last executing test programs: 5.693228783s ago: executing program 0 (id=537): socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000400)=ANY=[], 0x107c) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2b, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$kcm(0x2, 0x3, 0x84) sendmsg$inet(r0, 0x0, 0x8800) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x82, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000240)=0x3) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000080)=0x7f) syz_emit_ethernet(0x32, 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000340)=0x8) read$dsp(r1, &(0x7f0000000280)=""/79, 0x4f) move_mount(0xffffffffffffffff, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) getpid() bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 5.243762998s ago: executing program 1 (id=540): openat$tun(0xffffffffffffff9c, 0x0, 0x80840, 0x0) socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r1, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f00000001c0)='.\x00', &(0x7f0000000080)='system.posix_acl_default\x00', &(0x7f0000000340)={{}, {}, [], {0x2, 0x2}, [], {0x2}, {0x2}}, 0x24, 0x3) sendmmsg$unix(r0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) 4.773477425s ago: executing program 3 (id=544): socket$unix(0x1, 0x2, 0x0) landlock_create_ruleset(&(0x7f0000000140)={0x10895, 0x3, 0x2}, 0x18, 0x0) socket$nl_generic(0x10, 0x3, 0x10) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000040)='mem\x00\xffEev\xf2r\xf1\x18\x1d\xb9\x00y_hug$\bo-\x03Q`]o\x8cr\x9d_etl\xf9\xdd\a\xad\\H\xe94\b,H\xbf', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000a80)={0x0, 0xabba, 0x400, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f00000006c0)=0x0, &(0x7f0000000580)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='oom_adj\x00') read$FUSE(r6, 0x0, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x21}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x1, 0x1f0, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8200, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 4.757379126s ago: executing program 2 (id=545): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x22, 0x0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000500)=@broute={'broute\x00', 0x20, 0x1e01, 0x90, [0x0, 0x0, 0x1e01, 0x1e01, 0xfffff9, 0x80000440], 0x0, 0x0, &(0x7f0000000440)=[{0x0, '\x00', 0x1e010000, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}]}, 0xe0) socket$packet(0x11, 0xa, 0x300) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect(0x0, 0x36, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000011c0)={r2, 0x0, 0x0}, 0x10) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r3, 0x0, 0xc8, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socket$igmp(0x2, 0x3, 0x2) r4 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000080)={0x100000011, @multicast2, 0x0, 0x0, 'nq\x00', 0x28, 0xc, 0x5c}, 0x2c) syz_emit_ethernet(0x66, &(0x7f0000000400)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd60a24b9f00302b00fe8000000000000000000000000000bbfe8000000000000000000000000000aa3a020201"], 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000300)='illinois', 0x8) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) close(r0) 4.74787486s ago: executing program 0 (id=546): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000200)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x24, 0x3, 0x46d, 0xc082, 0x0, 0x0, "0600ff0901a10185107508950609018102090191028511750895130901810209019102c0"}}, 0x13c) read(r0, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000080)={0x0, 0x7, 0x10, 0x5, 0xb, 0x7, 0x51d6, 0x3eb, {0x0, @in6={{0xa, 0x72, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, 0xa}}, 0x8, 0x7f, 0x101, 0x1, 0x2}}, &(0x7f0000000140)=0xb0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000200)={r3, 0x3, 0x2}, &(0x7f0000000240)=0x8) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r4, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r4, 0x5001, 0x0) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f00000000c0)=0x7) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0xb}) shmat(0x0, &(0x7f000051b000/0x3000)=nil, 0x2000) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) sendmsg$key(r1, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x2, 0x400000000000003, 0x0, 0x5, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfbffffff}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @empty}}]}, 0x50}}, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r1, 0x8982, &(0x7f0000000280)={0x8, 'batadv0\x00', {'veth1_to_team\x00'}, 0x667}) write$UHID_INPUT2(r0, &(0x7f0000000440)={0xc, {0x4, "10ff0011"}}, 0xa) 4.332515311s ago: executing program 1 (id=547): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000640)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x28, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x2001, 'sh\x00', 0x1, 0x5, 0x6d}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) 4.153147169s ago: executing program 2 (id=548): socket$key(0xf, 0x3, 0x2) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x128, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0xfffffffffffffffd, 0x10000000, 0xffffffffffffffff}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}, @lifetime_val={0x24, 0x9, {0x3, 0x8000000000000001, 0xb4, 0x5}}]}, 0x128}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x1a, 0x7, 0x70bd2a, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast1, 0xffff, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0xfeffff7f00000001, 0x0, 0x60000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, 0x0) read(r3, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r3, 0x54a2) r4 = socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, 0x0) close(r2) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$XFS_IOC_PATH_TO_HANDLE(r4, 0xc0385869, 0x0) ioctl$SNAPSHOT_GET_IMAGE_SIZE(0xffffffffffffffff, 0x8008330e, 0x0) sendmsg$NFT_BATCH(r5, 0x0, 0x0) sendmsg$NFT_BATCH(r5, 0x0, 0x40) 3.793852646s ago: executing program 0 (id=549): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0x6, &(0x7f0000000300)=@raw=[@generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xffffffc0}, @call={0x85, 0x0, 0x0, 0xd1}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x45}, @generic={0x95}], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r2, r1, 0x25, 0x5, @void}, 0x10) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) keyctl$clear(0x3, 0xfffffffffffffffd) request_key(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0xfffffffffffffffe) r3 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b00000005000000020000000400000005"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xe, 0x4, 0x8, 0x7, 0x0, 0xffffffffffffffff, 0x7ff}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x11, 0x15, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000100850000000100000018110000", @ANYRES32, @ANYBLOB="00005130bd18475ab100000000dcdc000000b7080000000000007bf4289c9402c600f8b703002008000000b7040000000100be971a1732efd65a51b93800"/73, @ANYBLOB="d67f16b81011c22919a5bc8a2b5b79ca410b81e8e380dec05a9329cf53527d09d6275a8c2b27cf7e0721dfd679366990cf89c13ac425e94fa2cd41d0867fd8c71a6a6a6a321f15e6c32e1d38954854bf0eb7a8975d98e940c37988f4101e74ae0b72fe8b480a400c62c3c427c428e3de83ddbb836af15af4f52ff7f9304a00d9768dcf109e91dc04ba6ea683d2c559092f14653f7ebd0bfb2f27891e023701dd9775cb7290b54d943c8bf0", @ANYRESHEX=r1], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f00000000c0)='source', 0x0, r3) 3.793584176s ago: executing program 2 (id=550): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x11) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b4, 0x0, 0x2, 0x158}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) write$tun(0xffffffffffffffff, &(0x7f0000000500)={@val={0x0, 0xfbfb}, @void, @llc={@snap={0x1fe, 0x0, "4ee7", "85071d", 0xf8, "ae6ca250a8b910a892eb6a98da7a744a7b5d0a839da93cb80e7518adbe5ba27c6b40683163a099000dd1ba8c5cf7c45a40d717f5ea4d2ed8dd53f6b64110edf3"}}}, 0x4d) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0x5ba, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = dup(0xffffffffffffffff) r7 = openat$incfs(r6, &(0x7f00000002c0)='.pending_reads\x00', 0x10000, 0xf2) syz_ublk_setup_queues(r6, r5, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x3, 0x12c, 0x0, r7}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x0, 0xa100, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0x2, 0xae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x4000, 0x2000000, 0xf8, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x20, 0x2, 0x24e}}], 0x1, &(0x7f0000000340)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x40000, 0x0) fcntl$notify(r8, 0x402, 0x1a) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r10, @ANYBLOB="08002600940900000800b700"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x4}, @HCI_OP_EXIT_PERIODIC_INQ={{0xd1}, 0xb}}}, 0x7) 3.663470969s ago: executing program 0 (id=551): bpf$TOKEN_CREATE(0x24, &(0x7f0000000080), 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB], 0x0, 0x37}, 0x28) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) syz_usb_connect(0x0, 0x39, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r0, 0x400448ca, 0x0) ioctl(r0, 0x400448c9, 0x0) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000000)={0x80000000, 0x6, 0x3, 0x2, 0x9e, "3f3c5e0000ff775cfffffffff903e7ffffff00", 0x401, 0x91}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000002300)=@newqdisc={0x88, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0x5}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [0x4, 0x9, 0x8, 0x10, 0x9, 0x7, 0x5, 0x7, 0x9, 0xc, 0x1, 0xa, 0xb, 0x8, 0x1, 0x2], 0x1, [0x26f, 0x1ff, 0x0, 0x1d7, 0x4, 0x2, 0x9, 0x1ae, 0x39fe, 0x80, 0x6, 0xac8, 0x9, 0x0, 0x63cb, 0x1], [0xb, 0xfffa, 0x10, 0x4, 0x5, 0x226c, 0xc7, 0x5, 0x7, 0x3, 0x7, 0xd, 0x2af1, 0x40, 0x7ff, 0x81]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8000) write(r0, &(0x7f0000000200)="4a00000011007f0314066f9a70932d490675bc59083301", 0x17) 3.343551324s ago: executing program 1 (id=552): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) write$tun(r0, &(0x7f0000000380)=ANY=[], 0xfdef) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r1, 0x0, 0x2) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r4, r4) setpgid(0x0, r4) fchdir(r3) stat(&(0x7f0000000240)='./file0\x00', 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="0019000000000000000000bf4000000000000000756b66b266340537f1a266c3e4442e834ab4a80a8d182fd0", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/25], 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r5}, 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x6, 0x10, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000060000007b8af0ff0000", @ANYRES32=r5, @ANYRES64=r5], &(0x7f0000000640)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000, 0xa, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000100)={0x2, 0x0, 0xeeef0000, 0x1000, &(0x7f00000ae000/0x1000)=nil}) 3.251248856s ago: executing program 2 (id=553): setns(0xc9, 0x0) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=ANY=[@ANYRES32=0x0], 0x34}, 0x1, 0x0, 0x0, 0x600}, 0x2000114) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000001340)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@ll={0x11, 0x2, 0x0, 0x1, 0x40, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x80, 0x0}, 0x20000010) sendto$inet6(r3, &(0x7f00000001c0), 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x1c) r4 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, 0xffffffffffffffff, &(0x7f00000001c0)={0x2000000d}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000000c0)={0x20000, 0x1, 0x1000, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, &(0x7f0000000180)=0x6f) write$dsp(r2, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000240)=ANY=[], 0x34}}, 0x0) 2.537068918s ago: executing program 3 (id=554): r0 = epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@file={0x0, './bus\x00'}, 0x6e) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/mptcp/available_schedulers\x00', 0x0, 0x0) read$FUSE(r3, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET_DEF(r4, 0x4b72, &(0x7f0000000500)={0x2, 0x1, 0xe, 0x9, 0x80098, 0x0}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x2, &(0x7f00000000c0)=[{0x6, 0x72, 0x0, 0x7fff0000}, {0x1, 0x6, 0x40, 0x7fffffff}]}) close_range(r5, 0xffffffffffffffff, 0x0) r6 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0) read$FUSE(r6, &(0x7f0000001200)={0x2020, 0x0, 0x0}, 0x2020) io_submit(0x0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x2, 0xffffffffffffffff, 0x0}]) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) rt_sigtimedwait(&(0x7f0000000000)={[0x0, 0x6]}, 0x0, &(0x7f00000000c0)={0x0, 0x989680}, 0x8) write$FUSE_LSEEK(r6, &(0x7f0000000040)={0x18, 0x0, r7, {0x2}}, 0x18) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0x98, 0x0, 0x1, 0x700, 0x0, 0x0, {0x5}, [@CTA_PROTOINFO={0x30, 0x4, 0x0, 0x1, @CTA_PROTOINFO_DCCP={0x2c, 0x2, 0x0, 0x1, [@CTA_PROTOINFO_DCCP_ROLE={0x5, 0x2, 0xc9}, @CTA_PROTOINFO_DCCP_STATE={0x5, 0x1, 0x6f}, @CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ={0xc, 0x3, 0x1, 0x0, 0x40001}, @CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ={0xc, 0x3, 0x1, 0x0, 0x13}]}}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x3}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x2}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x6}, @CTA_PROTOINFO={0x28, 0x4, 0x0, 0x1, @CTA_PROTOINFO_DCCP={0x24, 0x2, 0x0, 0x1, [@CTA_PROTOINFO_DCCP_STATE={0x5, 0x1, 0x3}, @CTA_PROTOINFO_DCCP_STATE={0x5, 0x1, 0xc6}, @CTA_PROTOINFO_DCCP_ROLE={0x5, 0x2, 0x5}, @CTA_PROTOINFO_DCCP_STATE={0x5, 0x1, 0x3}]}}, @CTA_SYNPROXY={0xc, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x7}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x400}]}, 0x98}, 0x1, 0x0, 0x0, 0x4}, 0x4080) 2.403664835s ago: executing program 1 (id=555): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000680), &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @auto=[0x33, 0x65, 0x36, 0x65, 0x66, 0x34, 0x63, 0x64, 0x31, 0x1d, 0x38, 0x37, 0x38, 0x0, 0x36, 0x33]}, &(0x7f0000000100)={0x0, "00379bce195566778899aabbccddfcff00112233445566778899aabbccddeeff000011688e0346d524b29db701e5ddeeff8000", 0x3d}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37, 0x30, 0x64, 0x30, 0x30, 0x6c, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x37, 0x0, 0x30, 0x32, 0x34, 0x64, 0x30, 0x30, 0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x35, 0x30, 0x30, 0x30, 0x65, 0x30, 0x30, 0x30, 0x65, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @desc2}, &(0x7f0000000100)={0x0, "00112233445566768899aabbccddeeff001122c6445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aa91ccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @auto=[0x30, 0x31, 0x35, 0x63, 0x34, 0x30, 0x30, 0x30, 0x30, 0x62, 0x30, 0x30, 0x66, 0x36, 0x30, 0x39]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x39, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36, 0x30, 0x65, 0x30, 0x65, 0x30, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$keyring(&(0x7f0000000700), &(0x7f0000000740)={'syz', 0x0}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @desc3}, &(0x7f0000000100)={0x0, "00112233444d66778899aabbccddefff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff0011223344556677889c69bbccddeeff", 0x40}, 0x48, r1) add_key$keyring(&(0x7f0000000640), &(0x7f00000006c0)={'syz', 0x2}, 0x0, 0x0, r1) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x3}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x36, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x67, 0x63, 0x66, 0x30, 0x64, 0x31, 0x30, 0x66]}, &(0x7f0000000780)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x3e}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36, 0x30, 0x30, 0x31, 0x63]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x31, 0x30, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x31, 0x31]}, &(0x7f0000000580)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) keyctl$unlink(0x9, r0, r1) 2.35114411s ago: executing program 1 (id=556): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$phonet_pipe(0x23, 0x5, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000380)='devices.list\x00', 0x0, 0x0) preadv(r2, 0x0, 0x0, 0x1000000, 0xffffffff) setsockopt$PNPIPE_HANDLE(r0, 0x113, 0x3, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) poll(&(0x7f0000000180)=[{r3, 0xe203}, {r0, 0x8000}, {r0, 0x2400}, {r0, 0x10100}, {r3, 0xc030}, {r0, 0x23}, {r0, 0x24}, {r0, 0x290}, {r4, 0x40}], 0x9, 0x40) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x1}]}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) bind$bt_hci(r5, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r6) sendmsg$IEEE802154_LLSEC_ADD_DEV(r7, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000006c0)={0x14, r8, 0x1, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x95c5c52c0427a77b}, 0x2400c8c0) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r9, 0x400448ca, 0x0) 1.596645824s ago: executing program 3 (id=557): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/rcu_normal', 0x102, 0x166) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x80580, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000f40)={0x1000008, "b546baa5cc590d3033de259c2996817bb959ebab028deda525e19bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000100)={"4cf36a628ca84ddd2961bd42a3b25f1e2273a95c6ff8aa046bd8aca774d0a64b", r4}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xf, 0xb, 0xff}, 0x3d, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x5, 0x4, 0x10007e, 0x20000006, 0x53, 0x6, 0x10001, 0x80005, 0x102, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x2, 0x2, 0x7, 0x4, 0x200ffff, 0x40000026, 0xd, 0x53b7, 0x6, 0x7, 0xe661, 0x4, 0x7, 0x6, 0x8, 0x4c74, 0x201, 0x0, 0x4, 0x5, 0x8, 0x800080eb, 0xa, 0x17, 0x1, 0x9, 0x200, 0x3e, 0x8c, 0x6, 0xca9, 0x0, 0x2, 0x4, 0x9, 0x400, 0x80, 0x10001, 0x5, 0x6, 0x6, 0x5, 0x1, 0x40], [0xd, 0x9, 0x80000130, 0x8004, 0x8001, 0xfffffff3, 0x2, 0xfffffff7, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x42f, 0xe, 0x312, 0x78, 0x1, 0x2, 0xffff, 0x7, 0x7fff, 0x6, 0x4400, 0x401, 0x6, 0x1, 0xfc, 0x5, 0x1000005, 0x5f2f, 0xd, 0x40000101, 0x1, 0x4, 0xffff80f1, 0x7, 0x6, 0x8, 0x9, 0x5, 0x47, 0x8020, 0x4, 0xfe000000, 0xffff, 0xfffffe01, 0x4, 0x9, 0x200, 0x101, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93694, 0x6, 0x9], [0x7, 0xa, 0x0, 0x7, 0xfffffffe, 0x100, 0x8d2, 0x0, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x14, 0x6, 0x5, 0x5, 0x8, 0x5, 0x1, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000808, 0x2, 0x6d03, 0x5, 0xd, 0x800003, 0x200, 0x400080, 0x3, 0x4, 0x2950bfaf, 0x2, 0xa2, 0x7, 0xa9, 0x1, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x128, 0x4, 0x2000001, 0x6, 0x0, 0x2, 0x21c, 0x120000, 0x3, 0x1000, 0x80aaed, 0x4, 0x24], [0x9, 0x840bb33, 0x7ffffffd, 0xb, 0x5, 0x100093a, 0x7, 0x1000006, 0x1, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0x3, 0x80101, 0x10003, 0x2, 0x7fff, 0x1000, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000001, 0x7, 0x8, 0xc8, 0xfffffffd, 0xfffff000, 0x4010080, 0x3, 0x7e, 0x4, 0x1000, 0x7, 0xaf, 0x8, 0x400, 0x226, 0x5, 0x5, 0x1, 0x30b1d69b, 0x1000a1f, 0xffffffff, 0x7, 0x2, 0x6c1b, 0x0, 0x4, 0x928, 0xb1e, 0xc2, 0x200, 0xffff2441, 0xf7f]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) close_range(r2, r3, 0x0) poll(&(0x7f0000000200)=[{r0, 0x1210}], 0x1, 0x1ff8) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) accept4(r0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, 0x0, 0x0) 1.596262226s ago: executing program 1 (id=558): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r1 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d81201000001010203010902200001010080320904000002ff000000070581020002"], 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) readv(r2, &(0x7f0000000400)=[{&(0x7f00000000c0)=""/72, 0x48}], 0x1) syz_usb_ep_write(r1, 0x81, 0x0, 0x0) r3 = shmget$private(0x0, 0x2000, 0x54003f00, &(0x7f0000ffc000/0x2000)=nil) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) ioctl$PTP_SYS_OFFSET_EXTENDED(r0, 0xc4c03d09, &(0x7f0000000080)={0xa}) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, 0x0, 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000000)={@multicast, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x4002, 0x5, 0x11, 0x0, @empty, @empty}, {0x4e24, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "96597d00c5c0577eec4f99e3a24dd89fb66655d7b05291cb", "af6af5116bf52dbb91d30ae25aab828a961858f6c338a29f34c53e0526788e16"}}}}}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', 0x0, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r5, 0xc138fd0f, &(0x7f0000000000)="04000000000000000000") madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) setitimer(0x2, 0x0, 0x0) shmat(r3, &(0x7f0000000000/0x4000)=nil, 0x6000) read$FUSE(r0, &(0x7f0000004180)={0x2020}, 0x2020) 1.038485469s ago: executing program 0 (id=559): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_smc(0x2b, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000004c0)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}], 0x3}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x21) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) 943.669071ms ago: executing program 2 (id=560): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000640)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x28, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x2001, 'sh\x00', 0x1, 0x5, 0x6d}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) 660.944578ms ago: executing program 3 (id=561): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x11) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b4, 0x0, 0x2, 0x158}, &(0x7f00000000c0), &(0x7f0000000280), &(0x7f0000000140)) write$tun(0xffffffffffffffff, &(0x7f0000000500)={@val={0x0, 0xfbfb}, @void, @llc={@snap={0x1fe, 0x0, "4ee7", "85071d", 0xf8, "ae6ca250a8b910a892eb6a98da7a744a7b5d0a839da93cb80e7518adbe5ba27c6b40683163a099000dd1ba8c5cf7c45a40d717f5ea4d2ed8dd53f6b64110edf3"}}}, 0x4d) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) r3 = openat$incfs(r2, &(0x7f00000002c0)='.pending_reads\x00', 0x10000, 0xf2) syz_ublk_setup_queues(r2, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x3, 0x12c, 0x0, r3}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x0, 0xa100, 0x10000004, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0x2, 0xae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x4000, 0x2000000, 0xf8, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x20, 0x2, 0x24e}}], 0x1, &(0x7f0000000340)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x40000, 0x0) fcntl$notify(r4, 0x402, 0x1a) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r6, @ANYBLOB="08002600940900000800b700"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x4}, @HCI_OP_EXIT_PERIODIC_INQ={{0xd1}, 0xb}}}, 0x7) 73.780047ms ago: executing program 3 (id=562): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000180), 0x10) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000000)={0x2, [0x0, 0x0]}, &(0x7f0000000040)=0x8) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f0000000280)={{0x8080000, 0xf000, 0x8, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {0xb000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x81, 0x0, 0x44, 0xe, 0x0, 0x3}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x10}, {0x11000, 0x0, 0x0, 0x0, 0x9, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1a}, {0x100000, 0xd000, 0x0, 0x0, 0x0, 0x8f, 0x0, 0x0, 0x0, 0x0, 0xf}, {0x30000, 0x80a0000, 0x9}, {0x0, 0x13f1000, 0x11aba00d78cbb42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3}, {0x6000}, {0x1, 0x1}, 0x60000010, 0x0, 0x0, 0x0, 0x8, 0x0, 0x900, [0x0, 0x0, 0x0, 0x3]}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x800005}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x5}], 0x1}, 0x0) sendmsg$rds(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @private=0xa010102}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f0000000880)=""/240, 0xf0}, {0x0}], 0x2) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f00000001c0)={@remote, @ipv4={'\x00', '\xff\xff', @remote}, @empty, 0x1, 0x40, 0x8, 0x100, 0x6, 0x808082}) 15.73934ms ago: executing program 3 (id=563): r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="38000000240001040100000000000000000000000100000000000100ffffffff0000000008000100657473000c0002800500010010000000", 0x38) write(r0, &(0x7f0000000040)="38000000240001040200000000000000000000000100000000000200010001000000000008000100657473000c0002800500010010000000", 0x38) write(r0, &(0x7f0000000080)="38000000240001040300000000000000000000000100000000000300020001000000000008000100657473000c0002800500010010000000", 0x38) write(r0, &(0x7f00000000c0)="38000000240001040400000000000000000000000100000000000400030001000000000008000100657473000c0002800500010010000000", 0x38) write(r0, &(0x7f0000000100)="38000000240001040500000000000000000000000100000000000500040001000000000008000100657473000c0002800500010010000000", 0x38) write(r0, &(0x7f0000000140)="38000000240001040600000000000000000000000100000000000600050001000000000008000100657473000c00028005", 0x31) write(r0, &(0x7f0000000180)="38000000240001040700000000000000000000000100000000000700060001000000000008000100657473000c0002800500010010000000", 0x38) write(r0, &(0x7f0000000200)="380000002400010409000000000000000000000001000000000009000800010000000000080001006574", 0x2a) write(r0, &(0x7f0000000280)="38000000240001040b00000000000000000000000100000000000b000a0001000000000008000100657473000c0002800500010010000000", 0x38) write(r0, &(0x7f00000002c0)="38000000240001040c00000000000000000000000100000000000c000b0001000000000008000100657473000c0002800500010010000000", 0x38) write(r0, &(0x7f0000000300)="38000000240001040d00000000000000000000000100000000000d000c0001000000000008000100657473000c0002800500010010000000", 0x38) write(r0, &(0x7f0000000340)="38000000240001040e00"/20, 0x14) write(r0, 0x0, 0x0) write(r0, &(0x7f00000003c0)="380000002400010410000000000000000000000001000000000010000f0001000000000008000100657473000c0002800500010010000000", 0x38) write(r0, &(0x7f0000000400)="38000000240001041100000000000000000000000100000000001100100001000000000008000100657473000c0002800500010010000000", 0x38) write(r0, &(0x7f0000000500)="240000002a0001039900000000000000000000000100"/36, 0x24) read(r0, &(0x7f0000002000), 0x8000) read(r0, &(0x7f0000002000), 0x8000) read(r0, &(0x7f0000002000), 0x8000) 15.428076ms ago: executing program 2 (id=564): mount(0x0, &(0x7f0000000060)='./sys\x00', &(0x7f0000000070)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) write(r0, &(0x7f0000000340), 0x0) close(0xffffffffffffffff) write(0xffffffffffffffff, &(0x7f0000000b00), 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x12a) symlinkat(0x0, 0xffffffffffffff9c, 0x0) symlinkat(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ed) mkdirat(r0, 0x0, 0x1ed) symlinkat(&(0x7f0000001500)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlinkat(&(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000001900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') 0s ago: executing program 0 (id=565): socketpair(0xa, 0x1, 0x100, &(0x7f0000000700)) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), 0x0, &(0x7f00000004c0), 0x0, 0x0) syz_open_procfs(0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x5, 0x7fff7ffc}]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xa) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000003c0)) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x5) setreuid(0xee00, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xb, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}, [@printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x9b}}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x94) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000440)={'mangle\x00', 0x3, [{}, {}, {}]}, 0x54) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0xf000, 0x0) kernel console output (not intermixed with test programs): zkaller0: entered promiscuous mode [ 43.007783][ T5924] syzkaller0: entered allmulticast mode [ 43.079027][ T5822] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 43.080667][ T5822] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 43.080699][ T5822] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 43.082265][ T5822] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.082277][ T5822] usb 5-1: Product: syz [ 43.082284][ T5822] usb 5-1: Manufacturer: syz [ 43.082291][ T5822] usb 5-1: SerialNumber: syz [ 43.751801][ T5927] batman_adv: batadv0: Adding interface: veth0 [ 43.751821][ T5927] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 43.751845][ T5927] batman_adv: batadv0: Interface activated: veth0 [ 43.757808][ T5927] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 43.757829][ T5927] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 43.769928][ T5927] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 43.769949][ T5927] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 43.772064][ T5927] batman_adv: batadv0: Interface deactivated: veth0 [ 43.772080][ T5927] batman_adv: batadv0: Removing interface: veth0 [ 44.129459][ T5935] mmap: syz.1.17 (5935) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 44.199675][ T5937] netlink: 'syz.2.18': attribute type 1 has an invalid length. [ 44.256058][ T5941] netlink: 28 bytes leftover after parsing attributes in process `syz.2.18'. [ 44.286620][ T5747] Bluetooth: hci3: command tx timeout [ 44.287397][ T5747] Bluetooth: hci2: command tx timeout [ 44.287423][ T5747] Bluetooth: hci0: command tx timeout [ 44.487456][ T1344] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 44.517616][ T5576] usb 5-1: USB disconnect, device number 2 [ 44.636678][ T1344] usb 8-1: Using ep0 maxpacket: 32 [ 44.637423][ T1344] usb 8-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 44.639849][ T1344] usb 8-1: config 0 has an invalid interface number: 12 but max is 0 [ 44.639870][ T1344] usb 8-1: config 0 has no interface number 0 [ 44.639904][ T1344] usb 8-1: config 0 interface 12 has no altsetting 0 [ 44.641804][ T1344] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.641822][ T1344] usb 8-1: Product: syz [ 44.641834][ T1344] usb 8-1: Manufacturer: syz [ 44.641845][ T1344] usb 8-1: SerialNumber: syz [ 44.645354][ T1344] usb 8-1: config 0 descriptor?? [ 45.163948][ T5950] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 45.172531][ T5950] netlink: 48 bytes leftover after parsing attributes in process `syz.0.22'. [ 45.331822][ T5954] netlink: 'syz.2.23': attribute type 10 has an invalid length. [ 45.333153][ T5954] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.333766][ T5954] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.338895][ T5954] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.338945][ T5954] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.339146][ T5954] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.339196][ T5954] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.341367][ T5954] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 45.372092][ T5951] netlink: 4 bytes leftover after parsing attributes in process `syz.1.21'. [ 45.393117][ T5954] netlink: 4 bytes leftover after parsing attributes in process `syz.2.23'. [ 45.408396][ T5954] bridge_slave_1: left allmulticast mode [ 45.408424][ T5954] bridge_slave_1: left promiscuous mode [ 45.409715][ T5954] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.412994][ T5954] bridge_slave_0: left allmulticast mode [ 45.413017][ T5954] bridge_slave_0: left promiscuous mode [ 45.413207][ T5954] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.428895][ T5956] netlink: 8 bytes leftover after parsing attributes in process `syz.0.24'. [ 45.428921][ T5956] FAULT_INJECTION: forcing a failure. [ 45.428921][ T5956] name failslab, interval 1, probability 0, space 0, times 1 [ 45.428936][ T5956] CPU: 1 UID: 0 PID: 5956 Comm: syz.0.24 Not tainted syzkaller #0 PREEMPT(full) [ 45.428965][ T5956] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 45.428973][ T5956] Call Trace: [ 45.428980][ T5956] [ 45.428986][ T5956] dump_stack_lvl+0x100/0x190 [ 45.429013][ T5956] should_fail_ex.cold+0x5/0xa [ 45.429037][ T5956] should_failslab+0xc2/0x120 [ 45.429054][ T5956] __kvmalloc_node_noprof+0x113/0x9b0 [ 45.429067][ T5956] ? nla_strdup+0xc3/0x150 [ 45.429084][ T5956] ? nf_tables_addchain.constprop.0+0x9be/0x1ca0 [ 45.429099][ T5956] nf_tables_addchain.constprop.0+0x9be/0x1ca0 [ 45.429114][ T5956] ? nft_chain_lookup+0x59c/0xa60 [ 45.429130][ T5956] ? __pfx_nf_tables_addchain.constprop.0+0x10/0x10 [ 45.429143][ T5956] ? __pfx_nft_chain_lookup+0x10/0x10 [ 45.429157][ T5956] ? __lock_acquire+0x5c0/0x1f40 [ 45.429182][ T5956] ? nla_strcmp+0xff/0x130 [ 45.429199][ T5956] ? nft_table_lookup.part.0+0x1e3/0x230 [ 45.429213][ T5956] nf_tables_newchain+0x17c3/0x2d30 [ 45.429227][ T5956] ? __pfx____ratelimit+0x10/0x10 [ 45.429243][ T5956] ? rcu_is_watching+0x13/0xc0 [ 45.429255][ T5956] ? __nla_validate_parse+0x1e7/0x28b0 [ 45.429268][ T5956] ? __pfx_nf_tables_newchain+0x10/0x10 [ 45.429284][ T5956] ? __pfx___nla_validate_parse+0x10/0x10 [ 45.429296][ T5956] ? lock_acquire+0x1d1/0x380 [ 45.429309][ T5956] ? net_generic+0x25/0x2a0 [ 45.429327][ T5956] ? __nla_parse+0x40/0x60 [ 45.429339][ T5956] nfnetlink_rcv_batch+0x1410/0x2880 [ 45.429364][ T5956] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 45.429380][ T5956] ? find_held_lock+0x2b/0x80 [ 45.429394][ T5956] ? __local_bh_enable_ip+0xa5/0x120 [ 45.429411][ T5956] ? lockdep_hardirqs_on+0x7d/0x110 [ 45.429428][ T5956] ? __dev_queue_xmit+0xa12/0x4970 [ 45.429459][ T5956] ? __nla_parse+0x40/0x60 [ 45.429471][ T5956] nfnetlink_rcv+0x3bd/0x440 [ 45.429486][ T5956] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 45.429505][ T5956] netlink_unicast+0x585/0x850 [ 45.429520][ T5956] ? __pfx_netlink_unicast+0x10/0x10 [ 45.429536][ T5956] netlink_sendmsg+0x8b0/0xda0 [ 45.429551][ T5956] ? __pfx_netlink_sendmsg+0x10/0x10 [ 45.429565][ T5956] ? apparmor_socket_sendmsg+0x165/0x280 [ 45.429581][ T5956] ____sys_sendmsg+0xa4d/0xbe0 [ 45.429591][ T5956] ? __pfx_netlink_sendmsg+0x10/0x10 [ 45.429604][ T5956] ? __pfx_____sys_sendmsg+0x10/0x10 [ 45.429620][ T5956] ___sys_sendmsg+0x190/0x1e0 [ 45.429635][ T5956] ? __pfx____sys_sendmsg+0x10/0x10 [ 45.429668][ T5956] ? futex_wait+0x11e/0x370 [ 45.429689][ T5956] ? find_held_lock+0x2b/0x80 [ 45.429710][ T5956] __sys_sendmsg+0x160/0x210 [ 45.429726][ T5956] ? __pfx___sys_sendmsg+0x10/0x10 [ 45.429749][ T5956] __do_fast_syscall_32+0x13a/0x8b0 [ 45.429768][ T5956] do_fast_syscall_32+0x32/0x70 [ 45.429788][ T5956] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 45.429802][ T5956] RIP: 0023:0xf70befec [ 45.429815][ T5956] Code: Unable to access opcode bytes at 0xf70befc2. [ 45.429820][ T5956] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 45.429831][ T5956] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000800000c0 [ 45.429839][ T5956] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 45.429846][ T5956] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 45.429853][ T5956] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 45.429860][ T5956] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 45.429873][ T5956] [ 45.443473][ T5954] bond0: (slave bridge0): Releasing backup interface [ 45.638450][ T5746] Bluetooth: hci1: command 0x0419 tx timeout [ 45.861950][ T5939] nvme nvme0: rdma_resolve_addr failed (-19). [ 46.356746][ T5746] Bluetooth: hci2: command tx timeout [ 46.356770][ T5746] Bluetooth: hci3: command tx timeout [ 46.356798][ T5745] Bluetooth: hci0: command tx timeout [ 46.480607][ T1344] f81534 8-1:0.12: f81534_set_register: reg: 1002 data: 2f failed: -71 [ 46.480634][ T1344] f81534 8-1:0.12: f81534_find_config_idx: read failed: -71 [ 46.480643][ T1344] f81534 8-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 46.480677][ T1344] f81534 8-1:0.12: probe with driver f81534 failed with error -71 [ 46.498425][ T1344] usb 8-1: USB disconnect, device number 2 [ 46.543069][ T5966] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 47.172395][ T5980] netlink: 4 bytes leftover after parsing attributes in process `syz.3.29'. [ 47.177009][ T5980] netlink: 68 bytes leftover after parsing attributes in process `syz.3.29'. [ 47.329815][ T5988] capability: warning: `syz.3.30' uses deprecated v2 capabilities in a way that may be insecure [ 47.686645][ T35] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 47.726661][ T5745] Bluetooth: hci1: command 0x0419 tx timeout [ 47.837275][ T35] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 47.838225][ T35] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 47.838237][ T35] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 47.838253][ T35] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.842261][ T35] usb 8-1: config 0 descriptor?? [ 48.996381][ T55] IPVS: starting estimator thread 0... [ 49.079394][ T6022] IPVS: using max 44 ests per chain, 105600 per kthread [ 49.335225][ T6028] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 49.400578][ T6028] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 49.453405][ T6028] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 49.809335][ T5745] Bluetooth: hci1: command 0x0419 tx timeout [ 50.112601][ T6052] netlink: 24 bytes leftover after parsing attributes in process `syz.0.42'. [ 50.112621][ T6052] netlink: 16 bytes leftover after parsing attributes in process `syz.0.42'. [ 50.115765][ T6052] netlink: 36 bytes leftover after parsing attributes in process `syz.0.42'. [ 50.468905][ T1344] usb 8-1: USB disconnect, device number 3 [ 50.558206][ T6066] tipc: Started in network mode [ 50.558224][ T6066] tipc: Node identity 4a90f021a14a, cluster identity 4711 [ 50.558340][ T6066] tipc: Enabled bearer , priority 0 [ 50.559061][ T6066] syzkaller0: entered promiscuous mode [ 50.559072][ T6066] syzkaller0: entered allmulticast mode [ 50.566268][ T6066] tipc: Resetting bearer [ 50.580065][ T6065] tipc: Resetting bearer [ 50.587919][ T6065] tipc: Disabling bearer [ 51.123572][ T6098] netlink: 'syz.0.53': attribute type 12 has an invalid length. [ 51.123586][ T6098] netlink: 68 bytes leftover after parsing attributes in process `syz.0.53'. [ 51.562449][ T6104] loop0: detected capacity change from 0 to 32768 [ 51.576713][ T5883] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 51.577800][ T6104] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 51.702405][ T6104] md/raid1:md0: active with 1 out of 2 mirrors [ 51.703031][ T6104] md_update_sb: can't update sb for read-only array md0 [ 51.703096][ T6104] md0: detected capacity change from 0 to 2048 [ 51.704043][ T6106] md_update_sb: can't update sb for read-only array md0 [ 51.740857][ T5883] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 51.741821][ T5883] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 51.741840][ T5883] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 51.741853][ T5883] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 51.741881][ T5883] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.744473][ T5883] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 51.744492][ T5883] usb 6-1: Product: syz [ 51.744502][ T5883] usb 6-1: Manufacturer: syz [ 51.806670][ T6108] syzkaller0: entered promiscuous mode [ 51.806684][ T6108] syzkaller0: entered allmulticast mode [ 51.810218][ T6108] netlink: 4 bytes leftover after parsing attributes in process `syz.2.56'. [ 51.832240][ T5883] cdc_wdm 6-1:1.0: skipping garbage [ 51.832251][ T5883] cdc_wdm 6-1:1.0: skipping garbage [ 51.834388][ T5883] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 51.834402][ T5883] cdc_wdm 6-1:1.0: Unknown control protocol [ 51.946973][ T6108] tipc: Started in network mode [ 51.947128][ T6108] tipc: Node identity c677f1bef88e, cluster identity 4711 [ 51.948554][ T6108] tipc: Enabled bearer , priority 0 [ 51.969537][ T6107] tipc: Resetting bearer [ 51.979825][ T6107] tipc: Disabling bearer [ 52.160549][ T6114] : renamed from bond_slave_0 (while UP) [ 52.170871][ T6120] netlink: 32 bytes leftover after parsing attributes in process `syz.3.61'. [ 52.170885][ T6120] openvswitch: netlink: Flow key attr not present in new flow. [ 52.197702][ T6118] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 52.262963][ T6123] netlink: 4 bytes leftover after parsing attributes in process `syz.3.62'. [ 52.284170][ T6102] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 52.284400][ T6102] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 52.481369][ T5883] usb 6-1: USB disconnect, device number 3 [ 52.490339][ T6133] syz.0.65 uses obsolete (PF_INET,SOCK_PACKET) [ 53.543224][ T6151] netlink: 4 bytes leftover after parsing attributes in process `syz.3.69'. [ 55.700880][ T6179] FAULT_INJECTION: forcing a failure. [ 55.700880][ T6179] name failslab, interval 1, probability 0, space 0, times 0 [ 55.700911][ T6179] CPU: 2 UID: 0 PID: 6179 Comm: syz.0.78 Not tainted syzkaller #0 PREEMPT(full) [ 55.700932][ T6179] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 55.700943][ T6179] Call Trace: [ 55.700949][ T6179] [ 55.700957][ T6179] dump_stack_lvl+0x100/0x190 [ 55.700987][ T6179] should_fail_ex.cold+0x5/0xa [ 55.701013][ T6179] should_failslab+0xc2/0x120 [ 55.701039][ T6179] kmem_cache_alloc_noprof+0x92/0x6a0 [ 55.701061][ T6179] ? radix_tree_node_alloc.constprop.0+0x81/0x360 [ 55.701092][ T6179] radix_tree_node_alloc.constprop.0+0x81/0x360 [ 55.701120][ T6179] idr_get_free+0x52e/0xa00 [ 55.701177][ T6179] idr_alloc_u32+0x1ac/0x320 [ 55.701205][ T6179] ? __pfx_idr_alloc_u32+0x10/0x10 [ 55.701233][ T6179] ? __pfx___debug_object_init+0x10/0x10 [ 55.701280][ T6179] idr_alloc+0xc0/0x130 [ 55.701309][ T6179] ? __pfx_idr_alloc+0x10/0x10 [ 55.701339][ T6179] ? lockdep_init_map_type+0x5c/0x250 [ 55.701373][ T6179] loop_add+0x1fe/0xb60 [ 55.701395][ T6179] ? __pfx_loop_add+0x10/0x10 [ 55.701430][ T6179] ? __fget_files+0x34/0x3d0 [ 55.701453][ T6179] ? find_held_lock+0x2b/0x80 [ 55.701472][ T6179] ? __fget_files+0x215/0x3d0 [ 55.701496][ T6179] loop_control_ioctl+0xae/0x620 [ 55.701521][ T6179] ? __pfx_loop_control_ioctl+0x10/0x10 [ 55.701548][ T6179] ? __pfx_loop_control_ioctl+0x10/0x10 [ 55.701573][ T6179] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 55.701628][ T6179] __do_fast_syscall_32+0x13a/0x8b0 [ 55.701662][ T6179] do_fast_syscall_32+0x32/0x70 [ 55.701691][ T6179] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 55.701716][ T6179] RIP: 0023:0xf70befec [ 55.701737][ T6179] Code: Unable to access opcode bytes at 0xf70befc2. [ 55.701745][ T6179] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 55.701771][ T6179] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000004c80 [ 55.701784][ T6179] RDX: 0000000007000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 55.701796][ T6179] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 55.701808][ T6179] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 55.701819][ T6179] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 55.701844][ T6179] [ 56.074979][ T6191] jffs2: notice: (6191) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 56.100547][ T6191] overlayfs: upper fs does not support tmpfile. [ 56.102362][ T6191] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 56.107529][ T6191] evm: overlay not supported [ 56.479019][ T25] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 56.496065][ T6206] tcf_pedit_act: 7 callbacks suppressed [ 56.496078][ T6206] tc action pedit unable to extract header offset for header type (0x4) [ 56.496084][ T6206] tc action pedit unable to extract header offset for header type (0x4) [ 56.496089][ T6206] tc action pedit unable to extract header offset for header type (0x4) [ 56.496095][ T6206] tc action pedit unable to extract header offset for header type (0x4) [ 56.496100][ T6206] tc action pedit unable to extract header offset for header type (0x4) [ 56.496105][ T6206] tc action pedit unable to extract header offset for header type (0x4) [ 56.496111][ T6206] tc action pedit unable to extract header offset for header type (0x4) [ 56.496116][ T6206] tc action pedit unable to extract header offset for header type (0x4) [ 56.496121][ T6206] tc action pedit unable to extract header offset for header type (0x4) [ 56.496126][ T6206] tc action pedit unable to extract header offset for header type (0x4) [ 56.496136][ T6206] 0: reclassify loop, rule prio 0, protocol 800 [ 56.626636][ T5883] usb 8-1: new full-speed USB device number 4 using dummy_hcd [ 56.626790][ T25] usb 7-1: Using ep0 maxpacket: 16 [ 56.628553][ T25] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 56.631354][ T25] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 56.635628][ T25] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.635643][ T25] usb 7-1: Product: syz [ 56.635650][ T25] usb 7-1: Manufacturer: syz [ 56.635657][ T25] usb 7-1: SerialNumber: syz [ 56.637933][ T25] usb 7-1: config 0 descriptor?? [ 56.644810][ T25] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 56.644828][ T25] em28xx 7-1:0.0: DVB interface 0 found: bulk [ 56.988651][ T6213] tipc: Started in network mode [ 56.988670][ T6213] tipc: Node identity 36441ce7a9bd, cluster identity 4711 [ 56.988810][ T6213] tipc: Enabled bearer , priority 0 [ 56.989845][ T6213] syzkaller0: entered promiscuous mode [ 56.989857][ T6213] syzkaller0: entered allmulticast mode [ 57.015502][ T6213] tipc: Resetting bearer [ 57.019190][ T6212] tipc: Resetting bearer [ 57.025117][ T6212] tipc: Disabling bearer [ 57.257250][ T25] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 57.340263][ T6222] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.340539][ T6222] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.393996][ T6222] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 57.399907][ T6222] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 57.466892][ T5786] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.466919][ T5786] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.466936][ T5786] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.466952][ T5786] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.646322][ T6227] syzkaller0: entered promiscuous mode [ 57.646337][ T6227] syzkaller0: entered allmulticast mode [ 57.653201][ T6227] simple: /dev/video#_3 [ 57.798780][ T6229] netlink: 'syz.1.93': attribute type 12 has an invalid length. [ 57.852776][ T25] em28xx 7-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 57.852803][ T25] em28xx 7-1:0.0: board has no eeprom [ 57.906696][ T25] em28xx 7-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 57.906714][ T25] em28xx 7-1:0.0: dvb set to bulk mode. [ 57.908002][ T1344] em28xx 7-1:0.0: Binding DVB extension [ 57.914602][ T25] usb 7-1: USB disconnect, device number 2 [ 57.915284][ T25] em28xx 7-1:0.0: Disconnecting em28xx [ 57.939365][ T1344] em28xx 7-1:0.0: Registering input extension [ 57.939704][ T25] em28xx 7-1:0.0: Closing input extension [ 57.940974][ T6233] netlink: 4 bytes leftover after parsing attributes in process `syz.1.94'. [ 57.961243][ T25] em28xx: Freeing device [ 58.564030][ T1157] nvmet: connect request for invalid subsystem testsubsys! [ 58.566497][ T6259] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 59.219000][ T5883] usb 8-1: unable to get BOS descriptor or descriptor too short [ 59.220077][ T5883] usb 8-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 59.220148][ T5883] usb 8-1: no configurations [ 59.220177][ T5883] usb 8-1: can't read configurations, error -22 [ 60.732459][ T6292] netlink: 28 bytes leftover after parsing attributes in process `syz.3.103'. [ 60.732536][ T6292] netlink: 28 bytes leftover after parsing attributes in process `syz.3.103'. [ 60.863020][ T6292] netlink: 28 bytes leftover after parsing attributes in process `syz.3.103'. [ 60.863100][ T6292] netlink: 28 bytes leftover after parsing attributes in process `syz.3.103'. [ 60.895989][ T6293] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 60.899971][ T6293] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 60.906484][ T6292] netlink: 28 bytes leftover after parsing attributes in process `syz.3.103'. [ 60.910805][ T6292] netlink: 28 bytes leftover after parsing attributes in process `syz.3.103'. [ 60.936743][ T6293] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 60.940831][ T6293] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 60.940881][ T6293] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 60.942468][ T6293] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 60.943778][ T6293] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 60.943858][ T6293] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 60.944907][ T6293] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 60.946260][ T6293] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 60.947433][ T6293] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 60.966453][ T6293] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 61.013543][ T43] audit: type=1807 audit(1789737072.953:2): UNKNOWN=\ res=0 [ 61.014193][ T43] audit: type=1802 audit(1789737072.953:3): pid=6301 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.3.105" res=0 errno=0 [ 61.015105][ T43] audit: type=1807 audit(1789737072.953:4): action=measure func=FILE_CHECK res=1 [ 61.015881][ T6301] ima: policy update failed [ 61.016350][ T43] audit: type=1802 audit(1789737072.953:5): pid=6301 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.3.105" res=0 errno=0 [ 61.226663][ T1344] usb 6-1: new low-speed USB device number 4 using dummy_hcd [ 61.377593][ T1344] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 61.378761][ T1344] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 61.378778][ T1344] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 61.378796][ T1344] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 61.378809][ T1344] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 61.378821][ T1344] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 61.378833][ T1344] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 61.378845][ T1344] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 61.378857][ T1344] usb 6-1: config 168 interface 0 has no altsetting 0 [ 61.379793][ T1344] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 61.379809][ T1344] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 61.379825][ T1344] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 61.379837][ T1344] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 61.379849][ T1344] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 61.379861][ T1344] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 61.379873][ T1344] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 61.379886][ T1344] usb 6-1: config 168 interface 0 has no altsetting 0 [ 61.381589][ T1344] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 61.381606][ T1344] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 61.381622][ T1344] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 61.381634][ T1344] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 61.381646][ T1344] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 61.381658][ T1344] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 61.381670][ T1344] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 61.381682][ T1344] usb 6-1: config 168 interface 0 has no altsetting 0 [ 61.385650][ T1344] usb 6-1: string descriptor 0 read error: -22 [ 61.385705][ T1344] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.412158][ T1344] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 61.647208][ T5745] Bluetooth: hci1: unexpected cc 0x200b length: 2 > 1 [ 61.647527][ T5745] Bluetooth: hci1: unexpected event for opcode 0x200b [ 61.647738][ T6306] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 61.678828][ T1344] usb 6-1: USB disconnect, device number 4 [ 61.722459][ T6306] Zero length message leads to an empty skb [ 62.035231][ T43] audit: type=1326 audit(1789737073.973:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6310 comm="syz.3.110" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 62.035260][ T43] audit: type=1326 audit(1789737073.973:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6310 comm="syz.3.110" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 62.035917][ T43] audit: type=1326 audit(1789737073.973:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6310 comm="syz.3.110" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 62.036055][ T43] audit: type=1326 audit(1789737073.973:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6310 comm="syz.3.110" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 62.036219][ T43] audit: type=1326 audit(1789737073.973:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6310 comm="syz.3.110" exe="/syz-executor" sig=0 arch=40000003 syscall=320 compat=1 ip=0xf701efec code=0x7ffc0000 [ 62.036375][ T43] audit: type=1326 audit(1789737073.973:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6310 comm="syz.3.110" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 62.053843][ T6311] kAFS: No cell specified [ 62.144981][ T6315] netlink: 44 bytes leftover after parsing attributes in process `syz.2.108'. [ 62.247681][ T6322] ======================================================= [ 62.247681][ T6322] WARNING: The mand mount option has been deprecated and [ 62.247681][ T6322] and is ignored by this kernel. Remove the mand [ 62.247681][ T6322] option from the mount to silence this warning. [ 62.247681][ T6322] ======================================================= [ 62.251235][ T6322] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 62.388789][ T6322] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 62.389019][ T6322] overlayfs: failed to look up (tracing) for ino (-66) [ 62.926641][ T5745] Bluetooth: hci0: command 0x0c1a tx timeout [ 62.997663][ T5745] Bluetooth: hci3: command 0x0c1a tx timeout [ 62.999170][ T5747] Bluetooth: hci2: command 0x0c1a tx timeout [ 63.247345][ T6337] LUN: removable file: (no medium) [ 63.252010][ T6337] netlink: 'syz.2.119': attribute type 1 has an invalid length. [ 63.270053][ T6337] bond1: entered promiscuous mode [ 63.270302][ T6337] 8021q: adding VLAN 0 to HW filter on device bond1 [ 63.308215][ T6337] bond1: (slave bridge0): making interface the new active one [ 63.308231][ T6337] bridge0: entered promiscuous mode [ 63.310445][ T6337] bond1: (slave bridge0): Enslaving as an active interface with an up link [ 63.700350][ T6344] netdevsim netdevsim2: Direct firmware load for .® failed with error -2 [ 63.700365][ T6344] netdevsim netdevsim2: Falling back to sysfs fallback for: .® [ 64.694021][ T6364] warning: `syz.3.128' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 64.998287][ T5745] Bluetooth: hci0: command 0x0c1a tx timeout [ 65.088013][ T5745] Bluetooth: hci3: command 0x0c1a tx timeout [ 65.088037][ T5745] Bluetooth: hci2: command 0x0c1a tx timeout [ 65.210712][ T6380] netlink: 4 bytes leftover after parsing attributes in process `syz.2.133'. [ 65.294295][ T6386] netlink: 4 bytes leftover after parsing attributes in process `syz.2.134'. [ 66.612830][ T6415] ntfs3(nullb0): Primary boot signature is not NTFS. [ 66.613140][ T6415] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 67.077368][ T5747] Bluetooth: hci0: command 0x0c1a tx timeout [ 67.156865][ T5745] Bluetooth: hci3: command 0x0c1a tx timeout [ 67.156901][ T5747] Bluetooth: hci2: command 0x0c1a tx timeout [ 67.384905][ T6423] /dev/loop0: Can't open blockdev [ 67.430165][ T6423] netlink: 'syz.0.139': attribute type 9 has an invalid length. [ 67.430218][ T6423] netlink: 'syz.0.139': attribute type 7 has an invalid length. [ 67.430259][ T6423] netlink: 'syz.0.139': attribute type 8 has an invalid length. [ 68.127203][ T6436] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 68.139553][ T5747] Bluetooth: hci3: unexpected event for opcode 0x0c7b [ 68.176923][ T6436] md: couldn't update array info. -22 [ 68.178052][ T6106] md_update_sb: can't update sb for read-only array md0 [ 68.217650][ T6106] md_update_sb: can't update sb for read-only array md0 [ 68.680512][ T6444] nvmet: adding nsid 1 to subsystem testsubsys [ 69.067463][ T6452] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 69.067579][ T6452] block device autoloading is deprecated and will be removed. [ 69.594368][ T6457] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 69.594390][ T6457] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 69.594428][ T6457] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 70.155984][ T6465] syzkaller0: entered promiscuous mode [ 70.155999][ T6465] syzkaller0: entered allmulticast mode [ 70.394800][ T6469] netlink: 'syz.2.154': attribute type 1 has an invalid length. [ 70.877909][ T6469] 8021q: adding VLAN 0 to HW filter on device bond2 [ 70.878248][ T6469] af_packet: tpacket_rcv: packet too big, clamped from 36 to 4294967272. macoff=96 [ 70.891744][ T6471] bond2: (slave geneve2): making interface the new active one [ 70.893548][ T6471] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 70.894395][ T6474] tipc: Cannot configure node identity twice [ 70.923967][ T1436] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.924027][ T1436] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.935380][ T150] cfg80211: failed to load regulatory.db [ 70.980101][ T6478] FAULT_INJECTION: forcing a failure. [ 70.980101][ T6478] name failslab, interval 1, probability 0, space 0, times 0 [ 70.980132][ T6478] CPU: 3 UID: 0 PID: 6478 Comm: syz.1.157 Not tainted syzkaller #0 PREEMPT(full) [ 70.980153][ T6478] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.980163][ T6478] Call Trace: [ 70.980169][ T6478] [ 70.980176][ T6478] dump_stack_lvl+0x100/0x190 [ 70.980224][ T6478] should_fail_ex.cold+0x5/0xa [ 70.980248][ T6478] should_failslab+0xc2/0x120 [ 70.980277][ T6478] __kmalloc_cache_noprof+0x91/0x6d0 [ 70.980305][ T6478] ? get_mm_exe_file+0x8a/0x1a0 [ 70.980330][ T6478] ? get_current_details+0xa0/0x670 [ 70.980352][ T6478] get_current_details+0xa0/0x670 [ 70.980378][ T6478] landlock_merge_ruleset+0x7ea/0xd10 [ 70.980403][ T6478] __do_sys_landlock_restrict_self+0x264/0x10a0 [ 70.980433][ T6478] __do_fast_syscall_32+0x13a/0x8b0 [ 70.980472][ T6478] do_fast_syscall_32+0x32/0x70 [ 70.980500][ T6478] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 70.980522][ T6478] RIP: 0023:0xf7f47fec [ 70.980542][ T6478] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 70.980552][ T6478] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 00000000000001be [ 70.980572][ T6478] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000000001a [ 70.980584][ T6478] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 70.980593][ T6478] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 70.980612][ T6478] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 70.980623][ T6478] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 70.980649][ T6478] [ 71.042782][ T6480] syzkaller0: entered promiscuous mode [ 71.042795][ T6480] syzkaller0: entered allmulticast mode [ 71.045288][ T6480] 0: reclassify loop, rule prio 0, protocol 700 [ 71.045696][ T6480] netlink: 168 bytes leftover after parsing attributes in process `syz.1.158'. [ 71.112303][ T6485] jffs2: notice: (6485) jffs2_build_xattr_subsystem: complete building xattr subsystem, 8 of xdatum (0 unchecked, 8 orphan) and 8 of xref (1 dead, 7 orphan) found. [ 71.121943][ T6485] netlink: 8 bytes leftover after parsing attributes in process `syz.3.160'. [ 71.121956][ T6485] netlink: 8 bytes leftover after parsing attributes in process `syz.3.160'. [ 71.148020][ T6485] Illegal XDP return value 68 on prog (id 15) dev N/A, expect packet loss! [ 71.200778][ T6493] random: crng reseeded on system resumption [ 71.427778][ T5529] usb 8-1: new full-speed USB device number 6 using dummy_hcd [ 71.618503][ T6489] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 71.621482][ T5529] usb 8-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 71.622292][ T5529] usb 8-1: no configurations [ 71.622300][ T5529] usb 8-1: can't read configurations, error -22 [ 72.526942][ T10] libceph: connect (1)[c::]:6789 error -101 [ 72.527173][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 72.529629][ T10] libceph: connect (1)[c::]:6789 error -101 [ 72.529710][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 72.530615][ T6514] ceph: No mds server is up or the cluster is laggy [ 72.683939][ T6524] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 72.888617][ T6521] input: PS/2 BYD TouchPad as /devices/platform/i8042/serio1/input/input7 [ 73.832964][ T6544] process 'syz.2.178' launched '/dev/fd/3' with NULL argv: empty string added [ 75.785306][ T6559] netlink: 96 bytes leftover after parsing attributes in process `syz.1.184'. [ 75.785322][ T6559] netlink: 96 bytes leftover after parsing attributes in process `syz.1.184'. [ 76.280673][ T6572] bridge0: port 1(veth1_to_bridge) entered blocking state [ 76.280800][ T6572] bridge0: port 1(veth1_to_bridge) entered disabled state [ 76.281117][ T6572] veth1_to_bridge: entered allmulticast mode [ 76.285085][ T6572] veth1_to_bridge: entered promiscuous mode [ 76.285846][ T6572] bridge0: port 1(veth1_to_bridge) entered blocking state [ 76.287297][ T6572] bridge0: port 1(veth1_to_bridge) entered forwarding state [ 76.526225][ T6574] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 77.411298][ T6589] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 77.715769][ T6594] 8021q: adding VLAN 0 to HW filter on device bond3 [ 77.774390][ T6594] netlink: 8 bytes leftover after parsing attributes in process `syz.2.194'. [ 77.774412][ T6594] netlink: 4 bytes leftover after parsing attributes in process `syz.2.194'. [ 77.825722][ T6598] netlink: 'syz.2.194': attribute type 4 has an invalid length. [ 77.825750][ T6598] netlink: 152 bytes leftover after parsing attributes in process `syz.2.194'. [ 77.866938][ T6594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.869438][ T6594] bond3: (slave bond0): making interface the new active one [ 77.871184][ T6594] bond3: (slave bond0): Enslaving as an active interface with an up link [ 77.873924][ T6598] .`: renamed from bond0 (while UP) [ 77.890466][ T6598] bond3: Primary slave changed to .`, reselecting active slave [ 77.940849][ T5786] bond3: (slave .`): link status definitely down, disabling slave [ 77.945250][ T5786] bond3: now running without any active interface! [ 79.163040][ T6606] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 79.410335][ T6613] atomic_op ffff88806b9811e0 conn xmit_atomic 0000000000000000 [ 79.647062][ T6616] netlink: 'syz.3.199': attribute type 5 has an invalid length. [ 79.647077][ T6616] netlink: 3657 bytes leftover after parsing attributes in process `syz.3.199'. [ 79.899626][ T6626] netlink: 8 bytes leftover after parsing attributes in process `syz.0.201'. [ 79.903966][ T6620] kAFS: No cell specified [ 81.152012][ T6653] veth0_to_bridge: Caught tx_queue_len zero misconfig [ 82.341062][ T43] kauditd_printk_skb: 38 callbacks suppressed [ 82.341075][ T43] audit: type=1326 audit(1789737094.283:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6673 comm="syz.2.210" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 82.341204][ T43] audit: type=1326 audit(1789737094.283:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6673 comm="syz.2.210" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 82.342282][ T43] audit: type=1326 audit(1789737094.283:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6673 comm="syz.2.210" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 82.342425][ T43] audit: type=1326 audit(1789737094.283:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6673 comm="syz.2.210" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 82.342857][ T43] audit: type=1326 audit(1789737094.283:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6673 comm="syz.2.210" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf709efec code=0x7ffc0000 [ 82.342894][ T43] audit: type=1326 audit(1789737094.283:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6673 comm="syz.2.210" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 82.342914][ T43] audit: type=1326 audit(1789737094.283:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6673 comm="syz.2.210" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 82.343206][ T43] audit: type=1326 audit(1789737094.283:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6673 comm="syz.2.210" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf709efec code=0x7ffc0000 [ 82.725075][ T6677] netlink: 4 bytes leftover after parsing attributes in process `syz.0.212'. [ 83.326942][ T6696] pim6reg: entered allmulticast mode [ 83.363771][ T6696] pim6reg: left allmulticast mode [ 83.620364][ T6699] overlay: filesystem on ./bus not supported as upperdir [ 84.218868][ T6707] tc_dump_action: action bad kind [ 84.529577][ T6713] null_blk: rnullb0: using native zone append [ 84.985013][ T6720] jffs2: notice: (6720) jffs2_build_xattr_subsystem: complete building xattr subsystem, 8 of xdatum (0 unchecked, 8 orphan) and 8 of xref (1 dead, 7 orphan) found. [ 84.995126][ T6713] null_blk: disk rnullb0 created [ 85.001946][ T6720] overlayfs: failed to resolve '/éø•²_¬âw”T–zë ‰ªê„¨¶“‚&yPâ½7òUÍÊ!6 }n®ˆm5´%ëfÂÒΟ9Bº[/Îf³nÎzdh]sg6wéDOp·k%ÌÒ›@’Îì@á@ [ 85.001946][ T6720] é»ëBHF…€¥ÁüÇÖ’(ÛÞ) »<ûvwZà†¥Õ'¼ ': -2 [ 85.043572][ T6723] netlink: 'syz.2.221': attribute type 1 has an invalid length. [ 85.063485][ T6723] bond0: entered promiscuous mode [ 85.067989][ T6723] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.095033][ T6726] syzkaller0: entered promiscuous mode [ 85.095047][ T6726] syzkaller0: entered allmulticast mode [ 85.205016][ T6728] pci_bus 0000:01: busn_res: [bus 01] is released [ 85.238748][ T6735] loop1: detected capacity change from 0 to 65536 [ 85.252328][ T6735] device-mapper: table: 248:0: thin-pool: Error opening metadata block device (-EBUSY) [ 85.252343][ T6735] device-mapper: ioctl: error adding target to table [ 85.254854][ T6735] device-mapper: ioctl: The device has no table. [ 85.350480][ T6733] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 85.356465][ T6733] pci 0000:00:04.0: PCI bridge to [bus 01] [ 85.356833][ T6733] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 85.356927][ T6733] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 85.360830][ T6733] pci 0000:00:04.0: bridge window [mem 0xfe000000-0xfe1fffff 64bit pref] [ 85.364708][ T6733] pci 0000:00:04.0: enabling Extended Tags [ 85.382399][ T6733] pci 0000:00:04.0: Adding to iommu group 4 [ 85.408160][ T6733] pci 0000:00:04.0: PCI bridge to [bus 01] [ 85.420718][ T6733] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 85.420751][ T6733] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 85.420826][ T6733] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 85.420841][ T6733] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 85.420857][ T6733] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 85.420921][ T6733] pci 0000:00:04.0: PCI bridge to [bus 01] [ 85.421014][ T6733] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 85.429940][ T6733] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 85.430839][ T6733] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 85.524055][ T6733] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 85.530968][ T6733] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 85.533726][ T6745] faux_driver vgem: [drm] Unknown color mode 55545; guessing buffer size. [ 85.688806][ T6751] FAULT_INJECTION: forcing a failure. [ 85.688806][ T6751] name failslab, interval 1, probability 0, space 0, times 0 [ 85.688837][ T6751] CPU: 1 UID: 0 PID: 6751 Comm: syz.3.230 Not tainted syzkaller #0 PREEMPT(full) [ 85.688858][ T6751] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.688868][ T6751] Call Trace: [ 85.688875][ T6751] [ 85.688883][ T6751] dump_stack_lvl+0x100/0x190 [ 85.688931][ T6751] should_fail_ex.cold+0x5/0xa [ 85.688956][ T6751] should_failslab+0xc2/0x120 [ 85.688984][ T6751] __kmalloc_cache_noprof+0x91/0x6d0 [ 85.689013][ T6751] ? loopback_open+0x9f6/0x13d0 [ 85.689044][ T6751] loopback_open+0x9f6/0x13d0 [ 85.689072][ T6751] snd_pcm_open_substream+0xa76/0x1850 [ 85.689115][ T6751] ? __kasan_kmalloc+0xa0/0xb0 [ 85.689135][ T6751] ? __pfx_snd_pcm_open_substream+0x10/0x10 [ 85.689152][ T6751] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 85.689178][ T6751] ? snd_pcm_oss_open+0x5c5/0x1380 [ 85.689207][ T6751] snd_pcm_oss_open+0x715/0x1380 [ 85.689239][ T6751] ? __pfx_snd_pcm_oss_open+0x10/0x10 [ 85.689266][ T6751] ? __pfx_default_wake_function+0x10/0x10 [ 85.689294][ T6751] ? __lock_acquire+0x5c0/0x1f40 [ 85.689325][ T6751] ? do_raw_spin_lock+0x128/0x260 [ 85.689354][ T6751] ? soundcore_open+0x231/0x5a0 [ 85.689378][ T6751] ? __pfx_snd_pcm_oss_open+0x10/0x10 [ 85.689406][ T6751] soundcore_open+0x2e3/0x5a0 [ 85.689431][ T6751] ? __pfx_soundcore_open+0x10/0x10 [ 85.689454][ T6751] chrdev_open+0x234/0x6a0 [ 85.689501][ T6751] ? __pfx_apparmor_file_open+0x10/0x10 [ 85.689530][ T6751] ? __pfx_chrdev_open+0x10/0x10 [ 85.689554][ T6751] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 85.689583][ T6751] do_dentry_open+0x6ab/0x14d0 [ 85.689602][ T6751] ? __pfx_chrdev_open+0x10/0x10 [ 85.689635][ T6751] vfs_open+0x82/0x3f0 [ 85.689663][ T6751] path_openat+0x19fa/0x2440 [ 85.689690][ T6751] ? __pfx_path_openat+0x10/0x10 [ 85.689717][ T6751] do_file_open+0x20e/0x430 [ 85.689738][ T6751] ? __pfx_do_file_open+0x10/0x10 [ 85.689776][ T6751] ? _raw_spin_unlock+0x28/0x50 [ 85.689807][ T6751] ? alloc_fd+0x471/0x7a0 [ 85.689835][ T6751] do_sys_openat2+0x10f/0x1e0 [ 85.689859][ T6751] ? __pfx_do_sys_openat2+0x10/0x10 [ 85.689891][ T6751] __ia32_compat_sys_openat+0x12d/0x210 [ 85.689917][ T6751] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 85.689953][ T6751] __do_fast_syscall_32+0x13a/0x8b0 [ 85.689982][ T6751] do_fast_syscall_32+0x32/0x70 [ 85.690008][ T6751] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 85.690029][ T6751] RIP: 0023:0xf701efec [ 85.690049][ T6751] Code: Unable to access opcode bytes at 0xf701efc2. [ 85.690057][ T6751] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 85.690077][ T6751] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000000 [ 85.690089][ T6751] RDX: 0000000000020080 RSI: 0000000000000000 RDI: 0000000000000000 [ 85.690100][ T6751] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 85.690111][ T6751] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 85.690122][ T6751] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 85.690145][ T6751] [ 86.619522][ T6763] loop1: detected capacity change from 0 to 65536 [ 86.633916][ T6763] device-mapper: table: 248:0: thin-pool: Error opening metadata block device (-EBUSY) [ 86.633931][ T6763] device-mapper: ioctl: error adding target to table [ 86.881668][ T6778] netlink: 'syz.0.238': attribute type 1 has an invalid length. [ 86.891365][ T6778] 8021q: adding VLAN 0 to HW filter on device bond1 [ 86.932667][ T6778] bond1: (slave geneve2): making interface the new active one [ 86.935820][ T6778] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 86.957255][ T6778] FAULT_INJECTION: forcing a failure. [ 86.957255][ T6778] name failslab, interval 1, probability 0, space 0, times 0 [ 86.957274][ T6778] CPU: 3 UID: 0 PID: 6778 Comm: syz.0.238 Not tainted syzkaller #0 PREEMPT(full) [ 86.957286][ T6778] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.957292][ T6778] Call Trace: [ 86.957296][ T6778] [ 86.957300][ T6778] dump_stack_lvl+0x100/0x190 [ 86.957320][ T6778] should_fail_ex.cold+0x5/0xa [ 86.957334][ T6778] should_failslab+0xc2/0x120 [ 86.957349][ T6778] kmem_cache_alloc_noprof+0x92/0x6a0 [ 86.957362][ T6778] ? mas_preallocate+0xc22/0xee0 [ 86.957381][ T6778] mas_preallocate+0xc22/0xee0 [ 86.957399][ T6778] ? __pfx_mas_preallocate+0x10/0x10 [ 86.957415][ T6778] ? mt_find+0x136/0x9b0 [ 86.957429][ T6778] ? mt_find+0x4d5/0x9b0 [ 86.957440][ T6778] vma_link+0x14a/0x8c0 [ 86.957479][ T6778] ? __pfx_vma_link+0x10/0x10 [ 86.957501][ T6778] ? rcu_is_watching+0x13/0xc0 [ 86.957514][ T6778] ? percpu_counter_add_batch+0xb9/0x230 [ 86.957533][ T6778] insert_vm_struct+0x1f7/0x890 [ 86.957547][ T6778] create_init_stack_vma+0x830/0xcf0 [ 86.957561][ T6778] ? __pfx_create_init_stack_vma+0x10/0x10 [ 86.957574][ T6778] ? lock_acquire+0x1d1/0x380 [ 86.957589][ T6778] ? do_raw_spin_lock+0x128/0x260 [ 86.957606][ T6778] ? alloc_bprm+0x54e/0x9e0 [ 86.957616][ T6778] ? alloc_bprm+0x54e/0x9e0 [ 86.957629][ T6778] alloc_bprm+0x57b/0x9e0 [ 86.957641][ T6778] do_execveat_common.isra.0+0x19c/0x580 [ 86.957653][ T6778] ? do_getname+0x191/0x390 [ 86.957669][ T6778] __ia32_compat_sys_execveat+0xe4/0x130 [ 86.957682][ T6778] __do_fast_syscall_32+0x13a/0x8b0 [ 86.957702][ T6778] do_fast_syscall_32+0x32/0x70 [ 86.957719][ T6778] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 86.957733][ T6778] RIP: 0023:0xf70befec [ 86.957745][ T6778] Code: Unable to access opcode bytes at 0xf70befc2. [ 86.957750][ T6778] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000166 [ 86.957760][ T6778] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080000000 [ 86.957767][ T6778] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000001000 [ 86.957773][ T6778] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 86.957778][ T6778] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 86.957784][ T6778] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 86.957797][ T6778] [ 86.967219][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.967245][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.967263][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.967280][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.277887][ T35] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 87.398208][ T6739] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 87.437067][ T35] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 87.439633][ T35] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 87.439650][ T35] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 87.439661][ T35] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 87.439680][ T35] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.441076][ T35] usb 5-1: config 0 descriptor?? [ 87.504594][ T6813] device-mapper: table: 248:1: thin-pool: Error opening metadata block device (-EBUSY) [ 87.504609][ T6813] device-mapper: ioctl: error adding target to table [ 87.907872][ T35] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 88.086934][ T6788] netlink: 8 bytes leftover after parsing attributes in process `syz.0.240'. [ 88.158314][ T6829] syzkaller0: entered promiscuous mode [ 88.158328][ T6829] syzkaller0: entered allmulticast mode [ 88.210945][ T5747] Bluetooth: hci2: unexpected event for opcode 0x042d [ 88.320356][ T5747] Bluetooth: hci3: unexpected event for opcode 0x1804 [ 88.874034][ T6837] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 88.992511][ T6842] netlink: 4 bytes leftover after parsing attributes in process `syz.3.249'. [ 89.302123][ T6846] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 89.909365][ T6862] netlink: 4 bytes leftover after parsing attributes in process `syz.2.256'. [ 89.962488][ T5814] usb 5-1: USB disconnect, device number 3 [ 90.086612][ T5529] usb 8-1: new full-speed USB device number 8 using dummy_hcd [ 90.257199][ T5529] usb 8-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 90.257222][ T5529] usb 8-1: no configurations [ 90.257228][ T5529] usb 8-1: can't read configurations, error -22 [ 90.412172][ T6872] tc action pedit offset must be on 32 bit boundaries [ 90.459958][ T6869] FAULT_INJECTION: forcing a failure. [ 90.459958][ T6869] name failslab, interval 1, probability 0, space 0, times 0 [ 90.459978][ T6869] CPU: 2 UID: 0 PID: 6869 Comm: syz.1.258 Not tainted syzkaller #0 PREEMPT(full) [ 90.459990][ T6869] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 90.459996][ T6869] Call Trace: [ 90.460000][ T6869] [ 90.460004][ T6869] dump_stack_lvl+0x100/0x190 [ 90.460023][ T6869] should_fail_ex.cold+0x5/0xa [ 90.460038][ T6869] should_failslab+0xc2/0x120 [ 90.460053][ T6869] kmem_cache_alloc_noprof+0x92/0x6a0 [ 90.460067][ T6869] ? d_instantiate+0x8a/0xb0 [ 90.460081][ T6869] ? alloc_empty_file+0x5b/0x1c0 [ 90.460106][ T6869] alloc_empty_file+0x5b/0x1c0 [ 90.460121][ T6869] alloc_file_pseudo+0x183/0x290 [ 90.460137][ T6869] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 90.460153][ T6869] ? alloc_fd+0x471/0x7a0 [ 90.460167][ T6869] ? do_raw_spin_unlock+0x145/0x1e0 [ 90.460180][ T6869] __anon_inode_getfile+0xe8/0x280 [ 90.460199][ T6869] anon_inode_getfile_fmode+0x37/0xa0 [ 90.460217][ T6869] __do_sys_fanotify_init+0xa0d/0xe30 [ 90.460233][ T6869] __do_fast_syscall_32+0x13a/0x8b0 [ 90.460249][ T6869] ? lockdep_hardirqs_on+0x7d/0x110 [ 90.460266][ T6869] do_fast_syscall_32+0x32/0x70 [ 90.460282][ T6869] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 90.460295][ T6869] RIP: 0023:0xf7f47fec [ 90.460304][ T6869] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 90.460314][ T6869] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000152 [ 90.460324][ T6869] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 0000000000080000 [ 90.460333][ T6869] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 90.460340][ T6869] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 90.460347][ T6869] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 90.460354][ T6869] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 90.460368][ T6869] [ 90.828247][ T43] audit: type=1800 audit(1789737102.773:58): pid=6888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.264" name="(" dev="sda1" ino=2044 res=0 errno=0 [ 90.874565][ T6883] xt_IDLETIMER: timeout value is zero [ 90.899314][ T6883] netlink: Failed to add helper -22 [ 90.899342][ T6883] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 90.938776][ T6897] syz.2.265: vmalloc error: size 2147483264, exceeds total pages, mode:0x400cc0(GFP_KERNEL_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 90.938861][ T6897] CPU: 2 UID: 0 PID: 6897 Comm: syz.2.265 Not tainted syzkaller #0 PREEMPT(full) [ 90.938873][ T6897] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 90.938879][ T6897] Call Trace: [ 90.938883][ T6897] [ 90.938888][ T6897] dump_stack_lvl+0x100/0x190 [ 90.938906][ T6897] warn_alloc.cold+0x9e/0xb2 [ 90.938918][ T6897] ? __pfx_warn_alloc+0x10/0x10 [ 90.938942][ T6897] ? __lock_acquire+0x5c0/0x1f40 [ 90.938966][ T6897] __vmalloc_node_range_noprof+0x123b/0x1420 [ 90.938986][ T6897] ? __lock_acquire+0x5c0/0x1f40 [ 90.939007][ T6897] ? __lock_acquire+0x5c0/0x1f40 [ 90.939034][ T6897] ? do_replace+0x1c6/0x490 [ 90.939056][ T6897] ? do_raw_spin_lock+0x128/0x260 [ 90.939092][ T6897] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 90.939122][ T6897] ? __lock_acquire+0x5c0/0x1f40 [ 90.939144][ T6897] ? do_raw_spin_unlock+0x145/0x1e0 [ 90.939157][ T6897] ? do_replace+0x1c6/0x490 [ 90.939169][ T6897] __vmalloc_node_noprof+0xad/0xf0 [ 90.939183][ T6897] ? do_replace+0x1c6/0x490 [ 90.939197][ T6897] __vmalloc_noprof+0xa3/0x120 [ 90.939211][ T6897] ? __pfx___vmalloc_noprof+0x10/0x10 [ 90.939230][ T6897] do_replace+0x1c6/0x490 [ 90.939243][ T6897] ? __pfx_do_replace+0x10/0x10 [ 90.939264][ T6897] compat_do_replace+0x589/0x7a0 [ 90.939279][ T6897] ? __pfx_compat_do_replace+0x10/0x10 [ 90.939301][ T6897] ? bpf_lsm_capable+0x9/0x10 [ 90.939316][ T6897] ? security_capable+0x80/0x260 [ 90.939331][ T6897] do_ebt_set_ctl+0x3f4/0x4a0 [ 90.939345][ T6897] ? __pfx_do_ebt_set_ctl+0x10/0x10 [ 90.939360][ T6897] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 90.939369][ T6897] ? futex_wake+0x4ea/0x5e0 [ 90.939384][ T6897] ? nf_sockopt_find.isra.0+0x222/0x290 [ 90.939401][ T6897] nf_setsockopt+0x8d/0xf0 [ 90.939417][ T6897] ip_setsockopt+0xcb/0xf0 [ 90.939428][ T6897] tcp_setsockopt+0xa7/0x100 [ 90.939442][ T6897] smc_setsockopt+0x1b6/0xa40 [ 90.939455][ T6897] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 90.939473][ T6897] ? __pfx_smc_setsockopt+0x10/0x10 [ 90.939487][ T6897] ? aa_sock_opt_perm+0x114/0x1e0 [ 90.939502][ T6897] ? __pfx_smc_setsockopt+0x10/0x10 [ 90.939517][ T6897] do_sock_setsockopt+0xf3/0x1d0 [ 90.939536][ T6897] __sys_setsockopt+0x119/0x190 [ 90.939552][ T6897] __ia32_sys_setsockopt+0xbc/0x160 [ 90.939566][ T6897] ? __do_fast_syscall_32+0xb3/0x8b0 [ 90.939583][ T6897] ? lockdep_hardirqs_on+0x7d/0x110 [ 90.939598][ T6897] __do_fast_syscall_32+0x13a/0x8b0 [ 90.939616][ T6897] do_fast_syscall_32+0x32/0x70 [ 90.939632][ T6897] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 90.939646][ T6897] RIP: 0023:0xf709efec [ 90.939659][ T6897] Code: Unable to access opcode bytes at 0xf709efc2. [ 90.939664][ T6897] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 90.939675][ T6897] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000000000000 [ 90.939681][ T6897] RDX: 0000000000000080 RSI: 0000000080000100 RDI: 0000000000000108 [ 90.939688][ T6897] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 90.939695][ T6897] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 90.939702][ T6897] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 90.939717][ T6897] [ 90.939722][ T6897] Mem-Info: [ 90.939727][ T6897] active_anon:7619 inactive_anon:1663 isolated_anon:0 [ 90.939727][ T6897] active_file:7030 inactive_file:18317 isolated_file:0 [ 90.939727][ T6897] unevictable:1000 dirty:367 writeback:0 [ 90.939727][ T6897] slab_reclaimable:6157 slab_unreclaimable:52185 [ 90.939727][ T6897] mapped:24328 shmem:1472 pagetables:1232 [ 90.939727][ T6897] sec_pagetables:305 bounce:0 [ 90.939727][ T6897] kernel_misc_reclaimable:0 [ 90.939727][ T6897] free:60609 free_pcp:15580 free_cma:0 [ 90.939752][ T6897] Node 0 active_anon:2060kB inactive_anon:68kB active_file:100kB inactive_file:12kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:32kB dirty:12kB writeback:0kB shmem:2004kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:2048kB kernel_stack:9408kB pagetables:1532kB sec_pagetables:1104kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 90.939779][ T6897] Node 1 active_anon:28416kB inactive_anon:6584kB active_file:28020kB inactive_file:73256kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:97280kB dirty:1456kB writeback:0kB shmem:3884kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:6144kB kernel_stack:4504kB pagetables:3396kB sec_pagetables:116kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 90.939808][ T6897] Node 0 DMA free:2024kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:88kB inactive_file:12kB unevictable:0kB writepending:4kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:572kB local_pcp:72kB free_cma:0kB [ 90.939839][ T6897] lowmem_reserve[]: 0 277 277 277 277 [ 90.939859][ T6897] Node 0 DMA32 free:12848kB boost:0kB min:12628kB low:15784kB high:18940kB reserved_highatomic:2048kB free_highatomic:40kB active_anon:2060kB inactive_anon:68kB active_file:12kB inactive_file:0kB unevictable:2000kB writepending:8kB zspages:0kB present:1032196kB managed:284568kB mlocked:0kB bounce:0kB free_pcp:9276kB local_pcp:776kB free_cma:0kB [ 90.939891][ T6897] lowmem_reserve[]: 0 0 0 0 0 [ 90.939911][ T6897] Node 1 DMA32 free:227564kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0kB free_highatomic:0kB active_anon:28416kB inactive_anon:6584kB active_file:28020kB inactive_file:73256kB unevictable:2000kB writepending:1456kB zspages:2620kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:52472kB local_pcp:10868kB free_cma:0kB [ 90.939940][ T6897] lowmem_reserve[]: 0 0 0 0 0 [ 90.939957][ T6897] Node 0 DMA: 1*4kB (M) 2*8kB (UM) 4*16kB (UM) 18*32kB (UM) 5*64kB (UM) 0*128kB 0*256kB 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 2004kB [ 90.940042][ T6897] Node 0 DMA32: 68*4kB (UMEH) 52*8kB (UME) 21*16kB (ME) 58*32kB (UMEH) 31*64kB (UM) 16*128kB (UME) 9*256kB (ME) 7*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 12800kB [ 90.940129][ T6897] Node 1 DMA32: 350*4kB (UM) 124*8kB (UM) 124*16kB (ME) 138*32kB (UME) 177*64kB (UME) 73*128kB (UME) 64*256kB (UME) 71*512kB (UME) 42*1024kB (UME) 12*2048kB (M) 19*4096kB (M) = 227608kB [ 90.940222][ T6897] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 90.940232][ T6897] Node 0 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 90.940240][ T6897] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 90.940249][ T6897] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 90.940257][ T6897] 27857 total pagecache pages [ 90.940261][ T6897] 1041 pages in swap cache [ 90.940265][ T6897] Free swap = 115152kB [ 90.940269][ T6897] Total swap = 124996kB [ 90.940273][ T6897] 524155 pages RAM [ 90.940276][ T6897] 0 pages HighMem/MovableOnly [ 90.940280][ T6897] 212121 pages reserved [ 90.940283][ T6897] 0 pages cma reserved [ 91.779707][ T6911] ci_hdrc ci_hdrc.0: error -EINVAL: invalid resource (null) [ 91.779727][ T6911] ci_hdrc ci_hdrc.0: probe with driver ci_hdrc failed with error -22 [ 92.020401][ T6918] No such timeout policy "syz1" [ 92.463210][ T6920] IPVS: ip_vs_add_dest(): server weight less than zero [ 92.463489][ T1157] IPVS: starting estimator thread 0... [ 92.567228][ T6926] IPVS: using max 43 ests per chain, 103200 per kthread [ 92.720727][ T6934] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 92.735970][ T6934] IPv6: NLM_F_CREATE should be specified when creating new route [ 92.736227][ T6934] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 92.736236][ T6934] IPv6: NLM_F_CREATE should be set when creating new route [ 92.736268][ T6934] IPv6: NLM_F_CREATE should be set when creating new route [ 92.736285][ T6934] IPv6: NLM_F_CREATE should be set when creating new route [ 92.737412][ T6934] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.275'. [ 92.827237][ T6936] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+  ÿÿÈ ÿÿÿÿÿÿÿÿÿÿÿ÷ÿÿÿÿÿÿÿ ¶ @ [ 93.127510][ T6948] netlink: 16 bytes leftover after parsing attributes in process `syz.1.280'. [ 94.067502][ T6960] loop7: detected capacity change from 0 to 16384 [ 94.201944][ T6961] loop7: detected capacity change from 16384 to 0 [ 94.202176][ C0] I/O error, dev loop7, sector 8576 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 2 [ 94.202252][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 94.756714][ T5814] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 94.779451][ T6974] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 94.816937][ T6106] md_update_sb: can't update sb for read-only array md0 [ 94.857478][ T6106] md_update_sb: can't update sb for read-only array md0 [ 94.916667][ T5814] usb 7-1: Using ep0 maxpacket: 8 [ 94.917179][ T5814] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 94.918305][ T5814] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 94.918328][ T5814] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 94.918339][ T5814] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 94.918350][ T5814] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 94.918362][ T5814] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 94.918380][ T5814] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.949086][ T6976] md: recover of RAID array md0 [ 94.970157][ T6976] md: md0: recover done. [ 95.130319][ T5814] usb 7-1: GET_CAPABILITIES returned 0 [ 95.130343][ T5814] usbtmc 7-1:16.0: can't read capabilities [ 95.286808][ T5813] netdevsim netdevsim120 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.338352][ T1344] usb 7-1: USB disconnect, device number 3 [ 95.460473][ T6991] sctp: [Deprecated]: syz.3.291 (pid 6991) Use of int in max_burst socket option. [ 95.460473][ T6991] Use struct sctp_assoc_value instead [ 95.726643][ T150] usb 8-1: new full-speed USB device number 10 using dummy_hcd [ 95.880521][ T150] usb 8-1: not running at top speed; connect to a high speed hub [ 95.880548][ T150] usb 8-1: New USB device found, idVendor=03f0, idProduct=2a76, bcdDevice=b8.a5 [ 95.881792][ T150] usb 8-1: config 11 has an invalid interface number: 31 but max is 2 [ 95.881812][ T150] usb 8-1: config 11 contains an unexpected descriptor of type 0x1, skipping [ 95.881826][ T150] usb 8-1: config 11 has an invalid interface number: 188 but max is 2 [ 95.881841][ T150] usb 8-1: config 11 contains an unexpected descriptor of type 0x2, skipping [ 95.881856][ T150] usb 8-1: config 11 contains an unexpected descriptor of type 0x2, skipping [ 95.881870][ T150] usb 8-1: config 11 contains an unexpected descriptor of type 0x2, skipping [ 95.881883][ T150] usb 8-1: config 11 has an invalid descriptor of length 1, skipping remainder of the config [ 95.881898][ T150] usb 8-1: config 11 has 2 interfaces, different from the descriptor's value: 3 [ 95.881914][ T150] usb 8-1: config 11 has no interface number 0 [ 95.881926][ T150] usb 8-1: config 11 has no interface number 1 [ 95.881961][ T150] usb 8-1: config 11 interface 31 altsetting 10 has a duplicate endpoint with address 0x1, skipping [ 95.881980][ T150] usb 8-1: config 11 interface 31 altsetting 10 endpoint 0xC has invalid maxpacket 1023, setting to 64 [ 95.882002][ T150] usb 8-1: config 11 interface 31 altsetting 10 has a duplicate endpoint with address 0x5, skipping [ 95.882020][ T150] usb 8-1: config 11 interface 31 altsetting 10 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 95.882040][ T150] usb 8-1: config 11 interface 31 altsetting 10 has an invalid descriptor for endpoint zero, skipping [ 95.882057][ T150] usb 8-1: config 11 interface 31 altsetting 10 has a duplicate endpoint with address 0xB, skipping [ 95.882073][ T150] usb 8-1: config 11 interface 31 altsetting 10 has a duplicate endpoint with address 0xE, skipping [ 95.882098][ T150] usb 8-1: config 11 interface 188 altsetting 27 has a duplicate endpoint with address 0x1, skipping [ 95.882115][ T150] usb 8-1: config 11 interface 188 altsetting 27 endpoint 0x4 has invalid maxpacket 1024, setting to 64 [ 95.882135][ T150] usb 8-1: config 11 interface 188 altsetting 27 has a duplicate endpoint with address 0x5, skipping [ 95.882154][ T150] usb 8-1: config 11 interface 188 altsetting 27 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 95.882173][ T150] usb 8-1: config 11 interface 188 altsetting 27 has an invalid descriptor for endpoint zero, skipping [ 95.882189][ T150] usb 8-1: config 11 interface 188 altsetting 27 has a duplicate endpoint with address 0xA, skipping [ 95.882206][ T150] usb 8-1: config 11 interface 188 altsetting 27 has a duplicate endpoint with address 0xB, skipping [ 95.882224][ T150] usb 8-1: config 11 interface 188 altsetting 27 has a duplicate endpoint with address 0x6, skipping [ 95.882241][ T150] usb 8-1: config 11 interface 188 altsetting 27 has a duplicate endpoint with address 0xC, skipping [ 95.882258][ T150] usb 8-1: config 11 interface 188 altsetting 27 has a duplicate endpoint with address 0x6, skipping [ 95.882274][ T150] usb 8-1: config 11 interface 31 has no altsetting 0 [ 95.882288][ T150] usb 8-1: config 11 interface 188 has no altsetting 0 [ 95.884545][ T150] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.884563][ T150] usb 8-1: Product: ã° [ 95.884574][ T150] usb 8-1: Manufacturer: Ч [ 95.884585][ T150] usb 8-1: SerialNumber: ÐŽ [ 96.086303][ T7008] IPVS: Error connecting to the multicast addr [ 96.098541][ T6991] netlink: 8 bytes leftover after parsing attributes in process `syz.3.291'. [ 96.098562][ T6991] netlink: 12 bytes leftover after parsing attributes in process `syz.3.291'. [ 96.099612][ T6991] netlink: 8 bytes leftover after parsing attributes in process `syz.3.291'. [ 96.099632][ T6991] netlink: 12 bytes leftover after parsing attributes in process `syz.3.291'. [ 96.122193][ T150] usb 8-1: USB disconnect, device number 10 [ 96.166667][ T5814] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 96.331071][ T7004] netlink: 'syz.2.296': attribute type 1 has an invalid length. [ 96.331102][ T7004] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 96.338580][ T5814] usb 7-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 96.338614][ T5814] usb 7-1: no configurations [ 96.338624][ T5814] usb 7-1: can't read configurations, error -22 [ 96.670969][ T7021] syzkaller0: entered promiscuous mode [ 96.670985][ T7021] syzkaller0: entered allmulticast mode [ 98.416419][ T7030] netlink: 96 bytes leftover after parsing attributes in process `syz.0.306'. [ 98.416437][ T7030] netlink: 96 bytes leftover after parsing attributes in process `syz.0.306'. [ 100.402855][ T5747] Bluetooth: hci1: unexpected event for opcode 0x0404 [ 102.089494][ T5747] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 104.110099][ T5822] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 104.279487][ T5822] usb 6-1: Using ep0 maxpacket: 8 [ 104.284641][ T5822] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 104.309476][ T5822] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 104.309497][ T5822] usb 6-1: config 0 has no interface number 0 [ 104.309724][ T5822] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 104.309737][ T5822] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 104.309752][ T5822] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 207, changing to 11 [ 104.309767][ T5822] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 10104, setting to 1024 [ 104.309782][ T5822] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 104.309871][ T5822] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.350503][ T5822] usb 6-1: config 0 descriptor?? [ 104.366054][ T7062] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 104.654960][ T5822] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 106.063102][ T10] usb 6-1: USB disconnect, device number 5 [ 106.163117][ T10] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 109.603733][ T0] NOHZ tick-stop error: local softirq work is pending, handler #24a!!! [ 112.399594][ T7094] netlink: 24 bytes leftover after parsing attributes in process `syz.0.325'. [ 112.460466][ T7094] netlink: 24 bytes leftover after parsing attributes in process `syz.0.325'. [ 112.866963][ T7101] IPVS: sync thread started: state = BACKUP, mcast_ifn = macsec0, syncid = 3, id = 0 [ 115.939653][ T7117] netlink: 4 bytes leftover after parsing attributes in process `syz.3.331'. [ 121.358232][ T7140] futex_wake_op: syz.2.333 tries to shift op by 144; fix this program [ 122.531596][ T7153] Bluetooth: MGMT ver 1.23 [ 124.533604][ T7163] null_blk: nullb1: using native zone append [ 124.596875][ T5745] Bluetooth: hci2: command 0x0c1a tx timeout [ 124.598654][ T5747] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 124.755185][ T7164] syzkaller0: entered promiscuous mode [ 124.755211][ T7164] syzkaller0: entered allmulticast mode [ 125.458279][ T7163] null_blk: disk nullb1 created [ 129.003255][ T43] audit: type=1326 audit(1789737140.943:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7188 comm="syz.2.347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 129.027358][ T43] audit: type=1326 audit(1789737140.943:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7188 comm="syz.2.347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 129.144569][ T43] audit: type=1326 audit(1789737141.083:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7188 comm="syz.2.347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 129.146260][ T43] audit: type=1326 audit(1789737141.083:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7188 comm="syz.2.347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 129.154542][ T43] audit: type=1326 audit(1789737141.093:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7188 comm="syz.2.347" exe="/syz-executor" sig=0 arch=40000003 syscall=320 compat=1 ip=0xf709efec code=0x7ffc0000 [ 129.167136][ T43] audit: type=1326 audit(1789737141.093:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7188 comm="syz.2.347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 129.167388][ T43] audit: type=1326 audit(1789737141.103:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7188 comm="syz.2.347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 129.212918][ T43] audit: type=1326 audit(1789737141.153:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7188 comm="syz.2.347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 129.217453][ T43] audit: type=1326 audit(1789737141.153:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7188 comm="syz.2.347" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf709efec code=0x7ffc0000 [ 129.217723][ T43] audit: type=1326 audit(1789737141.153:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7188 comm="syz.2.347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 129.990082][ T7189] kAFS: No cell specified [ 132.369529][ T1436] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.369834][ T1436] ieee802154 phy1 wpan1: encryption failed: -22 [ 136.093784][ T7219] netlink: 96 bytes leftover after parsing attributes in process `syz.2.354'. [ 136.093816][ T7219] netlink: 96 bytes leftover after parsing attributes in process `syz.2.354'. [ 140.926137][ T7226] netlink: 28 bytes leftover after parsing attributes in process `syz.2.355'. [ 141.074591][ T7234] loop1: detected capacity change from 0 to 65536 [ 143.757709][ T43] kauditd_printk_skb: 34 callbacks suppressed [ 143.757734][ T43] audit: type=1326 audit(1789737155.703:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7247 comm="syz.1.358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f47fec code=0x7ffc0000 [ 143.758598][ T43] audit: type=1326 audit(1789737155.703:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7247 comm="syz.1.358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f47fec code=0x7ffc0000 [ 143.784218][ T5747] Bluetooth: hci1: unexpected event for opcode 0x0404 [ 143.801905][ T43] audit: type=1326 audit(1789737155.743:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7247 comm="syz.1.358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f47fec code=0x7ffc0000 [ 143.802188][ T43] audit: type=1326 audit(1789737155.743:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7247 comm="syz.1.358" exe="/syz-executor" sig=0 arch=40000003 syscall=320 compat=1 ip=0xf7f47fec code=0x7ffc0000 [ 143.803790][ T43] audit: type=1326 audit(1789737155.743:108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7247 comm="syz.1.358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f47fec code=0x7ffc0000 [ 143.809060][ T43] audit: type=1326 audit(1789737155.743:107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7247 comm="syz.1.358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f47fec code=0x7ffc0000 [ 143.810466][ T43] audit: type=1326 audit(1789737155.753:109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7247 comm="syz.1.358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f47fec code=0x7ffc0000 [ 143.818853][ T43] audit: type=1326 audit(1789737155.753:110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7247 comm="syz.1.358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f47fec code=0x7ffc0000 [ 143.824341][ T43] audit: type=1326 audit(1789737155.753:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7247 comm="syz.1.358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f47fec code=0x7ffc0000 [ 143.824609][ T43] audit: type=1326 audit(1789737155.753:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7247 comm="syz.1.358" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f47fec code=0x7ffc0000 [ 148.767528][ T43] kauditd_printk_skb: 311 callbacks suppressed [ 148.767613][ T43] audit: type=1326 audit(1789737160.703:424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7259 comm="syz.2.365" exe="/syz-executor" sig=0 arch=40000003 syscall=426 compat=1 ip=0xf709efec code=0x7ffc0000 [ 148.790499][ T43] audit: type=1326 audit(1789737160.713:425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7259 comm="syz.2.365" exe="/syz-executor" sig=0 arch=40000003 syscall=426 compat=1 ip=0xf709efec code=0x7ffc0000 [ 148.790749][ T43] audit: type=1326 audit(1789737160.723:426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7259 comm="syz.2.365" exe="/syz-executor" sig=0 arch=40000003 syscall=426 compat=1 ip=0xf709efec code=0x7ffc0000 [ 148.813298][ T43] audit: type=1326 audit(1789737160.733:427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7259 comm="syz.2.365" exe="/syz-executor" sig=0 arch=40000003 syscall=426 compat=1 ip=0xf709efec code=0x7ffc0000 [ 148.813581][ T43] audit: type=1326 audit(1789737160.743:428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7259 comm="syz.2.365" exe="/syz-executor" sig=0 arch=40000003 syscall=426 compat=1 ip=0xf709efec code=0x7ffc0000 [ 148.834450][ T43] audit: type=1326 audit(1789737160.753:429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7259 comm="syz.2.365" exe="/syz-executor" sig=0 arch=40000003 syscall=426 compat=1 ip=0xf709efec code=0x7ffc0000 [ 148.834727][ T43] audit: type=1326 audit(1789737160.763:430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7259 comm="syz.2.365" exe="/syz-executor" sig=0 arch=40000003 syscall=426 compat=1 ip=0xf709efec code=0x7ffc0000 [ 148.834955][ T43] audit: type=1326 audit(1789737160.763:431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7259 comm="syz.2.365" exe="/syz-executor" sig=0 arch=40000003 syscall=426 compat=1 ip=0xf709efec code=0x7ffc0000 [ 148.866949][ T43] audit: type=1326 audit(1789737160.773:432): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7259 comm="syz.2.365" exe="/syz-executor" sig=0 arch=40000003 syscall=426 compat=1 ip=0xf709efec code=0x7ffc0000 [ 148.867203][ T43] audit: type=1326 audit(1789737160.783:433): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7259 comm="syz.2.365" exe="/syz-executor" sig=0 arch=40000003 syscall=426 compat=1 ip=0xf709efec code=0x7ffc0000 [ 151.704985][ T7284] netlink: 28 bytes leftover after parsing attributes in process `syz.1.369'. [ 154.352765][ T7279] geneve3: entered promiscuous mode [ 154.370438][ T5813] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 38067 - 0 [ 154.370646][ T5813] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 38067 - 0 [ 154.370758][ T5813] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 38067 - 0 [ 154.370823][ T5813] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 38067 - 0 [ 156.239349][ T43] kauditd_printk_skb: 137 callbacks suppressed [ 156.239375][ T43] audit: type=1326 audit(1789737168.173:571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7291 comm="syz.0.371" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 156.239852][ T7290] netlink: 'syz.3.370': attribute type 7 has an invalid length. [ 156.243848][ T43] audit: type=1326 audit(1789737168.183:572): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7291 comm="syz.0.371" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 156.333403][ T43] audit: type=1326 audit(1789737168.273:573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7291 comm="syz.0.371" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 156.340825][ T43] audit: type=1326 audit(1789737168.283:574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7291 comm="syz.0.371" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 156.346429][ T43] audit: type=1326 audit(1789737168.283:575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7291 comm="syz.0.371" exe="/syz-executor" sig=0 arch=40000003 syscall=172 compat=1 ip=0xf70befec code=0x7ffc0000 [ 156.347669][ T43] audit: type=1326 audit(1789737168.293:576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7291 comm="syz.0.371" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 156.355936][ T43] audit: type=1326 audit(1789737168.293:577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7291 comm="syz.0.371" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 156.395376][ T43] audit: type=1326 audit(1789737168.333:578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7291 comm="syz.0.371" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 156.403020][ T43] audit: type=1326 audit(1789737168.343:579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7291 comm="syz.0.371" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 156.404505][ T43] audit: type=1326 audit(1789737168.343:580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7291 comm="syz.0.371" exe="/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf70befec code=0x7ffc0000 [ 156.927583][ T7292] binder: BINDER_SET_CONTEXT_MGR already set [ 156.927597][ T7292] binder: 7291:7292 ioctl 4018620d 80004a80 returned -16 [ 157.240888][ T5747] Bluetooth: hci2: unexpected event for opcode 0x0404 [ 160.405256][ T7312] syz.0.374 (7312) used greatest stack depth: 16920 bytes left [ 162.794501][ T7323] netlink: 'syz.1.378': attribute type 1 has an invalid length. [ 165.950252][ T7330] syzkaller0: entered promiscuous mode [ 165.950282][ T7330] syzkaller0: entered allmulticast mode [ 168.025380][ T1157] IPVS: starting estimator thread 0... [ 168.107202][ T7346] IPVS: using max 6 ests per chain, 14400 per kthread [ 173.211317][ T43] kauditd_printk_skb: 101 callbacks suppressed [ 173.211338][ T43] audit: type=1326 audit(1789737185.153:682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7360 comm="syz.0.384" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 173.214872][ T43] audit: type=1326 audit(1789737185.153:683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7360 comm="syz.0.384" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 173.268737][ T43] audit: type=1326 audit(1789737185.213:684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7360 comm="syz.0.384" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 173.270421][ T43] audit: type=1326 audit(1789737185.213:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7360 comm="syz.0.384" exe="/syz-executor" sig=0 arch=40000003 syscall=320 compat=1 ip=0xf70befec code=0x7ffc0000 [ 173.273078][ T43] audit: type=1326 audit(1789737185.213:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7360 comm="syz.0.384" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 173.279335][ T43] audit: type=1326 audit(1789737185.223:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7360 comm="syz.0.384" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 173.279579][ T43] audit: type=1326 audit(1789737185.223:688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7360 comm="syz.0.384" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 173.288583][ T43] audit: type=1326 audit(1789737185.223:689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7360 comm="syz.0.384" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 173.290515][ T43] audit: type=1326 audit(1789737185.233:690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7360 comm="syz.0.384" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf70befec code=0x7ffc0000 [ 173.293133][ T43] audit: type=1326 audit(1789737185.233:691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7360 comm="syz.0.384" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 173.980270][ T7361] kAFS: No cell specified [ 176.177767][ T7371] loop1: detected capacity change from 0 to 65536 [ 176.310330][ T7371] device-mapper: table: 248:0: thin-pool: Error opening metadata block device (-EBUSY) [ 176.310386][ T7371] device-mapper: ioctl: error adding target to table [ 176.347674][ T7371] device-mapper: ioctl: The device has no table. [ 178.168417][ T5835] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 178.490376][ T7383] FAULT_INJECTION: forcing a failure. [ 178.490376][ T7383] name failslab, interval 1, probability 0, space 0, times 0 [ 178.490415][ T7383] CPU: 0 UID: 0 PID: 7383 Comm: syz.1.395 Not tainted syzkaller #0 PREEMPT(full) [ 178.490434][ T7383] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 178.490446][ T7383] Call Trace: [ 178.490467][ T7383] [ 178.490489][ T7383] dump_stack_lvl+0x100/0x190 [ 178.490629][ T7383] should_fail_ex.cold+0x5/0xa [ 178.490704][ T7383] should_failslab+0xc2/0x120 [ 178.490757][ T7383] __kvmalloc_node_noprof+0x113/0x9b0 [ 178.490823][ T7383] ? __pfx___mutex_lock+0x10/0x10 [ 178.490907][ T7383] ? nf_hook_entries_grow+0x255/0x870 [ 178.491011][ T7383] nf_hook_entries_grow+0x255/0x870 [ 178.491089][ T7383] ? __call_rcu_common.constprop.0+0x3f2/0x9b0 [ 178.491262][ T7383] __nf_register_net_hook+0x112/0x780 [ 178.491372][ T7383] nf_register_net_hook+0xdb/0x170 [ 178.491459][ T7383] nf_register_net_hooks+0x5d/0xd0 [ 178.491526][ T7383] ip_vs_register_hooks+0xe3/0x150 [ 178.491622][ T7383] ip_vs_add_service+0x515/0x2240 [ 178.491765][ T7383] ? __ip_vs_service_find+0x4d0/0x9c0 [ 178.492009][ T7383] ? do_ip_vs_set_ctl+0xb86/0xc90 [ 178.492046][ T7383] do_ip_vs_set_ctl+0xb86/0xc90 [ 178.492132][ T7383] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 178.492320][ T7383] ? find_held_lock+0x2b/0x80 [ 178.492350][ T7383] ? nf_sockopt_find.isra.0+0x222/0x290 [ 178.492383][ T7383] ? nf_sockopt_find.isra.0+0x222/0x290 [ 178.492625][ T7383] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 178.492926][ T7383] ? nf_setsockopt+0x8d/0xf0 [ 178.492955][ T7383] nf_setsockopt+0x8d/0xf0 [ 178.493113][ T7383] ip_setsockopt+0xcb/0xf0 [ 178.493206][ T7383] udp_setsockopt+0x64/0xb0 [ 178.493256][ T7383] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 178.493363][ T7383] do_sock_setsockopt+0xf3/0x1d0 [ 178.493487][ T7383] __sys_setsockopt+0x119/0x190 [ 178.493635][ T7383] __ia32_sys_setsockopt+0xbc/0x160 [ 178.493678][ T7383] ? __do_fast_syscall_32+0xb3/0x8b0 [ 178.493736][ T7383] ? lockdep_hardirqs_on+0x7d/0x110 [ 178.493777][ T7383] __do_fast_syscall_32+0x13a/0x8b0 [ 178.493869][ T7383] do_fast_syscall_32+0x32/0x70 [ 178.493933][ T7383] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 178.493974][ T7383] RIP: 0023:0xf7f47fec [ 178.494041][ T7383] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 178.494055][ T7383] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 178.494083][ T7383] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000000000 [ 178.494096][ T7383] RDX: 0000000000000482 RSI: 0000000080000180 RDI: 000000000000002c [ 178.494105][ T7383] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 178.494114][ T7383] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 178.494122][ T7383] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 178.494378][ T7383] [ 178.547924][ T5835] usb 8-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 178.625202][ T5835] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 178.625224][ T5835] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 178.930237][ T5835] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.930257][ T5835] usb 8-1: Product: syz [ 178.930268][ T5835] usb 8-1: Manufacturer: syz [ 178.930279][ T5835] usb 8-1: SerialNumber: syz [ 180.151490][ T5835] usblp 8-1:1.0: usblp0: USB Bidirectional printer dev 11 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 181.082081][ T5814] usb 8-1: USB disconnect, device number 11 [ 181.295373][ T5814] usblp0: removed [ 182.864330][ T7392] netlink: 4 bytes leftover after parsing attributes in process `syz.0.397'. [ 183.860483][ T5835] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 184.048529][ T5835] usb 8-1: Using ep0 maxpacket: 32 [ 184.058780][ T5835] usb 8-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 184.088051][ T5835] usb 8-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 184.088572][ T5835] usb 8-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 184.088589][ T5835] usb 8-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 184.088604][ T5835] usb 8-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 184.152482][ T5835] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.152508][ T5835] usb 8-1: Product: syz [ 184.152525][ T5835] usb 8-1: Manufacturer: syz [ 184.152542][ T5835] usb 8-1: SerialNumber: syz [ 184.407689][ C3] imon 8-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 184.514343][ T5835] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:155.0/input/input8 [ 184.557489][ T7397] netlink: 'syz.3.399': attribute type 12 has an invalid length. [ 184.589533][ T5814] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 184.657567][ T5835] imon 8-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 184.657591][ T5835] (id 0x00) [ 184.791931][ T5814] usb 6-1: Using ep0 maxpacket: 8 [ 184.803079][ T5814] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 184.860221][ T5814] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 184.860559][ T5814] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 184.860587][ T5814] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 184.860608][ T5814] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 184.860629][ T5814] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 184.860764][ T5814] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.016853][ T5835] rc_core: IR keymap rc-imon-pad not found [ 185.016882][ T5835] Registered IR keymap rc-empty [ 185.017832][ T5835] imon 8-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 185.017855][ T5835] imon 8-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 185.464752][ T5835] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:155.0/rc/rc0 [ 185.493583][ T5814] usb 6-1: usb_control_msg returned -32 [ 185.493936][ T5814] usbtmc 6-1:16.0: can't read capabilities [ 185.632014][ T5835] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:155.0/rc/rc0/input9 [ 185.809289][ T5835] imon 8-1:155.0: iMON device (15c2:ffdc, intf0) on usb<8:12> initialized [ 186.952845][ T7412] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 187.118717][ T7412] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 187.165897][ T5835] usb 8-1: USB disconnect, device number 12 [ 189.680390][ T5814] usb 6-1: USB disconnect, device number 6 [ 190.517278][ T7423] loop1: detected capacity change from 0 to 65536 [ 190.858326][ T7423] device-mapper: table: 248:0: thin-pool: Error opening metadata block device (-EBUSY) [ 190.858354][ T7423] device-mapper: ioctl: error adding target to table [ 190.920296][ T7423] device-mapper: ioctl: The device has no table. [ 191.300914][ T7434] netlink: 4 bytes leftover after parsing attributes in process `syz.0.406'. [ 192.288057][ T5747] Bluetooth: hci0: unexpected event for opcode 0x0404 [ 192.313901][ T5747] Bluetooth: hci3: unexpected event for opcode 0x0404 [ 192.379395][ T7421] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 193.827259][ T1436] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.827851][ T1436] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.336823][ T7447] FAULT_INJECTION: forcing a failure. [ 194.336823][ T7447] name fail_futex, interval 1, probability 0, space 0, times 1 [ 194.336860][ T7447] CPU: 0 UID: 0 PID: 7447 Comm: syz.1.409 Not tainted syzkaller #0 PREEMPT(full) [ 194.336879][ T7447] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 194.336891][ T7447] Call Trace: [ 194.336911][ T7447] [ 194.336931][ T7447] dump_stack_lvl+0x100/0x190 [ 194.337064][ T7447] should_fail_ex.cold+0x5/0xa [ 194.337114][ T7447] ? trace_event_buffer_commit+0x20a/0xa80 [ 194.337207][ T7447] get_futex_key+0x1d0/0x14f0 [ 194.337316][ T7447] ? __pfx_get_futex_key+0x10/0x10 [ 194.337349][ T7447] ? __pfx_trace_event_raw_event_lock+0x10/0x10 [ 194.337492][ T7447] ? tracing_record_taskinfo_sched_switch+0xac/0x560 [ 194.337597][ T7447] futex_wait_setup+0x91/0x540 [ 194.337800][ T7447] __futex_wait+0x19f/0x300 [ 194.337905][ T7447] ? __pfx___futex_wait+0x10/0x10 [ 194.337937][ T7447] ? __pfx_try_to_wake_up+0x10/0x10 [ 194.338064][ T7447] ? __pfx_futex_wake_mark+0x10/0x10 [ 194.338241][ T7447] ? __raw_callee_save_pv_queued_spin_unlock_traced+0x15/0x40 [ 194.338417][ T7447] futex_wait+0xe6/0x370 [ 194.338504][ T7447] ? __pfx_futex_wait+0x10/0x10 [ 194.338653][ T7447] ? rcu_read_lock_any_held+0x6a/0x90 [ 194.338691][ T7447] ? find_held_lock+0x2b/0x80 [ 194.338730][ T7447] ? ksys_write+0x190/0x250 [ 194.338773][ T7447] ? ksys_write+0x190/0x250 [ 194.338883][ T7447] do_futex+0x265/0x440 [ 194.338943][ T7447] ? __pfx_do_futex+0x10/0x10 [ 194.339025][ T7447] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 194.339177][ T7447] __ia32_sys_futex_time32+0x2f4/0x470 [ 194.339252][ T7447] ? fput+0x7c/0x100 [ 194.339306][ T7447] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 194.339337][ T7447] ? ksys_write+0x1ac/0x250 [ 194.339395][ T7447] ? __pfx_ksys_write+0x10/0x10 [ 194.339560][ T7447] __do_fast_syscall_32+0x13a/0x8b0 [ 194.339700][ T7447] do_fast_syscall_32+0x32/0x70 [ 194.339751][ T7447] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 194.339777][ T7447] RIP: 0023:0xf7f47fec [ 194.339817][ T7447] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 194.339827][ T7447] RSP: 002b:00000000f54065bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 194.339847][ T7447] RAX: ffffffffffffffda RBX: 00000000f7404f88 RCX: 0000000000000080 [ 194.339859][ T7447] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7404f8c [ 194.339871][ T7447] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 194.339882][ T7447] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 194.339894][ T7447] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 194.340168][ T7447] [ 196.017256][ T7451] XFS (nbd2): SB validate failed with error -5. [ 196.497852][ T7461] netlink: 'syz.1.413': attribute type 1 has an invalid length. [ 196.699064][ T7466] hid-generic 0003:0627:0001.0001: pid 7466 passed too short report [ 201.135527][ T5747] Bluetooth: hci1: unexpected event for opcode 0x0404 [ 201.264645][ T5747] Bluetooth: hci3: unexpected event for opcode 0x0404 [ 201.447411][ T35] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 201.631590][ T35] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 201.644376][ T35] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 201.644399][ T35] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 201.644515][ T35] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 201.684434][ T35] usb 6-1: config 0 descriptor?? [ 205.224066][ T35] usb 6-1: USB disconnect, device number 7 [ 208.196171][ T5747] Bluetooth: hci2: unexpected event for opcode 0x0404 [ 211.032621][ T7557] syz.2.433 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 214.320693][ T7570] netlink: 'syz.1.436': attribute type 10 has an invalid length. [ 214.333903][ T5786] bond0: (slave bond_slave_0): interface is now down [ 214.333924][ T5786] bond0: (slave bond_slave_1): interface is now down [ 214.350411][ T7348] bond0: (slave bond_slave_0): interface is now down [ 214.350444][ T7348] bond0: (slave bond_slave_1): interface is now down [ 214.365603][ T7348] bond0: now running without any active interface! [ 214.783211][ T7572] netlink: 4 bytes leftover after parsing attributes in process `syz.2.437'. [ 216.227093][ T5815] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 216.411297][ T5815] usb 8-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 216.583644][ T5815] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 216.583994][ T5815] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 216.804837][ T5815] keyspan 8-1:1.0: Keyspan 2 port adapter converter detected [ 216.809602][ T5815] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 81 [ 216.810095][ T5815] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 1 [ 216.887397][ T5815] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 84 [ 216.888056][ T5815] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 2 [ 217.019291][ T5815] usb 8-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 217.131712][ T5815] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 88 [ 217.135838][ T5815] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 6 [ 217.235370][ T5815] usb 8-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 219.110166][ T7591] IPv6: addrconf: prefix option has invalid lifetime [ 220.099348][ T7597] netlink: 4 bytes leftover after parsing attributes in process `syz.2.444'. [ 220.161239][ T7597] netlink: 4 bytes leftover after parsing attributes in process `syz.2.444'. [ 222.130471][ T5814] usb 8-1: USB disconnect, device number 13 [ 222.133933][ T7595] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 222.217820][ T5814] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 222.401086][ T5814] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 222.416144][ T5814] keyspan 8-1:1.0: device disconnected [ 225.847091][ T25] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 226.049560][ T25] usb 7-1: Using ep0 maxpacket: 8 [ 226.054417][ T25] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 226.077144][ T25] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 226.077369][ T25] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 226.077561][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 226.077598][ T25] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 226.077629][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 226.077662][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 226.077698][ T25] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 226.077736][ T25] usb 7-1: config 168 interface 0 has no altsetting 0 [ 226.148314][ T25] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 226.148451][ T25] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 226.148555][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 226.148572][ T25] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 226.148589][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 226.148606][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 226.148624][ T25] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 226.148641][ T25] usb 7-1: config 168 interface 0 has no altsetting 0 [ 226.152125][ T7628] program syz.3.449 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 226.202246][ T25] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 226.202349][ T25] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 226.202507][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 226.202523][ T25] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 226.202539][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 226.202554][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 226.202570][ T25] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 226.202586][ T25] usb 7-1: config 168 interface 0 has no altsetting 0 [ 226.272560][ T25] usb 7-1: string descriptor 0 read error: -22 [ 226.273590][ T25] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.397577][ T25] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 226.843911][ T5835] usb 7-1: USB disconnect, device number 6 [ 227.335085][ T7617] FAULT_INJECTION: forcing a failure. [ 227.335085][ T7617] name failslab, interval 1, probability 0, space 0, times 0 [ 227.335131][ T7617] CPU: 3 UID: 0 PID: 7617 Comm: syz.1.448 Not tainted syzkaller #0 PREEMPT(full) [ 227.335152][ T7617] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 227.335167][ T7617] Call Trace: [ 227.335178][ T7617] [ 227.335190][ T7617] dump_stack_lvl+0x100/0x190 [ 227.335257][ T7617] should_fail_ex.cold+0x5/0xa [ 227.335377][ T7617] should_failslab+0xc2/0x120 [ 227.335459][ T7617] __kmalloc_noprof+0xfc/0x840 [ 227.335496][ T7617] ? __register_sysctl_table+0xac/0x1650 [ 227.335623][ T7617] __register_sysctl_table+0xac/0x1650 [ 227.335664][ T7617] ? trace_kmalloc+0xeb/0x110 [ 227.335714][ T7617] ? __kasan_kmalloc+0xaa/0xb0 [ 227.335775][ T7617] ? __kmalloc_node_track_caller_noprof+0x35b/0x870 [ 227.335819][ T7617] ? __pfx___register_sysctl_table+0x10/0x10 [ 227.335846][ T7617] ? register_pidns_sysctls+0x48/0x1c0 [ 227.335942][ T7617] ? __asan_memcpy+0x3c/0x60 [ 227.336052][ T7617] register_pidns_sysctls+0x11d/0x1c0 [ 227.336076][ T7617] ? __ns_common_init+0x299/0x4b0 [ 227.336185][ T7617] copy_pid_ns+0x680/0x10a0 [ 227.336308][ T7617] ? __pfx_copy_pid_ns+0x10/0x10 [ 227.336408][ T7617] ? __pfx_copy_mnt_ns+0x10/0x10 [ 227.336517][ T7617] ? create_new_namespaces+0x30/0xac0 [ 227.336680][ T7617] create_new_namespaces+0x2aa/0xac0 [ 227.336845][ T7617] unshare_nsproxy_namespaces+0xf2/0x220 [ 227.336970][ T7617] ksys_unshare+0x4a2/0xa70 [ 227.337008][ T7617] ? __pfx_ksys_unshare+0x10/0x10 [ 227.337246][ T7617] __ia32_sys_unshare+0x30/0x40 [ 227.337291][ T7617] __do_fast_syscall_32+0x13a/0x8b0 [ 227.337395][ T7617] do_fast_syscall_32+0x32/0x70 [ 227.337475][ T7617] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 227.337521][ T7617] RIP: 0023:0xf7f47fec [ 227.337575][ T7617] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 227.337582][ T7617] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000136 [ 227.337599][ T7617] RAX: ffffffffffffffda RBX: 0000000062040200 RCX: 0000000000000000 [ 227.337609][ T7617] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 227.337618][ T7617] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 227.337628][ T7617] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 227.337637][ T7617] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 227.337889][ T7617] [ 228.979648][ T5747] Bluetooth: hci2: unexpected event for opcode 0x0404 [ 232.838676][ T7647] 8021q: adding VLAN 0 to HW filter on device bond0 [ 232.904809][ T7647] 8021q: adding VLAN 0 to HW filter on device team0 [ 233.113487][ T7647] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 233.943894][ T7665] netlink: 8 bytes leftover after parsing attributes in process `syz.3.459'. [ 233.943963][ T7665] netlink: 16 bytes leftover after parsing attributes in process `syz.3.459'. [ 234.092945][ T7647] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 234.180850][ T7647] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 234.401735][ T7647] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 234.401760][ T7647] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 234.525666][ T7647] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 234.719119][ T172] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.720041][ T172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 234.738340][ T172] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.739144][ T172] bridge0: port 2(bridge_slave_1) entered forwarding state [ 235.368711][ T7660] netlink: 40 bytes leftover after parsing attributes in process `syz.3.459'. [ 236.128670][ T7670] nbd0: detected capacity change from 0 to 18 [ 236.150502][ T66] block nbd0: Receive control failed (result -107) [ 236.168293][ T36] block nbd0: Dead connection, failed to find a fallback [ 236.168333][ T36] block nbd0: shutting down sockets [ 236.168365][ T36] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 236.168617][ T36] Buffer I/O error on dev nbd0, logical block 0, async page read [ 236.215204][ T7677] nbd0: detected capacity change from 18 to 0 [ 236.221317][ T1299] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 236.221344][ T1299] Buffer I/O error on dev nbd0, logical block 0, async page read [ 236.222541][ T7415] ldm_validate_partition_table(): Disk read failed. [ 236.222559][ T7415] Dev nbd0: unable to read RDB block 0 [ 236.222574][ T7415] nbd0: unable to read partition table [ 236.224320][ T7415] nbd0: partition table beyond EOD, truncated [ 236.234399][ T5747] Bluetooth: hci2: unexpected event for opcode 0x2023 [ 236.564547][ T7670] pi3usb30532 0-0005: Error reading config register -6 [ 236.573017][ T7670] i2c i2c-0: new_device: Instantiated device pi3usb30532 at 0x05 [ 238.442361][ T7679] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 239.521255][ T5747] Bluetooth: hci2: unexpected event for opcode 0x0404 [ 241.216052][ T7698] MINIX-fs: blocksize too small for device [ 243.936618][ T7719] netlink: 20 bytes leftover after parsing attributes in process `syz.0.472'. [ 244.018897][ T7719] bond0: (slave bond_slave_0): Releasing backup interface [ 244.174866][ T7719] bond_slave_0: entered promiscuous mode [ 244.174887][ T7719] bond_slave_0: entered allmulticast mode [ 247.144574][ T7745] netlink: 4 bytes leftover after parsing attributes in process `syz.0.477'. [ 250.224138][ T7749] ntfs3(nullb0): Primary boot signature is not NTFS. [ 250.311376][ T7749] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 251.971656][ T7770] NILFS (loop1): device size too small [ 252.418080][ T7770] netlink: 'syz.1.479': attribute type 9 has an invalid length. [ 252.418131][ T7770] netlink: 'syz.1.479': attribute type 7 has an invalid length. [ 252.418371][ T7770] netlink: 'syz.1.479': attribute type 8 has an invalid length. [ 255.259397][ T1436] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.259673][ T1436] ieee802154 phy1 wpan1: encryption failed: -22 [ 258.540619][ T7782] netlink: 'syz.1.483': attribute type 1 has an invalid length. [ 259.299399][ T7782] bond1: entered promiscuous mode [ 259.304623][ T7782] 8021q: adding VLAN 0 to HW filter on device bond1 [ 259.606739][ T7790] bond1: (slave bridge1): making interface the new active one [ 259.606773][ T7790] bridge1: entered promiscuous mode [ 259.636328][ T7790] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 263.162092][ T7808] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 263.166453][ T7808] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 263.177672][ T7808] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 265.243142][ T5747] Bluetooth: hci3: command 0x0c1a tx timeout [ 265.243405][ T5747] Bluetooth: hci1: command 0x0419 tx timeout [ 265.243455][ T5745] Bluetooth: hci2: command 0x0c1a tx timeout [ 266.607156][ T7819] loop5: detected capacity change from 0 to 7 [ 266.624020][ T7819] Dev loop5: unable to read RDB block 7 [ 266.624047][ T7819] loop5: AHDI p1 p3 p4 [ 266.624192][ T7819] loop5: partition table partially beyond EOD, truncated [ 266.639613][ T7819] loop5: p1 size 100663296 extends beyond EOD, truncated [ 266.701597][ T7819] loop5: p3 size 4261412863 extends beyond EOD, truncated [ 266.903964][ T7819] netlink: 'syz.3.489': attribute type 88 has an invalid length. [ 267.092971][ T7816] bridge0: port 2(bridge_slave_1) entered disabled state [ 267.099960][ T7816] bridge0: port 1(bridge_slave_0) entered disabled state [ 267.317009][ T5747] Bluetooth: hci1: command 0x0419 tx timeout [ 267.604421][ T7295] udevd[7295]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 267.685616][ T7415] udevd[7415]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 268.949957][ T7816] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 268.952270][ T7816] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 269.397225][ T13] netdevsim netdevsim120 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.397221][ T5747] Bluetooth: hci1: command 0x0419 tx timeout [ 269.397263][ T13] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.397291][ T13] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.397342][ T13] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.397370][ T13] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.697160][ T7863] batman_adv: batadv0: Adding interface: veth0 [ 270.697171][ T7863] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 270.697187][ T7863] batman_adv: batadv0: Interface activated: veth0 [ 270.699683][ T7863] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 270.707630][ T7863] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 270.716010][ T7863] batman_adv: batadv0: Interface deactivated: veth0 [ 270.716023][ T7863] batman_adv: batadv0: Removing interface: veth0 [ 271.300275][ T7879] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 271.356809][ T7879] md: couldn't update array info. -22 [ 271.403543][ T7880] md: could not open device unknown-block(1,0). [ 271.403577][ T7880] md: md_import_device returned -16 [ 272.746329][ T7897] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 272.746710][ T7897] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 272.746778][ T7897] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 272.966901][ T150] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 273.054726][ T7910] netlink: 'syz.0.520': attribute type 1 has an invalid length. [ 273.069222][ T7910] 8021q: adding VLAN 0 to HW filter on device bond2 [ 273.103962][ T7910] bond2: (slave geneve4): making interface the new active one [ 273.112517][ T7910] bond2: (slave geneve4): Enslaving as an active interface with an up link [ 273.128270][ T150] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 273.129353][ T150] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 273.129374][ T150] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 273.129403][ T150] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 273.132614][ T150] usb 6-1: config 0 descriptor?? [ 273.824839][ T7917] tipc: Cannot configure node identity twice [ 274.030359][ T7931] netlink: 'syz.2.524': attribute type 12 has an invalid length. [ 274.030372][ T7931] netlink: 68 bytes leftover after parsing attributes in process `syz.2.524'. [ 274.043521][ T7933] jffs2: notice: (7933) jffs2_build_xattr_subsystem: complete building xattr subsystem, 8 of xdatum (0 unchecked, 8 orphan) and 8 of xref (1 dead, 7 orphan) found. [ 274.064633][ T7933] overlayfs: upper fs does not support tmpfile. [ 274.064877][ T7933] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 274.138241][ T7939] FAULT_INJECTION: forcing a failure. [ 274.138241][ T7939] name failslab, interval 1, probability 0, space 0, times 0 [ 274.138270][ T7939] CPU: 3 UID: 0 PID: 7939 Comm: syz.3.516 Not tainted syzkaller #0 PREEMPT(full) [ 274.138289][ T7939] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 274.138299][ T7939] Call Trace: [ 274.138305][ T7939] [ 274.138313][ T7939] dump_stack_lvl+0x100/0x190 [ 274.138342][ T7939] should_fail_ex.cold+0x5/0xa [ 274.138390][ T7939] should_failslab+0xc2/0x120 [ 274.138417][ T7939] __kmalloc_cache_noprof+0x91/0x6d0 [ 274.138444][ T7939] ? get_mm_exe_file+0x8a/0x1a0 [ 274.138473][ T7939] ? get_current_details+0xa0/0x670 [ 274.138496][ T7939] get_current_details+0xa0/0x670 [ 274.138518][ T7939] landlock_merge_ruleset+0x7ea/0xd10 [ 274.138543][ T7939] __do_sys_landlock_restrict_self+0x264/0x10a0 [ 274.138572][ T7939] __do_fast_syscall_32+0x13a/0x8b0 [ 274.138600][ T7939] do_fast_syscall_32+0x32/0x70 [ 274.138627][ T7939] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 274.138649][ T7939] RIP: 0023:0xf701efec [ 274.138668][ T7939] Code: Unable to access opcode bytes at 0xf701efc2. [ 274.138674][ T7939] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 00000000000001be [ 274.138686][ T7939] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000000001a [ 274.138694][ T7939] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 274.138702][ T7939] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 274.138709][ T7939] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 274.138715][ T7939] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 274.138731][ T7939] [ 274.386947][ T7948] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 275.209865][ T7955] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 275.472253][ T7955] md: could not open device unknown-block(7,0). [ 275.569715][ T6106] md_update_sb: can't update sb for read-only array md0 [ 275.641792][ T5747] Bluetooth: hci2: unexpected event for opcode 0x0404 [ 275.691468][ T42] usb 6-1: USB disconnect, device number 8 [ 275.921880][ T7970] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 276.463110][ T43] kauditd_printk_skb: 34 callbacks suppressed [ 276.463130][ T43] audit: type=1800 audit(1789737288.403:726): pid=7981 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.530" name="file0" dev="overlay" ino=816 res=0 errno=0 [ 277.098930][ T7987] bridge_slave_0: left allmulticast mode [ 277.098956][ T7987] bridge_slave_0: left promiscuous mode [ 277.099131][ T7987] bridge0: port 1(bridge_slave_0) entered disabled state [ 277.106214][ T7987] bridge_slave_1: left allmulticast mode [ 277.106236][ T7987] bridge_slave_1: left promiscuous mode [ 277.106453][ T7987] bridge0: port 2(bridge_slave_1) entered disabled state [ 277.131541][ T7987] bond0: (slave bond_slave_1): Releasing backup interface [ 277.145425][ T7987] team0: Port device team_slave_0 removed [ 277.182331][ T7987] team0: Port device team_slave_1 removed [ 277.182750][ T7987] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 277.182762][ T7987] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 277.198180][ T7987] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 277.198194][ T7987] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 277.210719][ T7987] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 277.257443][ T7988] team0: Port device xfrm0 added [ 277.260087][ T7989] tipc: Enabled bearer , priority 0 [ 277.547302][ T1157] IPVS: starting estimator thread 0... [ 277.636682][ T7997] IPVS: using max 43 ests per chain, 103200 per kthread [ 277.844950][ T7999] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 277.861832][ T43] audit: type=1326 audit(1789737289.803:727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7998 comm="syz.0.535" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 277.862861][ T43] audit: type=1326 audit(1789737289.803:728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7998 comm="syz.0.535" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 277.862901][ T43] audit: type=1326 audit(1789737289.803:729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7998 comm="syz.0.535" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 277.862935][ T43] audit: type=1326 audit(1789737289.803:730): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7998 comm="syz.0.535" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 277.862968][ T43] audit: type=1326 audit(1789737289.803:731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7998 comm="syz.0.535" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf70befec code=0x7ffc0000 [ 277.863001][ T43] audit: type=1326 audit(1789737289.803:732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7998 comm="syz.0.535" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 277.863038][ T43] audit: type=1326 audit(1789737289.803:733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7998 comm="syz.0.535" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70befec code=0x7ffc0000 [ 277.886655][ T7967] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 277.903975][ T43] audit: type=1326 audit(1789737289.833:734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7998 comm="syz.0.535" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 277.904022][ T43] audit: type=1326 audit(1789737289.833:735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7998 comm="syz.0.535" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 278.188231][ T5747] Bluetooth: hci3: unexpected event for opcode 0x0404 [ 278.279552][ T35] tipc: Node number set to 2683903207 [ 278.840682][ T8019] netlink: 4 bytes leftover after parsing attributes in process `syz.2.542'. [ 278.899499][ T8021] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 278.899513][ T8021] UDF-fs: Scanning with blocksize 512 failed [ 278.900044][ T8021] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 278.900058][ T8021] UDF-fs: Scanning with blocksize 1024 failed [ 278.900223][ T8021] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 278.900972][ T8021] UDF-fs: Scanning with blocksize 2048 failed [ 278.901109][ T8021] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 278.901119][ T8021] UDF-fs: Scanning with blocksize 4096 failed [ 279.226699][ T35] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 279.376641][ T35] usb 8-1: Using ep0 maxpacket: 16 [ 279.377326][ T35] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 279.378095][ T35] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 279.381833][ T35] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 279.381847][ T35] usb 8-1: Product: syz [ 279.381854][ T35] usb 8-1: Manufacturer: syz [ 279.381862][ T35] usb 8-1: SerialNumber: syz [ 279.383126][ T35] usb 8-1: config 0 descriptor?? [ 279.384897][ T35] em28xx 8-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 279.384913][ T35] em28xx 8-1:0.0: DVB interface 0 found: bulk [ 279.616891][ T8037] netlink: 4 bytes leftover after parsing attributes in process `syz.2.548'. [ 279.617660][ T8037] netlink: 4 bytes leftover after parsing attributes in process `syz.2.548'. [ 279.882894][ T5815] logitech-hidpp-device 0003:046D:C082.0003: hidraw1: USB HID v0.00 Device [syz0] on syz0 [ 279.930494][ T8038] fido_id[8038]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 279.944058][ T5747] Bluetooth: hci2: unexpected event for opcode 0x0404 [ 280.001265][ T25] libceph: connect (1)[c::]:6789 error -101 [ 280.001358][ T25] libceph: mon0 (1)[c::]:6789 connect error [ 280.001542][ T25] libceph: connect (1)[c::]:6789 error -101 [ 280.001604][ T25] libceph: mon0 (1)[c::]:6789 connect error [ 280.001636][ T8043] ceph: No mds server is up or the cluster is laggy [ 280.017392][ T35] em28xx 8-1:0.0: unknown em28xx chip ID (0) [ 280.751601][ T35] em28xx 8-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 280.751628][ T35] em28xx 8-1:0.0: board has no eeprom [ 280.816734][ T35] em28xx 8-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 280.816753][ T35] em28xx 8-1:0.0: dvb set to bulk mode. [ 280.823229][ T35] usb 8-1: USB disconnect, device number 14 [ 280.823901][ T35] em28xx 8-1:0.0: Disconnecting em28xx [ 280.826154][ T5529] em28xx 8-1:0.0: Binding DVB extension [ 280.863965][ T5529] em28xx 8-1:0.0: Registering input extension [ 280.864071][ T35] em28xx 8-1:0.0: Closing input extension [ 280.871777][ T35] em28xx: Freeing device [ 282.116728][ T8048] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 282.446659][ T35] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 282.607469][ T35] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 282.608675][ T35] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 282.608707][ T35] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 282.610422][ T35] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.610435][ T35] usb 6-1: Product: syz [ 282.610442][ T35] usb 6-1: Manufacturer: syz [ 282.610449][ T35] usb 6-1: SerialNumber: syz [ 283.125694][ T5747] Bluetooth: hci3: unexpected event for opcode 0x0404 [ 283.720243][ T8102] lo: Caught tx_queue_len zero misconfig [ 283.755512][ T8104] [ 283.756353][ T8104] ====================================================== [ 283.758608][ T8104] WARNING: possible circular locking dependency detected [ 283.760816][ T8104] syzkaller #0 Tainted: G L [ 283.762762][ T8104] ------------------------------------------------------ [ 283.764898][ T8104] syz.2.564/8104 is trying to acquire lock: [ 283.766667][ T8104] ffffffff903fe7e8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_streaming_header_allow_link+0x7c/0x650 [ 283.770423][ T8104] [ 283.770423][ T8104] but task is already holding lock: [ 283.773306][ T8104] ffff8880004eb580 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 283.777409][ T8104] [ 283.777409][ T8104] which lock already depends on the new lock. [ 283.777409][ T8104] [ 283.781389][ T8104] [ 283.781389][ T8104] the existing dependency chain (in reverse order) is: [ 283.784854][ T8104] [ 283.784854][ T8104] -> #3 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 283.787886][ T8104] lock_acquire+0x1d1/0x380 [ 283.790033][ T8104] down_write+0x8b/0x1f0 [ 283.791950][ T8104] configfs_depend_item_unlocked+0xf3/0x6a0 [ 283.794490][ T8104] usbg_make_tpg+0x251/0x610 [ 283.796525][ T8104] target_fabric_make_tpg+0xab/0x8c0 [ 283.798837][ T8104] configfs_mkdir+0x525/0xd40 [ 283.800468][ T8104] vfs_mkdir+0x364/0x850 [ 283.802339][ T8104] filename_mkdirat+0x48b/0x5e0 [ 283.804478][ T8104] __ia32_sys_mkdirat+0x88/0xc0 [ 283.806622][ T8104] __do_fast_syscall_32+0x13a/0x8b0 [ 283.808877][ T8104] do_fast_syscall_32+0x32/0x70 [ 283.810532][ T8104] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 283.812969][ T8104] [ 283.812969][ T8104] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 283.815886][ T8104] lock_acquire+0x1d1/0x380 [ 283.817463][ T8104] __mutex_lock+0x1a4/0x1bd0 [ 283.819554][ T8104] tcm_alloc_inst+0x5f/0x1e0 [ 283.821299][ T8104] try_get_usb_function_instance+0x136/0x1f0 [ 283.823449][ T8104] usb_get_function_instance+0x16/0x70 [ 283.825798][ T8104] function_make+0x18c/0x3f0 [ 283.827342][ T8104] configfs_mkdir+0x525/0xd40 [ 283.829176][ T8104] vfs_mkdir+0x364/0x850 [ 283.830942][ T8104] filename_mkdirat+0x48b/0x5e0 [ 283.832556][ T8104] __ia32_sys_mkdirat+0x88/0xc0 [ 283.834576][ T8104] __do_fast_syscall_32+0x13a/0x8b0 [ 283.836575][ T8104] do_fast_syscall_32+0x32/0x70 [ 283.838215][ T8104] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 283.840890][ T8104] [ 283.840890][ T8104] -> #1 (func_lock){+.+.}-{4:4}: [ 283.842986][ T8104] lock_acquire+0x1d1/0x380 [ 283.844898][ T8104] __mutex_lock+0x1a4/0x1bd0 [ 283.846831][ T8104] try_get_usb_function_instance+0x26/0x1f0 [ 283.848739][ T8104] usb_get_function_instance+0x16/0x70 [ 283.851139][ T8104] function_make+0x18c/0x3f0 [ 283.853008][ T8104] configfs_mkdir+0x525/0xd40 [ 283.854655][ T8104] vfs_mkdir+0x364/0x850 [ 283.856594][ T8104] filename_mkdirat+0x48b/0x5e0 [ 283.858655][ T8104] __ia32_sys_mkdir+0x6a/0x90 [ 283.860348][ T8104] __do_fast_syscall_32+0x13a/0x8b0 [ 283.862310][ T8104] do_fast_syscall_32+0x32/0x70 [ 283.864404][ T8104] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 283.866794][ T8104] [ 283.866794][ T8104] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 283.869681][ T8104] check_prev_add+0xeb/0xe60 [ 283.871687][ T8104] __lock_acquire+0x1528/0x1f40 [ 283.873810][ T8104] lock_acquire+0x1d1/0x380 [ 283.875802][ T8104] __mutex_lock+0x1a4/0x1bd0 [ 283.877807][ T8104] uvcg_streaming_header_allow_link+0x7c/0x650 [ 283.880424][ T8104] configfs_symlink+0x695/0x1340 [ 283.882583][ T8104] vfs_symlink+0x178/0x4d0 [ 283.884513][ T8104] filename_symlinkat+0x2a6/0x560 [ 283.886701][ T8104] __ia32_sys_symlinkat+0x9b/0xe0 [ 283.888472][ T8104] __do_fast_syscall_32+0x13a/0x8b0 [ 283.890742][ T8104] do_fast_syscall_32+0x32/0x70 [ 283.892862][ T8104] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 283.895126][ T8104] [ 283.895126][ T8104] other info that might help us debug this: [ 283.895126][ T8104] [ 283.898880][ T8104] Chain exists of: [ 283.898880][ T8104] gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#24 [ 283.898880][ T8104] [ 283.904258][ T8104] Possible unsafe locking scenario: [ 283.904258][ T8104] [ 283.906781][ T8104] CPU0 CPU1 [ 283.908855][ T8104] ---- ---- [ 283.910959][ T8104] lock(&sb->s_type->i_mutex_key#24); [ 283.912841][ T8104] lock(tpg_instances_lock); [ 283.915918][ T8104] lock(&sb->s_type->i_mutex_key#24); [ 283.919025][ T8104] lock(gadget_subsys.su_mutex); [ 283.921024][ T8104] [ 283.921024][ T8104] *** DEADLOCK *** [ 283.921024][ T8104] [ 283.923746][ T8104] locks held by syz.2.564/8104: 2, last CPU#3: [ 283.926210][ T8104] #0: ffff88802284a460 (sb_writers#12){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 283.929923][ T8104] #1: ffff8880004eb580 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 283.934144][ T8104] [ 283.934144][ T8104] stack backtrace: [ 283.936013][ T8104] CPU: 3 UID: 0 PID: 8104 Comm: syz.2.564 Tainted: G L syzkaller #0 PREEMPT(full) [ 283.940174][ T8104] Tainted: [L]=SOFTLOCKUP [ 283.941880][ T8104] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 283.945764][ T8104] Call Trace: [ 283.947102][ T8104] [ 283.948290][ T8104] dump_stack_lvl+0x100/0x190 [ 283.950159][ T8104] print_circular_bug.cold+0x178/0x1be [ 283.952079][ T8104] check_noncircular+0x146/0x160 [ 283.953794][ T8104] check_prev_add+0xeb/0xe60 [ 283.955757][ T8104] ? stack_trace_save+0x8e/0xc0 [ 283.957684][ T8104] __lock_acquire+0x1528/0x1f40 [ 283.959590][ T8104] ? kasan_save_track+0x14/0x30 [ 283.961428][ T8104] ? kasan_save_free_info+0x3b/0x70 [ 283.963511][ T8104] lock_acquire+0x1d1/0x380 [ 283.965304][ T8104] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 283.967809][ T8104] ? __pfx___might_resched+0x10/0x10 [ 283.969895][ T8104] __mutex_lock+0x1a4/0x1bd0 [ 283.971731][ T8104] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 283.974182][ T8104] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 283.976715][ T8104] ? __lock_acquire+0x5c0/0x1f40 [ 283.978678][ T8104] ? __pfx___mutex_lock+0x10/0x10 [ 283.980432][ T8104] ? make_vfsuid+0xec/0x140 [ 283.982080][ T8104] ? __pfx___might_resched+0x10/0x10 [ 283.984131][ T8104] ? make_vfsgid+0xf1/0x140 [ 283.985958][ T8104] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 283.988444][ T8104] ? security_inode_permission+0xbf/0x250 [ 283.990692][ T8104] uvcg_streaming_header_allow_link+0x7c/0x650 [ 283.993071][ T8104] ? inode_permission+0x374/0x620 [ 283.994734][ T8104] ? mntput_no_expire+0xe7/0x220 [ 283.996763][ T8104] configfs_symlink+0x695/0x1340 [ 283.998737][ T8104] ? bpf_lsm_inode_permission+0x9/0x10 [ 284.000920][ T8104] ? security_inode_permission+0xbf/0x250 [ 284.003142][ T8104] ? __pfx_configfs_symlink+0x10/0x10 [ 284.005243][ T8104] vfs_symlink+0x178/0x4d0 [ 284.007027][ T8104] filename_symlinkat+0x2a6/0x560 [ 284.009019][ T8104] ? __pfx_filename_symlinkat+0x10/0x10 [ 284.011208][ T8104] ? strncpy_from_user+0x19d/0x2d0 [ 284.013247][ T8104] ? do_getname+0x191/0x390 [ 284.015031][ T8104] __ia32_sys_symlinkat+0x9b/0xe0 [ 284.017016][ T8104] __do_fast_syscall_32+0x13a/0x8b0 [ 284.018621][ T8104] do_fast_syscall_32+0x32/0x70 [ 284.020560][ T8104] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 284.023013][ T8104] RIP: 0023:0xf709efec [ 284.024649][ T8104] Code: Unable to access opcode bytes at 0xf709efc2. [ 284.027222][ T8104] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000130 [ 284.030373][ T8104] RAX: ffffffffffffffda RBX: 0000000080001500 RCX: 00000000ffffff9c [ 284.033023][ T8104] RDX: 0000000080001600 RSI: 0000000000000000 RDI: 0000000000000000 [ 284.036227][ T8104] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 284.039465][ T8104] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 284.042535][ T8104] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 284.045512][ T8104] [ 284.048770][ T5814] usb 6-1: USB disconnect, device number 9