last executing test programs: 5.286318044s ago: executing program 2 (id=28): symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) chdir(&(0x7f0000000140)='./file0\x00') 4.865781747s ago: executing program 2 (id=30): r0 = socket$inet_sctp(0x2, 0x5, 0x84) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0xfffffffffffffd1d, &(0x7f0000000440)={&(0x7f0000000480)={0x58, 0x2, 0x6, 0x401, 0xe4340000, 0x0, {0x0, 0x0, 0x5}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x78}]}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x44000}, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x48, 0x9, 0x6, 0x801, 0x0, 0x0, {0x5, 0x0, 0xfffe}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010101}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x4, 0x6, 0x401, 0x0, 0x0, {0x3, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0x4000000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) sendmsg$inet_sctp(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001240)=ANY=[@ANYBLOB="2000000000000000840000000200000006000400280100000b008002", @ANYRES32=r4], 0x20, 0x6040}, 0x6) 4.56495248s ago: executing program 3 (id=34): bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x3, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000003008400000000000000ff10850000000700000095"], 0x0, 0x2, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000280)=ANY=[], 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x1, 0x1}}, 0x40) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x200002f, 0x10012, r0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mremap(&(0x7f0000000000/0x9000)=nil, 0x600a00, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) 4.540311049s ago: executing program 2 (id=35): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000100)={0x2, 0x0, @ioapic={0xeeee0000, 0x1, 0x8, 0xbfb, 0x0, [{0x8, 0x5, 0xf, '\x00', 0xd}, {0x52, 0x6, 0x8, '\x00', 0x7}, {0x9, 0x1, 0x7, '\x00', 0x8}, {0x22, 0x9, 0x8, '\x00', 0x4}, {0x8, 0xc, 0xda, '\x00', 0x3}, {0x9, 0x3, 0x83, '\x00', 0x2}, {0x0, 0x2, 0xa, '\x00', 0xa0}, {0x6, 0xa, 0x81, '\x00', 0xe}, {0x8, 0x8, 0x0, '\x00', 0x2}, {0x1, 0x40, 0x6, '\x00', 0x7f}, {0x7, 0x4, 0x2, '\x00', 0x8}, {0x7f, 0xbf, 0xfd, '\x00', 0x8}, {0x3, 0x5, 0x9, '\x00', 0x81}, {0x9, 0xf9, 0x3, '\x00', 0xa}, {0x8, 0x8, 0xf, '\x00', 0x8}, {0xc, 0x5, 0x80, '\x00', 0x5}, {0xff, 0x85, 0x9, '\x00', 0x1}, {0x1, 0x4, 0x6, '\x00', 0x5}, {0x3, 0xea, 0x3, '\x00', 0x6}, {0x7, 0xb, 0x8, '\x00', 0x80}, {0x1, 0x1, 0x4, '\x00', 0xa}, {0x0, 0xa8, 0x8, '\x00', 0x7f}, {0xa, 0xf4, 0x7f, '\x00', 0xf0}, {0x10, 0x4, 0x20, '\x00', 0x1a}]}}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000780)={@in={{0x2, 0x4e22, @multicast2}}, 0x0, 0x0, 0x21, 0x0, "a386bcb957f6ee650a88e8065cb3b0852da5b6b12cf609fdffffff0f392be7124f3883ab73ec229f5fab90b052c3572db8ed729eed0700001400000000de12709700"}, 0xd8) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000740)={"0bd13af7e222d7b82977a894bcf2d741b99f8f02da617b9ad94014424a83db0314f34fdfe9a260e953f1aaf3610eec4c839a08a42b569d1e59b5520d8ad988ecacf773bc8c1855c13291a20986512ff73d4967f734679cb88ac4c1013a6d38828f96b71019283ce07d08bbb370738322ffae7a0afc79279598c1166ec564d5be5344fc87a5f00ca1354bced1fccde226dcd6e864d8262199e37fda0824cafccbe5f8cd0518aa106eb5f8a0986aca2d05a5eaa0177c72d3caeb3579fd729cfe1e7c8e2bb7a9dcfc32e31c7dd4cb48b11128a933481391a63c788de6306217984ef3aa5c402cf680385d96c065818632f2eb3b976ae7997d793ee5a91e26017c70319748f5b8505ce26e2fc2a50296523adc134596ff6ce79f6b58e5ca0612085af940096fb90cb23a7eac4d0e1f0933ef17dd5b760ed2864d8cc3dca7174f7d10bc4ccde5463f72f0265c673a73a1d7d41a581d8491c8f37615278b543c2c3310ae461a924409d0b5a1a75085d800e69f7351d6f2e058d6323d3ae70c7a1b7961a017dcbd827381d2133be3eda141656239ee6859843e51305726cc2444f1360e65e2993842d09428843f2c50c989084ed7722d34e930873d420e9c9fffda5fedf8370000000000000000885e2e653d083ccc91792e12e3082139763d44f68d1115d8e545444accee3bb38a9fa3b9ff7172868cfaf0a8f22a6939248404db646f2aa405a21b953498132fe3167e4783623451da9253e12187b4086f56bdd827e75a5523e04683335992552fa2cce95d2b23833d57bf2872f9e428b374d049a35636113207f68e34d7f1392c05add0d78b9d999c7a5d47dcbb803bcab54544dbceb73f41d5ac0970883308fecd0edcbb3eea10c1b56c851d13ff248353994d4fc68815b1bf45d202c9944b5cecc4d09a99b422ef51442a8c16e1dbb6a955c4618d592d43cd7e52c206929662f178afe060401868ffaf0db2f1eb3aaeb591be9eae546ae97266315e87487dd399ea4ec20423904c3953376a3ab41853f00b720b270b6ae8fd3cbd6c66e4af6d15bbae6aa085e56a3f8ca4a40117a72209d18e4e31e06389650b8115ef5f1fcd8c2d56b37d66fff06008836e501304a332dd3a9e6eea4f8f8d9e3671edc0abe7788692ba653850e980c36a4d3f60d090a58e34fa033b8e92ce7c19a1730872bd9b58530729400823e68ebb0ab9294bebfcd5404194a9dce119d204e01736b57ef37f7bc11ebf9bbf4d33a35ccebc67a3e38bc092cc208e8d70f33d830d26e16b5adcfb3a8928ececc4273771716dce7a0cd4d6f37f8cf70242fe91f09d9d07745e60c35b93bc343eb27751afc6ffb4693ef290668824287595c20cda170ff582c630e2a5df595cb8b7868b8f28665c7fb592d8763b6a0c3e20154f6400"}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000100)={0x2, 0x0, @pic={0x0, 0x10, 0x3, 0x93, 0x0, 0x1, 0x1, 0xba, 0x2, 0xc0, 0x4d, 0x9, 0x61, 0x7, 0x90, 0xd}}) 4.251486181s ago: executing program 0 (id=37): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r1, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x1a000}], 0x1}, 0x0) sendmsg$rds(r1, &(0x7f0000000140)={&(0x7f0000000240)={0x2, 0xce21, @private=0xa010102}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x8c0}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) 3.997615794s ago: executing program 3 (id=38): r0 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi1\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000080)={0x4}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x181000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0xc048aeca, &(0x7f0000000080)) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000000)={'8255\x00', [0x0, 0x4, 0x2, 0x8, 0x90000, 0x9, 0xed, 0x890, 0x280ffa, 0xfffffffc, 0x4, 0x1, 0x1030, 0x1000008, 0x4c, 0x40000009, 0xfff7ffa6, 0x3ff, 0x912, 0x9ea, 0x3, 0x9, 0xc, 0x101, 0x1, 0x200, 0x5, 0x18, 0x2, 0x2000006, 0x5]}) 3.420765975s ago: executing program 2 (id=40): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) fchown(r0, 0x0, 0x0) 3.156127412s ago: executing program 0 (id=41): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x1000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xb}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000680)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x21}, @ptr={0x70742a85, 0x80002, &(0x7f0000000440)=""/210, 0xd2, 0x0, 0x31}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 2.998724819s ago: executing program 3 (id=42): sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = syz_open_dev$loop(&(0x7f0000000200), 0x5, 0x86100) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000005c0)={r1, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1c, 0x1c, "fee8a2ab78fc179fd1f8a0e9a1af1ea09dc2b7fb0a010000000000000000030000000000000000000000000000000000000000000000001b00", "28095397bab22d0000b42076c1ce8ef05f819e01177d3d458dac0000000000000000000800000000003788cf8f00", "90be8b1c5512406c7f00", [0x4, 0xa]}}) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, 0xffffffffffffffff, 0x1000) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x4, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 2.627841828s ago: executing program 0 (id=43): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}}, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) 2.048862584s ago: executing program 0 (id=44): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='illinois', 0x8) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 2.046064557s ago: executing program 1 (id=45): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @empty}, 0x20) syz_emit_ethernet(0x46, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60f91e2e00107300fc040000000000000000000000000000ff02000000000000000000000000000100000000ff"], 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0x7, 0x4, 0x3e0, 0x110, 0x11e, 0x110, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @mac=@remote, @loopback, @local, 0x1, 0x1}}}, {{@arp={@multicast2, @private=0xa010100, 0xff, 0xffffff00, 0xc, 0x4, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, {[0xff, 0xff, 0xff, 0xff, 0x0, 0xbe9240b8a223bba0]}}, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}, {[0xff, 0x0, 0xff, 0xff, 0xff]}}, 0x2, 0x6, 0x23b0, 0x9dd7, 0x80, 0x9, 'veth1_vlan\x00', 'ip_vti0\x00', {0xff}, {0xff}, 0x0, 0x12}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "716ebd2e1aa0cc683e62f312359594df00da56317f76121697127951fdba"}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) r1 = syz_io_uring_setup(0x5c65, &(0x7f0000000580)={0x0, 0x3, 0x10000, 0x8000001, 0x1db}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000640)=0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x9) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000040)=@IORING_OP_READV=@pass_iovec={0x1, 0xb, 0x2000, @fd, 0xf8, 0x0, 0x0, 0x11, 0x1, {0x4, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) 1.839226752s ago: executing program 1 (id=46): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={r1, 0xfffffff9}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x5001}) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000200)=0xc) r2 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'syzkaller1\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000500)={@dev={0xfe, 0x80, '\x00', 0x2}, 0x40, r3}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000600)={'syzkaller1\x00', 0x41}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="0105300007002800060000006000000000308440fe800000000000000000300000000001fe800000000000000000000000000002"], 0x64) 1.663456551s ago: executing program 2 (id=47): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) memfd_create(0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f00000003c0)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000180)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xff7e, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x2}) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) 1.081831761s ago: executing program 3 (id=48): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x4e20, @dev}, 0x2}}, 0x2e) 1.024357621s ago: executing program 0 (id=49): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='1', 0x1) symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='dummy_udc.0', 0xb) 1.009368224s ago: executing program 1 (id=50): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000140)={0xffffffff, "152a8b7d8c220803fd19cc7a25ff2e000000f500000000000000000800"}) sched_setscheduler(0x0, 0x2, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x4, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000080), 0x8100, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1}) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 695.672713ms ago: executing program 3 (id=51): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbff, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x7, 0x4) sendmsg$NL80211_CMD_SET_WDS_PEER(r0, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x81101000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, 0x0, 0x0, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x81, 0x79}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4000010) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0xcc, 0x30, 0xffff, 0x70bd25, 0x0, {}, [{0xb8, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x10000, 0x0, 0x0, 0xffffffff, 0x5, {0x0, 0x2, 0x0, 0x0, 0x27}, {0x0, 0x0, 0x0, 0x6, 0xfffd}}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_gact={0x48, 0x2, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x0, 0x1}}]}, {0x4}, {0xc, 0x3}, {0xc}}}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x24000804}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x31, 0x101, 0x70bd25, 0x4000000, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) 676.193511ms ago: executing program 1 (id=52): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000580)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r5}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0) 668.41528ms ago: executing program 2 (id=53): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffdfe) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, 0x0, &(0x7f0000000480)=""/61, 0x80a0000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000980)={0x84, 0x0, &(0x7f0000000480)={0x0, 0xa, 0x1, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 240.670412ms ago: executing program 3 (id=54): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x101}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000000)="77690addcfbe1fbb66ec", 0xfd9c}], 0x1, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) splice(r0, 0x0, r3, 0x0, 0x80000025a5, 0x0) 231.557837ms ago: executing program 0 (id=55): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'erspan0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x8, 0x80, 0x101, 0x2, {{0xb, 0x4, 0x0, 0x38, 0x2c, 0x65, 0x0, 0x2, 0x2f, 0x0, @loopback, @remote, {[@lsrr={0x83, 0x17, 0x8, [@multicast2, @local, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}, @local]}]}}}}}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) write$tun(r0, &(0x7f0000000280)=ANY=[], 0xfd6c) 211.722575ms ago: executing program 1 (id=56): r0 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) close(r0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) ioctl$TIOCGPGRP(r1, 0x540f, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') 0s ago: executing program 1 (id=57): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x4, 0x5}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x40, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x2, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0xfff9, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:18712' (ED25519) to the list of known hosts. syzkaller login: [ 94.400365][ T5700] cgroup: Unknown subsys name 'net' [ 94.581844][ T5700] cgroup: Unknown subsys name 'cpuset' [ 94.612015][ T5700] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 97.346908][ T5700] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 98.522102][ T58] cfg80211: failed to load regulatory.db [ 110.665177][ T5766] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 110.666764][ T5766] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 110.672433][ T5767] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 110.673160][ T5769] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 110.699890][ T5769] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 110.701546][ T5769] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 110.701983][ T5769] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 110.702721][ T5769] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 110.704075][ T5769] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 110.704323][ T5769] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 110.704804][ T5769] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 110.710359][ T5769] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 110.710747][ T5769] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 110.711413][ T5769] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 110.712707][ T5769] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 110.712884][ T5769] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 110.714443][ T5769] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 110.717042][ T5100] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 110.739916][ T67] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 110.740533][ T67] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 112.784247][ T5759] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.785799][ T5759] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.786899][ T5759] bridge_slave_0: entered allmulticast mode [ 112.796617][ T5759] bridge_slave_0: entered promiscuous mode [ 112.817940][ T67] Bluetooth: hci0: command tx timeout [ 112.962217][ T5759] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.962374][ T5759] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.962545][ T5759] bridge_slave_1: entered allmulticast mode [ 112.964051][ T5759] bridge_slave_1: entered promiscuous mode [ 112.967403][ T67] Bluetooth: hci1: command tx timeout [ 112.986669][ T67] Bluetooth: hci3: command tx timeout [ 112.986687][ T5100] Bluetooth: hci2: command tx timeout [ 113.016828][ T5757] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.016957][ T5757] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.017076][ T5757] bridge_slave_0: entered allmulticast mode [ 113.018305][ T5757] bridge_slave_0: entered promiscuous mode [ 113.022628][ T5757] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.022696][ T5757] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.022798][ T5757] bridge_slave_1: entered allmulticast mode [ 113.024078][ T5757] bridge_slave_1: entered promiscuous mode [ 113.214924][ T5759] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 113.237145][ T5759] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 113.293424][ T5757] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 113.293834][ T5763] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.293925][ T5763] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.294059][ T5763] bridge_slave_0: entered allmulticast mode [ 113.295731][ T5763] bridge_slave_0: entered promiscuous mode [ 113.297993][ T5763] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.298101][ T5763] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.298205][ T5763] bridge_slave_1: entered allmulticast mode [ 113.299412][ T5763] bridge_slave_1: entered promiscuous mode [ 113.337365][ T5757] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 113.451055][ T5763] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 113.461487][ T5763] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 113.512400][ T5759] team0: Port device team_slave_0 added [ 113.518391][ T5759] team0: Port device team_slave_1 added [ 113.521326][ T5757] team0: Port device team_slave_0 added [ 113.533229][ T5757] team0: Port device team_slave_1 added [ 113.646538][ T5763] team0: Port device team_slave_0 added [ 113.652005][ T5763] team0: Port device team_slave_1 added [ 113.751315][ T5758] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.751465][ T5758] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.751625][ T5758] bridge_slave_0: entered allmulticast mode [ 113.799235][ T5758] bridge_slave_0: entered promiscuous mode [ 113.820005][ T5759] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 113.820121][ T5759] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 113.820272][ T5759] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 113.836140][ T5763] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 113.836160][ T5763] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 113.836187][ T5763] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 113.838423][ T5763] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 113.838440][ T5763] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 113.838465][ T5763] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 113.888065][ T5757] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 113.888084][ T5757] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 113.888105][ T5757] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 113.893630][ T5758] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.893869][ T5758] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.894033][ T5758] bridge_slave_1: entered allmulticast mode [ 113.895698][ T5758] bridge_slave_1: entered promiscuous mode [ 114.007194][ T5757] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 114.007210][ T5757] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.007312][ T5757] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 114.023125][ T5763] hsr_slave_0: entered promiscuous mode [ 114.024154][ T5763] hsr_slave_1: entered promiscuous mode [ 114.025572][ T5759] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 114.025586][ T5759] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.025606][ T5759] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 114.089608][ T5758] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 114.108358][ T5758] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 114.163802][ T5759] hsr_slave_0: entered promiscuous mode [ 114.164600][ T5759] hsr_slave_1: entered promiscuous mode [ 114.165194][ T5759] debugfs: 'hsr0' already exists in 'hsr' [ 114.165270][ T5759] Cannot create hsr debugfs directory [ 114.266256][ T5758] team0: Port device team_slave_0 added [ 114.268890][ T5758] team0: Port device team_slave_1 added [ 114.338208][ T5757] hsr_slave_0: entered promiscuous mode [ 114.341707][ T5757] hsr_slave_1: entered promiscuous mode [ 114.345976][ T5757] debugfs: 'hsr0' already exists in 'hsr' [ 114.352505][ T5757] Cannot create hsr debugfs directory [ 114.359344][ T5758] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 114.359421][ T5758] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.360318][ T5758] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 114.412755][ T5758] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 114.412774][ T5758] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.412797][ T5758] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 114.766586][ T5758] hsr_slave_0: entered promiscuous mode [ 114.771270][ T5758] hsr_slave_1: entered promiscuous mode [ 114.772020][ T5758] debugfs: 'hsr0' already exists in 'hsr' [ 114.772088][ T5758] Cannot create hsr debugfs directory [ 114.938486][ T5100] Bluetooth: hci0: command tx timeout [ 115.037461][ T5100] Bluetooth: hci2: command tx timeout [ 115.039310][ T5100] Bluetooth: hci3: command tx timeout [ 115.039488][ T5100] Bluetooth: hci1: command tx timeout [ 115.262482][ T5763] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 115.293336][ T5763] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 115.335828][ T5763] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 115.346260][ T5763] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 115.445270][ T5763] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 115.452853][ T5763] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 115.549854][ T5763] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 115.561819][ T5763] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 115.683519][ T5759] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 115.692800][ T5759] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 115.708224][ T5759] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 115.720208][ T5759] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 115.721384][ T5759] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 115.745919][ T5759] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 115.816760][ T5759] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 115.842379][ T5759] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 115.999289][ T5757] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 116.014843][ T5757] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 116.121639][ T5757] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 116.133466][ T5757] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 116.138854][ T5757] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 116.152477][ T5757] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 116.164779][ T5757] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 116.197098][ T5757] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 116.425429][ T5758] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 116.449613][ T5758] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 116.474300][ T5758] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 116.493633][ T5758] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 116.518510][ T5758] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 116.526174][ T5758] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 116.529793][ T5758] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 116.537389][ T5758] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 116.619640][ T5763] 8021q: adding VLAN 0 to HW filter on device bond0 [ 116.865079][ T5763] 8021q: adding VLAN 0 to HW filter on device team0 [ 116.950973][ T633] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.951177][ T633] bridge0: port 1(bridge_slave_0) entered forwarding state [ 116.974846][ T5100] Bluetooth: hci0: command tx timeout [ 117.016596][ T5759] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.129116][ T5100] Bluetooth: hci2: command tx timeout [ 117.130367][ T5100] Bluetooth: hci1: command tx timeout [ 117.132846][ T5100] Bluetooth: hci3: command tx timeout [ 117.136368][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.136458][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.203971][ T5757] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.333546][ T5759] 8021q: adding VLAN 0 to HW filter on device team0 [ 117.443859][ T5758] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.469263][ T5757] 8021q: adding VLAN 0 to HW filter on device team0 [ 117.489366][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.489556][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.503274][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.503354][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.579462][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.579728][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.602464][ T5758] 8021q: adding VLAN 0 to HW filter on device team0 [ 117.646455][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.646686][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.675443][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.675558][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.746475][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.746800][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.981334][ T5759] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 119.023748][ T5763] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 119.051525][ T5100] Bluetooth: hci0: command tx timeout [ 119.158152][ T5759] veth0_vlan: entered promiscuous mode [ 119.189744][ T5758] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 119.203183][ T5757] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 119.209209][ T5100] Bluetooth: hci2: command tx timeout [ 119.219899][ T5100] Bluetooth: hci3: command tx timeout [ 119.219938][ T5100] Bluetooth: hci1: command tx timeout [ 119.282772][ T5763] veth0_vlan: entered promiscuous mode [ 119.299976][ T5759] veth1_vlan: entered promiscuous mode [ 119.336490][ T5763] veth1_vlan: entered promiscuous mode [ 119.515724][ T5758] veth0_vlan: entered promiscuous mode [ 119.558004][ T5757] veth0_vlan: entered promiscuous mode [ 119.578985][ T5758] veth1_vlan: entered promiscuous mode [ 119.620514][ T5763] veth0_macvtap: entered promiscuous mode [ 119.625843][ T5763] veth1_macvtap: entered promiscuous mode [ 119.628843][ T5759] veth0_macvtap: entered promiscuous mode [ 119.639945][ T5759] veth1_macvtap: entered promiscuous mode [ 119.661493][ T5757] veth1_vlan: entered promiscuous mode [ 119.709301][ T5763] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 119.735190][ T5763] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 119.784426][ T5759] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 119.893078][ T5757] veth0_macvtap: entered promiscuous mode [ 119.916187][ T5757] veth1_macvtap: entered promiscuous mode [ 119.931803][ T5759] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 120.001884][ T5758] veth0_macvtap: entered promiscuous mode [ 120.006296][ T5758] veth1_macvtap: entered promiscuous mode [ 120.080044][ T5757] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 120.087909][ T5828] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.088362][ T5828] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.088397][ T5828] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.088425][ T5828] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.088453][ T5828] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.088481][ T5828] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.088508][ T5828] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.088536][ T5828] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.177947][ T5757] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 120.311936][ T5758] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 120.548593][ T1163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.548700][ T1163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.668572][ T5758] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 120.908001][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.908508][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.908718][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.908855][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.909349][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.909550][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.909689][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.910101][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.093613][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.093683][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.099259][ T1163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.099288][ T1163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.264868][ T172] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.271128][ T172] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.451047][ T422] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.451184][ T422] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.517569][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.517634][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.579263][ T5763] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 121.678301][ T5763] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 121.748563][ T5763] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 121.784545][ T1163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.810109][ T1163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.826743][ T5763] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 121.834325][ T1163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.834350][ T1163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.066296][ T5763] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 123.275958][ T5912] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3'. [ 123.294770][ T5912] bridge_slave_1: left allmulticast mode [ 123.294883][ T5912] bridge_slave_1: left promiscuous mode [ 123.296153][ T5912] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.407857][ T5912] bridge_slave_0: left allmulticast mode [ 123.408180][ T5912] bridge_slave_0: left promiscuous mode [ 123.408494][ T5912] bridge0: port 1(bridge_slave_0) entered disabled state [ 124.382736][ T5918] EXT4-fs warning (device sda1): ext4_group_extend:1869: need to use ext2online to resize further [ 124.771231][ T5923] capability: warning: `syz.3.8' uses deprecated v2 capabilities in a way that may be insecure [ 125.285668][ T5934] Set syz1 is full, maxelem 1021 reached [ 127.943057][ T5969] netlink: 12 bytes leftover after parsing attributes in process `syz.3.22'. [ 127.951401][ T5969] netlink: 44 bytes leftover after parsing attributes in process `syz.3.22'. [ 128.007143][ T5970] netlink: 4 bytes leftover after parsing attributes in process `syz.3.22'. [ 128.318692][ T5974] netlink: 'syz.0.24': attribute type 1 has an invalid length. [ 128.915677][ T5978] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 128.915765][ T5978] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 128.925156][ T5978] vhci_hcd vhci_hcd.0: Device attached [ 129.176545][ T5982] vhci_hcd: connection closed [ 129.189924][ T14] vhci_hcd vhci_hcd.0: stop threads [ 129.190288][ T14] vhci_hcd vhci_hcd.0: release socket [ 129.190934][ T14] vhci_hcd vhci_hcd.0: disconnect device [ 129.263755][ T9] usb 38-1: enqueue for inactive port 0 [ 129.757649][ T5992] ======================================================= [ 129.757649][ T5992] WARNING: The mand mount option has been deprecated and [ 129.757649][ T5992] and is ignored by this kernel. Remove the mand [ 129.757649][ T5992] option from the mount to silence this warning. [ 129.757649][ T5992] ======================================================= [ 129.779973][ T9] usb usb38-port1: attempt power cycle [ 129.983108][ T5995] warning: `syz.3.29' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 130.381691][ T6007] process 'syz.1.33' launched './file0' with NULL argv: empty string added [ 130.439870][ T9] usb usb38-port1: unable to enumerate USB device [ 131.201350][ T6026] comedi: valid board names for 8255 driver are: [ 131.201438][ T6026] 8255 [ 131.208289][ T6026] comedi: valid board names for vmk80xx driver are: [ 131.208656][ T6026] vmk80xx [ 131.208703][ T6026] comedi: valid board names for usbduxsigma driver are: [ 131.208733][ T6026] usbduxsigma [ 131.208758][ T6026] comedi: valid board names for usbduxfast driver are: [ 131.208786][ T6026] usbduxfast [ 131.208812][ T6026] comedi: valid board names for usbdux driver are: [ 131.208840][ T6026] usbdux [ 131.208865][ T6026] comedi: valid board names for ni6501 driver are: [ 131.208893][ T6026] ni6501 [ 131.208918][ T6026] comedi: valid board names for dt9812 driver are: [ 131.208944][ T6026] dt9812 [ 131.208969][ T6026] comedi: valid board names for ni_labpc_cs driver are: [ 131.208997][ T6026] ni_labpc_cs [ 131.209021][ T6026] comedi: valid board names for ni_daq_700 driver are: [ 131.209048][ T6026] ni_daq_700 [ 131.209073][ T6026] comedi: valid board names for labpc_pci driver are: [ 131.209100][ T6026] labpc_pci [ 131.209126][ T6026] comedi: valid board names for adl_pci9118 driver are: [ 131.209154][ T6026] pci9118dg [ 131.209179][ T6026] pci9118hg [ 131.209203][ T6026] pci9118hr [ 131.209228][ T6026] comedi: valid board names for 8255_pci driver are: [ 131.209255][ T6026] 8255_pci [ 131.209281][ T6026] comedi: valid board names for s526 driver are: [ 131.209309][ T6026] s526 [ 131.209333][ T6026] comedi: valid board names for multiq3 driver are: [ 131.209360][ T6026] multiq3 [ 131.209385][ T6026] comedi: valid board names for pcmuio driver are: [ 131.209411][ T6026] pcmuio48 [ 131.209436][ T6026] pcmuio96 [ 131.209461][ T6026] comedi: valid board names for pcmmio driver are: [ 131.209489][ T6026] pcmmio [ 131.209514][ T6026] comedi: valid board names for pcmda12 driver are: [ 131.209542][ T6026] pcmda12 [ 131.209567][ T6026] comedi: valid board names for pcmad driver are: [ 131.209591][ T6026] pcmad12 [ 131.209614][ T6026] pcmad16 [ 131.209638][ T6026] comedi: valid board names for ni_labpc driver are: [ 131.209664][ T6026] lab-pc-1200 [ 131.209691][ T6026] lab-pc-1200ai [ 131.209724][ T6026] lab-pc+ [ 131.209750][ T6026] comedi: valid board names for atmio16 driver are: [ 131.209777][ T6026] atmio16 [ 131.209802][ T6026] atmio16d [ 131.209827][ T6026] comedi: valid board names for ni_at_ao driver are: [ 131.209856][ T6026] at-ao-6 [ 131.209882][ T6026] at-ao-10 [ 131.209907][ T6026] comedi: valid board names for ni_at_a2150 driver are: [ 131.209935][ T6026] ni_at_a2150 [ 131.209961][ T6026] comedi: valid board names for adq12b driver are: [ 131.209988][ T6026] adq12b [ 131.210013][ T6026] comedi: valid board names for mpc624 driver are: [ 131.210040][ T6026] mpc624 [ 131.210066][ T6026] comedi: valid board names for c6xdigio driver are: [ 131.210094][ T6026] c6xdigio [ 131.210120][ T6026] comedi: valid board names for aio_iiro_16 driver are: [ 131.210148][ T6026] aio_iiro_16 [ 131.210174][ T6026] comedi: valid board names for aio_aio12_8 driver are: [ 131.210202][ T6026] aio_aio12_8 [ 131.210227][ T6026] aio_ai12_8 [ 131.210253][ T6026] aio_ao12_4 [ 131.210279][ T6026] comedi: valid board names for fl512 driver are: [ 131.210308][ T6026] fl512 [ 131.210334][ T6026] comedi: valid board names for dmm32at driver are: [ 131.210362][ T6026] dmm32at [ 131.210387][ T6026] comedi: valid board names for dt282x driver are: [ 131.210415][ T6026] dt2821 [ 131.210440][ T6026] dt2821-f [ 131.210466][ T6026] dt2821-g [ 131.210492][ T6026] dt2823 [ 131.210549][ T6026] dt2824-pgh [ 131.210578][ T6026] dt2824-pgl [ 131.216683][ T6026] dt2825 [ 131.216744][ T6026] dt2827 [ 131.216776][ T6026] dt2828 [ 131.216807][ T6026] dt2829 [ 131.216838][ T6026] dt21-ez [ 131.216874][ T6026] dt23-ez [ 131.216906][ T6026] dt24-ez [ 131.216939][ T6026] dt24-ez-pgl [ 131.216972][ T6026] comedi: valid board names for dt2817 driver are: [ 131.217008][ T6026] dt2817 [ 131.217043][ T6026] comedi: valid board names for dt2815 driver are: [ 131.217078][ T6026] dt2815 [ 131.217108][ T6026] comedi: valid board names for dt2814 driver are: [ 131.217139][ T6026] dt2814 [ 131.217170][ T6026] comedi: valid board names for dt2811 driver are: [ 131.224040][ T6026] dt2811-pgh [ 131.224104][ T6026] dt2811-pgl [ 131.224113][ T6026] comedi: valid board names for dt2801 driver are: [ 131.224122][ T6026] dt2801 [ 131.224128][ T6026] comedi: valid board names for das6402 driver are: [ 131.224136][ T6026] das6402-12 [ 131.224143][ T6026] das6402-16 [ 131.224150][ T6026] comedi: valid board names for das1800 driver are: [ 131.224157][ T6026] das-1701st [ 131.224164][ T6026] das-1701st-da [ 131.224170][ T6026] das-1702st [ 131.224176][ T6026] das-1702st-da [ 131.224182][ T6026] das-1702hr [ 131.224188][ T6026] das-1702hr-da [ 131.224193][ T6026] das-1701ao [ 131.224198][ T6026] das-1702ao [ 131.224203][ T6026] das-1801st [ 131.224209][ T6026] das-1801st-da [ 131.224214][ T6026] das-1802st [ 131.224219][ T6026] das-1802st-da [ 131.224225][ T6026] das-1802hr [ 131.224230][ T6026] das-1802hr-da [ 131.224236][ T6026] das-1801hc [ 131.224241][ T6026] das-1802hc [ 131.224246][ T6026] das-1801ao [ 131.224252][ T6026] das-1802ao [ 131.224258][ T6026] comedi: valid board names for das800 driver are: [ 131.224265][ T6026] das-800 [ 131.224270][ T6026] cio-das800 [ 131.224275][ T6026] das-801 [ 131.224280][ T6026] cio-das801 [ 131.224286][ T6026] das-802 [ 131.224291][ T6026] cio-das802 [ 131.224296][ T6026] cio-das802/16 [ 131.224302][ T6026] comedi: valid board names for isa-das08 driver are: [ 131.224308][ T6026] isa-das08 [ 131.224313][ T6026] das08-pgm [ 131.224319][ T6026] das08-pgh [ 131.224324][ T6026] das08-pgl [ 131.224330][ T6026] das08-aoh [ 131.224335][ T6026] das08-aol [ 131.224341][ T6026] das08-aom [ 131.224346][ T6026] das08/jr-ao [ 131.224351][ T6026] das08jr-16-ao [ 131.224357][ T6026] pc104-das08 [ 131.224362][ T6026] das08jr/16 [ 131.224368][ T6026] comedi: valid board names for das16m1 driver are: [ 131.224374][ T6026] das16m1 [ 131.224379][ T6026] comedi: valid board names for dac02 driver are: [ 131.224386][ T6026] dac02 [ 131.224391][ T6026] comedi: valid board names for rti802 driver are: [ 131.224398][ T6026] rti802 [ 131.224403][ T6026] comedi: valid board names for rti800 driver are: [ 131.224409][ T6026] rti800 [ 131.224414][ T6026] rti815 [ 131.224419][ T6026] comedi: valid board names for pcm3724 driver are: [ 131.224425][ T6026] pcm3724 [ 131.224430][ T6026] comedi: valid board names for pcl818 driver are: [ 131.224437][ T6026] pcl818l [ 131.224442][ T6026] pcl818h [ 131.224448][ T6026] pcl818hd [ 131.224453][ T6026] pcl818hg [ 131.224457][ T6026] pcl818 [ 131.224461][ T6026] pcl718 [ 131.224465][ T6026] pcm3718 [ 131.224469][ T6026] comedi: valid board names for pcl816 driver are: [ 131.224475][ T6026] pcl816 [ 131.224480][ T6026] pcl814b [ 131.224484][ T6026] comedi: valid board names for pcl812 driver are: [ 131.224491][ T6026] pcl812 [ 131.224496][ T6026] pcl812pg [ 131.224500][ T6026] acl8112pg [ 131.224505][ T6026] acl8112dg [ 131.224509][ T6026] acl8112hg [ 131.224515][ T6026] a821pgl [ 131.224520][ T6026] a821pglnda [ 131.224525][ T6026] a821pgh [ 131.224530][ T6026] a822pgl [ 131.224534][ T6026] a822pgh [ 131.224539][ T6026] a823pgl [ 131.224544][ T6026] a823pgh [ 131.224549][ T6026] pcl813 [ 131.224554][ T6026] pcl813b [ 131.224559][ T6026] acl8113 [ 131.224567][ T6026] iso813 [ 131.224572][ T6026] acl8216 [ 131.224578][ T6026] a826pg [ 131.224583][ T6026] comedi: valid board names for pcl730 driver are: [ 131.224590][ T6026] pcl730 [ 131.224595][ T6026] iso730 [ 131.224600][ T6026] acl7130 [ 131.224605][ T6026] pcm3730 [ 131.224610][ T6026] pcl725 [ 131.224615][ T6026] p8r8dio [ 131.224621][ T6026] acl7225b [ 131.224626][ T6026] p16r16dio [ 131.224632][ T6026] pcl733 [ 131.224637][ T6026] pcl734 [ 131.224643][ T6026] opmm-1616-xt [ 131.224649][ T6026] pearl-mm-p [ 131.224655][ T6026] ir104-pbf [ 131.224661][ T6026] comedi: valid board names for pcl726 driver are: [ 131.224669][ T6026] pcl726 [ 131.224674][ T6026] pcl727 [ 131.224680][ T6026] pcl728 [ 131.224686][ T6026] acl6126 [ 131.224691][ T6026] acl6128 [ 131.224708][ T6026] comedi: valid board names for pcl724 driver are: [ 131.224716][ T6026] pcl724 [ 131.224721][ T6026] pcl722 [ 131.224726][ T6026] pcl731 [ 131.224732][ T6026] acl7122 [ 131.224737][ T6026] acl7124 [ 131.224742][ T6026] pet48dio [ 131.224748][ T6026] pcmio48 [ 131.224753][ T6026] onyx-mm-dio [ 131.224759][ T6026] comedi: valid board names for pcl711 driver are: [ 131.224765][ T6026] pcl711 [ 131.224770][ T6026] pcl711b [ 131.224775][ T6026] acl8112hg [ 131.224780][ T6026] acl8112dg [ 131.224786][ T6026] comedi: valid board names for amplc_pc263 driver are: [ 131.224793][ T6026] pc263 [ 131.224798][ T6026] comedi: valid board names for amplc_pc236 driver are: [ 131.224805][ T6026] pc36at [ 131.224811][ T6026] comedi: valid board names for amplc_dio200 driver are: [ 131.224818][ T6026] pc212e [ 131.224824][ T6026] pc214e [ 131.224829][ T6026] pc215e [ 131.224834][ T6026] pc218e [ 131.224839][ T6026] pc272e [ 131.224844][ T6026] comedi: valid board names for comedi_parport driver are: [ 131.224858][ T6026] comedi_parport [ 131.224865][ T6026] comedi: valid board names for comedi_test driver are: [ 131.224873][ T6026] comedi_test [ 131.224879][ T6026] comedi: valid board names for comedi_bond driver are: [ 131.224890][ T6026] comedi_bond [ 132.374200][ T6043] FAULT_INJECTION: forcing a failure. [ 132.374200][ T6043] name failslab, interval 1, probability 0, space 0, times 0 [ 132.374315][ T6043] CPU: 3 UID: 0 PID: 6043 Comm: syz.0.43 Not tainted syzkaller #0 PREEMPT(full) [ 132.374355][ T6043] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 132.374368][ T6043] Call Trace: [ 132.374375][ T6043] [ 132.374384][ T6043] dump_stack_lvl+0x100/0x190 [ 132.374417][ T6043] should_fail_ex.cold+0x5/0xa [ 132.374443][ T6043] should_failslab+0xc2/0x120 [ 132.374468][ T6043] __kmalloc_noprof+0xfc/0x840 [ 132.374489][ T6043] ? vhost_dev_set_owner+0x3b2/0xa30 [ 132.374558][ T6043] vhost_dev_set_owner+0x3b2/0xa30 [ 132.374595][ T6043] vhost_dev_ioctl+0x521/0xe70 [ 132.374618][ T6043] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 132.374644][ T6043] ? __pfx_vhost_dev_ioctl+0x10/0x10 [ 132.374677][ T6043] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 132.374718][ T6043] vhost_vsock_dev_ioctl+0x320/0xb60 [ 132.374745][ T6043] ? __pfx_vhost_vsock_dev_ioctl+0x10/0x10 [ 132.374766][ T6043] ? hook_file_ioctl_common+0x140/0x440 [ 132.374804][ T6043] ? __fget_files+0x21f/0x3d0 [ 132.374831][ T6043] ? __pfx_vhost_vsock_dev_ioctl+0x10/0x10 [ 132.374857][ T6043] compat_ptr_ioctl+0x6e/0xa0 [ 132.374891][ T6043] ? __pfx_compat_ptr_ioctl+0x10/0x10 [ 132.374923][ T6043] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 132.374962][ T6043] __do_fast_syscall_32+0x13a/0x8b0 [ 132.374998][ T6043] do_fast_syscall_32+0x32/0x70 [ 132.375030][ T6043] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 132.375058][ T6043] RIP: 0023:0xf704efec [ 132.375084][ T6043] Code: Unable to access opcode bytes at 0xf704efc2. [ 132.375094][ T6043] RSP: 002b:00000000f543d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 132.375116][ T6043] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000af01 [ 132.375130][ T6043] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 132.375142][ T6043] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 132.375153][ T6043] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 132.375165][ T6043] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 132.375193][ T6043] [ 134.020764][ T6066] FAULT_INJECTION: forcing a failure. [ 134.020764][ T6066] name failslab, interval 1, probability 0, space 0, times 0 [ 134.020876][ T6066] CPU: 3 UID: 0 PID: 6066 Comm: syz.3.48 Tainted: G L syzkaller #0 PREEMPT(full) [ 134.020918][ T6066] Tainted: [L]=SOFTLOCKUP [ 134.020925][ T6066] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.020936][ T6066] Call Trace: [ 134.020943][ T6066] [ 134.020951][ T6066] dump_stack_lvl+0x100/0x190 [ 134.020981][ T6066] should_fail_ex.cold+0x5/0xa [ 134.021005][ T6066] should_failslab+0xc2/0x120 [ 134.021027][ T6066] kmem_cache_alloc_noprof+0x92/0x6a0 [ 134.021061][ T6066] ? __hrtimer_rearm_deferred+0x23c/0x7b0 [ 134.021087][ T6066] ? radix_tree_node_alloc.constprop.0+0x81/0x360 [ 134.021118][ T6066] radix_tree_node_alloc.constprop.0+0x81/0x360 [ 134.021145][ T6066] idr_get_free+0x52e/0xa00 [ 134.021174][ T6066] idr_alloc_u32+0x1ac/0x320 [ 134.021199][ T6066] ? __pfx_idr_alloc_u32+0x10/0x10 [ 134.021220][ T6066] ? do_raw_spin_lock+0x128/0x260 [ 134.021255][ T6066] l2tp_tunnel_register+0xfc/0xc10 [ 134.021278][ T6066] ? __pfx___debug_object_init+0x10/0x10 [ 134.021301][ T6066] ? __pfx_l2tp_tunnel_register+0x10/0x10 [ 134.021325][ T6066] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 134.021351][ T6066] ? l2tp_tunnel_get+0x20c/0x490 [ 134.021372][ T6066] ? lockdep_init_map_type+0x5c/0x250 [ 134.021396][ T6066] ? l2tp_tunnel_create+0x2cf/0x460 [ 134.021411][ T6066] ? l2tp_tunnel_create+0x37d/0x460 [ 134.021429][ T6066] pppol2tp_tunnel_get.constprop.0+0x3f0/0x540 [ 134.021455][ T6066] ? __pfx_pppol2tp_tunnel_get.constprop.0+0x10/0x10 [ 134.021479][ T6066] ? __pfx_futex_wake_mark+0x10/0x10 [ 134.021507][ T6066] ? __lock_acquire+0x4c5/0x1ec0 [ 134.021533][ T6066] pppol2tp_connect+0xaf0/0x1c20 [ 134.021556][ T6066] ? __pfx_pppol2tp_connect+0x10/0x10 [ 134.021586][ T6066] ? apparmor_socket_connect+0x116/0x1f0 [ 134.021611][ T6066] __sys_connect_file+0x146/0x1a0 [ 134.021646][ T6066] __sys_connect+0x141/0x170 [ 134.021665][ T6066] ? __pfx___sys_connect+0x10/0x10 [ 134.021699][ T6066] __ia32_sys_connect+0x71/0xb0 [ 134.021717][ T6066] ? lockdep_hardirqs_on+0x7d/0x110 [ 134.021742][ T6066] __do_fast_syscall_32+0x13a/0x8b0 [ 134.021771][ T6066] do_fast_syscall_32+0x32/0x70 [ 134.021796][ T6066] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 134.021818][ T6066] RIP: 0023:0xf70cefec [ 134.021841][ T6066] Code: Unable to access opcode bytes at 0xf70cefc2. [ 134.021849][ T6066] RSP: 002b:00000000f54bd50c EFLAGS: 00000292 ORIG_RAX: 000000000000016a [ 134.021869][ T6066] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000000 [ 134.021882][ T6066] RDX: 000000000000002e RSI: 0000000000000000 RDI: 0000000000000000 [ 134.021893][ T6066] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 134.021903][ T6066] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 134.021913][ T6066] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 134.021937][ T6066] [ 134.376864][ T6069] netlink: 12 bytes leftover after parsing attributes in process `syz.1.52'. [ 134.635069][ T6073] netlink: 'syz.3.51': attribute type 3 has an invalid length. [ 134.641563][ T6073] netlink: 'syz.3.51': attribute type 3 has an invalid length. [ 134.786828][ T5873] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 134.827110][ T6081] FAULT_INJECTION: forcing a failure. [ 134.827110][ T6081] name failslab, interval 1, probability 0, space 0, times 0 [ 134.827394][ T6081] CPU: 2 UID: 0 PID: 6081 Comm: syz.1.56 Tainted: G L syzkaller #0 PREEMPT(full) [ 134.827454][ T6081] Tainted: [L]=SOFTLOCKUP [ 134.827467][ T6081] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.827483][ T6081] Call Trace: [ 134.827493][ T6081] [ 134.827504][ T6081] dump_stack_lvl+0x100/0x190 [ 134.827552][ T6081] should_fail_ex.cold+0x5/0xa [ 134.827593][ T6081] should_failslab+0xc2/0x120 [ 134.827631][ T6081] kmem_cache_alloc_noprof+0x92/0x6a0 [ 134.827662][ T6081] ? seq_open+0x55/0x170 [ 134.827714][ T6081] ? __pfx_proc_setgroups_show+0x10/0x10 [ 134.827866][ T6081] seq_open+0x55/0x170 [ 134.827914][ T6081] ? __pfx_proc_setgroups_show+0x10/0x10 [ 134.827952][ T6081] single_open+0xfc/0x1d0 [ 134.827992][ T6081] proc_setgroups_open+0x35a/0x7e0 [ 134.828022][ T6081] do_dentry_open+0x6ab/0x14d0 [ 134.828049][ T6081] ? __pfx_proc_setgroups_open+0x10/0x10 [ 134.828086][ T6081] vfs_open+0x82/0x3f0 [ 134.828126][ T6081] path_openat+0x19fa/0x2440 [ 134.828165][ T6081] ? __pfx_path_openat+0x10/0x10 [ 134.828207][ T6081] do_file_open+0x20e/0x430 [ 134.828242][ T6081] ? __pfx_do_file_open+0x10/0x10 [ 134.828289][ T6081] ? __pfx_kfree_link+0x10/0x10 [ 134.828325][ T6081] ? _raw_spin_unlock+0x28/0x50 [ 134.828359][ T6081] ? alloc_fd+0x471/0x7a0 [ 134.828400][ T6081] do_sys_openat2+0x10f/0x1e0 [ 134.828441][ T6081] ? __pfx_do_sys_openat2+0x10/0x10 [ 134.828521][ T6081] ? find_held_lock+0x2b/0x80 [ 134.828560][ T6081] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 134.828600][ T6081] __ia32_compat_sys_openat+0x12d/0x210 [ 134.828646][ T6081] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 134.828701][ T6081] do_int80_emulation+0x166/0x650 [ 134.828747][ T6081] asm_int80_emulation+0x1a/0x20 [ 134.828788][ T6081] RIP: 0023:0xf71475ab [ 134.828816][ T6081] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 134.828840][ T6081] RSP: 002b:00000000f53fd3cc EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 134.828864][ T6081] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f53fd490 [ 134.828902][ T6081] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 134.828922][ T6081] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 134.828935][ T6081] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 134.828951][ T6081] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 134.828979][ T6081] [ 134.834703][ T6083] syz.0.55 uses obsolete (PF_INET,SOCK_PACKET) [ 135.025074][ T5873] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03 [ 135.027475][ T5873] usb 5-1: Dual-Role OTG device on HNP port [ 135.027827][ T5873] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.066808][ T6085] netlink: 'syz.1.57': attribute type 13 has an invalid length. [ 135.125649][ T5873] gspca_main: spca501-2.14.0 probing 0000:0000 [ 135.133433][ T5873] gspca_spca501: reg write: error -32 [ 135.133469][ T5873] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 135.134630][ T5873] s ** replaying previous printk message ** [ 135.134630][ T5873] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 135.148352][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 135.167626][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 135.175620][ C0] CPU: 0 UID: 0 PID: 5873 Comm: kworker/0:6 Tainted: G L syzkaller #0 PREEMPT(full) [ 135.184907][ C0] Tainted: [L]=SOFTLOCKUP [ 135.188612][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 135.192877][ C0] Workqueue: usb_hub_wq hub_event [ 135.194972][ C0] RIP: 0010:f_midi2_free_ep_reqs+0x56/0x2b0 [ 135.198865][ C0] Code: 85 6a 02 00 00 49 8b 45 00 48 89 44 24 18 48 05 30 07 00 00 48 89 c2 48 89 44 24 20 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e b5 01 00 00 48 8b 44 24 18 31 [ 135.220818][ C0] RSP: 0018:ffffc900000079d8 EFLAGS: 00010002 [ 135.225592][ C0] RAX: dffffc0000000000 RBX: ffff88805ffb0000 RCX: 0000000000000103 [ 135.232824][ C0] RDX: 00000000000000e6 RSI: ffffffff87f391f6 RDI: ffff88805ffb0128 [ 135.240905][ C0] RBP: ffff88805ffb0128 R08: 0000000000000004 R09: 0000000000000020 [ 135.245410][ C0] R10: 0000000000000020 R11: 000000000000760b R12: ffff88805ffb00f0 [ 135.252505][ C0] R13: ffff88805ffb0128 R14: ffff88805ffb0740 R15: 0000000000000001 [ 135.260022][ C0] FS: 0000000000000000(0000) GS:ffff888096963000(0000) knlGS:0000000000000000 [ 135.269317][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 135.275928][ C0] CR2: 0000000034e17ff8 CR3: 0000000067a0b000 CR4: 0000000000352ef0 [ 135.281485][ C0] Call Trace: [ 135.283539][ C0] [ 135.285708][ C0] f_midi2_set_alt+0x444/0x5f0 [ 135.289807][ C0] composite_setup+0x16f8/0x9290 [ 135.293707][ C0] ? __lock_acquire+0x4c5/0x1ec0 [ 135.297662][ C0] ? __lock_acquire+0x4c5/0x1ec0 [ 135.302750][ C0] ? __pfx_composite_setup+0x10/0x10 [ 135.307423][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 135.312905][ C0] ? do_raw_spin_lock+0x128/0x260 [ 135.315532][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 135.318636][ C0] ? configfs_composite_setup+0xfb/0x130 [ 135.321236][ C0] configfs_composite_setup+0xfb/0x130 [ 135.323971][ C0] dummy_timer+0x2039/0x3700 [ 135.328180][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 135.334340][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 135.338433][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 135.342308][ C0] ? mark_held_locks+0x40/0x70 [ 135.345594][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 135.351116][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 135.357234][ C0] __hrtimer_run_queues+0x462/0x9c0 [ 135.361056][ C0] hrtimer_run_softirq+0x1ca/0x360 [ 135.364226][ C0] handle_softirqs+0x1e6/0x9d0 [ 135.368784][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 135.371575][ C0] ? _raw_spin_unlock+0x28/0x50 [ 135.374895][ C0] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 135.378708][ C0] __irq_exit_rcu+0x194/0x210 [ 135.382368][ C0] irq_exit_rcu+0x9/0x30 [ 135.385161][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 135.388686][ C0] [ 135.390444][ C0] [ 135.391878][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 135.396162][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 135.402083][ C0] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 e6 c5 15 f6 48 89 df e8 0e 1c 16 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 d5 22 05 f6 65 48 83 3d e4 f4 ba 08 00 74 16 5b [ 135.416014][ C0] RSP: 0018:ffffc90004ebe880 EFLAGS: 00000246 [ 135.419990][ C0] RAX: 0000000000000002 RBX: ffff88802791c000 RCX: 0000000000000040 [ 135.423438][ C0] RDX: 0000000000000001 RSI: ffffffff8e3f08a7 RDI: ffffffff8c622580 [ 135.428483][ C0] RBP: 0000000000000246 R08: 0000000000000001 R09: 0000000000000000 [ 135.432931][ C0] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000080000000 [ 135.438415][ C0] R13: ffff88802141a478 R14: 0000000000000000 R15: ffff88802141a400 [ 135.445390][ C0] dummy_urb_enqueue+0x56c/0x880 [ 135.449234][ C0] ? __device_attach_driver+0x131/0x320 [ 135.454074][ C0] usb_hcd_submit_urb+0x268/0x2150 [ 135.459614][ C0] ? bus_for_each_drv+0x159/0x1e0 [ 135.462996][ C0] ? __device_attach+0x1e4/0x4d0 [ 135.466378][ C0] ? device_initial_probe+0xaf/0xd0 [ 135.469319][ C0] ? bus_probe_device+0x64/0x160 [ 135.474769][ C0] ? device_add+0x121d/0x1970 [ 135.479753][ C0] ? usb_new_device.part.0+0xcc2/0x1686 [ 135.484282][ C0] ? hub_event.cold+0x1e3/0xe90 [ 135.490537][ C0] usb_submit_urb+0x827/0x19b0 [ 135.493784][ C0] ? __init_swait_queue_head+0xca/0x150 [ 135.496334][ C0] usb_start_wait_urb+0x10e/0x580 [ 135.498484][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 135.501656][ C0] ? __asan_memset+0x23/0x50 [ 135.505418][ C0] usb_control_msg+0x328/0x4b0 [ 135.508454][ C0] ? __pfx_usb_control_msg+0x10/0x10 [ 135.511038][ C0] ? lockdep_hardirqs_on+0x7d/0x110 [ 135.515033][ C0] usb_control_msg_send+0xca/0x130 [ 135.518726][ C0] usb_set_interface+0x9b6/0xe20 [ 135.521020][ C0] snd_usb_midi_v2_create+0x629/0x4070 [ 135.523932][ C0] ? __mutex_unlock_slowpath+0x35d/0x930 [ 135.526514][ C0] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 135.530802][ C0] ? snd_info_create_entry+0x6f/0x400 [ 135.535387][ C0] ? lockdep_init_map_type+0x5c/0x250 [ 135.538744][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 135.542768][ C0] ? lockdep_init_map_type+0x5c/0x250 [ 135.549757][ C0] ? snd_info_create_entry+0x314/0x400 [ 135.553747][ C0] ? usb_ifnum_to_if+0x16f/0x1d0 [ 135.556181][ C0] snd_usb_create_stream.isra.0+0x386/0x4d0 [ 135.558640][ C0] usb_audio_probe+0xf0b/0x3b10 [ 135.560484][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 135.562601][ C0] ? do_raw_spin_lock+0x128/0x260 [ 135.564560][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 135.566792][ C0] ? mark_held_locks+0x40/0x70 [ 135.569053][ C0] ? _raw_spin_lock_irqsave+0x52/0x60 [ 135.571949][ C0] ? find_held_lock+0x2b/0x80 [ 135.575182][ C0] ? mark_held_locks+0x40/0x70 [ 135.577324][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 135.593151][ C0] usb_probe_interface+0x386/0x9b0 [ 135.595373][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 135.610813][ C0] ? kernfs_put+0x3f/0x60 [ 135.612758][ C0] ? sysfs_create_link+0x68/0xc0 [ 135.614870][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 135.617299][ C0] really_probe+0x241/0xa60 [ 135.619702][ C0] __driver_probe_device+0x210/0x460 [ 135.621793][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 135.636679][ C0] driver_probe_device+0x4a/0x140 [ 135.638904][ C0] __device_attach_driver+0x1df/0x320 [ 135.641011][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 135.643343][ C0] bus_for_each_drv+0x159/0x1e0 [ 135.645380][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 135.649850][ C0] ? lockdep_hardirqs_on+0x7d/0x110 [ 135.666780][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 135.669025][ C0] __device_attach+0x1e4/0x4d0 [ 135.670628][ C0] ? __pfx___device_attach+0x10/0x10 [ 135.672431][ C0] ? do_raw_spin_unlock+0x145/0x1e0 [ 135.674341][ C0] device_initial_probe+0xaf/0xd0 [ 135.676523][ C0] bus_probe_device+0x64/0x160 [ 135.679052][ C0] device_add+0x121d/0x1970 [ 135.696408][ C0] ? __pfx_device_add+0x10/0x10 [ 135.698642][ C0] usb_set_configuration+0xd97/0x1c60 [ 135.700438][ C0] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 135.702466][ C0] usb_generic_driver_probe+0xa1/0xe0 [ 135.704269][ C0] usb_probe_device+0xef/0x400 [ 135.705921][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 135.723875][ C0] really_probe+0x241/0xa60 [ 135.727389][ C0] __driver_probe_device+0x210/0x460 [ 135.730308][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 135.733007][ C0] driver_probe_device+0x4a/0x140 [ 135.748319][ C0] __device_attach_driver+0x1df/0x320 [ 135.751244][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 135.768039][ C0] bus_for_each_drv+0x159/0x1e0 [ 135.771165][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 135.774526][ C0] ? lockdep_hardirqs_on+0x7d/0x110 [ 135.777063][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 135.779849][ C0] __device_attach+0x1e4/0x4d0 [ 135.782153][ C0] ? __pfx___device_attach+0x10/0x10 [ 135.805094][ C0] ? do_raw_spin_unlock+0x145/0x1e0 [ 135.807875][ C0] device_initial_probe+0xaf/0xd0 [ 135.810523][ C0] bus_probe_device+0x64/0x160 [ 135.813411][ C0] device_add+0x121d/0x1970 [ 135.816150][ C0] ? __pfx_device_add+0x10/0x10 [ 135.819560][ C0] ? usb_detect_static_quirks+0x335/0x3e0 [ 135.823506][ C0] usb_new_device.part.0+0xcc2/0x1686 [ 135.827311][ C0] ? __pfx_usb_new_device.part.0+0x10/0x10 [ 135.830944][ C0] ? mark_held_locks+0x40/0x70 [ 135.833557][ C0] hub_event.cold+0x1e3/0xe90 [ 135.836698][ C0] ? __pfx_hub_event+0x10/0x10 [ 135.840645][ C0] ? percpu_rwsem_wake_function+0x2b0/0x4a0 [ 135.847123][ C0] ? lock_acquire+0x1d1/0x380 [ 135.850531][ C0] ? process_one_work+0xa2c/0x1b10 [ 135.853448][ C0] ? process_one_work+0x906/0x1b10 [ 135.857156][ C0] ? process_one_work+0x906/0x1b10 [ 135.862191][ C0] process_one_work+0xac7/0x1b10 [ 135.865494][ C0] ? __pfx_process_one_work+0x10/0x10 [ 135.869235][ C0] ? lock_acquire+0x1d1/0x380 [ 135.875392][ C0] ? __pfx_hub_event+0x10/0x10 [ 135.882282][ C0] worker_thread+0x5ef/0xe50 [ 135.887032][ C0] ? __pfx_worker_thread+0x10/0x10 [ 135.891661][ C0] ? kthread+0x13a/0x450 [ 135.894444][ C0] ? __pfx_worker_thread+0x10/0x10 [ 135.899268][ C0] kthread+0x373/0x450 [ 135.902569][ C0] ? __pfx_kthread+0x10/0x10 [ 135.908548][ C0] ret_from_fork+0x730/0xd60 [ 135.914831][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 135.920192][ C0] ? native_load_gs_index+0x1e/0xc0 [ 135.924775][ C0] ? __switch_to+0x800/0x10f0 [ 135.927302][ C0] ? __pfx_kthread+0x10/0x10 [ 135.930595][ C0] ret_from_fork_asm+0x1a/0x30 [ 135.935772][ C0] [ 135.938993][ C0] Modules linked in: [ 135.943509][ C0] ---[ end trace 0000000000000000 ]--- [ 135.948858][ C0] RIP: 0010:f_midi2_free_ep_reqs+0x56/0x2b0 [ 135.948921][ C0] Code: 85 6a 02 00 00 49 8b 45 00 48 89 44 24 18 48 05 30 07 00 00 48 89 c2 48 89 44 24 20 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e b5 01 00 00 48 8b 44 24 18 31 [ 135.948937][ C0] RSP: 0018:ffffc900000079d8 EFLAGS: 00010002 [ 135.948991][ C0] RAX: dffffc0000000000 RBX: ffff88805ffb0000 RCX: 0000000000000103 [ 135.949002][ C0] RDX: 00000000000000e6 RSI: ffffffff87f391f6 RDI: ffff88805ffb0128 [ 135.949043][ C0] RBP: ffff88805ffb0128 R08: 0000000000000004 R09: 0000000000000020 [ 135.949053][ C0] R10: 0000000000000020 R11: 000000000000760b R12: ffff88805ffb00f0 [ 135.949062][ C0] R13: ffff88805ffb0128 R14: ffff88805ffb0740 R15: 0000000000000001 [ 135.949072][ C0] FS: 0000000000000000(0000) GS:ffff888096963000(0000) knlGS:0000000000000000 [ 135.949150][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 135.949212][ C0] CR2: 0000000034e17ff8 CR3: 0000000067a0b000 CR4: 0000000000352ef0 [ 135.949226][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 136.022919][ C0] Kernel Offset: disabled [ 136.025341][ C0] Rebooting in 86400 seconds..