last executing test programs: 7.824608679s ago: executing program 0 (id=965): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000063110c00000000008510f8ff02000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x70) 7.737376695s ago: executing program 0 (id=966): mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f00000000c0)='1', 0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) mount(0x0, 0x0, &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r3, 0xc138fd03, &(0x7f0000001000)="04000000320000") listen(r2, 0x3) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) close_range(r1, 0xffffffffffffffff, 0x0) 7.734576144s ago: executing program 0 (id=967): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xc0105b08, 0x0) 6.993126347s ago: executing program 3 (id=970): socket(0x10, 0x3, 0x0) socket$kcm(0x2, 0xa, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) pipe(&(0x7f0000000180)) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_TMR_START(r1, 0x5402) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000a00)={0x2, &(0x7f0000000940)=[{0x28, 0x0, 0x1, 0x5ae9}, {0x6, 0xb, 0xa1, 0x1000}]}, 0x10) sendmmsg$inet(r2, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) 1.763381977s ago: executing program 3 (id=973): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/rpc/use-gss-proxy\x00', 0x1, 0x20) write(r0, &(0x7f0000000280)='1', 0x1) 1.763142724s ago: executing program 0 (id=974): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[], 0x6c}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) 1.700911742s ago: executing program 0 (id=977): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x80000) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_FIOSETOWN(r4, 0x8901, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c80)={'lo\x00'}) r6 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x20042) write$sndseq(r6, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x6, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000029000000bca3000000000000240300002cfeffff6b0af0ff0000000071a4f0ff000000001f030000000000002e0a0200000000002604fdffffff000061140800000000001d430000000000007a0a00fe0000001f6114100000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f30002af51efd601b6bf01c8e8b1fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff6194732827a58f0177184b6a89adaf17b0a6041bdef728f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5901a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb1188883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcc536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d648532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2654026c6ea08b83b123145ab5703dad844ceb201efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f4000000000f00700003c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c1011e32f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963442aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2869291b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e637d4219ef7ec61261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addbc4b3093c91b8068c5adfcb0d7fd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f37382000000000000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf799b3746979f99f6a1527f004f37e84fb478199dc1020f4beb98b8074bf7df8b5e783637daf121f175a81cffff4ac55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a274000000000000000000000000000000000000000000000009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4120260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d3b332240d450fdb0a9a69f432e277f3a0386eb2bd1305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07e18b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e8c0a0d213c3ffad44d2a376def42e41e9fc3167a257e040fa7cf32c221aaac6cfdeb33c27500001a0000000000000000000017350000c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d10522a7a945b93fb705b95b6aae27a8fab1e6984c8bdc12360627137ab6737b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481ffe46a4ce86be0b1f8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0b74903580ac987fd637c80d6c7d0de4614195e40d797c0348dd70f36a220e8b3710fb5358c27e90793bcb9ee6319342c4b239ca8cbc6fc83d32e6eb62ad92e43991f2447be9c2a1ae1119eafb901a43d57e885116d19aa152bfb89f8d0b2516f80120a1cddff771657f3d0288ec3899f1e3ba0151c4037148fb479de703fd52b6573349c28d1b107d859b4961324c17756dde99de1924a1d2b7095d34a55060f47f4407d89acf9f285b20c2e6b3d0491d0d3591b0d94713332b6b79c8297117b0d14eff64e0aca8a4b4aa773d8fba1217e9519952419bb9dd998d0ec870ff00b6d556018602738fbc6cec89d6dd13cf55b96f6fe9a137d2d6a56ad78e52c23ed080000000000002bc261a781fd14126c146a0aac4221839a4b9bbf61e4bba695a41e2109eba8e40c370267cc51ffadbd15cafc97a4d3edfdcb9b5729307c6bdaf7b69325fb05fa8a9869de0600ee477d71bf3e36d1d9019edfa27aae24b632f251df210c86a18fae731ecb8b0d48357378caf2b6789509b1bacfd4fa812fc341875cfa5e798bbf59770000000000000000c8a594ea3c3347962d9113b1fecdfad5a8da641053f02e49456f5d21674521e67a5b18ea451eccf69dd6af928d2d68da9304a2271d96c22fdcea26498d26229110b1aade386b113045033a6188d56e675564d8cb8d5b40114b0f5bf15dd64c9ece60b8588ee8777d0ea8f4713b258427c7d90f9e93348e17723ba9ab8ae790f74cc41ae5795d35f3cec40dff485d2802c08611454d9ea784a205bcc07ec26f906f3cf45bb37014ab6f22af6213618e242b283ea9d3f0677ee598072ec06f7170009d92bb7eddd12c378dfd3e74ec056ee83eef666423d934fc5908c9ff98715218a5964f1e00000000426ac9588e27aefe307f49662990ee823568bbc2f89596ced7c6c52d76b8096f1848410843b93fd404f535be474f456778b5ef85abb8fc2336abd5ea64a6efea8a5aca0015499b0200780a7bae4df603bd3c72808cf300440b1b638a6640f7de8d0d82f359ca2f779cd48cd8d3603f4f69e47f386988c9b7b5d6dd3d48a1fdca78fa04d7c87bea42161a4c0d7cf0125b43dc9d8845f3c05a08acda647e7143d0e0aee2949a45e2848890522c2288072467d2afe269f589fb7e034b92d3ca245b16b71998711bfe206c9690b6d0eebb06a29349229eb45ff15c63aa2c82c56d7420738cd1b04eb16e87cb524315d7361ea3635d3799bb7fcc56aa5e1dbe031a7a12554dee6754b72f43a6fddf427f32ec3df274a88097725679769beebf1aa6eb09d5154e4900000000000d0f7160a05911d969879953d3d4702b78825d5ed789711b77d40dc31e0b8fc651b45559da463f00000000000000005bae7859839f856e7a397913eec7977f6231c5f11849b3deabc60c5ccf240d16924eb760a969813be02a229c674045b88915518a17b683268f10358e1c0b20cfc2bd105e5e1db7fed951b8faf126267bb38b8d356f63d3433d3dee643503a8ba4968adf6673f720c474ecf324d989235f1b52aacfe52e4519af87b7e1594728d6d6fff1248e72d5b1b1b692b2b732f0f2ac0714079fd7bf97bf2b5687d1db91daa5210d09ebe66d00ff4f35143be01585e629d408f2d00a0a290db76adc5f57e160b2c188bb1ecc4e7d2948788e4f9c1bcaf91dac53a2f525f7385d5d82728b5217908748f4c22b6d797b5bbeb61411f88ee1554a78306fe"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x5, &(0x7f00000000c0), 0xffffffffffffffc2}, 0x48) 1.700753411s ago: executing program 3 (id=979): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xa, 0xffea}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0xfffffff7, 0xb47e, 0xb, 0x20000003, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)=@newqdisc={0x50, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xffe0}, {0x2, 0xb}, {0xfff1, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x20, 0x2, {{0x9, 0x7, 0xa, 0x40000003, 0xfffffffc, 0xfffffffd}, [@TCA_NETEM_LOSS={0x4}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000030}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r7) close_range(r0, 0xffffffffffffffff, 0x0) 1.700646921s ago: executing program 2 (id=980): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000740)={r3, r2, 0x25, 0x0, @val=@tracing={0x0, 0x8}}, 0x20) syz_emit_ethernet(0x36, &(0x7f0000001180)={@local, @random="e130aeaaba30", @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "6410a6", 0x0, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, @mcast2}}}}, 0x0) 1.615893713s ago: executing program 2 (id=982): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @empty, 0x4}, 0x1c) listen(r1, 0x5) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_ENCODED_WRITE(0xffffffffffffffff, 0x40809440, 0x0) sendto$inet6(r1, &(0x7f0000000000)="81", 0x1, 0x20040044, &(0x7f00000000c0)={0xa, 0x4e23, 0x89af0000, @loopback, 0x9}, 0x1c) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) sendto$inet6(r0, &(0x7f0000000040)='l', 0x1, 0x810, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) 1.605077169s ago: executing program 3 (id=983): r0 = syz_open_dev$usbmon(&(0x7f0000000240), 0x8, 0x400) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0x49cdee) 1.443659827s ago: executing program 3 (id=985): r0 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) preadv(r0, &(0x7f0000001e80)=[{&(0x7f0000001c80)=""/236, 0xec}], 0x1, 0x5, 0x6) 1.273564218s ago: executing program 2 (id=986): open(&(0x7f00009e1000)='./file0\x00', 0x149040, 0x10) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000040), 0x10000, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}}) 1.162857432s ago: executing program 2 (id=987): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x3, 0x0, 0x0, 0xfffffff8, 0xfe, 0xff, 0xff, 0x0, '\x00', 0x4}) 933.831415ms ago: executing program 1 (id=989): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', 0x0, 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000002, 0xc3072, 0xffffffffffffffff, 0x200000) symlink(&(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unlink(&(0x7f0000000600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 933.577203ms ago: executing program 2 (id=990): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) read$FUSE(r1, &(0x7f0000000680)={0x2020}, 0x2020) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r3) socket$inet(0x2, 0x803, 0x6) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) unshare(0x42000000) 733.115606ms ago: executing program 1 (id=991): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000740)={r3, r2, 0x25, 0x0, @val=@tracing={0x0, 0x8}}, 0x20) syz_emit_ethernet(0x36, &(0x7f0000001180)={@local, @random="e130aeaaba30", @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "6410a6", 0x0, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, @mcast2}}}}, 0x0) 629.978933ms ago: executing program 1 (id=992): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[], 0x6c}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) 502.992582ms ago: executing program 1 (id=993): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x290, 0x0, 0x5802, 0x294, 0x0, 0x294, 0x1c0, 0x378, 0x378, 0x1c0, 0x378, 0x3, 0x0, {[{{@ipv6={@private2, @ipv4={'\x00', '\xff\xff', @empty}, [0x0, 0xffffffff, 0xff000000], [0xffffff00, 0xffffff00, 0xffffff00, 0xff], 'rose0\x00', 'veth1_to_hsr\x00', {}, {0xff}, 0x3b, 0x6, 0x1, 0x24}, 0x0, 0xa8, 0xd0, 0x52020000}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x5}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x3, 0xab9, 0x0, '\x00', {0xfff}}}}], {{'\x00', 0x0, 0xa8, 0x1c0}, {0x28}}}}, 0x2f0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB], 0x6f4}, 0x1, 0x0, 0x0, 0x4000054}, 0x0) 368.079633ms ago: executing program 0 (id=994): r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) mlockall(0x3) write(r0, &(0x7f00000002c0)='0', 0x1) 339.483299ms ago: executing program 3 (id=995): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) socket$nl_netfilter(0x10, 0x3, 0xc) mount(0x0, &(0x7f00000002c0)='./tracing\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r3, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) socket$inet6(0xa, 0x1, 0x0) r4 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) r6 = openat$cgroup_pressure(r5, &(0x7f00000000c0)='memory.pressure\x00', 0x2, 0x0) read(r6, &(0x7f0000000100)=""/43, 0x2b) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./tracing/instances/inst1\x00', 0x1ff) 243.535921ms ago: executing program 1 (id=996): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) 283.305µs ago: executing program 2 (id=997): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xa, 0xffea}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0xfffffff7, 0xb47e, 0xb, 0x20000003, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)=@newqdisc={0x50, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xffe0}, {0x2, 0xb}, {0xfff1, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x20, 0x2, {{0x9, 0x7, 0xa, 0x40000003, 0xfffffffc, 0xfffffffd}, [@TCA_NETEM_LOSS={0x4}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000030}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 1 (id=998): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='su', 0x2) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:49234' (ED25519) to the list of known hosts. [ 40.402421][ T5653] cgroup: Unknown subsys name 'net' [ 40.540962][ T5653] cgroup: Unknown subsys name 'cpuset' [ 40.543995][ T5653] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 41.778670][ T5653] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 45.592473][ T5743] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 45.594696][ T5743] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 45.595931][ T5743] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 45.596382][ T5743] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 45.598202][ T5743] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 45.602624][ T5748] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 45.602771][ T5748] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 45.603305][ T5755] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 45.604903][ T5755] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 45.606525][ T5755] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 45.607051][ T5756] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 45.607352][ T5754] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 45.607800][ T5755] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 45.609613][ T5755] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 45.610915][ T5755] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 45.612293][ T65] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 45.613796][ T5748] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 45.616235][ T5748] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 45.626702][ T5748] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 45.633755][ T5103] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 47.112283][ T5740] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.112496][ T5740] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.112670][ T5740] bridge_slave_0: entered allmulticast mode [ 47.114078][ T5740] bridge_slave_0: entered promiscuous mode [ 47.171710][ T5740] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.172188][ T5740] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.172388][ T5740] bridge_slave_1: entered allmulticast mode [ 47.173668][ T5740] bridge_slave_1: entered promiscuous mode [ 47.339643][ T5740] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.339825][ T5750] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.340473][ T5750] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.340596][ T5750] bridge_slave_0: entered allmulticast mode [ 47.342095][ T5750] bridge_slave_0: entered promiscuous mode [ 47.374016][ T5740] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.402605][ T5741] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.402686][ T5741] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.402793][ T5741] bridge_slave_0: entered allmulticast mode [ 47.404748][ T5741] bridge_slave_0: entered promiscuous mode [ 47.411482][ T5750] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.411592][ T5750] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.411699][ T5750] bridge_slave_1: entered allmulticast mode [ 47.413055][ T5750] bridge_slave_1: entered promiscuous mode [ 47.461852][ T5741] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.461986][ T5741] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.462097][ T5741] bridge_slave_1: entered allmulticast mode [ 47.463498][ T5741] bridge_slave_1: entered promiscuous mode [ 47.486482][ T5740] team0: Port device team_slave_0 added [ 47.486634][ T5749] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.486721][ T5749] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.486836][ T5749] bridge_slave_0: entered allmulticast mode [ 47.488608][ T5749] bridge_slave_0: entered promiscuous mode [ 47.515099][ T5750] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.519689][ T5750] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.521539][ T5740] team0: Port device team_slave_1 added [ 47.533390][ T5749] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.533466][ T5749] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.533560][ T5749] bridge_slave_1: entered allmulticast mode [ 47.534993][ T5749] bridge_slave_1: entered promiscuous mode [ 47.548665][ T5741] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.551399][ T5741] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.608594][ T5740] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.608610][ T5740] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.608630][ T5740] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.611050][ T5750] team0: Port device team_slave_0 added [ 47.611592][ T5740] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.611606][ T5740] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.611628][ T5740] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.615131][ T5749] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.618157][ T5749] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.642814][ T5750] team0: Port device team_slave_1 added [ 47.655462][ T5741] team0: Port device team_slave_0 added [ 47.691321][ T5741] team0: Port device team_slave_1 added [ 47.701087][ T5748] Bluetooth: hci3: command tx timeout [ 47.701510][ T5103] Bluetooth: hci1: command tx timeout [ 47.701978][ T5743] Bluetooth: hci2: command tx timeout [ 47.707774][ T5743] Bluetooth: hci0: command tx timeout [ 47.736572][ T5749] team0: Port device team_slave_0 added [ 47.748929][ T5741] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.748947][ T5741] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.748966][ T5741] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.749799][ T5750] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.749813][ T5750] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.749886][ T5750] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.750735][ T5741] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.750746][ T5741] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.750762][ T5741] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.756282][ T5740] hsr_slave_0: entered promiscuous mode [ 47.757219][ T5740] hsr_slave_1: entered promiscuous mode [ 47.761409][ T5749] team0: Port device team_slave_1 added [ 47.771655][ T5750] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.771671][ T5750] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.771690][ T5750] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.838989][ T5749] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.839003][ T5749] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.839021][ T5749] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.841202][ T5749] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.841215][ T5749] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.841232][ T5749] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.850768][ T5741] hsr_slave_0: entered promiscuous mode [ 47.851512][ T5741] hsr_slave_1: entered promiscuous mode [ 47.852236][ T5741] debugfs: 'hsr0' already exists in 'hsr' [ 47.852305][ T5741] Cannot create hsr debugfs directory [ 47.950433][ T5750] hsr_slave_0: entered promiscuous mode [ 47.951220][ T5750] hsr_slave_1: entered promiscuous mode [ 47.951823][ T5750] debugfs: 'hsr0' already exists in 'hsr' [ 47.951841][ T5750] Cannot create hsr debugfs directory [ 47.956076][ T5749] hsr_slave_0: entered promiscuous mode [ 47.956506][ T5749] hsr_slave_1: entered promiscuous mode [ 47.956787][ T5749] debugfs: 'hsr0' already exists in 'hsr' [ 47.956797][ T5749] Cannot create hsr debugfs directory [ 48.250559][ T5740] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 48.260910][ T5740] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.263466][ T5740] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 48.269465][ T5740] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.270531][ T5740] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 48.277163][ T5740] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.278079][ T5740] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 48.284723][ T5740] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.364062][ T5741] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 48.369110][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.370002][ T5741] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 48.377077][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.378732][ T5741] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 48.385854][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.387058][ T5741] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 48.392389][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.461203][ T5749] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 48.465116][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.465550][ T5749] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 48.468077][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.477339][ T5749] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 48.480204][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.481031][ T5749] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 48.485545][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.550940][ T5750] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 48.553884][ T5750] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.561208][ T5750] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 48.568335][ T5750] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.568848][ T5750] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 48.572954][ T5750] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.573825][ T5750] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 48.576977][ T5750] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.602937][ T5740] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.614824][ T5741] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.643914][ T5740] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.651046][ T5741] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.660022][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.660205][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.669277][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.669356][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.687863][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.687943][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.689242][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.689323][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.707825][ T5749] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.765007][ T5749] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.787282][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.787365][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.796202][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.796278][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.833555][ T5750] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.868621][ T5750] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.879725][ T165] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.879850][ T165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.894218][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.894304][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.176446][ T5741] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.207160][ T5740] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.246589][ T5741] veth0_vlan: entered promiscuous mode [ 49.255996][ T5749] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.266752][ T5741] veth1_vlan: entered promiscuous mode [ 49.299765][ T5740] veth0_vlan: entered promiscuous mode [ 49.311023][ T5741] veth0_macvtap: entered promiscuous mode [ 49.321040][ T5740] veth1_vlan: entered promiscuous mode [ 49.322886][ T5741] veth1_macvtap: entered promiscuous mode [ 49.333647][ T5750] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.366336][ T5749] veth0_vlan: entered promiscuous mode [ 49.380304][ T5749] veth1_vlan: entered promiscuous mode [ 49.388971][ T5741] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.392750][ T5741] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.418763][ T5740] veth0_macvtap: entered promiscuous mode [ 49.435534][ T5740] veth1_macvtap: entered promiscuous mode [ 49.461486][ T5750] veth0_vlan: entered promiscuous mode [ 49.468155][ T5749] veth0_macvtap: entered promiscuous mode [ 49.472712][ T5749] veth1_macvtap: entered promiscuous mode [ 49.481580][ T5740] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.490819][ T5740] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.500961][ T5750] veth1_vlan: entered promiscuous mode [ 49.539401][ T5749] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.544829][ T1175] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.544847][ T1175] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.549849][ T5749] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.600552][ T5750] veth0_macvtap: entered promiscuous mode [ 49.621027][ T1158] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.621044][ T1158] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.622749][ T5750] veth1_macvtap: entered promiscuous mode [ 49.629949][ T1175] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.629966][ T1175] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.663879][ T1158] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.663893][ T1158] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.673407][ T5750] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.685601][ T5741] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 49.688538][ T5741] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 49.692983][ T5750] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.693266][ T165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.693280][ T165] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.702092][ T5741] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 49.704574][ T5741] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 49.720862][ T5741] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 49.739654][ T165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.739673][ T165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.778095][ T5743] Bluetooth: hci3: command tx timeout [ 49.788192][ T5743] Bluetooth: hci0: command tx timeout [ 49.788220][ T5743] Bluetooth: hci2: command tx timeout [ 49.788239][ T5743] Bluetooth: hci1: command tx timeout [ 49.817159][ T165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.817172][ T165] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.851881][ T1158] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.851894][ T1158] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.858996][ T5820] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861077][ T5846] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861108][ T5846] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861131][ T5846] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861158][ T5846] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861183][ T5846] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861206][ T5846] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861222][ T5846] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861243][ T5846] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861260][ T5846] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861277][ T5846] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861294][ T5846] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861310][ T5846] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861327][ T5846] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861343][ T5846] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.861364][ T5846] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.857675][ T5103] Bluetooth: hci0: command tx timeout [ 51.857697][ T5103] Bluetooth: hci3: command tx timeout [ 51.857739][ T5743] Bluetooth: hci2: command tx timeout [ 51.857771][ T5748] Bluetooth: hci1: command tx timeout [ 53.938660][ T5743] Bluetooth: hci2: command tx timeout [ 53.938692][ T5743] Bluetooth: hci0: command tx timeout [ 53.938747][ T5748] Bluetooth: hci1: command tx timeout [ 53.938751][ T5746] Bluetooth: hci3: command tx timeout [ 55.249575][ T5928] netlink: zone id is out of range [ 59.646640][ T5990] tipc: Enabling not permitted [ 59.646670][ T5990] tipc: Enabling of bearer rejected, failed to enable media [ 61.034769][ T6009] netlink: 4 bytes leftover after parsing attributes in process `syz.0.31'. [ 64.316928][ T56] IPVS: starting estimator thread 0... [ 64.417724][ T6047] IPVS: using max 28 ests per chain, 67200 per kthread [ 66.635020][ T6065] netlink: 56 bytes leftover after parsing attributes in process `syz.0.48'. [ 71.071617][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.072031][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.090222][ T1036] cfg80211: failed to load regulatory.db [ 74.127838][ T6139] netlink: 4 bytes leftover after parsing attributes in process `syz.1.71'. [ 74.175194][ T6139] team0: Port device team_slave_0 removed [ 74.302090][ T6140] ======================================================= [ 74.302090][ T6140] WARNING: The mand mount option has been deprecated and [ 74.302090][ T6140] and is ignored by this kernel. Remove the mand [ 74.302090][ T6140] option from the mount to silence this warning. [ 74.302090][ T6140] ======================================================= [ 74.309733][ T6140] befs: (nbd0): unable to read superblock [ 75.265959][ T6149] syz.1.75 uses obsolete (PF_INET,SOCK_PACKET) [ 75.340597][ T6151] netlink: 'syz.0.76': attribute type 39 has an invalid length. [ 76.667207][ T6160] netlink: 4 bytes leftover after parsing attributes in process `syz.3.74'. [ 76.861161][ T6165] FAULT_INJECTION: forcing a failure. [ 76.861161][ T6165] name failslab, interval 1, probability 0, space 0, times 1 [ 76.861193][ T6165] CPU: 3 UID: 0 PID: 6165 Comm: syz.3.80 Tainted: G L syzkaller #0 PREEMPT(full) [ 76.861220][ T6165] Tainted: [L]=SOFTLOCKUP [ 76.861227][ T6165] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.861238][ T6165] Call Trace: [ 76.861244][ T6165] [ 76.861252][ T6165] dump_stack_lvl+0x100/0x190 [ 76.861281][ T6165] should_fail_ex.cold+0x5/0xa [ 76.861307][ T6165] should_failslab+0xc2/0x120 [ 76.861330][ T6165] __kmalloc_cache_noprof+0x91/0x6d0 [ 76.861358][ T6165] ? __pfx_sprintf+0x10/0x10 [ 76.861381][ T6165] ? call_usermodehelper_setup+0xaf/0x360 [ 76.861409][ T6165] ? __pfx_umh_keys_cleanup+0x10/0x10 [ 76.861432][ T6165] call_usermodehelper_setup+0xaf/0x360 [ 76.861454][ T6165] ? __pfx_umh_keys_init+0x10/0x10 [ 76.861480][ T6165] call_sbin_request_key+0x6ff/0xd90 [ 76.861508][ T6165] ? __pfx_call_sbin_request_key+0x10/0x10 [ 76.861531][ T6165] ? key_instantiate_and_link+0x39d/0x4b0 [ 76.861556][ T6165] ? key_alloc+0xbb4/0x1310 [ 76.861578][ T6165] ? __pfx_key_instantiate_and_link+0x10/0x10 [ 76.861617][ T6165] ? request_key_auth_new+0x6b9/0xa00 [ 76.861642][ T6165] ? __pfx_request_key_auth_new+0x10/0x10 [ 76.861676][ T6165] ? __pfx_call_sbin_request_key+0x10/0x10 [ 76.861701][ T6165] request_key_and_link+0x1115/0x1330 [ 76.861751][ T6165] ? __pfx_request_key_and_link+0x10/0x10 [ 76.861776][ T6165] ? __pfx___might_resched+0x10/0x10 [ 76.861802][ T6165] ? find_held_lock+0x2b/0x80 [ 76.861823][ T6165] ? __pfx_key_default_cmp+0x10/0x10 [ 76.861840][ T6165] ? __pfx_keyring_search_iterator+0x10/0x10 [ 76.861861][ T6165] ? _copy_from_user+0x59/0xd0 [ 76.861886][ T6165] __do_sys_request_key+0x2a2/0x3c0 [ 76.861911][ T6165] ? __pfx___do_sys_request_key+0x10/0x10 [ 76.861945][ T6165] __do_fast_syscall_32+0x13a/0x8b0 [ 76.861986][ T6165] do_fast_syscall_32+0x32/0x70 [ 76.862017][ T6165] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 76.862040][ T6165] RIP: 0023:0xf7f52fec [ 76.862061][ T6165] Code: Unable to access opcode bytes at 0xf7f52fc2. [ 76.862070][ T6165] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 000000000000011f [ 76.862089][ T6165] RAX: ffffffffffffffda RBX: 0000000080000040 RCX: 00000000800000c0 [ 76.862101][ T6165] RDX: 00000000800001c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 76.862113][ T6165] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 76.862123][ T6165] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 76.862134][ T6165] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 76.862156][ T6165] [ 77.686291][ T6175] process 'syz.0.82' launched './file2' with NULL argv: empty string added [ 78.576856][ T6187] vlan2: entered promiscuous mode [ 78.576877][ T6187] macvtap0: entered promiscuous mode [ 80.609944][ T6201] Zero length message leads to an empty skb [ 82.480595][ T6221] binder: 6218:6221 ioctl c0306201 80000080 returned -14 [ 83.537637][ T50] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 83.570754][ T5827] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 83.586030][ T5827] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 83.707756][ T50] usb 6-1: Using ep0 maxpacket: 8 [ 83.709252][ T50] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 83.710500][ T50] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 83.710524][ T50] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 83.710535][ T50] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 83.710546][ T50] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 83.710557][ T50] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 83.710575][ T50] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.839303][ T5827] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 84.348583][ T5827] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 84.420094][ T50] usb 6-1: usb_control_msg returned -32 [ 84.420127][ T50] usbtmc 6-1:16.0: can't read capabilities [ 84.479098][ T6238] ceph: No mds server is up or the cluster is laggy [ 86.420673][ T2323] usb 6-1: USB disconnect, device number 2 [ 87.512830][ T6294] FAULT_INJECTION: forcing a failure. [ 87.512830][ T6294] name failslab, interval 1, probability 0, space 0, times 0 [ 87.512860][ T6294] CPU: 1 UID: 0 PID: 6294 Comm: syz.3.114 Tainted: G L syzkaller #0 PREEMPT(full) [ 87.512880][ T6294] Tainted: [L]=SOFTLOCKUP [ 87.512885][ T6294] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.512893][ T6294] Call Trace: [ 87.512898][ T6294] [ 87.512904][ T6294] dump_stack_lvl+0x100/0x190 [ 87.512930][ T6294] should_fail_ex.cold+0x5/0xa [ 87.512951][ T6294] should_failslab+0xc2/0x120 [ 87.512972][ T6294] kmem_cache_alloc_noprof+0x92/0x6a0 [ 87.513012][ T6294] ? do_getname+0x35/0x390 [ 87.513038][ T6294] do_getname+0x35/0x390 [ 87.513061][ T6294] __ia32_sys_symlink+0x65/0xb0 [ 87.513083][ T6294] __do_fast_syscall_32+0x13a/0x8b0 [ 87.513107][ T6294] ? lockdep_hardirqs_on+0x7d/0x110 [ 87.513129][ T6294] do_fast_syscall_32+0x32/0x70 [ 87.513151][ T6294] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 87.513169][ T6294] RIP: 0023:0xf7f52fec [ 87.513186][ T6294] Code: Unable to access opcode bytes at 0xf7f52fc2. [ 87.513192][ T6294] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 87.513207][ T6294] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 87.513216][ T6294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 87.513224][ T6294] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 87.513232][ T6294] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 87.513241][ T6294] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 87.513259][ T6294] [ 89.290525][ T6324] FAULT_INJECTION: forcing a failure. [ 89.290525][ T6324] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 89.290548][ T6324] CPU: 0 UID: 0 PID: 6324 Comm: syz.1.124 Tainted: G L syzkaller #0 PREEMPT(full) [ 89.290564][ T6324] Tainted: [L]=SOFTLOCKUP [ 89.290568][ T6324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 89.290574][ T6324] Call Trace: [ 89.290578][ T6324] [ 89.290582][ T6324] dump_stack_lvl+0x100/0x190 [ 89.290602][ T6324] should_fail_ex.cold+0x5/0xa [ 89.290616][ T6324] strncpy_from_user+0x3b/0x2d0 [ 89.290633][ T6324] do_getname+0x271/0x390 [ 89.290650][ T6324] __ia32_sys_symlink+0x56/0xb0 [ 89.290664][ T6324] __do_fast_syscall_32+0x13a/0x8b0 [ 89.290682][ T6324] ? lockdep_hardirqs_on+0x7d/0x110 [ 89.290699][ T6324] do_fast_syscall_32+0x32/0x70 [ 89.290715][ T6324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 89.290729][ T6324] RIP: 0023:0xf706efec [ 89.290742][ T6324] Code: Unable to access opcode bytes at 0xf706efc2. [ 89.290747][ T6324] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 89.290758][ T6324] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 89.290765][ T6324] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 89.290771][ T6324] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 89.290778][ T6324] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 89.290785][ T6324] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 89.290798][ T6324] [ 91.123790][ T6354] nvme nvme0: failed to connect socket: -111 [ 91.266736][ T6357] FAULT_INJECTION: forcing a failure. [ 91.266736][ T6357] name failslab, interval 1, probability 0, space 0, times 0 [ 91.266757][ T6357] CPU: 3 UID: 0 PID: 6357 Comm: syz.0.136 Tainted: G L syzkaller #0 PREEMPT(full) [ 91.266775][ T6357] Tainted: [L]=SOFTLOCKUP [ 91.266779][ T6357] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 91.266784][ T6357] Call Trace: [ 91.266789][ T6357] [ 91.266805][ T6357] dump_stack_lvl+0x100/0x190 [ 91.266823][ T6357] should_fail_ex.cold+0x5/0xa [ 91.266838][ T6357] should_failslab+0xc2/0x120 [ 91.266854][ T6357] kmem_cache_alloc_noprof+0x92/0x6a0 [ 91.266867][ T6357] ? do_getname+0x35/0x390 [ 91.266884][ T6357] do_getname+0x35/0x390 [ 91.266900][ T6357] __ia32_sys_symlink+0x65/0xb0 [ 91.266914][ T6357] __do_fast_syscall_32+0x13a/0x8b0 [ 91.266930][ T6357] ? lockdep_hardirqs_on+0x7d/0x110 [ 91.266946][ T6357] do_fast_syscall_32+0x32/0x70 [ 91.266963][ T6357] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 91.266977][ T6357] RIP: 0023:0xf7fb7fec [ 91.266989][ T6357] Code: Unable to access opcode bytes at 0xf7fb7fc2. [ 91.266994][ T6357] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 91.267009][ T6357] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 91.267015][ T6357] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 91.267021][ T6357] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 91.267027][ T6357] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 91.267033][ T6357] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 91.267046][ T6357] [ 91.857619][ T5847] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 92.037619][ T5847] usb 5-1: Using ep0 maxpacket: 8 [ 92.038095][ T5847] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 92.038907][ T5847] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 92.038929][ T5847] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 92.038940][ T5847] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 92.038951][ T5847] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 92.038962][ T5847] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 92.038980][ T5847] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.258533][ T5847] usb 5-1: usb_control_msg returned -32 [ 92.258557][ T5847] usbtmc 5-1:16.0: can't read capabilities [ 92.409704][ T6383] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 93.742335][ T6423] nvme_fc: nvme_fc_create_ctrl: nn-0x3333333333333333:pn-0x4444444444444444 - nn-0x1111111111111111:pn-0x2222222222222222 combination not found [ 94.622177][ T9] usb 5-1: USB disconnect, device number 2 [ 95.383137][ T43] audit: type=1800 audit(1789010224.356:2): pid=6440 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.169" name="syzkaller0" dev="sda1" ino=2038 res=0 errno=0 [ 95.707700][ T3380] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 95.857777][ T3380] usb 7-1: Using ep0 maxpacket: 8 [ 95.858299][ T3380] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 95.859592][ T3380] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 95.859614][ T3380] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 95.859625][ T3380] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 95.859636][ T3380] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 95.859647][ T3380] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 95.859666][ T3380] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.070597][ T3380] usb 7-1: usb_control_msg returned -32 [ 96.070621][ T3380] usbtmc 7-1:16.0: can't read capabilities [ 97.405879][ T6458] netlink: 312 bytes leftover after parsing attributes in process `syz.1.176'. [ 98.359042][ T6487] syz.0.185 (6487): drop_caches: 2 [ 98.377812][ T1158] IPVS: starting estimator thread 0... [ 98.477671][ T6490] IPVS: using max 22 ests per chain, 52800 per kthread [ 98.494586][ T5827] usb 7-1: USB disconnect, device number 2 [ 99.932331][ T5847] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 100.120196][ T5847] usb 8-1: Using ep0 maxpacket: 8 [ 100.166702][ T5847] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 100.177441][ T5847] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 100.177486][ T5847] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 100.177505][ T5847] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 100.190085][ T5847] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 100.190107][ T5847] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 100.190143][ T5847] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.444367][ T5847] usb 8-1: usb_control_msg returned -32 [ 100.445096][ T5847] usbtmc 8-1:16.0: can't read capabilities [ 102.688664][ T2323] usb 8-1: USB disconnect, device number 2 [ 102.968786][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.265270][ T5746] Bluetooth: hci3: unknown advertising packet type: 0x69 [ 103.763083][ T6621] capability: warning: `syz.0.240' uses deprecated v2 capabilities in a way that may be insecure [ 105.008934][ T5847] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 105.167633][ T5847] usb 7-1: Using ep0 maxpacket: 8 [ 105.168432][ T5847] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 105.169409][ T5847] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 105.169448][ T5847] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 105.169467][ T5847] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 105.169494][ T5847] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 105.169513][ T5847] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 105.169547][ T5847] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.486883][ T5847] usb 7-1: usb_control_msg returned -32 [ 105.486923][ T5847] usbtmc 7-1:16.0: can't read capabilities [ 105.521645][ T9] usb 7-1: USB disconnect, device number 3 [ 107.602509][ T6698] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.691239][ T6698] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.772223][ T6698] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.882784][ T6698] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.027932][ T5820] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.027971][ T5820] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.027997][ T5820] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.037796][ T12] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.254646][ T6722] gretap0: entered promiscuous mode [ 108.256510][ T6722] macsec1: entered allmulticast mode [ 108.256533][ T6722] gretap0: entered allmulticast mode [ 108.268609][ T6722] gretap0: left allmulticast mode [ 108.268627][ T6722] gretap0: left promiscuous mode [ 108.619520][ T6740] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.715860][ T6740] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.803605][ T6740] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.907033][ T6740] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.027883][ T12] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.057980][ T12] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.060878][ T5820] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.060918][ T5820] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.601681][ T6772] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 113.492926][ T6934] evm: overlay not supported [ 113.721969][ T5746] Bluetooth: hci2: Malformed LE Event: 0x0b [ 115.139442][ T5746] Bluetooth: hci3: Malformed LE Event: 0x0b [ 116.633692][ T6992] FAULT_INJECTION: forcing a failure. [ 116.633692][ T6992] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 116.633727][ T6992] CPU: 2 UID: 0 PID: 6992 Comm: syz.0.381 Tainted: G L syzkaller #0 PREEMPT(full) [ 116.633752][ T6992] Tainted: [L]=SOFTLOCKUP [ 116.633759][ T6992] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.633770][ T6992] Call Trace: [ 116.633776][ T6992] [ 116.633784][ T6992] dump_stack_lvl+0x100/0x190 [ 116.633824][ T6992] should_fail_ex.cold+0x5/0xa [ 116.633852][ T6992] strncpy_from_user+0x3b/0x2d0 [ 116.633883][ T6992] do_getname+0x271/0x390 [ 116.633915][ T6992] __ia32_sys_symlink+0x56/0xb0 [ 116.633942][ T6992] __do_fast_syscall_32+0x13a/0x8b0 [ 116.633975][ T6992] do_fast_syscall_32+0x32/0x70 [ 116.634004][ T6992] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 116.634028][ T6992] RIP: 0023:0xf7fb7fec [ 116.634048][ T6992] Code: Unable to access opcode bytes at 0xf7fb7fc2. [ 116.634057][ T6992] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 116.634077][ T6992] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 116.634090][ T6992] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 116.634100][ T6992] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 116.634111][ T6992] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 116.634122][ T6992] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 116.634146][ T6992] [ 117.410828][ T5746] Bluetooth: hci1: Malformed LE Event: 0x0b [ 118.478504][ T7040] loop2: detected capacity change from 0 to 2640 [ 118.494165][ T7040] Buffer I/O error on dev loop2, logical block 0, lost async page write [ 118.494201][ T7040] Buffer I/O error on dev loop2, logical block 1, lost async page write [ 118.494219][ T7040] Buffer I/O error on dev loop2, logical block 2, lost async page write [ 118.494239][ T7040] Buffer I/O error on dev loop2, logical block 3, lost async page write [ 118.494258][ T7040] Buffer I/O error on dev loop2, logical block 4, lost async page write [ 118.494276][ T7040] Buffer I/O error on dev loop2, logical block 5, lost async page write [ 118.494293][ T7040] Buffer I/O error on dev loop2, logical block 6, lost async page write [ 118.494311][ T7040] Buffer I/O error on dev loop2, logical block 7, lost async page write [ 118.494331][ T7040] Buffer I/O error on dev loop2, logical block 8, lost async page write [ 118.494349][ T7040] Buffer I/O error on dev loop2, logical block 9, lost async page write [ 118.570969][ T7045] FAULT_INJECTION: forcing a failure. [ 118.570969][ T7045] name failslab, interval 1, probability 0, space 0, times 0 [ 118.571002][ T7045] CPU: 0 UID: 0 PID: 7045 Comm: syz.0.402 Tainted: G L syzkaller #0 PREEMPT(full) [ 118.571028][ T7045] Tainted: [L]=SOFTLOCKUP [ 118.571036][ T7045] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 118.571045][ T7045] Call Trace: [ 118.571052][ T7045] [ 118.571059][ T7045] dump_stack_lvl+0x100/0x190 [ 118.571090][ T7045] should_fail_ex.cold+0x5/0xa [ 118.571117][ T7045] should_failslab+0xc2/0x120 [ 118.571144][ T7045] kmem_cache_alloc_noprof+0x92/0x6a0 [ 118.571168][ T7045] ? do_getname+0x35/0x390 [ 118.571199][ T7045] do_getname+0x35/0x390 [ 118.571249][ T7045] __ia32_sys_symlink+0x65/0xb0 [ 118.571278][ T7045] __do_fast_syscall_32+0x13a/0x8b0 [ 118.571314][ T7045] do_fast_syscall_32+0x32/0x70 [ 118.571343][ T7045] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 118.571368][ T7045] RIP: 0023:0xf7fb7fec [ 118.571389][ T7045] Code: Unable to access opcode bytes at 0xf7fb7fc2. [ 118.571397][ T7045] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 118.571417][ T7045] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 118.571430][ T7045] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 118.571441][ T7045] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 118.571452][ T7045] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 118.571465][ T7045] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 118.571489][ T7045] [ 119.146786][ T5746] Bluetooth: hci0: unknown advertising packet type: 0x69 [ 123.947692][ T5746] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 123.947711][ T5746] CPU: 0 UID: 0 PID: 5746 Comm: kworker/u34:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 123.947729][ T5746] Tainted: [L]=SOFTLOCKUP [ 123.947733][ T5746] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 123.947740][ T5746] Workqueue: hci3 hci_rx_work [ 123.947759][ T5746] Call Trace: [ 123.947763][ T5746] [ 123.947770][ T5746] dump_stack_lvl+0x100/0x190 [ 123.947788][ T5746] sysfs_warn_dup.cold+0x1c/0x28 [ 123.947804][ T5746] sysfs_create_dir_ns+0x24b/0x2b0 [ 123.947819][ T5746] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 123.947831][ T5746] ? find_held_lock+0x2b/0x80 [ 123.947844][ T5746] ? kobject_add_internal+0x25f/0x930 [ 123.947856][ T5746] ? kobject_add_internal+0x25f/0x930 [ 123.947869][ T5746] ? do_raw_spin_unlock+0x145/0x1e0 [ 123.947880][ T5746] kobject_add_internal+0x2c8/0x930 [ 123.947894][ T5746] kobject_add+0x16a/0x1e0 [ 123.947906][ T5746] ? __pfx_kobject_add+0x10/0x10 [ 123.947917][ T5746] ? class_to_subsys+0x10f/0x150 [ 123.947936][ T5746] ? kobject_put+0xb9/0x640 [ 123.947946][ T5746] ? _raw_spin_unlock+0x28/0x50 [ 123.947963][ T5746] device_add+0x294/0x1970 [ 123.947979][ T5746] ? __pfx_dev_set_name+0x10/0x10 [ 123.947990][ T5746] ? __pfx_device_add+0x10/0x10 [ 123.948006][ T5746] ? mgmt_send_event_skb+0x2fb/0x460 [ 123.948024][ T5746] hci_conn_add_sysfs+0x1a3/0x260 [ 123.948041][ T5746] le_conn_complete_evt+0x122f/0x2130 [ 123.948060][ T5746] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 123.948074][ T5746] ? hci_event_packet+0x186/0xcd0 [ 123.948091][ T5746] hci_le_conn_complete_evt+0x23c/0x3a0 [ 123.948106][ T5746] ? skb_pull_data+0x15f/0x1e0 [ 123.948118][ T5746] hci_le_meta_evt+0x34a/0x5f0 [ 123.948149][ T5746] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 123.948167][ T5746] hci_event_packet+0x51c/0xcd0 [ 123.948182][ T5746] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 123.948198][ T5746] ? __pfx_hci_event_packet+0x10/0x10 [ 123.948216][ T5746] ? lockdep_hardirqs_on+0x7d/0x110 [ 123.948235][ T5746] hci_rx_work+0x451/0xfc0 [ 123.948252][ T5746] process_one_work+0xac7/0x1b10 [ 123.948282][ T5746] ? __pfx_process_one_work+0x10/0x10 [ 123.948296][ T5746] ? lock_acquire+0x1d1/0x380 [ 123.948316][ T5746] ? __pfx_hci_rx_work+0x10/0x10 [ 123.948333][ T5746] worker_thread+0x5ef/0xe50 [ 123.948352][ T5746] ? kthread+0x13a/0x450 [ 123.948364][ T5746] ? __pfx_worker_thread+0x10/0x10 [ 123.948377][ T5746] kthread+0x373/0x450 [ 123.948388][ T5746] ? __pfx_kthread+0x10/0x10 [ 123.948402][ T5746] ret_from_fork+0x730/0xd60 [ 123.948419][ T5746] ? __pfx_ret_from_fork+0x10/0x10 [ 123.948435][ T5746] ? rcu_is_watching+0x13/0xc0 [ 123.948446][ T5746] ? __switch_to+0x800/0x10f0 [ 123.948460][ T5746] ? __pfx_kthread+0x10/0x10 [ 123.948472][ T5746] ret_from_fork_asm+0x1a/0x30 [ 123.948489][ T5746] [ 123.948534][ T5746] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 123.948556][ T5746] Bluetooth: hci3: failed to register connection device [ 124.595623][ T7113] netlink: 'syz.0.432': attribute type 10 has an invalid length. [ 124.654213][ T7113] team0: Device dummy0 failed to register rx_handler [ 125.648792][ T1036] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 125.803479][ T1036] usb 7-1: Using ep0 maxpacket: 32 [ 125.804473][ T1036] usb 7-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 125.805405][ T1036] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 125.805424][ T1036] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 125.850324][ T1036] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.850349][ T1036] usb 7-1: Product: syz [ 125.850361][ T1036] usb 7-1: Manufacturer: syz [ 125.850373][ T1036] usb 7-1: SerialNumber: syz [ 126.203026][ T1036] usb 7-1: USB disconnect, device number 4 [ 126.356879][ T7150] udevd[7150]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb7/7-1/7-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 127.467721][ T35] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 127.628422][ T35] usb 7-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 127.630723][ T35] usb 7-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 127.633390][ T35] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.633434][ T35] usb 7-1: Product: syz [ 127.633442][ T35] usb 7-1: Manufacturer: syz [ 127.633449][ T35] usb 7-1: SerialNumber: syz [ 127.849976][ T35] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 127.850020][ T35] command write [95] error -22 [ 127.858307][ T35] usb 7-1: USB disconnect, device number 5 [ 128.064762][ T5746] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 128.625003][ T7198] syz.2.467 (7198) used greatest stack depth: 19256 bytes left [ 128.868735][ T5103] Bluetooth: hci2: unknown advertising packet type: 0x69 [ 128.967617][ T3380] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 129.117742][ T3380] usb 7-1: device descriptor read/64, error -71 [ 129.377677][ T3380] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 129.507829][ T3380] usb 7-1: device descriptor read/64, error -71 [ 129.618011][ T3380] usb usb7-port1: attempt power cycle [ 129.967827][ T3380] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 129.988070][ T3380] usb 7-1: device descriptor read/8, error -71 [ 130.097833][ T5748] Bluetooth: hci3: command 0x0406 tx timeout [ 130.237718][ T3380] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 130.258436][ T3380] usb 7-1: device descriptor read/8, error -71 [ 130.370789][ T3380] usb usb7-port1: unable to enumerate USB device [ 132.498383][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.498413][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.828436][ T7240] netlink: 4 bytes leftover after parsing attributes in process `syz.1.484'. [ 135.002649][ T7242] lo: entered promiscuous mode [ 135.226912][ T7242] tunl0: entered promiscuous mode [ 135.240599][ T7242] gre0: entered promiscuous mode [ 135.302234][ T7242] gretap0: entered promiscuous mode [ 135.427067][ T7242] erspan0: entered promiscuous mode [ 135.445189][ T7242] ip_vti0: entered promiscuous mode [ 135.446648][ T7242] ip6_vti0: entered promiscuous mode [ 135.448762][ T7242] sit0: entered promiscuous mode [ 135.473163][ T7242] ip6tnl0: entered promiscuous mode [ 135.498866][ T7242] ip6gre0: entered promiscuous mode [ 135.518796][ T7242] syz_tun: entered promiscuous mode [ 135.558125][ T7242] ip6gretap0: entered promiscuous mode [ 135.562501][ T7242] bridge0: port 2(bridge_slave_1) entered disabled state [ 135.563880][ T7242] bridge0: port 1(bridge_slave_0) entered disabled state [ 135.579950][ T7242] bridge0: entered promiscuous mode [ 135.583321][ T7242] vcan0: entered promiscuous mode [ 135.596560][ T7242] bond0: entered promiscuous mode [ 135.596582][ T7242] bond_slave_0: entered promiscuous mode [ 135.596763][ T7242] bond_slave_1: entered promiscuous mode [ 135.611046][ T7242] team0: entered promiscuous mode [ 135.611067][ T7242] team_slave_0: entered promiscuous mode [ 135.611248][ T7242] team_slave_1: entered promiscuous mode [ 135.637822][ T7242] dummy0: entered promiscuous mode [ 135.639617][ T7242] nlmon0: entered promiscuous mode [ 135.641351][ T7242] batadv0: entered promiscuous mode [ 135.644089][ T7242] vxcan0: entered promiscuous mode [ 135.644922][ T7242] vxcan1: entered promiscuous mode [ 135.645702][ T7242] veth0: entered promiscuous mode [ 135.650216][ T7242] veth1: entered promiscuous mode [ 135.680678][ T7242] wg0: entered promiscuous mode [ 135.719788][ T7242] wg2: entered promiscuous mode [ 135.721391][ T7242] veth0_to_bridge: entered promiscuous mode [ 135.733225][ T7242] veth1_to_bridge: entered promiscuous mode [ 135.766572][ T7242] veth0_to_bond: entered promiscuous mode [ 135.789142][ T7242] veth1_to_bond: entered promiscuous mode [ 135.792063][ T7242] veth0_to_team: entered promiscuous mode [ 135.820095][ T7242] veth1_to_team: entered promiscuous mode [ 135.841145][ T7242] veth0_to_batadv: entered promiscuous mode [ 135.961945][ T7242] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 135.962002][ T7242] batadv_slave_0: entered promiscuous mode [ 135.978595][ T7242] veth1_to_batadv: entered promiscuous mode [ 135.981007][ T7242] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 135.981054][ T7242] batadv_slave_1: entered promiscuous mode [ 136.007097][ T7242] xfrm0: entered promiscuous mode [ 136.026132][ T7242] veth0_to_hsr: entered promiscuous mode [ 136.050094][ T7242] veth1_to_hsr: entered promiscuous mode [ 136.054226][ T7242] hsr0: entered promiscuous mode [ 136.075854][ T7242] veth1_virt_wifi: entered promiscuous mode [ 136.078880][ T7242] veth0_virt_wifi: entered promiscuous mode [ 136.081191][ T7242] virt_wifi0: entered promiscuous mode [ 136.086821][ T7242] vlan0: entered promiscuous mode [ 136.113557][ T7242] vlan1: entered promiscuous mode [ 136.137899][ T7242] macvlan0: entered promiscuous mode [ 136.146678][ T7242] macvlan1: entered promiscuous mode [ 136.149340][ T7242] ipvlan0: entered promiscuous mode [ 136.149497][ T7242] ipvlan1: entered promiscuous mode [ 136.175635][ T7242] macvtap0: entered promiscuous mode [ 136.178480][ T7242] macsec0: entered promiscuous mode [ 136.184322][ T7242] geneve0: entered promiscuous mode [ 136.188440][ T7242] geneve1: entered promiscuous mode [ 136.267904][ T7242] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 136.350511][ T7242] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 136.352646][ T7242] ipvlan2: entered promiscuous mode [ 136.352805][ T7242] netdevsim netdevsim0 eth0: entered promiscuous mode [ 136.352980][ T7242] netdevsim netdevsim0 eth1: entered promiscuous mode [ 136.353104][ T7242] netdevsim netdevsim0 eth2: entered promiscuous mode [ 136.353217][ T7242] netdevsim netdevsim0 eth3: entered promiscuous mode [ 136.362377][ T5846] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.363439][ T5846] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.363478][ T5846] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.363507][ T5846] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.739972][ T7278] capability: warning: `syz.2.498' uses 32-bit capabilities (legacy support in use) [ 137.740436][ T7278] VFS: file-max limit 0 reached [ 138.664081][ T7288] netlink: 28 bytes leftover after parsing attributes in process `syz.2.503'. [ 138.664115][ T7288] netlink: 28 bytes leftover after parsing attributes in process `syz.2.503'. [ 138.815680][ T7294] netlink: 4 bytes leftover after parsing attributes in process `syz.2.506'. [ 139.107629][ T3380] usb 7-1: new full-speed USB device number 10 using dummy_hcd [ 139.195917][ T7304] lo: entered promiscuous mode [ 139.271891][ T7304] tunl0: entered promiscuous mode [ 139.272745][ T7304] gre0: entered promiscuous mode [ 139.278072][ T3380] usb 7-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 139.279151][ T3380] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 139.279163][ T3380] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 139.279974][ T3380] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=249 [ 139.279986][ T3380] usb 7-1: SerialNumber: syz [ 139.281236][ T3380] usb 7-1: config 0 descriptor?? [ 139.286511][ T3380] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 139.286662][ T3380] dvb-usb: bulk message failed: -22 (3/0) [ 139.297414][ T7304] gretap0: entered promiscuous mode [ 139.302315][ T3380] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 139.302788][ T3380] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 139.303171][ T3380] usb 7-1: media controller created [ 139.304194][ T3380] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 139.318569][ T7304] erspan0: entered promiscuous mode [ 139.319383][ T3380] dvb-usb: bulk message failed: -22 (6/0) [ 139.319434][ T3380] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 139.320064][ T7304] ip_vti0: entered promiscuous mode [ 139.321770][ T3380] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb7/7-1/input/input5 [ 139.326534][ T3380] dvb-usb: schedule remote query interval to 150 msecs. [ 139.326544][ T3380] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 139.326623][ T7304] ip6_vti0: entered promiscuous mode [ 139.332603][ T7304] sit0: entered promiscuous mode [ 139.335757][ T7304] ip6tnl0: entered promiscuous mode [ 139.343430][ T7304] ip6gre0: entered promiscuous mode [ 139.348588][ T7304] syz_tun: entered promiscuous mode [ 139.355519][ T7304] ip6gretap0: entered promiscuous mode [ 139.359764][ T7304] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.360122][ T7304] bridge0: port 1(bridge_slave_0) entered disabled state [ 139.361001][ T7304] bridge0: entered promiscuous mode [ 139.362355][ T7304] vcan0: entered promiscuous mode [ 139.374174][ T7304] bond0: entered promiscuous mode [ 139.374186][ T7304] bond_slave_0: entered promiscuous mode [ 139.374336][ T7304] bond_slave_1: entered promiscuous mode [ 139.376729][ T7304] team0: entered promiscuous mode [ 139.376740][ T7304] team_slave_0: entered promiscuous mode [ 139.376831][ T7304] team_slave_1: entered promiscuous mode [ 139.380548][ T7304] dummy0: entered promiscuous mode [ 139.398411][ T7304] nlmon0: entered promiscuous mode [ 139.399979][ T7304] batadv0: entered promiscuous mode [ 139.402346][ T7304] vxcan0: entered promiscuous mode [ 139.403088][ T7304] vxcan1: entered promiscuous mode [ 139.403848][ T7304] veth0: entered promiscuous mode [ 139.408600][ T7304] veth1: entered promiscuous mode [ 139.413719][ T7304] wg0: entered promiscuous mode [ 139.422121][ T7304] wg1: entered promiscuous mode [ 139.423789][ T7304] wg2: entered promiscuous mode [ 139.426261][ T7304] veth0_to_bridge: entered promiscuous mode [ 139.430428][ T7304] veth1_to_bridge: entered promiscuous mode [ 139.434316][ T7304] veth0_to_bond: entered promiscuous mode [ 139.436941][ T7304] veth1_to_bond: entered promiscuous mode [ 139.438876][ T7304] veth0_to_team: entered promiscuous mode [ 139.441199][ T7304] veth1_to_team: entered promiscuous mode [ 139.444887][ T7304] veth0_to_batadv: entered promiscuous mode [ 139.446077][ T7304] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 139.446101][ T7304] batadv_slave_0: entered promiscuous mode [ 139.447494][ T7304] veth1_to_batadv: entered promiscuous mode [ 139.448783][ T7304] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 139.448806][ T7304] batadv_slave_1: entered promiscuous mode [ 139.449940][ T7304] xfrm0: entered promiscuous mode [ 139.451785][ T7304] veth0_to_hsr: entered promiscuous mode [ 139.453655][ T7304] veth1_to_hsr: entered promiscuous mode [ 139.455825][ T7304] hsr0: entered promiscuous mode [ 139.459808][ T7304] veth1_virt_wifi: entered promiscuous mode [ 139.461169][ T7304] veth0_virt_wifi: entered promiscuous mode [ 139.463167][ T7304] virt_wifi0: entered promiscuous mode [ 139.465784][ T7304] vlan0: entered promiscuous mode [ 139.467243][ T7304] vlan1: entered promiscuous mode [ 139.471572][ T7304] macvlan0: entered promiscuous mode [ 139.473374][ T7304] macvlan1: entered promiscuous mode [ 139.475485][ T7304] ipvlan0: entered promiscuous mode [ 139.475557][ T7304] ipvlan1: entered promiscuous mode [ 139.479353][ T3380] dvb-usb: bulk message failed: -22 (1/0) [ 139.479374][ T3380] dvb-usb: error while querying for an remote control event. [ 139.486807][ T7304] macvtap0: entered promiscuous mode [ 139.489940][ T7304] macsec0: entered promiscuous mode [ 139.491844][ T7304] geneve0: entered promiscuous mode [ 139.494275][ T7304] geneve1: entered promiscuous mode [ 139.501745][ T7304] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 139.521553][ T7304] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 139.524275][ T7304] netdevsim netdevsim3 netdevsim2: entered promiscuous mode [ 139.526400][ T7304] netdevsim netdevsim3 netdevsim3: entered promiscuous mode [ 139.542761][ T7304] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 139.558862][ T7304] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 139.560102][ T7304] ip6gre1: entered promiscuous mode [ 139.567666][ T5820] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.567704][ T5820] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.567734][ T5820] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.567761][ T5820] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.637694][ T3380] dvb-usb: bulk message failed: -22 (1/0) [ 139.637723][ T3380] dvb-usb: error while querying for an remote control event. [ 139.797851][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 139.797880][ T25] dvb-usb: error while querying for an remote control event. [ 139.959425][ T3380] dvb-usb: bulk message failed: -22 (1/0) [ 139.959445][ T3380] dvb-usb: error while querying for an remote control event. [ 140.117659][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 140.117679][ T25] dvb-usb: error while querying for an remote control event. [ 140.288333][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 140.288353][ T25] dvb-usb: error while querying for an remote control event. [ 140.447668][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 140.447699][ T25] dvb-usb: error while querying for an remote control event. [ 140.617713][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 140.617761][ T25] dvb-usb: error while querying for an remote control event. [ 140.777686][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 140.777716][ T25] dvb-usb: error while querying for an remote control event. [ 140.937605][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 140.937624][ T25] dvb-usb: error while querying for an remote control event. [ 141.097615][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 141.097634][ T25] dvb-usb: error while querying for an remote control event. [ 141.257712][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 141.257754][ T25] dvb-usb: error while querying for an remote control event. [ 141.418953][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 141.418983][ T25] dvb-usb: error while querying for an remote control event. [ 141.577736][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 141.577766][ T25] dvb-usb: error while querying for an remote control event. [ 141.737664][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 141.737695][ T25] dvb-usb: error while querying for an remote control event. [ 141.898080][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 141.898109][ T25] dvb-usb: error while querying for an remote control event. [ 141.918006][ T9] usb 7-1: USB disconnect, device number 10 [ 142.020549][ T9] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 142.121016][ T7314] netlink: 56 bytes leftover after parsing attributes in process `syz.2.515'. [ 142.194606][ T7320] netlink: 12 bytes leftover after parsing attributes in process `syz.0.517'. [ 142.195486][ T7320] syzkaller0: entered promiscuous mode [ 142.195500][ T7320] syzkaller0: entered allmulticast mode [ 142.904286][ T7348] netlink: 4 bytes leftover after parsing attributes in process `syz.3.528'. [ 143.410716][ T5103] Bluetooth: hci1: Malformed LE Event: 0x0b [ 144.016815][ T7380] netlink: 4 bytes leftover after parsing attributes in process `syz.1.541'. [ 144.881954][ T7434] FAULT_INJECTION: forcing a failure. [ 144.881954][ T7434] name fail_futex, interval 1, probability 0, space 0, times 1 [ 144.881975][ T7434] CPU: 1 UID: 0 PID: 7434 Comm: syz.0.567 Tainted: G L syzkaller #0 PREEMPT(full) [ 144.881989][ T7434] Tainted: [L]=SOFTLOCKUP [ 144.881993][ T7434] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 144.881999][ T7434] Call Trace: [ 144.882003][ T7434] [ 144.882008][ T7434] dump_stack_lvl+0x100/0x190 [ 144.882028][ T7434] should_fail_ex.cold+0x5/0xa [ 144.882040][ T7434] ? do_getname+0x2ec/0x390 [ 144.882057][ T7434] get_futex_key+0x1d0/0x14f0 [ 144.882076][ T7434] ? __pfx_get_futex_key+0x10/0x10 [ 144.882091][ T7434] ? do_getname+0x2ec/0x390 [ 144.882105][ T7434] ? kasan_save_stack+0x3f/0x50 [ 144.882117][ T7434] ? kasan_save_stack+0x30/0x50 [ 144.882129][ T7434] ? kasan_save_track+0x14/0x30 [ 144.882141][ T7434] ? kasan_save_free_info+0x3b/0x70 [ 144.882156][ T7434] ? __kasan_slab_free+0x5f/0x80 [ 144.882168][ T7434] ? kmem_cache_free+0x127/0x6c0 [ 144.882184][ T7434] ? do_getname+0x2ec/0x390 [ 144.882198][ T7434] ? __ia32_sys_symlink+0x65/0xb0 [ 144.882213][ T7434] futex_wake+0xf4/0x5e0 [ 144.882227][ T7434] ? __pfx_futex_wake+0x10/0x10 [ 144.882245][ T7434] do_futex+0x2b2/0x440 [ 144.882255][ T7434] ? __pfx_do_futex+0x10/0x10 [ 144.882269][ T7434] __ia32_sys_futex_time32+0x2f4/0x470 [ 144.882283][ T7434] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 144.882300][ T7434] __do_fast_syscall_32+0x13a/0x8b0 [ 144.882317][ T7434] ? lockdep_hardirqs_on+0x7d/0x110 [ 144.882333][ T7434] do_fast_syscall_32+0x32/0x70 [ 144.882349][ T7434] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 144.882363][ T7434] RIP: 0023:0xf7fb7fec [ 144.882374][ T7434] Code: Unable to access opcode bytes at 0xf7fb7fc2. [ 144.882379][ T7434] RSP: 002b:00000000f54765cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 144.882390][ T7434] RAX: ffffffffffffffda RBX: 00000000f7474f8c RCX: 0000000000000081 [ 144.882397][ T7434] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 144.882404][ T7434] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 144.882410][ T7434] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 144.882417][ T7434] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 144.882431][ T7434] [ 144.896787][ T7432] netlink: 4 bytes leftover after parsing attributes in process `syz.1.566'. [ 145.678892][ T7459] FAULT_INJECTION: forcing a failure. [ 145.678892][ T7459] name fail_futex, interval 1, probability 0, space 0, times 0 [ 145.678914][ T7459] CPU: 0 UID: 0 PID: 7459 Comm: syz.0.577 Tainted: G L syzkaller #0 PREEMPT(full) [ 145.678930][ T7459] Tainted: [L]=SOFTLOCKUP [ 145.678934][ T7459] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 145.678940][ T7459] Call Trace: [ 145.678945][ T7459] [ 145.678950][ T7459] dump_stack_lvl+0x100/0x190 [ 145.678968][ T7459] should_fail_ex.cold+0x5/0xa [ 145.678981][ T7459] ? do_getname+0x2ec/0x390 [ 145.678998][ T7459] get_futex_key+0x1d0/0x14f0 [ 145.679018][ T7459] ? __pfx_get_futex_key+0x10/0x10 [ 145.679034][ T7459] ? do_getname+0x2ec/0x390 [ 145.679048][ T7459] ? kasan_save_stack+0x3f/0x50 [ 145.679060][ T7459] ? kasan_save_stack+0x30/0x50 [ 145.679072][ T7459] ? kasan_save_track+0x14/0x30 [ 145.679083][ T7459] ? kasan_save_free_info+0x3b/0x70 [ 145.679126][ T7459] ? __kasan_slab_free+0x5f/0x80 [ 145.679140][ T7459] ? kmem_cache_free+0x127/0x6c0 [ 145.679157][ T7459] ? do_getname+0x2ec/0x390 [ 145.679171][ T7459] ? __ia32_sys_symlink+0x65/0xb0 [ 145.679188][ T7459] futex_wake+0xf4/0x5e0 [ 145.679203][ T7459] ? __pfx_futex_wake+0x10/0x10 [ 145.679223][ T7459] do_futex+0x2b2/0x440 [ 145.679234][ T7459] ? __pfx_do_futex+0x10/0x10 [ 145.679249][ T7459] __ia32_sys_futex_time32+0x2f4/0x470 [ 145.679263][ T7459] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 145.679280][ T7459] __do_fast_syscall_32+0x13a/0x8b0 [ 145.679297][ T7459] ? lockdep_hardirqs_on+0x7d/0x110 [ 145.679313][ T7459] do_fast_syscall_32+0x32/0x70 [ 145.679330][ T7459] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 145.679344][ T7459] RIP: 0023:0xf7fb7fec [ 145.679355][ T7459] Code: Unable to access opcode bytes at 0xf7fb7fc2. [ 145.679361][ T7459] RSP: 002b:00000000f54765cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 145.679377][ T7459] RAX: ffffffffffffffda RBX: 00000000f7474f8c RCX: 0000000000000081 [ 145.679383][ T7459] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 145.679389][ T7459] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 145.679395][ T7459] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 145.679401][ T7459] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 145.679415][ T7459] [ 146.639585][ T7485] netlink: 'syz.0.587': attribute type 12 has an invalid length. [ 153.187154][ T7509] FAULT_INJECTION: forcing a failure. [ 153.187154][ T7509] name failslab, interval 1, probability 0, space 0, times 0 [ 153.187186][ T7509] CPU: 3 UID: 0 PID: 7509 Comm: syz.3.598 Tainted: G L syzkaller #0 PREEMPT(full) [ 153.187209][ T7509] Tainted: [L]=SOFTLOCKUP [ 153.187214][ T7509] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 153.187223][ T7509] Call Trace: [ 153.187229][ T7509] [ 153.187236][ T7509] dump_stack_lvl+0x100/0x190 [ 153.187289][ T7509] should_fail_ex.cold+0x5/0xa [ 153.187316][ T7509] should_failslab+0xc2/0x120 [ 153.187340][ T7509] kmem_cache_alloc_noprof+0x92/0x6a0 [ 153.187362][ T7509] ? do_getname+0x35/0x390 [ 153.187391][ T7509] do_getname+0x35/0x390 [ 153.187418][ T7509] __ia32_sys_symlink+0x65/0xb0 [ 153.187442][ T7509] __do_fast_syscall_32+0x13a/0x8b0 [ 153.187470][ T7509] ? lockdep_hardirqs_on+0x7d/0x110 [ 153.187496][ T7509] do_fast_syscall_32+0x32/0x70 [ 153.187522][ T7509] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 153.187545][ T7509] RIP: 0023:0xf7f52fec [ 153.187565][ T7509] Code: Unable to access opcode bytes at 0xf7f52fc2. [ 153.187572][ T7509] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 153.187590][ T7509] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 153.187602][ T7509] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 153.187613][ T7509] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 153.187623][ T7509] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 153.187633][ T7509] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 153.187656][ T7509] [ 153.469194][ T2323] kernel read not supported for file /adsp1 (pid: 2323 comm: kworker/0:2) [ 154.969674][ T7538] ubi0: attaching mtd0 [ 155.040978][ T7538] ubi0: scanning is finished [ 155.040997][ T7538] ubi0: empty MTD device detected [ 155.242185][ T7538] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 155.242270][ T7538] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 155.242287][ T7538] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 155.242408][ T7538] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 155.242484][ T7538] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 155.242558][ T7538] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 155.242573][ T7538] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 3053706261 [ 155.242590][ T7538] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 155.245014][ T7545] ubi0: background thread "ubi_bgt0d" started, PID 7545 [ 155.337375][ T7548] Illegal XDP return value 4294967294 on prog (id 31) dev syz_tun, expect packet loss! [ 157.651331][ T7616] netlink: 'syz.2.639': attribute type 12 has an invalid length. [ 163.028687][ T7634] netlink: 8 bytes leftover after parsing attributes in process `syz.3.649'. [ 163.907933][ T7651] netlink: 'syz.1.656': attribute type 12 has an invalid length. [ 164.127388][ T7656] netlink: 8 bytes leftover after parsing attributes in process `syz.0.659'. [ 164.142303][ T7659] FAULT_INJECTION: forcing a failure. [ 164.142303][ T7659] name failslab, interval 1, probability 0, space 0, times 0 [ 164.142334][ T7659] CPU: 2 UID: 0 PID: 7659 Comm: syz.2.658 Tainted: G L syzkaller #0 PREEMPT(full) [ 164.142357][ T7659] Tainted: [L]=SOFTLOCKUP [ 164.142363][ T7659] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 164.142373][ T7659] Call Trace: [ 164.142378][ T7659] [ 164.142383][ T7659] dump_stack_lvl+0x100/0x190 [ 164.142410][ T7659] should_fail_ex.cold+0x5/0xa [ 164.142431][ T7659] should_failslab+0xc2/0x120 [ 164.142457][ T7659] kmem_cache_alloc_noprof+0x92/0x6a0 [ 164.142478][ T7659] ? do_getname+0x35/0x390 [ 164.142506][ T7659] do_getname+0x35/0x390 [ 164.142532][ T7659] __ia32_sys_symlink+0x65/0xb0 [ 164.142556][ T7659] __do_fast_syscall_32+0x13a/0x8b0 [ 164.142575][ T7659] ? lockdep_hardirqs_on+0x7d/0x110 [ 164.142592][ T7659] do_fast_syscall_32+0x32/0x70 [ 164.142608][ T7659] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 164.142622][ T7659] RIP: 0023:0xf709efec [ 164.142652][ T7659] Code: Unable to access opcode bytes at 0xf709efc2. [ 164.142659][ T7659] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 164.142670][ T7659] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 164.142678][ T7659] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 164.142685][ T7659] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 164.142691][ T7659] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 164.142698][ T7659] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 164.142712][ T7659] [ 165.223195][ T7684] FAULT_INJECTION: forcing a failure. [ 165.223195][ T7684] name failslab, interval 1, probability 0, space 0, times 0 [ 165.223216][ T7684] CPU: 0 UID: 0 PID: 7684 Comm: syz.0.669 Tainted: G L syzkaller #0 PREEMPT(full) [ 165.223231][ T7684] Tainted: [L]=SOFTLOCKUP [ 165.223235][ T7684] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 165.223241][ T7684] Call Trace: [ 165.223245][ T7684] [ 165.223249][ T7684] dump_stack_lvl+0x100/0x190 [ 165.223268][ T7684] should_fail_ex.cold+0x5/0xa [ 165.223282][ T7684] should_failslab+0xc2/0x120 [ 165.223298][ T7684] kmem_cache_alloc_noprof+0x92/0x6a0 [ 165.223312][ T7684] ? do_getname+0x35/0x390 [ 165.223329][ T7684] do_getname+0x35/0x390 [ 165.223345][ T7684] __ia32_sys_symlink+0x65/0xb0 [ 165.223360][ T7684] __do_fast_syscall_32+0x13a/0x8b0 [ 165.223377][ T7684] ? lockdep_hardirqs_on+0x7d/0x110 [ 165.223393][ T7684] do_fast_syscall_32+0x32/0x70 [ 165.223410][ T7684] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 165.223424][ T7684] RIP: 0023:0xf7fb7fec [ 165.223436][ T7684] Code: Unable to access opcode bytes at 0xf7fb7fc2. [ 165.223441][ T7684] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 165.223452][ T7684] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 165.223459][ T7684] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 165.223466][ T7684] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 165.223473][ T7684] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 165.223481][ T7684] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 165.223494][ T7684] [ 165.985527][ T7717] Set syz0 is full, maxelem 0 reached [ 166.109149][ T7728] FAULT_INJECTION: forcing a failure. [ 166.109149][ T7728] name failslab, interval 1, probability 0, space 0, times 0 [ 166.109170][ T7728] CPU: 3 UID: 0 PID: 7728 Comm: syz.2.685 Tainted: G L syzkaller #0 PREEMPT(full) [ 166.109185][ T7728] Tainted: [L]=SOFTLOCKUP [ 166.109189][ T7728] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 166.109195][ T7728] Call Trace: [ 166.109199][ T7728] [ 166.109203][ T7728] dump_stack_lvl+0x100/0x190 [ 166.109222][ T7728] should_fail_ex.cold+0x5/0xa [ 166.109241][ T7728] should_failslab+0xc2/0x120 [ 166.109257][ T7728] kmem_cache_alloc_noprof+0x92/0x6a0 [ 166.109271][ T7728] ? do_getname+0x35/0x390 [ 166.109290][ T7728] do_getname+0x35/0x390 [ 166.109306][ T7728] __ia32_sys_symlink+0x65/0xb0 [ 166.109323][ T7728] __do_fast_syscall_32+0x13a/0x8b0 [ 166.109339][ T7728] ? lockdep_hardirqs_on+0x7d/0x110 [ 166.109356][ T7728] do_fast_syscall_32+0x32/0x70 [ 166.109372][ T7728] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 166.109386][ T7728] RIP: 0023:0xf709efec [ 166.109398][ T7728] Code: Unable to access opcode bytes at 0xf709efc2. [ 166.109403][ T7728] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 166.109413][ T7728] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 166.109420][ T7728] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 166.109426][ T7728] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 166.109431][ T7728] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 166.109437][ T7728] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 166.109450][ T7728] [ 166.653491][ T7740] netlink: 32 bytes leftover after parsing attributes in process `syz.2.690'. [ 166.897498][ T7753] FAULT_INJECTION: forcing a failure. [ 166.897498][ T7753] name failslab, interval 1, probability 0, space 0, times 0 [ 166.898596][ T7753] CPU: 0 UID: 0 PID: 7753 Comm: syz.0.697 Tainted: G L syzkaller #0 PREEMPT(full) [ 166.898625][ T7753] Tainted: [L]=SOFTLOCKUP [ 166.898632][ T7753] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 166.898643][ T7753] Call Trace: [ 166.898651][ T7753] [ 166.898659][ T7753] dump_stack_lvl+0x100/0x190 [ 166.898690][ T7753] should_fail_ex.cold+0x5/0xa [ 166.898715][ T7753] should_failslab+0xc2/0x120 [ 166.898740][ T7753] kmem_cache_alloc_noprof+0x92/0x6a0 [ 166.898761][ T7753] ? do_getname+0x35/0x390 [ 166.898791][ T7753] do_getname+0x35/0x390 [ 166.898820][ T7753] __ia32_sys_symlink+0x65/0xb0 [ 166.898844][ T7753] __do_fast_syscall_32+0x13a/0x8b0 [ 166.898891][ T7753] ? lockdep_hardirqs_on+0x7d/0x110 [ 166.898922][ T7753] do_fast_syscall_32+0x32/0x70 [ 166.898953][ T7753] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 166.898979][ T7753] RIP: 0023:0xf7fb7fec [ 166.899023][ T7753] Code: Unable to access opcode bytes at 0xf7fb7fc2. [ 166.899033][ T7753] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 166.899061][ T7753] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 166.899073][ T7753] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 166.899084][ T7753] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 166.899095][ T7753] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 166.899107][ T7753] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 166.899132][ T7753] [ 167.209240][ T7770] netlink: 'syz.0.705': attribute type 1 has an invalid length. [ 167.276158][ T7770] 8021q: adding VLAN 0 to HW filter on device bond1 [ 167.425760][ T7776] bond1: (slave geneve2): making interface the new active one [ 167.443281][ T7776] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 167.458198][ T5820] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 167.458735][ T12] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 167.458771][ T12] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 167.458802][ T12] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 167.878177][ T9] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 168.038475][ T9] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 168.039552][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.107789][ T3380] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 168.257779][ T3380] usb 7-1: Using ep0 maxpacket: 8 [ 168.258070][ T9] cdc_acm 5-1:1.0: ttyACM0: USB ACM device [ 168.258344][ T3380] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 168.259606][ T3380] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 168.259626][ T3380] usb 7-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 168.259655][ T3380] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 168.259678][ T3380] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 168.259696][ T3380] usb 7-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 168.259726][ T3380] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.266729][ T3380] usbtmc 7-1:16.0: bulk endpoints not found [ 168.701364][ T7825] FAULT_INJECTION: forcing a failure. [ 168.701364][ T7825] name failslab, interval 1, probability 0, space 0, times 0 [ 168.701385][ T7825] CPU: 2 UID: 0 PID: 7825 Comm: syz.3.728 Tainted: G L syzkaller #0 PREEMPT(full) [ 168.701400][ T7825] Tainted: [L]=SOFTLOCKUP [ 168.701404][ T7825] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 168.701410][ T7825] Call Trace: [ 168.701413][ T7825] [ 168.701418][ T7825] dump_stack_lvl+0x100/0x190 [ 168.701436][ T7825] should_fail_ex.cold+0x5/0xa [ 168.701450][ T7825] should_failslab+0xc2/0x120 [ 168.701466][ T7825] kmem_cache_alloc_noprof+0x92/0x6a0 [ 168.701480][ T7825] ? do_getname+0x35/0x390 [ 168.701497][ T7825] do_getname+0x35/0x390 [ 168.701513][ T7825] __ia32_sys_symlink+0x65/0xb0 [ 168.701528][ T7825] __do_fast_syscall_32+0x13a/0x8b0 [ 168.701545][ T7825] ? lockdep_hardirqs_on+0x7d/0x110 [ 168.701561][ T7825] do_fast_syscall_32+0x32/0x70 [ 168.701578][ T7825] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 168.701602][ T7825] RIP: 0023:0xf7f52fec [ 168.701615][ T7825] Code: Unable to access opcode bytes at 0xf7f52fc2. [ 168.701620][ T7825] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 168.701633][ T7825] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 168.701641][ T7825] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 168.701648][ T7825] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 168.701655][ T7825] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 168.701662][ T7825] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 168.701676][ T7825] [ 169.840569][ T7842] Set syz0 is full, maxelem 0 reached [ 170.420507][ T5748] Bluetooth: hci0: command 0x0406 tx timeout [ 170.420812][ T5748] Bluetooth: hci3: command 0x0406 tx timeout [ 170.420922][ T5743] Bluetooth: hci1: command 0x0406 tx timeout [ 170.431211][ T5755] Bluetooth: hci2: command 0x0406 tx timeout [ 170.878322][ T5847] usb 7-1: USB disconnect, device number 11 [ 171.293317][ T7882] FAULT_INJECTION: forcing a failure. [ 171.293317][ T7882] name failslab, interval 1, probability 0, space 0, times 0 [ 171.293339][ T7882] CPU: 0 UID: 0 PID: 7882 Comm: syz.3.754 Tainted: G L syzkaller #0 PREEMPT(full) [ 171.293355][ T7882] Tainted: [L]=SOFTLOCKUP [ 171.293359][ T7882] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 171.293365][ T7882] Call Trace: [ 171.293368][ T7882] [ 171.293372][ T7882] dump_stack_lvl+0x100/0x190 [ 171.293392][ T7882] should_fail_ex.cold+0x5/0xa [ 171.293407][ T7882] should_failslab+0xc2/0x120 [ 171.293422][ T7882] kmem_cache_alloc_noprof+0x92/0x6a0 [ 171.293436][ T7882] ? do_getname+0x35/0x390 [ 171.293453][ T7882] do_getname+0x35/0x390 [ 171.293469][ T7882] __ia32_sys_symlink+0x65/0xb0 [ 171.293483][ T7882] __do_fast_syscall_32+0x13a/0x8b0 [ 171.293500][ T7882] ? lockdep_hardirqs_on+0x7d/0x110 [ 171.293516][ T7882] do_fast_syscall_32+0x32/0x70 [ 171.293543][ T7882] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 171.293558][ T7882] RIP: 0023:0xf7f52fec [ 171.293570][ T7882] Code: Unable to access opcode bytes at 0xf7f52fc2. [ 171.293575][ T7882] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 171.293587][ T7882] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 171.293594][ T7882] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 171.293601][ T7882] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 171.293608][ T7882] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 171.293616][ T7882] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 171.293629][ T7882] [ 171.524389][ T7893] netlink: 'syz.2.757': attribute type 12 has an invalid length. [ 171.633300][ T7900] comedi comedi3: pcl818: I/O base address not correctly aligned [ 173.405135][ T7930] comedi comedi3: pcl818: I/O base address not correctly aligned [ 173.791673][ T1036] usb 5-1: USB disconnect, device number 3 [ 175.210538][ T7948] FAULT_INJECTION: forcing a failure. [ 175.210538][ T7948] name failslab, interval 1, probability 0, space 0, times 0 [ 175.210571][ T7948] CPU: 3 UID: 0 PID: 7948 Comm: syz.0.783 Tainted: G L syzkaller #0 PREEMPT(full) [ 175.210596][ T7948] Tainted: [L]=SOFTLOCKUP [ 175.210602][ T7948] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 175.210612][ T7948] Call Trace: [ 175.210618][ T7948] [ 175.210625][ T7948] dump_stack_lvl+0x100/0x190 [ 175.210654][ T7948] should_fail_ex.cold+0x5/0xa [ 175.210679][ T7948] should_failslab+0xc2/0x120 [ 175.210704][ T7948] kmem_cache_alloc_noprof+0x92/0x6a0 [ 175.210726][ T7948] ? do_getname+0x35/0x390 [ 175.210756][ T7948] do_getname+0x35/0x390 [ 175.210781][ T7948] __ia32_sys_symlink+0x65/0xb0 [ 175.210806][ T7948] __do_fast_syscall_32+0x13a/0x8b0 [ 175.210833][ T7948] ? lockdep_hardirqs_on+0x7d/0x110 [ 175.210862][ T7948] do_fast_syscall_32+0x32/0x70 [ 175.210890][ T7948] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 175.210912][ T7948] RIP: 0023:0xf7fb7fec [ 175.210932][ T7948] Code: Unable to access opcode bytes at 0xf7fb7fc2. [ 175.210940][ T7948] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 175.210981][ T7948] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 175.210995][ T7948] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 175.211007][ T7948] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 175.211018][ T7948] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 175.211031][ T7948] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 175.211056][ T7948] [ 176.757080][ T65] Bluetooth: hci1: Malformed LE Event: 0x0b [ 177.801485][ T7983] netlink: 4 bytes leftover after parsing attributes in process `syz.1.794'. [ 177.826539][ T7983] macvtap1: entered promiscuous mode [ 177.826554][ T7983] dummy0: entered promiscuous mode [ 177.827185][ T7983] macvtap1: entered allmulticast mode [ 177.827196][ T7983] dummy0: entered allmulticast mode [ 177.855323][ T7983] netlink: 4 bytes leftover after parsing attributes in process `syz.1.794'. [ 177.862908][ T7983] dummy0: left allmulticast mode [ 177.865473][ T7983] macvtap1: left promiscuous mode [ 177.865491][ T7983] macvtap1: left allmulticast mode [ 177.866075][ T2323] dummy0: left promiscuous mode [ 178.077775][ T9] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 178.247723][ T9] usb 7-1: Using ep0 maxpacket: 8 [ 178.248884][ T9] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 178.251694][ T9] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 178.251730][ T9] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 178.251747][ T9] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 178.251765][ T9] usb 7-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 178.251779][ T9] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 178.251804][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.258050][ T9] usbtmc 7-1:16.0: bulk endpoints not found [ 179.299219][ T8014] batadv_slave_0: entered promiscuous mode [ 179.303566][ T8014] batadv_slave_0: left promiscuous mode [ 180.147437][ T65] Bluetooth: hci2: unexpected event for opcode 0x0c20 [ 180.820829][ T5847] usb 7-1: USB disconnect, device number 12 [ 180.882910][ T43] audit: type=1326 audit(1789010309.856:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8066 comm="syz.0.828" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fb7fec code=0x50000 [ 180.882961][ T43] audit: type=1326 audit(1789010309.856:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8066 comm="syz.0.828" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fb8017 code=0x50000 [ 180.974029][ T8071] FAULT_INJECTION: forcing a failure. [ 180.974029][ T8071] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 180.974052][ T8071] CPU: 2 UID: 0 PID: 8071 Comm: syz.2.830 Tainted: G L syzkaller #0 PREEMPT(full) [ 180.974067][ T8071] Tainted: [L]=SOFTLOCKUP [ 180.974071][ T8071] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 180.974077][ T8071] Call Trace: [ 180.974081][ T8071] [ 180.974085][ T8071] dump_stack_lvl+0x100/0x190 [ 180.974103][ T8071] should_fail_ex.cold+0x5/0xa [ 180.974118][ T8071] strncpy_from_user+0x3b/0x2d0 [ 180.974135][ T8071] do_getname+0x78/0x390 [ 180.974153][ T8071] __ia32_sys_symlink+0x65/0xb0 [ 180.974167][ T8071] __do_fast_syscall_32+0x13a/0x8b0 [ 180.974184][ T8071] ? lockdep_hardirqs_on+0x7d/0x110 [ 180.974201][ T8071] do_fast_syscall_32+0x32/0x70 [ 180.974218][ T8071] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 180.974231][ T8071] RIP: 0023:0xf709efec [ 180.974244][ T8071] Code: Unable to access opcode bytes at 0xf709efc2. [ 180.974249][ T8071] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 180.974260][ T8071] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 180.974267][ T8071] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 180.974293][ T8071] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 180.974300][ T8071] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 180.974307][ T8071] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 180.974321][ T8071] [ 181.157627][ T1036] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 181.317697][ T1036] usb 8-1: Using ep0 maxpacket: 32 [ 181.322350][ T1036] usb 8-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 181.323435][ T1036] usb 8-1: config 0 has an invalid interface number: 184 but max is 0 [ 181.323453][ T1036] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 181.323470][ T1036] usb 8-1: config 0 has no interface number 0 [ 181.323496][ T1036] usb 8-1: config 0 interface 184 altsetting 7 endpoint 0x6 has invalid wMaxPacketSize 0 [ 181.323513][ T1036] usb 8-1: config 0 interface 184 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 181.323532][ T1036] usb 8-1: config 0 interface 184 has no altsetting 0 [ 181.325216][ T1036] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.325227][ T1036] usb 8-1: Product: syz [ 181.325234][ T1036] usb 8-1: Manufacturer: syz [ 181.325241][ T1036] usb 8-1: SerialNumber: syz [ 181.330332][ T1036] usb 8-1: config 0 descriptor?? [ 181.342494][ T1036] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 181.342856][ T1036] smsc75xx 8-1:0.184: probe with driver smsc75xx failed with error -22 [ 181.533770][ T1036] usb 8-1: USB disconnect, device number 3 [ 181.977682][ T1036] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 182.137707][ T1036] usb 8-1: Using ep0 maxpacket: 16 [ 182.139505][ T1036] usb 8-1: New USB device found, idVendor=0a12, idProduct=5d10, bcdDevice=69.ee [ 182.142465][ T1036] usb 8-1: config 0 has an invalid interface number: 184 but max is 0 [ 182.142562][ T1036] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 182.142572][ T1036] usb 8-1: config 0 has no interface number 0 [ 182.142590][ T1036] usb 8-1: config 0 interface 184 altsetting 7 endpoint 0x6 has invalid wMaxPacketSize 0 [ 182.142601][ T1036] usb 8-1: config 0 interface 184 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 182.142613][ T1036] usb 8-1: config 0 interface 184 has no altsetting 0 [ 182.144801][ T1036] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.144813][ T1036] usb 8-1: Product: syz [ 182.144820][ T1036] usb 8-1: Manufacturer: syz [ 182.144827][ T1036] usb 8-1: SerialNumber: syz [ 182.147622][ T1036] usb 8-1: config 0 descriptor?? [ 182.277889][ T1036] ushc 8-1:0.184: probe with driver ushc failed with error -110 [ 182.312287][ T8087] kAFS: No cell specified [ 182.706023][ T8116] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 182.706228][ T8116] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 183.582048][ T8127] netlink: 32 bytes leftover after parsing attributes in process `syz.0.851'. [ 183.738439][ T3380] usb 8-1: USB disconnect, device number 4 [ 183.752466][ T8133] netlink: 8 bytes leftover after parsing attributes in process `syz.0.855'. [ 183.901048][ T8146] FAULT_INJECTION: forcing a failure. [ 183.901048][ T8146] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 183.901075][ T8146] CPU: 0 UID: 0 PID: 8146 Comm: syz.3.860 Tainted: G L syzkaller #0 PREEMPT(full) [ 183.901090][ T8146] Tainted: [L]=SOFTLOCKUP [ 183.901094][ T8146] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 183.901100][ T8146] Call Trace: [ 183.901104][ T8146] [ 183.901109][ T8146] dump_stack_lvl+0x100/0x190 [ 183.901127][ T8146] should_fail_ex.cold+0x5/0xa [ 183.901141][ T8146] strncpy_from_user+0x3b/0x2d0 [ 183.901169][ T8146] do_getname+0x271/0x390 [ 183.901188][ T8146] __ia32_sys_symlink+0x56/0xb0 [ 183.901204][ T8146] __do_fast_syscall_32+0x13a/0x8b0 [ 183.901221][ T8146] ? lockdep_hardirqs_on+0x7d/0x110 [ 183.901239][ T8146] do_fast_syscall_32+0x32/0x70 [ 183.901256][ T8146] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 183.901269][ T8146] RIP: 0023:0xf7f52fec [ 183.901283][ T8146] Code: Unable to access opcode bytes at 0xf7f52fc2. [ 183.901288][ T8146] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 183.901300][ T8146] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 183.901307][ T8146] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 183.901314][ T8146] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 183.901320][ T8146] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 183.901326][ T8146] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 183.901339][ T8146] [ 184.097929][ T65] Bluetooth: hci0: SCO packet for unknown connection handle 0 [ 184.288794][ T8159] netlink: 'syz.3.867': attribute type 10 has an invalid length. [ 184.288827][ T8159] dummy0: left promiscuous mode [ 184.321681][ T8159] dummy0: entered promiscuous mode [ 184.324444][ T8159] team0: Port device dummy0 added [ 184.408550][ T8166] netlink: 8 bytes leftover after parsing attributes in process `syz.1.870'. [ 184.485137][ T8168] FAULT_INJECTION: forcing a failure. [ 184.485137][ T8168] name failslab, interval 1, probability 0, space 0, times 0 [ 184.485174][ T8168] CPU: 1 UID: 0 PID: 8168 Comm: syz.2.871 Tainted: G L syzkaller #0 PREEMPT(full) [ 184.485199][ T8168] Tainted: [L]=SOFTLOCKUP [ 184.485205][ T8168] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 184.485215][ T8168] Call Trace: [ 184.485221][ T8168] [ 184.485228][ T8168] dump_stack_lvl+0x100/0x190 [ 184.485256][ T8168] should_fail_ex.cold+0x5/0xa [ 184.485280][ T8168] should_failslab+0xc2/0x120 [ 184.485303][ T8168] kmem_cache_alloc_noprof+0x92/0x6a0 [ 184.485323][ T8168] ? do_getname+0x35/0x390 [ 184.485351][ T8168] do_getname+0x35/0x390 [ 184.485379][ T8168] __ia32_sys_symlink+0x65/0xb0 [ 184.485401][ T8168] __do_fast_syscall_32+0x13a/0x8b0 [ 184.485428][ T8168] ? lockdep_hardirqs_on+0x7d/0x110 [ 184.485452][ T8168] do_fast_syscall_32+0x32/0x70 [ 184.485510][ T8168] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 184.485534][ T8168] RIP: 0023:0xf709efec [ 184.485556][ T8168] Code: Unable to access opcode bytes at 0xf709efc2. [ 184.485564][ T8168] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 184.485591][ T8168] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 184.485604][ T8168] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 184.485613][ T8168] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 184.485622][ T8168] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 184.485631][ T8168] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 184.485653][ T8168] [ 184.642038][ T8170] fuse: fd is not a fuse device [ 185.131349][ T65] Bluetooth: hci2: SCO packet for unknown connection handle 0 [ 185.193664][ T43] audit: type=1326 audit(1789010314.166:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8192 comm="syz.3.882" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f52fec code=0x50000 [ 185.194124][ T43] audit: type=1326 audit(1789010314.166:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8192 comm="syz.3.882" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f52fec code=0x50000 [ 185.194164][ T43] audit: type=1326 audit(1789010314.166:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8192 comm="syz.3.882" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f52fec code=0x50000 [ 185.194197][ T43] audit: type=1326 audit(1789010314.166:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8192 comm="syz.3.882" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f52fec code=0x50000 [ 185.194231][ T43] audit: type=1326 audit(1789010314.166:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8192 comm="syz.3.882" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f52fec code=0x50000 [ 185.194264][ T43] audit: type=1326 audit(1789010314.166:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8192 comm="syz.3.882" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f52fec code=0x50000 [ 185.194350][ T43] audit: type=1326 audit(1789010314.166:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8192 comm="syz.3.882" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f52fec code=0x50000 [ 185.194506][ T43] audit: type=1326 audit(1789010314.166:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8192 comm="syz.3.882" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f52fec code=0x50000 [ 185.337725][ T9] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 185.487709][ T9] usb 7-1: Using ep0 maxpacket: 8 [ 185.488652][ T9] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 185.489498][ T9] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 185.489530][ T9] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 185.489541][ T9] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 185.489552][ T9] usb 7-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 185.489562][ T9] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 185.489585][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.494665][ T9] usbtmc 7-1:16.0: bulk endpoints not found [ 186.286044][ T65] Bluetooth: hci2: SCO packet for unknown connection handle 0 [ 186.741465][ T8234] netlink: 4 bytes leftover after parsing attributes in process `syz.3.895'. [ 186.742462][ T8234] netlink: 4 bytes leftover after parsing attributes in process `syz.3.895'. [ 186.789370][ T65] Bluetooth: hci1: SCO packet for unknown connection handle 0 [ 187.205536][ T65] Bluetooth: hci2: SCO packet for unknown connection handle 0 [ 187.219072][ T8263] netlink: 32 bytes leftover after parsing attributes in process `syz.3.912'. [ 187.320675][ T8275] netlink: 8 bytes leftover after parsing attributes in process `syz.1.916'. [ 187.333748][ T8274] syzkaller0: entered promiscuous mode [ 187.333762][ T8274] syzkaller0: entered allmulticast mode [ 187.343213][ T8274] tipc: Started in network mode [ 187.343229][ T8274] tipc: Node identity 1a0d502601d5, cluster identity 4711 [ 187.343485][ T8274] tipc: Enabled bearer , priority 0 [ 187.344748][ T8274] tipc: Resetting bearer [ 187.355765][ T8274] tipc: Disabling bearer [ 187.654783][ T8287] netlink: 'syz.1.922': attribute type 12 has an invalid length. [ 187.978200][ T8294] netlink: 32 bytes leftover after parsing attributes in process `syz.0.924'. [ 188.130711][ T2323] usb 7-1: USB disconnect, device number 13 [ 188.229746][ T8304] FAULT_INJECTION: forcing a failure. [ 188.229746][ T8304] name failslab, interval 1, probability 0, space 0, times 0 [ 188.229780][ T8304] CPU: 1 UID: 0 PID: 8304 Comm: syz.2.928 Tainted: G L syzkaller #0 PREEMPT(full) [ 188.229805][ T8304] Tainted: [L]=SOFTLOCKUP [ 188.229811][ T8304] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 188.229822][ T8304] Call Trace: [ 188.229828][ T8304] [ 188.229835][ T8304] dump_stack_lvl+0x100/0x190 [ 188.229866][ T8304] should_fail_ex.cold+0x5/0xa [ 188.229892][ T8304] should_failslab+0xc2/0x120 [ 188.229917][ T8304] kmem_cache_alloc_noprof+0x92/0x6a0 [ 188.229938][ T8304] ? do_getname+0x35/0x390 [ 188.229971][ T8304] do_getname+0x35/0x390 [ 188.230010][ T8304] __ia32_sys_symlink+0x65/0xb0 [ 188.230038][ T8304] __do_fast_syscall_32+0x13a/0x8b0 [ 188.230066][ T8304] ? lockdep_hardirqs_on+0x7d/0x110 [ 188.230095][ T8304] do_fast_syscall_32+0x32/0x70 [ 188.230124][ T8304] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 188.230148][ T8304] RIP: 0023:0xf709efec [ 188.230170][ T8304] Code: Unable to access opcode bytes at 0xf709efc2. [ 188.230180][ T8304] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 188.230199][ T8304] RAX: ffffffffffffffda RBX: 00000000800006c0 RCX: 0000000000000000 [ 188.230212][ T8304] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 188.230224][ T8304] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 188.230251][ T8304] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 188.230264][ T8304] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 188.230289][ T8304] [ 188.487595][ T9] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 188.640271][ T9] usb 8-1: Using ep0 maxpacket: 32 [ 188.641035][ T9] usb 8-1: New USB device found, idVendor=2304, idProduct=021a, bcdDevice=c7.8c [ 188.644193][ T9] usb 8-1: config 164 has an invalid interface number: 195 but max is 0 [ 188.644214][ T9] usb 8-1: config 164 has no interface number 0 [ 188.644236][ T9] usb 8-1: config 164 interface 195 has no altsetting 0 [ 188.646497][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.646515][ T9] usb 8-1: Product: syz [ 188.646528][ T9] usb 8-1: Manufacturer: syz [ 188.646539][ T9] usb 8-1: SerialNumber: syz [ 193.949023][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.949069][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 196.090539][ T1036] usb 8-1: USB disconnect, device number 5 [ 196.210931][ T8321] netlink: 32 bytes leftover after parsing attributes in process `syz.0.935'. [ 196.354242][ T8331] kAFS: unable to lookup cell '(G|' [ 196.579219][ T1036] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 196.594010][ T8340] Bluetooth: MGMT ver 1.23 [ 196.737711][ T1036] usb 8-1: Using ep0 maxpacket: 8 [ 196.740150][ T1036] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 196.741373][ T1036] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 196.741410][ T1036] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 196.741427][ T1036] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 196.741444][ T1036] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 196.741459][ T1036] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 196.741474][ T1036] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 196.741502][ T1036] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.757256][ T1036] usbtmc 8-1:16.0: probe with driver usbtmc failed with error -22 [ 196.915847][ T8345] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 197.042263][ T8350] netlink: 'syz.0.945': attribute type 1 has an invalid length. [ 197.042295][ T8350] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 197.103650][ T8350] binder: 8349:8350 ioctl 4018620d 0 returned -22 [ 198.253380][ T8373] netlink: 32 bytes leftover after parsing attributes in process `syz.1.951'. [ 198.682614][ T8383] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 199.215013][ T3380] usb 8-1: USB disconnect, device number 6 [ 199.271348][ T8388] netlink: 'syz.3.958': attribute type 1 has an invalid length. [ 199.271369][ T8388] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 199.316832][ T8388] binder: 8387:8388 ioctl 4018620d 0 returned -22 [ 199.408118][ T8395] netlink: 32 bytes leftover after parsing attributes in process `syz.2.961'. [ 199.664520][ T65] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 199.664546][ T65] CPU: 2 UID: 0 PID: 65 Comm: kworker/u34:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 199.664574][ T65] Tainted: [L]=SOFTLOCKUP [ 199.664581][ T65] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 199.664593][ T65] Workqueue: hci1 hci_rx_work [ 199.664623][ T65] Call Trace: [ 199.664629][ T65] [ 199.664636][ T65] dump_stack_lvl+0x100/0x190 [ 199.664666][ T65] sysfs_warn_dup.cold+0x1c/0x28 [ 199.664696][ T65] sysfs_create_dir_ns+0x24b/0x2b0 [ 199.664720][ T65] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 199.664741][ T65] ? find_held_lock+0x2b/0x80 [ 199.664762][ T65] ? kobject_add_internal+0x25f/0x930 [ 199.664783][ T65] ? kobject_add_internal+0x25f/0x930 [ 199.664806][ T65] ? do_raw_spin_unlock+0x145/0x1e0 [ 199.664827][ T65] kobject_add_internal+0x2c8/0x930 [ 199.664852][ T65] kobject_add+0x16a/0x1e0 [ 199.664873][ T65] ? __pfx_kobject_add+0x10/0x10 [ 199.664892][ T65] ? class_to_subsys+0x10f/0x150 [ 199.664925][ T65] ? kobject_put+0xb9/0x640 [ 199.664941][ T65] ? _raw_spin_unlock+0x28/0x50 [ 199.664971][ T65] device_add+0x294/0x1970 [ 199.665007][ T65] ? __pfx_dev_set_name+0x10/0x10 [ 199.665027][ T65] ? __pfx_device_add+0x10/0x10 [ 199.665057][ T65] ? mgmt_send_event_skb+0x2fb/0x460 [ 199.665092][ T65] hci_conn_add_sysfs+0x1a3/0x260 [ 199.665123][ T65] le_conn_complete_evt+0x122f/0x2130 [ 199.665158][ T65] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 199.665183][ T65] ? hci_event_packet+0x186/0xcd0 [ 199.665215][ T65] hci_le_conn_complete_evt+0x23c/0x3a0 [ 199.665241][ T65] ? skb_pull_data+0x15f/0x1e0 [ 199.665263][ T65] hci_le_meta_evt+0x34a/0x5f0 [ 199.665289][ T65] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 199.665316][ T65] hci_event_packet+0x51c/0xcd0 [ 199.665341][ T65] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 199.665367][ T65] ? __pfx_hci_event_packet+0x10/0x10 [ 199.665396][ T65] ? lockdep_hardirqs_on+0x7d/0x110 [ 199.665429][ T65] hci_rx_work+0x451/0xfc0 [ 199.665459][ T65] process_one_work+0xac7/0x1b10 [ 199.665495][ T65] ? __pfx_process_one_work+0x10/0x10 [ 199.665517][ T65] ? lock_acquire+0x1d1/0x380 [ 199.665551][ T65] ? __pfx_hci_rx_work+0x10/0x10 [ 199.665576][ T65] worker_thread+0x5ef/0xe50 [ 199.665609][ T65] ? kthread+0x13a/0x450 [ 199.665627][ T65] ? __pfx_worker_thread+0x10/0x10 [ 199.665648][ T65] kthread+0x373/0x450 [ 199.665667][ T65] ? __pfx_kthread+0x10/0x10 [ 199.665688][ T65] ret_from_fork+0x730/0xd60 [ 199.665719][ T65] ? __pfx_ret_from_fork+0x10/0x10 [ 199.665750][ T65] ? __switch_to+0x800/0x10f0 [ 199.665774][ T65] ? __pfx_kthread+0x10/0x10 [ 199.665796][ T65] ret_from_fork_asm+0x1a/0x30 [ 199.665829][ T65] [ 199.665851][ T65] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 199.665880][ T65] Bluetooth: hci1: failed to register connection device [ 200.017622][ T42] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 200.167593][ T42] usb 5-1: Using ep0 maxpacket: 8 [ 200.168093][ T42] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 200.168879][ T42] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 200.168904][ T42] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 200.168915][ T42] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 200.168926][ T42] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 200.168936][ T42] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 200.168947][ T42] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 200.169044][ T42] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.175273][ T42] usbtmc 5-1:16.0: probe with driver usbtmc failed with error -22 [ 200.285189][ T8415] syzkaller0: entered promiscuous mode [ 200.285210][ T8415] syzkaller0: entered allmulticast mode [ 202.748784][ T3380] usb 5-1: USB disconnect, device number 4 [ 205.702727][ T8435] syzkaller0: entered promiscuous mode [ 205.702740][ T8435] syzkaller0: entered allmulticast mode [ 207.002469][ T8474] netlink: 988 bytes leftover after parsing attributes in process `syz.1.993'. [ 207.374886][ T8482] syzkaller0: entered promiscuous mode [ 207.374905][ T8482] syzkaller0: entered allmulticast mode [ 207.522555][ T8476] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 207.522585][ T8476] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 207.571354][ T8476] udc dummy_udc.1: failed to start USB Gadget filesystem: -12 [ 207.571382][ T8476] gadgetfs gadget.1: probe with driver gadgetfs failed with error -12 [ 207.571674][ T8476] ================================================================== [ 207.571683][ T8476] BUG: KASAN: slab-use-after-free in gadgetfs_bind+0x82e/0x890 [ 207.571704][ T8476] Write of size 8 at addr ffff888049f938c0 by task syz.3.995/8476 [ 207.571717][ T8476] [ 207.571727][ T8476] CPU: 0 UID: 0 PID: 8476 Comm: syz.3.995 Tainted: G L syzkaller #0 PREEMPT(full) [ 207.571750][ T8476] Tainted: [L]=SOFTLOCKUP [ 207.571756][ T8476] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 207.571765][ T8476] Call Trace: [ 207.571771][ T8476] [ 207.571778][ T8476] dump_stack_lvl+0x100/0x190 [ 207.571825][ T8476] print_report+0x13d/0x4b0 [ 207.571849][ T8476] ? __virt_addr_valid+0x239/0x430 [ 207.571874][ T8476] ? gadgetfs_bind+0x82e/0x890 [ 207.571890][ T8476] kasan_report+0xdf/0x1c0 [ 207.571911][ T8476] ? gadgetfs_bind+0x82e/0x890 [ 207.571929][ T8476] gadgetfs_bind+0x82e/0x890 [ 207.571946][ T8476] ? kernfs_create_link+0x1bd/0x240 [ 207.571963][ T8476] gadget_bind_driver+0x28c/0xbf0 [ 207.571983][ T8476] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 207.572001][ T8476] ? __pfx_gadget_bind_driver+0x10/0x10 [ 207.572021][ T8476] really_probe+0x241/0xa60 [ 207.572044][ T8476] __driver_probe_device+0x210/0x460 [ 207.572064][ T8476] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 207.572088][ T8476] driver_probe_device+0x4a/0x140 [ 207.572109][ T8476] __driver_attach+0x21f/0x5b0 [ 207.572130][ T8476] ? __pfx___driver_attach+0x10/0x10 [ 207.572151][ T8476] bus_for_each_dev+0x13e/0x1d0 [ 207.572168][ T8476] ? __pfx_bus_for_each_dev+0x10/0x10 [ 207.572184][ T8476] ? bus_add_driver+0x2b5/0x5b0 [ 207.572205][ T8476] bus_add_driver+0x305/0x5b0 [ 207.572225][ T8476] driver_register+0x1e2/0x360 [ 207.572249][ T8476] usb_gadget_register_driver_owner+0x132/0x210 [ 207.572271][ T8476] dev_config+0xdce/0x1610 [ 207.572287][ T8476] ? ksys_write+0xe0/0x250 [ 207.572304][ T8476] ? __pfx_dev_config+0x10/0x10 [ 207.572324][ T8476] vfs_write+0x2aa/0x1050 [ 207.572341][ T8476] ? __pfx_dev_config+0x10/0x10 [ 207.572357][ T8476] ? lock_acquire+0x1d1/0x380 [ 207.572378][ T8476] ? __fget_files+0x34/0x3d0 [ 207.572399][ T8476] ? __pfx_vfs_write+0x10/0x10 [ 207.572415][ T8476] ? find_held_lock+0x2b/0x80 [ 207.572433][ T8476] ? __fget_files+0x215/0x3d0 [ 207.572452][ T8476] ? __fget_files+0x21f/0x3d0 [ 207.572474][ T8476] ksys_write+0x12a/0x250 [ 207.572491][ T8476] ? __pfx_ksys_write+0x10/0x10 [ 207.572512][ T8476] __do_fast_syscall_32+0x13a/0x8b0 [ 207.572540][ T8476] do_fast_syscall_32+0x32/0x70 [ 207.572573][ T8476] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 207.572595][ T8476] RIP: 0023:0xf7f52fec [ 207.572614][ T8476] Code: Unable to access opcode bytes at 0xf7f52fc2. [ 207.572622][ T8476] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 207.572641][ T8476] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000400 [ 207.572652][ T8476] RDX: 000000000000001f RSI: 0000000000000000 RDI: 0000000000000000 [ 207.572663][ T8476] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 207.572673][ T8476] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 207.572684][ T8476] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 207.572700][ T8476] [ 207.572706][ T8476] [ 207.572710][ T8476] Allocated by task 5741: [ 207.572719][ T8476] kasan_save_stack+0x30/0x50 [ 207.572738][ T8476] kasan_save_track+0x14/0x30 [ 207.572755][ T8476] __kasan_kmalloc+0xaa/0xb0 [ 207.572772][ T8476] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 207.572796][ T8476] gadgetfs_fill_super+0x1da/0x430 [ 207.572811][ T8476] get_tree_single+0xe2/0x190 [ 207.572826][ T8476] vfs_get_tree+0x92/0x320 [ 207.572847][ T8476] path_mount+0x7d0/0x24c0 [ 207.572867][ T8476] __ia32_sys_mount+0x292/0x310 [ 207.572887][ T8476] __do_fast_syscall_32+0x13a/0x8b0 [ 207.572911][ T8476] do_fast_syscall_32+0x32/0x70 [ 207.572933][ T8476] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 207.572952][ T8476] [ 207.572957][ T8476] Freed by task 8476: [ 207.572964][ T8476] kasan_save_stack+0x30/0x50 [ 207.572981][ T8476] kasan_save_track+0x14/0x30 [ 207.572998][ T8476] kasan_save_free_info+0x3b/0x70 [ 207.573021][ T8476] __kasan_slab_free+0x5f/0x80 [ 207.573039][ T8476] kfree+0x22b/0x6d0 [ 207.573061][ T8476] put_dev+0xb4/0xd0 [ 207.573073][ T8476] gadgetfs_bind+0x6bc/0x890 [ 207.573087][ T8476] gadget_bind_driver+0x28c/0xbf0 [ 207.573106][ T8476] really_probe+0x241/0xa60 [ 207.573125][ T8476] __driver_probe_device+0x210/0x460 [ 207.573145][ T8476] driver_probe_device+0x4a/0x140 [ 207.573165][ T8476] __driver_attach+0x21f/0x5b0 [ 207.573183][ T8476] bus_for_each_dev+0x13e/0x1d0 [ 207.573199][ T8476] bus_add_driver+0x305/0x5b0 [ 207.573215][ T8476] driver_register+0x1e2/0x360 [ 207.573237][ T8476] usb_gadget_register_driver_owner+0x132/0x210 [ 207.573257][ T8476] dev_config+0xdce/0x1610 [ 207.573272][ T8476] vfs_write+0x2aa/0x1050 [ 207.573286][ T8476] ksys_write+0x12a/0x250 [ 207.573301][ T8476] __do_fast_syscall_32+0x13a/0x8b0 [ 207.573325][ T8476] do_fast_syscall_32+0x32/0x70 [ 207.573348][ T8476] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 207.573367][ T8476] [ 207.573371][ T8476] The buggy address belongs to the object at ffff888049f93800 [ 207.573371][ T8476] which belongs to the cache kmalloc-1k of size 1024 [ 207.573384][ T8476] The buggy address is located 192 bytes inside of [ 207.573384][ T8476] freed 1024-byte region [ffff888049f93800, ffff888049f93c00) [ 207.573399][ T8476] [ 207.573403][ T8476] The buggy address belongs to the physical page: [ 207.573411][ T8476] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x49f90 [ 207.573427][ T8476] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 207.573440][ T8476] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 207.573456][ T8476] page_type: f5(slab) [ 207.573471][ T8476] raw: 04fff00000000040 ffff88801c042dc0 dead000000000100 dead000000000122 [ 207.573486][ T8476] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 207.573501][ T8476] head: 04fff00000000040 ffff88801c042dc0 dead000000000100 dead000000000122 [ 207.573517][ T8476] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 207.573532][ T8476] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 207.573547][ T8476] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 207.573557][ T8476] page dumped because: kasan: bad access detected [ 207.573572][ T8476] page_owner tracks the page as allocated [ 207.573578][ T8476] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5741, tgid 5741 (syz-executor), ts 49650443486 [ 207.573605][ T8476] post_alloc_hook+0xfd/0x120 [ 207.573630][ T8476] get_page_from_freelist+0x110d/0x35d0 [ 207.573646][ T8476] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 207.573661][ T8476] new_slab+0xa9/0x6e0 [ 207.573674][ T8476] refill_objects+0xe3/0x410 [ 207.573688][ T8476] __pcs_replace_empty_main+0x35e/0x650 [ 207.573711][ T8476] __kmalloc_noprof+0x67c/0x840 [ 207.573727][ T8476] tomoyo_init_log+0x1224/0x20c0 [ 207.573741][ T8476] tomoyo_supervisor+0x506/0x1340 [ 207.573757][ T8476] tomoyo_mount_acl+0x580/0x8b0 [ 207.573778][ T8476] tomoyo_mount_permission+0x214/0x460 [ 207.573802][ T8476] security_sb_mount+0xdd/0x270 [ 207.573821][ T8476] path_mount+0x158/0x24c0 [ 207.573841][ T8476] __ia32_sys_mount+0x292/0x310 [ 207.573862][ T8476] __do_fast_syscall_32+0x13a/0x8b0 [ 207.573885][ T8476] do_fast_syscall_32+0x32/0x70 [ 207.573909][ T8476] page last free pid 165 tgid 165 ts 49241719409 stack trace: [ 207.573920][ T8476] __free_frozen_pages+0x79f/0x10f0 [ 207.573942][ T8476] qlist_free_all+0x47/0xf0 [ 207.573958][ T8476] kasan_quarantine_reduce+0x1a0/0x1f0 [ 207.573974][ T8476] __kasan_slab_alloc+0x69/0x90 [ 207.573993][ T8476] __kmalloc_noprof+0x2cc/0x840 [ 207.574008][ T8476] fib6_info_alloc+0x40/0x160 [ 207.574025][ T8476] ip6_route_info_create+0x14c/0xad0 [ 207.574042][ T8476] ip6_route_add+0x4b/0x1d0 [ 207.574065][ T8476] addrconf_add_mroute+0x1de/0x350 [ 207.574079][ T8476] addrconf_add_dev+0x14e/0x1a0 [ 207.574096][ T8476] addrconf_init_auto_addrs+0x10e/0x780 [ 207.574115][ T8476] addrconf_notify+0xa10/0x1ba0 [ 207.574137][ T8476] notifier_call_chain+0x99/0x3f0 [ 207.574154][ T8476] call_netdevice_notifiers_info+0xbe/0x110 [ 207.574181][ T8476] netif_state_change+0x165/0x380 [ 207.574205][ T8476] linkwatch_do_dev+0xe0/0x120 [ 207.574222][ T8476] [ 207.574226][ T8476] Memory state around the buggy address: [ 207.574235][ T8476] ffff888049f93780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 207.574246][ T8476] ffff888049f93800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 207.574258][ T8476] >ffff888049f93880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 207.574267][ T8476] ^ [ 207.574277][ T8476] ffff888049f93900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 207.574288][ T8476] ffff888049f93980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 207.574297][ T8476] ================================================================== [ 207.574396][ T8476] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 208.379062][ T8476] CPU: 0 UID: 0 PID: 8476 Comm: syz.3.995 Tainted: G L syzkaller #0 PREEMPT(full) [ 208.383884][ T8476] Tainted: [L]=SOFTLOCKUP [ 208.385732][ T8476] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 208.390894][ T8476] Call Trace: [ 208.392813][ T8476] [ 208.396278][ T8476] dump_stack_lvl+0x100/0x190 [ 208.398664][ T8476] vpanic+0x553/0x970 [ 208.400486][ T8476] ? __pfx_vpanic+0x10/0x10 [ 208.402896][ T8476] ? gadgetfs_bind+0x82e/0x890 [ 208.405047][ T8476] panic+0xd1/0xe0 [ 208.406673][ T8476] ? __pfx_panic+0x10/0x10 [ 208.408872][ T8476] ? gadgetfs_bind+0x82e/0x890 [ 208.411344][ T8476] ? preempt_schedule_common+0x3c/0xb0 [ 208.413738][ T8476] check_panic_on_warn.cold+0x19/0x34 [ 208.416330][ T8476] end_report.part.0+0x3a/0x90 [ 208.419204][ T8476] kasan_report.cold+0xe/0x18 [ 208.422104][ T8476] ? gadgetfs_bind+0x82e/0x890 [ 208.424267][ T8476] gadgetfs_bind+0x82e/0x890 [ 208.426232][ T8476] ? kernfs_create_link+0x1bd/0x240 [ 208.428583][ T8476] gadget_bind_driver+0x28c/0xbf0 [ 208.431197][ T8476] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 208.442771][ T8476] ? __pfx_gadget_bind_driver+0x10/0x10 [ 208.445792][ T8476] really_probe+0x241/0xa60 [ 208.448480][ T8476] __driver_probe_device+0x210/0x460 [ 208.451322][ T8476] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 208.454873][ T8476] driver_probe_device+0x4a/0x140 [ 208.457817][ T8476] __driver_attach+0x21f/0x5b0 [ 208.460527][ T8476] ? __pfx___driver_attach+0x10/0x10 [ 208.463590][ T8476] bus_for_each_dev+0x13e/0x1d0 [ 208.466503][ T8476] ? __pfx_bus_for_each_dev+0x10/0x10 [ 208.469404][ T8476] ? bus_add_driver+0x2b5/0x5b0 [ 208.471884][ T8476] bus_add_driver+0x305/0x5b0 [ 208.474423][ T8476] driver_register+0x1e2/0x360 [ 208.476729][ T8476] usb_gadget_register_driver_owner+0x132/0x210 [ 208.480152][ T8476] dev_config+0xdce/0x1610 [ 208.483292][ T8476] ? ksys_write+0xe0/0x250 [ 208.486205][ T8476] ? __pfx_dev_config+0x10/0x10 [ 208.489112][ T8476] vfs_write+0x2aa/0x1050 [ 208.491358][ T8476] ? __pfx_dev_config+0x10/0x10 [ 208.493628][ T8476] ? lock_acquire+0x1d1/0x380 [ 208.496173][ T8476] ? __fget_files+0x34/0x3d0 [ 208.499158][ T8476] ? __pfx_vfs_write+0x10/0x10 [ 208.502042][ T8476] ? find_held_lock+0x2b/0x80 [ 208.505086][ T8476] ? __fget_files+0x215/0x3d0 [ 208.531560][ T8476] ? __fget_files+0x21f/0x3d0 [ 208.533884][ T8476] ksys_write+0x12a/0x250 [ 208.536162][ T8476] ? __pfx_ksys_write+0x10/0x10 [ 208.538386][ T8476] __do_fast_syscall_32+0x13a/0x8b0 [ 208.541762][ T8476] do_fast_syscall_32+0x32/0x70 [ 208.543881][ T8476] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 208.546354][ T8476] RIP: 0023:0xf7f52fec [ 208.547948][ T8476] Code: Unable to access opcode bytes at 0xf7f52fc2. [ 208.550421][ T8476] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 208.560156][ T8476] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000400 [ 208.563711][ T8476] RDX: 000000000000001f RSI: 0000000000000000 RDI: 0000000000000000 [ 208.567073][ T8476] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 208.570396][ T8476] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 208.574303][ T8476] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 208.578420][ T8476] [ 208.580960][ T8476] Kernel Offset: disabled [ 208.582775][ T8476] Rebooting in 86400 seconds.. VM DIAGNOSIS: 03:18:57 Registers: info registers vcpu 0 CPU#0 RAX=dffffc0000000060 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd RSI=ffffffff85aeb500 RDI=ffffffff9bc571e0 RBP=ffffffff9bc571a0 RSP=ffffc90021487050 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=666f206574697257 R12=0000000000000000 R13=0000000000000020 R14=fffffbfff378ae91 R15=dffffc0000000000 RIP=ffffffff85aeb527 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096960000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f7f53000 CR3=000000004c1d7000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000002 RBX=0000000000000004 RCX=ffffffff826407ac RDX=0000000000000003 RSI=0000000000000000 RDI=ffff88802632a580 RBP=0000000000000001 RSP=ffffc9000d78f700 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000001 R12=ffffea0001b78148 R13=0000000000000012 R14=ffffea0001b78140 R15=ffff88802b334d90 RIP=ffffffff82641fd9 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096a60000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000033b1fff8 CR3=000000004e6f6000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000001 RBX=000000000000000f RCX=0000000000000000 RDX=ffff88801ed5f808 RSI=ffffffff8bc541e0 RDI=ffffffff8d729d41 RBP=0000000000000002 RSP=ffffc90022206c88 R8 =0000000000000005 R9 =0000000000000004 R10=0000000000000001 R11=0000000000000001 R12=ffff88801c0cccc0 R13=dffffc0000000000 R14=0000000000000001 R15=00000000f6c7efff RIP=ffffffff8bc54227 RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096b60000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f53f5ba8 CR3=0000000046a30000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000005000000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000000 RBX=0000000000000000 RCX=0000000000000002 RDX=0000000000000000 RSI=ffffffff81b86e35 RDI=ffffffff8e6b9930 RBP=0000000000000002 RSP=ffffc9000d7aedf0 R8 =0000000000000000 R9 =ffffed1005687811 R10=ffff88802b43c08b R11=0000000000000003 R12=ffff88802b43c088 R13=0000000000000098 R14=0000000000000100 R15=00000000000000ff RIP=ffffffff81b86e94 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096c60000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000055c11f5f8000 CR3=000000004c1d7000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000585858585858 2e7a797300000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000585858585858 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff 0f0e0d0c0b0a0908 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000