last executing test programs: 1m56.211465757s ago: executing program 1 (id=689): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = memfd_create(&(0x7f0000000540)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\nh<\x99\xaa\xe1\xf3\xb8Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev<\x97\x1a2_\x82\xfa\x15h$\x01\xdd\xe5\xceC\x19\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xb2\xf5\x1e5.\xc1\xa1\x05\x92\x82d\x0e\xf5PMjIt\xc5u~Tw\xbeNg\xb5\xeeP\x9c\xce\xfaS\xa7\xec0\xf4\xd2\xc2+@\x12=\xaa\b\xd2&\x19k6\xc7\xa6+\x04V\xc3\xe1\xd3\fZZ\x1cJo\xa5(& \r\xf1\xa4\xb8\xc23\x16\xc3\xaejA/', 0x0) write$binfmt_elf32(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c46"], 0x66) execveat(r2, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000000080)=[@in={0x2, 0x4e22, @private=0xa010102}], 0x10) syz_open_dev$sndctrl(&(0x7f0000000180), 0x1, 0x10000) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000000)={0x400, 0xe}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f00000002c0)={r5, 0x5}, 0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r5, @in={{0x2, 0x4e23, @broadcast}}, 0x7, 0x8, 0xc, 0x8, 0x6a, 0xd, 0x1}, 0x9c) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000008c0)={'wlan1\x00', 0x0}) r8 = openat$rdma_cm(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0) r9 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r9, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r9, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {r10}}, 0x10) r11 = openat$rdma_cm(0xffffff9c, &(0x7f0000000300), 0x2, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(r8, &(0x7f0000000340)={0x12, 0x10, 0xfa00, {&(0x7f0000000240), r10, r11}}, 0x18) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000001300)={0x4c, r6, 0x1, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x4, 0x19}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'nicvf0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0xffffffffffffff13, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}]}]]}, 0x4c}}, 0x24000054) 1m55.341853498s ago: executing program 1 (id=695): epoll_create1(0x0) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) close(r0) r1 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_SENDMSG={0x9, 0x0, 0x21, 0xffffffffffffffff, 0x0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{0x0}, {0x0}], 0x2}, 0x7, 0x44004, 0x1}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet(0x2b, 0x801, 0x0) socket$tipc(0x1e, 0x5, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000000c0)=@x86={0x1, 0x7, 0x8, 0x0, 0x1, 0x8, 0x7, 0xc, 0x10, 0x35, 0x8, 0xb, 0x0, 0x902, 0x3, 0x0, 0xf, 0x8, 0xe, '\x00', 0xb, 0x7fffffffffffffff}) pselect6(0x40, &(0x7f00000001c0)={0x8, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x20000000009, 0x5, 0x0, 0x1, 0x9}, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r4, 0xffffffffffffffff, 0x100000000000000) 1m55.133516706s ago: executing program 1 (id=697): sched_setattr(0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x8040) set_mempolicy(0x3, 0x0, 0x7) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x0, 0x40, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r3, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r3, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000280)="5338a3848b25e258a25f", 0xa}], 0x1}}], 0x1, 0x20008000) recvmsg(r3, 0x0, 0x123) shutdown(r3, 0x1) getpgid(0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) 1m54.22666242s ago: executing program 1 (id=701): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x2, &(0x7f0000000200)=@raw=[@call={0x85, 0x0, 0x0, 0xae}, @exit], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x80) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat(r1, 0x0, 0x2, 0x0) unlinkat(0xffffffffffffff9c, 0x0, 0x200) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="08000000040000000400000009"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0xa, 0x8, &(0x7f0000000040)=ANY=[@ANYBLOB="1809000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7030000070000008500000021000000b70000000000000095"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xe, 0x0, &(0x7f0000000700)="b9d5e01a991e924ccc78cbc0a3ba", 0x0, 0xe8a2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000080)=0x3) setresuid(0xee01, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$TIOCSLCKTRMIOS(r4, 0x80047456, &(0x7f00000010c0)) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c0000"], 0x64}, 0x1, 0x0, 0x0, 0x94}, 0x24000000) 1m53.871794409s ago: executing program 1 (id=703): fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000080)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={&(0x7f00000001c0)="cb7721e9f692aa26c82552201f6cf26f111e71b7da2e62e72aed4762c09e81b5bbd88729aa00a49d8f716b522f75600a1404cf8035f2964c07a213ac66d0b9dcb2f1c99fe3ad9524b7a65b7e298fbd057b429d902ff16879cd27d8d8e5c7aa65ec67c137512d33cd66b5108d76c5676b89a0a7f69fd2a93430d3af7566aa1f743e0990018a8e5f915adccebe076d86495ca9f2cf", &(0x7f0000000280)="efe23f278d55ba806470fc73b67a0a5a5a284b616a7a4357c1419178186b40f6bd750d42f07f97f6167870feed5cbc2dde5c31d29efec0438d0ba91cb4c81ecf0d15727d1b9243b9ef7e9e821205faa719efe45fdcbf9805ae5dcb94c33a50a67686a1db216f958b0e1da8f891d8d7"}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r0 = socket(0x2, 0x800, 0x0) getsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000140), &(0x7f0000000500)=0xe) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000240)={'syztnl0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x700, 0x40, 0x9, 0x3, {{0x14, 0x4, 0x3, 0x3b, 0x50, 0x67, 0x0, 0xf, 0x29, 0x0, @local, @empty, {[@timestamp_addr={0x44, 0x2c, 0x9b, 0x1, 0x9, [{@rand_addr=0x64010101, 0x3}, {@dev={0xac, 0x14, 0x14, 0x17}, 0x7ceb4910}, {@remote, 0x101}, {@broadcast, 0x101}, {@private=0xa010101, 0x4e9}]}, @timestamp={0x44, 0x10, 0x92, 0x0, 0x7, [0x7, 0x4, 0x200]}]}}}}}) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) socket$inet6_sctp(0xa, 0x801, 0x84) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x3, 0x603, 0x0, 0x0, 0x1000, 0xb6a7, 0x0, 0x0, 0x28}}}, &(0x7f0000000180)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r4, &(0x7f0000000200)='md0', 0x3) write(0xffffffffffffffff, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/md0/md/dev-ram0/slot\x00', 0x2, 0x0) write(r5, 0x0, 0x0) r6 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r6, &(0x7f0000000a00)='1\x00', 0x1) r7 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/block/md0/md/component_size\x00', 0x2, 0x0) write(r7, &(0x7f0000000c00)='40', 0x2) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) syz_ublk_setup_queues(r8, r3, &(0x7f0000000480)={0x0, 0x18ee, 0x101f, 0x3, 0x1d2}, &(0x7f0000002680)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb656, 0x20, 0x2, 0x271, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x842d, 0x40, 0x2, 0x6a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb6d4, 0x10000, 0x1, 0x252}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xeaff, 0x8000, 0x0, 0x231}}], 0x4, &(0x7f0000000380)={0x2e, 0x62, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x9}, 0x0, r2, '\x00', {0x2003, 0xb66, 0x0, 0x0}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff01}, 0x50) 1m53.716930959s ago: executing program 1 (id=704): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) fcntl$lock(r0, 0x26, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x0, 0xffffffffffffffff}) r1 = syz_open_dev$evdev(0x0, 0x0, 0x2002) write$evdev(r1, 0x0, 0x0) r2 = fsopen(&(0x7f00000002c0)='ocfs2\x00', 0x1) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000080)={0x1, 0x2}, 0x8) close(r3) syz_usb_connect(0x5, 0x24, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x5, 0x7fff0000}]}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x1, 0x0, 0x7fff0000}]}) r6 = fanotify_init(0x200, 0x0) fanotify_mark(r6, 0x1, 0x1033, r5, 0x0) pipe2(&(0x7f00000012c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) r10 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) ioctl$TCXONC(r10, 0x540a, 0x2) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={r9}, 0x4) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x5, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7}, [@call={0x85, 0x0, 0x0, 0x2c}, @generic={0x8, 0x5, 0x9, 0xffff, 0xfd}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x32, '\x00', 0x0, @xdp=0xdca6bfcc9a561e2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r11, 0x0, 0xe, 0x0, &(0x7f0000000200)="6a00000000000000000000ccf0cf", 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) tee(r7, r5, 0xe, 0x4) ioctl$SG_EMULATED_HOST(r7, 0x2203, &(0x7f0000000200)) write$binfmt_script(r8, &(0x7f0000001380)={'#! ', './file0'}, 0xb) close_range(r4, 0xffffffffffffffff, 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, 0x0, &(0x7f0000000180)='%(,c\xbe\r\xcc:', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r12 = openat$uinput(0xffffff9c, &(0x7f0000000040), 0x802, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$UI_GET_VERSION(r12, 0x8004552d, 0x0) 1m38.526763303s ago: executing program 32 (id=704): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) fcntl$lock(r0, 0x26, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x0, 0xffffffffffffffff}) r1 = syz_open_dev$evdev(0x0, 0x0, 0x2002) write$evdev(r1, 0x0, 0x0) r2 = fsopen(&(0x7f00000002c0)='ocfs2\x00', 0x1) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000080)={0x1, 0x2}, 0x8) close(r3) syz_usb_connect(0x5, 0x24, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x5, 0x7fff0000}]}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x1, 0x0, 0x7fff0000}]}) r6 = fanotify_init(0x200, 0x0) fanotify_mark(r6, 0x1, 0x1033, r5, 0x0) pipe2(&(0x7f00000012c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) r10 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) ioctl$TCXONC(r10, 0x540a, 0x2) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={r9}, 0x4) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x5, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7}, [@call={0x85, 0x0, 0x0, 0x2c}, @generic={0x8, 0x5, 0x9, 0xffff, 0xfd}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x32, '\x00', 0x0, @xdp=0xdca6bfcc9a561e2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r11, 0x0, 0xe, 0x0, &(0x7f0000000200)="6a00000000000000000000ccf0cf", 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) tee(r7, r5, 0xe, 0x4) ioctl$SG_EMULATED_HOST(r7, 0x2203, &(0x7f0000000200)) write$binfmt_script(r8, &(0x7f0000001380)={'#! ', './file0'}, 0xb) close_range(r4, 0xffffffffffffffff, 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, 0x0, &(0x7f0000000180)='%(,c\xbe\r\xcc:', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r12 = openat$uinput(0xffffff9c, &(0x7f0000000040), 0x802, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$UI_GET_VERSION(r12, 0x8004552d, 0x0) 7.199067299s ago: executing program 3 (id=1208): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="14000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800084000000001140000001100010000000000000000000900000a69b877239f30e44d000ebcec5d3ddd0dde87990e7e57b5f4927b8138f09924b06a093a63129ddb092b08cf165d6c403d8346952ed8b5a1ff4331bd477939663008443d68322abb860ff728e9ba80cceff6def9d6608bb632c59e4549eb1bab14"], 0x6c}}, 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sec\x00', 0x1ff) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000900)=ANY=[@ANYBLOB="180200000500000000000000000000008500000011000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fcffffff850000007200000095"], &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/query\x00', 0x2, 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) getsockopt$IPT_SO_GET_INFO(r3, 0x0, 0x40, 0x0, &(0x7f0000000040)=0x54) r4 = getpgrp(0xffffffffffffffff) ptrace(0x11, r4) ppoll(&(0x7f0000000140)=[{r2, 0x4}], 0x1, 0x0, 0x0, 0x0) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000105509147200ed0000000109022400010000000009040000030300000009210000000122050009058103"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_generic(0x10, 0x3, 0x10) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r6, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x30, r7, 0x1, 0x70bd2c, 0xffeffffe, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x14}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0x41, 0x406}}}, 0x7) syz_usb_connect$uac1(0x2, 0xe2, &(0x7f00000003c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x13e5, 0x1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xd0, 0x3, 0x1, 0x5, 0x20, 0x4, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x5, 0x2a}, [@selector_unit={0x8, 0x24, 0x5, 0x1, 0x6, "c5698a"}, @processing_unit={0x9, 0x24, 0x7, 0x4, 0x6, 0x6, "0207"}, @processing_unit={0x9, 0x24, 0x7, 0x5, 0x5, 0x6, "d29b"}, @mixer_unit={0x6, 0x24, 0x4, 0x5, 0x7f, "fa"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x0, 0x6, 0x3}, @format_type_i_discrete={0xf, 0x24, 0x2, 0x1, 0x6, 0x1, 0x4, 0x7, "8402c06e4af05d"}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x3, 0x4, 0x4, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0xff, 0x6, 0x80, {0x7, 0x25, 0x1, 0xc, 0x6, 0x100}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x51, 0x2, 0x81, 'C'}, @format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0x0, 0x2, 0x3, "c6db2a2995b803"}, @format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x1, 0x2, 0xf, 0x5, "ed9064b00664"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x8, 0xa, 0x5, 0x9}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x3, 0x9, 0x7, {0x7, 0x25, 0x1, 0x4, 0x7, 0xe6}}}}}}}}]}}, &(0x7f0000000b40)={0xa, &(0x7f00000004c0)={0xa, 0x6, 0x310, 0x3, 0x5, 0x2, 0x40, 0x9}, 0x23, &(0x7f0000000500)={0x5, 0xf, 0x23, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x1a, "97a369e0a11e3ba4bd85fe465f8ecdb2"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x4, 0xeb, 0x7f}]}, 0x7, [{0xf6, &(0x7f0000000540)=@string={0xf6, 0x3, "5de7d972f1be46a2331a61578fe1e19803ef9958127416eb856b86fada9ed4bf156f308780271ac8c2a0606ee0f2c63d17f64a5e80cd9c0d2336f916b5fc165ab6b90d87bcfe7e6a002df088327b14a1b81a3fe947ab6795f05894b2c7b376b52fafd15518a772f2010e62d08ba5c877c5538a52a5de95468cdf0c5238c6095a4c2f4eba47218ebae58d079ae984820a6a6c0f7e3032260aab31c74f91e4a5915653ff4c9bd3010bcc5fab13792371ec82b045613eb4bb18d97354f4d03779e6d4ac7a403d31a8837d0b1755f132679fa9b30787905d77a1b65a0e4e9b33083711536be7f578cefb1bc48253bf435e3f497cf266"}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x455}}, {0x8a, &(0x7f0000000680)=@string={0x8a, 0x3, "bb8b196debf8aa8308544a8d60af542a23015be4f88d6bed7dcf8901b1624b4d04647953150c45a0dc6402e1ce547452c683b44618e2c7b7e74cc560cfb8d04fa87d8ff4c6fe6011fcd2a700e1e609e042ad575948cf08c41bdddf4981830bbd1f633883f438b746c9071df04ce803cb798f4c5821411d35464812b5ed998a967d21cddaa775175d"}}, {0x4, &(0x7f0000000780)=@lang_id={0x4, 0x3, 0x1801}}, {0xd6, &(0x7f0000000900)=@string={0xd6, 0x3, "f16f2b5664d1790f6ddbb08133a3cec60db596410ea9ecfef7a279bb7a5d9588bbfd303c7c025b525267a5abbccdf13f6f56d1482dc604c604b9a4d69cad5b2aed7fe523c80aba178fe5a383406c0ee0817391dbcf7feb7598bab01d6591044ee957a15c938a0a44fb86f9e9ab042321981e45c372deb06ce57eb63939f7b9bc6615d8e53ccab61f842d22219c68cb76f7af249e1f06dc0d32ab6a64e3f16e451b7250b00225dbab626f9c077ec872d0815b8f9fb47e1d8e201f56ad2d5db5b4373acaf7ba725ffd8e89e3ba853e2986ca4a0615"}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4, 0x3, 0x860}}, {0xc2, &(0x7f0000000a40)=@string={0xc2, 0x3, "fc9196684ea3cc358e18cbebbcc2e1e8bfd3d9485be5f8e6a98095e05fc7ae736c2c5a74122481e8d899c30eb330a17d18bcad6daac165ff69989f57c423ecbd0eaf5561fed6ff0180b1bf55f071aa0d67ddd3a4a32e7d10be23dd0d6d2282207c921435668fbaa511193c7fad31e8ddaae435a174ddae97c2b1786a268eaad91e5eb2a6b7e57bb0b3c42a9f56afbbe5039a842ba3675feab65874aa6ad52eb56983d6d301dc4b520560b5b52f200ea333fda4478069bad5ce7475608ac1461b"}}]}) syz_usb_control_io(r5, &(0x7f0000000100)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB=' mO'], 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="470d000000000000000000000000080002"], 0x1c}}, 0x0) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000740)=ANY=[@ANYBLOB="14020000140001002dbd7000000000000a"], 0x214}], 0x1}, 0x0) 5.698250873s ago: executing program 2 (id=1223): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x2, &(0x7f0000000200)=@raw=[@call={0x85, 0x0, 0x0, 0xae}, @exit], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x80) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat(r1, 0x0, 0x2, 0x0) unlinkat(0xffffffffffffff9c, 0x0, 0x200) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="08000000040000000400000009"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0xa, 0x8, &(0x7f0000000040)=ANY=[@ANYRES32=r2, @ANYBLOB="0000000000000000b7030000070000008500000021000000b70000000000000095"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xe, 0x0, &(0x7f0000000700)="b9d5e01a991e924ccc78cbc0a3ba", 0x0, 0xe8a2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000080)=0x3) setresuid(0xee01, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$TIOCSLCKTRMIOS(r4, 0x80047456, &(0x7f00000010c0)) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c0000"], 0x64}, 0x1, 0x0, 0x0, 0x94}, 0x24000000) 5.571404129s ago: executing program 2 (id=1224): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newlink={0x40, 0x10, 0xffffffffffffffff, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1414, 0x2021}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0xc008006) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00220f000000b01b45"], 0x0}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newlink={0x3c, 0x10, 0x421, 0x800000, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x88a8ffad, 0x60e1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_USE_IFADDR={0x5, 0x18, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8005}, 0x44002) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f00000002c0)=0x1, 0x4) r4 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r4, 0xc018480b, 0x0) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r5) syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d81201000001010203010902200001010080320904000002ff00000007058102"], 0x0) read$char_usb(0xffffffffffffffff, &(0x7f0000000600)=""/64, 0x40) syz_usb_ep_write(r5, 0x81, 0x3f, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251") sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x40, 0x0, 0x901, 0x70bd25, 0x25dfdbfb, {}, [@DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x8}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8c010}, 0x40) ioctl$HIDIOCGNAME(r4, 0x80404806, &(0x7f0000000040)) 4.950229546s ago: executing program 3 (id=1226): socket(0x26, 0x5, 0x200) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet(0x2, 0x6, 0x2) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) syz_genetlink_get_family_id$tipc(&(0x7f0000000340), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/uhci_hcd/unbind\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/irq/16/smp_affinity\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='5', 0x1) write(r2, &(0x7f0000000140)='0000:00:1d.0', 0xc) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, 0x0, 0x8400) close(r2) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/drivers/uhci_hcd/bind\x00', 0x69a200, 0x0) getpid() write(r5, &(0x7f00000001c0)='0000:00:1d.0', 0xc) getsockopt$inet6_buf(r2, 0x29, 0xcd, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000003f0007012bbd700000000000017c00000400fc800c00018008000600", @ANYRES32=0x0, @ANYBLOB="0c00028005002300ff05000000e504007405d82507a22135316548e7b18d3257270966d68ca05babfe45", @ANYRES32, @ANYBLOB], 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) 3.886082114s ago: executing program 3 (id=1228): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000180)='10000', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="840000001000010428bd70000000000000000000", @ANYRES32=0x0, @ANYRESDEC=r0, @ANYRES32, @ANYBLOB="0600100003000000080014000000000008000700"], 0x84}, 0x1, 0x0, 0x0, 0x4}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) lchown(&(0x7f0000000080)='./file0\x00', 0xee00, 0xee00) unshare(0x60060400) 3.696727641s ago: executing program 3 (id=1230): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000080)={&(0x7f0000000040)=[0x0], 0x1, 0x80000, 0x0, 0xffffffffffffffff}) quotactl_fd$Q_QUOTAON(r0, 0xffffffff80000202, 0xee01, &(0x7f00000000c0)='./file0\x00') mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x42, 0x1ff) sendfile(r2, r1, 0x0, 0xc00) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f00000002c0)=0x1, 0x4) close(r2) r4 = openat(0xffffffffffffff9c, 0x0, 0x113540, 0x1ff) sendfile(r4, r1, 0x0, 0xc00) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./mnt/f3\x00', 0x42, 0x1ff) sendfile(r5, r1, 0x0, 0xc00) close(r5) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/uevent_helper', 0xa82, 0x0) write$FUSE_INIT(r6, &(0x7f0000000100)={0x50, 0xffffffffffffffda, 0x0, {0x7, 0x2d, 0x3, 0x50a45805, 0x4, 0x4, 0x200, 0x1c18, 0x0, 0x0, 0x4, 0x7}}, 0x50) unshare(0x2a020480) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="400000001000010400000000fec95f25ef99b072", @ANYRES32=0x0, @ANYBLOB="430d030001a1010014000300776c616e3100000000000000000000000a0001"], 0x40}}, 0x4000) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001300)='./mnt/f4\x00', 0x42, 0x1ff) sendfile(0xffffffffffffffff, r1, 0x0, 0xc00) close(0xffffffffffffffff) unlinkat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x0) 3.590084973s ago: executing program 2 (id=1232): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, 0x0, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x70, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {}, {0x8, 0x8}}, [@filter_kind_options=@f_bpf={{0x8}, {0x44, 0x2, [@TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}, @TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}, @TCA_BPF_CLASSID={0x8, 0x3, {0xa, 0xe}}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x2004c800}, 0x0) 3.539482643s ago: executing program 3 (id=1235): epoll_create1(0x0) close(0xffffffffffffffff) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_io_uring_setup(0x2eff, &(0x7f0000000600)={0x0, 0x595f, 0x10000, 0x0, 0x51}, 0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(0x0, r1, r2, &(0x7f0000000280)=@IORING_OP_SENDMSG={0x9, 0x0, 0x21, 0xffffffffffffffff, 0x0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{0x0}, {0x0}], 0x2}, 0x7, 0x44004, 0x1}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet(0x2b, 0x801, 0x0) socket$tipc(0x1e, 0x5, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x4040aea0, &(0x7f00000000c0)=@x86={0x1, 0x7, 0x8, 0x0, 0x1, 0x8, 0x7, 0xc, 0x10, 0x35, 0x8, 0xb, 0x0, 0x902, 0x3, 0x0, 0xf, 0x8, 0xe, '\x00', 0xb, 0x7fffffffffffffff}) pselect6(0x40, &(0x7f00000001c0)={0x8, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x20000000009, 0x5, 0x0, 0x1, 0x9}, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r4, 0xffffffffffffffff, 0x100000000000000) 3.470951386s ago: executing program 2 (id=1236): epoll_create1(0x0) close(0xffffffffffffffff) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_io_uring_setup(0x2eff, &(0x7f0000000600)={0x0, 0x595f, 0x10000, 0x0, 0x51}, 0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(0x0, r1, r2, &(0x7f0000000280)=@IORING_OP_SENDMSG={0x9, 0x0, 0x21, 0xffffffffffffffff, 0x0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{0x0}, {0x0}], 0x2}, 0x7, 0x44004, 0x1}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet(0x2b, 0x801, 0x0) socket$tipc(0x1e, 0x5, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x4040aea0, &(0x7f00000000c0)=@x86={0x1, 0x7, 0x8, 0x0, 0x1, 0x8, 0x7, 0xc, 0x10, 0x35, 0x8, 0xb, 0x0, 0x902, 0x3, 0x0, 0xf, 0x8, 0xe, '\x00', 0xb, 0x7fffffffffffffff}) pselect6(0x40, &(0x7f00000001c0)={0x8, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x20000000009, 0x5, 0x0, 0x1, 0x9}, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r4, 0xffffffffffffffff, 0x100000000000000) 3.194669541s ago: executing program 3 (id=1237): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x800006, @loopback, 0x4}, 0x1c) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{0x104, 0x80, 0x0, 0x6a8}, 'syz1\x00', 0x2f}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[@ANYRESDEC=0x0, @ANYRES16, @ANYRES32, @ANYRESOCT=0x0, @ANYRESOCT=0x0], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2d, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000280)) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000100)={0x0, 'veth0_to_batadv\x00', {0x1}, 0x2a}) socket$inet6_sctp(0xa, 0x801, 0x84) r5 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000000), 0x4) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x15, 0x301, 0x0, 0x0, {0xb}}, 0x14}}, 0x0) ioctl$UI_DEV_CREATE(r1, 0x5501) 3.065497991s ago: executing program 33 (id=1237): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x800006, @loopback, 0x4}, 0x1c) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{0x104, 0x80, 0x0, 0x6a8}, 'syz1\x00', 0x2f}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[@ANYRESDEC=0x0, @ANYRES16, @ANYRES32, @ANYRESOCT=0x0, @ANYRESOCT=0x0], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2d, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000280)) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000100)={0x0, 'veth0_to_batadv\x00', {0x1}, 0x2a}) socket$inet6_sctp(0xa, 0x801, 0x84) r5 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000000), 0x4) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x15, 0x301, 0x0, 0x0, {0xb}}, 0x14}}, 0x0) ioctl$UI_DEV_CREATE(r1, 0x5501) 3.045882452s ago: executing program 2 (id=1240): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newlink={0x40, 0x10, 0xffffffffffffffff, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1414, 0x2021}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0xc008006) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00220f000000b01b45"], 0x0}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newlink={0x3c, 0x10, 0x421, 0x800000, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x88a8ffad, 0x60e1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_USE_IFADDR={0x5, 0x18, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8005}, 0x44002) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f00000002c0)=0x1, 0x4) r4 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r4, 0xc018480b, 0x0) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r5) syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d81201000001010203010902200001010080320904000002ff00000007058102"], 0x0) read$char_usb(0xffffffffffffffff, &(0x7f0000000600)=""/64, 0x40) syz_usb_ep_write(r5, 0x81, 0x40, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c36302725166") sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, 0x0, 0x40) ioctl$HIDIOCGNAME(r4, 0x80404806, &(0x7f0000000040)) 2.605592415s ago: executing program 0 (id=1244): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040001}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x70, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {}, {0x8, 0x8}}, [@filter_kind_options=@f_bpf={{0x8}, {0x44, 0x2, [@TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}, @TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}, @TCA_BPF_CLASSID={0x8, 0x3, {0xa, 0xe}}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x2004c800}, 0x0) 2.29546925s ago: executing program 0 (id=1246): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/cluster/mycluster\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/cluster/mycluster/node/mynode\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/cluster/mycluster/node/mynode/num\x00', 0x2, 0x1) write(r0, &(0x7f0000000180)='127.0.0.1', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='77', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/mycluster/node/mynode/num\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/mycluster/node/mynode/local\x00', 0x2, 0x0) write(r3, &(0x7f0000000300)='1', 0x1) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/cluster/mycluster/heartbeat/myregion/block_bytes\x00', 0x2, 0x0) write(r4, &(0x7f00000003c0)='512', 0x3) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x2, 0x0) write(r5, &(0x7f0000000440)='255', 0x3) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/mycluster/heartbeat/myregion/start_block\x00', 0x2, 0x0) write(r6, &(0x7f00000004c0)='1', 0x1) close(r6) mknodat(0xffffffffffffff9c, &(0x7f0000000540)='./loop0\x00', 0x61c0, 0x700) openat(0xffffffffffffff9c, &(0x7f0000000540)='./loop0\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./backing_file\x00', 0x42, 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x2, 0x0) write(r7, &(0x7f00000005c0)='3', 0x1) 2.201162759s ago: executing program 0 (id=1247): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff2}, {0xffff, 0x4}, {0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40050}, 0x0) r0 = openat$mice(0xffffff9c, &(0x7f0000000040), 0x40000) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xfffffffffffffceb, 0x0, &(0x7f0000000380)="f6f4e9a1d78ad62ceef1884386dd78bb3fb7dbfc", 0x0, 0xa1b, 0x0, 0x9, 0x0, &(0x7f00000006c0)="ccf95f497eb30b9d5b", 0x0}, 0x50) r2 = socket$netlink(0x10, 0x3, 0x9) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r3) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYRESOCT=r2, @ANYRES16=r4, @ANYBLOB="010025bd7000fddbdf254400000008000300", @ANYRES32=r5, @ANYBLOB="3c00238005001100"], 0x58}, 0x1, 0x0, 0x0, 0x8851}, 0x4800) r6 = syz_usbip_server_init(0x1) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000080)={{0x1, 0x1, 0x18, r6}, './file0\x00'}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f00001e7000/0x3000)=nil, 0x3000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r7 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) read(r7, 0x0, 0x0) syz_clone(0x100, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r9, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010829bd7000000000000b00000008000300", @ANYRES32=r10, @ANYBLOB="60005080110001004abee339084eeef16f162471f4000000080003000cac0f00050002"], 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x0) 1.531063233s ago: executing program 4 (id=1249): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./proc/net/pppol2tp\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f00000002c0)="ab005ce4eb278aad1e0baf3162d86ab50af6e76966c7b5432a75fbaf7e93751f9c9ff00000000000001e32ef2af0f3938861cc19e66f09b3ac23084bb2eeb1338c5b3c3a8f3082f7ad038cf9005e75bd8ece1eefe4daa1a9fc9bce276d06385e0208f55bfc4a82689e6406ec501b84fed3f153cc8487419fa5bcdd2814218e", 0x7f) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, 0x0) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f0000000080)={0x0, 0x3, r5, 0x3, 0x80000}) write(r3, &(0x7f0000000280)='0', 0x1) read(r0, &(0x7f0000004000), 0x100) 1.181242475s ago: executing program 0 (id=1250): openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount$tmpfs(0x0, 0x0, 0x0, 0x86022, &(0x7f0000000580)=ANY=[@ANYBLOB="61756469742c67e1506910fc83995f747970653d69"]) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x44021, 0x0) mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) lchown(&(0x7f0000000040)='my_tracefs/events/task/task_rename/filter\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) read$FUSE(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f00002d9000/0x2000)=nil, 0x2000, 0x70) openat$null(0xffffff9c, 0x0, 0x101201, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r1, 0x1) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, 0x0, &(0x7f00000000c0)) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r2 = creat(0x0, 0x0) fsetxattr$system_posix_acl(r2, &(0x7f0000000000)='system.posix_acl_default\x00', 0x0, 0xfe44, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (fail_nth: 4) 658.236303ms ago: executing program 4 (id=1251): openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x25, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) r0 = socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x4002, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r1 = syz_io_uring_setup(0x1d5f, &(0x7f00000003c0)={0x0, 0x3b5a, 0x20, 0x1, 0x80}, &(0x7f0000000340)=0x0, &(0x7f0000000140)=0x0, &(0x7f00000000c0)=0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15}, 0x94) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000000)={r7, 0x1, 0x6, @multicast}, 0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r5, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000040)={r8, 0x3}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r1}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180), 0x80000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r9 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000002a000000951000"/32], &(0x7f0000000100)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r10, 0x0, 0xe, 0x0, &(0x7f0000000380)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) writev(r9, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, &(0x7f0000000080)=0xa, 0x4) mount$9p_virtio(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x199081, 0x80a0a1240160193d) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) 541.333972ms ago: executing program 4 (id=1252): openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x66) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000180)={0x18, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e1d, 0x5, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x3}, 0xffffffffffffffff, 0x7}}, 0x48) r2 = userfaultfd(0x801) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_CPUID2(r5, 0x4008ae90, &(0x7f0000000100)={0xeb, 0x0, [{0x1, 0x0, 0x5, 0x7, 0x800, 0x7fffffff, 0x2}]}) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00005cf000/0x4000)=nil, 0x400000, 0x2, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mprotect(&(0x7f0000936000/0x9000)=nil, 0x9000, 0x0) setns(0xc9, 0x0) r6 = socket(0x8, 0x5, 0x5) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r6) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x15) fsync(r0) 238.87061ms ago: executing program 4 (id=1253): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040001}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x70, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {}, {0x8, 0x8}}, [@filter_kind_options=@f_bpf={{0x8}, {0x44, 0x2, [@TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}, @TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}, @TCA_BPF_CLASSID={0x8, 0x3, {0xa, 0xe}}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x2004c800}, 0x0) 129.76326ms ago: executing program 4 (id=1254): io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c0000000500000000000000000000020a8335973d8b189000000000000000000000000000302e6100"], 0x0, 0x39, 0x0, 0xa, 0xfffff57f}, 0x28) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x121102, 0x0) syz_open_dev$vcsu(&(0x7f0000000100), 0x4, 0x200041) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x1) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, 0x0, 0x1f) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000140)={r2, 0xb, 0x1}) socket$unix(0x1, 0x5, 0x0) ioctl(0xffffffffffffffff, 0x9, &(0x7f0000000000)="c4c61ea3461ebd4ab4111dff1a1f08795bc9205378e4c026ae08090c7a05461c4ca2db74a29310056da81d128a7828466b5cff43083e0cf05e2889dffa61c722e2967aeead5e7696311dd8d1edf6affa09244f87f803174852bacf6451f52eb3ce1ad12d1b6d1554cd849ee64b415d967f07d6ae486448d1f8fe25416f4177918f888f400689bc72a880b216fc19c6c25003d113646b310d658fc7c8d885") 121.13034ms ago: executing program 2 (id=1255): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0xee49, 0x20000) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r2, 0x40405515, &(0x7f0000000240)={0x2, 0x2, 0x80000001, 0x1, '\x00', 0x57}) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000c80)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r1, &(0x7f0000000000)='\x00', 0x1, 0xc891, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x8012, 0x0, 0xfffffffffffffe2d) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000040)=0x1, 0x4) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 120.931857ms ago: executing program 0 (id=1256): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, &(0x7f00000000c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) sched_setscheduler(r3, 0x3, &(0x7f0000000140)=0x8001) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000840), r1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000880)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f00000008c0)={0x1c, r4, 0x1, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000200)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r0, 0x7b1, &(0x7f0000002180)={0x0, 0x5, 0x0, 0x9}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWCHAIN={0x158, 0x3, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x9}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_USERDATA={0x76, 0xc, "9d6756194bbf8102de1ea24fb8c7bec180f5c67b73de458b48227875206fe48ac032caf647b2cd7dcf0639184bb432ed3408bdba961e6b8798c497851caae5d0386f72a70bda5f9a2248fd4feebda43b302714f366e3da32dc470a9660898326d08c1770968ffc4fcc4d5ea6093f2d336686"}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}, @NFTA_CHAIN_USERDATA={0x6d, 0xc, "93cdd73253dc3e5af233eb65fa22dc90601c8d8b892281d13253e3516be96d8a533cb5ef8988a118684694bd0fccc1cce79bb7bd117e8cc0caa83dc5a38b0ea7b6d7f40218fd55774b9671e31b01d6ac71e7f21f97ec83b6e4276046e645bbb7edd8ac15eaf74c2d19"}, @NFTA_CHAIN_COUNTERS={0x34, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xffffffffffffbe43}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xffffffffffffffff}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x100}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x5}]}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x180}, 0x1, 0x0, 0x0, 0x10}, 0x8084) 332.504µs ago: executing program 0 (id=1257): sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, 0x0, 0x40814) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f7274"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) ustat(0x11, &(0x7f0000000600)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x14, 0x7, 0x6, 0x3, 0x0, 0x0, {0xa, 0x0, 0x44}}, 0x14}}, 0x80) r3 = socket$can_bcm(0x1d, 0x2, 0x2) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000000)=0x4011, 0x4) connect$can_bcm(r3, &(0x7f00000005c0), 0x10) sendmsg$can_bcm(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) r4 = syz_io_uring_setup(0x4329, &(0x7f0000000180)={0x0, 0x776c, 0x110c9, 0x6, 0x160}, &(0x7f0000000100), &(0x7f0000000200), &(0x7f0000000000)) r5 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000140)={0x80000008}) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r4, 0xc, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x4) close(r2) socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000080)={'gretap0\x00', &(0x7f0000000380)={'syztnl0\x00', 0x0, 0x80, 0x80, 0x0, 0x7, {{0x8, 0x4, 0x0, 0x0, 0x20, 0x67, 0x0, 0x3, 0x2f, 0x0, @multicast2, @private=0xa010101, {[@timestamp={0x44, 0xc, 0x4d, 0x0, 0x4, [0x3, 0x5]}]}}}}}) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000fc0)="985e44efeabe001cabcfba21f157593d8673c3a254a9a2d3197970cb347b70a243bf77139a00bc3ae91684aaf7b7dff6", 0x30}], 0x1}}], 0x1, 0x80) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, 0x0) 0s ago: executing program 4 (id=1258): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) connect$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r1 = eventfd(0x5) r2 = fcntl$dupfd(r0, 0x406, r1) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./my_configfs/usb_gadget/g1\x00', 0x3b) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1b6) mkdir(0x0, 0x1ff) mkdir(&(0x7f0000000240)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1f7) symlink(&(0x7f0000000e00)='./my_configfs/target/core/rd_mcp_0/dev0\x00', &(0x7f0000000f00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00') write$binfmt_elf64(r2, &(0x7f0000000400)=ANY=[], 0xfffffdcf) connect$unix(r2, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) kernel console output (not intermixed with test programs): _gadget_register_driver returned -16 [ 233.658510][ T8803] syzkaller0: entered promiscuous mode [ 233.660452][ T8803] syzkaller0: entered allmulticast mode [ 233.779891][ T8805] input: syz1 as /devices/virtual/input/input90 [ 233.791254][ T8808] ceph: Path missing in source [ 233.799154][ T8801] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.803397][ T8801] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.949390][ T8810] netlink: 12 bytes leftover after parsing attributes in process `syz.3.739'. [ 234.554302][ T8813] dvmrp8: entered allmulticast mode [ 235.634871][ T8838] netlink: 100 bytes leftover after parsing attributes in process `syz.3.746'. [ 235.891302][ T845] usb 7-1: USB disconnect, device number 17 [ 236.214183][ T8842] bridge0: port 2(bridge_slave_1) entered disabled state [ 236.218147][ T8842] bridge0: port 1(bridge_slave_0) entered disabled state [ 236.352593][ T8842] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 236.359235][ T8842] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 236.559481][ T5819] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.565926][ T5819] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.571230][ T5819] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.580214][ T5819] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 237.229111][ T29] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 237.235207][ T1042] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 237.379736][ T29] usb 8-1: Using ep0 maxpacket: 8 [ 237.384862][ T29] usb 8-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 237.388593][ T29] usb 8-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 237.392962][ T29] usb 8-1: config 0 interface 0 has no altsetting 0 [ 237.395868][ T29] usb 8-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 237.399878][ T29] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.420196][ T29] usb 8-1: config 0 descriptor?? [ 237.713683][ T5750] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 237.719546][ T5750] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 237.724865][ T5750] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 237.728678][ T5750] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 237.731595][ T5750] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 237.894781][ T29] hid_parser_main: 18 callbacks suppressed [ 237.894797][ T29] mcp2221 0003:04D8:00DD.0039: unknown main item tag 0x0 [ 237.934749][ T29] mcp2221 0003:04D8:00DD.0039: unknown main item tag 0x0 [ 237.953341][ T29] mcp2221 0003:04D8:00DD.0039: unknown main item tag 0x0 [ 237.968894][ T29] mcp2221 0003:04D8:00DD.0039: unknown main item tag 0x0 [ 237.987202][ T29] mcp2221 0003:04D8:00DD.0039: unknown main item tag 0x0 [ 237.998266][ T29] mcp2221 0003:04D8:00DD.0039: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 238.048558][ T5819] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.059314][ T8855] netlink: 8 bytes leftover after parsing attributes in process `syz.3.751'. [ 238.140907][ T1042] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 238.234563][ T5819] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.454829][ T5819] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.591285][ T5819] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.767166][ T1042] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 238.771921][ T1042] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 238.775912][ T8857] bridge0: port 1(bridge_slave_0) entered blocking state [ 238.775974][ T1042] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 238.783575][ T1042] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.783610][ T8857] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.793915][ T8857] bridge_slave_0: entered allmulticast mode [ 238.793956][ T1042] usb 5-1: config 0 descriptor?? [ 238.802675][ T8857] bridge_slave_0: entered promiscuous mode [ 238.808507][ T8857] bridge0: port 2(bridge_slave_1) entered blocking state [ 238.813218][ T8857] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.817855][ T8857] bridge_slave_1: entered allmulticast mode [ 238.824489][ T8857] bridge_slave_1: entered promiscuous mode [ 238.830260][ T5842] usb 8-1: USB disconnect, device number 16 [ 238.891039][ T8857] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 238.895778][ T8857] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 238.934247][ T8857] team0: Port device team_slave_0 added [ 238.948298][ T8857] team0: Port device team_slave_1 added [ 238.952674][ T5819] bridge_slave_1: left allmulticast mode [ 238.954896][ T5819] bridge_slave_1: left promiscuous mode [ 238.960772][ T5819] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.966220][ T8889] netlink: 100 bytes leftover after parsing attributes in process `syz.2.757'. [ 238.969941][ T5819] bridge_slave_0: left allmulticast mode [ 238.971877][ T5819] bridge_slave_0: left promiscuous mode [ 238.973887][ T5819] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.993162][ T5819] batman_adv: batadv0: Interface deactivated: geneve2 [ 239.032964][ T8890] syz.2.757 invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_COMP), order=0, oom_score_adj=1000 [ 239.038079][ T8890] CPU: 1 UID: 0 PID: 8890 Comm: syz.2.757 Not tainted syzkaller #0 PREEMPT(full) [ 239.038096][ T8890] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 239.038104][ T8890] Call Trace: [ 239.038109][ T8890] [ 239.038114][ T8890] dump_stack_lvl+0x100/0x190 [ 239.038134][ T8890] dump_header+0xfb/0x606 [ 239.038151][ T8890] oom_kill_process.cold+0xd/0x330 [ 239.038169][ T8890] out_of_memory+0x340/0x14f0 [ 239.038200][ T8890] ? __pfx_out_of_memory+0x10/0x10 [ 239.038234][ T8890] mem_cgroup_out_of_memory+0xc6/0x130 [ 239.038258][ T8890] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 239.038279][ T8890] ? find_held_lock+0x2b/0x80 [ 239.038300][ T8890] ? do_raw_spin_unlock+0x145/0x1e0 [ 239.038314][ T8890] ? _raw_spin_unlock+0x28/0x50 [ 239.038329][ T8890] try_charge_memcg+0x6e5/0xdf0 [ 239.038348][ T8890] ? __pfx_try_charge_memcg+0x10/0x10 [ 239.038370][ T8890] ? find_held_lock+0x2b/0x80 [ 239.038384][ T8890] ? rcu_read_unlock+0x17/0x60 [ 239.038402][ T8890] ? rcu_read_unlock+0x17/0x60 [ 239.038424][ T8890] obj_cgroup_charge_pages+0x22/0x1d0 [ 239.038443][ T8890] __memcg_kmem_charge_page+0x1c1/0x4d0 [ 239.038464][ T8890] __alloc_frozen_pages_noprof+0x365/0x2dc0 [ 239.038484][ T8890] ? __lock_acquire+0x49f/0x1a40 [ 239.038500][ T8890] ? stack_trace_save+0x8e/0xc0 [ 239.038517][ T8890] ? __pfx_stack_trace_save+0x10/0x10 [ 239.038532][ T8890] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 239.038547][ T8890] ? lock_acquire+0x1b9/0x370 [ 239.038567][ T8890] ? __lock_acquire+0x49f/0x1a40 [ 239.038589][ T8890] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 239.038606][ T8890] ? policy_nodemask+0xed/0x4f0 [ 239.038623][ T8890] alloc_pages_mpol+0x1fb/0x540 [ 239.038639][ T8890] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 239.038654][ T8890] ? __memcg_slab_post_alloc_hook+0x749/0x1160 [ 239.038675][ T8890] alloc_pages_noprof+0x1a/0x160 [ 239.038686][ T8890] pgd_alloc+0x4d/0x630 [ 239.038704][ T8890] ? mutex_init_lockdep+0xf1/0x120 [ 239.038716][ T8890] mm_init+0x6ab/0xf00 [ 239.038729][ T8890] mm_alloc+0x47/0x60 [ 239.038740][ T8890] alloc_bprm+0x2ba/0x9d0 [ 239.038759][ T8890] do_execveat_common.isra.0+0x19c/0x580 [ 239.038776][ T8890] ? do_getname+0x191/0x390 [ 239.038791][ T8890] __ia32_compat_sys_execve+0x9c/0xd0 [ 239.038809][ T8890] __do_fast_syscall_32+0xe7/0x970 [ 239.038827][ T8890] do_fast_syscall_32+0x32/0x70 [ 239.038843][ T8890] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 239.038858][ T8890] RIP: 0023:0xf702efec [ 239.038876][ T8890] Code: Unable to access opcode bytes at 0xf702efc2. [ 239.038881][ T8890] RSP: 002b:00000000f53fc50c EFLAGS: 00000292 ORIG_RAX: 000000000000000b [ 239.038892][ T8890] RAX: ffffffffffffffda RBX: 00000000800000c0 RCX: 0000000000000000 [ 239.038899][ T8890] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 239.038905][ T8890] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 239.038928][ T8890] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 239.038936][ T8890] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 239.038952][ T8890] [ 239.149033][ T8890] memory: usage 8kB, limit 8kB, failcnt 40 [ 239.151065][ T8890] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 239.153513][ T8890] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 239.155738][ T8890] Memory cgroup stats for /syz2/test: [ 239.155962][ T8890] cache 0 [ 239.160309][ T8890] rss 0 [ 239.161169][ T5819] batman_adv: batadv0: Removing interface: geneve2 [ 239.161290][ T8890] rss_huge 0 [ 239.164675][ T8890] shmem 0 [ 239.165702][ T8890] mapped_file 0 [ 239.166880][ T8890] dirty 0 [ 239.167898][ T8890] writeback 0 [ 239.169209][ T8890] workingset_refault_anon 0 [ 239.171000][ T8890] workingset_refault_file 0 [ 239.172518][ T8890] swap 0 [ 239.173512][ T8890] swapcached 0 [ 239.174951][ T8890] pgpgin 0 [ 239.176025][ T8890] pgpgout 0 [ 239.177357][ T8890] pgfault 0 [ 239.178453][ T8890] pgmajfault 0 [ 239.179769][ T8890] inactive_anon 0 [ 239.181010][ T8890] active_anon 0 [ 239.182281][ T8890] inactive_file 0 [ 239.183518][ T8890] active_file 0 [ 239.184729][ T8890] unevictable 0 [ 239.185920][ T8890] hierarchical_memory_limit 8192 [ 239.188429][ T8890] hierarchical_memsw_limit 9223372036854771712 [ 239.191367][ T8890] total_cache 0 [ 239.192639][ T8890] total_rss 0 [ 239.193811][ T8890] total_rss_huge 0 [ 239.195089][ T8890] total_shmem 0 [ 239.196266][ T8890] total_mapped_file 0 [ 239.197632][ T8890] total_dirty 0 [ 239.198821][ T8890] total_writeback 0 [ 239.200129][ T8890] total_workingset_refault_anon 0 [ 239.201792][ T8890] total_workingset_refault_file 0 [ 239.203905][ T8890] total_swap 0 [ 239.206657][ T8890] total_swapcached 0 [ 239.208082][ T8890] total_pgpgin 0 [ 239.210091][ T1042] plantronics 0003:047F:FFFF.003A: unknown main item tag 0x0 [ 239.212553][ T8890] total_pgpgout 0 [ 239.214064][ T8890] total_pgfault 0 [ 239.215414][ T1042] plantronics 0003:047F:FFFF.003A: unknown main item tag 0x0 [ 239.217828][ T8890] total_pgmajfault 0 [ 239.219216][ T8890] total_inactive_anon 0 [ 239.220636][ T1042] plantronics 0003:047F:FFFF.003A: unknown main item tag 0x0 [ 239.223053][ T8890] total_active_anon 0 [ 239.224403][ T1042] plantronics 0003:047F:FFFF.003A: unknown main item tag 0x0 [ 239.228881][ T1042] plantronics 0003:047F:FFFF.003A: unknown main item tag 0x0 [ 239.231480][ T8890] total_inactive_file 0 [ 239.232870][ T8890] total_active_file 0 [ 239.235560][ T8890] total_unevictable 0 [ 239.238583][ T8890] anon_cost 0 [ 239.242794][ T8890] file_cost 0 [ 239.243943][ T8890] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2/test,task_memcg=/syz2/test,task=syz.2.757,pid=8888,uid=0 [ 239.249572][ T1042] plantronics 0003:047F:FFFF.003A: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 239.258130][ T8890] Memory cgroup out of memory: Killed process 8888 (syz.2.757) total-vm:102288kB, anon-rss:256kB, file-rss:22952kB, shmem-rss:0kB, UID:0 pgtables:116kB oom_score_adj:1000 [ 239.273175][ T8857] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 239.275630][ T8857] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 239.284183][ T8857] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 239.289435][ T8857] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 239.291823][ T8857] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 239.300342][ T8857] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 239.332331][ T8857] hsr_slave_0: entered promiscuous mode [ 239.334777][ T8857] hsr_slave_1: entered promiscuous mode [ 239.336957][ T8857] debugfs: 'hsr0' already exists in 'hsr' [ 239.338779][ T8857] Cannot create hsr debugfs directory [ 239.503498][ T5456] 8021q: adding VLAN 0 to HW filter on device eth1 [ 239.553669][ T8906] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 239.556798][ T8857] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 239.559504][ T8906] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 239.570704][ T8857] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 239.584653][ T8857] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 239.595483][ T8857] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 239.598399][ T8857] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 239.603777][ T8857] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 239.606580][ T8857] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 239.610889][ T8857] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 239.687583][ T5819] hsr_slave_0: left promiscuous mode [ 239.689859][ T5819] hsr_slave_1: left promiscuous mode [ 239.693882][ T5819] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 239.696705][ T5819] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 239.763968][ T8906] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 239.768346][ T8906] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 239.789159][ T5750] Bluetooth: hci4: command tx timeout [ 239.824190][ T5819] team0 (unregistering): Port device team_slave_1 removed [ 239.837279][ T5819] team0 (unregistering): Port device team_slave_0 removed [ 239.962788][ T5456] 8021q: adding VLAN 0 to HW filter on device eth2 [ 239.981771][ T8857] 8021q: adding VLAN 0 to HW filter on device bond0 [ 239.994273][ T8857] 8021q: adding VLAN 0 to HW filter on device team0 [ 240.000113][ T224] bridge0: port 1(bridge_slave_0) entered blocking state [ 240.002483][ T224] bridge0: port 1(bridge_slave_0) entered forwarding state [ 240.010409][ T224] bridge0: port 2(bridge_slave_1) entered blocking state [ 240.013451][ T224] bridge0: port 2(bridge_slave_1) entered forwarding state [ 240.046035][ T8857] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 240.049626][ T8857] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 240.159945][ T5456] 8021q: adding VLAN 0 to HW filter on device eth3 [ 240.319369][ T8857] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 240.333058][ T5456] 8021q: adding VLAN 0 to HW filter on device eth4 [ 240.342642][ T5819] IPVS: stop unused estimator thread 0... [ 240.512754][ T8857] veth0_vlan: entered promiscuous mode [ 240.522676][ T8857] veth1_vlan: entered promiscuous mode [ 240.545321][ T8857] veth0_macvtap: entered promiscuous mode [ 240.550129][ T8857] veth1_macvtap: entered promiscuous mode [ 240.562905][ T8857] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 240.571248][ T8857] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 240.647929][ T224] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 240.659115][ T224] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 240.679075][ T5819] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.682029][ T5819] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.693890][ T6619] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 240.696381][ T6619] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 240.719697][ T5819] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.722783][ T5819] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.753223][ T8960] ceph: Path missing in source [ 240.883502][ T8963] netlink: 12 bytes leftover after parsing attributes in process `syz.4.753'. [ 240.891860][ T8963] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input93 [ 241.229974][ T5849] usb 5-1: USB disconnect, device number 24 [ 241.869069][ T5750] Bluetooth: hci4: command tx timeout [ 241.875604][ T8976] netlink: 100 bytes leftover after parsing attributes in process `syz.0.765'. [ 241.934874][ T8980] [U]  [ 242.036334][ T8984] binder: 8979:8984 ioctl 4040aea0 800000c0 returned -22 [ 242.837454][ T8991] FAULT_INJECTION: forcing a failure. [ 242.837454][ T8991] name failslab, interval 1, probability 0, space 0, times 0 [ 242.842500][ T8991] CPU: 3 UID: 0 PID: 8991 Comm: syz.0.769 Not tainted syzkaller #0 PREEMPT(full) [ 242.842517][ T8991] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 242.842524][ T8991] Call Trace: [ 242.842529][ T8991] [ 242.842534][ T8991] dump_stack_lvl+0x100/0x190 [ 242.842554][ T8991] should_fail_ex.cold+0x5/0xa [ 242.842568][ T8991] should_failslab+0xc2/0x120 [ 242.842585][ T8991] __kmalloc_noprof+0xfc/0x820 [ 242.842600][ T8991] ? tomoyo_encode2+0xfb/0x3c0 [ 242.842621][ T8991] tomoyo_encode2+0xfb/0x3c0 [ 242.842640][ T8991] tomoyo_encode+0x29/0x50 [ 242.842656][ T8991] tomoyo_realpath_from_path+0x18c/0x690 [ 242.842677][ T8991] tomoyo_path_number_perm+0x23c/0x580 [ 242.842692][ T8991] ? tomoyo_path_number_perm+0x22e/0x580 [ 242.842708][ T8991] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 242.842724][ T8991] ? get_pid_task+0x106/0x250 [ 242.842751][ T8991] ? find_held_lock+0x2b/0x80 [ 242.842765][ T8991] ? __fget_files+0x215/0x3d0 [ 242.842776][ T8991] ? hook_file_ioctl_common+0x140/0x440 [ 242.842792][ T8991] ? __fget_files+0x215/0x3d0 [ 242.842809][ T8991] ? __fget_files+0x21f/0x3d0 [ 242.842822][ T8991] security_file_ioctl_compat+0xd3/0x230 [ 242.842852][ T8991] __ia32_compat_sys_ioctl+0xc2/0x360 [ 242.842871][ T8991] __do_fast_syscall_32+0xe7/0x970 [ 242.842889][ T8991] ? lockdep_hardirqs_on+0x78/0x100 [ 242.842906][ T8991] do_fast_syscall_32+0x32/0x70 [ 242.842922][ T8991] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 242.842937][ T8991] RIP: 0023:0xf7fa3fec [ 242.842952][ T8991] Code: Unable to access opcode bytes at 0xf7fa3fc2. [ 242.842957][ T8991] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 242.842969][ T8991] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080207450 [ 242.842976][ T8991] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 242.842982][ T8991] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 242.842988][ T8991] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 242.842994][ T8991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 242.843008][ T8991] [ 242.843046][ T8991] ERROR: Out of memory at tomoyo_realpath_from_path. [ 242.992137][ T8997] ceph: Path missing in source [ 243.117191][ T8999] netlink: 12 bytes leftover after parsing attributes in process `syz.2.772'. [ 243.126185][ T8999] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input95 [ 243.189478][ T5849] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 243.340223][ T5849] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 243.344181][ T5849] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 243.347384][ T5849] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 243.351713][ T5849] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 243.354686][ T5849] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.360016][ T5849] usb 5-1: config 0 descriptor?? [ 243.768130][ T5849] hid_parser_main: 4 callbacks suppressed [ 243.768146][ T5849] plantronics 0003:047F:FFFF.003B: unknown main item tag 0x0 [ 243.772511][ T5849] plantronics 0003:047F:FFFF.003B: unknown main item tag 0x0 [ 243.774972][ T5849] plantronics 0003:047F:FFFF.003B: unknown main item tag 0x0 [ 243.777438][ T5849] plantronics 0003:047F:FFFF.003B: unknown main item tag 0x0 [ 243.780055][ T5849] plantronics 0003:047F:FFFF.003B: unknown main item tag 0x0 [ 243.782409][ T5849] plantronics 0003:047F:FFFF.003B: unknown main item tag 0x0 [ 243.784749][ T5849] plantronics 0003:047F:FFFF.003B: unknown main item tag 0x0 [ 243.787183][ T5849] plantronics 0003:047F:FFFF.003B: unknown main item tag 0x0 [ 243.789664][ T5849] plantronics 0003:047F:FFFF.003B: unknown main item tag 0x0 [ 243.797354][ T5849] plantronics 0003:047F:FFFF.003B: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 243.949085][ T5750] Bluetooth: hci4: command tx timeout [ 244.091664][ T9011] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 244.094553][ T9011] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 244.307356][ T9011] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 244.330808][ T9011] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 244.886394][ T9014] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.889294][ T9014] bridge0: port 1(bridge_slave_0) entered disabled state [ 245.130199][ T9014] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 245.142163][ T9014] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 245.151947][ T845] libceph: connect (1)[c::]:6789 error -101 [ 245.154197][ T845] libceph: mon0 (1)[c::]:6789 connect error [ 245.200873][ T9020] ceph: No mds server is up or the cluster is laggy [ 245.370132][ T13] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.372968][ T13] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.375817][ T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.378841][ T13] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.710344][ T9035] ceph: Path missing in source [ 245.863290][ T5827] usb 5-1: USB disconnect, device number 25 [ 245.866776][ T9040] [U]  [ 246.019156][ T5750] Bluetooth: hci4: command tx timeout [ 246.273418][ T9037] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input97 [ 246.549637][ T9052] syzkaller0: entered promiscuous mode [ 246.552698][ T9052] syzkaller0: entered allmulticast mode [ 246.621759][ T9055] Invalid argument reading file caps for ./file0 [ 246.902302][ T9064] xt_CONNSECMARK: invalid mode: 5 [ 247.245423][ T9069] [U]  [ 247.385351][ T9075] [U]  [ 247.453319][ T9080] binder: 9074:9080 ioctl 4040aea0 800000c0 returned -22 [ 247.489100][ T5849] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 247.539304][ T9083] netlink: 100 bytes leftover after parsing attributes in process `syz.2.797'. [ 247.590282][ T9085] loop8: detected capacity change from 0 to 7 [ 247.601950][ C0] blk_print_req_error: 122 callbacks suppressed [ 247.601984][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.607091][ C0] buffer_io_error: 138 callbacks suppressed [ 247.607099][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 247.612804][ C1] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.615918][ C1] Buffer I/O error on dev loop8, logical block 0, async page read [ 247.619392][ C1] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.622756][ C1] Buffer I/O error on dev loop8, logical block 0, async page read [ 247.640110][ C3] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.643379][ C3] Buffer I/O error on dev loop8, logical block 0, async page read [ 247.647024][ C3] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.650625][ C3] Buffer I/O error on dev loop8, logical block 0, async page read [ 247.654995][ C3] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.658600][ C3] Buffer I/O error on dev loop8, logical block 0, async page read [ 247.662212][ C3] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.665394][ C3] Buffer I/O error on dev loop8, logical block 0, async page read [ 247.667950][ T9085] ldm_validate_partition_table(): Disk read failed. [ 247.671377][ T5849] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 247.675212][ C3] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.678346][ C3] Buffer I/O error on dev loop8, logical block 0, async page read [ 247.680976][ T5849] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 247.684423][ T5849] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 247.689232][ C3] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.692707][ C3] Buffer I/O error on dev loop8, logical block 0, async page read [ 247.695351][ T5849] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 247.698279][ C3] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.698335][ C3] Buffer I/O error on dev loop8, logical block 0, async page read [ 247.704983][ T9085] Dev loop8: unable to read RDB block 0 [ 247.707217][ T9085] loop8: unable to read partition table [ 247.710028][ T5849] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.742475][ T9085] loop8: partition table beyond EOD, truncated [ 247.745329][ T9085] loop_reread_partitions: partition scan of loop8 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 247.749764][ T5849] usb 5-1: config 0 descriptor?? [ 247.851496][ T9090] netlink: 'syz.4.799': attribute type 1 has an invalid length. [ 247.854065][ T9090] netlink: 12 bytes leftover after parsing attributes in process `syz.4.799'. [ 248.159278][ T5849] plantronics 0003:047F:FFFF.003C: unknown main item tag 0x0 [ 248.170845][ T5849] plantronics 0003:047F:FFFF.003C: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 248.519529][ T9101] [U]  [ 248.535227][ T9099] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 248.539128][ T9099] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 248.568737][ T9103] netlink: 'syz.4.803': attribute type 1 has an invalid length. [ 248.659003][ T9112] netlink: 100 bytes leftover after parsing attributes in process `syz.2.806'. [ 248.732750][ T9116] netlink: 52 bytes leftover after parsing attributes in process `syz.3.808'. [ 248.752756][ T9099] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 248.756717][ T9099] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 248.854487][ T9123] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 249.051887][ T42] audit: type=1800 audit(1786007428.649:6): pid=9127 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.811" name="idProduct" dev="configfs" ino=25930 res=0 errno=0 [ 249.275264][ T9136] [U]  [ 249.343958][ T9137] binder: 9135:9137 ioctl 4040aea0 800000c0 returned -22 [ 250.149056][ T9147] netlink: 100 bytes leftover after parsing attributes in process `syz.0.818'. [ 250.240834][ T9] usb 5-1: USB disconnect, device number 26 [ 250.288747][ T9152] loop5: detected capacity change from 0 to 4095 [ 250.339089][ T9153] tmpfs: Unknown parameter 'nr_inod' [ 250.753149][ T34] kernel read not supported for file /dsp1 (pid: 34 comm: kworker/3:0) [ 250.864981][ T9159] netlink: 'syz.2.821': attribute type 1 has an invalid length. [ 250.885891][ T9159] 8021q: adding VLAN 0 to HW filter on device bond2 [ 251.589042][ T6004] usb 8-1: new low-speed USB device number 17 using dummy_hcd [ 251.699654][ T5827] usb 7-1: new low-speed USB device number 18 using dummy_hcd [ 251.751134][ T6004] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 251.754423][ T6004] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 251.758822][ T6004] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 251.764162][ T6004] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 251.769149][ T6004] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 251.774847][ T6004] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 251.778104][ T6004] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 251.783579][ T6004] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 251.788493][ T6004] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 251.793394][ T6004] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 251.799316][ T6004] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 251.802595][ T6004] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 251.807025][ T6004] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 251.811967][ T6004] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 251.816563][ T6004] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 251.824196][ T6004] usb 8-1: string descriptor 0 read error: -22 [ 251.827020][ T6004] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 251.830828][ T6004] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.839051][ T1351] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 251.851693][ T6004] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 251.870434][ T5827] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 251.873286][ T5827] usb 7-1: config 0 has no interface number 0 [ 251.875336][ T5827] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 251.878833][ T5827] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 251.882473][ T5827] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 251.886362][ T5827] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 251.892004][ T5827] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 251.896258][ T5827] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 251.902562][ T5827] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 251.906380][ T5827] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.915630][ T5827] usb 7-1: config 0 descriptor?? [ 251.920575][ T9181] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 251.922989][ T9181] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 251.928420][ T5827] ldusb 7-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 252.001268][ T1351] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 252.006109][ T1351] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 252.010406][ T1351] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 252.015929][ T1351] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 252.020024][ T1351] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.025464][ T1351] usb 9-1: config 0 descriptor?? [ 252.066041][ T5827] usb 8-1: USB disconnect, device number 17 [ 252.126557][ T9195] netlink: 100 bytes leftover after parsing attributes in process `syz.0.828'. [ 252.133450][ T24] usb 7-1: USB disconnect, device number 18 [ 252.145677][ T24] ldusb 7-1:0.55: LD USB Device #1 now disconnected [ 252.435409][ T1351] hid_parser_main: 8 callbacks suppressed [ 252.435425][ T1351] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 252.439758][ T1351] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 252.442123][ T1351] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 252.444451][ T1351] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 252.446763][ T1351] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 252.449271][ T1351] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 252.451850][ T1351] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 252.454192][ T1351] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 252.456519][ T1351] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 252.461926][ T1351] plantronics 0003:047F:FFFF.003D: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 252.489821][ T5827] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 252.641679][ T5827] usb 5-1: Using ep0 maxpacket: 8 [ 252.645618][ T5827] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 252.651381][ T5827] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 252.655452][ T5827] usb 5-1: config 0 interface 0 has no altsetting 0 [ 252.658275][ T5827] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 252.662969][ T5827] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.671242][ T5827] usb 5-1: config 0 descriptor?? [ 252.757179][ T9206] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 252.761380][ T9206] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 252.966573][ T9206] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 252.973775][ T9206] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 253.087969][ T5827] mcp2221 0003:04D8:00DD.003E: unknown main item tag 0x0 [ 253.091102][ T5827] mcp2221 0003:04D8:00DD.003E: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 253.285680][ T9198] netlink: 8 bytes leftover after parsing attributes in process `syz.0.829'. [ 253.909715][ T24] usb 5-1: USB disconnect, device number 27 [ 255.199873][ T9235] netlink: 100 bytes leftover after parsing attributes in process `syz.0.837'. [ 255.213956][ T9237] netlink: 'syz.2.839': attribute type 2 has an invalid length. [ 255.220337][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.223656][ T1443] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.226301][ T9239] ceph: Path missing in source [ 255.349051][ T6004] usb 9-1: reset high-speed USB device number 2 using dummy_hcd [ 255.352094][ T6004] usb 9-1: device reset changed ep0 maxpacket size! [ 255.354560][ T1351] usb 9-1: USB disconnect, device number 2 [ 255.397990][ T9246] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input100 [ 255.519124][ T1351] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 255.669023][ T1351] usb 9-1: Using ep0 maxpacket: 8 [ 255.685560][ T1351] usb 9-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 255.699058][ T1351] usb 9-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 255.703025][ T1351] usb 9-1: config 0 interface 0 has no altsetting 0 [ 255.705293][ T1351] usb 9-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 255.708165][ T1351] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.714721][ T1351] usb 9-1: config 0 descriptor?? [ 255.729053][ T845] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 255.880297][ T845] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 255.883966][ T845] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 255.887488][ T845] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 255.891851][ T845] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 255.894762][ T845] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.899156][ T845] usb 7-1: config 0 descriptor?? [ 256.130728][ T1351] mcp2221 0003:04D8:00DD.003F: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 256.209339][ T24] libceph: connect (1)[c::]:6789 error -101 [ 256.211545][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 256.213878][ T24] libceph: connect (1)[c::]:6789 error -101 [ 256.215931][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 256.256574][ T9254] ceph: No mds server is up or the cluster is laggy [ 256.314713][ T845] plantronics 0003:047F:FFFF.0040: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 256.335103][ T1351] usb 9-1: USB disconnect, device number 3 [ 256.634566][ T9266] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 256.637769][ T9266] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 256.843673][ T9266] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 256.847233][ T9266] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 257.392917][ T9269] bridge0: port 2(bridge_slave_1) entered disabled state [ 257.395922][ T9269] bridge0: port 1(bridge_slave_0) entered disabled state [ 257.605857][ T9269] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 257.638404][ T9269] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 257.920517][ T9274] ceph: Path missing in source [ 257.940084][ T5819] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.943716][ T5819] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.947431][ T5819] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.952058][ T5819] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.007918][ T9278] ceph: Path missing in source [ 258.049047][ T9279] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input102 [ 258.149456][ T9282] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input103 [ 258.205103][ T9285] netlink: 100 bytes leftover after parsing attributes in process `syz.2.850'. [ 258.336249][ T9287] syzkaller0: entered promiscuous mode [ 258.341322][ T9287] syzkaller0: entered allmulticast mode [ 258.415668][ T845] usb 7-1: USB disconnect, device number 19 [ 258.960583][ T9305] syzkaller0: entered promiscuous mode [ 258.962479][ T9305] syzkaller0: entered allmulticast mode [ 258.977755][ T9308] [U]  [ 259.047974][ T9309] binder: 9307:9309 ioctl 4040aea0 800000c0 returned -22 [ 259.908481][ T9312] netlink: 100 bytes leftover after parsing attributes in process `syz.0.859'. [ 259.977956][ T9318] FAULT_INJECTION: forcing a failure. [ 259.977956][ T9318] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 259.983782][ T9318] CPU: 3 UID: 0 PID: 9318 Comm: syz.4.860 Not tainted syzkaller #0 PREEMPT(full) [ 259.983809][ T9318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 259.983820][ T9318] Call Trace: [ 259.983827][ T9318] [ 259.983835][ T9318] dump_stack_lvl+0x100/0x190 [ 259.983865][ T9318] should_fail_ex.cold+0x5/0xa [ 259.983883][ T9318] ? prepare_alloc_pages+0x16d/0x5f0 [ 259.983914][ T9318] should_fail_alloc_page+0xeb/0x140 [ 259.983941][ T9318] prepare_alloc_pages+0x1f0/0x5f0 [ 259.983970][ T9318] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 259.983995][ T9318] ? __lock_acquire+0x49f/0x1a40 [ 259.984027][ T9318] ? __lock_acquire+0x49f/0x1a40 [ 259.984059][ T9318] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 259.984085][ T9318] ? find_held_lock+0x2b/0x80 [ 259.984106][ T9318] ? weighted_interleave_nid+0x3e3/0x5a0 [ 259.984137][ T9318] ? weighted_interleave_nid+0x3e3/0x5a0 [ 259.984170][ T9318] ? __pfx_weighted_interleave_nid+0x10/0x10 [ 259.984203][ T9318] ? policy_nodemask+0xed/0x4f0 [ 259.984229][ T9318] alloc_pages_mpol+0x1fb/0x540 [ 259.984256][ T9318] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 259.984279][ T9318] ? __pfx___might_resched+0x10/0x10 [ 259.984313][ T9318] folio_alloc_mpol_noprof+0x36/0x260 [ 259.984343][ T9318] vma_alloc_folio_noprof+0xed/0x1d0 [ 259.984360][ T9318] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 259.984387][ T9318] ? rcu_read_unlock+0x2d/0xb0 [ 259.984405][ T9318] ? rcu_read_unlock+0x2d/0xb0 [ 259.984429][ T9318] do_wp_page+0xd75/0x4350 [ 259.984463][ T9318] ? __pfx_do_wp_page+0x10/0x10 [ 259.984490][ T9318] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 259.984515][ T9318] __handle_mm_fault+0x1ab6/0x2a00 [ 259.984536][ T9318] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 259.984557][ T9318] ? __pfx___handle_mm_fault+0x10/0x10 [ 259.984575][ T9318] ? pte_offset_map_lock+0x174/0x320 [ 259.984597][ T9318] ? find_held_lock+0x2b/0x80 [ 259.984624][ T9318] ? follow_page_pte+0x4d0/0x13f0 [ 259.984652][ T9318] handle_mm_fault+0x37b/0xa30 [ 259.984673][ T9318] __get_user_pages+0x1178/0x32a0 [ 259.984706][ T9318] ? __pfx___get_user_pages+0x10/0x10 [ 259.984736][ T9318] populate_vma_page_range+0x267/0x3f0 [ 259.984762][ T9318] ? __pfx_populate_vma_page_range+0x10/0x10 [ 259.984785][ T9318] ? __pfx_find_vma_intersection+0x10/0x10 [ 259.984809][ T9318] ? __pfx_apply_vma_lock_flags+0x10/0x10 [ 259.984831][ T9318] __mm_populate+0x107/0x3a0 [ 259.984856][ T9318] ? __pfx___mm_populate+0x10/0x10 [ 259.984886][ T9318] ? up_write+0x2e5/0x5c0 [ 259.984908][ T9318] do_mlock+0x3f0/0x7f0 [ 259.984928][ T9318] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 259.984960][ T9318] ? __pfx_do_mlock+0x10/0x10 [ 259.984983][ T9318] ? fput+0x79/0x100 [ 259.985005][ T9318] ? ksys_write+0x1ac/0x250 [ 259.985022][ T9318] ? __pfx_ksys_write+0x10/0x10 [ 259.985042][ T9318] __ia32_sys_mlock+0x57/0x80 [ 259.985062][ T9318] __do_fast_syscall_32+0xe7/0x970 [ 259.985087][ T9318] ? lockdep_hardirqs_on+0x78/0x100 [ 259.985113][ T9318] do_fast_syscall_32+0x32/0x70 [ 259.985142][ T9318] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 259.985166][ T9318] RIP: 0023:0xf7ff4fec [ 259.985185][ T9318] Code: Unable to access opcode bytes at 0xf7ff4fc2. [ 259.985193][ T9318] RSP: 002b:00000000f549550c EFLAGS: 00000292 ORIG_RAX: 0000000000000096 [ 259.985212][ T9318] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000800000 [ 259.985223][ T9318] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 259.985233][ T9318] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 259.985243][ T9318] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 259.985254][ T9318] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 259.985278][ T9318] [ 260.273082][ T9324] ceph: Path missing in source [ 260.416786][ T9326] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input105 [ 260.953189][ T9336] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 261.104255][ T9340] syzkaller0: entered promiscuous mode [ 261.106021][ T9340] syzkaller0: entered allmulticast mode [ 261.160967][ T9341] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.867'. [ 261.199155][ T9343] netlink: 100 bytes leftover after parsing attributes in process `syz.0.869'. [ 261.312798][ T5827] libceph: connect (1)[c::]:6789 error -99 [ 261.316945][ T5827] libceph: mon0 (1)[c::]:6789 connect error [ 261.361403][ T9345] ceph: No mds server is up or the cluster is laggy [ 261.859022][ T5849] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 262.029096][ T5849] usb 7-1: Using ep0 maxpacket: 8 [ 262.034015][ T5849] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 262.038684][ T5849] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 262.042878][ T5849] usb 7-1: config 0 interface 0 has no altsetting 0 [ 262.045736][ T5849] usb 7-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 262.049546][ T5849] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 262.056538][ T5849] usb 7-1: config 0 descriptor?? [ 262.236675][ T9359] syzkaller0: entered promiscuous mode [ 262.238520][ T9359] syzkaller0: entered allmulticast mode [ 262.476712][ T5849] hid_parser_main: 18 callbacks suppressed [ 262.476728][ T5849] mcp2221 0003:04D8:00DD.0041: unknown main item tag 0x0 [ 262.487787][ T5849] mcp2221 0003:04D8:00DD.0041: unknown main item tag 0x0 [ 262.493275][ T5849] mcp2221 0003:04D8:00DD.0041: unknown main item tag 0x0 [ 262.495513][ T5849] mcp2221 0003:04D8:00DD.0041: unknown main item tag 0x0 [ 262.497787][ T5849] mcp2221 0003:04D8:00DD.0041: unknown main item tag 0x0 [ 262.502789][ T5849] mcp2221 0003:04D8:00DD.0041: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 262.679249][ T9357] netlink: 8 bytes leftover after parsing attributes in process `syz.2.873'. [ 262.819630][ T1351] usb 7-1: USB disconnect, device number 20 [ 263.159096][ T5827] usb 5-1: new low-speed USB device number 28 using dummy_hcd [ 263.311860][ T5827] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 263.315530][ T5827] usb 5-1: config 0 has no interface number 0 [ 263.318309][ T5827] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 263.323467][ T5827] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 263.329021][ T5827] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 263.338550][ T5827] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 263.348598][ T5827] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 263.359176][ T5827] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 263.371402][ T5827] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 263.380361][ T5827] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.393585][ T5827] usb 5-1: config 0 descriptor?? [ 263.402736][ T9361] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 263.409148][ T9361] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 263.419929][ T5827] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 263.435720][ T9372] netlink: 100 bytes leftover after parsing attributes in process `syz.3.878'. [ 263.506390][ T9374] can0: slcan on ptm0. [ 263.519303][ T9374] netlink: 'syz.3.879': attribute type 4 has an invalid length. [ 263.546932][ T9370] ipt_rpfilter: unknown options [ 263.621580][ T9361] ldusb 5-1:0.55: Write buffer overflow, 79 bytes dropped [ 263.627865][ T5827] usb 5-1: USB disconnect, device number 28 [ 263.631153][ T9373] can0 (unregistered): slcan off ptm0. [ 263.635860][ T5827] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 263.652714][ T9382] syzkaller0: entered promiscuous mode [ 263.654550][ T9382] syzkaller0: entered allmulticast mode [ 263.851513][ T5849] libceph: connect (1)[c::]:6789 error -101 [ 263.854388][ T5849] libceph: mon0 (1)[c::]:6789 connect error [ 263.888498][ T9396] ceph: No mds server is up or the cluster is laggy [ 263.937148][ T845] libceph: connect (1)[c::]:6789 error -101 [ 263.940215][ T845] libceph: mon0 (1)[c::]:6789 connect error [ 264.036089][ T9406] ceph: No mds server is up or the cluster is laggy [ 264.649265][ T845] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 264.796269][ T9420] netlink: 100 bytes leftover after parsing attributes in process `syz.4.887'. [ 264.811114][ T845] usb 5-1: Using ep0 maxpacket: 8 [ 264.852221][ T845] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 264.878840][ T845] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 264.930846][ T845] usb 5-1: config 0 interface 0 has no altsetting 0 [ 264.941547][ T845] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 264.951483][ T845] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.016329][ T845] usb 5-1: config 0 descriptor?? [ 265.482504][ T845] mcp2221 0003:04D8:00DD.0042: unknown main item tag 0x0 [ 265.497354][ T845] mcp2221 0003:04D8:00DD.0042: unknown main item tag 0x0 [ 265.516991][ T845] mcp2221 0003:04D8:00DD.0042: unknown main item tag 0x0 [ 265.537124][ T845] mcp2221 0003:04D8:00DD.0042: unknown main item tag 0x0 [ 265.563896][ T845] mcp2221 0003:04D8:00DD.0042: unknown main item tag 0x0 [ 265.595751][ T845] mcp2221 0003:04D8:00DD.0042: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 265.640425][ T9418] netlink: 8 bytes leftover after parsing attributes in process `syz.0.886'. [ 266.633470][ T1351] usb 5-1: USB disconnect, device number 29 [ 266.879005][ T845] usb 8-1: new low-speed USB device number 18 using dummy_hcd [ 267.030938][ T845] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 267.034201][ T845] usb 8-1: config 0 has no interface number 0 [ 267.036629][ T845] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 267.041650][ T845] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 267.046681][ T845] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 267.051301][ T845] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 267.055041][ T845] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 267.058502][ T845] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 267.064995][ T845] usb 8-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 267.068776][ T845] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.072733][ T845] usb 8-1: config 0 descriptor?? [ 267.075472][ T9439] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 267.077793][ T9439] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 267.085079][ T845] ldusb 8-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 267.283054][ T9439] ldusb 8-1:0.55: Write buffer overflow, 79 bytes dropped [ 267.286599][ T845] usb 8-1: USB disconnect, device number 18 [ 267.293431][ T845] ldusb 8-1:0.55: LD USB Device #0 now disconnected [ 267.439008][ T10] usb 5-1: new full-speed USB device number 30 using dummy_hcd [ 267.611742][ T9444] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 267.614886][ T9444] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 267.651370][ T9449] [U]  [ 267.735981][ T9451] binder: 9448:9451 ioctl 4040aea0 800000c0 returned -22 [ 267.837715][ T9454] ceph: Path missing in source [ 267.926760][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 268.004652][ T9456] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input113 [ 268.996145][ T9468] FAULT_INJECTION: forcing a failure. [ 268.996145][ T9468] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 269.012747][ T9468] CPU: 2 UID: 0 PID: 9468 Comm: syz.2.900 Not tainted syzkaller #0 PREEMPT(full) [ 269.012766][ T9468] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 269.012773][ T9468] Call Trace: [ 269.012778][ T9468] [ 269.012782][ T9468] dump_stack_lvl+0x100/0x190 [ 269.012803][ T9468] should_fail_ex.cold+0x5/0xa [ 269.012819][ T9468] _copy_from_user+0x2e/0xd0 [ 269.012839][ T9468] __sys_bpf+0x2f5/0x4e80 [ 269.012858][ T9468] ? __pfx___sys_bpf+0x10/0x10 [ 269.012871][ T9468] ? find_held_lock+0x2b/0x80 [ 269.012886][ T9468] ? get_pid_task+0xfc/0x250 [ 269.012901][ T9468] ? get_pid_task+0xfc/0x250 [ 269.012918][ T9468] ? proc_fail_nth_write+0x9f/0x220 [ 269.012935][ T9468] ? find_held_lock+0x2b/0x80 [ 269.012952][ T9468] ? rcu_read_lock_any_held+0x6a/0xa0 [ 269.012968][ T9468] ? find_held_lock+0x2b/0x80 [ 269.012981][ T9468] ? ksys_write+0x190/0x250 [ 269.012992][ T9468] ? ksys_write+0x190/0x250 [ 269.013011][ T9468] ? fput+0x79/0x100 [ 269.013026][ T9468] ? __ia32_sys_bpf+0xcc/0x170 [ 269.013037][ T9468] __ia32_sys_bpf+0xcc/0x170 [ 269.013050][ T9468] ? __do_fast_syscall_32+0x98/0x970 [ 269.013067][ T9468] __do_fast_syscall_32+0xe7/0x970 [ 269.013083][ T9468] ? lockdep_hardirqs_on+0x78/0x100 [ 269.013099][ T9468] do_fast_syscall_32+0x32/0x70 [ 269.013115][ T9468] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 269.013130][ T9468] RIP: 0023:0xf702efec [ 269.013145][ T9468] Code: Unable to access opcode bytes at 0xf702efc2. [ 269.013150][ T9468] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 269.013162][ T9468] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000600 [ 269.013169][ T9468] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 269.013175][ T9468] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 269.013182][ T9468] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 269.013188][ T9468] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 269.013201][ T9468] [ 269.078799][ T10] usb 5-1: no configurations [ 269.081290][ T10] usb 5-1: can't read configurations, error -22 [ 269.126632][ T9472] ceph: Path missing in source [ 269.204518][ T5849] libceph: connect (1)[c::]:6789 error -101 [ 269.206701][ T5849] libceph: mon0 (1)[c::]:6789 connect error [ 269.339796][ T9476] ceph: No mds server is up or the cluster is laggy [ 269.452022][ T9480] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input114 [ 269.709024][ T10] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 269.931180][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 269.947113][ T10] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 269.951627][ T10] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 269.962549][ T10] usb 5-1: config 0 interface 0 has no altsetting 0 [ 269.965814][ T10] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 269.977266][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.029353][ T10] usb 5-1: config 0 descriptor?? [ 270.463707][ T9488] bridge0: port 2(bridge_slave_1) entered disabled state [ 270.466270][ T9488] bridge0: port 1(bridge_slave_0) entered disabled state [ 270.607777][ T9488] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 270.614850][ T9488] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 270.769301][ T24] usb 7-1: new low-speed USB device number 21 using dummy_hcd [ 270.815533][ T10] mcp2221 0003:04D8:00DD.0043: unknown main item tag 0x0 [ 270.820708][ T10] mcp2221 0003:04D8:00DD.0043: unknown main item tag 0x0 [ 270.823135][ T10] mcp2221 0003:04D8:00DD.0043: unknown main item tag 0x0 [ 270.825454][ T10] mcp2221 0003:04D8:00DD.0043: unknown main item tag 0x0 [ 270.827741][ T10] mcp2221 0003:04D8:00DD.0043: unknown main item tag 0x0 [ 270.831029][ T10] mcp2221 0003:04D8:00DD.0043: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 270.920402][ T24] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 270.923187][ T24] usb 7-1: config 0 has no interface number 0 [ 270.925193][ T24] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 270.933457][ T24] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 270.939132][ T24] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 270.949026][ T13] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.949045][ T24] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 270.953294][ T13] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.956978][ T24] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 270.965822][ T24] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 270.972769][ T24] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 270.977899][ T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.984788][ T24] usb 7-1: config 0 descriptor?? [ 270.987851][ T9493] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 270.990615][ T9493] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 270.999324][ T24] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 271.042570][ T9477] netlink: 8 bytes leftover after parsing attributes in process `syz.0.902'. [ 271.050466][ T24] usb 5-1: USB disconnect, device number 31 [ 271.059469][ T5819] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.072947][ T5819] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.200583][ T9492] ldusb 7-1:0.55: Write buffer overflow, 79 bytes dropped [ 271.211429][ T845] usb 7-1: USB disconnect, device number 21 [ 271.219651][ T845] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 271.282021][ T9505] netlink: 72 bytes leftover after parsing attributes in process `syz.4.908'. [ 271.614042][ T9514] syzkaller0: entered promiscuous mode [ 271.619100][ T9514] syzkaller0: entered allmulticast mode [ 271.639991][ T9516] binder: 9515:9516 unknown command 4294967295 [ 271.642036][ T9516] binder: 9515:9516 ioctl c0306201 80004a40 returned -22 [ 272.232485][ T1351] libceph: connect (1)[c::]:6789 error -101 [ 272.235396][ T1351] libceph: mon0 (1)[c::]:6789 connect error [ 272.325172][ T9521] ceph: No mds server is up or the cluster is laggy [ 272.443369][ T9527] ceph: Path missing in source [ 272.728865][ T9532] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input115 [ 273.366599][ T9539] netlink: 12 bytes leftover after parsing attributes in process `syz.3.917'. [ 273.527996][ T9548] fuse: Bad value for 'fd' [ 273.555642][ T9544] bond1 (unregistering): Released all slaves [ 273.636431][ T9554] netlink: 100 bytes leftover after parsing attributes in process `syz.4.920'. [ 273.638876][ T9555] binder: 9550:9555 ioctl 4040aea0 800000c0 returned -22 [ 273.945788][ T9560] netlink: 100 bytes leftover after parsing attributes in process `syz.4.921'. [ 274.188481][ T9565] netlink: 8 bytes leftover after parsing attributes in process `syz.2.922'. [ 274.329010][ T5849] usb 9-1: new full-speed USB device number 4 using dummy_hcd [ 274.507625][ T9567] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.515130][ T9567] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.518818][ T9576] syzkaller0: entered promiscuous mode [ 274.521416][ T9576] syzkaller0: entered allmulticast mode [ 274.531631][ T5849] usb 9-1: unable to get BOS descriptor or descriptor too short [ 274.539973][ T5849] usb 9-1: no configurations [ 274.541810][ T5849] usb 9-1: can't read configurations, error -22 [ 274.921769][ T9581] kAFS: unable to lookup cell '/,cL' [ 275.295436][ T9581] binder: BINDER_SET_CONTEXT_MGR already set [ 275.303986][ T9581] binder: 9572:9581 ioctl 4018620d 80004a80 returned -16 [ 275.315631][ T9581] binder: 9572:9581 ioctl c0506107 80000180 returned -22 [ 275.497348][ T9594] netlink: 100 bytes leftover after parsing attributes in process `syz.3.931'. [ 276.427250][ T9606] netlink: 24 bytes leftover after parsing attributes in process `syz.0.934'. [ 277.807209][ T9629] ceph: Path missing in source [ 277.977303][ T9631] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input117 [ 278.382087][ T9638] netlink: 100 bytes leftover after parsing attributes in process `syz.3.941'. [ 278.996545][ T9649] netlink: 100 bytes leftover after parsing attributes in process `syz.4.944'. [ 279.069122][ T9650] binder: 9646:9650 ioctl 4040aea0 800000c0 returned -22 [ 279.134472][ T9650] [U]  [ 279.189045][ T10] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 279.319075][ T24] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 279.469355][ T24] usb 8-1: Using ep0 maxpacket: 8 [ 279.474681][ T24] usb 8-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 279.483353][ T24] usb 8-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 279.488661][ T24] usb 8-1: config 0 interface 0 has no altsetting 0 [ 279.492030][ T24] usb 8-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 279.495762][ T24] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.501480][ T24] usb 8-1: config 0 descriptor?? [ 279.744924][ T9659] binder: 9657:9659 ioctl 4040aea0 800000c0 returned -22 [ 279.835836][ T9659] [U]  [ 279.954758][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 279.962293][ T10] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 279.966764][ T10] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 279.971113][ T10] usb 5-1: config 0 interface 0 has no altsetting 0 [ 279.973642][ T10] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 279.977864][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.987084][ T10] usb 5-1: config 0 descriptor?? [ 280.259378][ T24] mcp2221 0003:04D8:00DD.0044: unknown main item tag 0x0 [ 280.261410][ T24] mcp2221 0003:04D8:00DD.0044: unknown main item tag 0x0 [ 280.263221][ T24] mcp2221 0003:04D8:00DD.0044: unknown main item tag 0x0 [ 280.265134][ T24] mcp2221 0003:04D8:00DD.0044: unknown main item tag 0x0 [ 280.267112][ T24] mcp2221 0003:04D8:00DD.0044: unknown main item tag 0x0 [ 280.278329][ T24] mcp2221 0003:04D8:00DD.0044: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 280.281620][ T9642] netlink: 8 bytes leftover after parsing attributes in process `syz.3.942'. [ 280.351010][ T24] usb 8-1: USB disconnect, device number 19 [ 280.400682][ T10] mcp2221 0003:04D8:00DD.0045: unknown main item tag 0x0 [ 280.412584][ T10] mcp2221 0003:04D8:00DD.0045: unknown main item tag 0x0 [ 280.417064][ T10] mcp2221 0003:04D8:00DD.0045: unknown main item tag 0x0 [ 280.425685][ T10] mcp2221 0003:04D8:00DD.0045: unknown main item tag 0x0 [ 280.429561][ T10] mcp2221 0003:04D8:00DD.0045: unknown main item tag 0x0 [ 280.433609][ T10] mcp2221 0003:04D8:00DD.0045: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 280.443365][ T9668] netlink: 100 bytes leftover after parsing attributes in process `syz.4.950'. [ 280.567890][ T9673] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 280.572296][ T9673] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 280.617895][ T9640] netlink: 8 bytes leftover after parsing attributes in process `syz.0.943'. [ 280.638610][ T10] usb 5-1: USB disconnect, device number 32 [ 281.359341][ T9689] FAULT_INJECTION: forcing a failure. [ 281.359341][ T9689] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 281.373459][ T9689] CPU: 0 UID: 0 PID: 9689 Comm: syz.0.955 Not tainted syzkaller #0 PREEMPT(full) [ 281.373477][ T9689] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 281.373485][ T9689] Call Trace: [ 281.373490][ T9689] [ 281.373495][ T9689] dump_stack_lvl+0x100/0x190 [ 281.373516][ T9689] should_fail_ex.cold+0x5/0xa [ 281.373531][ T9689] _copy_from_iter+0x1f4/0x1690 [ 281.373554][ T9689] ? __asan_memset+0x23/0x50 [ 281.373568][ T9689] ? __pfx__copy_from_iter+0x10/0x10 [ 281.373586][ T9689] ? __pfx___alloc_skb+0x10/0x10 [ 281.373610][ T9689] netlink_sendmsg+0x808/0xda0 [ 281.373629][ T9689] ? __pfx_netlink_sendmsg+0x10/0x10 [ 281.373644][ T9689] ? apparmor_socket_sendmsg+0x15b/0x270 [ 281.373661][ T9689] ____sys_sendmsg+0xa4d/0xbe0 [ 281.373674][ T9689] ? __pfx_netlink_sendmsg+0x10/0x10 [ 281.373688][ T9689] ? __pfx_____sys_sendmsg+0x10/0x10 [ 281.373706][ T9689] ___sys_sendmsg+0x190/0x1e0 [ 281.373720][ T9689] ? __pfx____sys_sendmsg+0x10/0x10 [ 281.373739][ T9689] ? find_held_lock+0x2b/0x80 [ 281.373763][ T9689] __sys_sendmsg+0x160/0x210 [ 281.373781][ T9689] ? __pfx___sys_sendmsg+0x10/0x10 [ 281.373801][ T9689] ? __pfx_ksys_write+0x10/0x10 [ 281.373839][ T9689] __do_fast_syscall_32+0xe7/0x970 [ 281.373856][ T9689] ? lockdep_hardirqs_on+0x78/0x100 [ 281.373872][ T9689] do_fast_syscall_32+0x32/0x70 [ 281.373889][ T9689] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 281.373904][ T9689] RIP: 0023:0xf7fa3fec [ 281.373930][ T9689] Code: Unable to access opcode bytes at 0xf7fa3fc2. [ 281.373937][ T9689] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 281.373948][ T9689] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000180 [ 281.373955][ T9689] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 281.373961][ T9689] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 281.373968][ T9689] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 281.373974][ T9689] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 281.373993][ T9689] [ 281.870672][ T5849] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 282.040556][ T5849] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 282.043870][ T5849] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 282.046783][ T5849] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 282.051154][ T5849] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 282.054005][ T5849] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 282.058133][ T5849] usb 9-1: config 0 descriptor?? [ 282.414656][ T9702] netlink: 100 bytes leftover after parsing attributes in process `syz.0.960'. [ 282.451264][ T34] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 282.478572][ T5849] plantronics 0003:047F:FFFF.0046: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 282.669069][ T34] usb 7-1: Using ep0 maxpacket: 8 [ 282.799384][ T24] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 282.804122][ T9709] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 282.807092][ T9709] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 282.949426][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 282.953763][ T24] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 282.957597][ T24] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 282.962714][ T24] usb 5-1: config 0 interface 0 has no altsetting 0 [ 282.965098][ T24] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 282.968035][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 282.979523][ T24] usb 5-1: config 0 descriptor?? [ 283.016390][ T9709] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 283.020144][ T9709] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 283.109174][ T34] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 283.428719][ T24] mcp2221 0003:04D8:00DD.0047: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 283.590704][ T9708] netlink: 8 bytes leftover after parsing attributes in process `syz.0.961'. [ 283.702285][ T34] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 283.705301][ T34] usb 7-1: config 0 interface 0 has no altsetting 0 [ 283.707360][ T34] usb 7-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 283.709164][ T10] usb 5-1: USB disconnect, device number 33 [ 283.710129][ T34] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.719483][ T34] usb 7-1: config 0 descriptor?? [ 284.131151][ T34] mcp2221 0003:04D8:00DD.0048: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 284.137758][ T9715] device-mapper: ioctl: Invalid ioctl structure: name t, dev f800 [ 284.269748][ T9718] loop4: detected capacity change from 0 to 7 [ 284.295537][ T9718] Dev loop4: unable to read RDB block 7 [ 284.297340][ T9718] loop4: unable to read partition table [ 284.323490][ T9718] loop4: partition table beyond EOD, truncated [ 284.326278][ T9718] loop_reread_partitions: partition scan of loop4 (被x ) failed (rc=-5) [ 284.335228][ T34] usb 7-1: USB disconnect, device number 22 [ 284.389584][ T9723] ceph: Path missing in source [ 284.416606][ T9724] binder: 9720:9724 ioctl 4040aea0 800000c0 returned -22 [ 284.583719][ T9727] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input119 [ 284.679677][ T9] usb 9-1: USB disconnect, device number 6 [ 284.890950][ T9731] overlay: ./file0 is not a directory [ 285.009975][ T9735] netlink: 100 bytes leftover after parsing attributes in process `syz.2.969'. [ 285.332237][ T9748] Mass Storage Function, version: 2009/09/11 [ 285.336378][ T9748] LUN: removable file: (no medium) [ 285.421888][ T9748] LUN: removable file: (no medium) [ 285.821672][ T9751] ceph: Path missing in source [ 285.859874][ T9] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 286.009170][ T9] usb 9-1: Using ep0 maxpacket: 8 [ 286.018788][ T9] usb 9-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 286.024527][ T9] usb 9-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 286.028538][ T9] usb 9-1: config 0 interface 0 has no altsetting 0 [ 286.033080][ T9] usb 9-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 286.036242][ T9] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 286.064303][ T9] usb 9-1: config 0 descriptor?? [ 286.541465][ T9] hid_parser_main: 19 callbacks suppressed [ 286.542316][ T9] mcp2221 0003:04D8:00DD.0049: unknown main item tag 0x0 [ 286.576341][ T9] mcp2221 0003:04D8:00DD.0049: unknown main item tag 0x0 [ 286.592391][ T9] mcp2221 0003:04D8:00DD.0049: unknown main item tag 0x0 [ 286.601304][ T9] mcp2221 0003:04D8:00DD.0049: unknown main item tag 0x0 [ 286.608845][ T9] mcp2221 0003:04D8:00DD.0049: unknown main item tag 0x0 [ 286.630442][ T9] mcp2221 0003:04D8:00DD.0049: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 286.686363][ T9747] netlink: 8 bytes leftover after parsing attributes in process `syz.4.972'. [ 287.499262][ T9] usb 9-1: USB disconnect, device number 7 [ 287.792086][ T9773] binder: 9771:9773 ioctl 4040aea0 800000c0 returned -22 [ 287.941131][ T9775] netlink: 100 bytes leftover after parsing attributes in process `syz.0.979'. [ 288.170281][ T9781] input: syz0 as /devices/virtual/input/input122 [ 288.245292][ T9781] Mem-Info: [ 288.247223][ T9781] active_anon:14627 inactive_anon:216 isolated_anon:0 [ 288.247223][ T9781] active_file:985 inactive_file:51721 isolated_file:0 [ 288.247223][ T9781] unevictable:1768 dirty:360 writeback:0 [ 288.247223][ T9781] slab_reclaimable:7576 slab_unreclaimable:55509 [ 288.247223][ T9781] mapped:28424 shmem:10272 pagetables:1255 [ 288.247223][ T9781] sec_pagetables:302 bounce:0 [ 288.247223][ T9781] kernel_misc_reclaimable:0 [ 288.247223][ T9781] free:28419 free_pcp:13681 free_cma:0 [ 288.263891][ T9781] Node 0 active_anon:2652kB inactive_anon:56kB active_file:12kB inactive_file:0kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:8kB writeback:0kB shmem:6136kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:9248kB pagetables:1516kB sec_pagetables:1108kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 288.276129][ T9781] Node 1 active_anon:55856kB inactive_anon:808kB active_file:3928kB inactive_file:206884kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:113668kB dirty:1432kB writeback:0kB shmem:34952kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:4892kB pagetables:3504kB sec_pagetables:100kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 288.288986][ T9781] Node 0 DMA free:2044kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4kB inactive_anon:0kB active_file:4kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:4kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:748kB local_pcp:164kB free_cma:0kB [ 288.300187][ T9781] lowmem_reserve[]: 0 280 280 280 280 [ 288.302253][ T9781] Node 0 DMA32 free:15428kB boost:0kB min:12768kB low:15960kB high:19152kB reserved_highatomic:0KB free_highatomic:0KB active_anon:2652kB inactive_anon:16kB active_file:8kB inactive_file:0kB unevictable:3536kB writepending:8kB zspages:12kB present:1032196kB managed:286916kB mlocked:0kB bounce:0kB free_pcp:9456kB local_pcp:3040kB free_cma:0kB [ 288.313986][ T9781] lowmem_reserve[]: 0 0 0 0 0 [ 288.315902][ T9781] Node 1 DMA32 free:96204kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:55856kB inactive_anon:808kB active_file:3928kB inactive_file:206884kB unevictable:3536kB writepending:1432kB zspages:2416kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:44476kB local_pcp:21728kB free_cma:0kB [ 288.328092][ T9781] lowmem_reserve[]: 0 0 0 0 0 [ 288.329925][ T9781] Node 0 DMA: 61*4kB (U) 41*8kB (UE) 18*16kB (UE) 3*32kB (UE) 5*64kB (UE) 0*128kB 1*256kB (E) 1*512kB (E) 0*1024kB 0*2048kB 0*4096kB = 2044kB [ 288.335559][ T9781] Node 0 DMA32: 375*4kB (UME) 106*8kB (UE) 53*16kB (UE) 68*32kB (UME) 53*64kB (UME) 18*128kB (ME) 1*256kB (M) 4*512kB (UM) 2*1024kB (UM) 0*2048kB 0*4096kB = 15420kB [ 288.341715][ T9781] Node 1 DMA32: 757*4kB (ME) 271*8kB (UME) 191*16kB (UME) 381*32kB (UME) 206*64kB (UME) 29*128kB (UME) 12*256kB (UME) 5*512kB (UME) 6*1024kB (UM) 11*2048kB (UME) 6*4096kB (UM) = 96220kB [ 288.348690][ T9781] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 288.352262][ T9781] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 288.355722][ T9781] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 288.359299][ T9781] Node 1 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 288.362814][ T9781] 63959 total pagecache pages [ 288.364565][ T9781] 976 pages in swap cache [ 288.366267][ T9781] Free swap = 117232kB [ 288.367877][ T9781] Total swap = 124996kB [ 288.369515][ T9781] 524155 pages RAM [ 288.371008][ T9781] 0 pages HighMem/MovableOnly [ 288.372867][ T9781] 211533 pages reserved [ 288.374526][ T9781] 0 pages cma reserved [ 288.686137][ T9789] ceph: Path missing in source [ 288.989449][ T9791] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input123 [ 289.094995][ T9799] netlink: 4 bytes leftover after parsing attributes in process `syz.0.987'. [ 289.121814][ T9799] netlink: 4 bytes leftover after parsing attributes in process `syz.0.987'. [ 289.418216][ T9806] netlink: 100 bytes leftover after parsing attributes in process `syz.4.990'. [ 289.613812][ T9812] syzkaller0: entered promiscuous mode [ 289.616135][ T9812] syzkaller0: entered allmulticast mode [ 289.836037][ T9816] binder: 9814:9816 ioctl 4040aea0 800000c0 returned -22 [ 290.146420][ T9825] openvswitch: netlink: Missing key (keys=c0, expected=1100) [ 290.152057][ T9825] tmpfs: Bad value for 'mpol' [ 290.523377][ T9839] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1000'. [ 290.526957][ T9840] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1000'. [ 291.159119][ T1351] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 291.319055][ T1351] usb 8-1: Using ep0 maxpacket: 8 [ 291.322399][ T1351] usb 8-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 291.326413][ T1351] usb 8-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 291.330015][ T1351] usb 8-1: config 0 interface 0 has no altsetting 0 [ 291.332440][ T1351] usb 8-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 291.335438][ T1351] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.339819][ T1351] usb 8-1: config 0 descriptor?? [ 291.526833][ T9850] binder: 9848:9850 ioctl 4040aea0 800000c0 returned -22 [ 291.754483][ T1351] mcp2221 0003:04D8:00DD.004A: unknown main item tag 0x0 [ 291.761325][ T1351] mcp2221 0003:04D8:00DD.004A: unknown main item tag 0x0 [ 291.763561][ T1351] mcp2221 0003:04D8:00DD.004A: unknown main item tag 0x0 [ 291.768260][ T1351] mcp2221 0003:04D8:00DD.004A: unknown main item tag 0x0 [ 291.770835][ T1351] mcp2221 0003:04D8:00DD.004A: unknown main item tag 0x0 [ 291.774554][ T1351] mcp2221 0003:04D8:00DD.004A: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 291.952268][ T1351] usb 8-1: USB disconnect, device number 20 [ 292.431970][ T9860] netlink: 'syz.4.1006': attribute type 4 has an invalid length. [ 293.383460][ T9869] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1008'. [ 293.607285][ T9884] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1015'. [ 293.611574][ T9885] netlink: 'syz.3.1011': attribute type 2 has an invalid length. [ 293.656937][ T9885] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1011'. [ 293.845636][ T9888] ucsi-stm32g0-i2c 0-0003: i2c read 03, 00 error: -95 [ 293.850708][ T9888] ucsi-stm32g0-i2c 0-0003: probe with driver ucsi-stm32g0-i2c failed with error -95 [ 293.855861][ T9888] i2c i2c-0: new_device: Instantiated device stm32g0-typec at 0x03 [ 293.932297][ T9893] FAULT_INJECTION: forcing a failure. [ 293.932297][ T9893] name failslab, interval 1, probability 0, space 0, times 0 [ 293.936449][ T9893] CPU: 2 UID: 0 PID: 9893 Comm: syz.3.1017 Not tainted syzkaller #0 PREEMPT(full) [ 293.936465][ T9893] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 293.936473][ T9893] Call Trace: [ 293.936478][ T9893] [ 293.936484][ T9893] dump_stack_lvl+0x100/0x190 [ 293.936504][ T9893] should_fail_ex.cold+0x5/0xa [ 293.936518][ T9893] should_failslab+0xc2/0x120 [ 293.936535][ T9893] __kmalloc_noprof+0xfc/0x820 [ 293.936551][ T9893] ? software_key_query+0x1b8/0xe30 [ 293.936572][ T9893] software_key_query+0x1b8/0xe30 [ 293.936591][ T9893] ? __pfx_software_key_query+0x10/0x10 [ 293.936617][ T9893] ? __pfx_software_key_query+0x10/0x10 [ 293.936636][ T9893] query_asymmetric_key+0x104/0x160 [ 293.936654][ T9893] keyctl_pkey_params_get_2+0x1c6/0x3f0 [ 293.936675][ T9893] ? __pfx_keyctl_pkey_params_get_2+0x10/0x10 [ 293.936694][ T9893] ? find_held_lock+0x2b/0x80 [ 293.936714][ T9893] keyctl_pkey_verify+0xac/0x2c0 [ 293.936732][ T9893] ? __pfx_keyctl_pkey_verify+0x10/0x10 [ 293.936749][ T9893] ? __fget_files+0x21f/0x3d0 [ 293.936764][ T9893] ? fput+0x79/0x100 [ 293.936779][ T9893] __ia32_compat_sys_keyctl+0x44f/0x550 [ 293.936798][ T9893] __do_fast_syscall_32+0xe7/0x970 [ 293.936815][ T9893] ? lockdep_hardirqs_on+0x78/0x100 [ 293.936832][ T9893] do_fast_syscall_32+0x32/0x70 [ 293.936848][ T9893] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 293.936864][ T9893] RIP: 0023:0xf7f52fec [ 293.936878][ T9893] Code: Unable to access opcode bytes at 0xf7f52fc2. [ 293.936883][ T9893] RSP: 002b:00000000f53f550c EFLAGS: 00000292 ORIG_RAX: 0000000000000120 [ 293.936894][ T9893] RAX: ffffffffffffffda RBX: 000000000000001c RCX: 0000000080000080 [ 293.936901][ T9893] RDX: 0000000080000140 RSI: 0000000000000000 RDI: 0000000000000000 [ 293.936908][ T9893] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 293.936914][ T9893] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 293.936921][ T9893] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 293.936934][ T9893] [ 294.129048][ T34] usb 7-1: new full-speed USB device number 23 using dummy_hcd [ 294.221694][ T9895] device-mapper: ioctl: Invalid ioctl structure: name mypool, dev f801 [ 294.270358][ T9898] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 294.300418][ T34] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 294.304456][ T34] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 294.311120][ T34] usb 7-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 294.314517][ T34] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.317075][ T34] usb 7-1: Product: syz [ 294.318551][ T34] usb 7-1: Manufacturer: syz [ 294.320174][ T34] usb 7-1: SerialNumber: syz [ 294.323314][ T34] usb 7-1: config 0 descriptor?? [ 294.328999][ T34] hub 7-1:0.0: bad descriptor, ignoring hub [ 294.331065][ T34] hub 7-1:0.0: probe with driver hub failed with error -5 [ 294.337789][ T34] input: syz syz as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/input/input126 [ 294.823316][ T1351] IPVS: starting estimator thread 0... [ 294.826728][ T9907] IPVS: ip_vs_edit_dest(): server weight less than zero [ 294.909052][ T9908] IPVS: using max 43 ests per chain, 103200 per kthread [ 295.279626][ T9924] syzkaller0: entered promiscuous mode [ 295.281803][ T9924] syzkaller0: entered allmulticast mode [ 295.300394][ T24] usb 7-1: USB disconnect, device number 23 [ 296.139054][ T34] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 296.310434][ T34] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 296.314693][ T34] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 296.326599][ T34] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 296.330724][ T34] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.348333][ T9928] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 296.352700][ T34] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 298.012990][ T9954] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1036'. [ 298.017201][ T9954] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1036'. [ 298.075096][ T9956] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1037'. [ 298.213083][ T24] usb 5-1: USB disconnect, device number 34 [ 298.519282][ T9966] ceph: Path missing in source [ 299.126032][ T9982] input: syz1 as /devices/virtual/input/input128 [ 299.224617][ T9983] xt_connbytes: Forcing CT accounting to be enabled [ 299.227040][ T9983] xt_TPROXY: Can be used only with -p tcp or -p udp [ 299.542983][ T9967] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input129 [ 299.946163][ T9994] binder: 9993:9994 ioctl 4040aea0 800000c0 returned -22 [ 300.704886][T10023] ceph: Path missing in source [ 300.889011][ T1351] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 301.039874][ T1351] usb 7-1: Using ep0 maxpacket: 16 [ 301.045978][ T1351] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 301.056197][ T1351] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 301.060732][ T1351] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 301.064746][ T1351] usb 7-1: Product: syz [ 301.066104][ T1351] usb 7-1: Manufacturer: syz [ 301.070681][ T1351] usb 7-1: SerialNumber: syz [ 301.073684][ T1351] usb 7-1: config 0 descriptor?? [ 301.078540][ T1351] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 301.083861][ T1351] em28xx 7-1:0.0: DVB interface 0 found: bulk [ 301.196970][T10033] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input130 [ 301.829375][ T9] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 301.958665][ T1351] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 301.971188][T10059] netlink: 100 bytes leftover after parsing attributes in process `syz.4.1058'. [ 302.029005][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 302.038431][ T9] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 302.043734][ T9] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 302.046996][ T9] usb 5-1: config 0 interface 0 has no altsetting 0 [ 302.053451][ T9] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 302.057903][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 302.078406][ T9] usb 5-1: config 0 descriptor?? [ 302.157432][T10062] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 302.177850][T10062] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 302.182359][T10062] kvm: requested 12571 ns i8254 timer period limited to 200000 ns [ 302.197613][T10062] kvm: requested 12571 ns i8254 timer period limited to 200000 ns [ 302.205199][T10062] kvm: requested 85485 ns i8254 timer period limited to 200000 ns [ 302.208745][T10062] kvm: requested 93028 ns i8254 timer period limited to 200000 ns [ 302.217352][T10062] kvm: requested 7542 ns i8254 timer period limited to 200000 ns [ 302.222482][T10062] kvm: requested 10057 ns i8254 timer period limited to 200000 ns [ 302.231082][T10062] kvm: requested 155047 ns i8254 timer period limited to 200000 ns [ 302.245082][T10062] kvm: requested 160914 ns i8254 timer period limited to 200000 ns [ 302.249079][T10065] Invalid argument reading file caps for ./file0 [ 302.585868][ T9] mcp2221 0003:04D8:00DD.004B: unknown main item tag 0x0 [ 302.594657][ T9] mcp2221 0003:04D8:00DD.004B: unknown main item tag 0x0 [ 302.605573][ T9] mcp2221 0003:04D8:00DD.004B: unknown main item tag 0x0 [ 302.621567][ T9] mcp2221 0003:04D8:00DD.004B: unknown main item tag 0x0 [ 302.630497][ T9] mcp2221 0003:04D8:00DD.004B: unknown main item tag 0x0 [ 302.645610][ T9] mcp2221 0003:04D8:00DD.004B: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 302.765295][T10056] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1057'. [ 302.939102][ T24] usb 9-1: new full-speed USB device number 8 using dummy_hcd [ 303.080586][ T24] usb 9-1: device descriptor read/64, error -71 [ 303.125212][ T1351] em28xx 7-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 303.128040][ T1351] em28xx 7-1:0.0: board has no eeprom [ 303.180187][ T845] usb 5-1: USB disconnect, device number 35 [ 303.189351][ T1351] em28xx 7-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 303.192104][ T1351] em28xx 7-1:0.0: dvb set to bulk mode. [ 303.198446][ T8958] em28xx 7-1:0.0: Binding DVB extension [ 303.219563][ T1351] usb 7-1: USB disconnect, device number 24 [ 303.233473][ T8958] em28xx 7-1:0.0: Registering input extension [ 303.241977][ T1351] em28xx 7-1:0.0: Disconnecting em28xx [ 303.243880][ T1351] em28xx 7-1:0.0: Closing input extension [ 303.329143][ T24] usb 9-1: new full-speed USB device number 9 using dummy_hcd [ 303.368891][ T1351] em28xx 7-1:0.0: Freeing device [ 303.460426][ T24] usb 9-1: device descriptor read/64, error -71 [ 303.573088][ T24] usb usb9-port1: attempt power cycle [ 303.679103][ T1351] usb 7-1: new low-speed USB device number 25 using dummy_hcd [ 303.842434][ T1351] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 303.846739][ T1351] usb 7-1: config 0 has no interface number 0 [ 303.851214][ T1351] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 303.859023][ T1351] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 303.868069][ T1351] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 303.873231][ T1351] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 303.882140][ T1351] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 303.887705][ T1351] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 303.895614][ T1351] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 303.898523][ T1351] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 303.910493][ T1351] usb 7-1: config 0 descriptor?? [ 303.913630][T10081] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 303.913777][ T24] usb 9-1: new full-speed USB device number 10 using dummy_hcd [ 303.916120][T10081] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 303.928010][ T1351] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 303.949841][ T24] usb 9-1: device descriptor read/8, error -71 [ 304.176973][T10081] ldusb 7-1:0.55: Write buffer overflow, 79 bytes dropped [ 304.182013][ T845] usb 7-1: USB disconnect, device number 25 [ 304.189444][ T24] usb 9-1: new full-speed USB device number 11 using dummy_hcd [ 304.194564][ T845] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 304.213206][ T24] usb 9-1: device descriptor read/8, error -71 [ 304.261339][T10096] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 304.264051][T10096] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 304.269060][T10096] vhci_hcd vhci_hcd.0: Device attached [ 304.303951][T10096] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 304.319553][ T24] usb usb9-port1: unable to enumerate USB device [ 304.540267][ T1351] usb 44-1: SetAddress Request (2) to port 0 [ 304.543810][ T1351] usb 44-1: new SuperSpeed USB device number 2 using vhci_hcd [ 304.763161][T10097] vhci_hcd: connection reset by peer [ 304.766471][ T13] vhci_hcd vhci_hcd.3: stop threads [ 304.768235][ T13] vhci_hcd vhci_hcd.3: release socket [ 304.770435][ T13] vhci_hcd vhci_hcd.3: disconnect device [ 304.836751][T10103] netlink: 'syz.2.1071': attribute type 10 has an invalid length. [ 304.843490][T10103] 8021q: adding VLAN 0 to HW filter on device bond0 [ 304.847173][T10103] team0: Port device bond0 added [ 304.880653][T10103] 8021q: adding VLAN 0 to HW filter on device team0 [ 304.886596][T10103] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 304.941775][T10103] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 304.946740][T10103] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 305.013332][T10103] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 305.028108][T10103] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 305.057771][T10103] veth1_vlan: left promiscuous mode [ 305.061689][T10103] veth0_vlan: left promiscuous mode [ 305.066697][T10103] veth0_vlan: entered promiscuous mode [ 305.073880][T10103] veth1_vlan: entered promiscuous mode [ 305.081879][T10103] veth1_macvtap: left promiscuous mode [ 305.084991][T10103] veth0_macvtap: left promiscuous mode [ 305.087972][T10103] veth0_macvtap: entered promiscuous mode [ 305.091254][T10103] veth1_macvtap: entered promiscuous mode [ 305.097050][T10103] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 305.100938][T10103] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 305.104817][T10103] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 305.107914][T10103] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 305.116535][T10103] 8021q: adding VLAN 0 to HW filter on device bond1 [ 305.126707][T10103] 8021q: adding VLAN 0 to HW filter on device bond2 [ 305.136162][ T224] bridge0: port 1(bridge_slave_0) entered blocking state [ 305.139012][ T224] bridge0: port 1(bridge_slave_0) entered forwarding state [ 305.145574][ T224] bridge0: port 2(bridge_slave_1) entered blocking state [ 305.147992][ T224] bridge0: port 2(bridge_slave_1) entered forwarding state [ 305.199284][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 305.204434][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 305.213678][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 305.239365][ T5850] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 305.772056][T10140] netlink: 'syz.2.1078': attribute type 10 has an invalid length. [ 305.807054][T10140] 8021q: adding VLAN 0 to HW filter on device bond0 [ 306.127937][T10153] input: syz1 as /devices/virtual/input/input133 [ 306.130258][T10153] input: failed to attach handler leds to device input133, error: -6 [ 306.419098][ T82] wlan0: Trigger new scan to find an IBSS to join [ 306.826313][T10170] syzkaller0: entered promiscuous mode [ 306.828045][T10170] syzkaller0: entered allmulticast mode [ 307.957599][T10181] ceph: Path missing in source [ 309.563510][T10208] input: syz1 as /devices/virtual/input/input135 [ 309.566247][T10208] input: failed to attach handler leds to device input135, error: -6 [ 309.781918][ T1351] usb 44-1: device descriptor read/8, error -110 [ 309.875654][T10204] bridge0: port 2(bridge_slave_1) entered disabled state [ 309.880040][T10204] bridge0: port 1(bridge_slave_0) entered disabled state [ 310.262510][T10204] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 310.275132][T10204] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 310.449158][ T5850] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.452763][ T5850] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.456050][ T5850] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.459529][ T5850] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.479584][ T1351] usb usb44-port1: attempt power cycle [ 311.428267][ T1351] usb usb44-port1: unable to enumerate USB device [ 311.525192][T10250] ceph: Path missing in source [ 312.329083][ T845] usb 5-1: new low-speed USB device number 36 using dummy_hcd [ 312.501122][ T845] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 312.503627][ T845] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 312.506962][ T845] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 312.511177][ T845] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 312.515537][ T845] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 312.519868][ T845] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 312.522382][ T845] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 312.525801][ T845] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 312.531252][ T845] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 312.534838][ T845] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 312.539328][ T845] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 312.541730][ T845] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 312.545150][ T845] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 312.548890][ T845] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 312.552799][ T845] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 312.558473][ T845] usb 5-1: string descriptor 0 read error: -22 [ 312.561014][ T845] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 312.566132][ T845] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 312.579612][ T845] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 312.681797][T10272] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1115'. [ 312.790379][ T845] usb 5-1: USB disconnect, device number 36 [ 314.452726][T10294] ceph: Path missing in source [ 314.650579][T10299] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input137 [ 315.699288][T10314] input: syz1 as /devices/virtual/input/input139 [ 315.701402][T10314] input: failed to attach handler leds to device input139, error: -6 [ 315.888654][T10315] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1122'. [ 316.086379][T10319] netlink: 100 bytes leftover after parsing attributes in process `syz.0.1127'. [ 316.385296][T10330] 9pnet: Found fid 0 not clunked [ 316.660481][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.663528][ T1443] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.148397][T10357] netlink: 'syz.4.1139': attribute type 1 has an invalid length. [ 317.169231][T10359] netlink: 'syz.0.1140': attribute type 1 has an invalid length. [ 317.189907][T10357] bond1: entered promiscuous mode [ 317.192758][T10357] 8021q: adding VLAN 0 to HW filter on device bond1 [ 317.225507][T10394] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1140'. [ 317.271084][T10359] 8021q: adding VLAN 0 to HW filter on device bond3 [ 317.282958][T10359] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1140'. [ 317.285985][T10394] bond3: entered promiscuous mode [ 317.287646][T10394] bond3: entered allmulticast mode [ 317.295767][T10395] 8021q: adding VLAN 0 to HW filter on device bond1 [ 317.298654][T10395] bond1: (slave gre1): The slave device specified does not support setting the MAC address [ 317.309537][T10395] bond1: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 317.315302][T10395] bond1: (slave gre1): making interface the new active one [ 317.320163][T10395] gre1: entered promiscuous mode [ 317.325246][T10395] bond1: (slave gre1): Enslaving as an active interface with an up link [ 317.630178][ T5835] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 317.808995][ T5835] usb 9-1: Using ep0 maxpacket: 8 [ 317.813237][ T5835] usb 9-1: config 0 has an invalid interface number: 55 but max is 0 [ 317.816756][ T5835] usb 9-1: config 0 has no interface number 0 [ 317.820663][ T5835] usb 9-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 317.825247][ T5835] usb 9-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 317.830485][ T5835] usb 9-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 317.834991][ T5835] usb 9-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 317.840881][ T5835] usb 9-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 317.844675][ T5835] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.856154][ T5835] usb 9-1: config 0 descriptor?? [ 317.871111][ T5835] ldusb 9-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 319.178584][T10491] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 319.197013][T10496] 9p: Bad value for 'wfdno' [ 319.209810][T10496] syzkaller0: entered promiscuous mode [ 319.211687][T10496] syzkaller0: entered allmulticast mode [ 319.379874][T10505] binder: 10504:10505 ioctl c0306201 800001c0 returned -14 [ 320.103837][ T5849] usb 9-1: USB disconnect, device number 12 [ 320.110915][ T5849] ldusb 9-1:0.55: LD USB Device #0 now disconnected [ 320.136328][T10517] input: syz1 as /devices/virtual/input/input140 [ 320.139151][T10517] input: failed to attach handler leds to device input140, error: -6 [ 320.485041][T10534] netlink: 'syz.4.1162': attribute type 1 has an invalid length. [ 320.507244][T10534] 8021q: adding VLAN 0 to HW filter on device bond2 [ 320.581580][T10534] bond2: (slave ip6erspan0): making interface the new active one [ 320.605896][T10534] bond2: (slave ip6erspan0): Enslaving as an active interface with an up link [ 320.910590][ T5849] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 321.079196][ T5849] usb 5-1: Using ep0 maxpacket: 8 [ 321.085654][ T5849] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 321.091288][ T5849] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 321.094621][ T5849] usb 5-1: config 0 interface 0 has no altsetting 0 [ 321.096925][ T5849] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 321.103457][ T5849] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.145999][ T5849] usb 5-1: config 0 descriptor?? [ 321.639204][ T5849] mcp2221 0003:04D8:00DD.004C: unknown main item tag 0x0 [ 321.643565][T10600] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1167'. [ 321.652702][ T5849] mcp2221 0003:04D8:00DD.004C: unknown main item tag 0x0 [ 321.666774][ T5849] mcp2221 0003:04D8:00DD.004C: unknown main item tag 0x0 [ 321.682490][ T5849] mcp2221 0003:04D8:00DD.004C: unknown main item tag 0x0 [ 321.695607][ T5849] mcp2221 0003:04D8:00DD.004C: unknown main item tag 0x0 [ 321.717229][ T5849] mcp2221 0003:04D8:00DD.004C: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 321.795242][T10574] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1161'. [ 322.538112][ T5849] usb 5-1: USB disconnect, device number 37 [ 324.204876][T10708] input: syz1 as /devices/virtual/input/input141 [ 324.207009][T10708] input: failed to attach handler leds to device input141, error: -6 [ 324.722847][T10722] input: syz1 as /devices/virtual/input/input142 [ 324.724976][T10722] input: failed to attach handler leds to device input142, error: -6 [ 325.653785][T10770] binder: 10769:10770 unknown command 0 [ 325.655627][T10770] binder: 10769:10770 ioctl c0306201 80004a40 returned -22 [ 326.739799][ T5849] usb 7-1: new full-speed USB device number 26 using dummy_hcd [ 326.901922][ T5849] usb 7-1: config 0 has an invalid interface descriptor of length 8, skipping [ 326.905787][ T5849] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 326.910377][ T5849] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 326.916456][ T5849] usb 7-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 326.920713][ T5849] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 326.924073][ T5849] usb 7-1: Product: syz [ 326.925948][ T5849] usb 7-1: Manufacturer: syz [ 326.927999][ T5849] usb 7-1: SerialNumber: syz [ 326.937871][ T5849] usb 7-1: config 0 descriptor?? [ 327.379134][ T6210] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 327.539069][ T6210] usb 8-1: Using ep0 maxpacket: 8 [ 327.543725][ T6210] usb 8-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 327.548048][ T6210] usb 8-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 327.552022][ T6210] usb 8-1: config 0 interface 0 has no altsetting 0 [ 327.555009][ T6210] usb 8-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 327.558604][ T6210] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 327.573236][ T6210] usb 8-1: config 0 descriptor?? [ 327.582952][T10848] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 327.592044][T10848] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.052413][ T6210] mcp2221 0003:04D8:00DD.004D: unknown main item tag 0x0 [ 328.059635][ T6210] mcp2221 0003:04D8:00DD.004D: unknown main item tag 0x0 [ 328.061956][ T6210] mcp2221 0003:04D8:00DD.004D: unknown main item tag 0x0 [ 328.064140][ T6210] mcp2221 0003:04D8:00DD.004D: unknown main item tag 0x0 [ 328.066334][ T6210] mcp2221 0003:04D8:00DD.004D: unknown main item tag 0x0 [ 328.068838][ T6210] mcp2221 0003:04D8:00DD.004D: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 328.252073][T10836] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1203'. [ 328.255986][ T5835] usb 8-1: USB disconnect, device number 21 [ 328.874778][T10890] netlink: 'syz.3.1206': attribute type 3 has an invalid length. [ 328.997933][T10904] jffs2: notice: (10904) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 329.160329][ T5835] usb 8-1: new high-speed USB device number 22 using dummy_hcd [ 329.309135][ T5835] usb 8-1: Using ep0 maxpacket: 16 [ 329.312168][ T5835] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 329.316050][ T5835] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 329.328251][ T5835] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 329.339574][ T5835] usb 8-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 329.345949][ T5835] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.370012][ T5835] usb 8-1: config 0 descriptor?? [ 329.444068][T10965] binder: 10957:10965 ioctl 401c7012 0 returned -22 [ 329.518533][ T6210] usb 7-1: USB disconnect, device number 26 [ 329.614135][T10976] FAULT_INJECTION: forcing a failure. [ 329.614135][T10976] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 329.620468][T10976] CPU: 3 UID: 0 PID: 10976 Comm: syz.2.1219 Tainted: G L syzkaller #0 PREEMPT(full) [ 329.620488][T10976] Tainted: [L]=SOFTLOCKUP [ 329.620492][T10976] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 329.620499][T10976] Call Trace: [ 329.620503][T10976] [ 329.620508][T10976] dump_stack_lvl+0x100/0x190 [ 329.620528][T10976] should_fail_ex.cold+0x5/0xa [ 329.620557][T10976] _copy_from_user+0x2e/0xd0 [ 329.620588][T10976] io_register_rsrc+0xb8/0x215 [ 329.620612][T10976] ? __pfx_io_register_rsrc+0x10/0x10 [ 329.620636][T10976] __do_sys_io_uring_register+0x1148/0x1bc0 [ 329.620664][T10976] ? __pfx___do_sys_io_uring_register+0x10/0x10 [ 329.620684][T10976] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 329.620709][T10976] ? __fget_files+0x21f/0x3d0 [ 329.620724][T10976] ? fput+0x79/0x100 [ 329.620737][T10976] ? ksys_write+0x1ac/0x250 [ 329.620747][T10976] ? __pfx_ksys_write+0x10/0x10 [ 329.620761][T10976] __do_fast_syscall_32+0xe7/0x970 [ 329.620777][T10976] ? lockdep_hardirqs_on+0x78/0x100 [ 329.620793][T10976] do_fast_syscall_32+0x32/0x70 [ 329.620813][T10976] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 329.620829][T10976] RIP: 0023:0xf702efec [ 329.620844][T10976] Code: Unable to access opcode bytes at 0xf702efc2. [ 329.620849][T10976] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 00000000000001ab [ 329.620860][T10976] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000000000d [ 329.620867][T10976] RDX: 0000000080001800 RSI: 0000000000000020 RDI: 0000000000000000 [ 329.620873][T10976] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 329.620880][T10976] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 329.620886][T10976] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 329.620900][T10976] [ 329.843973][T10980] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 329.855049][T10980] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 330.096902][T10896] netlink: 504 bytes leftover after parsing attributes in process `syz.3.1208'. [ 330.108851][ T5835] usbhid 8-1:0.0: can't add hid device: -71 [ 330.111112][ T5835] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 330.116758][ T5835] usb 8-1: USB disconnect, device number 22 [ 330.320520][T10995] binder: 10993:10995 ioctl 4040aea0 800000c0 returned -22 [ 330.779071][ T10] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 330.940645][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 330.944241][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 330.947433][ T10] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 330.951770][ T10] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 330.954658][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.958493][ T10] usb 7-1: config 0 descriptor?? [ 331.454723][T11019] input: syz1 as /devices/virtual/input/input145 [ 331.457186][T11019] input: failed to attach handler leds to device input145, error: -6 [ 331.492336][ T10] plantronics 0003:047F:FFFF.004E: unknown main item tag 0x0 [ 331.749197][T11003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 331.754275][T11003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 331.959571][T11003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 331.962992][T11003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 332.196213][ T10] plantronics 0003:047F:FFFF.004E: unknown main item tag 0x0 [ 332.198638][ T10] plantronics 0003:047F:FFFF.004E: unknown main item tag 0x0 [ 332.201141][ T10] plantronics 0003:047F:FFFF.004E: unknown main item tag 0x0 [ 332.203536][ T10] plantronics 0003:047F:FFFF.004E: unknown main item tag 0x0 [ 332.212018][ T10] plantronics 0003:047F:FFFF.004E: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 332.220139][ T10] usb 7-1: USB disconnect, device number 27 [ 332.283043][T11038] fido_id[11038]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb7/report_descriptor': No such file or directory [ 332.288016][T11053] netlink: 100 bytes leftover after parsing attributes in process `syz.3.1228'. [ 332.291407][T11051] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1227'. [ 332.294798][T11051] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1227'. [ 332.301421][T11051] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1227'. [ 332.458975][T11060] jffs2: notice: (11060) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 332.718048][T11086] binder: 11082:11086 ioctl 4040aea0 800000c0 returned -22 [ 333.196513][ T5103] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 333.205359][ T5103] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 333.210142][ T5103] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 333.214007][ T5103] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 333.216737][ T5103] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 333.339092][ T5835] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 333.388513][ T5850] vlan3: left promiscuous mode [ 333.391059][ T5850] dummy0: left promiscuous mode [ 333.395173][ T5850] bridge0: port 3(vlan3) entered disabled state [ 333.405558][ T5850] bridge_slave_1: left allmulticast mode [ 333.407451][ T5850] bridge_slave_1: left promiscuous mode [ 333.409620][ T5850] bridge0: port 2(bridge_slave_1) entered disabled state [ 333.414933][ T5850] bridge_slave_0: left allmulticast mode [ 333.416832][ T5850] bridge_slave_0: left promiscuous mode [ 333.419781][ T5850] bridge0: port 1(bridge_slave_0) entered disabled state [ 333.527854][ T5835] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 333.529991][T11143] netlink: 'syz.4.1243': attribute type 3 has an invalid length. [ 333.543367][ T5835] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 333.549939][ T5835] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 333.562107][ T5835] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 333.565493][ T5835] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 333.581920][ T42] audit: type=1326 audit(1786007513.179:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11147 comm="syz.4.1245" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7ff4fec code=0x0 [ 333.582020][ T5835] usb 7-1: config 0 descriptor?? [ 333.646200][ T5850] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 333.652101][ T5850] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 333.656665][ T5850] bond0 (unregistering): Released all slaves [ 333.665474][ T5456] 8021q: adding VLAN 0 to HW filter on device eth5 [ 333.779067][ T5850] tipc: Left network mode [ 333.820983][ T42] audit: type=1800 audit(1786007513.419:8): pid=11188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1246" name="num" dev="configfs" ino=32371 res=0 errno=0 [ 333.827964][ T42] audit: type=1800 audit(1786007513.419:9): pid=11188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1246" name="ipv4_port" dev="configfs" ino=33873 res=0 errno=0 [ 333.835296][ T42] audit: type=1800 audit(1786007513.419:10): pid=11188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1246" name="num" dev="configfs" ino=33874 res=0 errno=0 [ 333.843779][ T42] audit: type=1800 audit(1786007513.419:11): pid=11188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1246" name="local" dev="configfs" ino=33875 res=0 errno=0 [ 333.850637][ T42] audit: type=1800 audit(1786007513.429:12): pid=11188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1246" name="block_bytes" dev="configfs" ino=31459 res=0 errno=0 [ 333.857496][ T42] audit: type=1800 audit(1786007513.439:13): pid=11188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1246" name="blocks" dev="configfs" ino=32958 res=0 errno=0 [ 333.868768][ T42] audit: type=1800 audit(1786007513.439:14): pid=11188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1246" name="start_block" dev="configfs" ino=32959 res=0 errno=0 [ 333.877047][ T42] audit: type=1800 audit(1786007513.439:15): pid=11188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1246" name="dev" dev="configfs" ino=32960 res=0 errno=0 [ 333.911068][ T5456] 8021q: adding VLAN 0 to HW filter on device eth6 [ 333.970783][T11233] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 333.973454][T11233] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 333.977625][T11233] vhci_hcd vhci_hcd.0: Device attached [ 334.004920][ T5835] hid_parser_main: 4 callbacks suppressed [ 334.004936][ T5835] plantronics 0003:047F:FFFF.004F: unknown main item tag 0x0 [ 334.010662][ T5835] plantronics 0003:047F:FFFF.004F: unknown main item tag 0x0 [ 334.014469][ T5835] plantronics 0003:047F:FFFF.004F: unknown main item tag 0x0 [ 334.019724][ T5835] plantronics 0003:047F:FFFF.004F: unknown main item tag 0x0 [ 334.024512][ T5835] plantronics 0003:047F:FFFF.004F: unknown main item tag 0x0 [ 334.028798][ T5835] plantronics 0003:047F:FFFF.004F: unknown main item tag 0x0 [ 334.036500][ T5835] plantronics 0003:047F:FFFF.004F: unknown main item tag 0x0 [ 334.038810][ T5835] plantronics 0003:047F:FFFF.004F: unknown main item tag 0x0 [ 334.041300][ T5835] plantronics 0003:047F:FFFF.004F: unknown main item tag 0x0 [ 334.050358][ T5835] plantronics 0003:047F:FFFF.004F: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 334.121735][ T5850] hsr_slave_0: left promiscuous mode [ 334.124536][ T5850] hsr_slave_1: left promiscuous mode [ 334.126631][ T5850] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 334.129379][ T5850] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 334.219076][ T6210] usb 2-1: new low-speed USB device number 2 using vhci_hcd [ 334.237876][ T5850] team0 (unregistering): Port device team_slave_1 removed [ 334.246439][ T5850] team0 (unregistering): Port device team_slave_0 removed [ 334.352072][ T5456] 8021q: adding VLAN 0 to HW filter on device eth7 [ 334.366627][T11102] bridge0: port 1(bridge_slave_0) entered blocking state [ 334.369214][T11102] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.371708][T11102] bridge_slave_0: entered allmulticast mode [ 334.375095][T11102] bridge_slave_0: entered promiscuous mode [ 334.381714][T11102] bridge0: port 2(bridge_slave_1) entered blocking state [ 334.384585][T11102] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.387788][T11102] bridge_slave_1: entered allmulticast mode [ 334.392049][T11102] bridge_slave_1: entered promiscuous mode [ 334.422625][T11102] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 334.432392][T11102] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 334.438032][T11295] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 334.449839][T11295] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 334.480891][T11102] team0: Port device team_slave_0 added [ 334.488416][T11102] team0: Port device team_slave_1 added [ 334.519150][T11102] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 334.521912][T11102] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 334.532293][T11102] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 334.541476][T11102] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 334.550090][T11102] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 334.582170][T11102] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 334.635437][T11102] hsr_slave_0: entered promiscuous mode [ 334.638751][T11102] hsr_slave_1: entered promiscuous mode [ 334.655466][T11295] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 334.661660][T11295] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 334.749102][ T5456] 8021q: adding VLAN 0 to HW filter on device eth8 [ 334.808624][T11102] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 334.818261][T11234] vhci_hcd: connection reset by peer [ 334.819183][T11102] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 334.823509][T11102] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 334.827444][ T12] vhci_hcd vhci_hcd.0: stop threads [ 334.830094][ T12] vhci_hcd vhci_hcd.0: release socket [ 334.832056][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 334.835470][T11102] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 334.838312][T11102] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 334.844082][T11102] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 334.847243][T11102] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 334.854404][T11102] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 334.908482][T11102] 8021q: adding VLAN 0 to HW filter on device bond0 [ 334.917661][T11102] 8021q: adding VLAN 0 to HW filter on device team0 [ 334.923675][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 334.926027][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 334.935421][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 334.938147][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 335.187399][T11102] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 335.217550][T11501] FAULT_INJECTION: forcing a failure. [ 335.217550][T11501] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 335.221821][T11501] CPU: 2 UID: 0 PID: 11501 Comm: syz.0.1250 Tainted: G L syzkaller #0 PREEMPT(full) [ 335.221839][T11501] Tainted: [L]=SOFTLOCKUP [ 335.221844][T11501] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 335.221863][T11501] Call Trace: [ 335.221868][T11501] [ 335.221873][T11501] dump_stack_lvl+0x100/0x190 [ 335.221893][T11501] should_fail_ex.cold+0x5/0xa [ 335.221905][T11501] ? prepare_alloc_pages+0x16d/0x5f0 [ 335.221924][T11501] should_fail_alloc_page+0xeb/0x140 [ 335.221942][T11501] prepare_alloc_pages+0x1f0/0x5f0 [ 335.221961][T11501] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 335.221979][T11501] ? __lock_acquire+0x49f/0x1a40 [ 335.222001][T11501] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 335.222018][T11501] ? find_held_lock+0x2b/0x80 [ 335.222031][T11501] ? weighted_interleave_nid+0x3e3/0x5a0 [ 335.222048][T11501] ? weighted_interleave_nid+0x3e3/0x5a0 [ 335.222068][T11501] ? __pfx_weighted_interleave_nid+0x10/0x10 [ 335.222084][T11501] ? lock_acquire+0x1b9/0x370 [ 335.222102][T11501] ? find_held_lock+0x2b/0x80 [ 335.222115][T11501] ? page_table_check_set+0x48f/0x930 [ 335.222134][T11501] ? policy_nodemask+0xed/0x4f0 [ 335.222151][T11501] alloc_pages_mpol+0x1fb/0x540 [ 335.222168][T11501] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 335.222183][T11501] ? __page_table_check_ptes_set+0x1b5/0x4e0 [ 335.222215][T11501] folio_alloc_mpol_noprof+0x36/0x260 [ 335.222234][T11501] vma_alloc_folio_noprof+0xed/0x1d0 [ 335.222246][T11501] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 335.222268][T11501] do_anonymous_page+0xb2b/0x2080 [ 335.222281][T11501] ? rcu_read_unlock+0x2d/0xb0 [ 335.222296][T11501] __handle_mm_fault+0x1d2c/0x2a00 [ 335.222309][T11501] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 335.222324][T11501] ? __pfx___handle_mm_fault+0x10/0x10 [ 335.222336][T11501] ? pte_offset_map_lock+0x174/0x320 [ 335.222351][T11501] ? find_held_lock+0x2b/0x80 [ 335.222369][T11501] ? follow_page_pte+0x4d0/0x13f0 [ 335.222389][T11501] handle_mm_fault+0x37b/0xa30 [ 335.222403][T11501] __get_user_pages+0x1178/0x32a0 [ 335.222424][T11501] ? __pfx___get_user_pages+0x10/0x10 [ 335.222444][T11501] populate_vma_page_range+0x267/0x3f0 [ 335.222462][T11501] ? __pfx_populate_vma_page_range+0x10/0x10 [ 335.222478][T11501] ? __pfx_find_vma_intersection+0x10/0x10 [ 335.222495][T11501] ? __pfx_apply_vma_lock_flags+0x10/0x10 [ 335.222509][T11501] __mm_populate+0x107/0x3a0 [ 335.222526][T11501] ? __pfx___mm_populate+0x10/0x10 [ 335.222544][T11501] ? up_write+0x2e5/0x5c0 [ 335.222557][T11501] do_mlock+0x3f0/0x7f0 [ 335.222570][T11501] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 335.222587][T11501] ? __pfx_do_mlock+0x10/0x10 [ 335.222602][T11501] ? fput+0x79/0x100 [ 335.222615][T11501] ? ksys_write+0x1ac/0x250 [ 335.222625][T11501] ? __pfx_ksys_write+0x10/0x10 [ 335.222637][T11501] __ia32_sys_mlock+0x57/0x80 [ 335.222650][T11501] __do_fast_syscall_32+0xe7/0x970 [ 335.222666][T11501] ? lockdep_hardirqs_on+0x78/0x100 [ 335.222681][T11501] do_fast_syscall_32+0x32/0x70 [ 335.222698][T11501] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 335.222713][T11501] RIP: 0023:0xf7fa3fec [ 335.222726][T11501] Code: Unable to access opcode bytes at 0xf7fa3fc2. [ 335.222731][T11501] RSP: 002b:00000000f544550c EFLAGS: 00000292 ORIG_RAX: 0000000000000096 [ 335.222743][T11501] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000800000 [ 335.222750][T11501] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 335.222756][T11501] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 335.222762][T11501] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 335.222768][T11501] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 335.222782][T11501] [ 335.309177][ T5750] Bluetooth: hci0: command tx timeout [ 335.612467][T11102] veth0_vlan: entered promiscuous mode [ 335.697689][T11102] veth1_vlan: entered promiscuous mode [ 335.921915][T11102] veth0_macvtap: entered promiscuous mode [ 335.953320][T11102] veth1_macvtap: entered promiscuous mode [ 336.007695][T11102] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 336.017051][T11102] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 336.111265][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.115004][ T6619] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 336.119009][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.120026][ T6619] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 336.145314][ T6619] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 336.148580][T11562] [ 336.148690][ T6619] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 336.149449][T11562] ====================================================== [ 336.149456][T11562] WARNING: possible circular locking dependency detected [ 336.149463][T11562] syzkaller #0 Tainted: G L [ 336.149469][T11562] ------------------------------------------------------ [ 336.149473][T11562] syz.4.1258/11562 is trying to acquire lock: [ 336.149480][T11562] ffff88801e4b1dc0 (&sb->s_type->i_mutex_key#27){++++}-{4:4}, at: configfs_depend_item_unlocked+0xf3/0x6a0 [ 336.149519][T11562] [ 336.149519][T11562] but task is already holding lock: [ 336.149523][T11562] ffff88804c0d5118 (&opts->dep_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x1a4/0x620 [ 336.149556][T11562] [ 336.149556][T11562] which lock already depends on the new lock. [ 336.149556][T11562] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 336.149579][T11562] [ 336.149579][T11562] the existing dependency chain (in reverse order) is: [ 336.149584][T11562] [ 336.149584][T11562] -> #2 (&opts->dep_lock){+.+.}-{4:4}: [ 336.149601][T11562] lock_acquire+0x1b9/0x370 [ 336.149620][T11562] __mutex_lock+0x1a4/0x1bd0 [ 336.149636][T11562] tcm_set_name+0x29/0xb0 [ 336.149648][T11562] function_make+0x21c/0x3f0 [ 336.149664][T11562] configfs_mkdir+0x51e/0xb70 [ 336.149676][T11562] vfs_mkdir+0x361/0x850 [ 336.195688][T11562] filename_mkdirat+0x48b/0x5e0 [ 336.197904][T11562] __ia32_sys_mkdir+0x6a/0x90 [ 336.200047][T11562] __do_fast_syscall_32+0xe7/0x970 [ 336.202345][T11562] do_fast_syscall_32+0x32/0x70 [ 336.204554][T11562] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 336.207210][T11562] [ 336.207210][T11562] -> #1 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 336.210569][T11562] lock_acquire+0x1b9/0x370 [ 336.212588][T11562] __mutex_lock+0x1a4/0x1bd0 [ 336.214572][T11562] configfs_rmdir+0x5ae/0x950 [ 336.216526][T11562] vfs_rmdir+0x328/0x8a0 [ 336.218566][T11562] filename_rmdir+0x31a/0x5c0 [ 336.220716][T11562] __ia32_sys_rmdir+0x45/0x60 [ 336.222401][T11562] __do_fast_syscall_32+0xe7/0x970 [ 336.224074][T11562] do_fast_syscall_32+0x32/0x70 [ 336.225750][T11562] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 336.228430][T11562] [ 336.228430][T11562] -> #0 (&sb->s_type->i_mutex_key#27){++++}-{4:4}: [ 336.231449][T11562] check_prev_add+0xeb/0xe60 [ 336.233086][T11562] __lock_acquire+0x136c/0x1a40 [ 336.234802][T11562] lock_acquire+0x1b9/0x370 [ 336.236393][T11562] down_write+0x8b/0x1f0 [ 336.238065][T11562] configfs_depend_item_unlocked+0xf3/0x6a0 [ 336.240147][T11562] usbg_make_tpg+0x261/0x620 [ 336.241775][T11562] target_fabric_make_tpg+0xab/0x8c0 [ 336.243611][T11562] configfs_mkdir+0x51e/0xb70 [ 336.245489][T11562] vfs_mkdir+0x361/0x850 [ 336.247503][T11562] filename_mkdirat+0x48b/0x5e0 [ 336.249747][T11562] __ia32_sys_mkdir+0x6a/0x90 [ 336.251880][T11562] __do_fast_syscall_32+0xe7/0x970 [ 336.254236][T11562] do_fast_syscall_32+0x32/0x70 [ 336.256409][T11562] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 336.259129][T11562] [ 336.259129][T11562] other info that might help us debug this: [ 336.259129][T11562] [ 336.263054][T11562] Chain exists of: [ 336.263054][T11562] &sb->s_type->i_mutex_key#27 --> gadget_subsys.su_mutex --> &opts->dep_lock [ 336.263054][T11562] [ 336.268813][T11562] Possible unsafe locking scenario: [ 336.268813][T11562] [ 336.271420][T11562] CPU0 CPU1 [ 336.273586][T11562] ---- ---- [ 336.275498][T11562] lock(&opts->dep_lock); [ 336.276930][T11562] lock(gadget_subsys.su_mutex); [ 336.279294][T11562] lock(&opts->dep_lock); [ 336.281444][T11562] lock(&sb->s_type->i_mutex_key#27); [ 336.283162][T11562] [ 336.283162][T11562] *** DEADLOCK *** [ 336.283162][T11562] [ 336.286196][T11562] 5 locks held by syz.4.1258/11562: [ 336.288344][T11562] #0: ffff888021dd8450 (sb_writers#16){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 336.292296][T11562] #1: ffff88802ac0e040 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 [ 336.296653][T11562] #2: ffffffff8fd8a928 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4b5/0xb70 [ 336.299802][T11562] #3: ffffffff90255c40 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x10b/0x620 [ 336.302824][T11562] #4: ffff88804c0d5118 (&opts->dep_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x1a4/0x620 [ 336.306041][T11562] [ 336.306041][T11562] stack backtrace: [ 336.308301][T11562] CPU: 1 UID: 0 PID: 11562 Comm: syz.4.1258 Tainted: G L syzkaller #0 PREEMPT(full) [ 336.308321][T11562] Tainted: [L]=SOFTLOCKUP [ 336.308327][T11562] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 336.308336][T11562] Call Trace: [ 336.308342][T11562] [ 336.308349][T11562] dump_stack_lvl+0x100/0x190 [ 336.308375][T11562] print_circular_bug.cold+0x178/0x1c7 [ 336.308410][T11562] check_noncircular+0x146/0x160 [ 336.308440][T11562] check_prev_add+0xeb/0xe60 [ 336.308468][T11562] __lock_acquire+0x136c/0x1a40 [ 336.308497][T11562] ? rcu_is_watching+0x12/0xc0 [ 336.308513][T11562] lock_acquire+0x1b9/0x370 [ 336.308528][T11562] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 336.308543][T11562] ? __pfx___might_resched+0x10/0x10 [ 336.308560][T11562] down_write+0x8b/0x1f0 [ 336.308578][T11562] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 336.308590][T11562] ? __pfx_down_write+0x10/0x10 [ 336.308606][T11562] configfs_depend_item_unlocked+0xf3/0x6a0 [ 336.308619][T11562] ? __lock_acquire+0x49f/0x1a40 [ 336.308636][T11562] usbg_make_tpg+0x261/0x620 [ 336.308654][T11562] ? __pfx_usbg_make_tpg+0x10/0x10 [ 336.308668][T11562] ? find_held_lock+0x2b/0x80 [ 336.308681][T11562] ? __pfx_usbg_make_tpg+0x10/0x10 [ 336.308695][T11562] target_fabric_make_tpg+0xab/0x8c0 [ 336.308714][T11562] configfs_mkdir+0x51e/0xb70 [ 336.308727][T11562] ? __pfx_target_fabric_make_tpg+0x10/0x10 [ 336.308747][T11562] ? __pfx_configfs_mkdir+0x10/0x10 [ 336.308763][T11562] vfs_mkdir+0x361/0x850 [ 336.308778][T11562] filename_mkdirat+0x48b/0x5e0 [ 336.308791][T11562] ? __pfx_filename_mkdirat+0x10/0x10 [ 336.308803][T11562] ? strncpy_from_user+0x19d/0x2d0 [ 336.308821][T11562] ? do_getname+0x191/0x390 [ 336.308835][T11562] __ia32_sys_mkdir+0x6a/0x90 [ 336.308846][T11562] __do_fast_syscall_32+0xe7/0x970 [ 336.308863][T11562] do_fast_syscall_32+0x32/0x70 [ 336.308886][T11562] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 336.308901][T11562] RIP: 0023:0xf7ff4fec [ 336.308920][T11562] Code: Unable to access opcode bytes at 0xf7ff4fc2. [ 336.308925][T11562] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000027 [ 336.308937][T11562] RAX: ffffffffffffffda RBX: 0000000080000600 RCX: 00000000000001ff [ 336.308943][T11562] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 336.308950][T11562] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 336.308956][T11562] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 336.308962][T11562] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 336.308972][T11562] [ 336.393440][ T9] usb 7-1: USB disconnect, device number 28 [ 336.441637][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.462942][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.970039][ T5850] bridge_slave_1: left allmulticast mode [ 336.972200][ T5850] bridge_slave_1: left promiscuous mode [ 336.974467][ T5850] bridge0: port 2(bridge_slave_1) entered disabled state [ 336.978575][ T5850] bridge_slave_0: left allmulticast mode [ 336.981373][ T5850] bridge_slave_0: left promiscuous mode [ 336.983880][ T5850] bridge0: port 1(bridge_slave_0) entered disabled state [ 337.025687][ T5850] bond2 (unregistering): (slave ip6erspan0): Releasing active interface [ 337.064076][ T5850] bond1 (unregistering): (slave gre1): Releasing backup interface [ 337.066551][ T5850] gre1 (unregistering): left promiscuous mode [ 337.088007][ T5850] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 337.096373][ T5850] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 337.105752][ T5850] bond0 (unregistering): Released all slaves [ 337.110516][ T5850] bond1 (unregistering): Released all slaves [ 337.116772][ T5850] bond2 (unregistering): Released all slaves [ 337.242988][ T5456] 8021q: adding VLAN 0 to HW filter on device eth9 [ 337.358723][ T5456] 8021q: adding VLAN 0 to HW filter on device eth10 [ 337.478560][ T5456] 8021q: adding VLAN 0 to HW filter on device eth11 [ 337.526226][ T5850] hsr_slave_0: left promiscuous mode [ 337.529531][ T5850] hsr_slave_1: left promiscuous mode [ 337.532239][ T5850] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 337.535750][ T5850] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 337.614267][ T5850] team0 (unregistering): Port device team_slave_1 removed [ 337.622600][ T5850] team0 (unregistering): Port device team_slave_0 removed [ 337.665937][ T5456] 8021q: adding VLAN 0 to HW filter on device eth12 [ 338.470640][ T5456] 8021q: adding VLAN 0 to HW filter on device eth13 [ 338.573662][ T5456] 8021q: adding VLAN 0 to HW filter on device eth14 [ 338.630991][ T5850] bridge_slave_1: left allmulticast mode [ 338.632844][ T5850] bridge_slave_1: left promiscuous mode [ 338.634714][ T5850] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.637628][ T5850] bridge_slave_0: left allmulticast mode [ 338.640266][ T5850] bridge_slave_0: left promiscuous mode [ 338.642145][ T5850] bridge0: port 1(bridge_slave_0) entered disabled state [ 338.651472][ T5850] team0: left allmulticast mode [ 338.653080][ T5850] team_slave_0: left allmulticast mode [ 338.654872][ T5850] team_slave_1: left allmulticast mode [ 338.656639][ T5850] dvmrp8: left allmulticast mode [ 338.660080][ T5850] bridge_slave_1: left allmulticast mode [ 338.661855][ T5850] bridge_slave_1: left promiscuous mode [ 338.663701][ T5850] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.666697][ T5850] bridge_slave_0: left allmulticast mode [ 338.668434][ T5850] bridge_slave_0: left promiscuous mode [ 338.671418][ T5850] bridge0: port 1(bridge_slave_0) entered disabled state [ 338.777000][ T5850] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 338.781649][ T5850] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 338.784596][ T5850] bond0 (unregistering): Released all slaves [ 338.787558][ T5850] bond1 (unregistering): Released all slaves [ 338.791469][ T5850] bond2 (unregistering): Released all slaves [ 338.795300][ T5850] bond3 (unregistering): Released all slaves [ 338.867004][ T5850] team0: Port device bond0 removed [ 338.869614][ T5850] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 338.873015][ T5850] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 338.876078][ T5850] bond0 (unregistering): Released all slaves [ 338.881736][ T5850] bond1 (unregistering): Released all slaves [ 338.885610][ T5850] bond2 (unregistering): Released all slaves [ 338.890186][ T5456] 8021q: adding VLAN 0 to HW filter on device eth15 [ 338.960125][ T5850] : left promiscuous mode [ 338.991279][ T5456] 8021q: adding VLAN 0 to HW filter on device eth16 [ 339.043728][ T5850] tipc: Left network mode [ 339.120913][ T5456] 8021q: adding VLAN 0 to HW filter on device eth17 [ 339.229995][ T5456] 8021q: adding VLAN 0 to HW filter on device eth18 [ 339.356762][ T5456] 8021q: adding VLAN 0 to HW filter on device eth19 [ 339.379106][ T6210] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 339.383495][ T5850] hsr_slave_0: left promiscuous mode [ 339.386311][ T5850] hsr_slave_1: left promiscuous mode [ 339.388882][ T5850] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 339.394030][ T5850] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 339.399242][ T5850] hsr_slave_0: left promiscuous mode [ 339.401239][ T5850] hsr_slave_1: left promiscuous mode [ 339.403112][ T5850] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 339.405669][ T5850] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 339.466394][ T5850] team0 (unregistering): Port device team_slave_1 removed [ 339.474012][ T5850] team0 (unregistering): Port device team_slave_0 removed [ 339.568509][ T5850] team0 (unregistering): Port device team_slave_1 removed [ 339.576300][ T5850] team0 (unregistering): Port device team_slave_0 removed [ 339.619067][ T5456] 8021q: adding VLAN 0 to HW filter on device eth20 [ 340.235165][ T5850] IPVS: stop unused estimator thread 0... [ 340.303622][ T5850] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.382240][ T5850] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.432962][ T5850] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.524322][ T5850] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.601720][ T5850] bridge_slave_1: left allmulticast mode [ 340.603573][ T5850] bridge_slave_1: left promiscuous mode [ 340.605423][ T5850] bridge0: port 2(bridge_slave_1) entered disabled state [ 340.608493][ T5850] bridge_slave_0: left allmulticast mode [ 340.610778][ T5850] bridge_slave_0: left promiscuous mode [ 340.612686][ T5850] bridge0: port 1(bridge_slave_0) entered disabled state [ 340.643984][ T5850] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 340.648092][ T5850] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 340.652309][ T5850] bond0 (unregistering): Released all slaves [ 340.777205][ T5456] 8021q: adding VLAN 0 to HW filter on device eth21 [ 340.891843][ T5456] 8021q: adding VLAN 0 to HW filter on device eth22 [ 340.948765][ T5850] hsr_slave_0: left promiscuous mode [ 340.951585][ T5850] hsr_slave_1: left promiscuous mode [ 340.954032][ T5850] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 340.956941][ T5850] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 340.962330][ T5850] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 340.965357][ T5850] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 340.972828][ T5850] veth1_macvtap: left promiscuous mode [ 340.975163][ T5850] veth0_macvtap: left promiscuous mode [ 340.977432][ T5850] veth1_vlan: left promiscuous mode [ 340.982044][ T5850] veth0_vlan: left promiscuous mode [ 341.042799][ T5850] team0 (unregistering): Port device team_slave_1 removed [ 341.047693][ T5850] team0 (unregistering): Port device team_slave_0 removed [ 341.077485][ T5456] 8021q: adding VLAN 0 to HW filter on device eth23 [ 341.192139][ T5456] 8021q: adding VLAN 0 to HW filter on device eth24