(full) [ 79.456085][ T6638] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 79.456093][ T6638] Call Trace: [ 79.456097][ T6638] [ 79.456102][ T6638] dump_stack_lvl+0x100/0x190 [ 79.456121][ T6638] should_fail_ex.cold+0x5/0xa [ 79.456135][ T6638] should_failslab+0xc2/0x120 [ 79.456151][ T6638] __kvmalloc_node_noprof+0x113/0x9b0 [ 79.456165][ T6638] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 79.456183][ T6638] ? alloc_netdev_mqs+0xf5f/0x15c0 [ 79.456200][ T6638] alloc_netdev_mqs+0xf5f/0x15c0 [ 79.456218][ T6638] ipip6_tunnel_locate+0x47d/0x880 [ 79.456236][ T6638] ? __pfx_ipip6_tunnel_locate+0x10/0x10 [ 79.456252][ T6638] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 79.456269][ T6638] ipip6_tunnel_ctl+0x44c/0x780 [ 79.456285][ T6638] ip_tunnel_siocdevprivate+0x114/0x1b0 [ 79.456302][ T6638] ? __pfx_ip_tunnel_siocdevprivate+0x10/0x10 [ 79.456324][ T6638] ipip6_tunnel_siocdevprivate+0x364/0x16a0 [ 79.456341][ T6638] ? __pfx_ipip6_tunnel_siocdevprivate+0x10/0x10 [ 79.456356][ T6638] ? __ia32_compat_sys_ioctl+0xc2/0x360 [ 79.456378][ T6638] ? __do_fast_syscall_32+0x13a/0x8b0 [ 79.456399][ T6638] ? lock_acquire+0x1d1/0x380 [ 79.456414][ T6638] ? dev_ioctl+0x6fd/0x1070 [ 79.456431][ T6638] ? rcu_is_watching+0x13/0xc0 [ 79.456442][ T6638] ? full_name_hash+0xbc/0x100 [ 79.456459][ T6638] ? dev_ifsioc+0xc2f/0x1f10 [ 79.456473][ T6638] dev_ifsioc+0xc2f/0x1f10 [ 79.456489][ T6638] ? __pfx_dev_ifsioc+0x10/0x10 [ 79.456503][ T6638] ? __pfx___mutex_lock+0x10/0x10 [ 79.456522][ T6638] ? lock_acquire+0x1d1/0x380 [ 79.456537][ T6638] ? dev_load+0x8e/0x240 [ 79.456550][ T6638] ? dev_load+0x8e/0x240 [ 79.456566][ T6638] dev_ioctl+0x70e/0x1070 [ 79.456581][ T6638] sock_ioctl+0x494/0x6b0 [ 79.456607][ T6638] ? __pfx_sock_ioctl+0x10/0x10 [ 79.456622][ T6638] ? do_vfs_ioctl+0x226/0x13e0 [ 79.456639][ T6638] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 79.456658][ T6638] compat_sock_ioctl+0x400/0x760 [ 79.456691][ T6638] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 79.456704][ T6638] ? hook_file_ioctl_common+0x140/0x440 [ 79.456725][ T6638] ? __fget_files+0x21f/0x3d0 [ 79.456740][ T6638] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 79.456753][ T6638] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 79.456774][ T6638] __do_fast_syscall_32+0x13a/0x8b0 [ 79.456792][ T6638] do_fast_syscall_32+0x32/0x70 [ 79.456809][ T6638] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 79.456824][ T6638] RIP: 0023:0xf709efec [ 79.456837][ T6638] Code: Unable to access opcode bytes at 0xf709efc2. [ 79.456842][ T6638] RSP: 002b:00000000f546c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 79.456853][ T6638] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000000089f1 [ 79.456860][ T6638] RDX: 0000000080000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 79.456867][ T6638] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 79.456873][ T6638] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 79.456880][ T6638] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 79.456895][ T6638] [ 79.498195][ T855] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 80.178053][ T855] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 80.279259][ T855] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 80.279276][ T855] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 80.279285][ T855] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 80.279305][ T855] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 80.279318][ T855] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59237, setting to 1024 [ 80.281432][ T855] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 80.281452][ T855] usb 7-1: Product: syz [ 80.281463][ T855] usb 7-1: Manufacturer: syz [ 80.285928][ T6635] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 80.287115][ T855] cdc_wdm 7-1:1.0: skipping garbage [ 80.287129][ T855] cdc_wdm 7-1:1.0: skipping garbage [ 80.292425][ T855] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 80.292441][ T855] cdc_wdm 7-1:1.0: Unknown control protocol [ 80.506738][ C0] wdm_int_callback: 1207 callbacks suppressed [ 80.506763][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 80.506778][ C0] wdm_int_callback: 1207 callbacks suppressed [ 80.506791][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 80.507013][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 80.507028][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 80.507249][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 80.507265][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 80.507480][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 80.507493][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 80.507711][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 80.507728][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 80.507945][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 80.507959][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 80.508184][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 80.508218][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 80.508421][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 80.508436][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 80.508658][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 80.508697][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 80.508903][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 80.508917][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 80.568231][ T42] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 80.619228][ T50] usb 7-1: USB disconnect, device number 8 [ 80.619229][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 80.645810][ T6654] jffs2: notice: (6654) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 80.719474][ T42] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 80.720372][ T42] usb 8-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 80.720385][ T42] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 80.720394][ T42] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 80.720414][ T42] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 80.721864][ T42] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 80.721876][ T42] usb 8-1: Product: syz [ 80.721883][ T42] usb 8-1: Manufacturer: syz [ 80.730407][ T42] cdc_wdm 8-1:1.0: skipping garbage [ 80.730419][ T42] cdc_wdm 8-1:1.0: skipping garbage [ 80.733492][ T42] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 80.733503][ T42] cdc_wdm 8-1:1.0: Unknown control protocol [ 80.851694][ T855] libceph: connect (1)[c::]:6789 error -101 [ 80.851779][ T855] libceph: mon0 (1)[c::]:6789 connect error [ 80.851990][ T855] libceph: connect (1)[c::]:6789 error -101 [ 80.852049][ T855] libceph: mon0 (1)[c::]:6789 connect error [ 80.896394][ T6664] ceph: No mds server is up or the cluster is laggy [ 81.109265][ T30] usb 8-1: USB disconnect, device number 7 [ 81.337231][ T6677] FAULT_INJECTION: forcing a failure. [ 81.337231][ T6677] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 81.337304][ T6677] CPU: 0 UID: 0 PID: 6677 Comm: syz.0.208 Not tainted syzkaller #0 PREEMPT(full) [ 81.337325][ T6677] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 81.337335][ T6677] Call Trace: [ 81.337341][ T6677] [ 81.337348][ T6677] dump_stack_lvl+0x100/0x190 [ 81.337377][ T6677] should_fail_ex.cold+0x5/0xa [ 81.337400][ T6677] _copy_from_user+0x2e/0xd0 [ 81.337423][ T6677] get_compat_msghdr+0xb3/0x480 [ 81.337452][ T6677] ? __pfx_get_compat_msghdr+0x10/0x10 [ 81.337489][ T6677] ___sys_sendmsg+0x1b6/0x1e0 [ 81.337510][ T6677] ? __pfx____sys_sendmsg+0x10/0x10 [ 81.337541][ T6677] ? find_held_lock+0x2b/0x80 [ 81.337575][ T6677] __sys_sendmsg+0x160/0x210 [ 81.337600][ T6677] ? __pfx___sys_sendmsg+0x10/0x10 [ 81.337629][ T6677] ? __pfx_ksys_write+0x10/0x10 [ 81.337654][ T6677] __do_fast_syscall_32+0x13a/0x8b0 [ 81.337681][ T6677] ? lockdep_hardirqs_on+0x7d/0x110 [ 81.337705][ T6677] do_fast_syscall_32+0x32/0x70 [ 81.337731][ T6677] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 81.337753][ T6677] RIP: 0023:0xf7fd7fec [ 81.337772][ T6677] Code: Unable to access opcode bytes at 0xf7fd7fc2. [ 81.337780][ T6677] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 81.337798][ T6677] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000080 [ 81.337809][ T6677] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 81.337820][ T6677] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 81.337837][ T6677] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 81.337847][ T6677] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 81.337870][ T6677] [ 81.518741][ T6683] futex_wake_op: syz.3.211 tries to shift op by 144; fix this program [ 81.661108][ T50] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 81.878159][ T50] usb 7-1: Using ep0 maxpacket: 16 [ 81.880929][ T50] usb 7-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 81.900104][ T50] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.900119][ T50] usb 7-1: Product: syz [ 81.900127][ T50] usb 7-1: Manufacturer: syz [ 81.900134][ T50] usb 7-1: SerialNumber: syz [ 81.956990][ T50] usb 7-1: config 0 descriptor?? [ 81.990004][ T6683] xt_MASQUERADE: bad rangesize 29 [ 82.368858][ T50] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 82.392650][ T50] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 82.393153][ T50] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 82.393178][ T50] usb 7-1: media controller created [ 82.430555][ T50] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 82.661495][ T9] libceph: connect (1)[c::]:6789 error -101 [ 82.661581][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 82.708902][ T6693] ceph: No mds server is up or the cluster is laggy [ 83.889744][ T50] zl10353_read_register: readreg error (reg=127, ret==0) [ 83.890078][ T50] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 83.890086][ T50] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 83.927917][ T6657] dtv5100: wlen = 0, aborting. [ 84.232984][ T50] usb 7-1: USB disconnect, device number 9 [ 84.347309][ T50] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 84.361802][ T6722] netlink: 16 bytes leftover after parsing attributes in process `syz.2.221'. [ 84.370398][ T6720] FAULT_INJECTION: forcing a failure. [ 84.370398][ T6720] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 84.370430][ T6720] CPU: 1 UID: 0 PID: 6720 Comm: syz.0.218 Not tainted syzkaller #0 PREEMPT(full) [ 84.370451][ T6720] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 84.370461][ T6720] Call Trace: [ 84.370470][ T6720] [ 84.370478][ T6720] dump_stack_lvl+0x100/0x190 [ 84.370504][ T6720] should_fail_ex.cold+0x5/0xa [ 84.370524][ T6720] ? prepare_alloc_pages+0x16d/0x5b0 [ 84.370551][ T6720] should_fail_alloc_page+0xeb/0x140 [ 84.370576][ T6720] prepare_alloc_pages+0x1f0/0x5b0 [ 84.370600][ T6720] ? find_held_lock+0x2b/0x80 [ 84.370623][ T6720] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 84.370645][ T6720] ? is_bpf_text_address+0x94/0x1a0 [ 84.370673][ T6720] ? kernel_text_address+0x8d/0x100 [ 84.370695][ T6720] ? __kernel_text_address+0xd/0x30 [ 84.370732][ T6720] ? unwind_get_return_address+0x59/0xa0 [ 84.370814][ T6720] ? __lock_acquire+0x5c0/0x1f40 [ 84.370845][ T6720] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 84.370871][ T6720] ? look_up_lock_class+0x55/0x120 [ 84.370900][ T6720] ? register_lock_class+0x3f/0x7b0 [ 84.370929][ T6720] ? find_held_lock+0x2b/0x80 [ 84.370950][ T6720] ? ima_match_policy+0x8c4/0x23f0 [ 84.370988][ T6720] ? __lock_acquire+0x5c0/0x1f40 [ 84.371016][ T6720] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 84.371043][ T6720] ? policy_nodemask+0xed/0x4f0 [ 84.371070][ T6720] alloc_pages_mpol+0x201/0x550 [ 84.371098][ T6720] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 84.371130][ T6720] folio_alloc_mpol_noprof+0x36/0x260 [ 84.371158][ T6720] shmem_alloc_folio+0x135/0x160 [ 84.371182][ T6720] shmem_alloc_and_add_folio+0x371/0xd40 [ 84.371216][ T6720] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 84.371244][ T6720] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 84.371276][ T6720] shmem_get_folio_gfp+0x75b/0x1980 [ 84.371322][ T6720] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 84.371354][ T6720] ? filemap_map_pages+0x114a/0x2100 [ 84.371384][ T6720] shmem_fault+0x1fb/0xa30 [ 84.371413][ T6720] ? __pfx_shmem_fault+0x10/0x10 [ 84.371466][ T6720] ? __pfx_filemap_map_pages+0x10/0x10 [ 84.371499][ T6720] ? find_held_lock+0x2b/0x80 [ 84.371522][ T6720] ? __pfx_filemap_map_pages+0x10/0x10 [ 84.371546][ T6720] __do_fault+0x10b/0x440 [ 84.371569][ T6720] do_fault+0xb3f/0x1830 [ 84.371595][ T6720] ? __pfx_do_fault+0x10/0x10 [ 84.371616][ T6720] ? rcu_read_unlock+0x2d/0xb0 [ 84.371643][ T6720] ? rcu_read_unlock+0x2d/0xb0 [ 84.371671][ T6720] ? __pte_offset_map+0x179/0x310 [ 84.371697][ T6720] __handle_mm_fault+0x150b/0x2f60 [ 84.371730][ T6720] ? __pfx___handle_mm_fault+0x10/0x10 [ 84.371765][ T6720] ? __pfx_mt_find+0x10/0x10 [ 84.371797][ T6720] ? find_vma+0xbf/0x140 [ 84.371819][ T6720] ? __pfx_find_vma+0x10/0x10 [ 84.371843][ T6720] handle_mm_fault+0x363/0xa20 [ 84.371878][ T6720] do_user_addr_fault+0x745/0x12f0 [ 84.371908][ T6720] exc_page_fault+0x6f/0xd0 [ 84.371935][ T6720] asm_exc_page_fault+0x26/0x30 [ 84.371955][ T6720] RIP: 0010:__get_user_4+0x14/0x30 [ 84.371978][ T6720] Code: 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 f0 ff ff ff 7f 00 00 48 39 d0 48 0f 47 c2 0f 01 cb <8b> 10 31 c0 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 84.371997][ T6720] RSP: 0018:ffffc9000c637eb8 EFLAGS: 00050283 [ 84.372013][ T6720] RAX: 0000000080001440 RBX: ffffc9000c637f48 RCX: ffffc9000cab1000 [ 84.372026][ T6720] RDX: 00007ffffffff000 RSI: ffffffff825fb441 RDI: ffffffff8c622c80 [ 84.372039][ T6720] RBP: 0000000080001440 R08: 0000000000010e42 R09: 00000000000001d4 [ 84.372050][ T6720] R10: 0000000000000200 R11: 0000000000000000 R12: ffff888021908000 [ 84.372061][ T6720] R13: 000000000000007f R14: 0000000000000000 R15: 0000000000000000 [ 84.372080][ T6720] ? __might_fault+0x111/0x140 [ 84.372112][ T6720] __ia32_compat_sys_io_setup+0x72/0x220 [ 84.372142][ T6720] __do_fast_syscall_32+0x13a/0x8b0 [ 84.372169][ T6720] ? lockdep_hardirqs_on+0x7d/0x110 [ 84.372197][ T6720] do_fast_syscall_32+0x32/0x70 [ 84.372224][ T6720] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 84.372245][ T6720] RIP: 0023:0xf7fd7fec [ 84.372265][ T6720] Code: Unable to access opcode bytes at 0xf7fd7fc2. [ 84.372272][ T6720] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 00000000000000f5 [ 84.372292][ T6720] RAX: ffffffffffffffda RBX: 000000000000007f RCX: 0000000080001440 [ 84.372304][ T6720] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 84.372316][ T6720] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 84.372328][ T6720] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 84.372340][ T6720] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 84.372366][ T6720] [ 84.445741][ T6717] bridge0: port 1(syz_tun) entered blocking state [ 84.445884][ T6717] bridge0: port 1(syz_tun) entered disabled state [ 84.446027][ T6717] syz_tun: entered allmulticast mode [ 84.447687][ T6717] syz_tun: entered promiscuous mode [ 84.452733][ T6717] bridge0: port 1(syz_tun) entered blocking state [ 84.452820][ T6717] bridge0: port 1(syz_tun) entered forwarding state [ 84.495838][ T6717] netlink: 'syz.1.220': attribute type 9 has an invalid length. [ 84.574717][ T238] Bluetooth: hci4: Frame reassembly failed (-84) [ 84.988223][ T64] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 85.149695][ T64] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 85.153083][ T64] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 85.153100][ T64] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 85.153109][ T64] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 85.153184][ T64] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 85.158051][ T64] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 85.158065][ T64] usb 7-1: Product: syz [ 85.158072][ T64] usb 7-1: Manufacturer: syz [ 85.175265][ T64] cdc_wdm 7-1:1.0: skipping garbage [ 85.175276][ T64] cdc_wdm 7-1:1.0: skipping garbage [ 85.177740][ T64] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 85.177751][ T64] cdc_wdm 7-1:1.0: Unknown control protocol [ 85.550627][ T35] usb 7-1: USB disconnect, device number 10 [ 86.438307][ T9] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 86.609476][ T9] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 86.611279][ T9] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 86.611302][ T9] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 86.611317][ T9] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 86.611352][ T9] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 86.611381][ T9] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59237, setting to 1024 [ 86.614553][ T9] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 86.614575][ T9] usb 7-1: Product: syz [ 86.614588][ T9] usb 7-1: Manufacturer: syz [ 86.618077][ T6774] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 86.620277][ T9] cdc_wdm 7-1:1.0: skipping garbage [ 86.620291][ T9] cdc_wdm 7-1:1.0: skipping garbage [ 86.621767][ T9] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 86.621781][ T9] cdc_wdm 7-1:1.0: Unknown control protocol [ 86.632202][ T5733] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 86.667852][ T43] kauditd_printk_skb: 4 callbacks suppressed [ 86.667870][ T43] audit: type=1326 audit(1790156846.382:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6775 comm="syz.1.235" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 86.674288][ T43] audit: type=1326 audit(1790156846.392:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6775 comm="syz.1.235" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 86.677390][ T43] audit: type=1326 audit(1790156846.392:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6775 comm="syz.1.235" exe="/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 86.677431][ T43] audit: type=1326 audit(1790156846.392:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6775 comm="syz.1.235" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 86.677466][ T43] audit: type=1326 audit(1790156846.392:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6775 comm="syz.1.235" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 86.677791][ T43] audit: type=1326 audit(1790156846.392:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6775 comm="syz.1.235" exe="/syz-executor" sig=0 arch=40000003 syscall=296 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 86.678019][ T43] audit: type=1326 audit(1790156846.392:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6775 comm="syz.1.235" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 86.679328][ T43] audit: type=1326 audit(1790156846.392:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6775 comm="syz.1.235" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 86.679895][ T43] audit: type=1326 audit(1790156846.402:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6775 comm="syz.1.235" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 86.680718][ T43] audit: type=1326 audit(1790156846.402:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6775 comm="syz.1.235" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 86.699289][ T6776] netlink: 12 bytes leftover after parsing attributes in process `syz.1.235'. [ 86.822784][ C0] wdm_int_callback: 546 callbacks suppressed [ 86.822801][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 86.822810][ C0] wdm_int_callback: 546 callbacks suppressed [ 86.822816][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 86.822993][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 86.823003][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 86.823180][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 86.823189][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 86.823365][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 86.823374][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 86.823563][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 86.823572][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 86.823746][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 86.823755][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 86.823947][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 86.823956][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 86.824169][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 86.824178][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 86.824363][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 86.824376][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 86.824553][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 86.824562][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 86.929693][ T9] usb 7-1: USB disconnect, device number 11 [ 87.124373][ T65] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.124393][ T65] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.189263][ T6800] netlink: 4 bytes leftover after parsing attributes in process `syz.2.242'. [ 87.273079][ T6794] netlink: 'syz.3.240': attribute type 9 has an invalid length. [ 88.369274][ T208] Bluetooth: hci4: Frame reassembly failed (-84) [ 88.712703][ T35] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 88.879745][ T35] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 88.884185][ T35] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 88.884304][ T35] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 88.884414][ T35] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 88.885134][ T35] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.913324][ T35] usb 6-1: config 0 descriptor?? [ 89.492593][ T35] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 89.727073][ T9] usb 6-1: USB disconnect, device number 10 [ 90.379140][ T5733] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 90.927074][ T6826] futex_wake_op: syz.1.248 tries to shift op by 144; fix this program [ 90.927319][ T6826] futex_wake_op: syz.1.248 tries to shift op by 144; fix this program [ 91.648901][ T6846] netlink: 16 bytes leftover after parsing attributes in process `syz.2.255'. [ 92.034552][ T6852] netdevsim netdevsim0: Direct firmware load for .® failed with error -2 [ 92.034564][ T6852] netdevsim netdevsim0: Falling back to sysfs fallback for: .® [ 92.151903][ T6861] FAULT_INJECTION: forcing a failure. [ 92.151903][ T6861] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 92.151989][ T6861] CPU: 0 UID: 0 PID: 6861 Comm: syz.1.256 Not tainted syzkaller #0 PREEMPT(full) [ 92.152025][ T6861] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.152033][ T6861] Call Trace: [ 92.152038][ T6861] [ 92.152042][ T6861] dump_stack_lvl+0x100/0x190 [ 92.152061][ T6861] should_fail_ex.cold+0x5/0xa [ 92.152076][ T6861] _copy_from_user+0x2e/0xd0 [ 92.152090][ T6861] get_compat_msghdr+0xb3/0x480 [ 92.152109][ T6861] ? __pfx_get_compat_msghdr+0x10/0x10 [ 92.152128][ T6861] ? __pfx___css_rstat_updated+0x10/0x10 [ 92.152144][ T6861] ? pick_eevdf+0x1ad/0x880 [ 92.152159][ T6861] ___sys_sendmsg+0x1b6/0x1e0 [ 92.152171][ T6861] ? __pfx____sys_sendmsg+0x10/0x10 [ 92.152193][ T6861] ? __fget_files+0x34/0x3d0 [ 92.152214][ T6861] __sys_sendmmsg+0x309/0x440 [ 92.152231][ T6861] ? __pfx___sys_sendmmsg+0x10/0x10 [ 92.152246][ T6861] ? __schedule+0x315b/0x6920 [ 92.152273][ T6861] ? __pfx___schedule+0x10/0x10 [ 92.152290][ T6861] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 92.152301][ T6861] ? lockdep_hardirqs_on+0x7d/0x110 [ 92.152317][ T6861] __do_fast_syscall_32+0x13a/0x8b0 [ 92.152336][ T6861] do_fast_syscall_32+0x32/0x70 [ 92.152353][ T6861] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 92.152367][ T6861] RIP: 0023:0xf6feefec [ 92.152382][ T6861] Code: Unable to access opcode bytes at 0xf6feefc2. [ 92.152387][ T6861] RSP: 002b:00000000f539b50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 92.152399][ T6861] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000480 [ 92.152406][ T6861] RDX: 00000000000002e9 RSI: 0000000000000000 RDI: 0000000000000000 [ 92.152412][ T6861] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 92.152419][ T6861] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.152425][ T6861] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 92.152438][ T6861] [ 92.687188][ T6873] process 'syz.3.263' launched '/dev/fd/10' with NULL argv: empty string added [ 93.138235][ T6877] 9pnet_virtio: no channels available for device syz [ 93.157188][ T5141] libceph: connect (1)[c::]:6789 error -101 [ 93.157285][ T5141] libceph: mon0 (1)[c::]:6789 connect error [ 93.157660][ T5141] libceph: connect (1)[c::]:6789 error -101 [ 93.157739][ T5141] libceph: mon0 (1)[c::]:6789 connect error [ 93.206982][ T6877] ceph: No mds server is up or the cluster is laggy [ 93.898144][ C3] net_ratelimit: 74 callbacks suppressed [ 95.738330][ T64] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 95.900737][ T64] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 95.904101][ T64] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 95.904363][ T64] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 95.904511][ T64] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 95.904978][ T64] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 95.931274][ T64] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 95.931448][ T64] usb 7-1: Product: syz [ 95.931481][ T64] usb 7-1: Manufacturer: syz [ 95.974118][ T64] cdc_wdm 7-1:1.0: skipping garbage [ 95.974544][ T64] cdc_wdm 7-1:1.0: skipping garbage [ 95.990382][ T64] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 95.990393][ T64] cdc_wdm 7-1:1.0: Unknown control protocol [ 97.514581][ T50] usb 7-1: USB disconnect, device number 12 [ 98.506582][ T6956] netlink: 12 bytes leftover after parsing attributes in process `syz.1.287'. [ 98.517939][ T6956] Bluetooth: MGMT ver 1.23 [ 98.818170][ T58] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 98.968255][ T58] usb 6-1: Using ep0 maxpacket: 32 [ 98.970058][ T58] usb 6-1: unable to get BOS descriptor or descriptor too short [ 98.970084][ T58] usb 6-1: New USB device found, idVendor=133e, idProduct=0815, bcdDevice= 0.40 [ 98.970891][ T58] usb 6-1: config 1 interface 2 has no altsetting 1 [ 98.972849][ T58] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.972859][ T58] usb 6-1: Product: syz [ 98.972866][ T58] usb 6-1: Manufacturer: syz [ 98.972873][ T58] usb 6-1: SerialNumber: syz [ 98.978735][ T5822] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 99.018204][ C1] net_ratelimit: 65 callbacks suppressed [ 99.133338][ T5822] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 99.134649][ T5822] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 99.134665][ T5822] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 99.134674][ T5822] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 99.134704][ T5822] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 99.137900][ T5822] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 99.137910][ T5822] usb 5-1: Product: syz [ 99.137917][ T5822] usb 5-1: Manufacturer: syz [ 99.146832][ T5822] cdc_wdm 5-1:1.0: skipping garbage [ 99.146838][ T5822] cdc_wdm 5-1:1.0: skipping garbage [ 99.152228][ T5822] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 99.152241][ T5822] cdc_wdm 5-1:1.0: Unknown control protocol [ 99.216094][ T58] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 99.270838][ T58] usb 6-1: USB disconnect, device number 11 [ 99.462249][ T58] usb 5-1: USB disconnect, device number 6 [ 100.011329][ T6989] FAULT_INJECTION: forcing a failure. [ 100.011329][ T6989] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 100.011361][ T6989] CPU: 3 UID: 0 PID: 6989 Comm: syz.3.299 Not tainted syzkaller #0 PREEMPT(full) [ 100.011383][ T6989] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 100.011395][ T6989] Call Trace: [ 100.011418][ T6989] [ 100.011427][ T6989] dump_stack_lvl+0x100/0x190 [ 100.011457][ T6989] should_fail_ex.cold+0x5/0xa [ 100.011480][ T6989] ? prepare_alloc_pages+0x16d/0x5b0 [ 100.011509][ T6989] should_fail_alloc_page+0xeb/0x140 [ 100.011539][ T6989] prepare_alloc_pages+0x1f0/0x5b0 [ 100.011571][ T6989] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 100.011602][ T6989] ? lock_acquire+0x1d1/0x380 [ 100.011628][ T6989] ? find_held_lock+0x2b/0x80 [ 100.011647][ T6989] ? rcu_preempt_deferred_qs_irqrestore+0x4fd/0xb90 [ 100.011674][ T6989] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 100.011697][ T6989] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 100.011723][ T6989] ? lockdep_hardirqs_on+0x7d/0x110 [ 100.011751][ T6989] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 100.011777][ T6989] ? look_up_lock_class+0x55/0x120 [ 100.011803][ T6989] ? rcu_preempt_deferred_qs_irqrestore+0x4fd/0xb90 [ 100.011832][ T6989] ? register_lock_class+0x3f/0x7b0 [ 100.011858][ T6989] ? __rcu_read_unlock+0x26a/0x5e0 [ 100.011885][ T6989] ? rcu_is_watching+0x13/0xc0 [ 100.011918][ T6989] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 100.011949][ T6989] ? policy_nodemask+0xed/0x4f0 [ 100.011976][ T6989] alloc_pages_mpol+0x201/0x550 [ 100.012003][ T6989] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 100.012036][ T6989] folio_alloc_mpol_noprof+0x36/0x260 [ 100.012067][ T6989] shmem_alloc_folio+0x135/0x160 [ 100.012094][ T6989] shmem_alloc_and_add_folio+0x371/0xd40 [ 100.012145][ T6989] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 100.012179][ T6989] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 100.012216][ T6989] shmem_get_folio_gfp+0x75b/0x1980 [ 100.012374][ T6989] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 100.012410][ T6989] ? filemap_map_pages+0x114a/0x2100 [ 100.012442][ T6989] shmem_fault+0x1fb/0xa30 [ 100.012473][ T6989] ? __pfx_shmem_fault+0x10/0x10 [ 100.012506][ T6989] ? __pfx_filemap_map_pages+0x10/0x10 [ 100.012535][ T6989] ? find_held_lock+0x2b/0x80 [ 100.012559][ T6989] ? __pfx_filemap_map_pages+0x10/0x10 [ 100.012608][ T6989] __do_fault+0x10b/0x440 [ 100.012634][ T6989] do_fault+0xb3f/0x1830 [ 100.012662][ T6989] ? __pfx_do_fault+0x10/0x10 [ 100.012684][ T6989] ? rcu_read_unlock+0x2d/0xb0 [ 100.012710][ T6989] ? rcu_read_unlock+0x2d/0xb0 [ 100.012735][ T6989] ? __pte_offset_map+0x179/0x310 [ 100.012762][ T6989] __handle_mm_fault+0x150b/0x2f60 [ 100.012793][ T6989] ? __pfx___handle_mm_fault+0x10/0x10 [ 100.012819][ T6989] ? __pfx_mt_find+0x10/0x10 [ 100.012851][ T6989] ? find_vma+0xbf/0x140 [ 100.012873][ T6989] ? __pfx_find_vma+0x10/0x10 [ 100.012900][ T6989] handle_mm_fault+0x363/0xa20 [ 100.012930][ T6989] do_user_addr_fault+0x745/0x12f0 [ 100.012960][ T6989] exc_page_fault+0x6f/0xd0 [ 100.012986][ T6989] asm_exc_page_fault+0x26/0x30 [ 100.013007][ T6989] RIP: 0010:__get_user_4+0x14/0x30 [ 100.013033][ T6989] Code: 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 f0 ff ff ff 7f 00 00 48 39 d0 48 0f 47 c2 0f 01 cb <8b> 10 31 c0 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 100.013051][ T6989] RSP: 0018:ffffc90007bd7eb8 EFLAGS: 00050283 [ 100.013069][ T6989] RAX: 0000000080001440 RBX: ffffc90007bd7f48 RCX: ffffc90024fa9000 [ 100.013083][ T6989] RDX: 00007ffffffff000 RSI: ffffffff825fb441 RDI: ffffffff8c622c80 [ 100.013097][ T6989] RBP: 0000000080001440 R08: 0000000000010e42 R09: 00000000000001d4 [ 100.013109][ T6989] R10: 0000000000000200 R11: 0000000000000000 R12: ffff888029a2cb00 [ 100.013121][ T6989] R13: 000000000000007f R14: 0000000000000000 R15: 0000000000000000 [ 100.013140][ T6989] ? __might_fault+0x111/0x140 [ 100.013171][ T6989] __ia32_compat_sys_io_setup+0x72/0x220 [ 100.013201][ T6989] __do_fast_syscall_32+0x13a/0x8b0 [ 100.013231][ T6989] ? lockdep_hardirqs_on+0x7d/0x110 [ 100.013260][ T6989] do_fast_syscall_32+0x32/0x70 [ 100.013299][ T6989] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 100.013325][ T6989] RIP: 0023:0xf709efec [ 100.013346][ T6989] Code: Unable to access opcode bytes at 0xf709efc2. [ 100.013355][ T6989] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 00000000000000f5 [ 100.013374][ T6989] RAX: ffffffffffffffda RBX: 000000000000007f RCX: 0000000080001440 [ 100.013388][ T6989] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 100.013403][ T6989] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 100.013417][ T6989] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 100.013431][ T6989] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 100.013456][ T6989] [ 100.160079][ T50] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 100.468231][ T50] usb 5-1: Using ep0 maxpacket: 32 [ 100.478586][ T50] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 100.593829][ T50] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 100.593862][ T50] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 100.593875][ T50] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 100.593889][ T50] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 100.662754][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.662764][ T50] usb 5-1: Product: syz [ 100.695190][ T50] usb 5-1: Manufacturer: syz [ 100.695207][ T50] usb 5-1: SerialNumber: syz [ 100.990078][ C3] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 100.991938][ T50] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:155.0/input/input9 [ 101.110806][ T1042] libceph: connect (1)[c::]:6789 error -101 [ 101.110953][ T1042] libceph: mon0 (1)[c::]:6789 connect error [ 101.179117][ T50] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 101.179131][ T50] (id 0x00) [ 101.228308][ T50] rc_core: IR keymap rc-imon-pad not found [ 101.228320][ T50] Registered IR keymap rc-empty [ 101.228378][ T50] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 101.228386][ T50] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 101.339659][ T5733] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 101.369261][ T1042] libceph: connect (1)[c::]:6789 error -101 [ 101.369366][ T1042] libceph: mon0 (1)[c::]:6789 connect error [ 101.391858][ T50] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:155.0/rc/rc0 [ 101.396182][ T50] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:155.0/rc/rc0/input10 [ 101.401661][ T50] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:7> initialized [ 101.499267][ T58] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 101.562595][ T50] usb 5-1: USB disconnect, device number 7 [ 101.660224][ T58] usb 6-1: New USB device found, idVendor=104f, idProduct=0004, bcdDevice= 1.00 [ 101.661077][ T58] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 101.661091][ T58] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 101.662394][ T58] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 101.662403][ T58] usb 6-1: Product: syz [ 101.662411][ T58] usb 6-1: Manufacturer: syz [ 101.668054][ T58] iuu_phoenix 6-1:1.0: iuu_phoenix converter detected [ 101.675373][ T58] usb 6-1: iuu_phoenix converter now attached to ttyUSB0 [ 101.893760][ T50] libceph: connect (1)[c::]:6789 error -101 [ 101.893859][ T50] libceph: mon0 (1)[c::]:6789 connect error [ 101.898767][ T7002] ceph: No mds server is up or the cluster is laggy [ 101.930879][ T7012] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 101.930896][ T7012] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 102.124114][ T6985] ================================================================== [ 102.124126][ T6985] BUG: KASAN: slab-use-after-free in __dynamic_dev_dbg+0x2fc/0x310 [ 102.124150][ T6985] Read of size 8 at addr ffff8880142fc0c8 by task syz.0.298/6985 [ 102.124159][ T6985] [ 102.124165][ T6985] CPU: 3 UID: 0 PID: 6985 Comm: syz.0.298 Not tainted syzkaller #0 PREEMPT(full) [ 102.124190][ T6985] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.124197][ T6985] Call Trace: [ 102.124202][ T6985] [ 102.124207][ T6985] dump_stack_lvl+0x100/0x190 [ 102.124222][ T6985] print_report+0x13d/0x4b0 [ 102.124239][ T6985] ? __virt_addr_valid+0x239/0x430 [ 102.124255][ T6985] ? __dynamic_dev_dbg+0x2fc/0x310 [ 102.124270][ T6985] kasan_report+0xdf/0x1c0 [ 102.124285][ T6985] ? __dynamic_dev_dbg+0x2fc/0x310 [ 102.124307][ T6985] __dynamic_dev_dbg+0x2fc/0x310 [ 102.124323][ T6985] ? __pfx___dynamic_dev_dbg+0x10/0x10 [ 102.124339][ T6985] ? __mutex_lock+0x26c/0x1bd0 [ 102.124355][ T6985] ? display_close+0x43/0x150 [ 102.124372][ T6985] ? do_group_exit+0xd5/0x2a0 [ 102.124384][ T6985] ? __do_fast_syscall_32+0x59f/0x8b0 [ 102.124401][ T6985] ? do_fast_syscall_32+0x32/0x70 [ 102.124417][ T6985] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 102.124434][ T6985] ? locks_remove_file+0xd1/0x600 [ 102.124450][ T6985] ? __pfx_locks_remove_file+0x10/0x10 [ 102.124466][ T6985] display_close+0x103/0x150 [ 102.124482][ T6985] ? __pfx_display_close+0x10/0x10 [ 102.124499][ T6985] __fput+0x3ff/0xb50 [ 102.124513][ T6985] task_work_run+0x150/0x240 [ 102.124527][ T6985] ? __pfx_task_work_run+0x10/0x10 [ 102.124540][ T6985] ? do_raw_spin_unlock+0x145/0x1e0 [ 102.124551][ T6985] do_exit+0x951/0x2ae0 [ 102.124581][ T6985] ? __pfx_do_exit+0x10/0x10 [ 102.124600][ T6985] ? do_raw_spin_lock+0x128/0x260 [ 102.124622][ T6985] ? find_held_lock+0x2b/0x80 [ 102.124633][ T6985] ? get_signal+0x7e0/0x21e0 [ 102.124649][ T6985] do_group_exit+0xd5/0x2a0 [ 102.124662][ T6985] get_signal+0x1ec7/0x21e0 [ 102.124680][ T6985] ? __pfx_get_signal+0x10/0x10 [ 102.124696][ T6985] ? do_futex+0x190/0x440 [ 102.124706][ T6985] arch_do_signal_or_restart+0x91/0x7a0 [ 102.124721][ T6985] ? __pfx_do_sys_openat2+0x10/0x10 [ 102.124736][ T6985] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 102.124758][ T6985] exit_to_user_mode_loop+0x139/0x700 [ 102.124781][ T6985] ? rcu_is_watching+0x13/0xc0 [ 102.124798][ T6985] __do_fast_syscall_32+0x59f/0x8b0 [ 102.124822][ T6985] ? lockdep_hardirqs_on+0x7d/0x110 [ 102.124844][ T6985] do_fast_syscall_32+0x32/0x70 [ 102.124867][ T6985] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 102.124888][ T6985] RIP: 0023:0xf7fd7fec [ 102.124897][ T6985] Code: Unable to access opcode bytes at 0xf7fd7fc2. [ 102.124902][ T6985] RSP: 002b:00000000f54965bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 102.124914][ T6985] RAX: fffffffffffffe00 RBX: 00000000f7494f88 RCX: 0000000000000080 [ 102.124921][ T6985] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7494f8c [ 102.124928][ T6985] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 102.124935][ T6985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.124942][ T6985] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 102.124952][ T6985] [ 102.124956][ T6985] [ 102.124958][ T6985] Allocated by task 50: [ 102.124964][ T6985] kasan_save_stack+0x30/0x50 [ 102.124976][ T6985] kasan_save_track+0x14/0x30 [ 102.124987][ T6985] __kasan_kmalloc+0xaa/0xb0 [ 102.124998][ T6985] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 102.125014][ T6985] usb_set_configuration+0x10cb/0x1c60 [ 102.125029][ T6985] usb_generic_driver_probe+0xa1/0xe0 [ 102.125042][ T6985] usb_probe_device+0xef/0x400 [ 102.125058][ T6985] really_probe+0x241/0xa60 [ 102.125070][ T6985] __driver_probe_device+0x210/0x460 [ 102.125083][ T6985] driver_probe_device+0x4a/0x140 [ 102.125096][ T6985] __device_attach_driver+0x1df/0x320 [ 102.125109][ T6985] bus_for_each_drv+0x159/0x1e0 [ 102.125119][ T6985] __device_attach+0x1e4/0x4d0 [ 102.125132][ T6985] device_initial_probe+0xaf/0xd0 [ 102.125145][ T6985] bus_probe_device+0x64/0x160 [ 102.125156][ T6985] device_add+0x121d/0x1970 [ 102.125171][ T6985] usb_new_device.part.0+0xcc2/0x1686 [ 102.125186][ T6985] hub_event.cold+0x1e3/0xe90 [ 102.125198][ T6985] process_one_work+0xac7/0x1b10 [ 102.125210][ T6985] worker_thread+0x5ef/0xe50 [ 102.125221][ T6985] kthread+0x373/0x450 [ 102.125232][ T6985] ret_from_fork+0x730/0xd60 [ 102.125248][ T6985] ret_from_fork_asm+0x1a/0x30 [ 102.125256][ T6985] [ 102.125259][ T6985] Freed by task 50: [ 102.125263][ T6985] kasan_save_stack+0x30/0x50 [ 102.125275][ T6985] kasan_save_track+0x14/0x30 [ 102.125286][ T6985] kasan_save_free_info+0x3b/0x70 [ 102.125318][ T6985] __kasan_slab_free+0x5f/0x80 [ 102.125331][ T6985] kfree+0x22b/0x6d0 [ 102.125345][ T6985] device_release+0xd2/0x270 [ 102.125354][ T6985] kobject_put+0x1f7/0x640 [ 102.125364][ T6985] put_device+0x1f/0x30 [ 102.125373][ T6985] usb_disable_device+0x44a/0x810 [ 102.125387][ T6985] usb_disconnect+0x2e2/0x9a0 [ 102.125401][ T6985] hub_event+0x1bb1/0x4420 [ 102.125416][ T6985] process_one_work+0xac7/0x1b10 [ 102.125428][ T6985] worker_thread+0x5ef/0xe50 [ 102.125439][ T6985] kthread+0x373/0x450 [ 102.125449][ T6985] ret_from_fork+0x730/0xd60 [ 102.125463][ T6985] ret_from_fork_asm+0x1a/0x30 [ 102.125472][ T6985] [ 102.125475][ T6985] The buggy address belongs to the object at ffff8880142fc000 [ 102.125475][ T6985] which belongs to the cache kmalloc-2k of size 2048 [ 102.125484][ T6985] The buggy address is located 200 bytes inside of [ 102.125484][ T6985] freed 2048-byte region [ffff8880142fc000, ffff8880142fc800) [ 102.125494][ T6985] [ 102.125497][ T6985] The buggy address belongs to the physical page: [ 102.125502][ T6985] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x142f8 [ 102.125512][ T6985] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 102.125520][ T6985] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 102.125530][ T6985] page_type: f5(slab) [ 102.125540][ T6985] raw: 00fff00000000040 ffff88801c042f00 dead000000000100 dead000000000122 [ 102.125549][ T6985] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 102.125558][ T6985] head: 00fff00000000040 ffff88801c042f00 dead000000000100 dead000000000122 [ 102.125567][ T6985] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 102.125576][ T6985] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 102.125585][ T6985] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 102.125591][ T6985] page dumped because: kasan: bad access detected [ 102.125596][ T6985] page_owner tracks the page as allocated [ 102.125599][ T6985] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5814, tgid 5814 (kworker/1:3), ts 40558908113 [ 102.125616][ T6985] post_alloc_hook+0xfd/0x120 [ 102.125631][ T6985] get_page_from_freelist+0x110d/0x35d0 [ 102.125641][ T6985] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 102.125651][ T6985] new_slab+0xa9/0x6e0 [ 102.125659][ T6985] refill_objects+0xe3/0x410 [ 102.125667][ T6985] __pcs_replace_empty_main+0x35e/0x650 [ 102.125683][ T6985] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 102.125695][ T6985] kmalloc_reserve+0xe8/0x350 [ 102.125705][ T6985] __alloc_skb+0x185/0x710 [ 102.125717][ T6985] mld_newpack.isra.0+0x18e/0xa20 [ 102.125731][ T6985] add_grhead+0x299/0x340 [ 102.125744][ T6985] add_grec+0x1389/0x1930 [ 102.125757][ T6985] mld_ifc_work+0x3c5/0xc10 [ 102.125770][ T6985] process_one_work+0xac7/0x1b10 [ 102.125782][ T6985] worker_thread+0x5ef/0xe50 [ 102.125793][ T6985] kthread+0x373/0x450 [ 102.125805][ T6985] page last free pid 5162 tgid 5162 ts 13259993049 stack trace: [ 102.125812][ T6985] __free_frozen_pages+0x79f/0x10f0 [ 102.125826][ T6985] qlist_free_all+0x47/0xf0 [ 102.125836][ T6985] kasan_quarantine_reduce+0x1a0/0x1f0 [ 102.125847][ T6985] __kasan_slab_alloc+0x69/0x90 [ 102.125859][ T6985] kmem_cache_alloc_noprof+0x269/0x6a0 [ 102.125870][ T6985] do_getname+0x35/0x390 [ 102.125884][ T6985] do_fchmodat+0xc9/0x1b0 [ 102.125895][ T6985] __x64_sys_chmod+0x5e/0x80 [ 102.125907][ T6985] do_syscall_64+0x121/0x770 [ 102.125922][ T6985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.125932][ T6985] [ 102.125934][ T6985] Memory state around the buggy address: [ 102.125939][ T6985] ffff8880142fbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 102.125947][ T6985] ffff8880142fc000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.125954][ T6985] >ffff8880142fc080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.125960][ T6985] ^ [ 102.125965][ T6985] ffff8880142fc100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.125972][ T6985] ffff8880142fc180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.125978][ T6985] ================================================================== [ 102.127231][ T6985] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 102.407115][ T6985] CPU: 3 UID: 0 PID: 6985 Comm: syz.0.298 Not tainted syzkaller #0 PREEMPT(full) [ 102.410103][ T6985] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.413235][ T6985] Call Trace: [ 102.414353][ T6985] [ 102.415327][ T6985] dump_stack_lvl+0x100/0x190 [ 102.416870][ T6985] vpanic+0x553/0x970 [ 102.418174][ T6985] ? __pfx_vpanic+0x10/0x10 [ 102.419726][ T6985] ? __dynamic_dev_dbg+0x2fc/0x310 [ 102.421436][ T6985] panic+0xd1/0xe0 [ 102.422664][ T6985] ? __pfx_panic+0x10/0x10 [ 102.424116][ T6985] ? __dynamic_dev_dbg+0x2fc/0x310 [ 102.425757][ T6985] ? preempt_schedule_common+0x3c/0xb0 [ 102.427525][ T6985] check_panic_on_warn.cold+0x19/0x34 [ 102.429247][ T6985] end_report.part.0+0x3a/0x90 [ 102.430802][ T6985] kasan_report.cold+0xe/0x18 [ 102.432323][ T6985] ? __dynamic_dev_dbg+0x2fc/0x310 [ 102.433977][ T6985] __dynamic_dev_dbg+0x2fc/0x310 [ 102.435547][ T6985] ? __pfx___dynamic_dev_dbg+0x10/0x10 [ 102.437689][ T6985] ? __mutex_lock+0x26c/0x1bd0 [ 102.439313][ T6985] ? display_close+0x43/0x150 [ 102.440893][ T6985] ? do_group_exit+0xd5/0x2a0 [ 102.442408][ T6985] ? __do_fast_syscall_32+0x59f/0x8b0 [ 102.444161][ T6985] ? do_fast_syscall_32+0x32/0x70 [ 102.445788][ T6985] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 102.447650][ T6985] ? locks_remove_file+0xd1/0x600 [ 102.449280][ T6985] ? __pfx_locks_remove_file+0x10/0x10 [ 102.451058][ T6985] display_close+0x103/0x150 [ 102.452506][ T6985] ? __pfx_display_close+0x10/0x10 [ 102.454166][ T6985] __fput+0x3ff/0xb50 [ 102.455459][ T6985] task_work_run+0x150/0x240 [ 102.456953][ T6985] ? __pfx_task_work_run+0x10/0x10 [ 102.458596][ T6985] ? do_raw_spin_unlock+0x145/0x1e0 [ 102.460344][ T6985] do_exit+0x951/0x2ae0 [ 102.461691][ T6985] ? __pfx_do_exit+0x10/0x10 [ 102.463267][ T6985] ? do_raw_spin_lock+0x128/0x260 [ 102.464976][ T6985] ? find_held_lock+0x2b/0x80 [ 102.466514][ T6985] ? get_signal+0x7e0/0x21e0 [ 102.468019][ T6985] do_group_exit+0xd5/0x2a0 [ 102.469544][ T6985] get_signal+0x1ec7/0x21e0 [ 102.471017][ T6985] ? __pfx_get_signal+0x10/0x10 [ 102.472598][ T6985] ? do_futex+0x190/0x440 [ 102.474006][ T6985] arch_do_signal_or_restart+0x91/0x7a0 [ 102.475785][ T6985] ? __pfx_do_sys_openat2+0x10/0x10 [ 102.477479][ T6985] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 102.479464][ T6985] exit_to_user_mode_loop+0x139/0x700 [ 102.481181][ T6985] ? rcu_is_watching+0x13/0xc0 [ 102.482704][ T6985] __do_fast_syscall_32+0x59f/0x8b0 [ 102.484391][ T6985] ? lockdep_hardirqs_on+0x7d/0x110 [ 102.485973][ T6985] do_fast_syscall_32+0x32/0x70 [ 102.487510][ T6985] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 102.489577][ T6985] RIP: 0023:0xf7fd7fec [ 102.490894][ T6985] Code: Unable to access opcode bytes at 0xf7fd7fc2. [ 102.493005][ T6985] RSP: 002b:00000000f54965bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 102.495549][ T6985] RAX: fffffffffffffe00 RBX: 00000000f7494f88 RCX: 0000000000000080 [ 102.498024][ T6985] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7494f8c [ 102.500557][ T6985] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 102.503083][ T6985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.505617][ T6985] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 102.508221][ T6985] [ 102.510016][ T6985] Kernel Offset: disabled [ 102.511462][ T6985] Rebooting in 86400 seconds.. VM DIAGNOSIS: 09:47:42 Registers: info registers vcpu 0 CPU#0 RAX=000000000021d42d RBX=ffffffff8ea91540 RCX=ffffffff8bce7185 RDX=0000000000000001 RSI=ffffffff8e3f18bd RDI=ffffffff8c622c80 RBP=fffffbfff1d522a8 RSP=ffffffff8ea07cf0 R8 =0000000000000001 R9 =ffffed10056467bd R10=ffff88802b233deb R11=0000000000000001 R12=0000000000000000 R13=0000000000000000 R14=1ffffffff1d40fa2 R15=dffffc0000000000 RIP=ffffffff8bce56bf RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096960000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000000003321cff8 CR3=0000000066eae000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000008 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000014000000000 0000000500000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=00000000001fe4f7 RBX=ffff88801cbfcb00 RCX=ffffffff8bce7185 RDX=0000000000000001 RSI=ffffffff8e3f18bd RDI=ffffffff8c622c80 RBP=ffffed100397f960 RSP=ffffc9000047fe00 R8 =0000000000000001 R9 =ffffed10056667bd R10=ffff88802b333deb R11=0000000000000001 R12=0000000000000000 R13=0000000000000000 R14=1ffff9200008ffc4 R15=dffffc0000000000 RIP=ffffffff8bce56bf RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096a60000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f728eb36 CR3=000000004d289000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000217e6f RBX=ffff88801cbfa580 RCX=ffffffff8bce7185 RDX=0000000000000001 RSI=ffffffff8e3f18bd RDI=ffffffff8c622c80 RBP=ffffed100397f4b0 RSP=ffffc9000048fe00 R8 =0000000000000001 R9 =ffffed10056867bd R10=ffff88802b433deb R11=0000000000000001 R12=0000000000000000 R13=0000000000000000 R14=1ffff92000091fc4 R15=dffffc0000000000 RIP=ffffffff8bce56bf RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096b60000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000080001898 CR3=0000000071b30000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=000000000000000e DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000fcffc200 Opmask01=000000000000ffff Opmask02=00000000ffffffff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000001 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000001a4 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000003bf12 0000002c00000012 0004000000080024 0000000000280030 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000013e 0000001400000000 0000000000000000 0000000000000015 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 006870656301ffff fffffffffffff508 0a80030600000072 0000000200000001 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000010008000008 000008000c080001 00000008060a0106 de0008000180022d ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 8002020800010000 0008060a0106ec00 3a3a3a6301ffffff fffffffffff50801 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 8003656372756f73 01ffffffffffffff fff3082d80030008 000a8002040007c6 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 006870656301ffff fffffffffffff508 0a80030600000072 0000000200000001 ZMM24=5698fc2b5698fc2b 5698fc2b5698fc2b 5698fc2b5698fc2b 5698fc2b5698fc2b 5698fc2b5698fc2b 5698fc2b5698fc2b 5698fc2b5698fc2b 5698fc2b5698fc2b ZMM25=9c3b91099c3b9109 9c3b91099c3b9109 9c3b91099c3b9109 9c3b91099c3b9109 9c3b91099c3b9109 9c3b91099c3b9109 9c3b91099c3b9109 9c3b91099c3b9109 ZMM26=be29bf67be29bf67 be29bf67be29bf67 be29bf67be29bf67 be29bf67be29bf67 be29bf67be29bf67 be29bf67be29bf67 be29bf67be29bf67 be29bf67be29bf67 ZMM27=2d4f6baf2d4f6baf 2d4f6baf2d4f6baf 2d4f6baf2d4f6baf 2d4f6baf2d4f6baf 2d4f6baf2d4f6baf 2d4f6baf2d4f6baf 2d4f6baf2d4f6baf 2d4f6baf2d4f6baf ZMM28=000000400000003f 0000003e0000003d 0000003c0000003b 0000003a00000039 0000003800000037 0000003600000035 0000003400000033 0000003200000031 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=e7070000e7070000 e7070000e7070000 e7070000e7070000 e7070000e7070000 e7070000e7070000 e7070000e7070000 e7070000e7070000 e7070000e7070000 info registers vcpu 3 CPU#3 RAX=0000000000000030 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85aeb445 RDI=ffffffff9bc571e0 RBP=ffffffff9bc571a0 RSP=ffffc90024ed7028 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=0000000038393654 R12=0000000000000000 R13=0000000000000030 R14=0000000000000004 R15=ffffc90024ed7340 RIP=ffffffff85aeb46f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096c60000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f732e3ac CR3=0000000071b30000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000