last executing test programs: 4.093760541s ago: executing program 2 (id=1190): r0 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x300000d, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffffda}, 0x1, 0x0, 0x0, 0x40}, 0x4000001) r1 = getpid() pipe2$watch_queue(&(0x7f0000000280), 0x80) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB="3000000068000903000000000154944733b70333d16f0000001a0a000000000000000400040d1400060064010102000009000000000000000000ad44a0f5f36777207c4c7fd93ddcb45b0e6148999baf064757ae8c2a3378bdf302565acbd1c1745a2df1f2dafe2cae98"], 0x30}, 0x1, 0x0, 0x0, 0x40010}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) getsockname$netlink(0xffffffffffffffff, &(0x7f0000000300), 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, &(0x7f0000000400)) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/oops_count', 0x20000, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r5) ioctl$sock_bt_bnep_BNEPCONNDEL(r5, 0x400442c9, &(0x7f0000000340)={0xfffff801, @remote}) syz_usbip_server_init(0x6) syz_80211_join_ibss(&(0x7f0000000100)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) mount(&(0x7f00000001c0)=@sr0, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000003c0)='erofs\x00', 0x1000d, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@ipv4_newnexthop={0x24, 0x5e, 0x103, 0x0, 0x25dfdbfb, {0x2, 0x0, 0x1, 0x0, 0x36}, [@NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_IDLE_TIMER={0x8, 0x2, 0x2}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x200444c1}, 0x200000c0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 3.524498308s ago: executing program 1 (id=1193): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x20000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x15, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$ITER_CREATE(0xb, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)) syz_io_uring_modify_offsets$generic(0x0, 0x0, 0x2c, 0x10000) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000140)={0x73e, 0x5, 0x8, 0x1, 0x7, 0x8}) io_uring_enter(0xffffffffffffffff, 0x2883, 0xf1bd, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000000c0)={0x28, r2, 0x1, 0x70bd2a, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HWMP_ROOTMODE={0x5, 0xe, 0x3}]}]}, 0x28}}, 0x0) r4 = inotify_init1(0x0) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x82, 0x3}, 0x10) open(&(0x7f0000000180)='./file1\x00', 0x101400, 0x80) bind$tipc(r5, 0x0, 0x0) setsockopt$TIPC_GROUP_LEAVE(r5, 0x10f, 0x88) inotify_add_watch(r4, &(0x7f0000000000)='.\x00', 0xa4000021) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x4000000, 0x2, 0x3, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r6, r7, r8, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xa, {0x2031}}) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0xb075c0, 0xf4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='\x16\x00'}]}, 0x1c}}, 0x0) 3.06280193s ago: executing program 1 (id=1194): fchdir(0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[@ANYRES32, @ANYRESOCT=0x0, @ANYRESOCT=0x0], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x42, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0xfffffffffffffdff, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_procfs(r0, &(0x7f0000000100)='net/tcp\x00') init_module(0x0, 0xa99, &(0x7f0000001800)='GPL\x00') r4 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000440)={{{@in6=@private0={0xfc, 0x0, '\x00', 0xfc}, @in=@remote, 0x4e20, 0x800, 0x4e20, 0x1, 0xa, 0x0, 0x20, 0x16}, {0x8000, 0x7fffffffffffffff, 0x7fff, 0x8000, 0xffffffffffffffff, 0x7ff, 0x32, 0x9}, {0x9, 0xffffffffffffffff, 0x8, 0xf}, 0x5, 0x6e6bb0, 0x2, 0x1, 0x1, 0x3}, {{@in=@loopback, 0x4d3, 0xff}, 0x2, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x3500, 0x2, 0x2, 0x5, 0x7, 0x8, 0x214}}, 0xe4) sendmmsg$inet6(r4, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0xffffffffffffff9c, &(0x7f0000000300)=[{&(0x7f0000000400)="b8", 0x1}], 0x1, 0x0, 0x0, 0xff000000}}], 0x1, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) 1.780378429s ago: executing program 2 (id=1198): openat$sndseq(0xffffff9c, &(0x7f0000000040), 0x22100) listen(0xffffffffffffffff, 0x5) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_CAP_DIRTY_LOG_RING(r1, 0x4068aea3, &(0x7f0000000080)={0xc0, 0x0, 0x8000}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x5, 0x1800087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x45) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) timer_create(0x0, 0x0, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000240)=@abs, 0x6e, &(0x7f00000005c0)=[{&(0x7f00000003c0)=""/177, 0xb1}, {&(0x7f00000004c0)}, {&(0x7f0000000500)=""/66, 0x42}, {&(0x7f0000000580)=""/19, 0x13}], 0x4, &(0x7f0000000600)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10, 0x1, 0x1, [0xffffffffffffffff]}}], 0x2c}, 0x23) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000640)=0xce0, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14, 0x2f, 0x9, 0x70bd2a, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 1.531377297s ago: executing program 3 (id=1199): socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507000000", @ANYRES32=r0, @ANYBLOB="e0ff8b0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) socket$nl_generic(0x10, 0x3, 0x10) r1 = userfaultfd(0x80001) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r1}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x8482, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280), 0x802, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0xde, 0x1071c3) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0442, 0x11) write$tcp_mem(r4, &(0x7f0000000140)={0x7, 0x2d, 0x0, 0x3a, 0x800000, 0x2c}, 0x48) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x1) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xfffffffffffffd8a, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYRESHEX=r2, @ANYRES32, @ANYRES32=0xee00, @ANYRES32], 0xec}, 0x1, 0x0, 0x0, 0x880}, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x16ba82, 0x10) write$cgroup_int(r5, &(0x7f0000000180)=0xfe5f, 0x12) set_mempolicy_home_node(&(0x7f0000417000/0x2000)=nil, 0x2000, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) 1.433058968s ago: executing program 1 (id=1200): openat$sndseq(0xffffff9c, &(0x7f0000000040), 0x22100) listen(0xffffffffffffffff, 0x5) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_CAP_DIRTY_LOG_RING(r1, 0x4068aea3, &(0x7f0000000080)={0xc0, 0x0, 0x8000}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x5, 0x1800087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x45) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) timer_create(0x0, 0x0, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000240)=@abs, 0x6e, &(0x7f00000005c0)=[{&(0x7f00000003c0)=""/177, 0xb1}, {&(0x7f00000004c0)}, {&(0x7f0000000500)=""/66, 0x42}, {&(0x7f0000000580)=""/19, 0x13}], 0x4, &(0x7f0000000600)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x14}, 0x23) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000640)=0xce0, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14, 0x2f, 0x9, 0x70bd2a, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 653.422521ms ago: executing program 2 (id=1201): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000100)=@other={0x2030000200000000, &(0x7f0000000200)}) 516.620664ms ago: executing program 3 (id=1202): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) 460.411828ms ago: executing program 0 (id=1203): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0xc2600, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 456.586696ms ago: executing program 2 (id=1204): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0xffc3}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_RESEND_IGMP={0x8, 0xf, 0xff}, @IFLA_BOND_MODE={0x5, 0x1, 0x6}]}}}]}, 0x44}}, 0x0) 409.492476ms ago: executing program 1 (id=1205): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) chdir(&(0x7f0000000140)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.swap.events\x00', 0x275a, 0x0) 407.780292ms ago: executing program 3 (id=1206): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x4, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x8}, [@call={0x85, 0x0, 0x0, 0x30}, @call={0x85, 0x0, 0x0, 0x50}]}, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x9, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f0000000340)="e02753e868a10000000000000000", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 351.759987ms ago: executing program 2 (id=1207): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000001c00010429bd7000fbdbdf2507000000", @ANYRES32=r1, @ANYBLOB="40000e060a000200aaaaaaaaaa1c"], 0x28}, 0x1, 0x0, 0x0, 0x44801}, 0x840) 304.364781ms ago: executing program 1 (id=1208): mkdir(&(0x7f0000000000)='./mnt\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='tracefs\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffff9c, &(0x7f0000000400)='./mnt/events/netlink/netlink_extack/enable\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1', 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="1400000010000100"/20], 0x14}}, 0x0) 304.017272ms ago: executing program 3 (id=1209): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x220c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x9) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$netlink(0x10, 0x3, 0x8000000004) setresuid(0x0, 0xee01, 0x0) writev(r7, &(0x7f0000000040)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a06e7bc45ff810500000000000058000b480000945f64009400050028925a01000000000000008000f0fffeffa809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r7) 303.547291ms ago: executing program 2 (id=1210): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000040)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/msr/parameters/allow_writes\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='on\x00', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/cpu/0/msr\x00', 0x2, 0x0) pwrite64(r1, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00\x00\x00', 0x8, 0x1a0) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/cpu/1/msr\x00', 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0) write(r3, &(0x7f0000000180)='0\x00', 0x1) pwrite64(r2, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00\x00\x00', 0x8, 0x1a0) write(r3, &(0x7f0000000180)='1\x00', 0x1) 249.350589ms ago: executing program 0 (id=1211): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000980)=@ipv4_delrule={0x24, 0x21, 0x9, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10014}, [@FRA_GENERIC_POLICY=@FRA_PRIORITY={0x8}]}, 0x24}}, 0x0) 231.988422ms ago: executing program 3 (id=1212): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x48, 0x10, 0x439, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gre={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @remote}, @IFLA_GRE_IGNORE_DF={0x5, 0x13, 0x1}, @IFLA_GRE_PMTUDISC={0x5}]}}}]}, 0x48}}, 0x0) 228.757238ms ago: executing program 1 (id=1213): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000640), 0x28e81, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000380)={0x9000, 0x35000}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000140)={0x30000, 0x8000}) 171.786663ms ago: executing program 0 (id=1214): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000380)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) io_setup(0xff, 0x0) 59.918479ms ago: executing program 0 (id=1215): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000002c0)={r1, 0x11, 0x6, @random="08d32bfb45c9"}, 0x10) close(0x4) 5.492199ms ago: executing program 0 (id=1216): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='temp_file\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000080)='/dev/mapper/control', 0x13) lseek(r0, 0x0, 0x0) read(r0, &(0x7f0000000100), 0x14) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r1, 0xc138fd12, &(0x7f0000000200)) 5.236862ms ago: executing program 0 (id=1217): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) write$cgroup_devices(0xffffffffffffffff, 0x0, 0x6) write(r0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0xfca804a0, 0x0, 0x10, 0x0, &(0x7f0000001500)=""/16, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4e2288bca9cf3ba, 0x0, 0xfffffffe}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x2, 0xc, 0x1400}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000980)={r2}, 0x4) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={r2, 0x68, &(0x7f0000000200)}, 0x10) 0s ago: executing program 3 (id=1218): socket$inet6_tcp(0xa, 0x1, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000380)="3633e04e813cbfba79cae0486c4303d9d8aba8e5", 0x14, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0x8, @loopback, 0xa8e}, 0x1c) sched_setscheduler(0x0, 0x1, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='bbr', 0x3) shutdown(r0, 0x1) kernel console output (not intermixed with test programs): : config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 120.651363][ T845] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 120.655603][ T845] usb 6-1: config 14 interface 57 has no altsetting 0 [ 120.658053][ T845] usb 6-1: config 14 interface 228 has no altsetting 0 [ 120.663591][ T845] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 120.666957][ T845] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.670107][ T845] usb 6-1: Product: syz [ 120.671533][ T845] usb 6-1: Manufacturer: syz [ 120.673121][ T845] usb 6-1: SerialNumber: syz [ 121.205323][ T845] legousbtower 6-1:14.57: interrupt endpoints not found [ 121.214609][ T845] legousbtower 6-1:14.228: interrupt endpoints not found [ 121.220591][ T845] usb 6-1: USB disconnect, device number 2 [ 121.488851][ T5761] Bluetooth: hci0: command 0x0406 tx timeout [ 121.488903][ T5763] Bluetooth: hci2: command 0x0c1a tx timeout [ 121.491605][ T5750] Bluetooth: hci3: command 0x0c1a tx timeout [ 121.832749][ T6711] netlink: 24 bytes leftover after parsing attributes in process `syz.0.143'. [ 122.485700][ T6724] netlink: 'syz.3.146': attribute type 1 has an invalid length. [ 123.201275][ T6715] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 123.211570][ T6715] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 123.217068][ T6715] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 123.219862][ T6715] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 123.242928][ T6728] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(9) [ 123.245076][ T6728] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 123.249069][ T6728] vhci_hcd vhci_hcd.0: Device attached [ 123.266010][ T6728] erofs (device sr0): cannot find valid erofs superblock [ 123.579105][ T5953] usb 38-1: SetAddress Request (3) to port 0 [ 123.586517][ T5953] usb 38-1: new SuperSpeed USB device number 3 using vhci_hcd [ 123.688955][ T6729] vhci_hcd: connection reset by peer [ 123.691757][ T12] vhci_hcd vhci_hcd.0: stop threads [ 123.693469][ T12] vhci_hcd vhci_hcd.0: release socket [ 123.697387][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 124.079147][ T5750] Bluetooth: hci1: command 0x0c1a tx timeout [ 125.256740][ T5750] Bluetooth: hci3: command 0x0c1a tx timeout [ 125.260211][ T5750] Bluetooth: hci0: command 0x0406 tx timeout [ 125.263402][ T5763] Bluetooth: hci2: command 0x0c1a tx timeout [ 126.347027][ T6777] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 126.349942][ T6777] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 126.352600][ T6777] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 126.355259][ T6777] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 128.370085][ T5761] Bluetooth: hci3: command 0x0c1a tx timeout [ 128.372624][ T5761] Bluetooth: hci0: command 0x0406 tx timeout [ 128.374578][ T5763] Bluetooth: hci2: command 0x0c1a tx timeout [ 128.376960][ T5761] Bluetooth: hci1: command 0x0c1a tx timeout [ 128.685152][ T6810] dvmrp0: entered allmulticast mode [ 128.688760][ T5953] usb 38-1: device descriptor read/8, error -110 [ 128.997432][ T5763] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 129.000540][ T5763] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 129.062088][ T42] audit: type=1326 audit(1785612949.468:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6815 comm="syz.0.169" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x0 [ 129.080817][ T5953] usb usb38-port1: attempt power cycle [ 129.203547][ T5763] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 129.207269][ T5763] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 129.226361][ T5763] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 129.229283][ T5763] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 129.284271][ T42] audit: type=1326 audit(1785612949.688:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6823 comm="syz.3.170" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc7fec code=0x0 [ 129.822329][ T5953] usb usb38-port1: unable to enumerate USB device [ 130.238205][ T6840] dvmrp0: entered allmulticast mode [ 131.018810][ T5763] Bluetooth: hci3: command 0x0c1a tx timeout [ 131.199773][ T6851] FAULT_INJECTION: forcing a failure. [ 131.199773][ T6851] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 131.199834][ T6851] CPU: 3 UID: 0 PID: 6851 Comm: syz.2.179 Tainted: G L syzkaller #0 PREEMPT(full) [ 131.199850][ T6851] Tainted: [L]=SOFTLOCKUP [ 131.199854][ T6851] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 131.199861][ T6851] Call Trace: [ 131.199893][ T6851] [ 131.199898][ T6851] dump_stack_lvl+0x100/0x190 [ 131.199957][ T6851] should_fail_ex.cold+0x5/0xa [ 131.199975][ T6851] _copy_from_user+0x2e/0xd0 [ 131.200017][ T6851] generic_map_update_batch+0x452/0x800 [ 131.200039][ T6851] ? __pfx_generic_map_update_batch+0x10/0x10 [ 131.200053][ T6851] ? __pfx_generic_map_update_batch+0x10/0x10 [ 131.200065][ T6851] bpf_map_do_batch+0x66f/0x6d0 [ 131.200083][ T6851] __sys_bpf+0x4ce/0x4e80 [ 131.200098][ T6851] ? __pfx___sys_bpf+0x10/0x10 [ 131.200111][ T6851] ? find_held_lock+0x2b/0x80 [ 131.200131][ T6851] ? get_pid_task+0xfc/0x250 [ 131.200150][ T6851] ? get_pid_task+0xfc/0x250 [ 131.200167][ T6851] ? proc_fail_nth_write+0x9f/0x220 [ 131.200190][ T6851] ? find_held_lock+0x2b/0x80 [ 131.200206][ T6851] ? rcu_read_lock_any_held+0x6a/0xa0 [ 131.200221][ T6851] ? find_held_lock+0x2b/0x80 [ 131.200234][ T6851] ? ksys_write+0x190/0x250 [ 131.200250][ T6851] ? ksys_write+0x190/0x250 [ 131.200269][ T6851] ? fput+0x79/0x100 [ 131.200283][ T6851] ? __ia32_sys_bpf+0xcc/0x170 [ 131.200294][ T6851] __ia32_sys_bpf+0xcc/0x170 [ 131.200306][ T6851] ? __do_fast_syscall_32+0x98/0x970 [ 131.200343][ T6851] __do_fast_syscall_32+0xe7/0x970 [ 131.200358][ T6851] ? lockdep_hardirqs_on+0x78/0x100 [ 131.200373][ T6851] do_fast_syscall_32+0x32/0x70 [ 131.200388][ T6851] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 131.200403][ T6851] RIP: 0023:0xf706efec [ 131.200416][ T6851] Code: Unable to access opcode bytes at 0xf706efc2. [ 131.200439][ T6851] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 131.200455][ T6851] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000080000200 [ 131.200462][ T6851] RDX: 0000000000000038 RSI: 0000000000000000 RDI: 0000000000000000 [ 131.200468][ T6851] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 131.200474][ T6851] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 131.200480][ T6851] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 131.200493][ T6851] [ 131.275744][ T6853] FAULT_INJECTION: forcing a failure. [ 131.275744][ T6853] name failslab, interval 1, probability 0, space 0, times 1 [ 131.323085][ T6853] CPU: 3 UID: 0 PID: 6853 Comm: syz.0.180 Tainted: G L syzkaller #0 PREEMPT(full) [ 131.323116][ T6853] Tainted: [L]=SOFTLOCKUP [ 131.323121][ T6853] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 131.323131][ T6853] Call Trace: [ 131.323137][ T6853] [ 131.323143][ T6853] dump_stack_lvl+0x100/0x190 [ 131.323171][ T6853] should_fail_ex.cold+0x5/0xa [ 131.323193][ T6853] should_failslab+0xc2/0x120 [ 131.323227][ T6853] __kmalloc_cache_noprof+0x91/0x6c0 [ 131.323253][ T6853] ? __pfx_sprintf+0x10/0x10 [ 131.323276][ T6853] ? snd_mixer_oss_build_test+0x7a/0x380 [ 131.323307][ T6853] snd_mixer_oss_build_test+0x7a/0x380 [ 131.323336][ T6853] snd_mixer_oss_build_test_all+0x230/0x6e0 [ 131.323365][ T6853] ? __pfx_snd_mixer_oss_build_test_all+0x10/0x10 [ 131.323402][ T6853] snd_mixer_oss_build_input+0x139/0xd50 [ 131.323431][ T6853] ? rcu_is_watching+0x12/0xc0 [ 131.323460][ T6853] ? __pfx_snd_mixer_oss_build_input+0x10/0x10 [ 131.323494][ T6853] ? __asan_memcpy+0x3c/0x60 [ 131.323515][ T6853] snd_mixer_oss_proc_write+0x3f8/0x650 [ 131.323544][ T6853] ? __pfx_snd_mixer_oss_proc_write+0x10/0x10 [ 131.323584][ T6853] ? find_held_lock+0x2b/0x80 [ 131.323607][ T6853] snd_info_text_entry_release+0xfb/0x260 [ 131.323645][ T6853] ? __pfx_snd_mixer_oss_proc_write+0x10/0x10 [ 131.323672][ T6853] ? __pfx_snd_info_text_entry_release+0x10/0x10 [ 131.323692][ T6853] close_pdeo.part.0+0xdf/0x2e0 [ 131.323720][ T6853] proc_reg_release+0x2df/0x350 [ 131.323746][ T6853] ? __pfx_proc_reg_release+0x10/0x10 [ 131.323773][ T6853] ? locks_remove_file+0xd1/0x600 [ 131.323795][ T6853] ? __pfx_locks_remove_file+0x10/0x10 [ 131.323819][ T6853] ? ima_iint_find+0xe9/0x130 [ 131.323847][ T6853] ? ima_file_free+0xc6/0x340 [ 131.323868][ T6853] ? __pfx_proc_reg_release+0x10/0x10 [ 131.323894][ T6853] __fput+0x3ff/0xb50 [ 131.323921][ T6853] fput_close_sync+0x118/0x250 [ 131.323942][ T6853] ? __pfx_fput_close_sync+0x10/0x10 [ 131.323969][ T6853] __ia32_sys_close+0x8b/0x120 [ 131.323994][ T6853] __do_fast_syscall_32+0xe7/0x970 [ 131.324017][ T6853] ? lockdep_hardirqs_on+0x78/0x100 [ 131.324041][ T6853] do_fast_syscall_32+0x32/0x70 [ 131.324065][ T6853] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 131.324087][ T6853] RIP: 0023:0xf7f15fec [ 131.324110][ T6853] Code: Unable to access opcode bytes at 0xf7f15fc2. [ 131.324118][ T6853] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000006 [ 131.324135][ T6853] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 131.324145][ T6853] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 131.324154][ T6853] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 131.324163][ T6853] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 131.324172][ T6853] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 131.324195][ T6853] [ 131.458202][ T5763] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 131.512815][ T42] audit: type=1326 audit(1785612951.918:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6856 comm="syz.2.182" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 131.518244][ T5763] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 131.524228][ T5763] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 131.581698][ T42] audit: type=1326 audit(1785612951.988:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6861 comm="syz.1.184" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x0 [ 131.617889][ T6871] netlink: 'syz.3.186': attribute type 1 has an invalid length. [ 131.643685][ T6871] bond1: entered promiscuous mode [ 131.646766][ T6871] 8021q: adding VLAN 0 to HW filter on device bond1 [ 131.720268][ T5763] Bluetooth: hci0: unexpected event for opcode 0x0403 [ 131.736220][ T6878] netlink: 'syz.3.189': attribute type 1 has an invalid length. [ 131.765733][ T6878] bond2: entered promiscuous mode [ 131.768313][ T6878] 8021q: adding VLAN 0 to HW filter on device bond2 [ 131.771309][ T6879] netlink: 12 bytes leftover after parsing attributes in process `syz.3.189'. [ 131.772204][ T6878] netlink: 12 bytes leftover after parsing attributes in process `syz.3.189'. [ 131.774501][ T6879] netlink: 12 bytes leftover after parsing attributes in process `syz.3.189'. [ 131.778201][ T6878] netlink: 12 bytes leftover after parsing attributes in process `syz.3.189'. [ 131.804263][ T6879] bond2: (slave bridge3): making interface the new active one [ 131.807356][ T6879] bridge3: entered promiscuous mode [ 131.810754][ T6879] bond2: (slave bridge3): Enslaving as an active interface with an up link [ 131.825055][ T6878] bond2: (slave bridge4): Enslaving as a backup interface with an up link [ 132.318101][ T5763] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 132.320836][ T5763] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 132.322612][ T6893] netlink: 'syz.1.192': attribute type 2 has an invalid length. [ 132.333235][ T6893] : entered promiscuous mode [ 132.372681][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.375650][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.380644][ T42] audit: type=1326 audit(1785612952.788:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6888 comm="syz.2.191" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 132.447926][ T6896] netlink: 24 bytes leftover after parsing attributes in process `syz.1.193'. [ 132.645285][ T6898] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(8) [ 132.647643][ T6898] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 132.650993][ T6898] vhci_hcd vhci_hcd.0: Device attached [ 132.676902][ T6898] erofs (device sr0): cannot find valid erofs superblock [ 132.938777][ T5953] usb 40-1: SetAddress Request (6) to port 0 [ 132.941789][ T5953] usb 40-1: new SuperSpeed USB device number 6 using vhci_hcd [ 133.133137][ T6910] netlink: 24 bytes leftover after parsing attributes in process `syz.2.197'. [ 133.297552][ T6899] vhci_hcd: connection reset by peer [ 133.300427][ T12] vhci_hcd vhci_hcd.1: stop threads [ 133.302839][ T12] vhci_hcd vhci_hcd.1: release socket [ 133.305288][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 133.394272][ T6913] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(9) [ 133.396335][ T6913] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 133.403130][ T6913] vhci_hcd vhci_hcd.0: Device attached [ 133.547543][ T6913] erofs (device sr0): cannot find valid erofs superblock [ 133.689288][ T4053] usb 42-1: SetAddress Request (6) to port 0 [ 133.691684][ T4053] usb 42-1: new SuperSpeed USB device number 6 using vhci_hcd [ 134.097505][ T6914] vhci_hcd: connection reset by peer [ 134.100018][ T12] vhci_hcd vhci_hcd.2: stop threads [ 134.101774][ T12] vhci_hcd vhci_hcd.2: release socket [ 134.105117][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 134.265031][ T6933] FAULT_INJECTION: forcing a failure. [ 134.265031][ T6933] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 134.270961][ T6933] CPU: 0 UID: 0 PID: 6933 Comm: syz.1.203 Tainted: G L syzkaller #0 PREEMPT(full) [ 134.270980][ T6933] Tainted: [L]=SOFTLOCKUP [ 134.270984][ T6933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.270990][ T6933] Call Trace: [ 134.270994][ T6933] [ 134.270998][ T6933] dump_stack_lvl+0x100/0x190 [ 134.271044][ T6933] should_fail_ex.cold+0x5/0xa [ 134.271057][ T6933] _copy_to_user+0x32/0xd0 [ 134.271076][ T6933] simple_read_from_buffer+0xcb/0x170 [ 134.271106][ T6933] proc_fail_nth_read+0x1af/0x230 [ 134.271122][ T6933] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 134.271138][ T6933] ? rw_verify_area+0xce/0x6d0 [ 134.271154][ T6933] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 134.271169][ T6933] vfs_read+0x1e4/0xb40 [ 134.271181][ T6933] ? __pfx_vfs_read+0x10/0x10 [ 134.271190][ T6933] ? find_held_lock+0x2b/0x80 [ 134.271204][ T6933] ? __fget_files+0x215/0x3d0 [ 134.271217][ T6933] ? __fget_files+0x21f/0x3d0 [ 134.271235][ T6933] ksys_read+0x12a/0x250 [ 134.271245][ T6933] ? __pfx_ksys_read+0x10/0x10 [ 134.271259][ T6933] do_int80_emulation+0x14b/0x720 [ 134.271277][ T6933] asm_int80_emulation+0x1a/0x20 [ 134.271288][ T6933] RIP: 0023:0xf71f73eb [ 134.271298][ T6933] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 134.271309][ T6933] RSP: 002b:00000000f54b64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 134.271320][ T6933] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54b65d0 [ 134.271327][ T6933] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 134.271333][ T6933] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 134.271338][ T6933] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 134.271345][ T6933] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 134.271358][ T6933] [ 134.847979][ T6943] netlink: 24 bytes leftover after parsing attributes in process `syz.0.207'. [ 134.978131][ T6946] netlink: 24 bytes leftover after parsing attributes in process `syz.2.208'. [ 135.316243][ T6948] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 135.319104][ T6948] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 135.322711][ T6948] vhci_hcd vhci_hcd.0: Device attached [ 135.450460][ T6953] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(9) [ 135.453033][ T6953] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 135.476146][ T6948] erofs (device sr0): cannot find valid erofs superblock [ 135.490596][ T6953] vhci_hcd vhci_hcd.0: Device attached [ 135.588266][ T6953] erofs (device sr0): cannot find valid erofs superblock [ 135.760249][ T56] usb 38-1: SetAddress Request (7) to port 0 [ 135.762231][ T56] usb 38-1: new SuperSpeed USB device number 7 using vhci_hcd [ 135.803300][ T6951] vhci_hcd: connection closed [ 135.805638][ T12] vhci_hcd vhci_hcd.2: stop threads [ 135.813041][ T12] vhci_hcd vhci_hcd.2: release socket [ 135.815821][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 136.031851][ T6956] vhci_hcd: connection reset by peer [ 136.033962][ T12] vhci_hcd vhci_hcd.0: stop threads [ 136.036922][ T12] vhci_hcd vhci_hcd.0: release socket [ 136.039612][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 136.812279][ T6977] netlink: 40 bytes leftover after parsing attributes in process `syz.0.217'. [ 136.885109][ T5763] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 136.936472][ T5763] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 136.996938][ T42] audit: type=1326 audit(1785612957.398:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6969 comm="syz.2.216" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 137.798119][ T6995] netlink: 64 bytes leftover after parsing attributes in process `syz.0.219'. [ 137.969251][ T5953] usb 40-1: device descriptor read/8, error -110 [ 138.071811][ T6997] netlink: 'syz.0.221': attribute type 1 has an invalid length. [ 138.136674][ T6997] bond3: entered promiscuous mode [ 138.140690][ T6997] 8021q: adding VLAN 0 to HW filter on device bond3 [ 138.198622][ T5763] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 138.201353][ T5763] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 138.258734][ T42] audit: type=1326 audit(1785612958.658:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7004 comm="syz.1.223" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x0 [ 138.286279][ T7013] netlink: 'syz.0.224': attribute type 1 has an invalid length. [ 138.299751][ T7013] bond4: entered promiscuous mode [ 138.301673][ T7013] 8021q: adding VLAN 0 to HW filter on device bond4 [ 138.314209][ T5763] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 138.317385][ T5763] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 138.382143][ T42] audit: type=1326 audit(1785612958.788:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7009 comm="syz.2.225" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 138.419796][ T7019] blktrace: Concurrent blktraces are not allowed on sg0 [ 138.476107][ T5953] usb usb40-port1: attempt power cycle [ 138.768844][ T4053] usb 42-1: device descriptor read/8, error -110 [ 139.069687][ T5953] usb usb40-port1: unable to enumerate USB device [ 139.189341][ T4053] usb usb42-port1: attempt power cycle [ 139.770534][ T4053] usb usb42-port1: unable to enumerate USB device [ 139.997964][ T7048] nd_pmem pfn0.0: probe with driver nd_pmem failed with error -16 [ 140.238823][ T50] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 140.400996][ T50] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 140.405698][ T50] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 140.410385][ T50] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 140.416018][ T50] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 140.420068][ T50] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 140.431718][ T50] usb 6-1: config 0 descriptor?? [ 140.858752][ T56] usb 38-1: device descriptor read/8, error -110 [ 140.933275][ T42] audit: type=1326 audit(1785612961.338:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7051 comm="syz.0.240" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x0 [ 140.974895][ T50] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 141.062748][ T7060] process 'syz.3.241' launched './file1' with NULL argv: empty string added [ 141.207830][ T29] usb 6-1: USB disconnect, device number 3 [ 141.259420][ T56] usb usb38-port1: attempt power cycle [ 141.853644][ T56] usb usb38-port1: unable to enumerate USB device [ 143.187259][ T5763] Bluetooth: hci3: command 0x0c1a tx timeout [ 143.547446][ T7095] netlink: 'syz.1.253': attribute type 1 has an invalid length. [ 143.579386][ T7095] bond2: entered promiscuous mode [ 143.581592][ T7095] 8021q: adding VLAN 0 to HW filter on device bond2 [ 143.898879][ T41] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 143.909337][ T5846] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 144.055298][ T41] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 144.059532][ T41] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 144.062867][ T41] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 144.065820][ T41] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 144.094588][ T7104] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 144.148618][ T41] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 144.530517][ T41] usb 7-1: USB disconnect, device number 4 [ 145.248812][ T5750] Bluetooth: hci3: command 0x0c1a tx timeout [ 145.539663][ T7130] netlink: 'syz.1.264': attribute type 1 has an invalid length. [ 145.555469][ T7130] bond3: entered promiscuous mode [ 145.557318][ T7130] 8021q: adding VLAN 0 to HW filter on device bond3 [ 147.270177][ T5750] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 147.274995][ T5750] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 147.325404][ T42] audit: type=1326 audit(1785612967.728:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7148 comm="syz.2.268" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 148.409549][ T7174] netlink: 'syz.1.274': attribute type 1 has an invalid length. [ 148.493081][ T7174] bond4: entered promiscuous mode [ 148.495546][ T7174] 8021q: adding VLAN 0 to HW filter on device bond4 [ 149.248710][ T5750] Bluetooth: hci3: command 0x0c1a tx timeout [ 149.417341][ T7205] FAULT_INJECTION: forcing a failure. [ 149.417341][ T7205] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 149.430755][ T7205] CPU: 1 UID: 0 PID: 7205 Comm: syz.2.281 Tainted: G L syzkaller #0 PREEMPT(full) [ 149.430778][ T7205] Tainted: [L]=SOFTLOCKUP [ 149.430782][ T7205] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 149.430788][ T7205] Call Trace: [ 149.430793][ T7205] [ 149.430797][ T7205] dump_stack_lvl+0x100/0x190 [ 149.430815][ T7205] should_fail_ex.cold+0x5/0xa [ 149.430828][ T7205] _copy_from_iter+0x1f4/0x1690 [ 149.430851][ T7205] ? __asan_memset+0x23/0x50 [ 149.430864][ T7205] ? __pfx__copy_from_iter+0x10/0x10 [ 149.430881][ T7205] ? __pfx___alloc_skb+0x10/0x10 [ 149.430901][ T7205] netlink_sendmsg+0x808/0xda0 [ 149.430917][ T7205] ? __pfx_netlink_sendmsg+0x10/0x10 [ 149.430931][ T7205] ? apparmor_socket_sendmsg+0x15b/0x270 [ 149.430982][ T7205] ____sys_sendmsg+0xa4d/0xbe0 [ 149.430993][ T7205] ? __pfx_netlink_sendmsg+0x10/0x10 [ 149.431006][ T7205] ? __pfx_____sys_sendmsg+0x10/0x10 [ 149.431024][ T7205] ___sys_sendmsg+0x190/0x1e0 [ 149.431037][ T7205] ? __pfx____sys_sendmsg+0x10/0x10 [ 149.431056][ T7205] ? find_held_lock+0x2b/0x80 [ 149.431078][ T7205] __sys_sendmsg+0x160/0x210 [ 149.431094][ T7205] ? __pfx___sys_sendmsg+0x10/0x10 [ 149.431113][ T7205] ? __pfx_ksys_write+0x10/0x10 [ 149.431127][ T7205] __do_fast_syscall_32+0xe7/0x970 [ 149.431142][ T7205] ? lockdep_hardirqs_on+0x78/0x100 [ 149.431157][ T7205] do_fast_syscall_32+0x32/0x70 [ 149.431173][ T7205] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 149.431188][ T7205] RIP: 0023:0xf706efec [ 149.431204][ T7205] Code: Unable to access opcode bytes at 0xf706efc2. [ 149.431209][ T7205] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 149.431221][ T7205] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 149.431227][ T7205] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 149.431233][ T7205] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 149.431239][ T7205] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 149.431245][ T7205] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 149.431259][ T7205] [ 150.679133][ T42] audit: type=1326 audit(1785612971.008:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7248 comm="syz.0.287" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x0 [ 150.732233][ T5763] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 150.735479][ T5763] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 150.794230][ T42] audit: type=1326 audit(1785612971.198:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7254 comm="syz.3.289" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc7fec code=0x0 [ 150.837099][ T7261] blktrace: Concurrent blktraces are not allowed on sg0 [ 151.590673][ T7269] dvmrp0: entered allmulticast mode [ 151.712260][ T7276] tipc: Enabling of bearer rejected, failed to enable media [ 151.781526][ T7283] FAULT_INJECTION: forcing a failure. [ 151.781526][ T7283] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 151.787753][ T7283] CPU: 1 UID: 0 PID: 7283 Comm: syz.0.296 Tainted: G L syzkaller #0 PREEMPT(full) [ 151.787780][ T7283] Tainted: [L]=SOFTLOCKUP [ 151.787785][ T7283] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 151.787795][ T7283] Call Trace: [ 151.787801][ T7283] [ 151.787807][ T7283] dump_stack_lvl+0x100/0x190 [ 151.787832][ T7283] should_fail_ex.cold+0x5/0xa [ 151.787853][ T7283] _copy_to_user+0x32/0xd0 [ 151.787879][ T7283] simple_read_from_buffer+0xcb/0x170 [ 151.787907][ T7283] proc_fail_nth_read+0x1af/0x230 [ 151.787931][ T7283] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 151.787953][ T7283] ? rw_verify_area+0xce/0x6d0 [ 151.787977][ T7283] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 151.787998][ T7283] vfs_read+0x1e4/0xb40 [ 151.788016][ T7283] ? __pfx_vfs_read+0x10/0x10 [ 151.788029][ T7283] ? find_held_lock+0x2b/0x80 [ 151.788050][ T7283] ? __fget_files+0x215/0x3d0 [ 151.788070][ T7283] ? __fget_files+0x21f/0x3d0 [ 151.788091][ T7283] ksys_read+0x12a/0x250 [ 151.788106][ T7283] ? __pfx_ksys_read+0x10/0x10 [ 151.788128][ T7283] do_int80_emulation+0x14b/0x720 [ 151.788153][ T7283] asm_int80_emulation+0x1a/0x20 [ 151.788169][ T7283] RIP: 0023:0xf71173eb [ 151.788189][ T7283] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 151.788204][ T7283] RSP: 002b:00000000f53d64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 151.788220][ T7283] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f53d65d0 [ 151.788231][ T7283] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 151.788239][ T7283] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 151.788248][ T7283] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 151.788257][ T7283] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 151.788278][ T7283] [ 152.034959][ T7294] netlink: 'syz.1.301': attribute type 1 has an invalid length. [ 152.173822][ T7294] bond5: entered promiscuous mode [ 152.176401][ T7294] 8021q: adding VLAN 0 to HW filter on device bond5 [ 152.357077][ T42] audit: type=1326 audit(1785612972.758:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7292 comm="syz.0.300" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x0 [ 152.414222][ T5763] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 152.418691][ T5763] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 152.460616][ T5763] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 152.481202][ T5763] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 152.484991][ T42] audit: type=1326 audit(1785612972.888:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7310 comm="syz.3.307" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc7fec code=0x0 [ 152.532615][ T42] audit: type=1326 audit(1785612972.938:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7312 comm="syz.1.306" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x0 [ 152.538778][ T5763] Bluetooth: hci3: command 0x0c1a tx timeout [ 153.198110][ T24] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 154.221719][ T5763] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 154.227808][ T5763] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 154.328985][ T42] audit: type=1326 audit(1785612974.718:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7342 comm="syz.3.316" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc7fec code=0x0 [ 154.547869][ T24] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 154.608733][ T5763] Bluetooth: hci3: command 0x0c1a tx timeout [ 156.698787][ T5763] Bluetooth: hci3: command 0x0c1a tx timeout [ 164.176769][ T7395] vhci_hcd vhci_hcd.0: remove, state 4 [ 164.181806][ T7395] usb usb38: USB disconnect, device number 1 [ 164.270634][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.272396][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.279145][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.285214][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.287270][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.292520][ T42] audit: type=1326 audit(1785612984.698:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7394 comm="syz.0.318" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x0 [ 164.302278][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.310761][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.312854][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.314553][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.322179][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.323948][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.325772][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.327869][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.332908][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.334723][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.338977][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.342192][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.345252][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.348813][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.351907][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.355431][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.364657][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.366365][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.368053][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.372869][ T7395] vhci_hcd vhci_hcd.0: USB bus 38 deregistered [ 164.390401][ T7395] vhci_hcd vhci_hcd.0: remove, state 4 [ 164.392218][ T7395] usb usb37: USB disconnect, device number 1 [ 164.424256][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.426008][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.429924][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.433001][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.436154][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.437834][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.440847][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.442824][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.444548][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.448931][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.450929][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.452674][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.458196][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.460562][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.463053][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.464893][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.466789][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.468490][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.470678][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.472773][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.475356][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.477671][ T5845] vhci_hcd vhci_hcd.0: stop threads [ 164.480746][ T5845] vhci_hcd vhci_hcd.0: release socket [ 164.483033][ T5845] vhci_hcd vhci_hcd.0: disconnect device [ 164.485404][ T7395] vhci_hcd vhci_hcd.0: USB bus 37 deregistered [ 164.963840][ T7422] netlink: 'syz.1.324': attribute type 1 has an invalid length. [ 165.271607][ T7422] bond6: entered promiscuous mode [ 165.288709][ T7422] 8021q: adding VLAN 0 to HW filter on device bond6 [ 166.207932][ T5763] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 166.210929][ T5763] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 166.287115][ T42] audit: type=1326 audit(1785612986.688:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7437 comm="syz.1.326" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x0 [ 166.295145][ T5763] Bluetooth: hci3: command 0x0c1a tx timeout [ 167.541632][ T7463] netlink: 24 bytes leftover after parsing attributes in process `syz.0.333'. [ 167.665588][ T7468] netlink: 'syz.2.334': attribute type 1 has an invalid length. [ 167.709780][ T7468] bond1: entered promiscuous mode [ 167.711837][ T7468] 8021q: adding VLAN 0 to HW filter on device bond1 [ 167.773815][ T42] audit: type=1804 audit(1785612988.178:21): pid=7472 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.331" name="/newroot/85/file0" dev="tmpfs" ino=493 res=1 errno=0 [ 167.808682][ T7475] erofs (device sr0): cannot find valid erofs superblock [ 168.335532][ T7491] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 168.343578][ T7491] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 168.351199][ T7491] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 168.359700][ T7491] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 168.540854][ T7457] netlink: 8 bytes leftover after parsing attributes in process `syz.3.331'. [ 168.820218][ T5763] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 168.823899][ T5763] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 168.885387][ T42] audit: type=1326 audit(1785612989.288:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7501 comm="syz.3.338" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc7fec code=0x0 [ 169.183224][ T7513] binder: 7512:7513 ioctl 541b 0 returned -22 [ 169.990032][ T7521] netlink: 'syz.2.343': attribute type 1 has an invalid length. [ 170.043072][ T7521] bond2: entered promiscuous mode [ 170.045033][ T7521] 8021q: adding VLAN 0 to HW filter on device bond2 [ 170.231489][ T7535] netlink: 24 bytes leftover after parsing attributes in process `syz.0.348'. [ 170.378828][ T5763] Bluetooth: hci3: command 0x0c1a tx timeout [ 170.378905][ T5761] Bluetooth: hci0: command 0x0406 tx timeout [ 170.379239][ T5759] Bluetooth: hci2: command 0x0c1a tx timeout [ 170.379272][ T5759] Bluetooth: hci1: command 0x0c1a tx timeout [ 170.496082][ T42] audit: type=1804 audit(1785612990.898:23): pid=7549 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.352" name="/newroot/89/file0" dev="tmpfs" ino=516 res=1 errno=0 [ 170.572238][ T7550] erofs (device sr0): cannot find valid erofs superblock [ 170.704347][ T7555] netlink: 48 bytes leftover after parsing attributes in process `syz.2.355'. [ 171.022018][ T5846] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 171.471191][ T7565] netlink: 'syz.2.359': attribute type 1 has an invalid length. [ 171.538408][ T7565] bond3: entered promiscuous mode [ 171.541028][ T7565] 8021q: adding VLAN 0 to HW filter on device bond3 [ 172.448746][ T5750] Bluetooth: hci3: command 0x0c1a tx timeout [ 172.704008][ T7603] FAULT_INJECTION: forcing a failure. [ 172.704008][ T7603] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 172.708199][ T7603] CPU: 2 UID: 0 PID: 7603 Comm: syz.1.365 Tainted: G L syzkaller #0 PREEMPT(full) [ 172.708218][ T7603] Tainted: [L]=SOFTLOCKUP [ 172.708222][ T7603] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 172.708228][ T7603] Call Trace: [ 172.708233][ T7603] [ 172.708238][ T7603] dump_stack_lvl+0x100/0x190 [ 172.708256][ T7603] should_fail_ex.cold+0x5/0xa [ 172.708270][ T7603] _copy_from_iter+0x1f4/0x1690 [ 172.708289][ T7603] ? __lock_acquire+0x49f/0x1a40 [ 172.708308][ T7603] ? __pfx__copy_from_iter+0x10/0x10 [ 172.708326][ T7603] ? _parse_integer_limit+0x1ac/0x220 [ 172.708343][ T7603] tun_get_user+0x265/0x3c20 [ 172.708370][ T7603] ? aa_file_perm+0x7f3/0x14d0 [ 172.708391][ T7603] ? __pfx_tun_get_user+0x10/0x10 [ 172.708405][ T7603] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 172.708427][ T7603] ? find_held_lock+0x2b/0x80 [ 172.708440][ T7603] ? tun_get+0x191/0x370 [ 172.708451][ T7603] ? tun_get+0x191/0x370 [ 172.708466][ T7603] tun_chr_write_iter+0xdc/0x200 [ 172.708480][ T7603] vfs_write+0x6ac/0x1050 [ 172.708491][ T7603] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 172.708505][ T7603] ? __pfx_vfs_write+0x10/0x10 [ 172.708514][ T7603] ? find_held_lock+0x2b/0x80 [ 172.708536][ T7603] ksys_write+0x12a/0x250 [ 172.708546][ T7603] ? __pfx_ksys_write+0x10/0x10 [ 172.708555][ T7603] ? ksys_write+0x1ac/0x250 [ 172.708565][ T7603] ? __pfx_ksys_write+0x10/0x10 [ 172.708577][ T7603] __do_fast_syscall_32+0xe7/0x970 [ 172.708593][ T7603] ? lockdep_hardirqs_on+0x78/0x100 [ 172.708608][ T7603] do_fast_syscall_32+0x32/0x70 [ 172.708624][ T7603] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 172.708652][ T7603] RIP: 0023:0xf7ff2fec [ 172.708666][ T7603] Code: Unable to access opcode bytes at 0xf7ff2fc2. [ 172.708670][ T7603] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 172.708682][ T7603] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 172.708688][ T7603] RDX: 000000000000004a RSI: 0000000000000000 RDI: 0000000000000000 [ 172.708694][ T7603] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 172.708700][ T7603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 172.708706][ T7603] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 172.708720][ T7603] [ 172.995827][ T5750] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 172.999627][ T5750] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 173.057597][ T42] audit: type=1326 audit(1785612993.458:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7605 comm="syz.1.366" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x0 [ 174.269727][ T7631] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 174.271849][ T7631] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 174.285804][ T7631] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 174.293760][ T7631] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 174.579777][ T7639] netlink: 24 bytes leftover after parsing attributes in process `syz.1.375'. [ 174.613957][ T7641] netlink: 'syz.0.376': attribute type 1 has an invalid length. [ 174.631515][ T7641] bond5: entered promiscuous mode [ 174.634131][ T7641] 8021q: adding VLAN 0 to HW filter on device bond5 [ 174.781561][ T7645] netlink: 'syz.0.377': attribute type 1 has an invalid length. [ 174.804758][ T7645] bond6: entered promiscuous mode [ 174.806787][ T7645] 8021q: adding VLAN 0 to HW filter on device bond6 [ 175.006568][ T7651] erofs (device sr0): cannot find valid erofs superblock [ 175.476739][ T7661] FAULT_INJECTION: forcing a failure. [ 175.476739][ T7661] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 175.487333][ T7661] CPU: 1 UID: 0 PID: 7661 Comm: syz.3.383 Tainted: G L syzkaller #0 PREEMPT(full) [ 175.487353][ T7661] Tainted: [L]=SOFTLOCKUP [ 175.487357][ T7661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 175.487363][ T7661] Call Trace: [ 175.487368][ T7661] [ 175.487373][ T7661] dump_stack_lvl+0x100/0x190 [ 175.487392][ T7661] should_fail_ex.cold+0x5/0xa [ 175.487405][ T7661] _copy_from_user+0x2e/0xd0 [ 175.487423][ T7661] get_compat_msghdr+0xb3/0x480 [ 175.487442][ T7661] ? __pfx_get_compat_msghdr+0x10/0x10 [ 175.487464][ T7661] ___sys_sendmsg+0x1b6/0x1e0 [ 175.487478][ T7661] ? __pfx____sys_sendmsg+0x10/0x10 [ 175.487496][ T7661] ? find_held_lock+0x2b/0x80 [ 175.487519][ T7661] __sys_sendmsg+0x160/0x210 [ 175.487535][ T7661] ? __pfx___sys_sendmsg+0x10/0x10 [ 175.487568][ T7661] ? __pfx_ksys_write+0x10/0x10 [ 175.487582][ T7661] __do_fast_syscall_32+0xe7/0x970 [ 175.487597][ T7661] ? lockdep_hardirqs_on+0x78/0x100 [ 175.487612][ T7661] do_fast_syscall_32+0x32/0x70 [ 175.487628][ T7661] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 175.487643][ T7661] RIP: 0023:0xf7fc7fec [ 175.487658][ T7661] Code: Unable to access opcode bytes at 0xf7fc7fc2. [ 175.487662][ T7661] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 175.487674][ T7661] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000180 [ 175.487681][ T7661] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 175.487687][ T7661] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 175.487705][ T7661] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 175.487712][ T7661] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 175.487725][ T7661] [ 176.177990][ T7671] netlink: 'syz.3.386': attribute type 1 has an invalid length. [ 176.272059][ T7671] bond3: entered promiscuous mode [ 176.279639][ T7671] 8021q: adding VLAN 0 to HW filter on device bond3 [ 176.289010][ T5761] Bluetooth: hci2: command 0x0c1a tx timeout [ 176.289109][ T5763] Bluetooth: hci1: command 0x0c1a tx timeout [ 176.291616][ T5750] Bluetooth: hci0: command 0x0406 tx timeout [ 176.378899][ T5750] Bluetooth: hci3: command 0x0c1a tx timeout [ 176.401686][ T7678] netlink: 24 bytes leftover after parsing attributes in process `syz.2.387'. [ 176.919540][ T7693] erofs (device sr0): cannot find valid erofs superblock [ 177.748264][ T41] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 177.756467][ T7711] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 177.764519][ T7711] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 177.772030][ T7711] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 177.777619][ T7711] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 178.271312][ T7722] netlink: 'syz.1.397': attribute type 1 has an invalid length. [ 178.294905][ T7725] FAULT_INJECTION: forcing a failure. [ 178.294905][ T7725] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 178.304381][ T7725] CPU: 2 UID: 0 PID: 7725 Comm: syz.3.399 Tainted: G L syzkaller #0 PREEMPT(full) [ 178.304427][ T7725] Tainted: [L]=SOFTLOCKUP [ 178.304433][ T7725] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 178.304443][ T7725] Call Trace: [ 178.304449][ T7725] [ 178.304455][ T7725] dump_stack_lvl+0x100/0x190 [ 178.304482][ T7725] should_fail_ex.cold+0x5/0xa [ 178.304503][ T7725] _copy_from_user+0x2e/0xd0 [ 178.304531][ T7725] get_compat_msghdr+0xb3/0x480 [ 178.304559][ T7725] ? __pfx_get_compat_msghdr+0x10/0x10 [ 178.304595][ T7725] ___sys_sendmsg+0x1b6/0x1e0 [ 178.304617][ T7725] ? __pfx____sys_sendmsg+0x10/0x10 [ 178.304649][ T7725] ? find_held_lock+0x2b/0x80 [ 178.304673][ T7722] bond7: entered promiscuous mode [ 178.304686][ T7725] __sys_sendmsg+0x160/0x210 [ 178.304726][ T7725] ? __pfx___sys_sendmsg+0x10/0x10 [ 178.304758][ T7725] ? __pfx_ksys_write+0x10/0x10 [ 178.304781][ T7725] __do_fast_syscall_32+0xe7/0x970 [ 178.304806][ T7725] ? lockdep_hardirqs_on+0x78/0x100 [ 178.304831][ T7725] do_fast_syscall_32+0x32/0x70 [ 178.304856][ T7725] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 178.304879][ T7725] RIP: 0023:0xf7fc7fec [ 178.304900][ T7725] Code: Unable to access opcode bytes at 0xf7fc7fc2. [ 178.304908][ T7725] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 178.304926][ T7725] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800002c0 [ 178.304937][ T7725] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 178.304947][ T7725] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 178.304956][ T7725] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 178.304967][ T7725] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 178.304989][ T7725] [ 178.380579][ T7722] 8021q: adding VLAN 0 to HW filter on device bond7 [ 179.199404][ T7747] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 179.221343][ T7747] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 179.230201][ T7747] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 179.232296][ T7747] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 179.529567][ T7754] netlink: 4 bytes leftover after parsing attributes in process `syz.0.406'. [ 179.535115][ T7755] netlink: 24 bytes leftover after parsing attributes in process `syz.3.405'. [ 179.729869][ T7764] overlayfs: failed to resolve './file2': -2 [ 179.873349][ T7768] netlink: 4 bytes leftover after parsing attributes in process `syz.1.410'. [ 179.890098][ T7768] FAULT_INJECTION: forcing a failure. [ 179.890098][ T7768] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 179.895510][ T6237] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 179.898462][ T6237] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 179.908621][ T7768] CPU: 0 UID: 0 PID: 7768 Comm: syz.1.410 Tainted: G L syzkaller #0 PREEMPT(full) [ 179.908659][ T7768] Tainted: [L]=SOFTLOCKUP [ 179.908663][ T7768] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 179.908670][ T7768] Call Trace: [ 179.908674][ T7768] [ 179.908679][ T7768] dump_stack_lvl+0x100/0x190 [ 179.908697][ T7768] should_fail_ex.cold+0x5/0xa [ 179.908711][ T7768] _copy_from_user+0x2e/0xd0 [ 179.908729][ T7768] get_compat_msghdr+0xb3/0x480 [ 179.908750][ T7768] ? __pfx_get_compat_msghdr+0x10/0x10 [ 179.908776][ T7768] ? _kstrtoull+0x13c/0x1f0 [ 179.908791][ T7768] ? __pfx__kstrtoull+0x10/0x10 [ 179.908809][ T7768] ___sys_sendmsg+0x1b6/0x1e0 [ 179.908830][ T7768] ? __pfx____sys_sendmsg+0x10/0x10 [ 179.908846][ T7768] ? __lock_acquire+0x49f/0x1a40 [ 179.908880][ T7768] __sys_sendmmsg+0x309/0x440 [ 179.908898][ T7768] ? __pfx___sys_sendmmsg+0x10/0x10 [ 179.908913][ T7768] ? find_held_lock+0x2b/0x80 [ 179.908931][ T7768] ? __mutex_unlock_slowpath+0x35d/0x930 [ 179.908953][ T7768] ? fput+0x79/0x100 [ 179.908966][ T7768] ? ksys_write+0x1ac/0x250 [ 179.908978][ T7768] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 179.908996][ T7768] ? lockdep_hardirqs_on+0x78/0x100 [ 179.909010][ T7768] __do_fast_syscall_32+0xe7/0x970 [ 179.909025][ T7768] ? lockdep_hardirqs_on+0x78/0x100 [ 179.909040][ T7768] do_fast_syscall_32+0x32/0x70 [ 179.909056][ T7768] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 179.909071][ T7768] RIP: 0023:0xf7ff2fec [ 179.909087][ T7768] Code: Unable to access opcode bytes at 0xf7ff2fc2. [ 179.909091][ T7768] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 179.909103][ T7768] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080007fc0 [ 179.909110][ T7768] RDX: 000000000800001d RSI: 000000000000001c RDI: 0000000000000000 [ 179.909116][ T7768] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 179.909122][ T7768] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 179.909128][ T7768] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 179.909142][ T7768] [ 180.070409][ T7769] erofs (device sr0): cannot find valid erofs superblock [ 180.076508][ T7771] netlink: 'syz.0.411': attribute type 1 has an invalid length. [ 180.114667][ T7771] bond7: entered promiscuous mode [ 180.120254][ T7771] 8021q: adding VLAN 0 to HW filter on device bond7 [ 181.258858][ T5750] Bluetooth: hci3: command 0x0c1a tx timeout [ 181.259027][ T5763] Bluetooth: hci0: command 0x0406 tx timeout [ 181.261207][ T5750] Bluetooth: hci2: command 0x0c1a tx timeout [ 181.396361][ T7787] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 181.424313][ T7787] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 181.449889][ T7787] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 181.455598][ T7787] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 182.525390][ T7813] netlink: 'syz.3.421': attribute type 1 has an invalid length. [ 182.539778][ T7813] bond4: entered promiscuous mode [ 182.542070][ T7813] 8021q: adding VLAN 0 to HW filter on device bond4 [ 182.596018][ T7816] netlink: 24 bytes leftover after parsing attributes in process `syz.3.422'. [ 182.768991][ T5750] Bluetooth: hci1: command 0x0c1a tx timeout [ 182.834166][ T7820] erofs (device sr0): cannot find valid erofs superblock [ 183.488787][ T5761] Bluetooth: hci0: command 0x0406 tx timeout [ 183.491399][ T5763] Bluetooth: hci2: command 0x0c1a tx timeout [ 183.494036][ T5750] Bluetooth: hci3: command 0x0c1a tx timeout [ 185.332851][ T42] audit: type=1804 audit(1785613005.738:25): pid=7852 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.435" name="/newroot/113/cgroup.controllers" dev="tmpfs" ino=649 res=1 errno=0 [ 185.347827][ T7859] netlink: 'syz.2.437': attribute type 1 has an invalid length. [ 185.357662][ T42] audit: type=1800 audit(1785613005.738:26): pid=7852 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.435" name="cgroup.controllers" dev="tmpfs" ino=649 res=0 errno=0 [ 185.648544][ T7859] bond4: entered promiscuous mode [ 185.655947][ T7859] 8021q: adding VLAN 0 to HW filter on device bond4 [ 186.144503][ T7879] netlink: 24 bytes leftover after parsing attributes in process `syz.2.440'. [ 186.524031][ T7887] erofs (device sr0): cannot find valid erofs superblock [ 188.290602][ T5763] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 188.296756][ T5763] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 188.351767][ T42] audit: type=1326 audit(1785613008.758:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7906 comm="syz.0.448" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x0 [ 189.088259][ T7925] overlay: Unknown parameter 'smackfsdef' [ 190.298715][ T5763] Bluetooth: hci3: command 0x0c1a tx timeout [ 190.647585][ T7956] netlink: 'syz.2.461': attribute type 1 has an invalid length. [ 190.723583][ T7956] bond5: entered promiscuous mode [ 190.728387][ T7956] 8021q: adding VLAN 0 to HW filter on device bond5 [ 190.813136][ T7960] FAULT_INJECTION: forcing a failure. [ 190.813136][ T7960] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 190.817253][ T7960] CPU: 0 UID: 0 PID: 7960 Comm: syz.2.462 Tainted: G L syzkaller #0 PREEMPT(full) [ 190.817271][ T7960] Tainted: [L]=SOFTLOCKUP [ 190.817275][ T7960] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 190.817282][ T7960] Call Trace: [ 190.817287][ T7960] [ 190.817291][ T7960] dump_stack_lvl+0x100/0x190 [ 190.817309][ T7960] should_fail_ex.cold+0x5/0xa [ 190.817322][ T7960] _copy_from_user+0x2e/0xd0 [ 190.817342][ T7960] get_compat_msghdr+0xb3/0x480 [ 190.817360][ T7960] ? __pfx_get_compat_msghdr+0x10/0x10 [ 190.817380][ T7960] ? __lock_acquire+0x49f/0x1a40 [ 190.817400][ T7960] ___sys_recvmsg+0x193/0x1a0 [ 190.817413][ T7960] ? __pfx____sys_recvmsg+0x10/0x10 [ 190.817437][ T7960] do_recvmmsg+0x54d/0x740 [ 190.817451][ T7960] ? __pfx_do_recvmmsg+0x10/0x10 [ 190.817464][ T7960] ? find_held_lock+0x2b/0x80 [ 190.817477][ T7960] ? ksys_write+0x190/0x250 [ 190.817488][ T7960] ? ksys_write+0x190/0x250 [ 190.817503][ T7960] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 190.817521][ T7960] __sys_recvmmsg+0x21f/0x270 [ 190.817538][ T7960] ? __pfx___sys_recvmmsg+0x10/0x10 [ 190.817555][ T7960] ? ksys_write+0x1ac/0x250 [ 190.817567][ T7960] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 190.817578][ T7960] ? __do_fast_syscall_32+0x98/0x970 [ 190.817594][ T7960] ? lockdep_hardirqs_on+0x78/0x100 [ 190.817607][ T7960] __do_fast_syscall_32+0xe7/0x970 [ 190.817622][ T7960] ? lockdep_hardirqs_on+0x78/0x100 [ 190.817637][ T7960] do_fast_syscall_32+0x32/0x70 [ 190.817653][ T7960] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 190.817668][ T7960] RIP: 0023:0xf706efec [ 190.817682][ T7960] Code: Unable to access opcode bytes at 0xf706efc2. [ 190.817687][ T7960] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 190.817698][ T7960] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000240 [ 190.817704][ T7960] RDX: 0000000000000001 RSI: 0000000040010130 RDI: 0000000000000000 [ 190.817711][ T7960] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 190.817717][ T7960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 190.817723][ T7960] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 190.817736][ T7960] [ 190.978814][ T42] audit: type=1326 audit(1785613011.378:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.2.463" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 190.991418][ T42] audit: type=1326 audit(1785613011.388:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.2.463" exe="/syz-executor" sig=0 arch=40000003 syscall=297 compat=1 ip=0xf706efec code=0x7ffc0000 [ 191.001333][ T42] audit: type=1326 audit(1785613011.388:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.2.463" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 191.031950][ T42] audit: type=1326 audit(1785613011.388:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.2.463" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 191.042470][ T42] audit: type=1326 audit(1785613011.398:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.2.463" exe="/syz-executor" sig=0 arch=40000003 syscall=358 compat=1 ip=0xf706efec code=0x7ffc0000 [ 191.056830][ T42] audit: type=1326 audit(1785613011.398:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.2.463" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 191.073019][ T42] audit: type=1326 audit(1785613011.398:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.2.463" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 191.089477][ T42] audit: type=1326 audit(1785613011.408:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.2.463" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf706efec code=0x7ffc0000 [ 191.098791][ T42] audit: type=1326 audit(1785613011.408:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.2.463" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 191.108718][ T42] audit: type=1326 audit(1785613011.408:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.2.463" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 191.172252][ T7962] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 191.175175][ T7962] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 191.177886][ T7962] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 191.181052][ T7962] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 191.268727][ T7968] random: crng reseeded on system resumption [ 191.476570][ T7981] netlink: 'syz.0.471': attribute type 1 has an invalid length. [ 191.489292][ T7981] bond8: entered promiscuous mode [ 191.491699][ T7981] 8021q: adding VLAN 0 to HW filter on device bond8 [ 191.627907][ T7987] netlink: 4 bytes leftover after parsing attributes in process `syz.3.467'. [ 191.632522][ T7987] bridge_slave_1: left allmulticast mode [ 191.635157][ T7987] bridge_slave_1: left promiscuous mode [ 191.639955][ T7987] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.650736][ T7987] bridge_slave_0: left allmulticast mode [ 191.653206][ T7987] bridge_slave_0: left promiscuous mode [ 191.655669][ T7987] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.744026][ T7989] loop9: detected capacity change from 0 to 8 [ 191.758433][ T7989] Dev loop9: unable to read RDB block 8 [ 191.761605][ T7989] loop9: unable to read partition table [ 191.764732][ T7989] loop9: partition table beyond EOD, truncated [ 191.771523][ T7989] loop_reread_partitions: partition scan of loop9 (þ被xüÿÿÿÿÿÿÿ ) failed (rc=-5) [ 191.936490][ T7994] FAULT_INJECTION: forcing a failure. [ 191.936490][ T7994] name failslab, interval 1, probability 0, space 0, times 0 [ 191.941857][ T7994] CPU: 0 UID: 0 PID: 7994 Comm: syz.2.473 Tainted: G L syzkaller #0 PREEMPT(full) [ 191.941888][ T7994] Tainted: [L]=SOFTLOCKUP [ 191.941891][ T7994] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 191.941898][ T7994] Call Trace: [ 191.941902][ T7994] [ 191.941907][ T7994] dump_stack_lvl+0x100/0x190 [ 191.941925][ T7994] should_fail_ex.cold+0x5/0xa [ 191.941938][ T7994] should_failslab+0xc2/0x120 [ 191.941954][ T7994] __kmalloc_noprof+0xfc/0x820 [ 191.941968][ T7994] ? rcu_is_watching+0x12/0xc0 [ 191.941982][ T7994] ? tomoyo_realpath_from_path+0xb6/0x690 [ 191.942003][ T7994] tomoyo_realpath_from_path+0xb6/0x690 [ 191.942023][ T7994] tomoyo_path_number_perm+0x23c/0x580 [ 191.942038][ T7994] ? tomoyo_path_number_perm+0x22e/0x580 [ 191.942053][ T7994] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 191.942067][ T7994] ? get_pid_task+0x106/0x250 [ 191.942094][ T7994] ? find_held_lock+0x2b/0x80 [ 191.942108][ T7994] ? __fget_files+0x215/0x3d0 [ 191.942118][ T7994] ? hook_file_ioctl_common+0x140/0x440 [ 191.942133][ T7994] ? __fget_files+0x215/0x3d0 [ 191.942145][ T7994] ? __fget_files+0x21f/0x3d0 [ 191.942157][ T7994] security_file_ioctl_compat+0xd3/0x230 [ 191.942173][ T7994] __ia32_compat_sys_ioctl+0xc2/0x360 [ 191.942193][ T7994] __do_fast_syscall_32+0xe7/0x970 [ 191.942209][ T7994] ? lockdep_hardirqs_on+0x78/0x100 [ 191.942224][ T7994] do_fast_syscall_32+0x32/0x70 [ 191.942240][ T7994] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 191.942255][ T7994] RIP: 0023:0xf706efec [ 191.942269][ T7994] Code: Unable to access opcode bytes at 0xf706efc2. [ 191.942273][ T7994] RSP: 002b:00000000f543c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 191.942285][ T7994] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000c040aed5 [ 191.942291][ T7994] RDX: 00000000800000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 191.942297][ T7994] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 191.942303][ T7994] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 191.942309][ T7994] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 191.942323][ T7994] [ 191.942421][ T7994] ERROR: Out of memory at tomoyo_realpath_from_path. [ 193.099127][ T8013] netlink: 8 bytes leftover after parsing attributes in process `syz.3.478'. [ 193.178732][ T5750] Bluetooth: hci1: command 0x0c1a tx timeout [ 193.258813][ T5761] Bluetooth: hci0: command 0x0406 tx timeout [ 193.260783][ T5761] Bluetooth: hci2: command 0x0c1a tx timeout [ 193.262915][ T5763] Bluetooth: hci3: command 0x0c1a tx timeout [ 193.263739][ T5759] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 193.268296][ T5759] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 193.629634][ T8021] FAULT_INJECTION: forcing a failure. [ 193.629634][ T8021] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 193.634443][ T8021] CPU: 1 UID: 0 PID: 8021 Comm: syz.1.480 Tainted: G L syzkaller #0 PREEMPT(full) [ 193.634468][ T8021] Tainted: [L]=SOFTLOCKUP [ 193.634473][ T8021] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 193.634485][ T8021] Call Trace: [ 193.634491][ T8021] [ 193.634497][ T8021] dump_stack_lvl+0x100/0x190 [ 193.634523][ T8021] should_fail_ex.cold+0x5/0xa [ 193.634546][ T8021] _copy_from_user+0x2e/0xd0 [ 193.634572][ T8021] get_compat_msghdr+0xb3/0x480 [ 193.634598][ T8021] ? __pfx_get_compat_msghdr+0x10/0x10 [ 193.634632][ T8021] ___sys_sendmsg+0x1b6/0x1e0 [ 193.634653][ T8021] ? __pfx____sys_sendmsg+0x10/0x10 [ 193.634685][ T8021] ? find_held_lock+0x2b/0x80 [ 193.634720][ T8021] __sys_sendmsg+0x160/0x210 [ 193.634768][ T8021] ? __pfx___sys_sendmsg+0x10/0x10 [ 193.634797][ T8021] ? __pfx_ksys_write+0x10/0x10 [ 193.634812][ T8021] __do_fast_syscall_32+0xe7/0x970 [ 193.634841][ T8021] ? lockdep_hardirqs_on+0x78/0x100 [ 193.634856][ T8021] do_fast_syscall_32+0x32/0x70 [ 193.634872][ T8021] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 193.634888][ T8021] RIP: 0023:0xf7ff2fec [ 193.634902][ T8021] Code: Unable to access opcode bytes at 0xf7ff2fc2. [ 193.634907][ T8021] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 193.634920][ T8021] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 193.634927][ T8021] RDX: 0000000060000090 RSI: 0000000000000000 RDI: 0000000000000000 [ 193.634933][ T8021] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 193.634939][ T8021] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 193.634946][ T8021] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 193.634959][ T8021] [ 193.734504][ T8024] netlink: 'syz.1.482': attribute type 1 has an invalid length. [ 193.778265][ T8024] bond8: entered promiscuous mode [ 193.788114][ T8024] 8021q: adding VLAN 0 to HW filter on device bond8 [ 193.814030][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.816755][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.649852][ T5759] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 194.652335][ T5759] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 195.330905][ T5759] Bluetooth: hci3: command 0x0c1a tx timeout [ 195.543802][ T8058] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 195.547865][ T8058] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 195.550718][ T8058] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 195.554346][ T8058] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 196.156315][ T8077] netlink: 'syz.3.492': attribute type 1 has an invalid length. [ 196.205751][ T8077] bond5: entered promiscuous mode [ 196.208602][ T8077] 8021q: adding VLAN 0 to HW filter on device bond5 [ 197.171201][ T5759] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 197.175662][ T5759] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 197.239664][ T42] kauditd_printk_skb: 57 callbacks suppressed [ 197.239677][ T42] audit: type=1326 audit(1785613017.648:95): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8088 comm="syz.1.498" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x0 [ 197.569131][ T5761] Bluetooth: hci0: command 0x0406 tx timeout [ 197.571914][ T5763] Bluetooth: hci2: command 0x0c1a tx timeout [ 197.573992][ T5759] Bluetooth: hci3: command 0x0c1a tx timeout [ 197.576853][ T5761] Bluetooth: hci1: command 0x0c1a tx timeout [ 197.943512][ T42] audit: type=1326 audit(1785613018.348:96): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8105 comm="syz.1.503" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x7ffc0000 [ 197.968281][ T42] audit: type=1326 audit(1785613018.348:97): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8105 comm="syz.1.503" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x7ffc0000 [ 197.987066][ T42] audit: type=1326 audit(1785613018.358:98): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8105 comm="syz.1.503" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7ff2fec code=0x7ffc0000 [ 197.994142][ T42] audit: type=1326 audit(1785613018.358:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8105 comm="syz.1.503" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x7ffc0000 [ 198.000922][ T42] audit: type=1326 audit(1785613018.358:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8105 comm="syz.1.503" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7ff2fec code=0x7ffc0000 [ 198.010281][ T8106] dvmrp1: entered allmulticast mode [ 198.015247][ T42] audit: type=1326 audit(1785613018.358:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8105 comm="syz.1.503" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x7ffc0000 [ 198.022110][ T42] audit: type=1326 audit(1785613018.358:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8105 comm="syz.1.503" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x7ffc0000 [ 198.028752][ T42] audit: type=1326 audit(1785613018.358:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8105 comm="syz.1.503" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7ff2fec code=0x7ffc0000 [ 198.036026][ T42] audit: type=1326 audit(1785613018.358:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8105 comm="syz.1.503" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x7ffc0000 [ 198.310581][ T8106] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 198.593129][ T8113] syzkaller0: entered promiscuous mode [ 198.594980][ T8113] syzkaller0: entered allmulticast mode [ 198.612174][ T5846] IPVS: starting estimator thread 0... [ 198.615635][ T8113] IPVS: wrr: SCTP 172.20.20.187:0 - no destination available [ 198.728817][ T8116] IPVS: using max 43 ests per chain, 103200 per kthread [ 198.823747][ T8122] syzkaller1: entered allmulticast mode [ 199.225330][ T5761] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 199.232420][ T5761] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 199.658806][ T5761] Bluetooth: hci3: command 0x0c1a tx timeout [ 200.698784][ T5845] netdevsim netdevsim120 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.856131][ T8183] FAULT_INJECTION: forcing a failure. [ 200.856131][ T8183] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 200.863479][ T8183] CPU: 0 UID: 0 PID: 8183 Comm: syz.1.525 Tainted: G L syzkaller #0 PREEMPT(full) [ 200.863511][ T8183] Tainted: [L]=SOFTLOCKUP [ 200.863515][ T8183] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 200.863522][ T8183] Call Trace: [ 200.863526][ T8183] [ 200.863531][ T8183] dump_stack_lvl+0x100/0x190 [ 200.863549][ T8183] should_fail_ex.cold+0x5/0xa [ 200.863562][ T8183] _copy_from_user+0x2e/0xd0 [ 200.863582][ T8183] get_compat_msghdr+0xb3/0x480 [ 200.863600][ T8183] ? __pfx_get_compat_msghdr+0x10/0x10 [ 200.863619][ T8183] ? _kstrtoull+0x13c/0x1f0 [ 200.863631][ T8183] ? __pfx__kstrtoull+0x10/0x10 [ 200.863645][ T8183] ___sys_sendmsg+0x1b6/0x1e0 [ 200.863659][ T8183] ? __pfx____sys_sendmsg+0x10/0x10 [ 200.863671][ T8183] ? __lock_acquire+0x49f/0x1a40 [ 200.863704][ T8183] __sys_sendmmsg+0x309/0x440 [ 200.863722][ T8183] ? __pfx___sys_sendmmsg+0x10/0x10 [ 200.863738][ T8183] ? find_held_lock+0x2b/0x80 [ 200.863755][ T8183] ? __mutex_unlock_slowpath+0x35d/0x930 [ 200.863778][ T8183] ? fput+0x79/0x100 [ 200.863791][ T8183] ? ksys_write+0x1ac/0x250 [ 200.863804][ T8183] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 200.863822][ T8183] ? lockdep_hardirqs_on+0x78/0x100 [ 200.863836][ T8183] __do_fast_syscall_32+0xe7/0x970 [ 200.863851][ T8183] ? lockdep_hardirqs_on+0x78/0x100 [ 200.863866][ T8183] do_fast_syscall_32+0x32/0x70 [ 200.863882][ T8183] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 200.863897][ T8183] RIP: 0023:0xf7ff2fec [ 200.863911][ T8183] Code: Unable to access opcode bytes at 0xf7ff2fc2. [ 200.863916][ T8183] RSP: 002b:00000000f549550c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 200.863928][ T8183] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080003cc0 [ 200.863935][ T8183] RDX: 0000000000000172 RSI: 0000000004001c00 RDI: 0000000000000000 [ 200.863942][ T8183] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 200.863948][ T8183] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 200.863954][ T8183] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 200.863967][ T8183] [ 201.343046][ T8201] FAULT_INJECTION: forcing a failure. [ 201.343046][ T8201] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 201.350965][ T8201] CPU: 2 UID: 0 PID: 8201 Comm: syz.0.534 Tainted: G L syzkaller #0 PREEMPT(full) [ 201.350984][ T8201] Tainted: [L]=SOFTLOCKUP [ 201.350988][ T8201] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 201.350997][ T8201] Call Trace: [ 201.351001][ T8201] [ 201.351006][ T8201] dump_stack_lvl+0x100/0x190 [ 201.351025][ T8201] should_fail_ex.cold+0x5/0xa [ 201.351038][ T8201] _copy_from_user+0x2e/0xd0 [ 201.351062][ T8201] __sys_bpf+0x2f5/0x4e80 [ 201.351079][ T8201] ? __pfx___sys_bpf+0x10/0x10 [ 201.351092][ T8201] ? find_held_lock+0x2b/0x80 [ 201.351106][ T8201] ? get_pid_task+0xfc/0x250 [ 201.351120][ T8201] ? get_pid_task+0xfc/0x250 [ 201.351137][ T8201] ? proc_fail_nth_write+0x9f/0x220 [ 201.351153][ T8201] ? find_held_lock+0x2b/0x80 [ 201.351170][ T8201] ? rcu_read_lock_any_held+0x6a/0xa0 [ 201.351185][ T8201] ? find_held_lock+0x2b/0x80 [ 201.351198][ T8201] ? ksys_write+0x190/0x250 [ 201.351209][ T8201] ? ksys_write+0x190/0x250 [ 201.351229][ T8201] ? fput+0x79/0x100 [ 201.351257][ T8201] ? __ia32_sys_bpf+0xcc/0x170 [ 201.351269][ T8201] __ia32_sys_bpf+0xcc/0x170 [ 201.351281][ T8201] ? __do_fast_syscall_32+0x98/0x970 [ 201.351298][ T8201] __do_fast_syscall_32+0xe7/0x970 [ 201.351313][ T8201] ? lockdep_hardirqs_on+0x78/0x100 [ 201.351328][ T8201] do_fast_syscall_32+0x32/0x70 [ 201.351344][ T8201] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 201.351358][ T8201] RIP: 0023:0xf7f15fec [ 201.351373][ T8201] Code: Unable to access opcode bytes at 0xf7f15fc2. [ 201.351378][ T8201] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 201.351390][ T8201] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000180 [ 201.351397][ T8201] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 201.351403][ T8201] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 201.351409][ T8201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 201.351415][ T8201] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 201.351429][ T8201] [ 203.001390][ T8240] blktrace: Concurrent blktraces are not allowed on sg0 [ 203.941359][ T8264] FAULT_INJECTION: forcing a failure. [ 203.941359][ T8264] name failslab, interval 1, probability 0, space 0, times 0 [ 203.946318][ T8264] CPU: 0 UID: 0 PID: 8264 Comm: syz.3.550 Tainted: G L syzkaller #0 PREEMPT(full) [ 203.946338][ T8264] Tainted: [L]=SOFTLOCKUP [ 203.946342][ T8264] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 203.946349][ T8264] Call Trace: [ 203.946353][ T8264] [ 203.946358][ T8264] dump_stack_lvl+0x100/0x190 [ 203.946376][ T8264] should_fail_ex.cold+0x5/0xa [ 203.946389][ T8264] should_failslab+0xc2/0x120 [ 203.946406][ T8264] __kmalloc_noprof+0xfc/0x820 [ 203.946422][ T8264] ? kernfs_fop_write_iter+0x26a/0x5f0 [ 203.946452][ T8264] kernfs_fop_write_iter+0x26a/0x5f0 [ 203.946467][ T8264] vfs_write+0x6ac/0x1050 [ 203.946478][ T8264] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 203.946493][ T8264] ? __pfx_vfs_write+0x10/0x10 [ 203.946503][ T8264] ? find_held_lock+0x2b/0x80 [ 203.946526][ T8264] ksys_write+0x12a/0x250 [ 203.946539][ T8264] ? __pfx_ksys_write+0x10/0x10 [ 203.946548][ T8264] ? ksys_write+0x1ac/0x250 [ 203.946558][ T8264] ? __pfx_ksys_write+0x10/0x10 [ 203.946571][ T8264] __do_fast_syscall_32+0xe7/0x970 [ 203.946587][ T8264] ? lockdep_hardirqs_on+0x78/0x100 [ 203.946603][ T8264] do_fast_syscall_32+0x32/0x70 [ 203.946618][ T8264] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 203.946634][ T8264] RIP: 0023:0xf7fc7fec [ 203.946647][ T8264] Code: Unable to access opcode bytes at 0xf7fc7fc2. [ 203.946652][ T8264] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 203.946664][ T8264] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300 [ 203.946671][ T8264] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000000 [ 203.946677][ T8264] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 203.946683][ T8264] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 203.946708][ T8264] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 203.946723][ T8264] [ 204.012265][ T845] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 204.039299][ T8259] bond9 (unregistering): Released all slaves [ 204.264291][ T845] usb 6-1: config index 0 descriptor too short (expected 39, got 27) [ 204.271670][ T845] usb 6-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 204.279761][ T845] usb 6-1: config 0 interface 0 has no altsetting 0 [ 204.306856][ T845] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 204.310061][ T845] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 204.318997][ T845] usb 6-1: Product: syz [ 204.325194][ T845] usb 6-1: Manufacturer: syz [ 204.327373][ T845] usb 6-1: SerialNumber: syz [ 204.394264][ T845] usb 6-1: config 0 descriptor?? [ 204.433779][ T845] hub 6-1:0.0: bad descriptor, ignoring hub [ 204.436519][ T845] hub 6-1:0.0: probe with driver hub failed with error -5 [ 204.490945][ T845] usb 6-1: selecting invalid altsetting 0 [ 204.688004][ T8278] FAULT_INJECTION: forcing a failure. [ 204.688004][ T8278] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 204.694126][ T8278] CPU: 3 UID: 0 PID: 8278 Comm: syz.2.556 Tainted: G L syzkaller #0 PREEMPT(full) [ 204.694153][ T8278] Tainted: [L]=SOFTLOCKUP [ 204.694160][ T8278] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 204.694169][ T8278] Call Trace: [ 204.694175][ T8278] [ 204.694180][ T8278] dump_stack_lvl+0x100/0x190 [ 204.694205][ T8278] should_fail_ex.cold+0x5/0xa [ 204.694224][ T8278] _copy_from_user+0x2e/0xd0 [ 204.694249][ T8278] get_compat_msghdr+0xb3/0x480 [ 204.694274][ T8278] ? __pfx_get_compat_msghdr+0x10/0x10 [ 204.694306][ T8278] ___sys_sendmsg+0x1b6/0x1e0 [ 204.694325][ T8278] ? __pfx____sys_sendmsg+0x10/0x10 [ 204.694353][ T8278] ? find_held_lock+0x2b/0x80 [ 204.694385][ T8278] __sys_sendmsg+0x160/0x210 [ 204.694408][ T8278] ? __pfx___sys_sendmsg+0x10/0x10 [ 204.694435][ T8278] ? __pfx_ksys_write+0x10/0x10 [ 204.694456][ T8278] __do_fast_syscall_32+0xe7/0x970 [ 204.694479][ T8278] ? lockdep_hardirqs_on+0x78/0x100 [ 204.694500][ T8278] do_fast_syscall_32+0x32/0x70 [ 204.694522][ T8278] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 204.694543][ T8278] RIP: 0023:0xf706efec [ 204.694562][ T8278] Code: Unable to access opcode bytes at 0xf706efc2. [ 204.694569][ T8278] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 204.694586][ T8278] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000008000c2c0 [ 204.694596][ T8278] RDX: 0000000000000802 RSI: 0000000000000000 RDI: 0000000000000000 [ 204.694605][ T8278] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 204.694614][ T8278] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 204.694624][ T8278] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 204.694643][ T8278] [ 204.922583][ T8280] evm: overlay not supported [ 204.938509][ T5761] Bluetooth: hci1: unexpected event for opcode 0x080e [ 205.254190][ T845] usb 6-1: reset high-speed USB device number 4 using dummy_hcd [ 205.446181][ T845] usb 6-1: device firmware changed [ 205.449233][ T845] usb 6-1: USB disconnect, device number 4 [ 205.498855][ T29] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 205.658766][ T29] usb 8-1: Using ep0 maxpacket: 8 [ 205.662659][ T29] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 205.668585][ T29] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 205.671464][ T29] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 205.674433][ T29] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 205.677471][ T29] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 205.685461][ T29] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 205.688299][ T29] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.867812][ T845] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 205.899305][ T29] usb 8-1: usb_control_msg returned -32 [ 205.904997][ T29] usbtmc 8-1:16.0: can't read capabilities [ 206.103825][ T845] usb 6-1: config index 0 descriptor too short (expected 39, got 27) [ 206.109780][ T845] usb 6-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 206.114839][ T845] usb 6-1: config 0 interface 0 has no altsetting 0 [ 206.127713][ T845] usb 6-1: string descriptor 0 read error: -22 [ 206.130802][ T845] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 206.134604][ T845] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 206.145265][ T8294] netlink: 4 bytes leftover after parsing attributes in process `syz.2.562'. [ 206.155093][ T845] usb 6-1: config 0 descriptor?? [ 206.167942][ T845] hub 6-1:0.0: bad descriptor, ignoring hub [ 206.170910][ T845] hub 6-1:0.0: probe with driver hub failed with error -5 [ 206.184226][ T845] usb 6-1: selecting invalid altsetting 0 [ 206.220120][ T8283] usbtmc 8-1:16.0: usb_control_msg returned -32 [ 206.223959][ T8295] usbtmc 8-1:16.0: send_request_dev_dep_msg_in returned -90 [ 206.228455][ T41] usb 8-1: USB disconnect, device number 4 [ 206.383573][ T8255] serio: Serial port ptm0 [ 206.662536][ T845] usb 6-1: USB disconnect, device number 5 [ 206.980910][ T8312] netlink: 'syz.0.568': attribute type 5 has an invalid length. [ 206.994261][ T8312] bond9: entered promiscuous mode [ 209.657126][ T8369] FAULT_INJECTION: forcing a failure. [ 209.657126][ T8369] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 209.672303][ T8369] CPU: 0 UID: 0 PID: 8369 Comm: syz.0.584 Tainted: G L syzkaller #0 PREEMPT(full) [ 209.672332][ T8369] Tainted: [L]=SOFTLOCKUP [ 209.672340][ T8369] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 209.672349][ T8369] Call Trace: [ 209.672355][ T8369] [ 209.672362][ T8369] dump_stack_lvl+0x100/0x190 [ 209.672403][ T8369] should_fail_ex.cold+0x5/0xa [ 209.672422][ T8369] _copy_from_user+0x2e/0xd0 [ 209.672448][ T8369] get_compat_msghdr+0xb3/0x480 [ 209.672478][ T8369] ? __pfx_get_compat_msghdr+0x10/0x10 [ 209.672511][ T8369] ___sys_sendmsg+0x1b6/0x1e0 [ 209.672531][ T8369] ? __pfx____sys_sendmsg+0x10/0x10 [ 209.672559][ T8369] ? find_held_lock+0x2b/0x80 [ 209.672592][ T8369] __sys_sendmsg+0x160/0x210 [ 209.672615][ T8369] ? __pfx___sys_sendmsg+0x10/0x10 [ 209.672643][ T8369] ? __pfx_ksys_write+0x10/0x10 [ 209.672664][ T8369] __do_fast_syscall_32+0xe7/0x970 [ 209.672686][ T8369] ? lockdep_hardirqs_on+0x78/0x100 [ 209.672707][ T8369] do_fast_syscall_32+0x32/0x70 [ 209.672728][ T8369] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 209.672748][ T8369] RIP: 0023:0xf7f15fec [ 209.672768][ T8369] Code: Unable to access opcode bytes at 0xf7f15fc2. [ 209.672775][ T8369] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 209.672793][ T8369] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000000 [ 209.672803][ T8369] RDX: 0000000024000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 209.672813][ T8369] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 209.672822][ T8369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 209.672832][ T8369] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 209.672852][ T8369] [ 209.887544][ T8376] netlink: 24 bytes leftover after parsing attributes in process `syz.3.585'. [ 210.081610][ T8380] netlink: 24 bytes leftover after parsing attributes in process `syz.1.586'. [ 210.204755][ T8376] erofs (device sr0): cannot find valid erofs superblock [ 210.438762][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 210.886851][ T8379] erofs (device sr0): cannot find valid erofs superblock [ 211.899868][ T8408] dvmrp1: entered allmulticast mode [ 213.083210][ T8423] netlink: 24 bytes leftover after parsing attributes in process `syz.3.600'. [ 213.358326][ T8423] erofs (device sr0): cannot find valid erofs superblock [ 213.589235][ T5846] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 215.025647][ T8454] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 215.031351][ T8454] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 215.041123][ T8454] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 215.044330][ T8454] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 215.173561][ T8470] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 215.178862][ T8470] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 217.009050][ T5759] Bluetooth: hci1: command 0x0c1a tx timeout [ 217.099203][ T5761] Bluetooth: hci0: command 0x0406 tx timeout [ 217.099338][ T5763] Bluetooth: hci2: command 0x0c1a tx timeout [ 217.101829][ T5759] Bluetooth: hci3: command 0x0c1a tx timeout [ 224.734841][ T8512] netlink: 'syz.2.616': attribute type 1 has an invalid length. [ 225.058377][ T5761] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 225.061901][ T5761] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 225.117767][ T42] kauditd_printk_skb: 165 callbacks suppressed [ 225.117779][ T42] audit: type=1326 audit(1785613045.518:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8515 comm="syz.3.619" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc7fec code=0x0 [ 227.009039][ T5761] Bluetooth: hci3: command 0x0c1a tx timeout [ 228.589128][ T8578] netlink: 'syz.0.633': attribute type 1 has an invalid length. [ 228.629504][ T8578] bond10: entered promiscuous mode [ 228.632237][ T8578] 8021q: adding VLAN 0 to HW filter on device bond10 [ 229.521200][ T8609] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 229.525444][ T8609] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 229.527476][ T8609] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 229.530812][ T8609] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 230.225477][ T8624] netlink: 20 bytes leftover after parsing attributes in process `syz.1.645'. [ 230.228796][ T8624] nbd: must specify a size in bytes for the device [ 230.689544][ T8583] Set syz1 is full, maxelem 65536 reached [ 231.096384][ T8640] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 231.122704][ T8640] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 231.132299][ T8640] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 231.142470][ T8640] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 233.168837][ T5761] Bluetooth: hci3: command 0x0c1a tx timeout [ 233.171015][ T5761] Bluetooth: hci0: command 0x0406 tx timeout [ 233.184913][ T5761] Bluetooth: hci2: command 0x0c1a tx timeout [ 233.188094][ T5761] Bluetooth: hci1: command 0x0c1a tx timeout [ 233.231398][ T8679] syzkaller0: entered promiscuous mode [ 233.236792][ T8679] syzkaller0: entered allmulticast mode [ 233.445939][ T8712] netlink: 'syz.2.663': attribute type 1 has an invalid length. [ 235.149850][ T8704] Set syz1 is full, maxelem 65536 reached [ 236.745446][ T8771] capability: warning: `syz.0.666' uses deprecated v2 capabilities in a way that may be insecure [ 236.756906][ T8712] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 237.062869][ T5761] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 237.068964][ T5761] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 237.123593][ T42] audit: type=1326 audit(1785613057.528:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8773 comm="syz.2.667" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 237.776376][ T8786] can0: slcan on ttyS3. [ 239.089031][ T5761] Bluetooth: hci3: command 0x0c1a tx timeout [ 239.653571][ T8787] can0 (unregistered): slcan off ttyS3. [ 239.973400][ T5763] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 239.982212][ T5763] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 240.088601][ T42] audit: type=1326 audit(1785613060.488:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8854 comm="syz.2.679" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 241.506222][ T8879] blktrace: Concurrent blktraces are not allowed on sg0 [ 242.371895][ T8896] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 242.384518][ T8896] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 242.399461][ T8896] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 242.406603][ T8896] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 242.562356][ T5761] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 242.565232][ T5761] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 242.629724][ T42] audit: type=1326 audit(1785613063.028:273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8904 comm="syz.2.691" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 243.648788][ T5761] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 243.651467][ T5761] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 243.692105][ T42] audit: type=1326 audit(1785613064.098:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8915 comm="syz.2.694" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 244.378771][ T5761] Bluetooth: hci1: command 0x0c1a tx timeout [ 244.449861][ T5761] Bluetooth: hci3: command 0x0c1a tx timeout [ 244.449959][ T5759] Bluetooth: hci0: command 0x0406 tx timeout [ 244.452832][ T5763] Bluetooth: hci2: command 0x0c1a tx timeout [ 244.816255][ T8947] blktrace: Concurrent blktraces are not allowed on sg0 [ 245.068151][ T5761] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 245.070734][ T5761] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 245.122702][ T42] audit: type=1326 audit(1785613065.528:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8948 comm="syz.0.702" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x0 [ 245.904096][ T8967] FAULT_INJECTION: forcing a failure. [ 245.904096][ T8967] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 245.908425][ T8967] CPU: 1 UID: 0 PID: 8967 Comm: syz.0.708 Tainted: G L syzkaller #0 PREEMPT(full) [ 245.908446][ T8967] Tainted: [L]=SOFTLOCKUP [ 245.908449][ T8967] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 245.908456][ T8967] Call Trace: [ 245.908461][ T8967] [ 245.908466][ T8967] dump_stack_lvl+0x100/0x190 [ 245.908484][ T8967] should_fail_ex.cold+0x5/0xa [ 245.908497][ T8967] _copy_from_user+0x2e/0xd0 [ 245.908515][ T8967] get_compat_msghdr+0xb3/0x480 [ 245.908534][ T8967] ? __pfx_get_compat_msghdr+0x10/0x10 [ 245.908557][ T8967] ___sys_sendmsg+0x1b6/0x1e0 [ 245.908571][ T8967] ? __pfx____sys_sendmsg+0x10/0x10 [ 245.908601][ T8967] ? find_held_lock+0x2b/0x80 [ 245.908637][ T8967] __sys_sendmsg+0x160/0x210 [ 245.908656][ T8967] ? __pfx___sys_sendmsg+0x10/0x10 [ 245.908675][ T8967] ? __pfx_ksys_write+0x10/0x10 [ 245.908689][ T8967] __do_fast_syscall_32+0xe7/0x970 [ 245.908705][ T8967] ? lockdep_hardirqs_on+0x78/0x100 [ 245.908720][ T8967] do_fast_syscall_32+0x32/0x70 [ 245.908736][ T8967] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 245.908750][ T8967] RIP: 0023:0xf7f15fec [ 245.908764][ T8967] Code: Unable to access opcode bytes at 0xf7f15fc2. [ 245.908773][ T8967] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 245.908785][ T8967] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 245.908792][ T8967] RDX: 0000000004000084 RSI: 0000000000000000 RDI: 0000000000000000 [ 245.908798][ T8967] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 245.908804][ T8967] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 245.908810][ T8967] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 245.908824][ T8967] [ 246.528811][ T5761] Bluetooth: hci3: command 0x0c1a tx timeout [ 246.564681][ T8976] netlink: 44 bytes leftover after parsing attributes in process `syz.2.711'. [ 246.597030][ T8976] netlink: 52 bytes leftover after parsing attributes in process `syz.2.711'. [ 246.733303][ T8979] bond6: entered promiscuous mode [ 247.460126][ T8995] erofs (device sr0): cannot find valid erofs superblock [ 247.478263][ T8996] blktrace: Concurrent blktraces are not allowed on sg0 [ 248.210737][ T9010] erofs (device sr0): cannot find valid erofs superblock [ 248.398982][ T9018] Unsupported ieee802154 address type: 0 [ 248.500738][ T9022] team0: No ports can be present during mode change [ 249.402584][ T9034] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 249.614819][ T9038] NILFS (loop0): device size too small [ 251.014378][ T9062] erofs (device sr0): cannot find valid erofs superblock [ 253.459247][ T41] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 254.490510][ T9085] cgroup: fork rejected by pids controller in /syz2 [ 255.262921][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.265794][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.800258][ T5846] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 259.325202][ T9195] erofs (device sr0): cannot find valid erofs superblock [ 268.644489][ T5761] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 268.647112][ T5761] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 268.749157][ T42] audit: type=1326 audit(1785613089.148:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9244 comm="syz.3.768" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc7fec code=0x0 [ 272.559108][ T9330] netlink: 24 bytes leftover after parsing attributes in process `syz.2.784'. [ 272.905487][ T9302] cgroup: fork rejected by pids controller in /syz3 [ 273.438141][ T9351] NILFS (loop3): device size too small [ 273.861835][ T9353] erofs (device sr0): cannot find valid erofs superblock [ 276.581741][ T9391] netlink: 24 bytes leftover after parsing attributes in process `syz.3.798'. [ 276.917598][ T9399] erofs (device sr0): cannot find valid erofs superblock [ 279.620914][ T5761] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 279.626951][ T5761] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 279.680301][ T42] audit: type=1326 audit(1785613100.088:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9421 comm="syz.1.807" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x0 [ 279.841830][ T42] audit: type=1326 audit(1785613100.248:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9427 comm="syz.0.809" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x0 [ 281.889005][ T5763] Bluetooth: hci3: command 0x0c1a tx timeout [ 282.209279][ T5763] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 282.211721][ T5759] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 282.215982][ T5759] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 282.219616][ T5759] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 282.280768][ T42] audit: type=1326 audit(1785613102.688:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9480 comm="syz.3.824" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc7fec code=0x0 [ 282.301933][ T42] audit: type=1326 audit(1785613102.708:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9476 comm="syz.2.823" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 283.971512][ T5759] Bluetooth: hci3: command 0x0c1a tx timeout [ 284.627847][ T5759] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 284.631723][ T5759] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 284.696577][ T42] audit: type=1326 audit(1785613105.098:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9530 comm="syz.1.839" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x0 [ 286.058813][ T5759] Bluetooth: hci3: command 0x0c1a tx timeout [ 286.962011][ T9565] netlink: 28 bytes leftover after parsing attributes in process `syz.2.842'. [ 289.195915][ T42] audit: type=1326 audit(1785613109.598:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9589 comm="syz.0.848" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x0 [ 291.024305][ T5761] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 291.027617][ T5761] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 291.065603][ T9639] netlink: 24 bytes leftover after parsing attributes in process `syz.3.859'. [ 291.089498][ T5761] Bluetooth: hci3: command 0x0c1a tx timeout [ 291.150902][ T42] audit: type=1326 audit(1785613111.558:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9633 comm="syz.2.857" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 291.338854][ T9642] erofs (device sr0): cannot find valid erofs superblock [ 291.367272][ T9644] netlink: 28 bytes leftover after parsing attributes in process `syz.0.860'. [ 292.489085][ T9650] syz.1.862 (9650) used greatest stack depth: 19104 bytes left [ 292.836043][ T9670] netlink: 12 bytes leftover after parsing attributes in process `syz.3.869'. [ 292.942229][ T9674] NILFS (loop2): device size too small [ 293.184744][ T5759] Bluetooth: hci3: command 0x0c1a tx timeout [ 295.266225][ T9709] netlink: 24 bytes leftover after parsing attributes in process `syz.0.875'. [ 295.531598][ T9713] erofs (device sr0): cannot find valid erofs superblock [ 296.362833][ T9727] FAULT_INJECTION: forcing a failure. [ 296.362833][ T9727] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 296.367158][ T9727] CPU: 3 UID: 0 PID: 9727 Comm: syz.2.879 Tainted: G L syzkaller #0 PREEMPT(full) [ 296.367178][ T9727] Tainted: [L]=SOFTLOCKUP [ 296.367182][ T9727] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 296.367189][ T9727] Call Trace: [ 296.367193][ T9727] [ 296.367198][ T9727] dump_stack_lvl+0x100/0x190 [ 296.367232][ T9727] should_fail_ex.cold+0x5/0xa [ 296.367245][ T9727] _copy_from_user+0x2e/0xd0 [ 296.367264][ T9727] get_compat_msghdr+0xb3/0x480 [ 296.367282][ T9727] ? __pfx_get_compat_msghdr+0x10/0x10 [ 296.367306][ T9727] ___sys_sendmsg+0x1b6/0x1e0 [ 296.367320][ T9727] ? __pfx____sys_sendmsg+0x10/0x10 [ 296.367338][ T9727] ? find_held_lock+0x2b/0x80 [ 296.367362][ T9727] __sys_sendmsg+0x160/0x210 [ 296.367378][ T9727] ? __pfx___sys_sendmsg+0x10/0x10 [ 296.367398][ T9727] ? __pfx_ksys_write+0x10/0x10 [ 296.367412][ T9727] __do_fast_syscall_32+0xe7/0x970 [ 296.367427][ T9727] ? lockdep_hardirqs_on+0x78/0x100 [ 296.367443][ T9727] do_fast_syscall_32+0x32/0x70 [ 296.367458][ T9727] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 296.367480][ T9727] RIP: 0023:0xf706efec [ 296.367495][ T9727] Code: Unable to access opcode bytes at 0xf706efc2. [ 296.367500][ T9727] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 296.367511][ T9727] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000000 [ 296.367518][ T9727] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 296.367524][ T9727] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 296.367531][ T9727] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 296.367537][ T9727] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 296.367551][ T9727] [ 298.531650][ T9764] netlink: 24 bytes leftover after parsing attributes in process `syz.3.891'. [ 299.107390][ T9776] erofs (device sr0): cannot find valid erofs superblock [ 301.875829][ T9822] NILFS (loop2): device size too small [ 302.689839][ T5761] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 302.695892][ T5761] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 302.738822][ T42] audit: type=1326 audit(1785613123.138:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9834 comm="syz.3.903" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc7fec code=0x0 [ 304.608830][ T5761] Bluetooth: hci3: command 0x0c1a tx timeout [ 304.793599][ T9876] tc action pedit 'at' offset 5 out of bounds [ 304.796172][ T9876] tc action pedit 'at' offset 5 out of bounds [ 304.799995][ T9876] tc action pedit 'at' offset 5 out of bounds [ 304.800019][ T9876] tc action pedit 'at' offset 5 out of bounds [ 304.800025][ T9876] tc action pedit 'at' offset 5 out of bounds [ 304.800031][ T9876] tc action pedit 'at' offset 5 out of bounds [ 304.800037][ T9876] tc action pedit 'at' offset 5 out of bounds [ 304.800043][ T9876] tc action pedit 'at' offset 5 out of bounds [ 304.800049][ T9876] tc action pedit 'at' offset 5 out of bounds [ 304.800055][ T9876] tc action pedit 'at' offset 5 out of bounds [ 304.800067][ T9876] 0: reclassify loop, rule prio 0, protocol 800 [ 304.946020][ T42] audit: type=1326 audit(1785613125.348:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9888 comm="syz.0.915" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x0 [ 306.851560][ T5759] Bluetooth: hci3: command 0x0c1a tx timeout [ 306.874709][ T9918] FAULT_INJECTION: forcing a failure. [ 306.874709][ T9918] name failslab, interval 1, probability 0, space 0, times 0 [ 306.880233][ T9918] CPU: 3 UID: 0 PID: 9918 Comm: syz.2.924 Tainted: G L syzkaller #0 PREEMPT(full) [ 306.880264][ T9918] Tainted: [L]=SOFTLOCKUP [ 306.880270][ T9918] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 306.880282][ T9918] Call Trace: [ 306.880289][ T9918] [ 306.880295][ T9918] dump_stack_lvl+0x100/0x190 [ 306.880324][ T9918] should_fail_ex.cold+0x5/0xa [ 306.880343][ T9918] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 306.880363][ T9918] should_failslab+0xc2/0x120 [ 306.880388][ T9918] kmem_cache_alloc_noprof+0x91/0x6a0 [ 306.880419][ T9918] ? skb_clone+0x190/0x400 [ 306.880450][ T9918] skb_clone+0x190/0x400 [ 306.880476][ T9918] netlink_deliver_tap+0xaed/0xcc0 [ 306.880502][ T9918] netlink_unicast+0x6a5/0x850 [ 306.880527][ T9918] ? __pfx_netlink_unicast+0x10/0x10 [ 306.880555][ T9918] netlink_ack+0x655/0xb80 [ 306.880584][ T9918] netlink_rcv_skb+0x333/0x420 [ 306.880606][ T9918] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 306.880637][ T9918] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 306.880667][ T9918] ? netlink_deliver_tap+0x1ae/0xcc0 [ 306.880693][ T9918] netlink_unicast+0x585/0x850 [ 306.880715][ T9918] ? __pfx_netlink_unicast+0x10/0x10 [ 306.880745][ T9918] netlink_sendmsg+0x8b0/0xda0 [ 306.880771][ T9918] ? __pfx_netlink_sendmsg+0x10/0x10 [ 306.880793][ T9918] ? apparmor_socket_sendmsg+0x15b/0x270 [ 306.880818][ T9918] ____sys_sendmsg+0xa4d/0xbe0 [ 306.880836][ T9918] ? __pfx_netlink_sendmsg+0x10/0x10 [ 306.880860][ T9918] ? __pfx_____sys_sendmsg+0x10/0x10 [ 306.880892][ T9918] ___sys_sendmsg+0x190/0x1e0 [ 306.880915][ T9918] ? __pfx____sys_sendmsg+0x10/0x10 [ 306.880948][ T9918] ? find_held_lock+0x2b/0x80 [ 306.880989][ T9918] __sys_sendmsg+0x160/0x210 [ 306.881016][ T9918] ? __pfx___sys_sendmsg+0x10/0x10 [ 306.881049][ T9918] ? __pfx_ksys_write+0x10/0x10 [ 306.881073][ T9918] __do_fast_syscall_32+0xe7/0x970 [ 306.881097][ T9918] ? lockdep_hardirqs_on+0x78/0x100 [ 306.881122][ T9918] do_fast_syscall_32+0x32/0x70 [ 306.881148][ T9918] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 306.881172][ T9918] RIP: 0023:0xf706efec [ 306.881195][ T9918] Code: Unable to access opcode bytes at 0xf706efc2. [ 306.881204][ T9918] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 306.881223][ T9918] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 306.881235][ T9918] RDX: 0000000000040040 RSI: 0000000000000000 RDI: 0000000000000000 [ 306.881246][ T9918] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 306.881255][ T9918] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 306.881266][ T9918] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 306.881291][ T9918] [ 307.075670][ T9924] blktrace: Concurrent blktraces are not allowed on sg0 [ 307.200922][ T9933] NILFS (loop2): device size too small [ 308.179614][ T9944] 9pnet_virtio: no channels available for device syz [ 308.929301][ T5761] Bluetooth: hci3: command 0x0c1a tx timeout [ 309.389543][ T9969] NILFS (loop3): device size too small [ 309.990601][ T9980] netlink: 4 bytes leftover after parsing attributes in process `syz.0.945'. [ 310.200628][ T9988] FAULT_INJECTION: forcing a failure. [ 310.200628][ T9988] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 310.204775][ T9988] CPU: 2 UID: 0 PID: 9988 Comm: syz.1.946 Tainted: G L syzkaller #0 PREEMPT(full) [ 310.204794][ T9988] Tainted: [L]=SOFTLOCKUP [ 310.204798][ T9988] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 310.204805][ T9988] Call Trace: [ 310.204810][ T9988] [ 310.204814][ T9988] dump_stack_lvl+0x100/0x190 [ 310.204833][ T9988] should_fail_ex.cold+0x5/0xa [ 310.204847][ T9988] _copy_from_iter+0x1f4/0x1690 [ 310.204869][ T9988] ? __asan_memset+0x23/0x50 [ 310.204882][ T9988] ? __pfx__copy_from_iter+0x10/0x10 [ 310.204903][ T9988] ? __pfx___alloc_skb+0x10/0x10 [ 310.204924][ T9988] netlink_sendmsg+0x808/0xda0 [ 310.204939][ T9988] ? __pfx_netlink_sendmsg+0x10/0x10 [ 310.204954][ T9988] ? apparmor_socket_sendmsg+0x15b/0x270 [ 310.204969][ T9988] ____sys_sendmsg+0xa4d/0xbe0 [ 310.204981][ T9988] ? __pfx_netlink_sendmsg+0x10/0x10 [ 310.204994][ T9988] ? __pfx_____sys_sendmsg+0x10/0x10 [ 310.205011][ T9988] ___sys_sendmsg+0x190/0x1e0 [ 310.205025][ T9988] ? __pfx____sys_sendmsg+0x10/0x10 [ 310.205043][ T9988] ? find_held_lock+0x2b/0x80 [ 310.205066][ T9988] __sys_sendmsg+0x160/0x210 [ 310.205082][ T9988] ? __pfx___sys_sendmsg+0x10/0x10 [ 310.205102][ T9988] ? __pfx_ksys_write+0x10/0x10 [ 310.205117][ T9988] __do_fast_syscall_32+0xe7/0x970 [ 310.205132][ T9988] ? lockdep_hardirqs_on+0x78/0x100 [ 310.205148][ T9988] do_fast_syscall_32+0x32/0x70 [ 310.205163][ T9988] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 310.205178][ T9988] RIP: 0023:0xf7ff2fec [ 310.205193][ T9988] Code: Unable to access opcode bytes at 0xf7ff2fc2. [ 310.205198][ T9988] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 310.205209][ T9988] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000240 [ 310.205217][ T9988] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 310.205223][ T9988] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 310.205229][ T9988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 310.205236][ T9988] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 310.205249][ T9988] [ 310.206549][ T5761] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 311.650680][T10023] NILFS (loop1): device size too small [ 313.562712][ T5759] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 313.566476][ T5759] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 313.630706][ T42] audit: type=1326 audit(1785613134.038:286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10049 comm="syz.0.967" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x0 [ 314.852589][T10076] FAULT_INJECTION: forcing a failure. [ 314.852589][T10076] name failslab, interval 1, probability 0, space 0, times 0 [ 314.909071][T10076] CPU: 1 UID: 0 PID: 10076 Comm: syz.0.976 Tainted: G L syzkaller #0 PREEMPT(full) [ 314.909105][T10076] Tainted: [L]=SOFTLOCKUP [ 314.909112][T10076] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 314.909122][T10076] Call Trace: [ 314.909131][T10076] [ 314.909140][T10076] dump_stack_lvl+0x100/0x190 [ 314.909169][T10076] should_fail_ex.cold+0x5/0xa [ 314.909189][T10076] should_failslab+0xc2/0x120 [ 314.909215][T10076] __kmalloc_noprof+0xfc/0x820 [ 314.909236][T10076] ? __pfx___nla_validate_parse+0x10/0x10 [ 314.909258][T10076] ? hash_ipmark_create+0x45f/0x1430 [ 314.909282][T10076] hash_ipmark_create+0x45f/0x1430 [ 314.909301][T10076] ? __nla_parse+0x40/0x60 [ 314.909321][T10076] ? __pfx_hash_ipmark_create+0x10/0x10 [ 314.909340][T10076] ip_set_create+0x6b8/0x14f0 [ 314.909374][T10076] ? __pfx_ip_set_create+0x10/0x10 [ 314.909418][T10076] ? find_held_lock+0x2b/0x80 [ 314.909448][T10076] nfnetlink_rcv_msg+0x9d5/0x11e0 [ 314.909488][T10076] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 314.909511][T10076] ? skb_release_data+0x6ca/0x8e0 [ 314.909540][T10076] ? kfree_skbmem+0x19f/0x210 [ 314.909584][T10076] ? __pfx___dev_queue_xmit+0x10/0x10 [ 314.909608][T10076] netlink_rcv_skb+0x159/0x420 [ 314.909628][T10076] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 314.909656][T10076] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 314.909687][T10076] ? ns_capable+0xd2/0xf0 [ 314.909710][T10076] nfnetlink_rcv+0x1b3/0x440 [ 314.909735][T10076] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 314.909758][T10076] ? netlink_deliver_tap+0x1ae/0xcc0 [ 314.909782][T10076] netlink_unicast+0x585/0x850 [ 314.909805][T10076] ? __pfx_netlink_unicast+0x10/0x10 [ 314.909832][T10076] netlink_sendmsg+0x8b0/0xda0 [ 314.909872][T10076] ? __pfx_netlink_sendmsg+0x10/0x10 [ 314.909897][T10076] ? apparmor_socket_sendmsg+0x15b/0x270 [ 314.909921][T10076] ____sys_sendmsg+0xa4d/0xbe0 [ 314.909939][T10076] ? __pfx_netlink_sendmsg+0x10/0x10 [ 314.909961][T10076] ? __pfx_____sys_sendmsg+0x10/0x10 [ 314.909977][T10076] ? lockdep_hardirqs_on+0x78/0x100 [ 314.910012][T10076] ___sys_sendmsg+0x190/0x1e0 [ 314.910033][T10076] ? __pfx____sys_sendmsg+0x10/0x10 [ 314.910065][T10076] ? find_held_lock+0x2b/0x80 [ 314.910103][T10076] __sys_sendmsg+0x160/0x210 [ 314.910127][T10076] ? __pfx___sys_sendmsg+0x10/0x10 [ 314.910160][T10076] ? __pfx_ksys_write+0x10/0x10 [ 314.910184][T10076] __do_fast_syscall_32+0xe7/0x970 [ 314.910234][T10076] ? lockdep_hardirqs_on+0x78/0x100 [ 314.910259][T10076] do_fast_syscall_32+0x32/0x70 [ 314.910283][T10076] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 314.910307][T10076] RIP: 0023:0xf7f15fec [ 314.910328][T10076] Code: Unable to access opcode bytes at 0xf7f15fc2. [ 314.910336][T10076] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 314.910354][T10076] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 314.910365][T10076] RDX: 0000000000008800 RSI: 0000000000000000 RDI: 0000000000000000 [ 314.910375][T10076] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 314.910386][T10076] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 314.910395][T10076] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 314.910419][T10076] [ 314.993808][T10077] NILFS (loop1): device size too small [ 315.571082][ T5759] Bluetooth: hci3: command 0x0c1a tx timeout [ 316.605844][T10116] netlink: 24 bytes leftover after parsing attributes in process `syz.0.990'. [ 316.690492][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.693427][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.789848][T10122] netlink: 'syz.2.988': attribute type 6 has an invalid length. [ 317.038819][T10132] NILFS (loop1): device size too small [ 317.724809][T10130] erofs (device sr0): cannot find valid erofs superblock [ 318.007581][T10147] netlink: 20 bytes leftover after parsing attributes in process `syz.3.995'. [ 318.014475][T10148] batman_adv: batadv0: Adding interface: vlan2 [ 318.016517][T10148] batman_adv: batadv0: The MTU of interface vlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 318.028962][T10148] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 318.032440][T10148] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 318.038056][T10148] batman_adv: batadv0: Not using interface vlan2 (retrying later): interface not active [ 318.052270][T10147] netlink: 4 bytes leftover after parsing attributes in process `syz.3.995'. [ 321.307109][ T42] audit: type=1326 audit(1785613141.708:287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10180 comm="syz.0.1009" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x0 [ 322.464856][T10215] FAULT_INJECTION: forcing a failure. [ 322.464856][T10215] name failslab, interval 1, probability 0, space 0, times 0 [ 322.470583][T10215] CPU: 3 UID: 0 PID: 10215 Comm: syz.3.1019 Tainted: G L syzkaller #0 PREEMPT(full) [ 322.470614][T10215] Tainted: [L]=SOFTLOCKUP [ 322.470620][T10215] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 322.470632][T10215] Call Trace: [ 322.470639][T10215] [ 322.470646][T10215] dump_stack_lvl+0x100/0x190 [ 322.470677][T10215] should_fail_ex.cold+0x5/0xa [ 322.470700][T10215] should_failslab+0xc2/0x120 [ 322.470728][T10215] __kmalloc_noprof+0xfc/0x820 [ 322.470750][T10215] ? __pfx___nla_validate_parse+0x10/0x10 [ 322.470775][T10215] ? hash_ipmark_create+0x45f/0x1430 [ 322.470802][T10215] hash_ipmark_create+0x45f/0x1430 [ 322.470822][T10215] ? __nla_parse+0x40/0x60 [ 322.470844][T10215] ? __pfx_hash_ipmark_create+0x10/0x10 [ 322.470866][T10215] ip_set_create+0x6b8/0x14f0 [ 322.470900][T10215] ? __pfx_ip_set_create+0x10/0x10 [ 322.470951][T10215] ? __rcu_read_unlock+0x26a/0x5e0 [ 322.470970][T10215] ? rcu_is_watching+0x12/0xc0 [ 322.470999][T10215] nfnetlink_rcv_msg+0x9d5/0x11e0 [ 322.471035][T10215] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 322.471065][T10215] ? kfree_skbmem+0x19f/0x210 [ 322.471109][T10215] netlink_rcv_skb+0x159/0x420 [ 322.471132][T10215] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 322.471159][T10215] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 322.471191][T10215] ? ns_capable+0xd2/0xf0 [ 322.471214][T10215] nfnetlink_rcv+0x1b3/0x440 [ 322.471240][T10215] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 322.471264][T10215] ? rcu_is_watching+0x12/0xc0 [ 322.471292][T10215] netlink_unicast+0x585/0x850 [ 322.471317][T10215] ? __pfx_netlink_unicast+0x10/0x10 [ 322.471347][T10215] netlink_sendmsg+0x8b0/0xda0 [ 322.471372][T10215] ? __pfx_netlink_sendmsg+0x10/0x10 [ 322.471394][T10215] ? apparmor_socket_sendmsg+0x15b/0x270 [ 322.471420][T10215] ____sys_sendmsg+0xa4d/0xbe0 [ 322.471438][T10215] ? __pfx_netlink_sendmsg+0x10/0x10 [ 322.471463][T10215] ? __pfx_____sys_sendmsg+0x10/0x10 [ 322.471481][T10215] ? __css_rstat_updated+0x1ce/0x5a0 [ 322.471532][T10215] ? __lock_acquire+0x49f/0x1a40 [ 322.471566][T10215] ___sys_sendmsg+0x190/0x1e0 [ 322.471589][T10215] ? __pfx____sys_sendmsg+0x10/0x10 [ 322.471611][T10215] ? find_held_lock+0x2b/0x80 [ 322.471644][T10215] ? find_held_lock+0x2b/0x80 [ 322.471682][T10215] __sys_sendmsg+0x160/0x210 [ 322.471709][T10215] ? __pfx___sys_sendmsg+0x10/0x10 [ 322.471741][T10215] ? exit_to_user_mode_loop+0x166/0x6f0 [ 322.471760][T10215] ? rcu_is_watching+0x12/0xc0 [ 322.471786][T10215] __do_fast_syscall_32+0xe7/0x970 [ 322.471810][T10215] ? lockdep_hardirqs_on+0x78/0x100 [ 322.471836][T10215] do_fast_syscall_32+0x32/0x70 [ 322.471862][T10215] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 322.471885][T10215] RIP: 0023:0xf7fc7fec [ 322.471908][T10215] Code: Unable to access opcode bytes at 0xf7fc7fc2. [ 322.471921][T10215] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 322.471940][T10215] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 322.471953][T10215] RDX: 0000000000008800 RSI: 0000000000000000 RDI: 0000000000000000 [ 322.471964][T10215] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 322.471973][T10215] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 322.471982][T10215] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 322.472006][T10215] [ 323.005285][ T5763] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 323.009927][ T5763] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 323.063128][ T42] audit: type=1326 audit(1785613143.468:288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10227 comm="syz.3.1024" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc7fec code=0x0 [ 323.249803][ T5759] Bluetooth: hci3: command 0x0c1a tx timeout [ 323.686455][T10241] syzkaller1: entered promiscuous mode [ 323.690724][T10241] syzkaller1: entered allmulticast mode [ 325.340435][ T5761] Bluetooth: hci3: command 0x0c1a tx timeout [ 326.734935][ T5759] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 326.737450][ T5759] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 326.789205][ T42] audit: type=1326 audit(1785613147.198:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10279 comm="syz.3.1038" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc7fec code=0x0 [ 326.871004][T10292] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1041'. [ 327.689235][T10300] erofs (device sr0): cannot find valid erofs superblock [ 328.688896][ T5759] Bluetooth: hci3: command 0x0c1a tx timeout [ 330.098531][T10337] NILFS (loop0): device size too small [ 330.684345][T10342] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1055'. [ 331.150271][T10356] erofs (device sr0): cannot find valid erofs superblock [ 332.583425][ T42] audit: type=1326 audit(1785613152.988:290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10383 comm="syz.0.1061" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f15fec code=0x0 [ 332.778319][T10385] fuse: Bad value for 'fd' [ 333.858500][T10412] NILFS (loop1): device size too small [ 334.890546][ T5759] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 334.894388][ T5759] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 334.952223][ T42] audit: type=1326 audit(1785613155.358:291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10429 comm="syz.1.1074" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x0 [ 335.981901][T10451] bond0: (slave bond_slave_0): Releasing backup interface [ 336.103304][T10451] bond0: (slave bond_slave_1): Releasing backup interface [ 336.260941][T10451] team0: Port device team_slave_0 removed [ 336.371890][T10451] team0: Port device team_slave_1 removed [ 336.381257][T10451] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 336.384483][T10451] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 336.460034][T10451] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 336.463644][T10451] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 336.524425][T10451] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 336.531571][T10454] tipc: Enabling of bearer rejected, media not registered [ 338.639184][T10480] NILFS (loop2): device size too small [ 341.049608][T10508] netlink: 188 bytes leftover after parsing attributes in process `syz.3.1095'. [ 341.052621][T10508] openvswitch: netlink: Flow actions attr not present in new flow. [ 342.028886][ T3269] usb 8-1: new full-speed USB device number 5 using dummy_hcd [ 342.360740][ T3269] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 342.365208][ T3269] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 342.372002][ T3269] usb 8-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 342.375841][ T3269] usb 8-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 342.378428][ T3269] usb 8-1: Product: syz [ 342.381101][ T3269] usb 8-1: Manufacturer: syz [ 342.383096][ T3269] usb 8-1: SerialNumber: syz [ 342.394965][ T3269] usb 8-1: config 0 descriptor?? [ 342.697249][ T3269] usb 8-1: USB disconnect, device number 5 [ 346.662436][T10610] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1114'. [ 347.533922][T10611] erofs (device sr0): cannot find valid erofs superblock [ 347.787661][T10624] typec_fusb302 0-0022: supply vbus not found, using dummy regulator [ 347.825446][T10624] typec_fusb302 0-0022: failed to request gpio_int_n [ 347.831067][T10625] typec_fusb302 1-0022: I2C/SMBus block functionality not supported! [ 347.852787][T10625] i2c i2c-1: new_device: Instantiated device typec_fusb302 at 0x22 [ 347.910524][T10627] Invalid option length (1047276) for dns_resolver key [ 348.171326][T10625] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.188467][T10624] typec_fusb302 0-0022: probe with driver typec_fusb302 failed with error -2 [ 348.195632][T10624] i2c i2c-0: new_device: Instantiated device typec_fusb302 at 0x22 [ 348.584430][ T5458] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 350.140874][T10683] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1133'. [ 350.524821][T10685] erofs (device sr0): cannot find valid erofs superblock [ 351.198557][T10699] FAULT_INJECTION: forcing a failure. [ 351.198557][T10699] name failslab, interval 1, probability 0, space 0, times 0 [ 351.208841][T10699] CPU: 0 UID: 0 PID: 10699 Comm: syz.3.1139 Tainted: G L syzkaller #0 PREEMPT(full) [ 351.208873][T10699] Tainted: [L]=SOFTLOCKUP [ 351.208879][T10699] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 351.208890][T10699] Call Trace: [ 351.208897][T10699] [ 351.208904][T10699] dump_stack_lvl+0x100/0x190 [ 351.208931][T10699] should_fail_ex.cold+0x5/0xa [ 351.208953][T10699] should_failslab+0xc2/0x120 [ 351.208978][T10699] __kmalloc_noprof+0xfc/0x820 [ 351.209001][T10699] ? genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 351.209031][T10699] genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 351.209060][T10699] genl_family_rcv_msg_doit+0xc7/0x300 [ 351.209085][T10699] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 351.209107][T10699] ? genl_get_cmd+0x3e7/0x760 [ 351.209132][T10699] ? ____sys_sendmsg+0xa4d/0xbe0 [ 351.209149][T10699] ? ___sys_sendmsg+0x190/0x1e0 [ 351.209165][T10699] ? __radix_tree_lookup+0x217/0x2b0 [ 351.209191][T10699] genl_rcv_msg+0x560/0x800 [ 351.209216][T10699] ? __pfx_genl_rcv_msg+0x10/0x10 [ 351.209239][T10699] ? __pfx_nbd_genl_connect+0x10/0x10 [ 351.209290][T10699] ? __lock_acquire+0x49f/0x1a40 [ 351.209318][T10699] netlink_rcv_skb+0x159/0x420 [ 351.209335][T10699] ? __pfx_genl_rcv_msg+0x10/0x10 [ 351.209354][T10699] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 351.209379][T10699] ? netlink_deliver_tap+0x1ae/0xcc0 [ 351.209397][T10699] genl_rcv+0x28/0x40 [ 351.209413][T10699] netlink_unicast+0x585/0x850 [ 351.209432][T10699] ? __pfx_netlink_unicast+0x10/0x10 [ 351.209455][T10699] netlink_sendmsg+0x8b0/0xda0 [ 351.209476][T10699] ? __pfx_netlink_sendmsg+0x10/0x10 [ 351.209495][T10699] ? apparmor_socket_sendmsg+0x15b/0x270 [ 351.209516][T10699] ____sys_sendmsg+0xa4d/0xbe0 [ 351.209531][T10699] ? __pfx_netlink_sendmsg+0x10/0x10 [ 351.209549][T10699] ? __pfx_____sys_sendmsg+0x10/0x10 [ 351.209574][T10699] ___sys_sendmsg+0x190/0x1e0 [ 351.209592][T10699] ? __pfx____sys_sendmsg+0x10/0x10 [ 351.209619][T10699] ? find_held_lock+0x2b/0x80 [ 351.209650][T10699] __sys_sendmsg+0x160/0x210 [ 351.209671][T10699] ? __pfx___sys_sendmsg+0x10/0x10 [ 351.209696][T10699] ? __pfx_ksys_write+0x10/0x10 [ 351.209715][T10699] __do_fast_syscall_32+0xe7/0x970 [ 351.209735][T10699] ? lockdep_hardirqs_on+0x78/0x100 [ 351.209756][T10699] do_fast_syscall_32+0x32/0x70 [ 351.209776][T10699] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 351.209795][T10699] RIP: 0023:0xf7fc7fec [ 351.209817][T10699] Code: Unable to access opcode bytes at 0xf7fc7fc2. [ 351.209823][T10699] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 351.209847][T10699] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000400 [ 351.209855][T10699] RDX: 0000000020000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 351.209864][T10699] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 351.209872][T10699] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 351.209880][T10699] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 351.209900][T10699] [ 351.291270][ T5759] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 351.342095][ T5759] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 351.385693][ T42] audit: type=1326 audit(1785613171.788:292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10696 comm="syz.1.1138" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7ff2fec code=0x0 [ 354.044305][T10749] syz.0.1154 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 354.573876][T10760] netlink: 188 bytes leftover after parsing attributes in process `syz.2.1156'. [ 354.578081][T10760] openvswitch: netlink: Flow actions attr not present in new flow. [ 355.638326][T10774] netlink: 188 bytes leftover after parsing attributes in process `syz.1.1159'. [ 355.641349][T10774] openvswitch: netlink: Flow actions attr not present in new flow. [ 359.223673][T10843] netlink: 188 bytes leftover after parsing attributes in process `syz.1.1172'. [ 359.226814][T10843] openvswitch: netlink: Flow actions attr not present in new flow. [ 362.079033][T10885] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1184'. [ 362.318374][ T5759] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 362.321398][ T5759] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 362.374311][ T42] audit: type=1326 audit(1785613182.778:293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10888 comm="syz.2.1185" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 362.614317][T10909] erofs (device sr0): cannot find valid erofs superblock [ 363.081652][T10911] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1190'. [ 363.895044][T10921] erofs (device sr0): cannot find valid erofs superblock [ 364.622345][T10873] syz.1.1180 (10873) used greatest stack depth: 18816 bytes left [ 365.691766][T10943] gretap0: entered promiscuous mode [ 366.771779][T10953] bond6: entered promiscuous mode [ 366.773602][T10953] bond6: entered allmulticast mode [ 366.775664][T10953] 8021q: adding VLAN 0 to HW filter on device bond6 [ 366.870306][T10964] bridge_slave_0: default FDB implementation only supports local addresses [ 367.040168][ T42] audit: type=1326 audit(1785613187.448:294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10978 comm="syz.0.1214" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x7ffc0000 [ 367.051888][ T42] audit: type=1326 audit(1785613187.458:295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10978 comm="syz.0.1214" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x7ffc0000 [ 367.059053][ T42] audit: type=1326 audit(1785613187.458:296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10978 comm="syz.0.1214" exe="/syz-executor" sig=0 arch=40000003 syscall=245 compat=1 ip=0xf7f15fec code=0x7ffc0000 [ 367.066660][T10970] smpboot: CPU 1 is now offline [ 367.081818][ T42] audit: type=1326 audit(1785613187.458:297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10978 comm="syz.0.1214" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x7ffc0000 [ 367.112796][ T42] audit: type=1326 audit(1785613187.458:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10978 comm="syz.0.1214" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f15fec code=0x7ffc0000 [ 367.183800][T10984] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(18) [ 367.229264][T10975] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 367.237639][ T0] Disabled fast string operations [ 367.239748][ T0] ------------[ cut here ]------------ [ 367.242062][ T0] alternatives_patched [ 367.242075][ T0] WARNING: arch/x86/kernel/cpu/cpuid-deps.c:127 at do_clear_cpu_cap+0x356/0x440, CPU#1: swapper/1/0 [ 367.248075][ T0] Modules linked in: [ 367.249824][ T0] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G S L syzkaller #0 PREEMPT(full) [ 367.254368][ T0] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 367.256866][ T0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 367.261180][ T0] RIP: 0010:do_clear_cpu_cap+0x356/0x440 [ 367.263583][ T0] Code: 2a 38 d0 7c 08 84 d2 0f 85 ea 00 00 00 8b 2d 31 5e 72 0f 31 ff 89 ee e8 08 6b 59 00 85 ed 0f 84 7d fd ff ff e8 8b 70 59 00 90 <0f> 0b 90 e9 6f fd ff ff 48 89 54 24 18 89 14 24 e8 75 70 59 00 8b [ 367.271574][ T0] RSP: 0000:ffffc9000046fc98 EFLAGS: 00010093 [ 367.274076][ T0] RAX: 0000000000000000 RBX: 0000000000000070 RCX: ffffffff81b03d68 [ 367.277282][ T0] RDX: ffff88801c342540 RSI: ffffffff81b03d75 RDI: ffff88801c342540 [ 367.280635][ T0] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 367.283954][ T0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000070 [ 367.287207][ T0] R13: 0000000000000601 R14: ffffc9000046fce0 R15: ffffc9000046fd80 [ 367.290625][ T0] FS: 0000000000000000(0000) GS:ffff888096cdf000(0000) knlGS:0000000000000000 [ 367.294369][ T0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 367.297113][ T0] CR2: 0000000000000000 CR3: 000000000e994000 CR4: 0000000000350eb0 [ 367.300543][ T0] Call Trace: [ 367.302034][ T0] [ 367.303283][ T0] ? __pfx_do_clear_cpu_cap+0x10/0x10 [ 367.305607][ T0] ? _printk+0xcf/0x110 [ 367.307380][ T0] ? __pfx_cpu_parse_topology+0x10/0x10 [ 367.309637][ T0] ? early_init_intel.cold+0x129/0x1eb [ 367.311761][ T0] early_init_intel.cold+0x13f/0x1eb [ 367.313558][ T0] init_intel+0x1c/0x7b0 [ 367.315022][ T0] identify_cpu+0x8b0/0x1c30 [ 367.317041][ T0] ? __pfx_cpu_init+0x10/0x10 [ 367.318733][ T0] identify_secondary_cpu+0x178/0x270 [ 367.320757][ T0] start_secondary+0xcf/0x2d0 [ 367.322365][ T0] ? __pfx_start_secondary+0x10/0x10 [ 367.324133][ T0] common_startup_64+0x13e/0x158 [ 367.325863][ T0] [ 367.326922][ T0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 367.329451][ T0] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G S L syzkaller #0 PREEMPT(full) [ 367.333027][ T0] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 367.335095][ T0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 367.338513][ T0] Call Trace: [ 367.339673][ T0] [ 367.340683][ T0] dump_stack_lvl+0x100/0x190 [ 367.342292][ T0] vpanic+0x552/0x970 [ 367.343627][ T0] ? __pfx_vpanic+0x10/0x10 [ 367.345231][ T0] panic+0xd1/0xe0 [ 367.346557][ T0] ? __pfx_panic+0x10/0x10 [ 367.348211][ T0] ? check_panic_on_warn+0x1f/0x90 [ 367.350238][ T0] check_panic_on_warn.cold+0x19/0x34 [ 367.352067][ T0] ? do_clear_cpu_cap+0x356/0x440 [ 367.353731][ T0] __warn.cold+0x191/0x318 [ 367.355300][ T0] __report_bug+0x30f/0x440 [ 367.356795][ T0] ? do_clear_cpu_cap+0x356/0x440 [ 367.358536][ T0] ? __pfx___report_bug+0x10/0x10 [ 367.360269][ T0] ? prb_read_valid+0x78/0xa0 [ 367.362011][ T0] ? __pfx_prb_read_valid+0x10/0x10 [ 367.364166][ T0] ? do_clear_cpu_cap+0x356/0x440 [ 367.366311][ T0] report_bug+0xb2/0x220 [ 367.368098][ T0] ? do_clear_cpu_cap+0x356/0x440 [ 367.370209][ T0] handle_bug+0x16a/0x2a0 [ 367.371969][ T0] exc_invalid_op+0x17/0x50 [ 367.373886][ T0] asm_exc_invalid_op+0x1a/0x20 [ 367.375582][ T0] RIP: 0010:do_clear_cpu_cap+0x356/0x440 [ 367.377408][ T0] Code: 2a 38 d0 7c 08 84 d2 0f 85 ea 00 00 00 8b 2d 31 5e 72 0f 31 ff 89 ee e8 08 6b 59 00 85 ed 0f 84 7d fd ff ff e8 8b 70 59 00 90 <0f> 0b 90 e9 6f fd ff ff 48 89 54 24 18 89 14 24 e8 75 70 59 00 8b [ 367.383834][ T0] RSP: 0000:ffffc9000046fc98 EFLAGS: 00010093 [ 367.385891][ T0] RAX: 0000000000000000 RBX: 0000000000000070 RCX: ffffffff81b03d68 [ 367.388476][ T0] RDX: ffff88801c342540 RSI: ffffffff81b03d75 RDI: ffff88801c342540 [ 367.391577][ T0] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 367.394236][ T0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000070 [ 367.396810][ T0] R13: 0000000000000601 R14: ffffc9000046fce0 R15: ffffc9000046fd80 [ 367.399418][ T0] ? do_clear_cpu_cap+0x348/0x440 [ 367.401083][ T0] ? do_clear_cpu_cap+0x355/0x440 [ 367.402747][ T0] ? do_clear_cpu_cap+0x355/0x440 [ 367.404325][ T0] ? __pfx_do_clear_cpu_cap+0x10/0x10 [ 367.406108][ T0] ? _printk+0xcf/0x110 [ 367.407515][ T0] ? __pfx_cpu_parse_topology+0x10/0x10 [ 367.409428][ T0] ? early_init_intel.cold+0x129/0x1eb [ 367.411567][ T0] early_init_intel.cold+0x13f/0x1eb [ 367.413641][ T0] init_intel+0x1c/0x7b0 [ 367.415270][ T0] identify_cpu+0x8b0/0x1c30 [ 367.416758][ T0] ? __pfx_cpu_init+0x10/0x10 [ 367.418656][ T0] identify_secondary_cpu+0x178/0x270 [ 367.420599][ T0] start_secondary+0xcf/0x2d0 [ 367.422238][ T0] ? __pfx_start_secondary+0x10/0x10 [ 367.424083][ T0] common_startup_64+0x13e/0x158 [ 367.425759][ T0] [ 367.427481][ T0] Kernel Offset: disabled [ 367.428923][ T0] Rebooting in 86400 seconds..