last executing test programs: 37.595241354s ago: executing program 2 (id=1796): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x20, r1, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000001}, 0x2004c005) (async) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x20, r1, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000001}, 0x2004c005) 37.540236145s ago: executing program 2 (id=1797): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$FS_IOC_READ_VERITY_METADATA(r0, 0xc0286687, &(0x7f0000000200)={0x1, 0x6, 0xe5, &(0x7f0000000100)=""/229}) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000300)={0x1, r1}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="400100001000130100000000000000007f00000100"/64, @ANYRES32=r0, @ANYRES32=0xee00, @ANYRES8=r0], 0x140}, 0x1, 0x0, 0x0, 0x4080}, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) (async) ioctl$FS_IOC_READ_VERITY_METADATA(r0, 0xc0286687, &(0x7f0000000200)={0x1, 0x6, 0xe5, &(0x7f0000000100)=""/229}) (async) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) (async) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000300)={0x1, r1}) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="400100001000130100000000000000007f00000100"/64, @ANYRES32=r0, @ANYRES32=0xee00, @ANYRES8=r0], 0x140}, 0x1, 0x0, 0x0, 0x4080}, 0x0) (async) 37.415077576s ago: executing program 2 (id=1799): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000140), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c020000", @ANYRES16=r1, @ANYBLOB="010000000000000000000100000024000300a05ca84f6c9c8e3853e2fd7a70ae0fb20fa152600cb00845174f08076f8d7843e40108804400208024000100ffffff810100000000000000fdffff01000000000000000000000000000000001400040003000000ac1414bb00000000000000000600050000000000000100802400020073e591ec06154031d3954ac0e16752e72640f08b5281a8461d17d26d12f2bbb6060005000021000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39228c00098028000080060001000a0000001400020020010000000000000000000000000001050003000000000088000080060001000a0000001400020020010000000000000000000000000002050003000000001003800080060001008c0e000008000200ac1414aa05000300000000001c000080060001000200000008000200ac1414bb0500030000000000200004000e00000000000000fe800000000000000000000000000000000000009c0000802400020073961633df6dc9cb418b15afd0bae7b90f1e6cfed8bb423cf9285c474163154908000a00010000002400010000000000000000000000000000000000000000000000000000000000000000004800098028000080060001000a00000014000200fe8000000000000000000000000000bb05000300000000001c000080060001000200000008000200000000000500030000000000080005000100000008000100", @ANYRES32=r2], 0x22c}, 0x1, 0x0, 0xff80, 0x44080}, 0x0) 37.360554746s ago: executing program 2 (id=1800): setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x80000000, 0x1, 0xf, 0x7, 0x8000006, 0x0, 0xffffffa6}, 0x1c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x100) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000100)='autofs\x00', 0x0, &(0x7f0000000400)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000200), 0x2d3102, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x28011, r3, 0xaae46000) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000140)) pwritev(r2, &(0x7f0000000480)=[{&(0x7f00000004c0)='\x00!', 0x2}], 0x1, 0x1000000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937e, &(0x7f00000019c0)={{0x1, 0x1, 0x1018, r0}, './file1\x00'}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="58000000020601080000000008000000000000000c0b078005001500010000000500010006000000050005000a00000005000400000000000900020073797a310000000014000300686173683a69702c706f72742c697000"], 0x58}, 0x1, 0x0, 0x0, 0xc0d1}, 0x0) timer_create(0x0, &(0x7f0000000280)={0x0, 0x21, 0x2}, &(0x7f0000000000)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) prctl$PR_MCE_KILL(0x4e, 0x1, 0x0) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r6, 0x40505330, &(0x7f0000000040)={{}, {0x18}, 0x0, 0x9}) prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x1140700, &(0x7f0000000500)="2774e11eaa79d89a88cf99f882944993a568bc600e3d8446f105c48cbd87c50e9648a5748d2a446682a0a2e38e52fd9d75df6e4bd744c96ec59fa9db007f1cf2bed74718bdb6fd0c709c636e53322eee8b0af9bc5694348f4a1642517246144aeca20c59e348725bc6658ee6678982efdd63462d6f477837cf7cdddd8eb85bc14417f3c1780f12d35eaaa20000000000000000000000000000000011568463d8bb3f8fe2ecf37b1b9ebae72f69be23d341", 0xb1, &(0x7f0000000440), 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000880)=ANY=[@ANYRES32=r5, @ANYBLOB="1bc93915bc676178d830fd0d662cc2dfd0e9", @ANYBLOB="010000000000000000003d0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000d0082006c325f64726f7073000000000500870000000000", @ANYBLOB="fc22e088c3eade860dafbfee1a05bf54071abda176b5ed55d54163d49de46bc10f3ba9eb86d482b62d2ddec4f55bb1a3c3e1cbc2c7f29097"], 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x8) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 36.554608461s ago: executing program 2 (id=1806): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c0000001000030428bd780000f8ffffff000000", @ANYRES32=0x0, @ANYBLOB="4606090000000000140012800b0001006970766c616e00000400028008000500", @ANYRES32=r6], 0x3c}, 0x1, 0x0, 0x0, 0x600}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 35.97515541s ago: executing program 2 (id=1809): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = syz_clone(0x88200, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x1}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @broadcast}) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x2010042, &(0x7f0000000000)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}]}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0xa888, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030212590214000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) r8 = socket(0x8, 0x5, 0x5) connect$l2tp6(r8, &(0x7f0000000000)={0xa, 0x0, 0x9, @remote, 0xff, 0x4}, 0x20) fcntl$getownex(r5, 0x10, &(0x7f0000000200)) r9 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000700), 0x8000, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) r12 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/power/pm_debug_messages', 0x200, 0x18c) ioctl$UFFDIO_MOVE(r12, 0xc028aa05, &(0x7f0000000440)={&(0x7f0000bdd000/0x2000)=nil, &(0x7f0000bde000/0x3000)=nil, 0x2000, 0x2}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x38, r11, 0x1, 0x0, 0x2, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_MASK={0x4}]}]}, 0x38}}, 0x4) ioctl$CDROM_TIMED_MEDIA_CHANGE(r9, 0x5396, &(0x7f0000000000)={0xffffffffffffffff, 0x1}) syz_clone3(&(0x7f0000000380)={0x2140000, 0x0, 0x0, 0x0, {0x1a}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[r0], 0x1}, 0x58) 35.910791256s ago: executing program 32 (id=1809): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = syz_clone(0x88200, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x1}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @broadcast}) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x2010042, &(0x7f0000000000)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}]}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0xa888, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030212590214000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) r8 = socket(0x8, 0x5, 0x5) connect$l2tp6(r8, &(0x7f0000000000)={0xa, 0x0, 0x9, @remote, 0xff, 0x4}, 0x20) fcntl$getownex(r5, 0x10, &(0x7f0000000200)) r9 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000700), 0x8000, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) r12 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/power/pm_debug_messages', 0x200, 0x18c) ioctl$UFFDIO_MOVE(r12, 0xc028aa05, &(0x7f0000000440)={&(0x7f0000bdd000/0x2000)=nil, &(0x7f0000bde000/0x3000)=nil, 0x2000, 0x2}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x38, r11, 0x1, 0x0, 0x2, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_MASK={0x4}]}]}, 0x38}}, 0x4) ioctl$CDROM_TIMED_MEDIA_CHANGE(r9, 0x5396, &(0x7f0000000000)={0xffffffffffffffff, 0x1}) syz_clone3(&(0x7f0000000380)={0x2140000, 0x0, 0x0, 0x0, {0x1a}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[r0], 0x1}, 0x58) 3.835021589s ago: executing program 4 (id=2099): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000c00000009"], 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000080)={&(0x7f0000000180), 0x0, 0x0, 0x0, 0xb11, r1}, 0x38) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_DEBUGREGS(r4, 0x4080aea2, &(0x7f0000000440)={[0x8080000, 0xf7f74000, 0x4, 0x6000], 0x5}) mkdir(&(0x7f00000020c0)='./file0\x00', 0x46) mount$tmpfs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='huge=']) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18020000000400000000000000000000850000002c000000850000002a00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000840)={r6, r5, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xfef3, &(0x7f0000000200)=ANY=[], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r7 = inotify_init1(0x800) inotify_add_watch(r7, &(0x7f0000000e00)='./file0\x00', 0x140) setxattr$incfs_metadata(&(0x7f0000000f80)='./file0\x00', &(0x7f0000000fc0), 0x0, 0x0, 0x0) lremovexattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@known='user.incfs.metadata\x00') r8 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r8, 0x0, 0x0) syz_usb_control_io$sierra_net(r8, 0x0, 0x0) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000780)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00 \x00', 0x18, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @local, {[], @mld={0x187, 0x0, 0x0, 0x0, 0x0, @local}}}}}}, 0x0) ioctl$EVIOCGMASK(r9, 0x80015b1b, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="0000001a0000cbd540648fd8e1877c00ee969ca100000000c3", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x3, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006100000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r11, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000240)="d2ff03066003008cb89e08d988a8", 0x0, 0xd5b4, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000080)={0x7, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xe, 0x16, &(0x7f0000000940)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x10, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0, 0x0, r12, r11}, 0x94) 3.754342773s ago: executing program 1 (id=2102): r0 = memfd_secret(0x80000) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) (async) mount(&(0x7f0000000300), &(0x7f0000000100)='.\x00', &(0x7f00000000c0)='hugetlbfs\x00', 0x0, 0x0) 3.68523476s ago: executing program 1 (id=2104): setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@mcast1, 0x1, 0x0, 0x2, 0x2, 0x9, 0xfffe}, 0x20) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x10}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x81}]}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}, @NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x4}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xcc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) r2 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r3 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000840)="3e12d23d346cfdeb1716f73827", 0xd, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={r1, r2, r3}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'sha256\x00'}}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0, {0xfff}}, './file0\x00'}) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, &(0x7f0000000440)={&(0x7f00000003c0)=""/76, 0x210e000, 0x800, 0x3, 0x1}, 0x20) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r5, 0xc0bc5351, &(0x7f0000000d40)={0x52, 0x0, 'client1\x00', 0x0, "2cd367818b4014ff", "859e92f118c4484604734b1d43209426c1bd711b936fc2c4d28f902e94f8e647"}) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0x9}) ioctl(r4, 0x8b32, &(0x7f0000000040)) 3.554613367s ago: executing program 1 (id=2105): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000005c0)=ANY=[@ANYBLOB="fc0000001900010000000000000000000000000000ebff000000000000000000ff02000000000000000000000000000100000008000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000001000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400002000000000000080000000000000000000000000000000044000500fc000000000000000000000000000001000000003c000000000000007f0000010000000000000000000000000200000004"], 0xfc}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, 0x0, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r4, 0x40015b0b, &(0x7f0000000040)) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000200)={'gretap0\x00', 0x0, 0x10, 0x700, 0x7af5, 0x4, {{0x1d, 0x4, 0x0, 0x4, 0x74, 0x66, 0x0, 0x7f, 0x29, 0x0, @local, @multicast2, {[@ra={0x94, 0x4, 0x1001}, @lsrr={0x83, 0xf, 0xb, [@dev={0xac, 0x14, 0x14, 0x44}, @empty, @remote]}, @noop, @generic={0x82, 0xffffffffffffff04, "99bc6728988ff389f06fb0914c"}, @timestamp_addr={0x44, 0xc, 0x2c, 0x1, 0xc, [{@loopback, 0x10001}]}, @rr={0x7, 0x7, 0xa2, [@multicast2]}, @timestamp={0x44, 0xc, 0xd3, 0x0, 0xe, [0x7, 0x0]}, @generic={0x83, 0xc, "34fa01592222168922a8"}, @ra={0x94, 0x4, 0x8}, @timestamp_addr={0x44, 0xc, 0xd4, 0x1, 0x1, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7}]}]}}}}}) syz_emit_ethernet(0x5a, &(0x7f0000000500)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0xe, 0x4, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x6, 0x0, @dev, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x44, 0x1c, 0xa, 0x1, 0x0, [{@empty}, {}, {@rand_addr=0x64010101, 0x3}]}, @cipso={0x86, 0x6, 0x1}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) syz_usb_control_io(r3, &(0x7f0000000ec0)={0x2c, &(0x7f00000004c0)={0x20, 0x21, 0x66, {0x66, 0xa, "3b1afe03113f74893f555995409082934d0a19ffd3ce7e52dbcdae6801b02b5149413fbff0d02a2d24b570ba24bbb15b1ec59b2769e6de36d5a470331deadeebf7f36ba9e722d58fe53e1d234dd2ba22521ba17df836360fdd630764528c0bcaab2b04a3"}}, &(0x7f0000000d40)={0x0, 0x3, 0x84, @string={0x84, 0x3, "3f2defc805f657669214106af119fb49dd7b50f7a0832accc439d992e18305b962cabd820e36a25183e93c6d049c52c54449bca553963bae503a21e6718e975386e578d084cf3ce16016e83f0dd5b921c087ce078652e15aea0b8592844462150ca0fdd45a1cd68d5d77bbbdf178aeb5565dd4fcf547141928345e450e3f90a45c96"}}, &(0x7f0000000e00)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, &(0x7f0000000e40)={0x20, 0x29, 0xf, {0xf, 0x29, 0xff, 0x1, 0x3, 0xa6, "fc87d6f6", "9c37627b"}}, &(0x7f0000000e80)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x0, 0x7, 0x8, 0x2, 0x3, 0x3}}}, &(0x7f0000001380)={0x84, &(0x7f0000000f00)={0x20, 0x15, 0xb4, "a91545782f32c3dbcbe49ad4837a0e8fc690e451f03ef64baba11577ddbd8e7c5ce4aa321306e4ed3efd74531cfe8ce2afba5454132766a8857c3e93e698ef4a651728d0f638c29ee8d51f2fa404fc707b9eb36d527ca6f8423b69ced12a30db9e3b42dfd26d2dde6e716d556c9fcf672caa5267dfff830aec1be523411faac8a511b55cf40aa38fdcac51877f2a971dd8129fce64d8dfa676cf98aac83b6f4723c6752b0b167655030ef0996407b5d09524fe07"}, &(0x7f0000000fc0)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000001000)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000001040)={0x20, 0x0, 0x4, {0x0, 0x2}}, &(0x7f0000001080)={0x20, 0x0, 0x4, {0x20, 0x4}}, &(0x7f00000010c0)={0x40, 0x7, 0x2}, &(0x7f0000001100)={0x40, 0x9, 0x1, 0x7}, &(0x7f0000001140)={0x40, 0xb, 0x2, "6c11"}, &(0x7f0000001180)={0x40, 0xf, 0x2, 0xf3}, &(0x7f00000011c0)={0x40, 0x13, 0x6, @local}, &(0x7f0000001200)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}}, &(0x7f0000001240)={0x40, 0x19, 0x2, "2497"}, &(0x7f0000001280)={0x40, 0x1a, 0x2, 0xf}, &(0x7f00000012c0)={0x40, 0x1c, 0x1, 0x3}, &(0x7f0000001300)={0x40, 0x1e, 0x1, 0xfa}, &(0x7f0000001340)={0x40, 0x21, 0x1, 0x6}}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="280bab83", @ANYRES16=r7, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r8, @ANYBLOB="0a00f5003ef1f5bdc88f0000"], 0x28}}, 0x0) r9 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r9, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) sendmmsg(r9, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) r10 = getuid() r11 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/nd/drivers/nd_pmem/unbind\x00', 0x1, 0x0) write(r11, &(0x7f0000000240)='namespace0.0\x00', 0xc) close(r11) write$6lowpan_enable(r11, &(0x7f0000000440)='0', 0x1) syz_emit_ethernet(0x46, &(0x7f0000000840)={@multicast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "c6dd00", 0x10, 0x3a, 0xff, @remote={0xfe, 0xe0}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x3, 0x401, 0x63, 0x8}}}}}}, 0x0) fstat(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=@getpolicy={0x64c, 0x15, 0x4, 0x70bd28, 0x25dfdbff, {{@in=@rand_addr=0x64010102, @in=@rand_addr=0x64010100, 0x4e23, 0x0, 0x4e24, 0x0, 0x2, 0x0, 0x20, 0x8, r5, r10}, 0x6e6bb8}, [@replay_esn_val={0x20, 0x17, {0x1, 0x70bd2a, 0x70bd2c, 0x70bd25, 0x70bd26, 0x0, [0xe]}}, @algo_crypt={0x117, 0x2, {{'ecb(cast5)\x00'}, 0x678, "fd94596827709a1b743634a60460098bb4749c524e2c0dabf5dbb2044bf9c0f2c5110bd359f1f718bcc2233eb371b3200820fd05324922f27ea5f63a5ef2bb383d3598c4a961caf68eff524c4d21961200291c10d2f8241740f16b59a6221bada1437500bb5f283099006376e931c7d6cf61ab2f0e5073d6e632d09d34b9eef8d301092e80723db31cf4af242395855b3501483647e7ff950ff7976825374f9e23526fd0869d11d4139920a343f059e96effa4444b01456bb9abc89ce370bda9b1fc0f1fece3048adac84f90eb31f1"}}, @algo_auth_trunc={0xf5, 0x14, {{'poly1305-generic\x00'}, 0x548, 0x80, "2685bf78e2fdff746a335298be199b6f9b83f4e790e2b74877b4c045386d999113ef8cc8531eeb5e06925a5543b19b323964a9b8677a9e0d505104dfd0970cc81040c5678b6ce28f2e0683e6c1c2879e75fc7def577ad60a1d58ae767a9f79ceee8595025bc5d6b66b6be7390be8d8de16ccd6d25cf0844d5db8a62ef036cf9b597deb26e2bebdc4648dd2d020a39561bad7275fde554bd2626afd4e68029d935e2bddf8eb7b511194"}}, @replay_esn_val={0x28, 0x17, {0x3, 0x70bd2d, 0x70bd28, 0x70bd2b, 0x70bd27, 0x3, [0xfffffe00, 0x1, 0x10000]}}, @policy={0xac, 0x7, {{@in=@dev={0xac, 0x14, 0x14, 0x50}, @in=@remote, 0x4e20, 0xa, 0x4e24, 0x0, 0x2, 0x0, 0x10, 0x87, 0x0, r12}, {0xffffffffffffff8f, 0x2, 0xffffffffffff94c7, 0x7, 0x8, 0x6, 0x1, 0xa}, {0x8000000000000001, 0xa, 0x6, 0x14b4}, 0x2, 0x6e6bb4, 0x0, 0x0, 0x2, 0x3}}, @encap={0x1c, 0x4, {0xfffffffffffffffd, 0x4e24, 0x4e23, @in6=@private2}}, @algo_aead={0x10d, 0x12, {{'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x608, 0x0, "2ae727faf7c23d08327cce7fe872e1cb4d7585b3078c9c4e054f0391e8bc416a289f979596ff21ca146c98e1a95d2aa94e7d22bc3e3c6e12f897c6d5882030a82799353d0894ae8831b897305d3ae4e7f806657cf9549f70409962b9ea82614c6283d4032a3c06e7afabd2a76c4754f51ba0c70d3d6780d8261a32bae6ba52974970e67db720299af9a6b0de779533aadd6564b4c02df4146b965b24aa2a1e73498aed23a475ab67e4d4850b0a55a50442aa392a408d1096150aea4c89b1a5e3bd"}}, @migrate={0x1cc, 0x11, [{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@multicast1, @in=@multicast1, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x6c, 0x2, 0x0, 0x3502, 0x2, 0x2}, {@in=@empty, @in=@private=0xa010100, @in6=@empty, @in6=@mcast2, 0x2b, 0x0, 0x0, 0x34ff, 0xa, 0xa}, {@in=@rand_addr=0x64010100, @in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2c}}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x32, 0x3, 0x0, 0x3502, 0x2, 0xa}, {@in=@loopback, @in6=@private1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@local, 0x3c, 0x0, 0x0, 0x0, 0x2, 0xa}, {@in=@rand_addr=0x64010101, @in=@rand_addr=0x64010100, @in6=@empty, @in=@dev={0xac, 0x14, 0x14, 0x18}, 0x33, 0x3, 0x0, 0x34ff, 0x0, 0x2}, {@in6=@mcast1, @in=@multicast2, @in6=@empty, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x2b, 0x4, 0x0, 0x3504, 0x2, 0xa}]}]}, 0x64c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r13, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f00000008c0)=@newtaction={0x88c, 0x30, 0x12f, 0x0, 0x0, {}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x864, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, {0x1, 0x0, 0x0, 0x0, 0x0, 0x6}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x6}}}, @TCA_POLICE_PEAKRATE={0x404}, @TCA_POLICE_RATE={0x404}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x88c}}, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000580)={r11}, 0x8) read$char_usb(r4, &(0x7f0000000100)=""/230, 0xe6) 2.404933586s ago: executing program 3 (id=2116): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x9, 0x2}, 0x10) write(r0, &(0x7f00000000c0)="1b0000001e005f025145e9676a2cbf0dffffffff01000000000000", 0x1b) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b70000000100000bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000004d44000000000000630a04fe0000000071330000000000009f030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fba1e3587b9d9e878c86ba9b66c4491fcff607d9cbf156f3fc0fb8c827d4e6cac493a3e2746bd5f0f8bc024352200a4250785cdca4fe3c546972d0a56e3905d1e72c33d64f6591fe25f312f47e7ec6b4640f1f6dc4efee4b8d3cfbfcbf77bfd52f0a99adc7d359233cfea0a11f5dcb87603885f08d633e842644988d2f45a1824361b5df707f726fad22d53727b4396b3d05df34933262fdb09f19837fdc2af1c721b17d54076e25ab625ae0a4c9cd900"/3002], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000080), 0xfffffffffffffdbb}, 0x48) 2.404647423s ago: executing program 3 (id=2117): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x2, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x33c, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000080)={0x7e, 0x8, 0x2, {0x1, @sliced={0x0, [0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0xfffd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x3, 0x0, 0x0, 0x0, 0x3]}}}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc000905850200"], 0x0) read$char_usb(0xffffffffffffffff, &(0x7f0000000000)=""/172, 0xac) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0xffffffffffffff12, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYRESDEC], 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0xab, @loopback, 0x10001}, 0x1c) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(r0, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x8003, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) ioctl$USBDEVFS_DROP_PRIVILEGES(0xffffffffffffffff, 0x4004551e, 0x0) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x4e22, 0x7, @loopback, 0xb}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(0xffffffffffffffff, 0x29, 0x3b, &(0x7f00000001c0)=ANY=[], 0x40) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000005700)=ANY=[@ANYBLOB="580000000906010200000000000000000200fdff300007800c00018008000140e8000001140017006261746164765f736c6176655f3000000c00028008000140640101010900020073797a31000000000500010007"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x40c0080) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r5, 0x0, 0x48810) syz_usb_disconnect(0xffffffffffffffff) 1.854919008s ago: executing program 0 (id=2118): socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) socket$inet_udp(0x2, 0x2, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200800, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48640) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)=[0x7fffffff], 0x0, 0x1}) 1.854508972s ago: executing program 0 (id=2119): r0 = fsopen(&(0x7f00000000c0)='securityfs\x00', 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900038073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x25}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x6000000, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000040)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @address_request={0x11, 0x0, 0x0, 0x90b8}}}}}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r0, 0x0, 0x87) fchdir(r3) openat(0xffffffffffffff9c, &(0x7f0000001740)='.\x00', 0x511001, 0x0) setns(0xc9, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000005300)=[{0x28, 0x0, 0xfb, 0xfffff034}, {0x80000006, 0x66}]}, 0x10) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) close(r6) tee(r5, r4, 0x5, 0x0) sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x6, 0x7, 0x0, 0x8001}]}, 0x10) recvfrom$inet(r6, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 1.682255889s ago: executing program 3 (id=2120): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x840, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x4003}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x240408a0}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc801}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00?', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 1.564953342s ago: executing program 3 (id=2121): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001100)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01010000000000000000020000000900010073797a3000000000080002400000000350000000120a01010000000000000000020000000900010073797a3000000000070002006f303000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323900080003400000000720000480060001000002000005000200110000000c000300080001000000001e140000001100010000000000000000000000000a"], 0xcd0}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000002200)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002000)=ANY=[@ANYBLOB="28000000130a01030000000000000000020000000900010073797a30000000000800034000000007"], 0x28}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x3c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) connect$llc(r1, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) sendmmsg(r1, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 943.149605ms ago: executing program 0 (id=2122): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r0, 0x6, &(0x7f0000002000)={0x1}) fcntl$lock(r0, 0x26, &(0x7f0000000180)) fcntl$lock(r0, 0x7, &(0x7f0000000200)={0x0, 0x2, 0x8}) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/uac1.usb0\x00', 0x1ed) rmdir(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/uac1.usb0\x00') 694.156103ms ago: executing program 4 (id=2123): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x488d0}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000240)=ANY=[@ANYBLOB="600000006c000100279d7020f7dbdf2500000000", @ANYRES32=0x0, @ANYBLOB="1a0000009c2800002c00348014003500000000000000000000000000000000001400350076657468305f766c616e000000000000140035006e657464657673696d30"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x40040) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c0000001a00010028bd70000000000002202000ff00000700020000080002000a01010008000100ac14143308000300", @ANYRES8=r2], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0xea5bc50b6199d76e) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 693.806593ms ago: executing program 3 (id=2124): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000003b0009002bbd7000fddbc72512"], 0x14}, 0x1, 0x0, 0x0, 0x8080}, 0x4000010) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r1, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=@newqdisc={0x34, 0x24, 0xf0b, 0x70bd2e, 0x25dfdbfe, {0x0, 0x0, 0x12, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8004001}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="500000002700010000000000000000000a010100000000000000000000000000fe8000000000000000000000000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ceeee58544e56032"], 0x50}}, 0x1000) 691.242255ms ago: executing program 4 (id=2125): setns(0xc9, 0x0) r0 = syz_open_dev$sg(&(0x7f00000002c0), 0xe6, 0x2602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x380000f, 0x11, r0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc0686611, &(0x7f0000000040)={0x68, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) r2 = socket(0x8, 0x5, 0x5) ioctl$sock_bt_hidp_HIDPCONNDEL(r2, 0x541b, 0x0) mount(&(0x7f00000006c0)=@sr0, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='ext3\x00', 0x204001, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), r2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000280)={'syztnl1\x00', &(0x7f0000000200)={'ip6_vti0\x00', 0x0, 0x4, 0x2d, 0x4, 0xffffffca, 0x20, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x10, 0x7, 0x3, 0x9}}) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r1, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xa4, r3, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010100}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x20}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x18}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x48, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x49}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0xa4}}, 0x0) setns(0xc9, 0x0) (async) syz_open_dev$sg(&(0x7f00000002c0), 0xe6, 0x2602) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x380000f, 0x11, r0, 0x0) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0}, 0x68) (async) syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc0686611, &(0x7f0000000040)={0x68, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) (async) socket(0x8, 0x5, 0x5) (async) ioctl$sock_bt_hidp_HIDPCONNDEL(r2, 0x541b, 0x0) (async) mount(&(0x7f00000006c0)=@sr0, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='ext3\x00', 0x204001, 0x0) (async) syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), r2) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000280)={'syztnl1\x00', &(0x7f0000000200)={'ip6_vti0\x00', 0x0, 0x4, 0x2d, 0x4, 0xffffffca, 0x20, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x10, 0x7, 0x3, 0x9}}) (async) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r1, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xa4, r3, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010100}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x20}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x18}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x48, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x49}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0xa4}}, 0x0) (async) 604.275822ms ago: executing program 3 (id=2126): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x204031, 0xffffffffffffffff, 0x2795000) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) readv(r0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/235, 0xeb}], 0x1) write$UHID_CREATE(r0, &(0x7f0000000280)={0x0, {'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000200)=""/108, 0x6c, 0xa, 0xffffff1d, 0x2, 0x4, 0x7}}, 0x120) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x80040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r6 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000080)="aefdda9d240103005a90f57f02703aeff0f64eb9ee07962c220852f426072a0000000000000000000012", 0x2a}, {&(0x7f0000000280)="f012c7ce60085637bd4b9201802c47e45be5c44b928323df15ae38b067b2230701229e5070f5f56d4d11", 0x2a}], 0x2) writev(r5, &(0x7f0000000900)=[{&(0x7f00000005c0)="107e", 0x2}], 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0xe8, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 540.472775ms ago: executing program 4 (id=2127): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r1) socket$kcm(0x2, 0x2, 0x0) sendmsg$NFNL_MSG_ACCT_GET(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x20008814) (async) sendmsg$NFNL_MSG_ACCT_GET(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x20008814) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r2}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0x80, 0x0, 0xffffffffffffffff, 0x87}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r3, 0xffffffffffffffff}, 0x0, &(0x7f0000000040)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000200)={r4, 0x0, &(0x7f0000001780)=""/4096}, 0x20) (async) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000200)={r4, 0x0, &(0x7f0000001780)=""/4096}, 0x20) close_range(r0, 0xffffffffffffffff, 0x0) 539.773909ms ago: executing program 1 (id=2128): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000080)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x4, 0x6, 0x6, 0x5, 0x2c, @private2, @empty, 0x8, 0x7800, 0x4, 0x7}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000000c0)={@remote, @dev, 0x0}, &(0x7f0000000100)=0xc) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000002c0)=@RTM_DELMDB={0x78, 0x55, 0x100, 0x70bd2a, 0x25dfdbff, {0x7, r1}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x2, 0x2, {@in6_addr=@local, 0x8edd}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r2, 0x1, 0x3, 0x0, {@ip4=@multicast1, 0xc5b3}}}, @MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x2, 0x1, {@in6_addr=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x86dd}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x28040000}, 0x4000000) 539.400168ms ago: executing program 4 (id=2129): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newqdisc={0x50, 0x24, 0xd0f, 0x70bd27, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xffff, 0xffff}, {0x2, 0xf}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x20, 0x2, {{0x0, 0x0, 0x0, 0x386561e9}, [@TCA_NETEM_DELAY_DIST={0x4, 0xd}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40010}, 0x8080) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newqdisc={0x50, 0x24, 0xd0f, 0x70bd27, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xffff, 0xffff}, {0x2, 0xf}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x20, 0x2, {{0x0, 0x0, 0x0, 0x386561e9}, [@TCA_NETEM_DELAY_DIST={0x4, 0xd}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40010}, 0x8080) syz_genetlink_get_family_id$fou(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x60044831}, 0x40880) 475.063814ms ago: executing program 4 (id=2130): r0 = fsopen(&(0x7f00000000c0)='securityfs\x00', 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900038073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x25}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x6000000, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000040)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @address_request={0x11, 0x0, 0x0, 0x90b8}}}}}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r0, 0x0, 0x87) fchdir(r3) openat(0xffffffffffffff9c, &(0x7f0000001740)='.\x00', 0x511001, 0x0) setns(0xc9, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000005300)=[{0x28, 0x0, 0xfb, 0xfffff034}, {0x80000006, 0x66}]}, 0x10) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) close(r6) tee(r5, r4, 0x5, 0x0) sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x6, 0x7, 0x0, 0x8001}]}, 0x10) recvfrom$inet(r6, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 474.624468ms ago: executing program 1 (id=2131): r0 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x20000) mount$tmpfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={[{@mpol={'mpol', 0x3d, {'bind', '=static', @val={0x3a, [0x30]}}}}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f00000001c0)={0x1, 0x7e, 0x22, 0x0, 0x407}) openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000380)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x2, @loopback, 0x8}, {0xa, 0x4e23, 0x7, @remote, 0x8}, r2, 0x10007}}, 0x48) read$midi(r0, 0x0, 0x3b) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80383, 0x0) read$midi(r0, &(0x7f0000000040)=""/25, 0x19) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi2\x00', 0x1, 0x0) setns(0xc9, 0x0) r5 = socket(0x2a, 0x2, 0x0) getsockname$packet(r5, 0x0, &(0x7f0000001480)) ioctl$COMEDI_CMD(r4, 0x80506409, &(0x7f0000001480)={0x0, 0x0, 0x2, 0xc01, 0xffffffff, 0x8, 0x10, 0x8381, 0x80, 0x7ff, 0x40, 0x7, 0x0, 0x0, 0x0}) socket(0x10, 0x80002, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000240), 0x4000) ioctl$SNDCTL_SEQ_RESET(r3, 0x5100) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x3, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x7c}, [], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 323.746575ms ago: executing program 1 (id=2132): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x902, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) getsockopt$bt_rfcomm_RFCOMM_LM(r1, 0x12, 0x3, &(0x7f0000000340), &(0x7f00000003c0)=0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x2}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x40081e0}, 0x40) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002800128009000100626f6e640000000018000280140008"], 0x48}}, 0x0) sendmmsg$inet(r5, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x34, 0x64, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0xffe0}, {0x10, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x4040004) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) r7 = userfaultfd(0x801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r7, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) madvise(&(0x7f000076e000/0x11000)=nil, 0x11000, 0x15) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r9) getsockname$packet(r9, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000980)=@delchain={0x34, 0x2c, 0xf31, 0x70bd27, 0x2000, {0x0, 0x0, 0x0, r10, {0x8}, {0xfff2, 0xffff}, {0xffff, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) ioctl$PTP_PIN_SETFUNC(r1, 0x40603d07, &(0x7f00000000c0)={'\x00', 0x2, 0x0, 0x3}) r11 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r11, &(0x7f0000bfe000/0x400000)=nil) 75.124917ms ago: executing program 0 (id=2133): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x100000000000) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r3 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x183200) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) write$binfmt_misc(r4, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f00000002c0)={r4, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xe, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b4a0d93481b232b11b819ef6167d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x1000008]}}) socket$inet_tcp(0x2, 0x1, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000140)="0f30c402fd3eecae660f38800a66b80c010f00d0662e3646d87213460f09b98c0900000f32b8010000000f01c12e644c0fc72f", 0x33}], 0x1, 0x41, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x9, 0x810004, 0x0, 0xffff7ffffffffffd, 0x800000ffffffff, 0x105, 0xc9, 0x3, 0x7, 0x33, 0x2000000000000807, 0x3, 0x200000003, 0x6, 0x8, 0x40], 0x8000000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.0946ms ago: executing program 0 (id=2134): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c0000001800dd8d0000000000000000020000000000000600000000060015000100000018001680140001"], 0x3c}, 0x1, 0x0, 0x0, 0x20000010}, 0x200000a0) (async) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="fc0000001300e9990000000000000000ac14143300000000000000dbe9b277f2d926ee0000000000000000000000000100000000000000000200001000000000", @ANYRES32=0x0, @ANYBLOB="98155583c4737be5852a7c9c04dbecf348271d1d8064e42e6114fe5c35acdbd06a1a7a97b2be6ab800c89e2e9fe6d3160b066b58d74e58d2842613f7b97b1f30e16c70b30691c46d85698283754b754e64ce082a81c7ae3b587898c9a48596b3620c81057699ba7f3dfd791b106c89eeec730ebfa61f7250ce8abbb1e2c7b42dfa0c", @ANYBLOB="00000000000000000000000000000000000000000000000009000000000000000000000000000000fdffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500fe880000000000000000000000000101000004d43300000002000000640101020000000000000000000000000435000001022700070000000200000007000000"], 0xfc}}, 0x4000080) (async) sendmsg$nl_route(r0, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=@getnexthop={0x30, 0x6a, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@NHA_MASTER={0x8}, @NHA_FDB={0x4}, @NHA_FDB={0x4}, @NHA_FDB={0x4}, @NHA_GROUPS={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004800}, 0x20008010) 0s ago: executing program 0 (id=2135): r0 = fanotify_init(0x1a, 0x800) (async) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0xa8) fanotify_mark(r0, 0x441, 0x4800001a, r1, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0) dup2(r3, r3) write(r3, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000b80)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x20, r6, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_DEV_SETUP(r7, 0x405c5503, &(0x7f0000000480)={{}, 'syz0\x00'}) ioctl$UI_SET_EVBIT(r7, 0x40045564, 0x1) (async) ioctl$UI_DEV_CREATE(r7, 0x5501) (async) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0, 0x0) read$FUSE(r8, &(0x7f0000000300)={0x2020}, 0x2020) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) (async) r9 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r9, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r9, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) (async) fanotify_mark(r0, 0x1, 0x20, r1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) kernel console output (not intermixed with test programs): : gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 165.996026][T11906] CPU: 1 UID: 0 PID: 11906 Comm: syz.0.1791 Tainted: G L syzkaller #0 PREEMPT(full) [ 165.996046][T11906] Tainted: [L]=SOFTLOCKUP [ 165.996050][T11906] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 165.996056][T11906] Call Trace: [ 165.996060][T11906] [ 165.996064][T11906] dump_stack_lvl+0x100/0x190 [ 165.996083][T11906] dump_header+0xfb/0x606 [ 165.996097][T11906] oom_kill_process.cold+0xd/0x330 [ 165.996110][T11906] out_of_memory+0x340/0x14f0 [ 165.996130][T11906] ? __pfx_out_of_memory+0x10/0x10 [ 165.996150][T11906] mem_cgroup_out_of_memory+0xc6/0x130 [ 165.996163][T11906] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 165.996174][T11906] ? find_held_lock+0x2b/0x80 [ 165.996187][T11906] ? do_raw_spin_unlock+0x145/0x1e0 [ 165.996202][T11906] ? _raw_spin_unlock+0x28/0x50 [ 165.996215][T11906] try_charge_memcg+0x6e5/0xdf0 [ 165.996233][T11906] ? __pfx_try_charge_memcg+0x10/0x10 [ 165.996260][T11906] ? find_held_lock+0x2b/0x80 [ 165.996270][T11906] ? rcu_read_unlock+0x17/0x60 [ 165.996286][T11906] ? rcu_read_unlock+0x17/0x60 [ 165.996301][T11906] ? find_held_lock+0x2b/0x80 [ 165.996311][T11906] ? rcu_read_unlock+0x17/0x60 [ 165.996329][T11906] charge_memcg+0x187/0x1e0 [ 165.996344][T11906] __mem_cgroup_charge+0x2b/0x1c0 [ 165.996362][T11906] shmem_alloc_and_add_folio+0x451/0xd40 [ 165.996377][T11906] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 165.996389][T11906] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 165.996404][T11906] shmem_get_folio_gfp+0x6ad/0x1910 [ 165.996417][T11906] ? __lock_acquire+0x49f/0x1a40 [ 165.996430][T11906] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 165.996445][T11906] shmem_write_begin+0x1a4/0x420 [ 165.996458][T11906] ? __pfx_shmem_write_begin+0x10/0x10 [ 165.996469][T11906] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 165.996482][T11906] ? lockdep_hardirqs_on+0x78/0x100 [ 165.996497][T11906] generic_perform_write+0x292/0xa40 [ 165.996517][T11906] ? __pfx_generic_perform_write+0x10/0x10 [ 165.996535][T11906] ? file_update_time_flags+0x373/0x500 [ 165.996551][T11906] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 165.996564][T11906] shmem_file_write_iter+0x10e/0x140 [ 165.996578][T11906] __kernel_write_iter+0x2ac/0x930 [ 165.996596][T11906] ? __pfx___kernel_write_iter+0x10/0x10 [ 165.996613][T11906] ? __up_read+0x333/0x980 [ 165.996629][T11906] ? dump_user_range+0x65e/0xad0 [ 165.996643][T11906] ? copy_mc_enhanced_fast_string+0x6/0xf [ 165.996663][T11906] dump_user_range+0x3f9/0xad0 [ 165.996680][T11906] ? __pfx_dump_user_range+0x10/0x10 [ 165.996699][T11906] ? __pfx_writenote+0x10/0x10 [ 165.996713][T11906] ? elf_core_dump+0x1f25/0x3d20 [ 165.996731][T11906] elf_core_dump+0x2d68/0x3d20 [ 165.996754][T11906] ? __pfx_elf_core_dump+0x10/0x10 [ 165.996768][T11906] ? kasan_save_stack+0x3f/0x50 [ 165.996781][T11906] ? kasan_save_stack+0x30/0x50 [ 165.996792][T11906] ? kasan_save_track+0x14/0x30 [ 165.996804][T11906] ? __kasan_kmalloc+0xaa/0xb0 [ 165.996815][T11906] ? vfs_coredump+0x22a6/0x56f0 [ 165.996828][T11906] ? get_signal+0x1f2a/0x21e0 [ 165.996843][T11906] ? arch_do_signal_or_restart+0x91/0x7e0 [ 165.996858][T11906] ? 0xffffffffff600000 [ 165.996890][T11906] ? vfs_coredump+0x294b/0x56f0 [ 165.996904][T11906] vfs_coredump+0x294b/0x56f0 [ 165.996923][T11906] ? __pfx_vfs_coredump+0x10/0x10 [ 165.996938][T11906] ? __lock_acquire+0x49f/0x1a40 [ 165.996969][T11906] ? bpf_ksym_find+0x128/0x1c0 [ 165.996989][T11906] ? unwind_get_return_address+0x59/0xa0 [ 165.997001][T11906] ? arch_stack_walk+0xa6/0xf0 [ 165.997022][T11906] ? __sigqueue_free+0xbe/0x2a0 [ 165.997032][T11906] ? stack_trace_save+0x8e/0xc0 [ 165.997043][T11906] ? __pfx_stack_trace_save+0x10/0x10 [ 165.997055][T11906] ? stack_depot_save_flags+0x27/0x9d0 [ 165.997096][T11906] ? proc_coredump_connector+0x2d3/0x4f0 [ 165.997108][T11906] ? __pfx_proc_coredump_connector+0x10/0x10 [ 165.997122][T11906] ? rcu_is_watching+0x12/0xc0 [ 165.997141][T11906] get_signal+0x1f2a/0x21e0 [ 165.997161][T11906] ? __pfx_get_signal+0x10/0x10 [ 165.997179][T11906] arch_do_signal_or_restart+0x91/0x7e0 [ 165.997192][T11906] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 165.997212][T11906] irqentry_exit+0x402/0xa00 [ 165.997227][T11906] asm_exc_page_fault+0x26/0x30 [ 165.997239][T11906] RIP: 0033:0x7f61c8f9e021 [ 165.997248][T11906] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 165.997258][T11906] RSP: 002b:fffffffffffffc70 EFLAGS: 00010217 [ 165.997268][T11906] RAX: 0000000000000000 RBX: 00007f61c9226090 RCX: 00007f61c8f9e019 [ 165.997275][T11906] RDX: 0000000000000000 RSI: fffffffffffffc70 RDI: 0000000001022000 [ 165.997281][T11906] RBP: 00007f61c903500c R08: 0000000000000000 R09: 0000000000000000 [ 165.997288][T11906] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 165.997294][T11906] R13: 00007f61c9226128 R14: 00007f61c9226090 R15: 00007ffc24e46a28 [ 165.997308][T11906] [ 166.028643][T11951] team0: Port device team_slave_0 added [ 166.053038][T11906] memory: usage 307200kB, limit 307200kB, failcnt 22799 [ 166.176877][T11906] memory+swap: usage 423208kB, limit 9007199254740988kB, failcnt 0 [ 166.190506][T11906] kmem: usage 15812kB, limit 9007199254740988kB, failcnt 0 [ 166.194388][T11906] Memory cgroup stats for /syz0: [ 166.194588][T11906] cache 291651584 [ 166.198783][T11906] rss 172032 [ 166.200040][T11906] rss_huge 0 [ 166.211874][T11906] shmem 289562624 [ 166.213489][T11906] mapped_file 262144 [ 166.224163][T11951] team0: Port device team_slave_1 added [ 166.226337][T11906] dirty 0 [ 166.227534][T11906] writeback 0 [ 166.229779][T11906] workingset_refault_anon 5 [ 166.255445][T11906] workingset_refault_file 3211 [ 166.257144][T11906] swap 125640704 [ 166.258281][T11906] swapcached 165441536 [ 166.266364][T11906] pgpgin 319014 [ 166.267549][T11906] pgpgout 247768 [ 166.281378][T11906] pgfault 115866 [ 166.282556][T11906] pgmajfault 20 [ 166.285101][T11906] inactive_anon 137490432 [ 166.287066][T11906] active_anon 152158208 [ 166.288414][T11906] inactive_file 0 [ 166.289633][T11906] active_file 2084864 [ 166.290897][T11906] unevictable 0 [ 166.292035][T11906] hierarchical_memory_limit 314572800 [ 166.293755][T11906] hierarchical_memsw_limit 9223372036854771712 [ 166.295698][T11906] total_cache 291651584 [ 166.295842][T11951] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 166.299820][T11906] total_rss 172032 [ 166.302493][T11906] total_rss_huge 0 [ 166.303112][T11951] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 166.303731][T11906] total_shmem 289562624 [ 166.303738][T11906] total_mapped_file 262144 [ 166.303743][T11906] total_dirty 0 [ 166.318625][T11951] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 166.326510][T11906] total_writeback 0 [ 166.327808][T11906] total_workingset_refault_anon 5 [ 166.329537][T11906] total_workingset_refault_file 3211 [ 166.331336][T11906] total_swap 125640704 [ 166.332666][T11906] total_swapcached 165441536 [ 166.338322][T11906] total_pgpgin 319014 [ 166.339608][T11906] total_pgpgout 247768 [ 166.342946][T11906] total_pgfault 115866 [ 166.343102][T11951] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 166.344392][T11906] total_pgmajfault 20 [ 166.349679][T11951] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 166.355456][T11906] total_inactive_anon 137490432 [ 166.362289][T11906] total_active_anon 152158208 [ 166.366457][T11906] total_inactive_file 0 [ 166.367934][T11951] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 166.368254][T11906] total_active_file 2084864 [ 166.373100][T12045] syzkaller0: entered promiscuous mode [ 166.377268][T12045] syzkaller0: entered allmulticast mode [ 166.397129][T11906] total_unevictable 0 [ 166.398985][T11906] anon_cost 0 [ 166.400648][T11906] file_cost 0 [ 166.402050][T11906] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.1791,pid=11882,uid=0 [ 166.422092][T11906] Memory cgroup out of memory: Killed process 11882 (syz.0.1791) total-vm:98676kB, anon-rss:1268kB, file-rss:57412kB, shmem-rss:0kB, UID:0 pgtables:216kB oom_score_adj:0 [ 166.459245][T12007] syz.0.1818 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 166.464988][T12007] CPU: 1 UID: 0 PID: 12007 Comm: syz.0.1818 Tainted: G L syzkaller #0 PREEMPT(full) [ 166.465007][T12007] Tainted: [L]=SOFTLOCKUP [ 166.465011][T12007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 166.465017][T12007] Call Trace: [ 166.465021][T12007] [ 166.465025][T12007] dump_stack_lvl+0x100/0x190 [ 166.465043][T12007] dump_header+0xfb/0x606 [ 166.465056][T12007] oom_kill_process.cold+0xd/0x330 [ 166.465069][T12007] out_of_memory+0x340/0x14f0 [ 166.465089][T12007] ? __pfx_out_of_memory+0x10/0x10 [ 166.465109][T12007] mem_cgroup_out_of_memory+0xc6/0x130 [ 166.465121][T12007] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 166.465132][T12007] ? find_held_lock+0x2b/0x80 [ 166.465144][T12007] ? do_raw_spin_unlock+0x145/0x1e0 [ 166.465160][T12007] ? _raw_spin_unlock+0x28/0x50 [ 166.465173][T12007] try_charge_memcg+0x6e5/0xdf0 [ 166.465190][T12007] ? __pfx_try_charge_memcg+0x10/0x10 [ 166.465205][T12007] ? find_held_lock+0x2b/0x80 [ 166.465214][T12007] ? rcu_read_unlock+0x17/0x60 [ 166.465229][T12007] ? rcu_read_unlock+0x17/0x60 [ 166.465248][T12007] __memcg_slab_post_alloc_hook+0x469/0x1160 [ 166.465269][T12007] ? kasan_save_track+0x14/0x30 [ 166.465283][T12007] kmem_cache_alloc_noprof+0x587/0x6a0 [ 166.465296][T12007] ? mas_next_range+0x9b/0xf0 [ 166.465311][T12007] ? vm_area_alloc+0x1f/0x160 [ 166.465331][T12007] vm_area_alloc+0x1f/0x160 [ 166.465347][T12007] __mmap_region+0x1033/0x2db0 [ 166.465361][T12007] ? __pfx___mmap_region+0x10/0x10 [ 166.465370][T12007] ? __lock_acquire+0x49f/0x1a40 [ 166.465383][T12007] ? find_held_lock+0x2b/0x80 [ 166.465394][T12007] ? __lock_acquire+0x49f/0x1a40 [ 166.465416][T12007] ? mas_prev_slot+0x760/0x1d20 [ 166.465442][T12007] ? unmapped_area_topdown+0x54e/0x6a0 [ 166.465474][T12007] ? filemap_map_pages+0x1137/0x1fe0 [ 166.465494][T12007] mmap_region+0x35d/0x620 [ 166.465507][T12007] ? __pfx_mmap_region+0x10/0x10 [ 166.465518][T12007] ? mm_get_unmapped_area_vmflags+0xd7/0x130 [ 166.465533][T12007] ? selinux_mmap_addr+0x2b/0x110 [ 166.465548][T12007] ? bpf_lsm_mmap_addr+0x9/0x30 [ 166.465566][T12007] ? security_mmap_addr+0x71/0x1e0 [ 166.465577][T12007] ? __get_unmapped_area+0x255/0x3e0 [ 166.465593][T12007] do_mmap+0xc63/0x12f0 [ 166.465609][T12007] ? __pfx_do_mmap+0x10/0x10 [ 166.465624][T12007] ? __pfx_down_write_killable+0x10/0x10 [ 166.465657][T12007] vm_mmap_pgoff+0x29e/0x470 [ 166.465674][T12007] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 166.465688][T12007] ? ktime_expiry_to_cycles+0x3c/0x2c0 [ 166.465707][T12007] ? clockevents_program_event+0x1ef/0x820 [ 166.465726][T12007] ksys_mmap_pgoff+0xe4/0x610 [ 166.465742][T12007] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 166.465754][T12007] ? __hrtimer_rearm_deferred+0x23c/0x720 [ 166.465765][T12007] ? __hrtimer_rearm_deferred+0x23c/0x720 [ 166.465779][T12007] __x64_sys_mmap+0x125/0x190 [ 166.465797][T12007] do_syscall_64+0x115/0x870 [ 166.465810][T12007] ? clear_bhb_loop+0x40/0x90 [ 166.465823][T12007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.465835][T12007] RIP: 0033:0x7f61c8f9dd82 [ 166.465849][T12007] Code: 4f 01 00 0f 1f 44 00 00 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 3b 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6e 5b 5d c3 0f 1f 00 48 c7 c0 e8 ff ff ff 64 [ 166.465863][T12007] RSP: 002b:00007ffc24e469b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 166.465881][T12007] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f61c8f9dd82 [ 166.465894][T12007] RDX: 0000000000000000 RSI: 0000000000021000 RDI: 0000000000000000 [ 166.465905][T12007] RBP: 0000000000020022 R08: 00000000ffffffff R09: 0000000000000000 [ 166.465914][T12007] R10: 0000000000020022 R11: 0000000000000246 R12: 00007ffc24e46b20 [ 166.465921][T12007] R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000 [ 166.465936][T12007] [ 166.465994][T12007] memory: usage 307200kB, limit 307200kB, failcnt 23639 [ 166.612158][T12007] memory+swap: usage 430736kB, limit 9007199254740988kB, failcnt 0 [ 166.615436][T12007] kmem: usage 15732kB, limit 9007199254740988kB, failcnt 0 [ 166.619926][T12007] Memory cgroup stats for /syz0: [ 166.628397][T12007] cache 298258432 [ 166.636476][T12007] rss 172032 [ 166.637889][T12007] rss_huge 0 [ 166.639274][T12007] shmem 298258432 [ 166.641372][T12007] mapped_file 0 [ 166.642896][T12007] dirty 0 [ 166.644253][T12007] writeback 0 [ 166.645658][T12007] workingset_refault_anon 5 [ 166.647830][T12007] workingset_refault_file 3211 [ 166.649800][T12007] swap 126185472 [ 166.651360][T12007] swapcached 166313984 [ 166.653032][T12007] pgpgin 323201 [ 166.654467][T12007] pgpgout 250342 [ 166.655935][T12007] pgfault 117417 [ 166.657489][T12007] pgmajfault 21 [ 166.658927][T12007] inactive_anon 152211456 [ 166.660684][T12007] active_anon 146219008 [ 166.662443][T12007] inactive_file 0 [ 166.664001][T12007] active_file 0 [ 166.665441][T12007] unevictable 0 [ 166.667025][T12007] hierarchical_memory_limit 314572800 [ 166.669348][T12007] hierarchical_memsw_limit 9223372036854771712 [ 166.671898][T12007] total_cache 298258432 [ 166.673625][T12007] total_rss 172032 [ 166.675084][T12007] total_rss_huge 0 [ 166.676829][T12007] total_shmem 298258432 [ 166.678559][T12007] total_mapped_file 0 [ 166.680275][T12007] total_dirty 0 [ 166.681740][T12007] total_writeback 0 [ 166.690408][T12007] total_workingset_refault_anon 5 [ 166.692527][T12007] total_workingset_refault_file 3211 [ 166.694763][T12007] total_swap 126185472 [ 166.696621][T12007] total_swapcached 166313984 [ 166.698572][T12007] total_pgpgin 323201 [ 166.700405][T12007] total_pgpgout 250342 [ 166.701188][ T5445] 8021q: adding VLAN 0 to HW filter on device eth4 [ 166.702127][T12007] total_pgfault 117417 [ 166.713927][T12007] total_pgmajfault 21 [ 166.715665][T12007] total_inactive_anon 152211456 [ 166.728454][T12007] total_active_anon 146219008 [ 166.730248][T12007] total_inactive_file 0 [ 166.731909][T12007] total_active_file 0 [ 166.733380][T12007] total_unevictable 0 [ 166.734925][T12007] anon_cost 0 [ 166.736212][T12007] file_cost 0 [ 166.738297][T12007] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.1791,pid=11892,uid=0 [ 166.747393][T12007] Memory cgroup out of memory: Killed process 11892 (syz.0.1791) total-vm:98676kB, anon-rss:1268kB, file-rss:57412kB, shmem-rss:0kB, UID:0 pgtables:216kB oom_score_adj:0 [ 166.755745][T11951] hsr_slave_0: entered promiscuous mode [ 166.769703][T11951] hsr_slave_1: entered promiscuous mode [ 166.774937][T11951] debugfs: 'hsr0' already exists in 'hsr' [ 166.777032][T11951] Cannot create hsr debugfs directory [ 166.868129][T12062] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1818'. [ 166.875759][ T5786] hsr_slave_0: left promiscuous mode [ 166.882829][ T5786] hsr_slave_1: left promiscuous mode [ 166.887655][ T5786] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 166.890154][ T5786] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 166.918768][ T5786] veth1_macvtap: left allmulticast mode [ 166.921244][ T5786] veth1_macvtap: left promiscuous mode [ 166.923098][ T5786] veth0_macvtap: left promiscuous mode [ 166.925987][ T5786] veth1_vlan: left promiscuous mode [ 166.927876][ T5786] veth0_vlan: left promiscuous mode [ 167.417624][ T5739] Bluetooth: hci1: command tx timeout [ 167.546700][T11901] syz.0.1791 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 167.550072][T11901] CPU: 0 UID: 0 PID: 11901 Comm: syz.0.1791 Tainted: G L syzkaller #0 PREEMPT(full) [ 167.550091][T11901] Tainted: [L]=SOFTLOCKUP [ 167.550095][T11901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 167.550102][T11901] Call Trace: [ 167.550107][T11901] [ 167.550111][T11901] dump_stack_lvl+0x100/0x190 [ 167.550130][T11901] dump_header+0xfb/0x606 [ 167.550147][T11901] oom_kill_process.cold+0xd/0x330 [ 167.550167][T11901] out_of_memory+0x340/0x14f0 [ 167.550201][T11901] ? __pfx_out_of_memory+0x10/0x10 [ 167.550233][T11901] mem_cgroup_out_of_memory+0xc6/0x130 [ 167.550252][T11901] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 167.550271][T11901] ? find_held_lock+0x2b/0x80 [ 167.550291][T11901] ? do_raw_spin_unlock+0x145/0x1e0 [ 167.550317][T11901] ? _raw_spin_unlock+0x28/0x50 [ 167.550339][T11901] try_charge_memcg+0x6e5/0xdf0 [ 167.550367][T11901] ? __pfx_try_charge_memcg+0x10/0x10 [ 167.550388][T11901] ? find_held_lock+0x2b/0x80 [ 167.550404][T11901] ? rcu_read_unlock+0x17/0x60 [ 167.550429][T11901] ? rcu_read_unlock+0x17/0x60 [ 167.550451][T11901] ? find_held_lock+0x2b/0x80 [ 167.550464][T11901] ? rcu_read_unlock+0x17/0x60 [ 167.550492][T11901] charge_memcg+0x187/0x1e0 [ 167.550515][T11901] __mem_cgroup_charge+0x2b/0x1c0 [ 167.550543][T11901] shmem_alloc_and_add_folio+0x451/0xd40 [ 167.550567][T11901] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 167.550586][T11901] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 167.550609][T11901] shmem_get_folio_gfp+0x6ad/0x1910 [ 167.550629][T11901] ? __lock_acquire+0x49f/0x1a40 [ 167.550648][T11901] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 167.550672][T11901] shmem_write_begin+0x1a4/0x420 [ 167.550692][T11901] ? __pfx_shmem_write_begin+0x10/0x10 [ 167.550710][T11901] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 167.550730][T11901] ? lockdep_hardirqs_on+0x78/0x100 [ 167.550753][T11901] generic_perform_write+0x292/0xa40 [ 167.550785][T11901] ? __pfx_generic_perform_write+0x10/0x10 [ 167.550811][T11901] ? file_update_time_flags+0x373/0x500 [ 167.550838][T11901] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 167.550860][T11901] shmem_file_write_iter+0x10e/0x140 [ 167.550888][T11901] __kernel_write_iter+0x2ac/0x930 [ 167.550918][T11901] ? __pfx___kernel_write_iter+0x10/0x10 [ 167.550941][T11901] ? __up_read+0x333/0x980 [ 167.550957][T11901] ? dump_user_range+0x65e/0xad0 [ 167.550976][T11901] dump_user_range+0x3f9/0xad0 [ 167.551002][T11901] ? __pfx_dump_user_range+0x10/0x10 [ 167.551032][T11901] ? __pfx_writenote+0x10/0x10 [ 167.551054][T11901] ? elf_core_dump+0x1f25/0x3d20 [ 167.551085][T11901] elf_core_dump+0x2d68/0x3d20 [ 167.551123][T11901] ? __pfx_elf_core_dump+0x10/0x10 [ 167.551144][T11901] ? kasan_save_stack+0x3f/0x50 [ 167.551164][T11901] ? kasan_save_stack+0x30/0x50 [ 167.551184][T11901] ? kasan_save_track+0x14/0x30 [ 167.551202][T11901] ? __kasan_kmalloc+0xaa/0xb0 [ 167.551218][T11901] ? vfs_coredump+0x22a6/0x56f0 [ 167.551240][T11901] ? get_signal+0x1f2a/0x21e0 [ 167.551261][T11901] ? arch_do_signal_or_restart+0x91/0x7e0 [ 167.551284][T11901] ? 0xffffffffff600000 [ 167.551334][T11901] ? vfs_coredump+0x294b/0x56f0 [ 167.551357][T11901] vfs_coredump+0x294b/0x56f0 [ 167.551388][T11901] ? __pfx_vfs_coredump+0x10/0x10 [ 167.551413][T11901] ? __lock_acquire+0x49f/0x1a40 [ 167.551460][T11901] ? bpf_ksym_find+0x128/0x1c0 [ 167.551492][T11901] ? unwind_get_return_address+0x59/0xa0 [ 167.551513][T11901] ? arch_stack_walk+0xa6/0xf0 [ 167.551548][T11901] ? __sigqueue_free+0xbe/0x2a0 [ 167.551565][T11901] ? stack_trace_save+0x8e/0xc0 [ 167.551583][T11901] ? __pfx_stack_trace_save+0x10/0x10 [ 167.551602][T11901] ? stack_depot_save_flags+0x27/0x9d0 [ 167.551670][T11901] ? proc_coredump_connector+0x2d3/0x4f0 [ 167.551692][T11901] ? __pfx_proc_coredump_connector+0x10/0x10 [ 167.551739][T11901] ? rcu_is_watching+0x12/0xc0 [ 167.551770][T11901] get_signal+0x1f2a/0x21e0 [ 167.551800][T11901] ? __pfx_get_signal+0x10/0x10 [ 167.551830][T11901] arch_do_signal_or_restart+0x91/0x7e0 [ 167.551853][T11901] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 167.551892][T11901] irqentry_exit+0x402/0xa00 [ 167.551918][T11901] asm_exc_page_fault+0x26/0x30 [ 167.551935][T11901] RIP: 0033:0x7f61c8f9e021 [ 167.551951][T11901] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 167.551967][T11901] RSP: 002b:fffffffffffffc70 EFLAGS: 00010217 [ 167.551982][T11901] RAX: 0000000000000000 RBX: 00007f61c9226090 RCX: 00007f61c8f9e019 [ 167.551993][T11901] RDX: 0000000000000000 RSI: fffffffffffffc70 RDI: 0000000001022000 [ 167.552004][T11901] RBP: 00007f61c903500c R08: 0000000000000000 R09: 0000000000000000 [ 167.552014][T11901] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 167.552024][T11901] R13: 00007f61c9226128 R14: 00007f61c9226090 R15: 00007ffc24e46a28 [ 167.552049][T11901] [ 167.552056][T11901] memory: usage 307024kB, limit 307200kB, failcnt 27349 [ 167.591403][T11951] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 167.592930][T11901] memory+swap: usage 430496kB, limit 9007199254740988kB, failcnt 0 [ 167.723266][T11951] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 167.730803][T11951] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 167.734968][T11901] kmem: usage 15708kB, limit 9007199254740988kB, failcnt 0 [ 167.755011][T11901] Memory cgroup stats for /syz0: [ 167.755119][T11901] cache 297631744 [ 167.762967][T11901] rss 94208 [ 167.763385][T11951] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 167.764027][T11901] rss_huge 0 [ 167.764035][T11901] shmem 297271296 [ 167.768054][T11951] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 167.787387][T11901] mapped_file 4096 [ 167.792353][T11901] dirty 0 [ 167.793139][T11951] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 167.794234][T11901] writeback 0 [ 167.796664][T11951] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 167.799354][T11901] workingset_refault_anon 5 [ 167.800909][T11901] workingset_refault_file 3808 [ 167.805677][T11901] swap 126763008 [ 167.809343][T11901] swapcached 189534208 [ 167.812136][T11901] pgpgin 347201 [ 167.813528][T11901] pgpgout 274514 [ 167.818212][T11901] pgfault 119048 [ 167.819358][T11901] pgmajfault 23 [ 167.822722][T11901] inactive_anon 89780224 [ 167.824070][T11901] active_anon 207581184 [ 167.830543][T11951] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 167.830658][T11901] inactive_file 200704 [ 167.836053][T11901] active_file 114688 [ 167.838379][T11901] unevictable 0 [ 167.841308][T11901] hierarchical_memory_limit 314572800 [ 167.853996][T11901] hierarchical_memsw_limit 9223372036854771712 [ 167.859884][T11901] total_cache 297631744 [ 167.861245][T11901] total_rss 94208 [ 167.864286][T11901] total_rss_huge 0 [ 167.865523][T11901] total_shmem 297271296 [ 167.869968][T11901] total_mapped_file 4096 [ 167.871355][T11901] total_dirty 0 [ 167.875198][T11901] total_writeback 0 [ 167.877972][T11901] total_workingset_refault_anon 5 [ 167.880737][T11901] total_workingset_refault_file 3808 [ 167.882402][T11901] total_swap 126763008 [ 167.887601][T11901] total_swapcached 189534208 [ 167.889106][T11901] total_pgpgin 347201 [ 167.893046][T11901] total_pgpgout 274514 [ 167.894340][T11901] total_pgfault 119048 [ 167.900481][T11901] total_pgmajfault 23 [ 167.901797][T11901] total_inactive_anon 89780224 [ 167.906498][T11901] total_active_anon 207581184 [ 167.908007][T11901] total_inactive_file 200704 [ 167.912125][T11901] total_active_file 114688 [ 167.913559][T11901] total_unevictable 0 [ 167.917990][T11901] anon_cost 0 [ 167.921170][T11901] file_cost 0 [ 167.925604][T11901] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.1791,pid=11886,uid=0 [ 167.944397][T11951] 8021q: adding VLAN 0 to HW filter on device bond0 [ 167.950350][T11901] Memory cgroup out of memory: Killed process 11886 (syz.0.1791) total-vm:98676kB, anon-rss:1268kB, file-rss:57412kB, shmem-rss:0kB, UID:0 pgtables:216kB oom_score_adj:0 [ 167.960913][T11951] 8021q: adding VLAN 0 to HW filter on device team0 [ 167.970341][T11831] bridge0: port 1(bridge_slave_0) entered blocking state [ 167.972543][T11831] bridge0: port 1(bridge_slave_0) entered forwarding state [ 167.984078][T11831] bridge0: port 2(bridge_slave_1) entered blocking state [ 167.986365][T11831] bridge0: port 2(bridge_slave_1) entered forwarding state [ 167.995977][T12094] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 168.002396][T12095] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 168.002473][T12094] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 168.027495][T11902] syz.0.1791 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 168.090109][T11902] CPU: 2 UID: 0 PID: 11902 Comm: syz.0.1791 Tainted: G L syzkaller #0 PREEMPT(full) [ 168.090138][T11902] Tainted: [L]=SOFTLOCKUP [ 168.090145][T11902] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 168.090154][T11902] Call Trace: [ 168.090159][T11902] [ 168.090164][T11902] dump_stack_lvl+0x100/0x190 [ 168.090193][T11902] dump_header+0xfb/0x606 [ 168.090214][T11902] oom_kill_process.cold+0xd/0x330 [ 168.090236][T11902] out_of_memory+0x340/0x14f0 [ 168.090268][T11902] ? __pfx_out_of_memory+0x10/0x10 [ 168.090296][T11902] mem_cgroup_out_of_memory+0xc6/0x130 [ 168.090315][T11902] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 168.090333][T11902] ? find_held_lock+0x2b/0x80 [ 168.090354][T11902] ? do_raw_spin_unlock+0x145/0x1e0 [ 168.090380][T11902] ? _raw_spin_unlock+0x28/0x50 [ 168.090401][T11902] try_charge_memcg+0x6e5/0xdf0 [ 168.090430][T11902] ? __pfx_try_charge_memcg+0x10/0x10 [ 168.090453][T11902] ? find_held_lock+0x2b/0x80 [ 168.090474][T11902] ? rcu_read_unlock+0x17/0x60 [ 168.090499][T11902] ? rcu_read_unlock+0x17/0x60 [ 168.090523][T11902] ? find_held_lock+0x2b/0x80 [ 168.090539][T11902] ? rcu_read_unlock+0x17/0x60 [ 168.090569][T11902] charge_memcg+0x187/0x1e0 [ 168.090594][T11902] __mem_cgroup_charge+0x2b/0x1c0 [ 168.090623][T11902] shmem_alloc_and_add_folio+0x451/0xd40 [ 168.090647][T11902] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 168.090668][T11902] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 168.090692][T11902] shmem_get_folio_gfp+0x6ad/0x1910 [ 168.090713][T11902] ? __lock_acquire+0x49f/0x1a40 [ 168.090735][T11902] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 168.090760][T11902] shmem_write_begin+0x1a4/0x420 [ 168.090782][T11902] ? __pfx_shmem_write_begin+0x10/0x10 [ 168.090802][T11902] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 168.090823][T11902] ? lockdep_hardirqs_on+0x78/0x100 [ 168.090847][T11902] generic_perform_write+0x292/0xa40 [ 168.090879][T11902] ? __pfx_generic_perform_write+0x10/0x10 [ 168.090909][T11902] ? file_update_time_flags+0x373/0x500 [ 168.090932][T11902] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 168.090950][T11902] shmem_file_write_iter+0x10e/0x140 [ 168.090973][T11902] __kernel_write_iter+0x2ac/0x930 [ 168.091003][T11902] ? __pfx___kernel_write_iter+0x10/0x10 [ 168.091030][T11902] ? __up_read+0x333/0x980 [ 168.091056][T11902] ? dump_user_range+0x65e/0xad0 [ 168.091075][T11902] ? copy_mc_enhanced_fast_string+0x6/0xf [ 168.091106][T11902] dump_user_range+0x3f9/0xad0 [ 168.091133][T11902] ? __pfx_dump_user_range+0x10/0x10 [ 168.091166][T11902] ? __pfx_writenote+0x10/0x10 [ 168.091190][T11902] ? elf_core_dump+0x1f25/0x3d20 [ 168.091219][T11902] elf_core_dump+0x2d68/0x3d20 [ 168.091258][T11902] ? __pfx_elf_core_dump+0x10/0x10 [ 168.091281][T11902] ? kasan_save_stack+0x3f/0x50 [ 168.091297][T11902] ? kasan_save_stack+0x30/0x50 [ 168.091315][T11902] ? kasan_save_track+0x14/0x30 [ 168.091333][T11902] ? __kasan_kmalloc+0xaa/0xb0 [ 168.091352][T11902] ? vfs_coredump+0x22a6/0x56f0 [ 168.091389][T11902] ? get_signal+0x1f2a/0x21e0 [ 168.091412][T11902] ? arch_do_signal_or_restart+0x91/0x7e0 [ 168.091436][T11902] ? 0xffffffffff600000 [ 168.091497][T11902] ? vfs_coredump+0x294b/0x56f0 [ 168.091519][T11902] vfs_coredump+0x294b/0x56f0 [ 168.091548][T11902] ? __pfx_vfs_coredump+0x10/0x10 [ 168.091573][T11902] ? __lock_acquire+0x49f/0x1a40 [ 168.091618][T11902] ? bpf_ksym_find+0x128/0x1c0 [ 168.091652][T11902] ? unwind_get_return_address+0x59/0xa0 [ 168.091671][T11902] ? arch_stack_walk+0xa6/0xf0 [ 168.091728][T11902] ? __sigqueue_free+0xbe/0x2a0 [ 168.091743][T11902] ? stack_trace_save+0x8e/0xc0 [ 168.091761][T11902] ? __pfx_stack_trace_save+0x10/0x10 [ 168.091780][T11902] ? stack_depot_save_flags+0x27/0x9d0 [ 168.091848][T11902] ? proc_coredump_connector+0x2d3/0x4f0 [ 168.091868][T11902] ? __pfx_proc_coredump_connector+0x10/0x10 [ 168.091892][T11902] ? rcu_is_watching+0x12/0xc0 [ 168.091922][T11902] get_signal+0x1f2a/0x21e0 [ 168.091955][T11902] ? __pfx_get_signal+0x10/0x10 [ 168.091984][T11902] arch_do_signal_or_restart+0x91/0x7e0 [ 168.092005][T11902] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 168.092039][T11902] irqentry_exit+0x402/0xa00 [ 168.092065][T11902] asm_exc_page_fault+0x26/0x30 [ 168.092082][T11902] RIP: 0033:0x7f61c8f9e021 [ 168.092097][T11902] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 168.092113][T11902] RSP: 002b:fffffffffffffc70 EFLAGS: 00010217 [ 168.092128][T11902] RAX: 0000000000000000 RBX: 00007f61c9226090 RCX: 00007f61c8f9e019 [ 168.092138][T11902] RDX: 0000000000000000 RSI: fffffffffffffc70 RDI: 0000000001022000 [ 168.092149][T11902] RBP: 00007f61c903500c R08: 0000000000000000 R09: 0000000000000000 [ 168.092159][T11902] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 168.092169][T11902] R13: 00007f61c9226128 R14: 00007f61c9226090 R15: 00007ffc24e46a28 [ 168.092193][T11902] [ 168.092229][T11902] memory: usage 307200kB, limit 307200kB, failcnt 28523 [ 168.104149][T12103] syzkaller0: entered promiscuous mode [ 168.107694][T11902] memory+swap: usage 430980kB, limit 9007199254740988kB, failcnt 0 [ 168.114134][T12103] syzkaller0: entered allmulticast mode [ 168.114856][T11902] kmem: usage 15460kB, limit 9007199254740988kB, failcnt 0 [ 168.114873][T11902] Memory cgroup stats for /syz0: [ 168.349670][T11902] cache 281104384 [ 168.367490][T11902] rss 139264 [ 168.371669][T11902] rss_huge 0 [ 168.373128][T11902] shmem 280174592 [ 168.377145][T11902] mapped_file 12288 [ 168.378949][T11902] dirty 4096 [ 168.396425][T11902] writeback 0 [ 168.397871][T11902] workingset_refault_anon 5 [ 168.399736][T11902] workingset_refault_file 3981 [ 168.409834][T11902] swap 115298304 [ 168.411476][T11902] swapcached 194867200 [ 168.416186][T11902] pgpgin 353065 [ 168.421601][T11902] pgpgout 284397 [ 168.424884][T11902] pgfault 119430 [ 168.428539][T11902] pgmajfault 25 [ 168.429799][T11902] inactive_anon 50487296 [ 168.431208][T11902] active_anon 228536320 [ 168.432622][T11902] inactive_file 0 [ 168.433891][T11902] active_file 929792 [ 168.435254][T11902] unevictable 0 [ 168.436614][T11902] hierarchical_memory_limit 314572800 [ 168.438302][T11902] hierarchical_memsw_limit 9223372036854771712 [ 168.440222][T11902] total_cache 281104384 [ 168.441537][T11902] total_rss 139264 [ 168.442895][T11902] total_rss_huge 0 [ 168.444133][T11902] total_shmem 280174592 [ 168.445561][T11902] total_mapped_file 12288 [ 168.446990][T11902] total_dirty 4096 [ 168.448229][T11902] total_writeback 0 [ 168.449472][T11902] total_workingset_refault_anon 5 [ 168.451083][T11902] total_workingset_refault_file 3981 [ 168.453028][T11902] total_swap 115298304 [ 168.454351][T11902] total_swapcached 194867200 [ 168.455938][T11902] total_pgpgin 353065 [ 168.457156][T11902] total_pgpgout 284397 [ 168.458331][T11902] total_pgfault 119430 [ 168.459467][T11902] total_pgmajfault 25 [ 168.460782][T11902] total_inactive_anon 50487296 [ 168.462290][T11902] total_active_anon 228536320 [ 168.462760][ T5786] IPVS: stop unused estimator thread 0... [ 168.463777][T11902] total_inactive_file 0 [ 168.463784][T11902] total_active_file 929792 [ 168.463789][T11902] total_unevictable 0 [ 168.463794][T11902] anon_cost 0 [ 168.463798][T11902] file_cost 0 [ 168.463804][T11902] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.1791,pid=11908,uid=0 [ 168.480500][T11902] Memory cgroup out of memory: Killed process 11908 (syz.0.1791) total-vm:98676kB, anon-rss:1248kB, file-rss:57412kB, shmem-rss:0kB, UID:0 pgtables:216kB oom_score_adj:0 [ 168.550700][T11951] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 168.698728][T11951] veth0_vlan: entered promiscuous mode [ 168.705222][T11951] veth1_vlan: entered promiscuous mode [ 168.721882][T11951] veth0_macvtap: entered promiscuous mode [ 168.729323][T11951] veth1_macvtap: entered promiscuous mode [ 168.740190][T11951] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 168.746173][T11951] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 168.786354][ T8165] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 168.789520][ T8165] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 168.791196][ T34] hid (null): global environment stack underflow [ 168.791826][T12105] CIFS mount error: No usable UNC path provided in device string! [ 168.791826][T12105] [ 168.792071][T12105] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 168.792249][ T8165] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 168.792271][ T8165] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 168.891874][ T34] hid-generic 616F:20C2607D:F72986D9.0005: global environment stack underflow [ 168.904596][ T34] hid-generic 616F:20C2607D:F72986D9.0005: item 0 1 1 11 parsing failed [ 168.911269][ T34] hid-generic 616F:20C2607D:F72986D9.0005: probe with driver hid-generic failed with error -22 [ 168.931302][T11832] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 168.933902][T11832] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 168.963775][T11832] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 168.967801][T11832] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 169.158057][T12136] netlink: 'syz.4.1817': attribute type 1 has an invalid length. [ 169.364190][T11907] syz.0.1791 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 169.386376][T11907] CPU: 2 UID: 0 PID: 11907 Comm: syz.0.1791 Tainted: G L syzkaller #0 PREEMPT(full) [ 169.386410][T11907] Tainted: [L]=SOFTLOCKUP [ 169.386416][T11907] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 169.386426][T11907] Call Trace: [ 169.386433][T11907] [ 169.386440][T11907] dump_stack_lvl+0x100/0x190 [ 169.386469][T11907] dump_header+0xfb/0x606 [ 169.386489][T11907] oom_kill_process.cold+0xd/0x330 [ 169.386509][T11907] out_of_memory+0x340/0x14f0 [ 169.386542][T11907] ? __pfx_out_of_memory+0x10/0x10 [ 169.386574][T11907] mem_cgroup_out_of_memory+0xc6/0x130 [ 169.386594][T11907] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 169.386611][T11907] ? find_held_lock+0x2b/0x80 [ 169.386632][T11907] ? do_raw_spin_unlock+0x145/0x1e0 [ 169.386658][T11907] ? _raw_spin_unlock+0x28/0x50 [ 169.386677][T11907] try_charge_memcg+0x6e5/0xdf0 [ 169.386709][T11907] ? __pfx_try_charge_memcg+0x10/0x10 [ 169.386732][T11907] ? find_held_lock+0x2b/0x80 [ 169.386749][T11907] ? rcu_read_unlock+0x17/0x60 [ 169.386773][T11907] ? rcu_read_unlock+0x17/0x60 [ 169.386796][T11907] ? find_held_lock+0x2b/0x80 [ 169.386812][T11907] ? rcu_read_unlock+0x17/0x60 [ 169.386840][T11907] charge_memcg+0x187/0x1e0 [ 169.386866][T11907] __mem_cgroup_charge+0x2b/0x1c0 [ 169.386892][T11907] shmem_alloc_and_add_folio+0x451/0xd40 [ 169.386914][T11907] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 169.386935][T11907] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 169.386959][T11907] shmem_get_folio_gfp+0x6ad/0x1910 [ 169.386979][T11907] ? __lock_acquire+0x49f/0x1a40 [ 169.387000][T11907] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 169.387023][T11907] shmem_write_begin+0x1a4/0x420 [ 169.387044][T11907] ? __pfx_shmem_write_begin+0x10/0x10 [ 169.387065][T11907] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 169.387089][T11907] generic_perform_write+0x292/0xa40 [ 169.387124][T11907] ? __pfx_generic_perform_write+0x10/0x10 [ 169.387153][T11907] ? file_update_time_flags+0x373/0x500 [ 169.387179][T11907] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 169.387199][T11907] shmem_file_write_iter+0x10e/0x140 [ 169.387222][T11907] __kernel_write_iter+0x2ac/0x930 [ 169.387250][T11907] ? __pfx___kernel_write_iter+0x10/0x10 [ 169.387275][T11907] ? __up_read+0x333/0x980 [ 169.387298][T11907] ? dump_user_range+0x65e/0xad0 [ 169.387329][T11907] dump_user_range+0x3f9/0xad0 [ 169.387358][T11907] ? __pfx_dump_user_range+0x10/0x10 [ 169.387397][T11907] ? __pfx_writenote+0x10/0x10 [ 169.387422][T11907] ? elf_core_dump+0x1f25/0x3d20 [ 169.387451][T11907] elf_core_dump+0x2d68/0x3d20 [ 169.387488][T11907] ? __pfx_elf_core_dump+0x10/0x10 [ 169.387511][T11907] ? kasan_save_stack+0x3f/0x50 [ 169.387532][T11907] ? kasan_save_stack+0x30/0x50 [ 169.387551][T11907] ? kasan_save_track+0x14/0x30 [ 169.387572][T11907] ? __kasan_kmalloc+0xaa/0xb0 [ 169.387590][T11907] ? vfs_coredump+0x22a6/0x56f0 [ 169.387610][T11907] ? get_signal+0x1f2a/0x21e0 [ 169.387630][T11907] ? arch_do_signal_or_restart+0x91/0x7e0 [ 169.387656][T11907] ? 0xffffffffff600000 [ 169.387733][T11907] ? vfs_coredump+0x294b/0x56f0 [ 169.387757][T11907] vfs_coredump+0x294b/0x56f0 [ 169.387789][T11907] ? __pfx_vfs_coredump+0x10/0x10 [ 169.387814][T11907] ? __lock_acquire+0x49f/0x1a40 [ 169.387858][T11907] ? bpf_ksym_find+0x128/0x1c0 [ 169.387891][T11907] ? unwind_get_return_address+0x59/0xa0 [ 169.387912][T11907] ? arch_stack_walk+0xa6/0xf0 [ 169.387948][T11907] ? __sigqueue_free+0xbe/0x2a0 [ 169.387964][T11907] ? stack_trace_save+0x8e/0xc0 [ 169.387985][T11907] ? __pfx_stack_trace_save+0x10/0x10 [ 169.388001][T11907] ? stack_depot_save_flags+0x27/0x9d0 [ 169.388068][T11907] ? proc_coredump_connector+0x2d3/0x4f0 [ 169.388086][T11907] ? __pfx_proc_coredump_connector+0x10/0x10 [ 169.388110][T11907] ? rcu_is_watching+0x12/0xc0 [ 169.388141][T11907] get_signal+0x1f2a/0x21e0 [ 169.388189][T11907] ? __pfx_get_signal+0x10/0x10 [ 169.388220][T11907] arch_do_signal_or_restart+0x91/0x7e0 [ 169.388241][T11907] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 169.388275][T11907] irqentry_exit+0x402/0xa00 [ 169.388301][T11907] asm_exc_page_fault+0x26/0x30 [ 169.388318][T11907] RIP: 0033:0x7f61c8f9e021 [ 169.388334][T11907] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 169.388350][T11907] RSP: 002b:fffffffffffffc70 EFLAGS: 00010217 [ 169.388364][T11907] RAX: 0000000000000000 RBX: 00007f61c9226090 RCX: 00007f61c8f9e019 [ 169.388376][T11907] RDX: 0000000000000000 RSI: fffffffffffffc70 RDI: 0000000001022000 [ 169.388391][T11907] RBP: 00007f61c903500c R08: 0000000000000000 R09: 0000000000000000 [ 169.388402][T11907] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 169.388412][T11907] R13: 00007f61c9226128 R14: 00007f61c9226090 R15: 00007ffc24e46a28 [ 169.388437][T11907] [ 169.464514][T11907] memory: usage 307200kB, limit 307200kB, failcnt 35382 [ 169.506530][ T5739] Bluetooth: hci1: command tx timeout [ 169.512837][T11907] memory+swap: usage 430760kB, limit 9007199254740988kB, failcnt 0 [ 169.581564][T11907] kmem: usage 15064kB, limit 9007199254740988kB, failcnt 0 [ 169.584757][T11907] Memory cgroup stats for /syz0: [ 169.584875][T11907] cache 299040768 [ 169.589368][T11907] rss 81920 [ 169.590642][T11907] rss_huge 0 [ 169.592095][T11907] shmem 299036672 [ 169.593589][T11907] mapped_file 0 [ 169.595001][T11907] dirty 0 [ 169.596229][T11907] writeback 0 [ 169.598319][T11907] workingset_refault_anon 33 [ 169.600353][T11907] workingset_refault_file 6740 [ 169.602413][T11907] swap 126525440 [ 169.604093][T11907] swapcached 211206144 [ 169.605851][T11907] pgpgin 374318 [ 169.608600][T11907] pgpgout 301289 [ 169.610167][T11907] pgfault 129607 [ 169.611768][T11907] pgmajfault 72 [ 169.613397][T11907] inactive_anon 136364032 [ 169.615245][T11907] active_anon 162758656 [ 169.620130][T11907] inactive_file 0 [ 169.621701][T11907] active_file 4096 [ 169.623351][T11907] unevictable 0 [ 169.624848][T11907] hierarchical_memory_limit 314572800 [ 169.628287][T11907] hierarchical_memsw_limit 9223372036854771712 [ 169.630874][T11907] total_cache 299040768 [ 169.632635][T11907] total_rss 81920 [ 169.634295][T11907] total_rss_huge 0 [ 169.635939][T11907] total_shmem 299036672 [ 169.637792][T11907] total_mapped_file 0 [ 169.639180][T11907] total_dirty 0 [ 169.640441][T11907] total_writeback 0 [ 169.641759][T11907] total_workingset_refault_anon 33 [ 169.643440][T11907] total_workingset_refault_file 6740 [ 169.645198][T11907] total_swap 126525440 [ 169.646872][T11907] total_swapcached 211206144 [ 169.648345][T11907] total_pgpgin 374318 [ 169.649599][T11907] total_pgpgout 301289 [ 169.650850][T11907] total_pgfault 129607 [ 169.652155][T11907] total_pgmajfault 72 [ 169.653371][T11907] total_inactive_anon 136364032 [ 169.654877][T11907] total_active_anon 162758656 [ 169.657404][T11907] total_inactive_file 0 [ 169.658953][T11907] total_active_file 4096 [ 169.660531][T11907] total_unevictable 0 [ 169.661788][T11907] anon_cost 0 [ 169.662922][T11907] file_cost 0 [ 169.664120][T11907] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.1791,pid=11919,uid=0 [ 169.669209][T11907] Memory cgroup out of memory: Killed process 11919 (syz.0.1791) total-vm:98676kB, anon-rss:1268kB, file-rss:57412kB, shmem-rss:0kB, UID:0 pgtables:216kB oom_score_adj:0 [ 169.674885][T11913] syz.0.1791 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 169.679223][T11913] CPU: 1 UID: 0 PID: 11913 Comm: syz.0.1791 Tainted: G L syzkaller #0 PREEMPT(full) [ 169.679241][T11913] Tainted: [L]=SOFTLOCKUP [ 169.679245][T11913] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 169.679251][T11913] Call Trace: [ 169.679255][T11913] [ 169.679259][T11913] dump_stack_lvl+0x100/0x190 [ 169.679278][T11913] dump_header+0xfb/0x606 [ 169.679290][T11913] oom_kill_process.cold+0xd/0x330 [ 169.679303][T11913] out_of_memory+0x340/0x14f0 [ 169.679323][T11913] ? __pfx_out_of_memory+0x10/0x10 [ 169.679343][T11913] mem_cgroup_out_of_memory+0xc6/0x130 [ 169.679355][T11913] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 169.679366][T11913] ? find_held_lock+0x2b/0x80 [ 169.679379][T11913] ? do_raw_spin_unlock+0x145/0x1e0 [ 169.679394][T11913] ? _raw_spin_unlock+0x28/0x50 [ 169.679407][T11913] try_charge_memcg+0x6e5/0xdf0 [ 169.679424][T11913] ? __pfx_try_charge_memcg+0x10/0x10 [ 169.679438][T11913] ? find_held_lock+0x2b/0x80 [ 169.679447][T11913] ? rcu_read_unlock+0x17/0x60 [ 169.679469][T11913] ? rcu_read_unlock+0x17/0x60 [ 169.679484][T11913] ? find_held_lock+0x2b/0x80 [ 169.679494][T11913] ? rcu_read_unlock+0x17/0x60 [ 169.679512][T11913] charge_memcg+0x187/0x1e0 [ 169.679528][T11913] __mem_cgroup_charge+0x2b/0x1c0 [ 169.679547][T11913] shmem_alloc_and_add_folio+0x451/0xd40 [ 169.679562][T11913] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 169.679574][T11913] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 169.679588][T11913] shmem_get_folio_gfp+0x6ad/0x1910 [ 169.679601][T11913] ? __lock_acquire+0x49f/0x1a40 [ 169.679614][T11913] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 169.679629][T11913] shmem_write_begin+0x1a4/0x420 [ 169.679641][T11913] ? __pfx_shmem_write_begin+0x10/0x10 [ 169.679653][T11913] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 169.679669][T11913] generic_perform_write+0x292/0xa40 [ 169.679689][T11913] ? __pfx_generic_perform_write+0x10/0x10 [ 169.679727][T11913] ? file_update_time_flags+0x373/0x500 [ 169.679745][T11913] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 169.679758][T11913] shmem_file_write_iter+0x10e/0x140 [ 169.679773][T11913] __kernel_write_iter+0x2ac/0x930 [ 169.679790][T11913] ? __pfx___kernel_write_iter+0x10/0x10 [ 169.679807][T11913] ? __up_read+0x333/0x980 [ 169.679823][T11913] ? dump_user_range+0x65e/0xad0 [ 169.679838][T11913] ? copy_mc_enhanced_fast_string+0x6/0xf [ 169.679857][T11913] dump_user_range+0x3f9/0xad0 [ 169.679876][T11913] ? __pfx_dump_user_range+0x10/0x10 [ 169.679903][T11913] ? __pfx_writenote+0x10/0x10 [ 169.679922][T11913] ? elf_core_dump+0x1f25/0x3d20 [ 169.679946][T11913] elf_core_dump+0x2d68/0x3d20 [ 169.679983][T11913] ? __pfx_elf_core_dump+0x10/0x10 [ 169.680001][T11913] ? kasan_save_stack+0x3f/0x50 [ 169.680014][T11913] ? kasan_save_stack+0x30/0x50 [ 169.680025][T11913] ? kasan_save_track+0x14/0x30 [ 169.680037][T11913] ? __kasan_kmalloc+0xaa/0xb0 [ 169.680049][T11913] ? vfs_coredump+0x22a6/0x56f0 [ 169.680062][T11913] ? get_signal+0x1f2a/0x21e0 [ 169.680076][T11913] ? arch_do_signal_or_restart+0x91/0x7e0 [ 169.680092][T11913] ? 0xffffffffff600000 [ 169.680123][T11913] ? vfs_coredump+0x294b/0x56f0 [ 169.680136][T11913] vfs_coredump+0x294b/0x56f0 [ 169.680155][T11913] ? __pfx_vfs_coredump+0x10/0x10 [ 169.680171][T11913] ? __lock_acquire+0x49f/0x1a40 [ 169.680197][T11913] ? bpf_ksym_find+0x128/0x1c0 [ 169.680217][T11913] ? unwind_get_return_address+0x59/0xa0 [ 169.680229][T11913] ? arch_stack_walk+0xa6/0xf0 [ 169.680250][T11913] ? __sigqueue_free+0xbe/0x2a0 [ 169.680260][T11913] ? stack_trace_save+0x8e/0xc0 [ 169.680272][T11913] ? __pfx_stack_trace_save+0x10/0x10 [ 169.680283][T11913] ? stack_depot_save_flags+0x27/0x9d0 [ 169.680323][T11913] ? proc_coredump_connector+0x2d3/0x4f0 [ 169.680335][T11913] ? __pfx_proc_coredump_connector+0x10/0x10 [ 169.680349][T11913] ? rcu_is_watching+0x12/0xc0 [ 169.680368][T11913] get_signal+0x1f2a/0x21e0 [ 169.680387][T11913] ? __pfx_get_signal+0x10/0x10 [ 169.680405][T11913] arch_do_signal_or_restart+0x91/0x7e0 [ 169.680417][T11913] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 169.680437][T11913] irqentry_exit+0x402/0xa00 [ 169.680453][T11913] asm_exc_page_fault+0x26/0x30 [ 169.680467][T11913] RIP: 0033:0x7f61c8f9e021 [ 169.680477][T11913] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 169.680487][T11913] RSP: 002b:fffffffffffffc70 EFLAGS: 00010217 [ 169.680497][T11913] RAX: 0000000000000000 RBX: 00007f61c9226090 RCX: 00007f61c8f9e019 [ 169.680504][T11913] RDX: 0000000000000000 RSI: fffffffffffffc70 RDI: 0000000001022000 [ 169.680510][T11913] RBP: 00007f61c903500c R08: 0000000000000000 R09: 0000000000000000 [ 169.680517][T11913] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 169.680523][T11913] R13: 00007f61c9226128 R14: 00007f61c9226090 R15: 00007ffc24e46a28 [ 169.680537][T11913] [ 169.680541][T11913] memory: usage 307200kB, limit 307200kB, failcnt 35585 [ 169.841233][T11913] memory+swap: usage 430748kB, limit 9007199254740988kB, failcnt 0 [ 169.846162][T11913] kmem: usage 15036kB, limit 9007199254740988kB, failcnt 0 [ 169.848663][T11913] Memory cgroup stats for /syz0: [ 169.848753][T11913] cache 298364928 [ 169.851696][T11913] rss 81920 [ 169.852800][T11913] rss_huge 0 [ 169.853952][T11913] shmem 298360832 [ 169.855203][T11913] mapped_file 0 [ 169.856959][T11913] dirty 0 [ 169.858048][T11913] writeback 0 [ 169.859193][T11913] workingset_refault_anon 33 [ 169.859361][T12166] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 169.860792][T11913] workingset_refault_file 6740 [ 169.860800][T11913] swap 126513152 [ 169.860804][T11913] swapcached 211206144 [ 169.860810][T11913] pgpgin 374319 [ 169.860814][T11913] pgpgout 301444 [ 169.860819][T11913] pgfault 129607 [ 169.860823][T11913] pgmajfault 72 [ 169.860828][T11913] inactive_anon 122368000 [ 169.866205][T12166] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1844'. [ 169.866975][T11913] active_anon 176123904 [ 169.879821][T11913] inactive_file 0 [ 169.881095][T11913] active_file 4096 [ 169.882293][T11913] unevictable 0 [ 169.883435][T11913] hierarchical_memory_limit 314572800 [ 169.886113][T11913] hierarchical_memsw_limit 9223372036854771712 [ 169.888937][T11913] total_cache 298364928 [ 169.890298][T11913] total_rss 81920 [ 169.891520][T11913] total_rss_huge 0 [ 169.892713][T11913] total_shmem 298360832 [ 169.894031][T11913] total_mapped_file 0 [ 169.895364][T11913] total_dirty 0 [ 169.897004][T11913] total_writeback 0 [ 169.898272][T11913] total_workingset_refault_anon 33 [ 169.899967][T11913] total_workingset_refault_file 6740 [ 169.901648][T11913] total_swap 126513152 [ 169.902974][T11913] total_swapcached 211206144 [ 169.904432][T11913] total_pgpgin 374319 [ 169.905636][T11913] total_pgpgout 301444 [ 169.907523][T11913] total_pgfault 129607 [ 169.908971][T11913] total_pgmajfault 72 [ 169.910354][T11913] total_inactive_anon 122368000 [ 169.912211][T11913] total_active_anon 176123904 [ 169.913687][T11913] total_inactive_file 0 [ 169.915067][T11913] total_active_file 4096 [ 169.916685][T11913] total_unevictable 0 [ 169.917995][T11913] anon_cost 0 [ 169.919143][T11913] file_cost 0 [ 169.920270][T11913] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.1791,pid=11913,uid=0 [ 169.925366][T11913] Memory cgroup out of memory: Killed process 11913 (syz.0.1791) total-vm:98676kB, anon-rss:1268kB, file-rss:57412kB, shmem-rss:0kB, UID:0 pgtables:216kB oom_score_adj:0 [ 169.930440][T12168] ntfs3(sr0): Primary boot signature is not NTFS. [ 169.939956][T12168] ntfs3(sr0): try to read out of volume at offset 0xf800 [ 169.997734][T12168] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 170.004191][T12171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1838'. [ 170.024240][ T42] kauditd_printk_skb: 69 callbacks suppressed [ 170.024257][ T42] audit: type=1400 audit(2000000061.709:1159): avc: denied { write } for pid=12170 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 170.058054][T12171] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1838'. [ 170.060340][ T42] audit: type=1800 audit(2000000061.749:1160): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16354 res=0 errno=0 [ 170.089335][T12171] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1838'. [ 170.105479][ T42] audit: type=1400 audit(2000000061.789:1161): avc: denied { write } for pid=12177 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 170.205599][T12171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1838'. [ 170.209400][T12001] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 170.227817][T12001] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 170.231496][T12001] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 170.236533][T12001] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 170.240644][T12171] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1838'. [ 170.253914][ T42] audit: type=1400 audit(2000000061.939:1162): avc: denied { read } for pid=12174 comm="syz.1.1846" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 170.256843][T12171] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1838'. [ 170.265047][ T42] audit: type=1400 audit(2000000061.939:1163): avc: denied { open } for pid=12174 comm="syz.1.1846" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 170.277752][ T42] audit: type=1400 audit(2000000061.949:1164): avc: denied { mount } for pid=12174 comm="syz.1.1846" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 170.374896][T11884] syz.0.1791 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 170.383969][T11884] CPU: 2 UID: 0 PID: 11884 Comm: syz.0.1791 Tainted: G L syzkaller #0 PREEMPT(full) [ 170.384000][T11884] Tainted: [L]=SOFTLOCKUP [ 170.384006][T11884] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 170.384017][T11884] Call Trace: [ 170.384024][T11884] [ 170.384033][T11884] dump_stack_lvl+0x100/0x190 [ 170.384062][T11884] dump_header+0xfb/0x606 [ 170.384085][T11884] oom_kill_process.cold+0xd/0x330 [ 170.384107][T11884] out_of_memory+0x340/0x14f0 [ 170.384142][T11884] ? __pfx_out_of_memory+0x10/0x10 [ 170.384173][T11884] mem_cgroup_out_of_memory+0xc6/0x130 [ 170.384194][T11884] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 170.384214][T11884] ? find_held_lock+0x2b/0x80 [ 170.384235][T11884] ? do_raw_spin_unlock+0x145/0x1e0 [ 170.384262][T11884] ? _raw_spin_unlock+0x28/0x50 [ 170.384284][T11884] try_charge_memcg+0x6e5/0xdf0 [ 170.384312][T11884] ? __pfx_try_charge_memcg+0x10/0x10 [ 170.384336][T11884] ? find_held_lock+0x2b/0x80 [ 170.384353][T11884] ? rcu_read_unlock+0x17/0x60 [ 170.384377][T11884] ? rcu_read_unlock+0x17/0x60 [ 170.384402][T11884] ? find_held_lock+0x2b/0x80 [ 170.384420][T11884] ? rcu_read_unlock+0x17/0x60 [ 170.384449][T11884] charge_memcg+0x187/0x1e0 [ 170.384475][T11884] __mem_cgroup_charge+0x2b/0x1c0 [ 170.384505][T11884] shmem_alloc_and_add_folio+0x451/0xd40 [ 170.384531][T11884] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 170.384553][T11884] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 170.384575][T11884] shmem_get_folio_gfp+0x6ad/0x1910 [ 170.384599][T11884] ? __lock_acquire+0x49f/0x1a40 [ 170.384621][T11884] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 170.384647][T11884] shmem_write_begin+0x1a4/0x420 [ 170.384669][T11884] ? __pfx_shmem_write_begin+0x10/0x10 [ 170.384690][T11884] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 170.384710][T11884] ? lockdep_hardirqs_on+0x78/0x100 [ 170.384736][T11884] generic_perform_write+0x292/0xa40 [ 170.384769][T11884] ? __pfx_generic_perform_write+0x10/0x10 [ 170.384799][T11884] ? file_update_time_flags+0x373/0x500 [ 170.384827][T11884] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 170.384847][T11884] shmem_file_write_iter+0x10e/0x140 [ 170.384879][T11884] __kernel_write_iter+0x2ac/0x930 [ 170.384907][T11884] ? __pfx___kernel_write_iter+0x10/0x10 [ 170.384934][T11884] ? __up_read+0x333/0x980 [ 170.384962][T11884] ? dump_user_range+0x65e/0xad0 [ 170.384990][T11884] dump_user_range+0x3f9/0xad0 [ 170.385021][T11884] ? __pfx_dump_user_range+0x10/0x10 [ 170.385053][T11884] ? __pfx_writenote+0x10/0x10 [ 170.385078][T11884] ? elf_core_dump+0x1f25/0x3d20 [ 170.385108][T11884] elf_core_dump+0x2d68/0x3d20 [ 170.385146][T11884] ? __pfx_elf_core_dump+0x10/0x10 [ 170.385171][T11884] ? kasan_save_stack+0x3f/0x50 [ 170.385189][T11884] ? kasan_save_stack+0x30/0x50 [ 170.385209][T11884] ? kasan_save_track+0x14/0x30 [ 170.385228][T11884] ? __kasan_kmalloc+0xaa/0xb0 [ 170.385247][T11884] ? vfs_coredump+0x22a6/0x56f0 [ 170.385269][T11884] ? get_signal+0x1f2a/0x21e0 [ 170.385290][T11884] ? arch_do_signal_or_restart+0x91/0x7e0 [ 170.385314][T11884] ? 0xffffffffff600000 [ 170.385369][T11884] ? vfs_coredump+0x294b/0x56f0 [ 170.385390][T11884] vfs_coredump+0x294b/0x56f0 [ 170.385425][T11884] ? __pfx_vfs_coredump+0x10/0x10 [ 170.385451][T11884] ? __lock_acquire+0x49f/0x1a40 [ 170.385498][T11884] ? bpf_ksym_find+0x128/0x1c0 [ 170.385532][T11884] ? unwind_get_return_address+0x59/0xa0 [ 170.385552][T11884] ? arch_stack_walk+0xa6/0xf0 [ 170.385588][T11884] ? __sigqueue_free+0xbe/0x2a0 [ 170.385606][T11884] ? stack_trace_save+0x8e/0xc0 [ 170.385625][T11884] ? __pfx_stack_trace_save+0x10/0x10 [ 170.385645][T11884] ? stack_depot_save_flags+0x27/0x9d0 [ 170.385715][T11884] ? proc_coredump_connector+0x2d3/0x4f0 [ 170.385734][T11884] ? __pfx_proc_coredump_connector+0x10/0x10 [ 170.385759][T11884] ? rcu_is_watching+0x12/0xc0 [ 170.385790][T11884] get_signal+0x1f2a/0x21e0 [ 170.385824][T11884] ? __pfx_get_signal+0x10/0x10 [ 170.385860][T11884] arch_do_signal_or_restart+0x91/0x7e0 [ 170.385879][T11884] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 170.385915][T11884] irqentry_exit+0x402/0xa00 [ 170.385941][T11884] asm_exc_page_fault+0x26/0x30 [ 170.385959][T11884] RIP: 0033:0x7f61c8f9e021 [ 170.385974][T11884] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 170.385992][T11884] RSP: 002b:fffffffffffffc70 EFLAGS: 00010217 [ 170.386008][T11884] RAX: 0000000000000000 RBX: 00007f61c9226090 RCX: 00007f61c8f9e019 [ 170.386018][T11884] RDX: 0000000000000000 RSI: fffffffffffffc70 RDI: 0000000001022000 [ 170.386028][T11884] RBP: 00007f61c903500c R08: 0000000000000000 R09: 0000000000000000 [ 170.386040][T11884] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 170.386050][T11884] R13: 00007f61c9226128 R14: 00007f61c9226090 R15: 00007ffc24e46a28 [ 170.386076][T11884] [ 170.386084][T11884] memory: usage 307200kB, limit 307200kB, failcnt 37840 [ 170.488372][ T42] audit: type=1400 audit(2000000062.129:1165): avc: denied { unmount } for pid=5731 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 170.489488][T11884] memory+swap: usage 414708kB, limit 9007199254740988kB, failcnt 0 [ 170.507532][ T42] audit: type=1800 audit(2000000062.199:1166): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16354 res=0 errno=0 [ 170.594029][T12184] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=29 sclass=netlink_tcpdiag_socket pid=12184 comm=syz.1.1848 [ 170.602111][T11884] kmem: usage 15044kB, limit 9007199254740988kB, failcnt 0 [ 170.608566][T11884] Memory cgroup stats for /syz0: [ 170.608689][T11884] cache 298536960 [ 170.612189][T11884] rss 221184 [ 170.613519][T11884] rss_huge 0 [ 170.614697][T11884] shmem 296448000 [ 170.615860][T11884] mapped_file 1630208 [ 170.619678][T11884] dirty 4096 [ 170.621057][T11884] writeback 0 [ 170.622143][T11884] workingset_refault_anon 33 [ 170.623767][T11884] workingset_refault_file 7758 [ 170.625727][T11884] swap 126230528 [ 170.627269][T11884] swapcached 215470080 [ 170.628611][T11884] pgpgin 395253 [ 170.629833][T11884] pgpgout 322313 [ 170.631329][T11884] pgfault 135036 [ 170.632715][T11884] pgmajfault 74 [ 170.634083][T11884] inactive_anon 83566592 [ 170.635467][T11884] active_anon 212987904 [ 170.636963][T11884] inactive_file 0 [ 170.638133][T11884] active_file 2088960 [ 170.639393][T11884] unevictable 0 [ 170.640544][T11884] hierarchical_memory_limit 314572800 [ 170.642520][T11884] hierarchical_memsw_limit 9223372036854771712 [ 170.645088][T11884] total_cache 298536960 [ 170.647298][T11884] total_rss 221184 [ 170.649923][T11884] total_rss_huge 0 [ 170.651111][T11884] total_shmem 296448000 [ 170.652716][T11884] total_mapped_file 1630208 [ 170.654584][T11884] total_dirty 4096 [ 170.655991][T11884] total_writeback 0 [ 170.657283][T11884] total_workingset_refault_anon 33 [ 170.659206][T11884] total_workingset_refault_file 7758 [ 170.661399][T11884] total_swap 126230528 [ 170.663080][T11884] total_swapcached 215470080 [ 170.664985][T11884] total_pgpgin 395253 [ 170.666765][T11884] total_pgpgout 322313 [ 170.668256][T11884] total_pgfault 135036 [ 170.669997][T11884] total_pgmajfault 74 [ 170.671617][T11884] total_inactive_anon 83566592 [ 170.673556][T11884] total_active_anon 212987904 [ 170.675108][T11884] total_inactive_file 0 [ 170.676681][T11884] total_active_file 2088960 [ 170.678630][T11884] total_unevictable 0 [ 170.680322][T11884] anon_cost 0 [ 170.681487][T11884] file_cost 0 [ 170.682562][T11884] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.1791,pid=11907,uid=0 [ 170.688617][T11884] Memory cgroup out of memory: Killed process 11907 (syz.0.1791) total-vm:98676kB, anon-rss:1268kB, file-rss:57412kB, shmem-rss:0kB, UID:0 pgtables:216kB oom_score_adj:0 [ 170.703350][T12186] syz.0.1849 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 170.714841][T12186] CPU: 0 UID: 0 PID: 12186 Comm: syz.0.1849 Tainted: G L syzkaller #0 PREEMPT(full) [ 170.714862][T12186] Tainted: [L]=SOFTLOCKUP [ 170.714866][T12186] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 170.714873][T12186] Call Trace: [ 170.714878][T12186] [ 170.714883][T12186] dump_stack_lvl+0x100/0x190 [ 170.714902][T12186] dump_header+0xfb/0x606 [ 170.714916][T12186] oom_kill_process.cold+0xd/0x330 [ 170.714930][T12186] out_of_memory+0x340/0x14f0 [ 170.714951][T12186] ? __pfx_out_of_memory+0x10/0x10 [ 170.714971][T12186] mem_cgroup_out_of_memory+0xc6/0x130 [ 170.714985][T12186] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 170.714996][T12186] ? find_held_lock+0x2b/0x80 [ 170.715009][T12186] ? do_raw_spin_unlock+0x145/0x1e0 [ 170.715025][T12186] ? _raw_spin_unlock+0x28/0x50 [ 170.715039][T12186] try_charge_memcg+0x6e5/0xdf0 [ 170.715059][T12186] ? __pfx_try_charge_memcg+0x10/0x10 [ 170.715074][T12186] ? find_held_lock+0x2b/0x80 [ 170.715083][T12186] ? rcu_read_unlock+0x17/0x60 [ 170.715099][T12186] ? rcu_read_unlock+0x17/0x60 [ 170.715114][T12186] ? find_held_lock+0x2b/0x80 [ 170.715124][T12186] ? rcu_read_unlock+0x17/0x60 [ 170.715142][T12186] charge_memcg+0x187/0x1e0 [ 170.715158][T12186] __mem_cgroup_charge+0x2b/0x1c0 [ 170.715176][T12186] shmem_alloc_and_add_folio+0x451/0xd40 [ 170.715191][T12186] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 170.715204][T12186] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 170.715219][T12186] shmem_get_folio_gfp+0x6ad/0x1910 [ 170.715232][T12186] ? filemap_map_pages+0x112d/0x1fe0 [ 170.715250][T12186] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 170.715262][T12186] ? filemap_map_pages+0x1137/0x1fe0 [ 170.715280][T12186] shmem_fault+0x1f9/0xa20 [ 170.715293][T12186] ? __pfx_shmem_fault+0x10/0x10 [ 170.715306][T12186] ? __pfx_filemap_map_pages+0x10/0x10 [ 170.715325][T12186] ? find_held_lock+0x2b/0x80 [ 170.715341][T12186] __do_fault+0x10b/0x440 [ 170.715362][T12186] do_fault+0xa99/0x1750 [ 170.715390][T12186] __handle_mm_fault+0x187d/0x2a00 [ 170.715423][T12186] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 170.715452][T12186] ? __pfx___handle_mm_fault+0x10/0x10 [ 170.715471][T12186] ? pte_offset_map_lock+0x174/0x320 [ 170.715486][T12186] ? find_held_lock+0x2b/0x80 [ 170.715500][T12186] ? follow_page_pte+0x4d0/0x13f0 [ 170.715517][T12186] handle_mm_fault+0x37b/0xa30 [ 170.715537][T12186] __get_user_pages+0x1178/0x32a0 [ 170.715561][T12186] ? __pfx___get_user_pages+0x10/0x10 [ 170.715580][T12186] populate_vma_page_range+0x267/0x3f0 [ 170.715596][T12186] ? __pfx_populate_vma_page_range+0x10/0x10 [ 170.715611][T12186] ? __pfx_find_vma_intersection+0x10/0x10 [ 170.715626][T12186] ? do_mmap+0x93f/0x12f0 [ 170.715642][T12186] __mm_populate+0x107/0x3a0 [ 170.715657][T12186] ? __pfx___mm_populate+0x10/0x10 [ 170.715674][T12186] ? up_write+0x2e5/0x5c0 [ 170.715690][T12186] vm_mmap_pgoff+0x37f/0x470 [ 170.715741][T12186] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 170.715758][T12186] ? __pfx_do_futex+0x10/0x10 [ 170.715775][T12186] ? do_fcntl+0x811/0x1670 [ 170.715791][T12186] ksys_mmap_pgoff+0xe4/0x610 [ 170.715806][T12186] ? __x64_sys_futex+0x358/0x4d0 [ 170.715822][T12186] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 170.715836][T12186] ? xfd_validate_state+0x129/0x190 [ 170.715854][T12186] __x64_sys_mmap+0x125/0x190 [ 170.715872][T12186] do_syscall_64+0x115/0x870 [ 170.715885][T12186] ? clear_bhb_loop+0x40/0x90 [ 170.715899][T12186] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.715911][T12186] RIP: 0033:0x7f61c8f9e019 [ 170.715922][T12186] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 170.715933][T12186] RSP: 002b:00007f61c9f0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 170.715945][T12186] RAX: ffffffffffffffda RBX: 00007f61c9225fa0 RCX: 00007f61c8f9e019 [ 170.715952][T12186] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000 [ 170.715959][T12186] RBP: 00007f61c903500c R08: 0000000000000004 R09: 00000000a9525000 [ 170.715965][T12186] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 170.715972][T12186] R13: 00007f61c9226038 R14: 00007f61c9225fa0 R15: 00007ffc24e46a28 [ 170.715986][T12186] [ 170.715990][T12186] memory: usage 307200kB, limit 307200kB, failcnt 38434 [ 170.760047][T12189] netlink: 'syz.3.1850': attribute type 1 has an invalid length. [ 170.764817][T12186] memory+swap: usage 430948kB, limit 9007199254740988kB, failcnt 0 [ 170.795788][T12189] bond10: entered promiscuous mode [ 170.805590][ T42] audit: type=1800 audit(2000000062.489:1167): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16354 res=0 errno=0 [ 170.809286][T12189] 8021q: adding VLAN 0 to HW filter on device bond10 [ 170.811381][T12186] kmem: usage 14504kB, limit 9007199254740988kB, failcnt 0 [ 170.837000][T12189] ipvlan4: entered allmulticast mode [ 170.842098][T12186] Memory cgroup stats for /syz0 [ 170.847505][ T42] audit: type=1800 audit(2000000062.529:1168): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16354 res=0 errno=0 [ 170.848424][T12186] : [ 170.852399][T12189] bond10: entered allmulticast mode [ 170.854182][T12186] cache 296472576 [ 170.887707][T12189] bond10: (slave bridge3): making interface the new active one [ 170.887725][T12189] bridge3: entered promiscuous mode [ 170.887808][T12189] bridge3: entered allmulticast mode [ 170.891148][T12186] rss 221184 [ 170.907446][T12189] bond10: (slave bridge3): Enslaving as an active interface with an up link [ 170.909419][T12186] rss_huge 0 [ 170.909431][T12186] shmem 296472576 [ 170.909439][T12186] mapped_file 2056192 [ 170.914777][T12197] usb usb8: usbfs: process 12197 (syz.4.1853) did not claim interface 0 before use [ 170.916697][T12186] dirty 0 [ 170.916708][T12186] writeback 0 [ 170.916716][T12186] workingset_refault_anon 33 [ 170.916725][T12186] workingset_refault_file 7758 [ 170.916734][T12186] swap 123498496 [ 170.916743][T12186] swapcached 215969792 [ 170.935106][T12186] pgpgin 396065 [ 170.937233][T12186] pgpgout 323616 [ 170.938613][T12186] pgfault 135205 [ 170.940208][T12186] pgmajfault 75 [ 170.941707][T12186] inactive_anon 163524608 [ 170.943570][T12186] active_anon 133226496 [ 170.945348][T12186] inactive_file 0 [ 170.947021][T12186] active_file 0 [ 170.948422][T12186] unevictable 0 [ 170.949923][T12186] hierarchical_memory_limit 314572800 [ 170.952195][T12186] hierarchical_memsw_limit 9223372036854771712 [ 170.954822][T12186] total_cache 296472576 [ 170.956649][T12186] total_rss 221184 [ 170.958006][T12186] total_rss_huge 0 [ 170.959261][T12186] total_shmem 296472576 [ 170.960642][T12186] total_mapped_file 2056192 [ 170.962070][T12186] total_dirty 0 [ 170.963220][T12186] total_writeback 0 [ 170.964441][T12186] total_workingset_refault_anon 33 [ 170.966038][T12186] total_workingset_refault_file 7758 [ 170.967868][T12186] total_swap 123498496 [ 170.969157][T12186] total_swapcached 215969792 [ 170.970677][T12186] total_pgpgin 396065 [ 170.972005][T12186] total_pgpgout 323616 [ 170.973288][T12186] total_pgfault 135205 [ 170.974588][T12186] total_pgmajfault 75 [ 170.975871][T12186] total_inactive_anon 163524608 [ 170.976118][T12201] syzkaller0: entered promiscuous mode [ 170.977901][T12186] total_active_anon 133226496 [ 170.977912][T12186] total_inactive_file 0 [ 170.977919][T12186] total_active_file 0 [ 170.977926][T12186] total_unevictable 0 [ 170.977934][T12186] anon_cost 0 [ 170.977942][T12186] file_cost 0 [ 170.977950][T12186] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.1791,pid=11909,uid=0 [ 170.979261][T12186] Memory cgroup out of memory: Killed process 11909 (syz.0.1791) total-vm:98676kB, anon-rss:1268kB, file-rss:57412kB, shmem-rss:0kB, UID:0 pgtables:216kB oom_score_adj:0 [ 170.988144][T12201] syzkaller0: entered allmulticast mode [ 170.997730][T12206] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1857'. [ 171.009725][T12201] tipc: Started in network mode [ 171.010982][T12206] netlink: 144 bytes leftover after parsing attributes in process `syz.3.1857'. [ 171.011390][T12201] tipc: Node identity 56fa56c346ba, cluster identity 4711 [ 171.034919][T12201] tipc: Enabled bearer , priority 0 [ 171.055343][T12200] tipc: Resetting bearer [ 171.115292][T12200] tipc: Disabling bearer [ 171.233798][T12215] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12215 comm=syz.3.1859 [ 171.248742][T12215] bridge4: entered allmulticast mode [ 171.259772][T12215] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 171.391619][T12218] /dev/nullb0: Can't open blockdev [ 171.656406][T12227] netlink: 'syz.0.1862': attribute type 1 has an invalid length. [ 171.681104][T12227] bond65: entered promiscuous mode [ 171.683605][T12227] 8021q: adding VLAN 0 to HW filter on device bond65 [ 171.694701][T12227] ipvlan23: entered allmulticast mode [ 171.696783][T12227] bond65: entered allmulticast mode [ 171.708599][T12227] bond65: (slave bridge16): making interface the new active one [ 171.711962][T12227] bridge16: entered promiscuous mode [ 171.714461][T12227] bridge16: entered allmulticast mode [ 171.718321][T12227] bond65: (slave bridge16): Enslaving as an active interface with an up link [ 171.952260][T12241] netlink: 'syz.0.1867': attribute type 10 has an invalid length. [ 171.955611][T12241] ipvlan0: entered allmulticast mode [ 171.958920][T12241] team0: Device ipvlan0 is VLAN challenged and team device has VLAN set up [ 172.038789][T12246] file system registered [ 172.054636][T12246] read descriptors [ 172.090212][T11951] ffs_data_put(): freeing [ 172.152125][T12255] netlink: 'syz.0.1873': attribute type 1 has an invalid length. [ 172.175008][T12255] 8021q: adding VLAN 0 to HW filter on device bond66 [ 172.194372][T12255] bond66: (slave geneve14): making interface the new active one [ 172.198865][T12255] bond66: (slave geneve14): Enslaving as an active interface with an up link [ 172.275273][T12262] ffs_data_put(): freeing [ 172.612740][ T5092] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 172.623386][ T5092] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 172.629264][ T5092] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 172.633510][ T5092] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 172.639550][ T5092] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 173.017965][ T5731] ffs_data_put(): freeing [ 173.061969][T12285] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 173.122764][T12304] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 173.125517][T12304] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 173.133756][T12304] vhci_hcd vhci_hcd.0: Device attached [ 173.197751][T12310] syzkaller0: entered promiscuous mode [ 173.199920][T12310] syzkaller0: entered allmulticast mode [ 173.329041][T12287] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.332194][T12287] bridge0: port 1(bridge_slave_0) entered disabled state [ 173.335536][T12287] bridge_slave_0: entered allmulticast mode [ 173.340373][T12287] bridge_slave_0: entered promiscuous mode [ 173.345114][T12287] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.348310][T12287] bridge0: port 2(bridge_slave_1) entered disabled state [ 173.351408][T12287] bridge_slave_1: entered allmulticast mode [ 173.354811][T12287] bridge_slave_1: entered promiscuous mode [ 173.376438][ T34] usb 39-1: new high-speed USB device number 3 using vhci_hcd [ 173.379954][T12307] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 173.382042][T12287] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 173.387867][ T13] vhci_hcd vhci_hcd.1: stop threads [ 173.388947][T12287] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 173.390535][ T13] vhci_hcd vhci_hcd.1: release socket [ 173.397472][ T13] vhci_hcd vhci_hcd.1: disconnect device [ 173.418715][T12287] team0: Port device team_slave_0 added [ 173.422934][T12287] team0: Port device team_slave_1 added [ 173.446124][T12287] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 173.449128][T12287] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 173.459265][T12287] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 173.465368][T12287] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 173.468692][T12287] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 173.479149][T12287] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 173.518295][T12287] hsr_slave_0: entered promiscuous mode [ 173.521298][T12287] hsr_slave_1: entered promiscuous mode [ 173.524214][T12287] debugfs: 'hsr0' already exists in 'hsr' [ 173.526388][T12287] Cannot create hsr debugfs directory [ 173.707674][T12320] overlayfs: workdir and upperdir must reside under the same mount [ 173.741219][T12287] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 173.747363][T12287] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.911860][ T148] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 173.919732][ T148] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 173.922853][ T148] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 173.925988][ T148] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 173.929693][ T148] rtc rtc0: __rtc_set_alarm: err=-22 [ 173.962583][T12287] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 173.965830][T12287] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 174.049127][T12287] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 174.058411][T12287] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 174.210979][T12287] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 174.215277][T12287] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 174.227908][T10099] ffs_data_put(): freeing [ 174.287052][T12266] __nla_validate_parse: 5 callbacks suppressed [ 174.287074][T12266] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1877'. [ 174.342251][T12341] netlink: 'syz.3.1894': attribute type 10 has an invalid length. [ 174.345664][T12341] ipvlan0: entered allmulticast mode [ 174.349117][T12341] veth0_vlan: entered allmulticast mode [ 174.359963][T12341] team0: Device ipvlan0 failed to register rx_handler [ 174.491391][T12350] read descriptors [ 174.526344][T11951] ffs_data_put(): freeing [ 174.593562][T11951] ffs_data_put(): freeing [ 174.633890][T12357] netlink: 'syz.4.1901': attribute type 1 has an invalid length. [ 174.647021][ T29] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 174.696316][T12287] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 174.696865][ T5739] Bluetooth: hci4: command tx timeout [ 174.703631][T12287] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 174.708141][T12287] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 174.715401][T12287] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 174.718597][T12287] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 174.725006][T12287] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 174.728908][T12287] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 174.734887][T12287] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 174.744073][T12362] netlink: 'syz.3.1902': attribute type 21 has an invalid length. [ 174.754529][T12362] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1902'. [ 174.825829][T12362] configfs-gadget.g1 gadget.0: HOST MAC 62:6a:2a:bf:31:8a [ 174.833489][T12362] configfs-gadget.g1 gadget.0: MAC ee:43:b5:af:b9:47 [ 174.874839][T12287] 8021q: adding VLAN 0 to HW filter on device bond0 [ 174.895562][T12287] 8021q: adding VLAN 0 to HW filter on device team0 [ 174.914082][T11832] bridge0: port 1(bridge_slave_0) entered blocking state [ 174.917170][T11832] bridge0: port 1(bridge_slave_0) entered forwarding state [ 174.938018][T11832] bridge0: port 2(bridge_slave_1) entered blocking state [ 174.941133][T11832] bridge0: port 2(bridge_slave_1) entered forwarding state [ 175.038334][ T42] kauditd_printk_skb: 108 callbacks suppressed [ 175.038356][ T42] audit: type=1400 audit(2000000066.719:1277): avc: denied { write } for pid=12380 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 175.126459][ T41] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 175.141729][ T42] audit: type=1400 audit(2000000066.829:1278): avc: denied { write } for pid=12384 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 175.203370][ T42] audit: type=1400 audit(2000000066.889:1279): avc: denied { write } for pid=12391 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 175.289504][ T41] usb 5-1: Dual-Role OTG device on HNP port [ 175.293425][ T41] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 175.297337][ T41] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.304763][ T41] usb 5-1: Device is not authorized for usage [ 175.313353][ T42] audit: type=1800 audit(2000000066.999:1280): pid=8741 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=244293 res=0 errno=0 [ 175.324223][ T42] audit: type=1800 audit(2000000066.999:1281): pid=8741 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=244322 res=0 errno=0 [ 175.325014][T12287] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 175.340751][ T42] audit: type=1800 audit(2000000066.999:1282): pid=8741 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=244300 res=0 errno=0 [ 175.352594][ T42] audit: type=1800 audit(2000000066.999:1283): pid=8741 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=244301 res=0 errno=0 [ 175.364768][T12287] veth0_vlan: entered promiscuous mode [ 175.364864][ T42] audit: type=1800 audit(2000000066.999:1284): pid=8741 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="bcdDevice" dev="sysfs" ino=244302 res=0 errno=0 [ 175.371088][T12287] veth1_vlan: entered promiscuous mode [ 175.390588][ T42] audit: type=1400 audit(2000000067.079:1285): avc: denied { write } for pid=12399 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 175.407932][T12287] veth0_macvtap: entered promiscuous mode [ 175.414561][T12287] veth1_macvtap: entered promiscuous mode [ 175.430297][T12287] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 175.438815][T12287] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 175.458888][ T42] audit: type=1400 audit(2000000067.139:1286): avc: denied { write } for pid=12402 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 175.557597][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 175.557630][ T1167] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 175.561653][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 175.567829][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 175.567882][ T1167] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 175.606088][T11831] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 175.609518][T11831] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 175.626417][ T5820] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 175.689258][T12408] fuse: Unknown parameter '00000000000000000005' [ 176.776946][ T5739] Bluetooth: hci4: command tx timeout [ 178.546850][ T34] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 178.774027][T12442] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 178.788332][T12442] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 178.868383][ T5739] Bluetooth: hci4: command tx timeout [ 178.870350][T12445] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 178.921138][T12464] netlink: 'syz.1.1911': attribute type 1 has an invalid length. [ 178.961628][T12464] 8021q: adding VLAN 0 to HW filter on device bond59 [ 178.985089][T12464] bond59: (slave geneve7): making interface the new active one [ 178.991482][T12464] bond59: (slave geneve7): Enslaving as an active interface with an up link [ 179.105394][T12478] tipc: Enabling of bearer rejected, failed to enable media [ 179.112765][T12488] netlink: 260 bytes leftover after parsing attributes in process `syz.1.1918'. [ 179.205048][T12499] netlink: 'syz.4.1921': attribute type 1 has an invalid length. [ 179.217038][T12499] ipvlan2: entered allmulticast mode [ 179.219341][T12499] vlan1: entered allmulticast mode [ 179.221422][T12499] veth0_vlan: entered allmulticast mode [ 179.284995][T12501] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1922'. [ 179.351819][T12511] netlink: 'syz.3.1926': attribute type 1 has an invalid length. [ 179.390511][T12511] 8021q: adding VLAN 0 to HW filter on device bond13 [ 179.401660][T12518] (syz.1.1929,12518,2):dlmfs_mkdir:421 ERROR: invalid domain name for directory. [ 179.405495][T12511] bond13: (slave geneve6): making interface the new active one [ 179.406218][T12518] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1929'. [ 179.410917][T12511] bond13: (slave geneve6): Enslaving as an active interface with an up link [ 179.554491][T12534] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 179.604958][T12537] netlink: 'syz.1.1937': attribute type 1 has an invalid length. [ 179.622618][T12539] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7) [ 179.622671][T12539] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 179.622770][T12539] vhci_hcd vhci_hcd.0: Device attached [ 179.638963][T12537] bond60: entered promiscuous mode [ 179.639283][T12537] 8021q: adding VLAN 0 to HW filter on device bond60 [ 179.644211][T12541] vhci_hcd: cannot find a urb of seqnum 0 max seqnum 0 [ 179.644556][ T5786] vhci_hcd vhci_hcd.4: stop threads [ 179.644574][ T5786] vhci_hcd vhci_hcd.4: release socket [ 179.644592][ T5786] vhci_hcd vhci_hcd.4: disconnect device [ 179.678452][T12537] ipvlan22: entered allmulticast mode [ 179.678469][T12537] bond60: entered allmulticast mode [ 179.695183][T12537] bond60: (slave bridge0): making interface the new active one [ 179.695201][T12537] bridge0: entered promiscuous mode [ 179.695323][T12537] bridge0: entered allmulticast mode [ 179.696530][T12537] bond60: (slave bridge0): Enslaving as an active interface with an up link [ 179.706147][T12546] netlink: 'syz.3.1936': attribute type 39 has an invalid length. [ 179.733542][T12546] hsr_slave_0 (unregistering): left promiscuous mode [ 179.772656][T12552] netlink: 'syz.1.1940': attribute type 1 has an invalid length. [ 179.799610][T12552] 8021q: adding VLAN 0 to HW filter on device bond61 [ 179.812652][T12552] bond61: (slave geneve8): making interface the new active one [ 179.817380][T12552] bond61: (slave geneve8): Enslaving as an active interface with an up link [ 180.125129][ T42] kauditd_printk_skb: 75 callbacks suppressed [ 180.125284][ T42] audit: type=1800 audit(2000000071.809:1362): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16225 res=0 errno=0 [ 180.188891][ T42] audit: type=1800 audit(2000000071.879:1363): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16225 res=0 errno=0 [ 180.207552][ T34] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 180.229582][ T42] audit: type=1800 audit(2000000071.919:1364): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=246815 res=0 errno=0 [ 180.251309][T12574] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 180.321273][ T42] audit: type=1800 audit(2000000072.009:1365): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16741 res=0 errno=0 [ 180.331516][ T42] audit: type=1400 audit(2000000072.029:1366): avc: denied { watch_reads } for pid=12575 comm="syz.4.1947" path="/25" dev="tmpfs" ino=150 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 180.368679][ T34] usb 6-1: not running at top speed; connect to a high speed hub [ 180.373131][ T34] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 180.374063][ T42] audit: type=1800 audit(2000000072.059:1367): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16225 res=0 errno=0 [ 180.377706][ T34] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 180.391792][T12578] ICMPv6: NA: 00:00:00:00:00:00 advertised our address fe80::aa on syz_tun! [ 180.392187][ T34] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 180.398495][ T34] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.401965][ T34] usb 6-1: Product: syz [ 180.403789][ T34] usb 6-1: Manufacturer: syz [ 180.405730][ T34] usb 6-1: SerialNumber: syz [ 180.414208][ T42] audit: type=1800 audit(2000000072.099:1368): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=246834 res=0 errno=0 [ 180.422760][ T42] audit: type=1800 audit(2000000072.099:1369): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=246866 res=0 errno=0 [ 180.432071][ T42] audit: type=1800 audit(2000000072.129:1370): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=246841 res=0 errno=0 [ 180.440584][ T42] audit: type=1800 audit(2000000072.129:1371): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=246842 res=0 errno=0 [ 180.477396][T12588] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1950'. [ 180.535797][T12588] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12588 comm=syz.3.1950 [ 180.587787][T12592] kernel read not supported for file /policy (pid: 12592 comm: syz.4.1951) [ 180.625112][ T34] usb 6-1: USB disconnect, device number 17 [ 180.718585][T12607] syzkaller0: entered promiscuous mode [ 180.720445][T12607] syzkaller0: entered allmulticast mode [ 180.730453][T12607] tipc: Enabled bearer , priority 0 [ 180.734133][T12606] tipc: Resetting bearer [ 180.754123][T12606] tipc: Disabling bearer [ 180.859304][T12614] tmpfs: Unknown parameter 'usrquËŽ‘G~™@e[ îÎota' [ 180.883881][T12621] geneve1: entered allmulticast mode [ 180.901916][T12621] input: syz0 as /devices/virtual/input/input27 [ 180.946414][ T5739] Bluetooth: hci4: command tx timeout [ 181.015755][T12636] netlink: 'syz.0.1963': attribute type 1 has an invalid length. [ 181.028443][T12636] ipvlan2: entered allmulticast mode [ 181.030648][T12636] geneve0: entered allmulticast mode [ 181.098319][ T29] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 181.171718][T12642] syzkaller0: entered promiscuous mode [ 181.173614][T12642] syzkaller0: entered allmulticast mode [ 181.177187][T12642] tipc: Started in network mode [ 181.178876][T12642] tipc: Node identity ee6f9673784d, cluster identity 4711 [ 181.181403][T12642] tipc: Enabled bearer , priority 0 [ 181.184476][T12641] tipc: Resetting bearer [ 181.196421][ T1045] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 181.200569][T12641] tipc: Disabling bearer [ 181.271076][ T29] usb 8-1: Using ep0 maxpacket: 32 [ 181.279578][ T29] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 181.283810][ T29] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 181.290320][ T29] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 181.294351][ T29] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 181.298387][ T29] usb 8-1: Product: syz [ 181.300222][ T29] usb 8-1: Manufacturer: syz [ 181.302185][ T29] usb 8-1: SerialNumber: syz [ 181.315230][ T29] usb 8-1: config 0 descriptor?? [ 181.323132][ T29] hub 8-1:0.0: bad descriptor, ignoring hub [ 181.325056][T12654] ipt_REJECT: TCP_RESET invalid for non-tcp [ 181.326865][ T29] hub 8-1:0.0: probe with driver hub failed with error -5 [ 181.354743][ T1045] usb 9-1: config 0 has an invalid interface number: 8 but max is 0 [ 181.360904][ T1045] usb 9-1: config 0 has no interface number 0 [ 181.363739][ T1045] usb 9-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 181.370153][ T1045] usb 9-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 181.371704][T12659] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1971'. [ 181.377437][ T1045] usb 9-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 181.390132][ T1045] usb 9-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 181.396371][ T1045] usb 9-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 181.401304][ T1045] usb 9-1: Product: syz [ 181.402750][ T1045] usb 9-1: SerialNumber: syz [ 181.411158][ T1045] usb 9-1: config 0 descriptor?? [ 181.414984][ T1045] cm109 9-1:0.8: invalid payload size 0, expected 4 [ 181.415877][T12663] (syz.0.1972,12663,3):dlmfs_mkdir:421 ERROR: invalid domain name for directory. [ 181.420726][ T1045] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.8/input/input28 [ 181.421936][T12663] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1972'. [ 181.547243][T12672] netlink: 'syz.1.1975': attribute type 1 has an invalid length. [ 181.594996][T12672] 8021q: adding VLAN 0 to HW filter on device bond62 [ 181.611001][T12672] bond62: (slave geneve9): making interface the new active one [ 181.615613][T12672] bond62: (slave geneve9): Enslaving as an active interface with an up link [ 181.621032][T12629] PKCS7: Unknown OID: [4] 5.25.43183(bad) [ 181.624147][T12629] PKCS7: Only support pkcs7_signedData type [ 181.631901][T12629] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1961'. [ 181.693478][T12683] read descriptors [ 181.709782][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 181.714285][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 181.717754][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 181.720241][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 181.722496][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 181.725426][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 181.728546][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 181.731349][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 181.734537][ T1045] usb 9-1: USB disconnect, device number 2 [ 181.737122][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 181.737142][ C0] cm109 9-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 181.753439][ T5731] ffs_data_put(): freeing [ 181.772988][ T1045] cm109 9-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 181.932182][T12695] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 181.937881][T12695] qnx6: wrong signature (magic) in superblock #1. [ 181.941874][T12695] qnx6: unable to read the first superblock [ 182.251465][T12701] (syz.4.1984,12701,1):dlmfs_mkdir:421 ERROR: invalid domain name for directory. [ 182.256185][T12701] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1984'. [ 182.404728][T12707] netlink: 'syz.4.1986': attribute type 1 has an invalid length. [ 182.431459][T12707] 8021q: adding VLAN 0 to HW filter on device bond1 [ 182.483713][T12707] bond1: (slave geneve2): making interface the new active one [ 182.488163][T12707] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 182.517187][T12711] read descriptors [ 182.580666][T12287] ffs_data_put(): freeing [ 182.756163][T12728] syzkaller0: entered promiscuous mode [ 182.759098][T12728] syzkaller0: entered allmulticast mode [ 182.889702][T12733] 8021q: VLANs not supported on gre0 [ 182.905867][T12617] Set syz1 is full, maxelem 65536 reached [ 182.998766][T12742] read descriptors [ 183.019200][ T5731] ffs_data_put(): freeing [ 183.041918][T12735] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 183.047667][ T5842] usb 8-1: USB disconnect, device number 17 [ 183.084328][T12748] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2002'. [ 183.410542][T12764] read descriptors [ 183.427367][T12287] ffs_data_put(): freeing [ 183.488839][T12770] overlayfs: missing 'lowerdir' [ 183.554764][T12776] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2015'. [ 183.597670][T12781] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2018'. [ 183.601492][T12781] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2018'. [ 183.616355][T12782] input: syz0 as /devices/virtual/input/input29 [ 183.739366][T12795] read descriptors [ 183.741096][T12795] bcdVersion must be 0x0100, stored in Little Endian order. Userspace driver should be fixed, accepting 0x0001 for compatibility. [ 183.748366][T12795] read strings [ 183.773344][ T5731] ffs_data_put(): freeing [ 183.839183][T12798] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 183.924620][T12809] netlink: 'syz.1.2028': attribute type 1 has an invalid length. [ 183.956966][T12809] 8021q: adding VLAN 0 to HW filter on device bond63 [ 183.991245][T12809] bond63: (slave geneve10): making interface the new active one [ 183.992823][T12809] bond63: (slave geneve10): Enslaving as an active interface with an up link [ 184.193016][T12833] read descriptors [ 184.194704][T12833] bcdVersion must be 0x0100, stored in Little Endian order. Userspace driver should be fixed, accepting 0x0001 for compatibility. [ 184.201907][T12833] read strings [ 184.219254][T10099] ffs_data_put(): freeing [ 184.243860][T12836] Bluetooth: Invalid esc byte 0x03 [ 184.267846][ T1167] Bluetooth: (null): Invalid header checksum [ 184.366630][T11832] Bluetooth: (null): Invalid header checksum [ 184.592245][T12868] FAULT_INJECTION: forcing a failure. [ 184.592245][T12868] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 184.600820][T12868] CPU: 1 UID: 0 PID: 12868 Comm: syz.1.2038 Tainted: G L syzkaller #0 PREEMPT(full) [ 184.600848][T12868] Tainted: [L]=SOFTLOCKUP [ 184.600855][T12868] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 184.600877][T12868] Call Trace: [ 184.600895][T12868] [ 184.600902][T12868] dump_stack_lvl+0x100/0x190 [ 184.600949][T12868] should_fail_ex.cold+0x5/0xa [ 184.600982][T12868] _copy_to_user+0x32/0xd0 [ 184.601019][T12868] simple_read_from_buffer+0xcb/0x170 [ 184.601049][T12868] proc_fail_nth_read+0x1af/0x230 [ 184.601085][T12868] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 184.601128][T12868] ? rw_verify_area+0xce/0x6d0 [ 184.601163][T12868] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 184.601189][T12868] vfs_read+0x1e4/0xb40 [ 184.601217][T12868] ? __pfx_vfs_read+0x10/0x10 [ 184.601243][T12868] ? __fget_files+0x215/0x3d0 [ 184.601266][T12868] ? __fget_files+0x21f/0x3d0 [ 184.601290][T12868] ksys_read+0x12a/0x250 [ 184.601322][T12868] ? __pfx_ksys_read+0x10/0x10 [ 184.601354][T12868] do_syscall_64+0x115/0x870 [ 184.601381][T12868] ? clear_bhb_loop+0x40/0x90 [ 184.601404][T12868] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.601421][T12868] RIP: 0033:0x7f774915e84e [ 184.601437][T12868] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 184.601454][T12868] RSP: 002b:00007f774a0abfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 184.601471][T12868] RAX: ffffffffffffffda RBX: 00007f774a0ac6c0 RCX: 00007f774915e84e [ 184.601482][T12868] RDX: 000000000000000f RSI: 00007f774a0ac0a0 RDI: 0000000000000006 [ 184.601495][T12868] RBP: 00007f774a0ac090 R08: 0000000000000000 R09: 0000000000000000 [ 184.601505][T12868] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 184.601515][T12868] R13: 00007f7749426038 R14: 00007f7749425fa0 R15: 00007ffd5be06d18 [ 184.601539][T12868] [ 184.729411][T12890] read descriptors [ 184.740083][T12890] bcdVersion must be 0x0100, stored in Little Endian order. Userspace driver should be fixed, accepting 0x0001 for compatibility. [ 184.745000][T12890] read strings [ 184.758456][ T5731] ffs_data_put(): freeing [ 184.926557][ T148] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 185.023986][T12915] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 185.073788][T12921] netlink: 'syz.4.2051': attribute type 1 has an invalid length. [ 185.076521][T12921] __nla_validate_parse: 1 callbacks suppressed [ 185.076530][T12921] netlink: 756 bytes leftover after parsing attributes in process `syz.4.2051'. [ 185.089171][T12923] read descriptors [ 185.090961][T12923] bcdVersion must be 0x0100, stored in Little Endian order. Userspace driver should be fixed, accepting 0x0001 for compatibility. [ 185.097252][T12923] read strings [ 185.098378][ T148] usb 8-1: config index 0 descriptor too short (expected 39, got 27) [ 185.102290][ T148] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 185.112238][ T148] usb 8-1: config 0 interface 0 has no altsetting 0 [ 185.117920][ T148] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 185.123762][ T148] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 185.126649][T12926] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2053'. [ 185.129768][T12287] ffs_data_put(): freeing [ 185.130514][ T148] usb 8-1: Product: syz [ 185.130533][ T148] usb 8-1: Manufacturer: syz [ 185.130549][ T148] usb 8-1: SerialNumber: syz [ 185.136893][ T148] usb 8-1: config 0 descriptor?? [ 185.140735][ T42] kauditd_printk_skb: 219 callbacks suppressed [ 185.140746][ T42] audit: type=1800 audit(2000000076.829:1591): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=249880 res=0 errno=0 [ 185.145054][ T148] hub 8-1:0.0: bad descriptor, ignoring hub [ 185.156357][ T148] hub 8-1:0.0: probe with driver hub failed with error -5 [ 185.169794][ T42] audit: type=1800 audit(2000000076.829:1592): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=249912 res=0 errno=0 [ 185.187411][ T42] audit: type=1800 audit(2000000076.849:1593): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=249887 res=0 errno=0 [ 185.195985][ T148] usb 8-1: selecting invalid altsetting 0 [ 185.198716][ T42] audit: type=1800 audit(2000000076.849:1594): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=249888 res=0 errno=0 [ 185.212427][ T42] audit: type=1800 audit(2000000076.869:1595): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16225 res=0 errno=0 [ 185.220656][ T42] audit: type=1800 audit(2000000076.899:1596): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16741 res=0 errno=0 [ 185.233450][ T42] audit: type=1800 audit(2000000076.909:1597): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16354 res=0 errno=0 [ 185.276856][ T42] audit: type=1800 audit(2000000076.969:1598): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="manufacturer" dev="sysfs" ino=249909 res=0 errno=0 [ 185.285103][ T42] audit: type=1800 audit(2000000076.969:1599): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="product" dev="sysfs" ino=249910 res=0 errno=0 [ 185.293314][ T42] audit: type=1800 audit(2000000076.969:1600): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="bcdDevice" dev="sysfs" ino=249889 res=0 errno=0 [ 185.427048][T12940] netlink: 'syz.4.2058': attribute type 1 has an invalid length. [ 185.470149][T12940] 8021q: adding VLAN 0 to HW filter on device bond2 [ 185.527565][T12940] bond2: (slave geneve3): making interface the new active one [ 185.533955][T12940] bond2: (slave geneve3): Enslaving as an active interface with an up link [ 185.539734][T12952] read descriptors [ 185.544894][T12952] bcdVersion must be 0x0100, stored in Little Endian order. Userspace driver should be fixed, accepting 0x0001 for compatibility. [ 185.551302][T12952] read strings [ 185.567994][ T5731] ffs_data_put(): freeing [ 185.759477][T12962] netlink: 'syz.1.2066': attribute type 1 has an invalid length. [ 185.771434][T12962] bond65: entered promiscuous mode [ 185.773332][T12962] 8021q: adding VLAN 0 to HW filter on device bond65 [ 185.782856][T12962] ipvlan23: entered allmulticast mode [ 185.784615][T12962] bond65: entered allmulticast mode [ 185.808679][T12962] bond65: (slave bridge14): making interface the new active one [ 185.814463][T12962] bridge14: entered promiscuous mode [ 185.817800][T12962] bridge14: entered allmulticast mode [ 185.822393][T12962] bond65: (slave bridge14): Enslaving as an active interface with an up link [ 185.955882][T12974] netlink: 'syz.0.2071': attribute type 1 has an invalid length. [ 185.976504][ T5739] Bluetooth: hci3: command 0x0406 tx timeout [ 185.977148][T12974] 8021q: adding VLAN 0 to HW filter on device bond1 [ 185.982065][ T5886] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 185.987792][ T5886] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 185.998157][T12974] bond1: (slave geneve2): making interface the new active one [ 186.011867][T12974] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 186.823356][T12993] block device autoloading is deprecated and will be removed. [ 186.830483][T12993] md: invalid raid superblock magic on ram32 [ 186.833473][T12993] md: ram32 does not have a valid v0.0 superblock, not importing! [ 186.836778][T12993] md: md_import_device returned -22 [ 187.126741][ T1353] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 187.287100][ T1353] usb 9-1: Using ep0 maxpacket: 8 [ 187.290792][ T1353] usb 9-1: config 179 has an invalid interface number: 65 but max is 0 [ 187.294665][ T1353] usb 9-1: config 179 has no interface number 0 [ 187.297366][ T1353] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 187.301755][ T1353] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 187.306314][ T1353] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 187.310336][ T1353] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 187.314517][ T1353] usb 9-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 187.319513][ T1353] usb 9-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 187.323319][ T1353] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.328971][T12996] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 187.558665][ T1353] input: Generic X-Box pad as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:179.65/input/input30 [ 187.762743][ T6911] usb 9-1: USB disconnect, device number 3 [ 187.762812][ C3] xpad 9-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 187.767817][ C3] xpad 9-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 188.136355][ T5886] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 188.136481][ T5739] Bluetooth: hci1: command 0x0c1a tx timeout [ 188.138347][ T5886] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 188.753872][ T848] usb 8-1: USB disconnect, device number 18 [ 189.858446][ T5841] e1000 0000:00:06.0 eth0: Reset adapter [ 189.976834][ T5841] e1000 0000:00:06.0 eth0: Reset adapter [ 190.046547][ T34] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 190.077284][ T5842] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 190.206374][ T34] usb 8-1: Using ep0 maxpacket: 32 [ 190.214033][ T34] usb 8-1: unable to get BOS descriptor or descriptor too short [ 190.216418][ T5886] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 190.216627][ T5739] Bluetooth: hci4: command 0x0c1a tx timeout [ 190.222392][ T5886] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 190.223260][ T34] usb 8-1: string descriptor 0 read error: -22 [ 190.226558][ T5842] usb 9-1: Using ep0 maxpacket: 32 [ 190.228571][ T34] usb 8-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 190.232496][ T5842] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 190.237642][ T34] usb 8-1: New USB device strings: Mfr=1, Product=252, SerialNumber=3 [ 190.238271][ T5842] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 190.246033][ T42] kauditd_printk_skb: 93 callbacks suppressed [ 190.246053][ T42] audit: type=1800 audit(2000000081.929:1694): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=253077 res=0 errno=0 [ 190.254638][ T5842] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 190.257576][ T5842] usb 9-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 190.260213][ T5842] usb 9-1: Product: syz [ 190.261531][ T5842] usb 9-1: Manufacturer: syz [ 190.263436][ T5842] usb 9-1: SerialNumber: syz [ 190.268571][ T34] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 190.274735][ T5842] usb 9-1: config 0 descriptor?? [ 190.275171][ T42] audit: type=1800 audit(2000000081.959:1695): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=253106 res=0 errno=0 [ 190.279306][ T5842] hub 9-1:0.0: bad descriptor, ignoring hub [ 190.282768][ T34] dw2102: su3000_power_ctrl: 1, initialized 0 [ 190.290098][ T5842] hub 9-1:0.0: probe with driver hub failed with error -5 [ 190.293116][ T42] audit: type=1800 audit(2000000081.959:1696): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=253084 res=0 errno=0 [ 190.298592][ T34] dvb-usb: bulk message failed: -22 (2/0) [ 190.316856][ T42] audit: type=1800 audit(2000000081.969:1697): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=253085 res=0 errno=0 [ 190.328844][ T42] audit: type=1800 audit(2000000081.969:1698): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="bcdDevice" dev="sysfs" ino=253086 res=0 errno=0 [ 190.339070][ T42] audit: type=1400 audit(2000000081.969:1699): avc: denied { write } for pid=13039 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 190.346850][ T34] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 190.348747][ T42] audit: type=1800 audit(2000000081.979:1700): pid=12599 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=253141 res=0 errno=0 [ 190.359019][ T34] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 190.361423][ T42] audit: type=1800 audit(2000000081.979:1701): pid=12447 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=253126 res=0 errno=0 [ 190.370853][ T34] usb 8-1: media controller created [ 190.371453][ T42] audit: type=1800 audit(2000000081.979:1702): pid=12599 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=253173 res=0 errno=0 [ 190.373955][ T34] dvb-usb: bulk message failed: -22 (6/0) [ 190.387147][ T42] audit: type=1800 audit(2000000081.979:1703): pid=12599 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=253148 res=0 errno=0 [ 190.390443][ T34] dw2102: i2c transfer failed. [ 190.401636][ T34] dvb-usb: bulk message failed: -22 (6/0) [ 190.405272][ T34] dw2102: i2c transfer failed. [ 190.408515][ T34] dvb-usb: bulk message failed: -22 (6/0) [ 190.410906][ T34] dw2102: i2c transfer failed. [ 190.412866][ T34] dvb-usb: bulk message failed: -22 (6/0) [ 190.416443][ T34] dw2102: i2c transfer failed. [ 190.420487][ T34] dvb-usb: bulk message failed: -22 (6/0) [ 190.422932][ T34] dw2102: i2c transfer failed. [ 190.424952][ T34] dvb-usb: bulk message failed: -22 (6/0) [ 190.428372][ T34] dw2102: i2c transfer failed. [ 190.430502][ T34] dvb-usb: MAC address: 02:02:02:02:02:02 [ 190.445520][ T34] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 190.489324][ T34] dvb-usb: bulk message failed: -22 (3/0) [ 190.491149][ T34] dw2102: command 0x0e transfer failed. [ 190.497398][ T34] dvb-usb: bulk message failed: -22 (3/0) [ 190.508938][ T34] dw2102: command 0x0e transfer failed. [ 190.594972][T13058] max out of range [ 190.680259][ T5738] usb 9-1: USB disconnect, device number 4 [ 190.725029][T13068] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 190.735219][T13068] batman_adv: batadv0: Adding interface: gretap1 [ 190.738271][T13068] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 190.753283][T13068] batman_adv: batadv0: Interface activated: gretap1 [ 190.764793][T13068] team0: entered promiscuous mode [ 190.766979][T13068] team_slave_0: entered promiscuous mode [ 190.769417][T13068] team_slave_1: entered promiscuous mode [ 190.772476][T13068] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2095'. [ 190.782453][T13068] xfrm1: entered promiscuous mode [ 190.784248][T13068] xfrm1: entered allmulticast mode [ 190.788627][T13068] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2095'. [ 190.816451][ T34] dvb-usb: bulk message failed: -22 (3/0) [ 190.818462][ T34] dw2102: command 0x0e transfer failed. [ 190.820532][ T34] dvb-usb: bulk message failed: -22 (3/0) [ 190.822415][ T34] dw2102: command 0x0e transfer failed. [ 190.824187][ T34] dvb-usb: bulk message failed: -22 (1/0) [ 190.826073][ T34] dw2102: command 0x51 transfer failed. [ 190.877211][ T34] DVB: Unable to find symbol ds3000_attach() [ 190.879317][ T34] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 190.936872][ T34] rc_core: IR keymap rc-su3000 not found [ 190.939724][ T34] Registered IR keymap rc-empty [ 190.943801][ T34] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.3/usb8/8-1/rc/rc0 [ 190.954069][ T34] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.3/usb8/8-1/rc/rc0/input31 [ 190.964239][ T34] dvb-usb: schedule remote query interval to 150 msecs. [ 190.967472][ T34] dw2102: su3000_power_ctrl: 0, initialized 1 [ 190.969964][ T34] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 190.975740][ T34] usb 8-1: USB disconnect, device number 19 [ 191.029433][ T34] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 192.138170][ T5886] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX [ 193.072715][T13096] tmpfs: Bad value for 'huge' [ 193.326386][ T5886] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 193.406577][ T5841] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 193.496529][ T5886] usb 9-1: Using ep0 maxpacket: 8 [ 193.499886][ T5886] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 193.502810][ T5886] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 193.506181][ T5886] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 193.510926][ T5886] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 193.514583][ T5886] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 193.519456][ T5886] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 193.524808][ T5886] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.536703][T13122] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 193.546592][T13122] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 193.557009][ T5738] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 193.566590][ T5841] usb 8-1: Using ep0 maxpacket: 32 [ 193.571801][ T5841] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 193.575800][ T5841] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 193.585674][ T5841] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 193.590583][ T5841] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 193.594345][ T5841] usb 8-1: Product: syz [ 193.596619][ T5841] usb 8-1: Manufacturer: syz [ 193.598684][ T5841] usb 8-1: SerialNumber: syz [ 193.606522][ T5841] usb 8-1: config 0 descriptor?? [ 193.612225][ T5841] hub 8-1:0.0: bad descriptor, ignoring hub [ 193.615331][ T5841] hub 8-1:0.0: probe with driver hub failed with error -5 [ 193.716352][ T5738] usb 6-1: Using ep0 maxpacket: 8 [ 193.719774][ T5738] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 193.722894][ T5738] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 193.725926][ T5738] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 193.729256][ T5738] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 193.734173][ T5738] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 193.734551][ T5886] usb 9-1: usb_control_msg returned -32 [ 193.737341][ T5738] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.741617][ T5886] usbtmc 9-1:16.0: can't read capabilities [ 193.923620][T13126] syzkaller0: entered promiscuous mode [ 193.925400][T13126] syzkaller0: entered allmulticast mode [ 193.926656][ T5886] usb 8-1: USB disconnect, device number 20 [ 193.948083][ T5738] usb 6-1: GET_CAPABILITIES returned 0 [ 193.951609][ T5738] usbtmc 6-1:16.0: can't read capabilities [ 194.138672][ T1445] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.171376][T13130] block nbd3: shutting down sockets [ 194.558093][T13149] usbtmc 9-1:16.0: send_request_dev_dep_msg_in returned -90 [ 194.726406][ T5738] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 194.876492][ T5738] usb 8-1: Using ep0 maxpacket: 32 [ 194.880643][ T5738] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 194.884707][ T5738] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 194.890793][ T5738] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 194.894616][ T5738] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 194.898131][ T5738] usb 8-1: Product: syz [ 194.899944][ T5738] usb 8-1: Manufacturer: syz [ 194.901935][ T5738] usb 8-1: SerialNumber: syz [ 194.907444][ T5738] usb 8-1: config 0 descriptor?? [ 194.911621][ T5738] hub 8-1:0.0: bad descriptor, ignoring hub [ 194.914723][ T5738] hub 8-1:0.0: probe with driver hub failed with error -5 [ 195.051824][T13153] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2119'. [ 195.175685][T13156] syzkaller0: entered promiscuous mode [ 195.177822][T13156] syzkaller0: entered allmulticast mode [ 195.246830][ T5841] usb 8-1: USB disconnect, device number 21 [ 195.360797][ T42] kauditd_printk_skb: 94 callbacks suppressed [ 195.360811][ T42] audit: type=1400 audit(2000000087.049:1798): avc: denied { write } for pid=13157 comm="syz.3.2121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 195.908173][ T42] audit: type=1800 audit(2000000087.599:1799): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16225 res=0 errno=0 [ 195.917417][ T42] audit: type=1400 audit(2000000087.599:1800): avc: denied { lock } for pid=13160 comm="syz.0.2122" path="socket:[52551]" dev="sockfs" ino=52551 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 195.967080][ T42] audit: type=1400 audit(2000000087.659:1801): avc: denied { write } for pid=13160 comm="syz.0.2122" name="functions" dev="configfs" ino=19501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 195.974524][ T42] audit: type=1400 audit(2000000087.659:1802): avc: denied { write } for pid=13160 comm="syz.0.2122" name="functions" dev="configfs" ino=19501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 195.982026][ T42] audit: type=1400 audit(2000000087.659:1803): avc: denied { remove_name } for pid=13160 comm="syz.0.2122" name="uac1.usb0" dev="configfs" ino=52553 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 195.989975][ T42] audit: type=1400 audit(2000000087.659:1804): avc: denied { rmdir } for pid=13160 comm="syz.0.2122" name="uac1.usb0" dev="configfs" ino=52553 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 196.073981][ T9] usb 9-1: USB disconnect, device number 5 [ 196.151051][ T42] audit: type=1800 audit(2000000087.839:1805): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16741 res=0 errno=0 [ 196.165420][T13164] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2123'. [ 196.189521][ T42] audit: type=1800 audit(2000000087.879:1806): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16741 res=0 errno=0 [ 196.196186][T13168] kernel read not supported for file /sg0 (pid: 13168 comm: syz.4.2125) [ 196.201369][ T42] audit: type=1400 audit(2000000087.879:1807): avc: denied { map } for pid=13167 comm="syz.4.2125" path="/dev/sg0" dev="devtmpfs" ino=722 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 196.211192][T13166] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2124'. [ 196.211749][T13168] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 196.214484][T13166] unsupported nlmsg_type 40 [ 196.281752][T13168] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 196.313924][ T5842] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 196.316992][ T5842] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 196.318368][ T5738] usb 6-1: USB disconnect, device number 18 [ 196.319391][ T5842] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 196.319416][ T5842] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 196.319430][ T5842] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 196.319446][ T5842] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 196.332163][ T5842] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 196.335572][ T5842] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 196.339690][ T5842] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 196.341863][ T5842] hid-generic 000A:FFFFFF1D:0002.0006: unknown main item tag 0x0 [ 196.351208][ T5842] hid-generic 000A:FFFFFF1D:0002.0006: hidraw1: HID v0.04 Device [syz0] on syz1 [ 196.382104][T13186] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2130'. [ 196.540874][T13194] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2132'. [ 196.557028][ T5841] usb 8-1: new high-speed USB device number 22 using dummy_hcd [ 196.621650][T13194] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=13194 comm=syz.1.2132 [ 196.697619][ T5841] usb 8-1: device descriptor read/64, error -71 [ 196.793542][T13197] loop5: detected capacity change from 0 to 7 [ 196.801842][T13197] Dev loop5: unable to read RDB block 7 [ 196.804095][T13197] loop5: AHDI p1 p2 p3 [ 196.805849][T13197] loop5: partition table partially beyond EOD, truncated [ 196.810426][T13197] loop5: p1 start 1818582900 is beyond EOD, truncated [ 196.813934][T13197] loop5: p3 start 335544320 is beyond EOD, truncated [ 196.858495][T13200] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2134'. [ 196.901155][T13203] vhci_hcd vhci_hcd.0: remove, state 4 [ 196.903506][T13203] usb usb38: USB disconnect, device number 1 [ 196.954895][ T5833] vhci_hcd vhci_hcd.0: stop threads [ 196.955325][T13203] vhci_hcd vhci_hcd.0: USB bus 38 deregistered [ 196.956691][ T5833] vhci_hcd vhci_hcd.0: release socket [ 196.959266][ T5841] usb 8-1: new high-speed USB device number 23 using dummy_hcd [ 196.961031][ T5833] vhci_hcd vhci_hcd.0: disconnect device [ 196.961053][ T5833] vhci_hcd vhci_hcd.0: stop threads [ 196.961060][ T5833] vhci_hcd vhci_hcd.0: release socket [ 196.961069][ T5833] vhci_hcd vhci_hcd.0: disconnect device [ 196.961081][ T5833] vhci_hcd vhci_hcd.0: stop threads [ 196.961088][ T5833] vhci_hcd vhci_hcd.0: release socket [ 196.961097][ T5833] vhci_hcd vhci_hcd.0: disconnect device [ 196.975853][ T5833] vhci_hcd vhci_hcd.0: stop threads [ 196.977630][ T5833] vhci_hcd vhci_hcd.0: release socket [ 196.979490][ T5833] vhci_hcd vhci_hcd.0: disconnect device [ 196.979813][T13203] vhci_hcd vhci_hcd.0: remove, state 4 [ 196.981284][ T5833] ================================================================== [ 196.981300][ T5833] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x3a/0x60 [ 196.983113][T13203] usb usb37: USB disconnect, device number 1 [ 196.985592][ T5833] Read of size 1 at addr ffff88802d378b68 by task kworker/u32:4/5833 [ 196.994329][ T5833] [ 196.995127][ T5833] CPU: 2 UID: 0 PID: 5833 Comm: kworker/u32:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 196.995145][ T5833] Tainted: [L]=SOFTLOCKUP [ 196.995149][ T5833] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 196.995166][ T5833] Workqueue: usbip_event event_handler [ 196.995186][ T5833] Call Trace: [ 196.995197][ T5833] [ 196.995202][ T5833] dump_stack_lvl+0x100/0x190 [ 196.995225][ T5833] print_report+0x13d/0x4b0 [ 196.995247][ T5833] ? __virt_addr_valid+0x239/0x430 [ 196.995270][ T5833] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 196.995281][ T5833] kasan_report+0xdf/0x1c0 [ 196.995302][ T5833] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 196.995314][ T5833] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 196.995325][ T5833] __kasan_check_byte+0x36/0x50 [ 196.995339][ T5833] lock_acquire+0x132/0x370 [ 196.995358][ T5833] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 196.995371][ T5833] ? _raw_spin_lock_irqsave+0x52/0x60 [ 196.995382][ T5833] _raw_spin_lock_irqsave+0x3a/0x60 [ 196.995393][ T5833] ? event_handler+0x21e/0x570 [ 196.995403][ T5833] event_handler+0x21e/0x570 [ 196.995415][ T5833] process_one_work+0xa23/0x1940 [ 196.995434][ T5833] ? __pfx_process_one_work+0x10/0x10 [ 196.995447][ T5833] ? __pfx_event_handler+0x10/0x10 [ 196.995459][ T5833] worker_thread+0x5ef/0xe50 [ 196.995471][ T5833] ? __pfx_worker_thread+0x10/0x10 [ 196.995483][ T5833] ? kthread+0x13a/0x450 [ 196.995498][ T5833] ? __pfx_worker_thread+0x10/0x10 [ 196.995509][ T5833] kthread+0x370/0x450 [ 196.995519][ T5833] ? __pfx_kthread+0x10/0x10 [ 196.995530][ T5833] ret_from_fork+0x72b/0xd50 [ 196.995552][ T5833] ? __pfx_ret_from_fork+0x10/0x10 [ 196.995567][ T5833] ? __switch_to+0x800/0x10f0 [ 196.995602][ T5833] ? __pfx_kthread+0x10/0x10 [ 196.995617][ T5833] ret_from_fork_asm+0x1a/0x30 [ 196.995644][ T5833] [ 196.995650][ T5833] [ 197.012590][T13203] vhci_hcd vhci_hcd.0: USB bus 37 deregistered [ 197.013538][ T5833] Allocated by task 1: [ 197.021859][T13204] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller [ 197.023244][ T5833] kasan_save_stack+0x30/0x50 [ 197.023263][ T5833] kasan_save_track+0x14/0x30 [ 197.023275][ T5833] __kasan_kmalloc+0xaa/0xb0 [ 197.043422][T13204] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 37 [ 197.043765][ T5833] __kmalloc_noprof+0x322/0x820 [ 197.043793][ T5833] __usb_create_hcd+0x5e/0xac0 [ 197.046221][T13204] vhci_hcd vhci_hcd.0: created sysfs vhci_hcd.0 [ 197.047222][ T5833] vhci_hcd_probe+0x1a5/0x4e0 [ 197.047236][ T5833] platform_probe+0x106/0x1d0 [ 197.047258][ T5833] really_probe+0x241/0xa60 [ 197.047270][ T5833] __driver_probe_device+0x20e/0x450 [ 197.047283][ T5833] driver_probe_device+0x4a/0x140 [ 197.047296][ T5833] __device_attach_driver+0x1df/0x320 [ 197.047309][ T5833] bus_for_each_drv+0x159/0x1e0 [ 197.047319][ T5833] __device_attach+0x1e4/0x4d0 [ 197.047331][ T5833] device_initial_probe+0xaf/0xd0 [ 197.047344][ T5833] bus_probe_device+0x64/0x160 [ 197.047355][ T5833] device_add+0x121d/0x1970 [ 197.047369][ T5833] platform_device_add+0x35a/0x800 [ 197.047378][ T5833] platform_device_register_full+0x5cf/0x830 [ 197.047392][ T5833] vhci_hcd_init+0x1a1/0x2f0 [ 197.047404][ T5833] do_one_initcall+0x11d/0x700 [ 197.047420][ T5833] kernel_init_freeable+0x6ea/0x7b0 [ 197.047434][ T5833] kernel_init+0x1f/0x1e0 [ 197.047449][ T5833] ret_from_fork+0x72b/0xd50 [ 197.047463][ T5833] ret_from_fork_asm+0x1a/0x30 [ 197.047478][ T5833] [ 197.047481][ T5833] Freed by task 13203: [ 197.047487][ T5833] kasan_save_stack+0x30/0x50 [ 197.047499][ T5833] kasan_save_track+0x14/0x30 [ 197.047511][ T5833] kasan_save_free_info+0x3b/0x70 [ 197.047527][ T5833] __kasan_slab_free+0x5f/0x80 [ 197.047539][ T5833] kfree+0x22b/0x6c0 [ 197.047554][ T5833] usb_put_hcd+0x149/0x1f0 [ 197.047568][ T5833] vhci_hcd_remove+0xb5/0x1b0 [ 197.047599][ T5833] platform_remove+0x5f/0x80 [ 197.047612][ T5833] device_remove+0xcb/0x180 [ 197.047628][ T5833] device_release_driver_internal+0x44e/0x620 [ 197.047647][ T5833] unbind_store+0xf8/0x110 [ 197.047657][ T5833] drv_attr_store+0x74/0xb0 [ 197.047672][ T5833] sysfs_kf_write+0xf2/0x150 [ 197.047694][ T5833] kernfs_fop_write_iter+0x3e0/0x5f0 [ 197.047708][ T5833] vfs_write+0x6ac/0x1050 [ 197.047733][ T5833] ksys_write+0x12a/0x250 [ 197.047747][ T5833] do_syscall_64+0x115/0x870 [ 197.047760][ T5833] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.047771][ T5833] [ 197.047774][ T5833] Last potentially related work creation: [ 197.047779][ T5833] kasan_save_stack+0x30/0x50 [ 197.047790][ T5833] kasan_record_aux_stack+0xa7/0xc0 [ 197.047806][ T5833] insert_work+0x36/0x230 [ 197.047816][ T5833] __queue_work+0x9bc/0x12b0 [ 197.047826][ T5833] queue_work_on+0x1a9/0x1e0 [ 197.047836][ T5833] usb_hcd_giveback_urb+0x330/0x4a0 [ 197.047850][ T5833] unlink1+0x418/0x510 [ 197.047864][ T5833] usb_hcd_unlink_urb+0x131/0x210 [ 197.047879][ T5833] usb_kill_urb+0x121/0x320 [ 197.047887][ T5833] hub_quiesce+0x1e9/0x320 [ 197.047898][ T5833] hub_suspend+0x4ab/0x9e0 [ 197.047910][ T5833] usb_suspend_both+0x288/0x950 [ 197.047923][ T5833] usb_runtime_suspend+0x49/0x120 [ 197.047937][ T5833] __rpm_callback+0xc8/0x620 [ 197.057952][T13204] usb usb37: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 197.059928][ T5833] rpm_callback+0x16a/0x1b0 [ 197.059950][ T5833] rpm_suspend+0x2f4/0x11a0 [ 197.059962][ T5833] __pm_runtime_suspend+0xba/0x1a0 [ 197.061739][T13204] usb usb37: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 197.063164][ T5833] usb_runtime_idle+0x7e/0x90 [ 197.063181][ T5833] rpm_idle+0x322/0x790 [ 197.063193][ T5833] pm_runtime_work+0x120/0x150 [ 197.064767][T13204] usb usb37: Product: USB/IP Virtual Host Controller [ 197.067264][ T5833] process_one_work+0xa23/0x1940 [ 197.067278][ T5833] worker_thread+0x5ef/0xe50 [ 197.067288][ T5833] kthread+0x370/0x450 [ 197.067298][ T5833] ret_from_fork+0x72b/0xd50 [ 197.067312][ T5833] ret_from_fork_asm+0x1a/0x30 [ 197.067327][ T5833] [ 197.067330][ T5833] Second to last potentially related work creation: [ 197.067335][ T5833] kasan_save_stack+0x30/0x50 [ 197.067346][ T5833] kasan_record_aux_stack+0xa7/0xc0 [ 197.067362][ T5833] insert_work+0x36/0x230 [ 197.067371][ T5833] __queue_work+0x9bc/0x12b0 [ 197.067381][ T5833] queue_work_on+0x1a9/0x1e0 [ 197.067391][ T5833] usb_hcd_giveback_urb+0x3b8/0x4a0 [ 197.067406][ T5833] usb_hcd_submit_urb+0xab7/0x2150 [ 197.067421][ T5833] usb_submit_urb+0x827/0x19b0 [ 197.067431][ T5833] usb_start_wait_urb+0x10e/0x580 [ 197.067441][ T5833] usb_control_msg+0x328/0x4b0 [ 197.067450][ T5833] hub_suspend+0x826/0x9e0 [ 197.067462][ T5833] usb_suspend_both+0x288/0x950 [ 197.067475][ T5833] usb_runtime_suspend+0x49/0x120 [ 197.069487][T13204] usb usb37: Manufacturer: Linux syzkaller vhci_hcd [ 197.071177][ T5833] __rpm_callback+0xc8/0x620 [ 197.073753][T13204] usb usb37: SerialNumber: vhci_hcd.0 [ 197.075390][ T5833] rpm_callback+0x16a/0x1b0 [ 197.075407][ T5833] rpm_suspend+0x2f4/0x11a0 [ 197.075420][ T5833] __pm_runtime_suspend+0xba/0x1a0 [ 197.075433][ T5833] usb_runtime_idle+0x7e/0x90 [ 197.075449][ T5833] rpm_idle+0x322/0x790 [ 197.106350][ T5841] usb 8-1: device descriptor read/64, error -71 [ 197.107161][ T5833] pm_runtime_work+0x120/0x150 [ 197.107181][ T5833] process_one_work+0xa23/0x1940 [ 197.107192][ T5833] worker_thread+0x5ef/0xe50 [ 197.107203][ T5833] kthread+0x370/0x450 [ 197.153271][T13204] hub 37-0:1.0: USB hub found [ 197.154218][ T5833] ret_from_fork+0x72b/0xd50 [ 197.154239][ T5833] ret_from_fork_asm+0x1a/0x30 [ 197.154255][ T5833] [ 197.154259][ T5833] The buggy address belongs to the object at ffff88802d378000 [ 197.154259][ T5833] which belongs to the cache kmalloc-8k of size 8192 [ 197.154269][ T5833] The buggy address is located 2920 bytes inside of [ 197.154269][ T5833] freed 8192-byte region [ffff88802d378000, ffff88802d37a000) [ 197.154280][ T5833] [ 197.154283][ T5833] The buggy address belongs to the physical page: [ 197.154289][ T5833] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d378 [ 197.154311][ T5833] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 197.154321][ T5833] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 197.154332][ T5833] page_type: f5(slab) [ 197.154342][ T5833] raw: 00fff00000000040 ffff88801bc43180 dead000000000122 0000000000000000 [ 197.154353][ T5833] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 197.154363][ T5833] head: 00fff00000000040 ffff88801bc43180 dead000000000122 0000000000000000 [ 197.154373][ T5833] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 197.154382][ T5833] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 197.154392][ T5833] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 197.154398][ T5833] page dumped because: kasan: bad access detected [ 197.154404][ T5833] page_owner tracks the page as allocated [ 197.154408][ T5833] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11025115899, free_ts 11016986542 [ 197.154428][ T5833] post_alloc_hook+0xfd/0x120 [ 197.154446][ T5833] get_page_from_freelist+0xf48/0x3530 [ 197.154456][ T5833] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 197.154467][ T5833] new_slab+0xa2/0x640 [ 197.154476][ T5833] refill_objects+0xe3/0x410 [ 197.154485][ T5833] __pcs_replace_empty_main+0x376/0x680 [ 197.154501][ T5833] __kmalloc_noprof+0x66d/0x820 [ 197.154512][ T5833] __usb_create_hcd+0x5e/0xac0 [ 197.154527][ T5833] vhci_hcd_probe+0xf3/0x4e0 [ 197.154538][ T5833] platform_probe+0x106/0x1d0 [ 197.154549][ T5833] really_probe+0x241/0xa60 [ 197.154561][ T5833] __driver_probe_device+0x20e/0x450 [ 197.154573][ T5833] driver_probe_device+0x4a/0x140 [ 197.154586][ T5833] __device_attach_driver+0x1df/0x320 [ 197.154598][ T5833] bus_for_each_drv+0x159/0x1e0 [ 197.154608][ T5833] __device_attach+0x1e4/0x4d0 [ 197.154621][ T5833] page last free pid 10 tgid 10 stack trace: [ 197.154627][ T5833] free_pages_prepare+0x586/0xd80 [ 197.154642][ T5833] __free_contig_range_common+0x14f/0x250 [ 197.154658][ T5833] free_pages_bulk+0x12a/0x200 [ 197.154667][ T5833] vm_area_free_pages+0xad/0x2b0 [ 197.154679][ T5833] vfree+0x107/0x750 [ 197.154692][ T5833] delayed_vfree_work+0x56/0x80 [ 197.154705][ T5833] process_one_work+0xa23/0x1940 [ 197.154716][ T5833] worker_thread+0x5ef/0xe50 [ 197.154726][ T5833] kthread+0x370/0x450 [ 197.154735][ T5833] ret_from_fork+0x72b/0xd50 [ 197.154749][ T5833] ret_from_fork_asm+0x1a/0x30 [ 197.154763][ T5833] [ 197.154766][ T5833] Memory state around the buggy address: [ 197.154772][ T5833] ffff88802d378a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 197.154779][ T5833] ffff88802d378a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 197.154787][ T5833] >ffff88802d378b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 197.154793][ T5833] ^ [ 197.154799][ T5833] ffff88802d378b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 197.154807][ T5833] ffff88802d378c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 197.154812][ T5833] ================================================================== [ 197.154820][ T5833] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 197.154831][ T5833] CPU: 2 UID: 0 PID: 5833 Comm: kworker/u32:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 197.154847][ T5833] Tainted: [L]=SOFTLOCKUP [ 197.154852][ T5833] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 197.154861][ T5833] Workqueue: usbip_event event_handler [ 197.154873][ T5833] Call Trace: [ 197.154877][ T5833] [ 197.154882][ T5833] dump_stack_lvl+0x100/0x190 [ 197.154897][ T5833] vpanic+0x552/0x970 [ 197.154908][ T5833] ? __pfx_vpanic+0x10/0x10 [ 197.154918][ T5833] ? __pfx_vprintk_emit+0x10/0x10 [ 197.154938][ T5833] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 197.154954][ T5833] panic+0xd1/0xe0 [ 197.154964][ T5833] ? __pfx_panic+0x10/0x10 [ 197.154975][ T5833] ? end_report.part.0+0x23/0x90 [ 197.154991][ T5833] ? rcu_is_watching+0x12/0xc0 [ 197.155016][ T5833] ? end_report.part.0+0x23/0x90 [ 197.155031][ T5833] ? check_panic_on_warn+0x1f/0x90 [ 197.155044][ T5833] check_panic_on_warn.cold+0x19/0x34 [ 197.155055][ T5833] end_report.part.0+0x3a/0x90 [ 197.155071][ T5833] kasan_report.cold+0xe/0x18 [ 197.155086][ T5833] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 197.155098][ T5833] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 197.155110][ T5833] __kasan_check_byte+0x36/0x50 [ 197.155125][ T5833] lock_acquire+0x132/0x370 [ 197.155138][ T5833] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 197.155151][ T5833] ? _raw_spin_lock_irqsave+0x52/0x60 [ 197.155162][ T5833] _raw_spin_lock_irqsave+0x3a/0x60 [ 197.155173][ T5833] ? event_handler+0x21e/0x570 [ 197.155184][ T5833] event_handler+0x21e/0x570 [ 197.155195][ T5833] process_one_work+0xa23/0x1940 [ 197.155210][ T5833] ? __pfx_process_one_work+0x10/0x10 [ 197.155223][ T5833] ? __pfx_event_handler+0x10/0x10 [ 197.155235][ T5833] worker_thread+0x5ef/0xe50 [ 197.155248][ T5833] ? __pfx_worker_thread+0x10/0x10 [ 197.155260][ T5833] ? kthread+0x13a/0x450 [ 197.155270][ T5833] ? __pfx_worker_thread+0x10/0x10 [ 197.155281][ T5833] kthread+0x370/0x450 [ 197.155291][ T5833] ? __pfx_kthread+0x10/0x10 [ 197.155301][ T5833] ret_from_fork+0x72b/0xd50 [ 197.155317][ T5833] ? __pfx_ret_from_fork+0x10/0x10 [ 197.155332][ T5833] ? __switch_to+0x800/0x10f0 [ 197.155344][ T5833] ? __pfx_kthread+0x10/0x10 [ 197.155355][ T5833] ret_from_fork_asm+0x1a/0x30 [ 197.155373][ T5833] [ 197.157553][ T5833] Kernel Offset: disabled VM DIAGNOSIS: 21:53:53 Registers: info registers vcpu 0 CPU#0 RAX=00000000001ad09d RBX=ffffffff8e891480 RCX=ffffffff8bbb42d5 RDX=0000000000000000 RSI=ffffffff8e1a815f RDI=ffffffff8c402680 RBP=fffffbfff1d12290 RSP=ffffffff8e807e10 R8 =0000000000000001 R9 =ffffed100d48678d R10=ffff88806a433c6b R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffffffff1d00fc6 R15=dffffc0000000000 RIP=ffffffff8bbb289f RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d5dd8000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007ffd92ef0da8 CR3=00000000251b3000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=00000000000003ff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0ad395d560 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffa5c976f6 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffa5c976f6 00007fffa5c976fc ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0ad2c355ef ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0ad2c3562f ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0ad2c35793 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0ad2c35621 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0ad2df2600 00007f0ad2df25e0 00007f0ad2df25e8 00007f0ad2df2618 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000004 0008000f0010000a ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0ad2df25f8 00007f0ad2df25c8 00007f0ad2df2600 00007f0ad2df25e0 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=00000000ffffffff RBX=ffffffff8ebe8200 RCX=0000000000000001 RDX=0000000000000000 RSI=ffffffff8e29e6a5 RDI=ffffffff8c402680 RBP=ffff88802bf60000 RSP=ffffc90004be7510 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000000 R12=00000000ffffffff R13=0000000000000246 R14=0000000000000000 R15=ffff88802a8844b0 RIP=ffffffff8bbb4a58 RFL=00000082 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007fd282b336c0 ffffffff 00c00000 GS =0000 ffff8880d5ed8000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007fd282b32ff8 CR3=000000003cd0a000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000104080 Opmask01=0000000000000000 Opmask02=00000000ffff7fdf Opmask03=0000000020400004 Opmask04=00000000ffffffff Opmask05=00000000004007ff Opmask06=0000000007ffe7ff Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 44455a494c414954 494e495f43455355 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000056218bdb64c0 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000056218bd9c3c0 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00ff000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffff0000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 73732552f8aad483 737325579adde159 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 9655c3fd20a61ed1 73737376116bced6 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 38336e6f6d627375 2f6e6f6d6273752f 302e6463685f6963 68762f6d726f6674 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 005600051f40494c 43055c5155484005 424b4c55554c4e53 004057005b1a0f00 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 7269762f73656369 7665642f7379732f 0000000000000051 0000363030302e32 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 772c30362c41352c 39352c38352c3135 2c303566736c6d2c 31312c30312c352c ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 342c332c322c312c 3061722c4533312c 4433312c4333312c 4233312c4133312c ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3733312c3633312c 3433312c3333312c 3133312c3033316b 2c35312c332c312c ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 30652d4245453165 3141323070424132 317633303030623a 7475706e693d5341 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 323032302c313032 302c394631302c32 4331302c38423130 2c464131302c4541 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3130312c00303039 2c342c0000302030 2030202d20303000 3000303030370032 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 282b2e2fdf37342d 280bbfbf23243324 26312033fc040f18 1317140d080b0412 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 343133bffc121104 1214041204110814 100411bffc040f18 1317140d080b0412 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000038 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85a2fef5 RDI=ffffffff9ba0be80 RBP=ffffffff9ba0be40 RSP=ffffc90004a67570 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3364323038386552 R12=0000000000000000 R13=0000000000000038 R14=ffffffff9b6fe21a R15=ffffffff85a2fe90 RIP=ffffffff85a2ff1f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d5fd8000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007fd282acfff8 CR3=000000003cd0a000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000010001 Opmask01=0000000000000000 Opmask02=000000000000003f Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 203a6b6361747320 6461657268747020 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc6a22e836 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc6a22e836 00007ffc6a22e83c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd281c355ef ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd281c3562f ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd281c35793 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd281c35621 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 657a6973203c2065 7a69736565726600 632e6b6361747365 7461636f6c6c6100 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 405f4c5605190540 5f4c564040574300 460b4e4644515640 5144464a49494400 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd281df25f8 00007fd281df25c8 00007fd281df2600 00007fd281df25e0 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=00000000001775fb RBX=ffff88801eeea540 RCX=ffffffff8bbb42d5 RDX=0000000000000000 RSI=ffffffff8e1a815f RDI=ffffffff8c402680 RBP=ffffed1003ddd4a8 RSP=ffffc90000197e00 R8 =0000000000000001 R9 =ffffed100d4e678d R10=ffff88806a733c6b R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff92000032fc4 R15=dffffc0000000000 RIP=ffffffff8bbb289f RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d60d8000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000000000000 CR3=000000003b4d8000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=00000000000003ff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd5be07206 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd5be07206 00007ffd5be0720c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f77492355ef ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f774923562f ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7749235793 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7749235621 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000004 0000000b000c000a ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f77493f25f8 00007f77493f25c8 00007f77493f2600 00007f77493f25e0 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000