last executing test programs: 5.742697554s ago: executing program 2 (id=527): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x6}]}, &(0x7f00000002c0)='syzkaller\x00', 0x4}, 0x94) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000440)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_int(r0, 0x11a, 0x5, &(0x7f0000000000)=0x3f9, 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r3, @ANYBLOB="0000000003120100500012800b00010062726964676500004000028008000500010000000600270fff0000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r4, 0x10040) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa1b080045f400280069000002069078640101", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="b56d3ef48d2683515ce4bbd197775dc2639859aef079e1b665eb17acf7d0c38edb752f256e5d8eef0face8791d4654ea5a9e70b548b60737ac7ac04b6db79d63a2cf2bd21baa5c56a76a10998e5933e71b2ae1e63946c6ea"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r5, &(0x7f00000000c0)='1\x00', 0x1) write(0xffffffffffffffff, &(0x7f0000000140)='1', 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x60, 0x30, 0x9, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_bpf={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x14, 0x4, [{}, {0x35, 0x0, 0x5}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x60}}, 0x0) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000002800000028000000020000000100000000000001e5ff0000400000000000000001000084080000000000000001"], 0x0, 0x42}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)={0x6, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, r6, 0x0, 0x2}, 0x50) r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r7, &(0x7f00000001c0)='1\x00', 0x1) fsopen(&(0x7f0000000180)='gfs2meta\x00', 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000140)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x6c, 0xfffe, 0x0, 0x95, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x16, 0x20, 0xb, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x6, 0x7}, @md5sig={0x13, 0x12, "a16dc34416fcb1917fdf02dd82bbfc0e"}, @mptcp=@syn={0x1e, 0xc, 0x0, 0x1, 0x7, 0x5, 0x2}, @mptcp=@mp_fclose={0x1e, 0xc, 0x4, 0x0, 0x6}, @mptcp=@synack={0x1e, 0x10, 0x7, 0x2, 0x80, 0x101, 0x4}]}}}}}}}, 0x0) 3.94161945s ago: executing program 2 (id=535): r0 = syz_open_dev$vbi(&(0x7f0000000380), 0x1, 0x2) ioctl$VIDIOC_G_OUTPUT(r0, 0x8004562e, &(0x7f0000000180)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TLS_TX(r2, 0x6, 0x17, &(0x7f0000000140)=@gcm_128={{0xcf05a145b37f58f3}, "2034b251822b3a46", "fa6b72def4acb1a6c86918c638857983", "34b3adec", "6745ac421772258f"}, 0x28) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) writev(r4, &(0x7f00000016c0)=[{&(0x7f0000000000)="0e899b5d7e007ca0af03034fda66c42909f2aa970dd1128ac13e22848982175c91b1cd92f2df0c83021d9d9ad4f2c662", 0x30}, {&(0x7f00000002c0)="40064ed8117515dc4fc9d61c72b953ec", 0x10}], 0x2) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x109000, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r5, 0x400455c8, 0x10002) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x100000001, 0x211f00, 0x1, 0xa, 0x401}, 0x1c) close(0x3) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000006c0), 0x0, &(0x7f0000000900)={[{@workdir}]}) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000080)={0x204801600, &(0x7f00000001c0), 0x0, 0x0, {0x2c}, 0x0, 0x0, 0x0, 0x0, 0x0, {r1}}, 0x58) syz_open_dev$vbi(&(0x7f0000000380), 0x1, 0x2) (async) ioctl$VIDIOC_G_OUTPUT(r0, 0x8004562e, &(0x7f0000000180)) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async) setsockopt$inet_tcp_TLS_TX(r2, 0x6, 0x17, &(0x7f0000000140)=@gcm_128={{0xcf05a145b37f58f3}, "2034b251822b3a46", "fa6b72def4acb1a6c86918c638857983", "34b3adec", "6745ac421772258f"}, 0x28) (async) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r3, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) accept4(r3, 0x0, 0x0, 0x800) (async) writev(r4, &(0x7f00000016c0)=[{&(0x7f0000000000)="0e899b5d7e007ca0af03034fda66c42909f2aa970dd1128ac13e22848982175c91b1cd92f2df0c83021d9d9ad4f2c662", 0x30}, {&(0x7f00000002c0)="40064ed8117515dc4fc9d61c72b953ec", 0x10}], 0x2) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x109000, 0x0) (async) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xf) (async) ioctl$TCFLSH(r5, 0x400455c8, 0x10002) (async) socket$packet(0x11, 0x2, 0x300) (async) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x100000001, 0x211f00, 0x1, 0xa, 0x401}, 0x1c) (async) close(0x3) (async) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000006c0), 0x0, &(0x7f0000000900)={[{@workdir}]}) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) (async) syz_clone3(&(0x7f0000000080)={0x204801600, &(0x7f00000001c0), 0x0, 0x0, {0x2c}, 0x0, 0x0, 0x0, 0x0, 0x0, {r1}}, 0x58) (async) 3.886511972s ago: executing program 3 (id=536): madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rfc1337\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000580)='1\x00', 0x2) 3.752817475s ago: executing program 3 (id=538): r0 = io_uring_setup(0x33f0, &(0x7f0000000240)={0x0, 0x86a1, 0x2, 0x3, 0x401fb}) close_range(r0, 0xffffffffffffffff, 0x0) 3.749212729s ago: executing program 3 (id=541): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x20, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000006000079b005"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) add_key$fscrypt_v1(0x0, 0x0, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300", 0xffffffff}, 0x48, 0xffffffffffffffff) ptrace(0x10, r1) ptrace$getregset(0x4205, r1, 0x200, &(0x7f0000000080)={&(0x7f00000000c0)=""/112, 0x70}) r2 = openat$vhost_vsock(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_VDPA_GET_IOVA_RANGE(r2, 0x8010af78, &(0x7f0000000040)) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100008e88052086800095d8b601020301090212000100000000090401"], 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x40402) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000340)={&(0x7f0000000380)=[{0x1e, 0x5011, 0x0, 0x0}], 0x1}) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r5, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$KVM_SET_GSI_ROUTING(r5, 0x4008ae6a, &(0x7f0000000300)={0x1, 0x0, [{0x1, 0x1, 0x0, 0x0, @adapter={0xfffffffffffffff9, 0x7, 0x101, 0x1, 0x200400}}]}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_IRQ_LINE_STATUS(r5, 0xc008ae67, &(0x7f00000002c0)={0x0, 0x81}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000440)="ba01b5cf3a36df707ec7ba6aa4fc21e99c274e30b3b62c74fa95154fe6e1981ff0e91202bd4eac8632abab107e505267a3ecf81776ab25748cd40ffcf2151c269567babfd4bb77ba2f84996771a09968621ad974976d7c2c740f19a5c527964d0ac8fc1bf939ca9ae9b711d2a41e9ef1315da7794e7dc6cae9b878e4", 0x7c) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/remove\x00', 0x1, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) write(r6, &(0x7f0000000140)='1\x00', 0x1) r7 = openat(r6, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:02.0/remove\x00', 0xfc94c54f54391741, 0x188) write(r7, &(0x7f00000001c0)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='sys_mnt/block/zram0/algorithm_params\x00', 0x1, 0x0) 3.662272607s ago: executing program 2 (id=542): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f0000000080)=0x1) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x13, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000540000000000000070000006b1138000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x4008080}, 0x8000) request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{0x0}], 0x1) r2 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_IPV6_RTHDR(r2, 0x29, 0x39, &(0x7f0000000080)={0x0, 0x2, 0x2, 0x1, 0x0, [@mcast2]}, 0x18) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0xea60}, 0x10) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, &(0x7f0000000340)=ANY=[], 0x8) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={0x0, 0x58}, 0x1, 0x0, 0x0, 0x44000880}, 0x4080) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x28, 0x0, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x28}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_DESTROY(r3, &(0x7f0000000200), 0x4) 2.133463966s ago: executing program 2 (id=547): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0xc}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x48}], {0x95, 0x0, 0x9}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85}, 0x52) r0 = socket$inet(0x2, 0x6, 0xfffb) getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d616e676c650000000000000000000000000000000000000000000000000000420000007d862657db5feccf4aa7c556a2cc0567d7ce326ac6f9196d23c033d87fd8c2ae3af2624b91d265ce0752522f1c6bb63324e0aa040f3c"], &(0x7f0000000140)=0x66) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0xaf) socket$netlink(0x10, 0x3, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000007c0)='cgroup.events\x00', 0x26e1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f0000000780)={0x1, 'ip_vti0\x00', 0xfffffffe}, 0x18) sendmsg$NFT_BATCH(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c00)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a000a01040000000000000000010000030900010073797a30000000002c000000030a010100000000000000000100fff90900010073797a30000000000900030073797a300000000098000000060a010400000000000000000100000008000b400000000070000480340001800b000100657874686472000024000280080001400000000c0800034000000000080004400000002d0500020007000000380001800c0001006269747769736500280002800800014000000002080002400000000a08000640000000000800034000000001040004800900010073797a3000000000140000001100010000000000000000000700000a"], 0x10c}}, 0x0) syz_emit_ethernet(0xbe, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa23aaaaaaaaaabb0800450000b00000000000119078000000000000000000004e20009c907801000000000000007b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424dbcfd56f1375461caaa2f19935e699600649a3bfbc1d162a5011bb7c55c55437d95bac23d53b39cb307b3472ab9cdb042d2"], 0x0) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657930820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b716380327727385edb72ae6e0decfbb66d017fe95566dfbf1d76780228fbb57ff8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cde982d4b55b2d321f1c9d55f844f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ad", 0x559, 0xffffffffffffffff) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x2}, 0x94) ioctl$SNAPSHOT_PLATFORM_SUPPORT(r2, 0x330f, 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x24, 0x0, 0xc, 0x0, 0x10003}, 0x0, &(0x7f00000002c0)={0x3ff, 0x80000001, 0x200, 0x9, 0x4, 0x0, 0x1}, 0x0, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r6, @ANYBLOB="050000000000000000000200000008000300", @ANYRES32=r7, @ANYBLOB="2d000e0080000000ffffffffffff08021100000008021100000000000000000000000000640000002503000000000000080026006c09"], 0x80}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/kernel/mm/transparent_hugepage/shmem_enabled\x00', 0x2, 0x0) syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xfffffffe, 0x2, 0x83, 0x3af}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000180)) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) 1.737563681s ago: executing program 0 (id=550): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140604000000000e000a000f0000000280000012", 0x2d}], 0x1}, 0x0) 1.622339191s ago: executing program 1 (id=551): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x40100001, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f00000002c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000240)={0x0, 0x1800, r2, r3, 0x1800, 0x0, 0x2, 0x1, {0xac7c, 0x1, 0x7, 0x69, 0xf4b, 0x2, 0x2, 0x45, 0x412f, 0xe154, 0x20, 0x7, 0xb2bf, 0x3, "fe1d00003413000000000000000caa000000090000000000000004b427180010"}}) 1.62150313s ago: executing program 0 (id=552): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x12) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000480)={{0x0, 0x1}, 'syz0\x00', 0x7}) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000000500)={0x2020}, 0x2020) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x40086602, &(0x7f0000000080)={0x17e}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000003c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x800010, &(0x7f00000002c0)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000100)='./file0\x00') execve(&(0x7f0000001000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e21, 0xd, @loopback, 0xc}], 0x1c) sendto$inet6(r3, &(0x7f0000000340)='0', 0xffe0, 0x4000854, &(0x7f0000000300)={0xa, 0x4e21, 0xbe7, @loopback, 0x800000c0}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) 1.474209754s ago: executing program 1 (id=553): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x800}, 0x1c) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x201000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x20, 0x70bd25, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x1) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x8001, 0x10040) ioctl$EVIOCGKEYCODE(r2, 0x80084504, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000040)={0x340, 0x7, 0x1800, 0x9, 0x1512}) 1.302125397s ago: executing program 1 (id=554): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x8080, 0x8, 0x3, 0x0, 0x0, r0}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = open(&(0x7f0000000140)='./file1\x00', 0x66842, 0x21) syz_ublk_add_dev(r5, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x71, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000180)=@any_dev={0x4, 0x58e, 0x0, 0x0, 0x1000, 0x9, 0xffffffffffffffff}}}, &(0x7f0000000440)=0x0) r8 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000080)='asymmetric\x00', 0x0, &(0x7f0000000780)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d32323035315b3232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r8) add_key(&(0x7f00000002c0)='cifs.idmap\x00', &(0x7f0000000300)={'syz', 0x1}, 0x0, 0x0, r8) syz_ublk_setup_queues(r5, r7, &(0x7f0000000340)={0x0, 0xfb7e, 0x3000, 0x2, 0x3cf, 0x0, r1}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd3db, 0x200, 0xfffffffd, 0x3de, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9e00, 0x200, 0xfffffffe, 0x278}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdada, 0x1000, 0x3, 0x321}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc9b3, 0x20, 0x3, 0x80000c4}}], 0x4, &(0x7f0000000e00)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0xf6}, 0x0, r6, '\x00', {0x5, 0xe81, 0x0, 0x0}}, 0x0) r9 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r5) sendmsg$TIPC_CMD_RESET_LINK_STATS(r5, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, r9, 0x100, 0x70bd29, 0x25dfdbfb, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x41}, 0x10) 1.170647895s ago: executing program 3 (id=555): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8c1}, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = fsopen(&(0x7f0000000040)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/cgroup.procs\x00', 0x181101, 0xfc) getdents64(r5, &(0x7f0000001700)=""/127, 0x7f) mount$9p_virtio(&(0x7f0000000340), &(0x7f00000001c0)='.\x00', &(0x7f00000005c0), 0x4004, &(0x7f0000000040)={'trans=virtio,', {[{@access_any}]}}) lseek(r5, 0x5, 0x1) getdents64(r5, 0x0, 0x4f) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000600), 0x56) write(0xffffffffffffffff, &(0x7f0000000200), 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000280)=ANY=[@ANYRESHEX=r4], 0x8c}}, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) syncfs(0xffffffffffffffff) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000068000000090a0104000000000000000007000040000000000900000073797a30000000000900010073797a3000000000080005400000000d24001280200001800e000100636f6e6e6c696d69740000000c000280080001400000ffff0800034000000110140000001000010000000000000000000084000ae236b94c83129187b4924b036b1d70df3543c9e8e4931360eae9188409f99943cdc8269c813a1978cb3ebbee883d129bc20283c11e687de4faf7a8bb62e71a7c558048da2180fb3d452a831d03c60d2375d8424cf4b6563f30f9615856c4431f59cfa7ad24d464405f884a472c162b0669667a5e18d9c8ceade55ec6a9b851a711a23364a99825bf1a406d70890b224ec6c68cfabb417bd106c3300ae1f66674a93d650a06c64e571d30ad54071ed4b46d5eef71a991d07cb2f6ca32856ba3344795ba48e09536f651359010561a246b99129d40d833ffdd33ba8a64827fd5b6896683edcc8353e195e20149ef0242ecc2e70bdc23a259fb2b29cd77706af22cc5ced6a3870586e442ca109b7ca907c440808739cadc96dd2b8a3ac7cd2a8ca903d5af3db10c532a3942d78c6f4a1e3ad5c5ded9f92c055a6e1506bae60050dc34312c94451004bf2e409840792ab36e3be4142acc16cd3d4f5efbca8c6ffd092763ed50a427dd5395d404602aac498f8b4bee88295b2a4c1ec417eae6b07d3b6f4f3da123626a79884efc98964b1e"], 0xb0}}, 0x20050800) write(r7, &(0x7f0000000280)='0', 0x1) socket$nl_rdma(0x10, 0x3, 0x14) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r7, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x2}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f0000000340)={r9, @in={{0x2, 0x4e21, @multicast1}}, 0x3ff, 0x7}, 0x88) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 1.169986222s ago: executing program 2 (id=556): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f0000000080)=0x1) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x13, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000540000000000000070000006b1138000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x4008080}, 0x8000) request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) r2 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_IPV6_RTHDR(r2, 0x29, 0x39, &(0x7f0000000080)={0x0, 0x2, 0x2, 0x1, 0x0, [@mcast2]}, 0x18) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0xea60}, 0x10) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, &(0x7f0000000340)=ANY=[], 0x8) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={0x0, 0x58}, 0x1, 0x0, 0x0, 0x44000880}, 0x4080) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x28, 0x0, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x28}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_DESTROY(r3, &(0x7f0000000200), 0x4) 1.053459725s ago: executing program 0 (id=557): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./security\x00', &(0x7f0000000200)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./security/apparmor/.load\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)="04080076657273696f6e00020500000003080070726f66696c6500070502007000040600666c6167730007020000000002000000000200000001", 0x3a) 901.54527ms ago: executing program 1 (id=558): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000200)={'#! ', './file0'}, 0xb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) r4 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x6) ioctl$KDMKTONE(r4, 0x4b30, 0x7fffffff) r5 = syz_io_uring_setup(0x29d7, &(0x7f0000000540)={0x0, 0x8550, 0x3100, 0x2, 0x1d5}, &(0x7f0000000100)=0x0, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r6, r7, r8, &(0x7f0000000280)=@IORING_OP_WAITID={0x32, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x4}}) io_uring_enter(r5, 0x1, 0x1, 0x61, 0x0, 0x0) r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) r10 = socket$kcm(0x2, 0x3, 0x2) ioctl$sock_kcm_SIOCKCMUNATTACH(r10, 0x89e1, &(0x7f0000000440)) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000400)={0x0, &(0x7f0000000040)}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x2, 0x0, 0x0, 0x0, 0x61, 0x18, 0x50}, [@ldst={0x5, 0x0, 0x4, 0x0, 0x0, 0x0, 0x27}]}, &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x3}, 0x28) r11 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x2, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010000000000fdffffdf03000000140001800d0001007764703a73"], 0x28}, 0x1, 0x0, 0x0, 0x20010018}, 0x0) ioctl(r11, 0x40946400, &(0x7f0000000100)='pc212e\x00\x00\x00\x00\x00') ioctl$COMEDI_INSN(r11, 0x8028250c, 0x0) write$binfmt_script(r9, 0x0, 0x0) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f0000000080)={r9, 0x0, {0x0, 0x0, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xa]}}) r14 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000001600), 0x20000, 0x0) ioctl$PTP_CLOCK_GETCAPS(r14, 0x43403d0e, &(0x7f0000000140)) pwrite64(r3, &(0x7f0000000440)="6ca7", 0x2, 0x5) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x27) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) 901.236778ms ago: executing program 0 (id=559): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_dev$vim2m(&(0x7f0000000240), 0x6, 0x2) ioctl$vim2m_VIDIOC_DQBUF(r3, 0xc044560f, &(0x7f0000000380)=@mmap={0x101, 0x1, 0x4, 0x2, 0x0, {0x77359400}, {0x0, 0x2, 0x0, 0x0, 0x4, 0x0, "37bb54f0"}}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000100)=0x1) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="4800000002060104000000000200000000000000050004000000000010000300686173683a2c6d61630005000500020000000900020073797a30000000000500010007000000"], 0x48}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c00000007060108e8ff000000000000000000000500010006", @ANYRES32=r0, @ANYRES16=r1, @ANYRES8=r4], 0x1c}, 0x1, 0x0, 0x0, 0x40844}, 0x0) recvmmsg(r5, &(0x7f00000047c0)=[{{0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000005c0)=""/9, 0x9}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000000280)=""/116, 0x74}], 0x3}, 0x43}], 0x1, 0x20, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a010400000000000000000a0080010900010073797a31000000002c0004802800018007000100637400001c0002800500030001000000080002400000000908000140000000090900020073797a32000000001400000011009c0000000000000000000200000a"], 0x80}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x40086806, 0x21) read$usbfs(0xffffffffffffffff, &(0x7f0000000100)=""/151, 0x97) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) recvfrom$l2tp6(0xffffffffffffffff, &(0x7f00000004c0)=""/252, 0xfc, 0x4000, &(0x7f0000001600)={0xa, 0x0, 0x0, @loopback}, 0x20) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 780.139051ms ago: executing program 3 (id=560): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x12) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000480)={{0x0, 0x1}, 'syz0\x00', 0x7}) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000000500)={0x2020}, 0x2020) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x40086602, &(0x7f0000000080)={0x17e}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000003c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x800010, &(0x7f00000002c0)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000100)='./file0\x00') execve(&(0x7f0000001000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0x6) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e21, 0xd, @loopback, 0xc}], 0x1c) sendto$inet6(r3, &(0x7f0000000340)='0', 0xffe0, 0x4000854, &(0x7f0000000300)={0xa, 0x4e21, 0xbe7, @loopback, 0x800000c0}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) 522.630553ms ago: executing program 0 (id=561): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYRES16=r0], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x40004) r2 = syz_open_dev$vim2m(&(0x7f0000000240), 0x6, 0x2) ioctl$vim2m_VIDIOC_DQBUF(r2, 0xc044560f, &(0x7f0000000380)=@mmap={0x101, 0x1, 0x4, 0x2, 0x0, {0x77359400}, {0x0, 0x2, 0x0, 0x0, 0x4, 0x0, "37bb54f0"}}) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000100)=0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="4800000002060104000000000200000000000000050004000000000010000300686173683a2c6d61630005000500020000000900020073797a30000000000500010007000000"], 0x48}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c00000007060108e8ff000000000000000000000500010006", @ANYRES32=r0, @ANYRES16=r1, @ANYRES8=r3], 0x1c}, 0x1, 0x0, 0x0, 0x40844}, 0x0) recvmmsg(r4, &(0x7f00000047c0)=[{{0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000005c0)=""/9, 0x9}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000000280)=""/116, 0x74}], 0x3}, 0x43}], 0x1, 0x20, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a010400000000000000000a0080010900010073797a31000000002c0004802800018007000100637400001c0002800500030001000000080002400000000908000140000000090900020073797a32000000001400000011009c0000000000000000000200000a"], 0x80}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x40086806, 0x21) read$usbfs(0xffffffffffffffff, &(0x7f0000000100)=""/151, 0x97) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) recvfrom$l2tp6(0xffffffffffffffff, &(0x7f00000004c0)=""/252, 0xfc, 0x4000, &(0x7f0000001600)={0xa, 0x0, 0x0, @loopback}, 0x20) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 288.954311ms ago: executing program 3 (id=562): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000200)={'#! ', './file0'}, 0xb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) r4 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x6) ioctl$KDMKTONE(r4, 0x4b30, 0x7fffffff) r5 = syz_io_uring_setup(0x29d7, &(0x7f0000000540)={0x0, 0x8550, 0x3100, 0x2, 0x1d5}, &(0x7f0000000100)=0x0, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r6, r7, r8, &(0x7f0000000280)=@IORING_OP_WAITID={0x32, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x4}}) io_uring_enter(r5, 0x1, 0x1, 0x61, 0x0, 0x0) r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) r10 = socket$kcm(0x2, 0x3, 0x2) ioctl$sock_kcm_SIOCKCMUNATTACH(r10, 0x89e1, &(0x7f0000000440)) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000400)={0x0, &(0x7f0000000040)}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x2, 0x0, 0x0, 0x0, 0x61, 0x18, 0x50}, [@ldst={0x5, 0x0, 0x4, 0x0, 0x0, 0x0, 0x27}]}, &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x3}, 0x28) r11 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x2, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010000000000fdffffdf03000000140001800d0001007764703a73"], 0x28}, 0x1, 0x0, 0x0, 0x20010018}, 0x0) ioctl(r11, 0x40946400, &(0x7f0000000100)) ioctl$COMEDI_INSN(r11, 0x8028250c, 0x0) write$binfmt_script(r9, 0x0, 0x0) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f0000000080)={r9, 0x0, {0x0, 0x0, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xa]}}) r14 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000001600), 0x20000, 0x0) ioctl$PTP_CLOCK_GETCAPS(r14, 0x43403d0e, &(0x7f0000000140)) pwrite64(r3, &(0x7f0000000440)="6ca7", 0x2, 0x5) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x27) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) 236.001902ms ago: executing program 1 (id=563): r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000000)={0xfff, 0x0, 0x3, 0x14, 0x4}) ioctl$DVB_DEMUX_DMX_ADD_PID(r0, 0x40026f33, &(0x7f00000000c0)=0x7) ioctl$DVB_DEMUX_DMX_START(r0, 0x6f29) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000480)='/proc/bus/input/devices\x00', 0x0, 0x0) poll(&(0x7f00000004c0)=[{r2, 0x402}], 0x1, 0x1) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x2000000) sendmsg$nl_xfrm(r2, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000580)=ANY=[@ANYBLOB="14002000250000023029bd7000fbdbdf25080000c94a9772392ac02c7f29f73173635d427e55aae3724d487dc0b9ea427d5fb2578583c46a17d2e67a438b8692140b5a1c2cc3aa04", @ANYRESOCT=r0], 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4040841) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000380), 0x4000000004882, 0x0) io_setup(0x1, &(0x7f00000004c0)=0x0) io_submit(r7, 0xf3, &(0x7f00000000c0)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x7, 0x1, 0x0, r6, &(0x7f0000000000)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000080)={0x50, r5, 0x1, 0x70bd2a, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x50}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) r8 = openat2$dir(0xffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x800, 0x8, 0x9}, 0x18) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) write$uinput_user_dev(r9, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0x3, [0x0, 0x0, 0x0, 0x9, 0x1, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x6000000, 0x8, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x3, 0x20000, 0x0, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x9197, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x0, 0x3, 0x805, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x2007, 0x0, 0x7, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x40, 0x0, 0x200, 0x0, 0xfffffffe, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x921, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x635, 0x0, 0x8000000, 0xe0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x6c, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1f73, 0x80000000, 0x5, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0xcaa, 0x10006, 0x200000, 0xfffffff7, 0x0, 0x0, 0xffffffff, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r9, 0x5501) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x94, 0x7fff0000}]}) close_range(r10, 0xffffffffffffffff, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000000a499d0000000000000000020000010900010073797a310000000008000240000000030400060014000000110001"], 0x54}}, 0x0) sendmsg$NFT_MSG_GETTABLE(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000010a0101"], 0x14}, 0x1, 0x0, 0x0, 0x400c895}, 0x24000800) faccessat(r8, &(0x7f0000000140)='./file0\x00', 0x79) 161.850972ms ago: executing program 2 (id=564): r0 = openat$zero(0xffffff9c, &(0x7f00000000c0), 0x141080, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x14000, 0x20) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) r2 = openat$nmem0(0xffffff9c, &(0x7f0000000100), 0x401, 0x0) r3 = syz_open_dev$dmmidi(&(0x7f0000000140), 0x40, 0x400) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xee00}}, './file0\x00'}) r6 = socket$inet_tcp(0x2, 0x1, 0x0) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1b00000000000000000000000000010000000000", @ANYRES32, @ANYBLOB="560500"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/15], 0x50) r8 = openat$userfaultfd(0xffffff9c, &(0x7f0000000280), 0x800, 0x0) poll(&(0x7f00000002c0)=[{r0, 0x280}, {r1, 0xa020}, {r2, 0x10002}, {r3, 0x1000}, {0xffffffffffffffff, 0xc0e}, {r4, 0x51}, {r6, 0x2}, {r7, 0x80}, {r8, 0x2296}], 0x9, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), 0x0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x188) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) r10 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x101900, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r10, 0xc0285700, &(0x7f0000000180)={0x6d26, "7bb9595931028deda525e19bdeffafde2500f6d15c9e31df9454310ad7c18e65", 0xffffffffffffffff}) r12 = openat$6lowpan_control(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) r13 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000100), 0x218888, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r13}, 0x2c, {'wfdno', 0x3d, r12}}) ppoll(&(0x7f0000000400)=[{0xffffffffffffffff, 0x435}, {r11, 0x1580}], 0x2, 0x0, 0x0, 0x0) close_range(r10, 0xffffffffffffffff, 0x0) r14 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r14, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x25dfdbfd, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x4}, 0x1}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x8848}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20040800}, 0x0) mount$overlay(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000440), 0x102800, &(0x7f0000000480)={[{@default_permissions}], [{@rootcontext={'rootcontext', 0x3d, 'system_u'}}, {@dont_appraise}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@fowner_eq={'fowner', 0x3d, r5}}]}) socket$netlink(0x10, 0x3, 0x0) syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="02c80012000e000100"], 0x17) ioctl$TIOCGPTLCK(0xffffffffffffffff, 0x80045439, &(0x7f0000000200)) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r9, 0x84, 0x84, 0x0, &(0x7f0000000040)) syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffff6487a2bed3000001e000000114009078ac1e0001000000000000000000"], 0x0) syz_open_dev$ublk_chdev(&(0x7f0000000780), 0x0, 0x234840) 95.031889ms ago: executing program 0 (id=565): sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x2000000000000013, &(0x7f0000000440)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x6, 0xb8, &(0x7f0000000140)=""/184, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) request_key(0x0, 0x0, 0x0, 0x0) add_key$fscrypt_v1(0x0, 0x0, &(0x7f0000000080)={0x0, "4d0916cb7a186d2a2e55ba48ad3f796547502777ff87f76b395c692150689bb4a628a9f3aa873e97ebd2a2089456afed727eaa0e6eaaad8669a20c12065b35a5", 0x39}, 0x48, 0xffffffffffffffff) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x1, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cb, 0x0, 0xa1d, 0x68ff, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000480)={{0xd000, 0x54000, 0xc, 0x1, 0x8, 0x0, 0x0, 0x3, 0x0, 0xc, 0x6, 0x9}, {0xffffffff, 0x10000, 0x9, 0x3, 0x2, 0x0, 0x0, 0x0, 0x7, 0xff}, {0xe6ee2000, 0x3000, 0x0, 0x1, 0x8, 0xc4, 0x0, 0x0, 0x48, 0x3, 0x0, 0x5}, {0xeeef0000, 0xeee96000, 0xa, 0x0, 0xa, 0xa6, 0x9, 0x0, 0x8, 0xfe, 0x4, 0x4}, {0x6000, 0xffff1000, 0xe, 0x0, 0x0, 0x4, 0xe1, 0xfd, 0x0, 0x3c}, {0x8000000, 0x0, 0xb, 0x78, 0x5, 0x80, 0x0, 0x0, 0x3, 0xff, 0x1}, {0x1, 0xeeee0000, 0xa, 0x4, 0x0, 0x0, 0xa1, 0x20, 0x0, 0x0, 0x8}, {0x81a0002, 0x6000, 0xc, 0x0, 0x0, 0x5, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0x80a0000, 0x48cc}, {0xdddd1000, 0x14}, 0xddf8ffdb, 0x0, 0x0, 0x114, 0x0, 0xf801, 0x0, [0x80000005, 0x0, 0x1]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r6 = syz_open_dev$sndpcmc(&(0x7f0000000a00), 0x0, 0x0) getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x43, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r6, 0xc25c4110, &(0x7f0000000100)={0x0, [[0x1, 0x0, 0x0, 0x2, 0x4, 0x101], [0x20000000, 0x500, 0x4, 0x0, 0x0, 0x0, 0xf4e], [0x40, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x20000000]], '\x00', [{0x1, 0x0, 0x0, 0x1, 0x1}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0xe}, {0x5}, {0x1, 0x2}, {0x0, 0x3}, {}, {}, {0xfffffffc, 0xab9}, {0x82}, {0x400}, {0x6}], '\x00', 0x4b4}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, &(0x7f00000007c0)='syzkaller\x00', 0x9}, 0x94) 0s ago: executing program 1 (id=566): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./security\x00', &(0x7f0000000200)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./security/apparmor/.load\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)="04080076657273696f6e00020500000004080070726f66696c6500070502007000040600666c6167730007020000000002000000000200000001", 0x3a) (fail_nth: 5) kernel console output (not intermixed with test programs): T6645] syzkaller0: entered allmulticast mode [ 96.623624][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 97.871807][ T6693] Bluetooth: MGMT ver 1.23 [ 97.901061][ T6693] netlink: 8 bytes leftover after parsing attributes in process `syz.2.199'. [ 97.978170][ T6701] MTD: Couldn't look up './dev/mtdblock0': -2 [ 97.981409][ T6698] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 97.982713][ T6693] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 97.994254][ T6698] netlink: 20 bytes leftover after parsing attributes in process `syz.0.200'. [ 98.011417][ T6693] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 98.015157][ T6693] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 98.077338][ T6706] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 98.845408][ T6727] netlink: 28 bytes leftover after parsing attributes in process `syz.1.204'. [ 99.276152][ T6724] overlay: Unknown parameter '/v98PIx@Q3}g{.$߂ ugG1e HID v0.10 Device [syz0] on syz1 [ 104.126141][ T6821] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 104.599212][ T36] IPVS: starting estimator thread 0... [ 104.699933][ T6841] IPVS: using max 27 ests per chain, 64800 per kthread [ 104.789956][ T5818] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 104.931693][ T5818] usb 5-1: device descriptor read/64, error -71 [ 105.190441][ T5818] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 105.330017][ T5818] usb 5-1: device descriptor read/64, error -71 [ 105.452691][ T5818] usb usb5-port1: attempt power cycle [ 105.814975][ T5818] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 105.843363][ T5818] usb 5-1: device descriptor read/8, error -71 [ 106.099907][ T5818] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 106.120589][ T5818] usb 5-1: device descriptor read/8, error -71 [ 106.153914][ T6860] loop6: detected capacity change from 0 to 2640 [ 106.159716][ T6860] ldm_validate_partition_table(): Disk read failed. [ 106.164399][ T6860] Dev loop6: unable to read RDB block 0 [ 106.166588][ T6860] loop6: unable to read partition table [ 106.168548][ T6860] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 106.230566][ T5818] usb usb5-port1: unable to enumerate USB device [ 106.955350][ T42] kauditd_printk_skb: 19 callbacks suppressed [ 106.955380][ T42] audit: type=1326 audit(1787299352.546:164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6861 comm="syz.2.234" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 106.980815][ T42] audit: type=1326 audit(1787299352.546:165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6861 comm="syz.2.234" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 109.517914][ T6887] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 109.872479][ T42] audit: type=1326 audit(1787299355.466:166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6892 comm="syz.2.241" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 109.920754][ T42] audit: type=1326 audit(1787299355.466:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6892 comm="syz.2.241" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 109.965565][ T42] audit: type=1326 audit(1787299355.466:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6892 comm="syz.2.241" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf709efec code=0x7ffc0000 [ 110.009136][ T42] audit: type=1326 audit(1787299355.466:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6892 comm="syz.2.241" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 110.035060][ T42] audit: type=1326 audit(1787299355.466:170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6892 comm="syz.2.241" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 110.054556][ T42] audit: type=1326 audit(1787299355.466:171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6892 comm="syz.2.241" exe="/syz-executor" sig=0 arch=40000003 syscall=242 compat=1 ip=0xf709efec code=0x7ffc0000 [ 110.065605][ T42] audit: type=1326 audit(1787299355.466:172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6892 comm="syz.2.241" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 110.076666][ T42] audit: type=1326 audit(1787299355.466:173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6892 comm="syz.2.241" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 110.622311][ T6909] syz_tun: entered allmulticast mode [ 110.627806][ T6909] lo: entered allmulticast mode [ 110.656118][ T6908] syz_tun: left allmulticast mode [ 110.657983][ T6908] lo: left allmulticast mode [ 111.147656][ T6913] input: syz0 as /devices/virtual/input/input8 [ 111.231860][ T6922] loop6: detected capacity change from 0 to 2640 [ 111.252994][ T6922] buffer_io_error: 33 callbacks suppressed [ 111.253305][ T6922] Buffer I/O error on dev loop6, logical block 0, async page read [ 111.318757][ T6922] Buffer I/O error on dev loop6, logical block 0, async page read [ 111.365898][ T6922] Buffer I/O error on dev loop6, logical block 0, async page read [ 111.458373][ T6922] Buffer I/O error on dev loop6, logical block 0, async page read [ 111.538655][ T6922] Buffer I/O error on dev loop6, logical block 0, async page read [ 111.593019][ T6922] Buffer I/O error on dev loop6, logical block 0, async page read [ 111.596496][ T6922] Buffer I/O error on dev loop6, logical block 0, async page read [ 111.599937][ T6922] Buffer I/O error on dev loop6, logical block 0, async page read [ 111.603326][ T6922] ldm_validate_partition_table(): Disk read failed. [ 111.606139][ T6922] Buffer I/O error on dev loop6, logical block 0, async page read [ 111.609693][ T6922] Buffer I/O error on dev loop6, logical block 0, async page read [ 111.613534][ T6922] Dev loop6: unable to read RDB block 0 [ 111.616177][ T6922] loop6: unable to read partition table [ 111.618943][ T6922] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 111.873844][ T6926] Console: switching to colour dummy device 80x25 [ 112.146923][ T6929] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 112.187885][ T6929] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 112.192130][ T6929] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 112.195319][ T6929] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 112.200904][ T6929] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 112.228457][ T6929] pci 0000:00:01.0: pci_fixup_video+0x0/0x280 took 27233 usecs [ 112.265230][ T6929] pci 0000:00:01.0: Adding to iommu group 1 [ 112.283987][ T6929] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 112.287282][ T6929] pci 0000:00:01.0: vgaarb: bridge control possible [ 112.290194][ T6929] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 112.490482][ T6929] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 112.494248][ T6929] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 112.502440][ T6929] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 112.518727][ T6929] [drm] Found bochs VGA, ID 0xb0c5. [ 112.521511][ T6929] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 112.553402][ T6929] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 112.740308][ T6942] netlink: 'syz.2.251': attribute type 1 has an invalid length. [ 112.764852][ T6929] Console: switching to colour frame buffer device 160x50 [ 112.801269][ T6942] bond2: entered promiscuous mode [ 112.801854][ T6942] 8021q: adding VLAN 0 to HW filter on device bond2 [ 112.833179][ T6929] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 112.965913][ T6940] overlay: Unknown parameter '/' [ 112.971257][ T6940] syzkaller0: entered promiscuous mode [ 112.973697][ T6940] syzkaller0: entered allmulticast mode [ 112.994218][ T5744] Bluetooth: hci0: unexpected subevent 0x10 length: 30 > 2 [ 113.433595][ T6961] netlink: 'syz.1.256': attribute type 29 has an invalid length. [ 115.780202][ T13] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 115.788545][ T13] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 115.799159][ T13] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 115.815202][ T13] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 115.848342][ T6965] netlink: 'syz.3.258': attribute type 10 has an invalid length. [ 115.853483][ T6965] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.856759][ T6965] bridge0: port 2(bridge_slave_1) entered listening state [ 115.862046][ T6965] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.865075][ T6965] bridge0: port 1(bridge_slave_0) entered listening state [ 115.873112][ T6965] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 115.938951][ T6968] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 115.944980][ T6968] netlink: 20 bytes leftover after parsing attributes in process `syz.3.259'. [ 116.828731][ T6975] netlink: 76 bytes leftover after parsing attributes in process `syz.0.261'. [ 117.345424][ T6988] netlink: 'syz.2.265': attribute type 1 has an invalid length. [ 117.362653][ T6988] bond3: entered promiscuous mode [ 117.366735][ T6988] 8021q: adding VLAN 0 to HW filter on device bond3 [ 117.467097][ T6984] overlay: Unknown parameter '/' [ 118.442523][ T7002] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 118.448870][ T7002] netlink: 20 bytes leftover after parsing attributes in process `syz.1.268'. [ 118.671453][ T7000] pim6reg: entered allmulticast mode [ 119.095659][ T6997] team0: entered allmulticast mode [ 119.097912][ T6997] team_slave_0: entered allmulticast mode [ 119.100448][ T6997] team_slave_1: entered allmulticast mode [ 119.104378][ T6997] team0: left allmulticast mode [ 119.106685][ T6997] team_slave_0: left allmulticast mode [ 119.109014][ T6997] team_slave_1: left allmulticast mode [ 119.111738][ T6997] pim6reg: left allmulticast mode [ 119.147716][ T7016] netlink: 12 bytes leftover after parsing attributes in process `syz.3.272'. [ 119.167438][ T7016] jffs2: notice: (7016) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 120.065887][ T42] kauditd_printk_skb: 21 callbacks suppressed [ 120.065918][ T42] audit: type=1326 audit(1787299365.646:195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7023 comm="syz.1.275" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23fec code=0x7ffc0000 [ 120.358411][ T42] audit: type=1326 audit(1787299365.646:196): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7023 comm="syz.1.275" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23fec code=0x7ffc0000 [ 120.386906][ T42] audit: type=1326 audit(1787299365.646:197): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7023 comm="syz.1.275" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f23fec code=0x7ffc0000 [ 120.433072][ T42] audit: type=1326 audit(1787299365.646:198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7023 comm="syz.1.275" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23fec code=0x7ffc0000 [ 120.442573][ T42] audit: type=1326 audit(1787299365.646:199): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7023 comm="syz.1.275" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23fec code=0x7ffc0000 [ 120.454518][ T42] audit: type=1326 audit(1787299365.646:200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7023 comm="syz.1.275" exe="/syz-executor" sig=0 arch=40000003 syscall=242 compat=1 ip=0xf7f23fec code=0x7ffc0000 [ 120.464350][ T42] audit: type=1326 audit(1787299365.646:201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7023 comm="syz.1.275" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23fec code=0x7ffc0000 [ 120.474745][ T42] audit: type=1326 audit(1787299365.646:202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7023 comm="syz.1.275" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23fec code=0x7ffc0000 [ 120.484090][ T42] audit: type=1326 audit(1787299365.646:203): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7023 comm="syz.1.275" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f23fec code=0x7ffc0000 [ 120.500185][ T42] audit: type=1326 audit(1787299365.646:204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7023 comm="syz.1.275" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23fec code=0x7ffc0000 [ 120.589274][ T7036] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 120.602907][ T7036] netlink: 20 bytes leftover after parsing attributes in process `syz.0.277'. [ 120.799956][ T7040] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 120.811770][ T7040] netlink: 20 bytes leftover after parsing attributes in process `syz.1.278'. [ 120.933626][ T7044] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 120.936428][ T7044] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 120.947543][ T7048] jffs2: notice: (7048) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 120.951120][ T7044] vhci_hcd vhci_hcd.0: Device attached [ 121.150005][ T7054] netlink: 'syz.0.282': attribute type 10 has an invalid length. [ 121.160486][ T7054] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.163508][ T7054] bridge0: port 1(bridge_slave_0) entered listening state [ 121.198707][ T7054] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 121.230031][ T5818] usb 44-1: SetAddress Request (2) to port 0 [ 121.238323][ T5818] usb 44-1: new SuperSpeed USB device number 2 using vhci_hcd [ 122.560017][ T7046] vhci_hcd: connection reset by peer [ 122.565332][ T12] vhci_hcd vhci_hcd.3: stop threads [ 122.597369][ T12] vhci_hcd vhci_hcd.3: release socket [ 122.618019][ T12] vhci_hcd vhci_hcd.3: disconnect device [ 122.929597][ T7065] loop6: detected capacity change from 0 to 2640 [ 122.934480][ T7065] buffer_io_error: 11 callbacks suppressed [ 122.934518][ T7065] Buffer I/O error on dev loop6, logical block 0, async page read [ 122.940900][ T7065] Buffer I/O error on dev loop6, logical block 0, async page read [ 122.944649][ T7065] Buffer I/O error on dev loop6, logical block 0, async page read [ 122.948044][ T7065] Buffer I/O error on dev loop6, logical block 0, async page read [ 122.951629][ T7065] Buffer I/O error on dev loop6, logical block 0, async page read [ 122.956470][ T7065] Buffer I/O error on dev loop6, logical block 0, async page read [ 122.960250][ T7065] Buffer I/O error on dev loop6, logical block 0, async page read [ 122.963632][ T7065] Buffer I/O error on dev loop6, logical block 0, async page read [ 122.966796][ T7065] ldm_validate_partition_table(): Disk read failed. [ 122.970045][ T7065] Buffer I/O error on dev loop6, logical block 0, async page read [ 122.973189][ T7065] Buffer I/O error on dev loop6, logical block 0, async page read [ 122.975648][ T7065] Dev loop6: unable to read RDB block 0 [ 122.978917][ T7065] loop6: unable to read partition table [ 122.981471][ T7065] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 123.577573][ T7059] xt_CT: No such helper "syz1" [ 123.774427][ T7080] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 123.790831][ T7080] netlink: 20 bytes leftover after parsing attributes in process `syz.2.287'. [ 124.146172][ T7087] input: syz0 as /devices/virtual/input/input9 [ 124.371471][ T7096] Console: switching to colour dummy device 80x25 [ 124.404012][ T7097] netlink: 8 bytes leftover after parsing attributes in process `syz.2.291'. [ 124.465450][ T7098] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 124.523256][ T7098] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 124.526634][ T7098] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 124.530432][ T7098] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 124.534760][ T7098] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 124.555376][ T7098] pci 0000:00:01.0: Adding to iommu group 1 [ 124.563779][ T7098] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 124.566826][ T7098] pci 0000:00:01.0: vgaarb: bridge control possible [ 124.569738][ T7098] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 124.592097][ T7098] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 124.596680][ T7098] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 124.603331][ T7098] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 124.621375][ T7090] overlay: Unknown parameter '/v98PIx@Q3}g{.$߂ ugG1e [ 136.395104][ T7279] dump_stack_lvl+0x100/0x190 [ 136.395210][ T7279] should_fail_ex.cold+0x5/0xa [ 136.395239][ T7279] should_failslab+0xc2/0x120 [ 136.395290][ T7279] __kvmalloc_node_noprof+0x116/0x970 [ 136.395312][ T7279] ? lockdep_init_map_type+0x5c/0x250 [ 136.395351][ T7279] ? alloc_netdev_mqs+0xd40/0x15c0 [ 136.395408][ T7279] alloc_netdev_mqs+0xd40/0x15c0 [ 136.395431][ T7279] rtnl_create_link+0xc13/0xf80 [ 136.395454][ T7279] rtnl_newlink+0x15bc/0x2620 [ 136.395482][ T7279] ? __pfx_rtnl_newlink+0x10/0x10 [ 136.395504][ T7279] ? rcu_is_watching+0x13/0xc0 [ 136.395546][ T7279] ? lock_acquire+0x1b9/0x370 [ 136.395573][ T7279] ? find_held_lock+0x2b/0x80 [ 136.395596][ T7279] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 136.395614][ T7279] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 136.395635][ T7279] ? __pfx_rtnl_newlink+0x10/0x10 [ 136.395653][ T7279] rtnetlink_rcv_msg+0x95e/0xe90 [ 136.395675][ T7279] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 136.395696][ T7279] ? __pfx_clockevents_program_event+0x10/0x10 [ 136.395722][ T7279] ? find_held_lock+0x2b/0x80 [ 136.395745][ T7279] ? __hrtimer_rearm_deferred+0x23c/0x7b0 [ 136.395770][ T7279] ? __hrtimer_rearm_deferred+0x23c/0x7b0 [ 136.395799][ T7279] netlink_rcv_skb+0x159/0x420 [ 136.395826][ T7279] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 136.395847][ T7279] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 136.395869][ T7279] ? irqentry_exit+0x24d/0xa10 [ 136.395948][ T7279] ? __pfx_rtnetlink_rcv+0x10/0x10 [ 136.395975][ T7279] ? netlink_unicast+0x55b/0x850 [ 136.396001][ T7279] netlink_unicast+0x585/0x850 [ 136.396029][ T7279] ? __pfx_netlink_unicast+0x10/0x10 [ 136.396058][ T7279] netlink_sendmsg+0x8b0/0xda0 [ 136.396086][ T7279] ? __pfx_netlink_sendmsg+0x10/0x10 [ 136.396114][ T7279] ? apparmor_socket_sendmsg+0x15b/0x270 [ 136.396137][ T7279] ____sys_sendmsg+0xa4d/0xbe0 [ 136.396159][ T7279] ? __pfx_netlink_sendmsg+0x10/0x10 [ 136.396184][ T7279] ? __pfx_____sys_sendmsg+0x10/0x10 [ 136.396217][ T7279] ___sys_sendmsg+0x190/0x1e0 [ 136.396250][ T7279] ? __pfx____sys_sendmsg+0x10/0x10 [ 136.396284][ T7279] ? find_held_lock+0x2b/0x80 [ 136.396324][ T7279] __sys_sendmsg+0x160/0x210 [ 136.396344][ T7279] ? __pfx___sys_sendmsg+0x10/0x10 [ 136.396368][ T7279] ? __pfx_ksys_write+0x10/0x10 [ 136.396392][ T7279] __do_fast_syscall_32+0x13a/0x8b0 [ 136.396412][ T7279] ? lockdep_hardirqs_on+0x7d/0x110 [ 136.396430][ T7279] do_fast_syscall_32+0x32/0x70 [ 136.396450][ T7279] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 136.396471][ T7279] RIP: 0023:0xf7f23fec [ 136.396565][ T7279] Code: Unable to access opcode bytes at 0xf7f23fc2. [ 136.396583][ T7279] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 136.396602][ T7279] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 136.396613][ T7279] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 136.396623][ T7279] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 136.396632][ T7279] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 136.396641][ T7279] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 136.396664][ T7279] [ 136.501428][ T7284] netlink: 'syz.1.337': attribute type 1 has an invalid length. [ 136.544122][ T6167] usb 5-1: device descriptor read/8, error -71 [ 136.621094][ T7284] bond5: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 136.627708][ T7287] netlink: 'syz.2.335': attribute type 1 has an invalid length. [ 136.649997][ T7284] bond5 (unregistering): Released all slaves [ 136.689202][ T7287] bond4: entered promiscuous mode [ 136.691900][ T7287] 8021q: adding VLAN 0 to HW filter on device bond4 [ 136.719701][ T7288] bridge1: entered promiscuous mode [ 136.761907][ T7288] bond4: (slave bridge1): making interface the new active one [ 136.765926][ T7288] bond4: (slave bridge1): Enslaving as an active interface with an up link [ 136.782210][ T7281] overlay: Unknown parameter '/' [ 136.801635][ T6167] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 136.825077][ T6167] usb 5-1: device descriptor read/8, error -71 [ 136.887364][ T7294] FAULT_INJECTION: forcing a failure. [ 136.887364][ T7294] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 136.893796][ T7294] CPU: 0 UID: 0 PID: 7294 Comm: syz.1.339 Not tainted syzkaller #0 PREEMPT(full) [ 136.893823][ T7294] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 136.893834][ T7294] Call Trace: [ 136.893841][ T7294] [ 136.893849][ T7294] dump_stack_lvl+0x100/0x190 [ 136.893875][ T7294] should_fail_ex.cold+0x5/0xa [ 136.893896][ T7294] _copy_from_iter+0x1f4/0x1690 [ 136.893919][ T7294] ? __asan_memset+0x23/0x50 [ 136.893939][ T7294] ? __pfx__copy_from_iter+0x10/0x10 [ 136.893958][ T7294] ? __pfx___alloc_skb+0x10/0x10 [ 136.893984][ T7294] netlink_sendmsg+0x808/0xda0 [ 136.894012][ T7294] ? __pfx_netlink_sendmsg+0x10/0x10 [ 136.894040][ T7294] ? apparmor_socket_sendmsg+0x15b/0x270 [ 136.894062][ T7294] ____sys_sendmsg+0xa4d/0xbe0 [ 136.894084][ T7294] ? __pfx_netlink_sendmsg+0x10/0x10 [ 136.894131][ T7294] ? __pfx_____sys_sendmsg+0x10/0x10 [ 136.894165][ T7294] ___sys_sendmsg+0x190/0x1e0 [ 136.894188][ T7294] ? __pfx____sys_sendmsg+0x10/0x10 [ 136.894219][ T7294] ? find_held_lock+0x2b/0x80 [ 136.894257][ T7294] __sys_sendmsg+0x160/0x210 [ 136.894276][ T7294] ? __pfx___sys_sendmsg+0x10/0x10 [ 136.894301][ T7294] ? __pfx_ksys_write+0x10/0x10 [ 136.894332][ T7294] __do_fast_syscall_32+0x13a/0x8b0 [ 136.894353][ T7294] ? lockdep_hardirqs_on+0x7d/0x110 [ 136.894373][ T7294] do_fast_syscall_32+0x32/0x70 [ 136.894394][ T7294] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 136.894417][ T7294] RIP: 0023:0xf7f23fec [ 136.894440][ T7294] Code: Unable to access opcode bytes at 0xf7f23fc2. [ 136.894449][ T7294] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 136.894493][ T7294] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800005c0 [ 136.894505][ T7294] RDX: 0000000000000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 136.894516][ T7294] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 136.894526][ T7294] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 136.894536][ T7294] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 136.894556][ T7294] [ 136.952369][ T6167] usb usb5-port1: unable to enumerate USB device [ 137.084689][ T7300] CIFS mount error: No usable UNC path provided in device string! [ 137.084689][ T7300] [ 137.089045][ T7300] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 137.392387][ T7305] Bluetooth: MGMT ver 1.23 [ 137.945010][ T7311] netlink: 4 bytes leftover after parsing attributes in process `syz.2.345'. [ 138.002405][ T7314] FAULT_INJECTION: forcing a failure. [ 138.002405][ T7314] name failslab, interval 1, probability 0, space 0, times 0 [ 138.029097][ T7314] CPU: 0 UID: 0 PID: 7314 Comm: syz.2.346 Not tainted syzkaller #0 PREEMPT(full) [ 138.029128][ T7314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 138.029141][ T7314] Call Trace: [ 138.029148][ T7314] [ 138.029155][ T7314] dump_stack_lvl+0x100/0x190 [ 138.029185][ T7314] should_fail_ex.cold+0x5/0xa [ 138.029209][ T7314] should_failslab+0xc2/0x120 [ 138.029236][ T7314] __kmalloc_node_noprof+0x101/0x830 [ 138.029262][ T7314] ? __get_vm_area_node+0x1ff/0x350 [ 138.029288][ T7314] ? __get_vm_area_node+0x22b/0x350 [ 138.029314][ T7314] ? __vmalloc_node_range_noprof+0x409/0x1630 [ 138.029348][ T7314] __vmalloc_node_range_noprof+0x409/0x1630 [ 138.029379][ T7314] ? __pfx_format_decode+0x10/0x10 [ 138.029405][ T7314] ? kasan_save_stack+0x3f/0x50 [ 138.029430][ T7314] ? __kasan_kmalloc+0xaa/0xb0 [ 138.029456][ T7314] ? bpf_prog_calc_tag+0x63/0x340 [ 138.029482][ T7314] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 138.029511][ T7314] ? __pfx_vsnprintf+0x10/0x10 [ 138.029527][ T7314] ? bpf_check_btf_info+0x2dc/0x1de0 [ 138.029563][ T7314] ? bpf_prog_calc_tag+0x63/0x340 [ 138.029582][ T7314] __vmalloc_node_noprof+0xad/0xf0 [ 138.029612][ T7314] ? bpf_prog_calc_tag+0x63/0x340 [ 138.029632][ T7314] __vmalloc_noprof+0xa3/0x120 [ 138.029660][ T7314] ? __pfx___vmalloc_noprof+0x10/0x10 [ 138.029688][ T7314] ? __pfx_verbose+0x10/0x10 [ 138.029722][ T7314] ? __pfx_cmp_subprogs+0x10/0x10 [ 138.029766][ T7314] bpf_prog_calc_tag+0x63/0x340 [ 138.029788][ T7314] bpf_check+0x5daf/0xa7c0 [ 138.029810][ T7314] ? __lock_acquire+0x4c5/0x1ec0 [ 138.029831][ T7314] ? __pfx___css_rstat_updated+0x10/0x10 [ 138.029868][ T7314] ? __pfx_bpf_check+0x10/0x10 [ 138.029890][ T7314] ? find_held_lock+0x2b/0x80 [ 138.029915][ T7314] ? bpf_prog_load+0x1a09/0x2a80 [ 138.029938][ T7314] ? __asan_memset+0x23/0x50 [ 138.029960][ T7314] ? bpf_prog_load+0x1ac3/0x2a80 [ 138.029976][ T7314] bpf_prog_load+0x1ac3/0x2a80 [ 138.030002][ T7314] ? __pfx_bpf_prog_load+0x10/0x10 [ 138.030040][ T7314] __sys_bpf+0x1f46/0x4a30 [ 138.030070][ T7314] ? __pfx___sys_bpf+0x10/0x10 [ 138.030098][ T7314] ? find_held_lock+0x2b/0x80 [ 138.030123][ T7314] ? get_pid_task+0xfc/0x250 [ 138.030148][ T7314] ? get_pid_task+0xfc/0x250 [ 138.030177][ T7314] ? proc_fail_nth_write+0x9f/0x220 [ 138.030196][ T7314] ? find_held_lock+0x2b/0x80 [ 138.030228][ T7314] ? rcu_read_lock_any_held+0x6a/0x90 [ 138.030257][ T7314] ? find_held_lock+0x2b/0x80 [ 138.030284][ T7314] ? ksys_write+0x190/0x250 [ 138.030304][ T7314] ? ksys_write+0x190/0x250 [ 138.030342][ T7314] ? fput+0x7c/0x100 [ 138.030368][ T7314] ? __ia32_sys_bpf+0xcc/0x170 [ 138.030393][ T7314] __ia32_sys_bpf+0xcc/0x170 [ 138.030421][ T7314] ? __do_fast_syscall_32+0xb3/0x8b0 [ 138.030443][ T7314] __do_fast_syscall_32+0x13a/0x8b0 [ 138.030488][ T7314] ? lockdep_hardirqs_on+0x7d/0x110 [ 138.030509][ T7314] do_fast_syscall_32+0x32/0x70 [ 138.030532][ T7314] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 138.030558][ T7314] RIP: 0023:0xf709efec [ 138.030584][ T7314] Code: Unable to access opcode bytes at 0xf709efc2. [ 138.030593][ T7314] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 138.030612][ T7314] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000340 [ 138.030625][ T7314] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 138.030635][ T7314] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 138.030645][ T7314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 138.030656][ T7314] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 138.030682][ T7314] [ 138.259415][ T7314] syz.2.346: vmalloc error: size 4096, failed to allocated page array size 8, mode:0x400cc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 138.267932][ T7314] CPU: 0 UID: 0 PID: 7314 Comm: syz.2.346 Not tainted syzkaller #0 PREEMPT(full) [ 138.267953][ T7314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 138.267963][ T7314] Call Trace: [ 138.267970][ T7314] [ 138.267977][ T7314] dump_stack_lvl+0x100/0x190 [ 138.268005][ T7314] warn_alloc.cold+0x94/0xa8 [ 138.268023][ T7314] ? __pfx_warn_alloc+0x10/0x10 [ 138.268044][ T7314] ? dump_stack_lvl+0x17c/0x190 [ 138.268063][ T7314] ? rcu_is_watching+0x13/0xc0 [ 138.268085][ T7314] ? __kasan_kmalloc+0x8a/0xb0 [ 138.268104][ T7314] ? __kmalloc_node_noprof+0x359/0x830 [ 138.268123][ T7314] ? __get_vm_area_node+0x1ff/0x350 [ 138.268145][ T7314] ? __get_vm_area_node+0x22b/0x350 [ 138.268169][ T7314] ? __vmalloc_node_range_noprof+0x409/0x1630 [ 138.268201][ T7314] __vmalloc_node_range_noprof+0x1394/0x1630 [ 138.268229][ T7314] ? __pfx_format_decode+0x10/0x10 [ 138.268254][ T7314] ? kasan_save_stack+0x3f/0x50 [ 138.268278][ T7314] ? __kasan_kmalloc+0xaa/0xb0 [ 138.268301][ T7314] ? bpf_prog_calc_tag+0x63/0x340 [ 138.268327][ T7314] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 138.268357][ T7314] ? __pfx_vsnprintf+0x10/0x10 [ 138.268390][ T7314] ? bpf_check_btf_info+0x2dc/0x1de0 [ 138.268424][ T7314] ? bpf_prog_calc_tag+0x63/0x340 [ 138.268443][ T7314] __vmalloc_node_noprof+0xad/0xf0 [ 138.268470][ T7314] ? bpf_prog_calc_tag+0x63/0x340 [ 138.268491][ T7314] __vmalloc_noprof+0xa3/0x120 [ 138.268519][ T7314] ? __pfx___vmalloc_noprof+0x10/0x10 [ 138.268543][ T7314] ? __pfx_verbose+0x10/0x10 [ 138.268570][ T7314] ? __pfx_cmp_subprogs+0x10/0x10 [ 138.268598][ T7314] bpf_prog_calc_tag+0x63/0x340 [ 138.268620][ T7314] bpf_check+0x5daf/0xa7c0 [ 138.268641][ T7314] ? __lock_acquire+0x4c5/0x1ec0 [ 138.268661][ T7314] ? __pfx___css_rstat_updated+0x10/0x10 [ 138.268695][ T7314] ? __pfx_bpf_check+0x10/0x10 [ 138.268723][ T7314] ? find_held_lock+0x2b/0x80 [ 138.268747][ T7314] ? bpf_prog_load+0x1a09/0x2a80 [ 138.268768][ T7314] ? __asan_memset+0x23/0x50 [ 138.268789][ T7314] ? bpf_prog_load+0x1ac3/0x2a80 [ 138.268805][ T7314] bpf_prog_load+0x1ac3/0x2a80 [ 138.268827][ T7314] ? __pfx_bpf_prog_load+0x10/0x10 [ 138.268862][ T7314] __sys_bpf+0x1f46/0x4a30 [ 138.268892][ T7314] ? __pfx___sys_bpf+0x10/0x10 [ 138.268918][ T7314] ? find_held_lock+0x2b/0x80 [ 138.268943][ T7314] ? get_pid_task+0xfc/0x250 [ 138.268969][ T7314] ? get_pid_task+0xfc/0x250 [ 138.269000][ T7314] ? proc_fail_nth_write+0x9f/0x220 [ 138.269017][ T7314] ? find_held_lock+0x2b/0x80 [ 138.269043][ T7314] ? rcu_read_lock_any_held+0x6a/0x90 [ 138.269069][ T7314] ? find_held_lock+0x2b/0x80 [ 138.269093][ T7314] ? ksys_write+0x190/0x250 [ 138.269111][ T7314] ? ksys_write+0x190/0x250 [ 138.269144][ T7314] ? fput+0x7c/0x100 [ 138.269167][ T7314] ? __ia32_sys_bpf+0xcc/0x170 [ 138.269190][ T7314] __ia32_sys_bpf+0xcc/0x170 [ 138.269214][ T7314] ? __do_fast_syscall_32+0xb3/0x8b0 [ 138.269260][ T7314] __do_fast_syscall_32+0x13a/0x8b0 [ 138.269278][ T7314] ? lockdep_hardirqs_on+0x7d/0x110 [ 138.269297][ T7314] do_fast_syscall_32+0x32/0x70 [ 138.269317][ T7314] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 138.269339][ T7314] RIP: 0023:0xf709efec [ 138.269366][ T7314] Code: Unable to access opcode bytes at 0xf709efc2. [ 138.269374][ T7314] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 138.269392][ T7314] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000340 [ 138.269403][ T7314] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 138.269415][ T7314] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 138.269427][ T7314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 138.269437][ T7314] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 138.269460][ T7314] [ 138.269625][ T7314] Mem-Info: [ 138.427276][ T7314] active_anon:4851 inactive_anon:293 isolated_anon:0 [ 138.427276][ T7314] active_file:869 inactive_file:53052 isolated_file:0 [ 138.427276][ T7314] unevictable:1000 dirty:475 writeback:0 [ 138.427276][ T7314] slab_reclaimable:6996 slab_unreclaimable:53417 [ 138.427276][ T7314] mapped:24031 shmem:1503 pagetables:1114 [ 138.427276][ T7314] sec_pagetables:290 bounce:0 [ 138.427276][ T7314] kernel_misc_reclaimable:0 [ 138.427276][ T7314] free:45153 free_pcp:12918 free_cma:0 [ 138.447656][ T7314] Node 0 active_anon:240kB inactive_anon:40kB active_file:8kB inactive_file:3808kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:604kB dirty:340kB writeback:0kB shmem:4kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8576kB pagetables:1552kB sec_pagetables:1116kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 138.468334][ T7314] Node 1 active_anon:19164kB inactive_anon:1132kB active_file:3468kB inactive_file:208400kB unevictable:4000kB isolated(anon):0kB isolated(file):0kB mapped:95520kB dirty:1560kB writeback:0kB shmem:6008kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5312kB pagetables:2888kB sec_pagetables:44kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 138.489065][ T7314] Node 0 DMA free:2024kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:124kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:536kB local_pcp:68kB free_cma:0kB [ 138.506068][ T7314] lowmem_reserve[]: 0 279 279 279 279 [ 138.507930][ T7314] Node 0 DMA32 free:16860kB boost:0kB min:12648kB low:15808kB high:18968kB reserved_highatomic:0KB free_highatomic:0KB active_anon:240kB inactive_anon:40kB active_file:8kB inactive_file:3684kB unevictable:0kB writepending:340kB zspages:0kB present:1032196kB managed:285924kB mlocked:0kB bounce:0kB free_pcp:8796kB local_pcp:1220kB free_cma:0kB [ 138.520184][ T7314] lowmem_reserve[]: 0 0 0 0 0 [ 138.521778][ T7314] Node 1 DMA32 free:161728kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:19164kB inactive_anon:1132kB active_file:3468kB inactive_file:208400kB unevictable:4000kB writepending:1560kB zspages:2964kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:43644kB local_pcp:23420kB free_cma:0kB [ 138.534837][ T7314] lowmem_reserve[]: 0 0 0 0 0 [ 138.536771][ T7314] Node 0 DMA: 6*4kB (U) 14*8kB (UM) 2*16kB (U) 10*32kB (UM) 2*64kB (U) 1*128kB (U) 1*256kB (M) 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 2024kB [ 138.542538][ T7314] Node 0 DMA32: 163*4kB (UME) 84*8kB (UME) 21*16kB (UME) 43*32kB (UE) 12*64kB (UME) 8*128kB (UE) 11*256kB (UME) 8*512kB (UME) 3*1024kB (UM) 1*2048kB (M) 0*4096kB = 16860kB [ 138.549607][ T7314] Node 1 DMA32: 1168*4kB (UM) 398*8kB (UME) 211*16kB (UM) 420*32kB (UME) 338*64kB (UME) 198*128kB (UME) 102*256kB (UME) 47*512kB (ME) 15*1024kB (ME) 6*2048kB (UME) 3*4096kB (UM) = 161760kB [ 138.556803][ T7314] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 138.561362][ T7314] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 138.564658][ T7314] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 138.568184][ T7314] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 138.577213][ T7314] 55840 total pagecache pages [ 138.579346][ T7314] 419 pages in swap cache [ 138.581791][ T7314] Free swap = 117792kB [ 138.583626][ T7314] Total swap = 124996kB [ 138.585429][ T7314] 524155 pages RAM [ 138.587227][ T7314] 0 pages HighMem/MovableOnly [ 138.589282][ T7314] 211781 pages reserved [ 138.591868][ T7314] 0 pages cma reserved [ 138.982398][ T7331] 9p: Bad value for 'rfdno' [ 139.003330][ T7331] Console: switching to colour dummy device 80x25 [ 139.099380][ T7334] input: syz0 as /devices/virtual/input/input13 [ 139.514428][ T7332] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 139.548030][ T7332] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 139.552914][ T7332] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 139.556981][ T7332] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 139.569603][ T7332] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 139.852602][ T7332] pci 0000:00:01.0: Adding to iommu group 1 [ 140.180004][ T7350] netlink: 12 bytes leftover after parsing attributes in process `syz.0.355'. [ 140.190021][ T7350] netlink: 12 bytes leftover after parsing attributes in process `syz.0.355'. [ 140.191611][ T7332] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 140.196558][ T7332] pci 0000:00:01.0: vgaarb: bridge control possible [ 140.199185][ T7332] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 140.218885][ T7332] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 140.222491][ T7332] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 140.227299][ T7332] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 140.241833][ T7332] [drm] Found bochs VGA, ID 0xb0c5. [ 140.244598][ T7332] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 140.249459][ T7332] bochs-drm 0000:00:01.0: probe with driver bochs-drm failed with error -4 [ 140.274902][ T7351] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 140.368579][ T7351] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 140.371936][ T7351] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 140.381506][ T7351] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 140.388184][ T7351] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 140.403532][ T7351] pci 0000:00:01.0: pci_fixup_video+0x0/0x280 took 15126 usecs [ 140.562310][ T7351] pci 0000:00:01.0: Adding to iommu group 1 [ 140.570664][ T7351] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 140.573290][ T7351] pci 0000:00:01.0: vgaarb: bridge control possible [ 140.575836][ T7351] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 140.591499][ T7351] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 140.595261][ T7351] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 140.600573][ T7351] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 140.943230][ T7351] [drm] Found bochs VGA, ID 0xb0c5. [ 140.945466][ T7351] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 140.965321][ T7351] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 141.105839][ T7351] Console: switching to colour frame buffer device 160x50 [ 141.151594][ T7351] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 141.947442][ T7379] input: syz0 as /devices/virtual/input/input14 [ 142.439159][ T7389] netlink: 'syz.0.365': attribute type 1 has an invalid length. [ 142.462515][ T7389] bond4: entered promiscuous mode [ 142.465256][ T7389] 8021q: adding VLAN 0 to HW filter on device bond4 [ 142.759429][ T7392] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input15 [ 142.782884][ T7384] overlay: Unknown parameter '/v98PIx@Q3}g{.$߂ ugG1e [ 154.240823][ T7600] dump_stack_lvl+0x100/0x190 [ 154.240851][ T7600] should_fail_ex.cold+0x5/0xa [ 154.240882][ T7600] _copy_to_user+0x32/0xd0 [ 154.240958][ T7600] simple_read_from_buffer+0xcb/0x170 [ 154.240979][ T7600] proc_fail_nth_read+0x1af/0x230 [ 154.240997][ T7600] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 154.241016][ T7600] ? rw_verify_area+0xce/0x6d0 [ 154.241041][ T7600] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 154.241058][ T7600] vfs_read+0x1e4/0xb40 [ 154.241078][ T7600] ? __pfx_vfs_read+0x10/0x10 [ 154.241093][ T7600] ? find_held_lock+0x2b/0x80 [ 154.241117][ T7600] ? __fget_files+0x215/0x3d0 [ 154.241138][ T7600] ? __fget_files+0x21f/0x3d0 [ 154.241162][ T7600] ksys_read+0x12a/0x250 [ 154.241178][ T7600] ? __pfx_ksys_read+0x10/0x10 [ 154.241199][ T7600] do_int80_emulation+0x166/0x650 [ 154.241219][ T7600] asm_int80_emulation+0x1a/0x20 [ 154.241236][ T7600] RIP: 0023:0xf71a74eb [ 154.241252][ T7600] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 154.241267][ T7600] RSP: 002b:00000000f545d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 154.241303][ T7600] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000f545d5d0 [ 154.241313][ T7600] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 154.241322][ T7600] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 154.241332][ T7600] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 154.241342][ T7600] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 154.241364][ T7600] [ 154.380008][ T1034] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 154.529932][ T1034] usb 6-1: Using ep0 maxpacket: 8 [ 154.533064][ T1034] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000c, bcdDevice= 0.40 [ 154.545390][ T1034] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.550761][ T1034] usb 6-1: Product: syz [ 154.552630][ T1034] usb 6-1: Manufacturer: syz [ 154.562099][ T1034] usb 6-1: SerialNumber: syz [ 155.249997][ T10] wiimote 0005:057E:0306.0003: detected device: Nintendo Wii Remote (Gen 1) [ 155.535955][ T10] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0003/input/input18 [ 155.569694][ T10] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0003/input/input19 [ 155.619193][ T7610] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 155.619956][ T7612] syz_tun: entered allmulticast mode [ 155.631783][ T10] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0003/input/input17 [ 155.681890][ T7610] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 155.684754][ T7612] lo: entered allmulticast mode [ 155.691480][ T7610] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 155.694160][ T7610] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 155.697370][ T7610] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 155.733830][ T7611] syz_tun: left allmulticast mode [ 155.735982][ T7611] lo: left allmulticast mode [ 155.784653][ T7610] pci 0000:00:01.0: Adding to iommu group 1 [ 155.791256][ T1034] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 155.793156][ T7590] wiimote 0005:057E:0306.0003: Device removed [ 155.799260][ T7610] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 155.801549][ T7610] pci 0000:00:01.0: vgaarb: bridge control possible [ 155.804127][ T7610] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 155.830451][ T7610] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 155.833651][ T7610] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 155.836715][ T7610] pci 0000:00:04.0: PCI bridge to [bus 01] [ 155.839089][ T7610] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 155.843806][ T7610] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 155.848047][ T7610] pci 0000:00:04.0: bridge window [mem 0xfe000000-0xfe1fffff 64bit pref] [ 155.857979][ T7610] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 155.871576][ T7610] [drm] Found bochs VGA, ID 0xb0c5. [ 155.874189][ T7610] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 155.879127][ T7610] bochs-drm 0000:00:01.0: probe with driver bochs-drm failed with error -4 [ 155.891466][ T7622] netlink: 'syz.3.411': attribute type 1 has an invalid length. [ 155.914772][ T7622] bond3: entered promiscuous mode [ 155.917588][ T7622] 8021q: adding VLAN 0 to HW filter on device bond3 [ 155.933789][ T1034] usb 6-1: USB disconnect, device number 3 [ 155.973721][ T7622] overlay: Unknown parameter '/' [ 155.997217][ T7622] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 156.000423][ T7622] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 156.032231][ T5738] udevd[5738]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 156.113656][ T7629] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 156.117454][ T7631] input: syz0 as /devices/virtual/input/input20 [ 156.140222][ T5887] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 156.176244][ T7629] nvme_fc: nvme_fc_create_ctrl: nn-0x3333333333333333:pn-0x4444444444444444 - nn-0x1111111111111111:pn-0x2222222222222222 combination not found [ 156.186295][ T7629] 9pnet_virtio: no channels available for device 127.0.0.1 [ 156.290002][ T5887] usb 7-1: Using ep0 maxpacket: 8 [ 156.294857][ T5887] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 156.301857][ T5887] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 156.305373][ T5887] usb 7-1: config 16 has an invalid interface number: 23 but max is 0 [ 156.308599][ T5887] usb 7-1: config 16 has no interface number 0 [ 156.310762][ T5887] usb 7-1: config 16 interface 23 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 156.313862][ T5887] usb 7-1: config 16 interface 23 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 156.318566][ T5887] usb 7-1: config 16 interface 23 altsetting 0 endpoint 0x8B has invalid maxpacket 43552, setting to 1024 [ 156.322617][ T5887] usb 7-1: config 16 interface 23 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 156.326230][ T5887] usb 7-1: config 16 interface 23 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 156.331322][ T5887] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 156.376644][ T7636] lo speed is unknown, defaulting to 1000 [ 156.541121][ T5887] usb 7-1: usb_control_msg returned -32 [ 156.542953][ T5887] usbtmc 7-1:16.23: can't read capabilities [ 156.917921][ T7648] usbtmc 7-1:16.23: usb_control_msg returned -32 [ 156.941651][ T7621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 156.971111][ T7621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 157.183465][ T7621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 157.195646][ T7621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 157.406585][ T7621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 157.420502][ T7621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 157.438500][ T5887] usb 7-1: USB disconnect, device number 2 [ 158.183657][ T7655] loop6: detected capacity change from 0 to 2640 [ 158.188473][ T7655] buffer_io_error: 31 callbacks suppressed [ 158.188549][ T7655] Buffer I/O error on dev loop6, logical block 0, async page read [ 158.194451][ T7655] Buffer I/O error on dev loop6, logical block 0, async page read [ 158.198131][ T7655] Buffer I/O error on dev loop6, logical block 0, async page read [ 158.201575][ T7655] Buffer I/O error on dev loop6, logical block 0, async page read [ 158.320422][ T7655] Buffer I/O error on dev loop6, logical block 0, async page read [ 158.324408][ T7655] Buffer I/O error on dev loop6, logical block 0, async page read [ 158.329218][ T7655] Buffer I/O error on dev loop6, logical block 0, async page read [ 158.332862][ T7655] Buffer I/O error on dev loop6, logical block 0, async page read [ 158.336866][ T7655] ldm_validate_partition_table(): Disk read failed. [ 158.339614][ T7655] Buffer I/O error on dev loop6, logical block 0, async page read [ 158.345225][ T7655] Buffer I/O error on dev loop6, logical block 0, async page read [ 158.352838][ T7655] Dev loop6: unable to read RDB block 0 [ 158.355333][ T7655] loop6: unable to read partition table [ 158.359216][ T7655] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 159.188391][ T42] kauditd_printk_skb: 25 callbacks suppressed [ 159.188553][ T42] audit: type=1326 audit(1787299404.776:363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7661 comm="syz.2.422" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 159.201330][ T42] audit: type=1326 audit(1787299404.776:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7661 comm="syz.2.422" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 159.210546][ T42] audit: type=1326 audit(1787299404.776:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7661 comm="syz.2.422" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf709efec code=0x7ffc0000 [ 159.220197][ T42] audit: type=1326 audit(1787299404.776:366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7661 comm="syz.2.422" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 159.228552][ T42] audit: type=1326 audit(1787299404.776:367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7661 comm="syz.2.422" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 159.237279][ T42] audit: type=1326 audit(1787299404.776:368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7661 comm="syz.2.422" exe="/syz-executor" sig=0 arch=40000003 syscall=242 compat=1 ip=0xf709efec code=0x7ffc0000 [ 159.245789][ T42] audit: type=1326 audit(1787299404.776:369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7661 comm="syz.2.422" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 159.254614][ T42] audit: type=1326 audit(1787299404.776:370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7661 comm="syz.2.422" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 159.272741][ T42] audit: type=1326 audit(1787299404.776:371): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7661 comm="syz.2.422" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf709efec code=0x7ffc0000 [ 159.287437][ T42] audit: type=1326 audit(1787299404.776:372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7661 comm="syz.2.422" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 159.307900][ T7667] lo speed is unknown, defaulting to 1000 [ 159.352144][ T7670] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 159.390037][ T7670] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 159.393604][ T7670] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 159.397449][ T7670] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 159.403260][ T7670] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 159.428819][ T7670] pci 0000:00:01.0: Adding to iommu group 1 [ 159.438616][ T7670] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 159.441959][ T7670] pci 0000:00:01.0: vgaarb: bridge control possible [ 159.444797][ T7670] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 159.467295][ T7670] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 159.471443][ T7670] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 159.475467][ T7670] pci 0000:00:04.0: PCI bridge to [bus 01] [ 159.478437][ T7670] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 159.485248][ T7670] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 159.493733][ T7670] pci 0000:00:04.0: bridge window [mem 0xfe000000-0xfe1fffff 64bit pref] [ 159.499703][ T7667] FAULT_INJECTION: forcing a failure. [ 159.499703][ T7667] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 159.507781][ T7670] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 159.508023][ T7667] CPU: 3 UID: 0 PID: 7667 Comm: syz.3.423 Not tainted syzkaller #0 PREEMPT(full) [ 159.508050][ T7667] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 159.508069][ T7667] Call Trace: [ 159.508128][ T7667] [ 159.508137][ T7667] dump_stack_lvl+0x100/0x190 [ 159.508235][ T7667] should_fail_ex.cold+0x5/0xa [ 159.508260][ T7667] _copy_from_user+0x2e/0xd0 [ 159.508314][ T7667] get_compat_msghdr+0xb3/0x480 [ 159.508372][ T7667] ? __pfx_get_compat_msghdr+0x10/0x10 [ 159.508406][ T7667] ___sys_sendmsg+0x1b6/0x1e0 [ 159.508440][ T7667] ? __pfx____sys_sendmsg+0x10/0x10 [ 159.508478][ T7667] ? find_held_lock+0x2b/0x80 [ 159.508522][ T7667] __sys_sendmsg+0x160/0x210 [ 159.508545][ T7667] ? __pfx___sys_sendmsg+0x10/0x10 [ 159.508572][ T7667] ? __pfx_ksys_write+0x10/0x10 [ 159.508598][ T7667] __do_fast_syscall_32+0x13a/0x8b0 [ 159.508669][ T7667] ? lockdep_hardirqs_on+0x7d/0x110 [ 159.508690][ T7667] do_fast_syscall_32+0x32/0x70 [ 159.508712][ T7667] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 159.508738][ T7667] RIP: 0023:0xf706efec [ 159.508810][ T7667] Code: Unable to access opcode bytes at 0xf706efc2. [ 159.508857][ T7667] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 159.508878][ T7667] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800002c0 [ 159.508889][ T7667] RDX: 0000000000000090 RSI: 0000000000000000 RDI: 0000000000000000 [ 159.508900][ T7667] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 159.508911][ T7667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 159.508922][ T7667] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 159.508947][ T7667] [ 159.584600][ T7670] [drm] Found bochs VGA, ID 0xb0c5. [ 159.586465][ T7670] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 159.610090][ T7670] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 159.739117][ T7670] Console: switching to colour frame buffer device 160x50 [ 159.778158][ T7670] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 160.184211][ T7686] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 161.672034][ T7708] block nbd0: server does not support multiple connections per device. [ 161.682498][ T7708] block nbd0: shutting down sockets [ 161.911722][ T7715] input: syz0 as /devices/virtual/input/input21 [ 162.395576][ T7733] netlink: 4 bytes leftover after parsing attributes in process `syz.3.438'. [ 162.537589][ T7727] syz_tun: entered allmulticast mode [ 162.541117][ T7731] lo: entered allmulticast mode [ 162.566588][ T7724] syz_tun: left allmulticast mode [ 162.568506][ T7724] lo: left allmulticast mode [ 163.757369][ T7748] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 163.762845][ T7753] netlink: 'syz.3.443': attribute type 1 has an invalid length. [ 163.799304][ T7753] bond4: entered promiscuous mode [ 163.809260][ T7753] 8021q: adding VLAN 0 to HW filter on device bond4 [ 163.836806][ T7753] overlay: Unknown parameter '/v98PIx@Q3}g{.$߂ ugG1e 9 [ 166.724296][ T7816] loop6: detected capacity change from 0 to 2640 [ 166.736782][ T7816] ldm_validate_partition_table(): Disk read failed. [ 166.742379][ T7816] Dev loop6: unable to read RDB block 0 [ 166.746450][ T7816] loop6: unable to read partition table [ 166.753194][ T7816] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 166.760863][ T7811] netlink: 12 bytes leftover after parsing attributes in process `syz.3.457'. [ 166.765128][ T7811] netlink: 12 bytes leftover after parsing attributes in process `syz.3.457'. [ 166.917046][ T7821] loop5: detected capacity change from 0 to 7 [ 167.100179][ T7821] Dev loop5: unable to read RDB block 7 [ 167.103074][ T7821] loop5: unable to read partition table [ 167.103148][ C2] invalid error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800800 phys_seg 1 prio class 2 [ 167.105600][ T7821] loop5: partition table beyond EOD, truncated [ 167.112749][ T7821] loop_reread_partitions: partition scan of loop5 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 167.471639][ T7825] block nbd0: server does not support multiple connections per device. [ 167.479191][ T7825] block nbd0: shutting down sockets [ 167.597823][ T7831] input: syz0 as /devices/virtual/input/input22 [ 167.704679][ T7839] netlink: 'syz.3.462': attribute type 1 has an invalid length. [ 167.746922][ T7839] bond5: entered promiscuous mode [ 167.749591][ T7839] 8021q: adding VLAN 0 to HW filter on device bond5 [ 167.915338][ T7830] overlay: Unknown parameter '/v98PIx@Q3}g{.$߂ ugG1e [ 175.755284][ T8011] dump_stack_lvl+0x100/0x190 [ 175.755390][ T8011] should_fail_ex.cold+0x5/0xa [ 175.755410][ T8011] _copy_from_user+0x2e/0xd0 [ 175.755455][ T8011] get_compat_msghdr+0xb3/0x480 [ 175.755517][ T8011] ? __pfx_get_compat_msghdr+0x10/0x10 [ 175.755541][ T8011] ? _kstrtoull+0x13c/0x1f0 [ 175.755563][ T8011] ? __pfx__kstrtoull+0x10/0x10 [ 175.755587][ T8011] ___sys_sendmsg+0x1b6/0x1e0 [ 175.755613][ T8011] ? __pfx____sys_sendmsg+0x10/0x10 [ 175.755636][ T8011] ? __lock_acquire+0x4c5/0x1ec0 [ 175.755680][ T8011] __sys_sendmmsg+0x309/0x440 [ 175.755700][ T8011] ? __pfx___sys_sendmmsg+0x10/0x10 [ 175.755718][ T8011] ? find_held_lock+0x2b/0x80 [ 175.755748][ T8011] ? __mutex_unlock_slowpath+0x35d/0x930 [ 175.755817][ T8011] ? fput+0x7c/0x100 [ 175.755838][ T8011] ? ksys_write+0x1ac/0x250 [ 175.755859][ T8011] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 175.755881][ T8011] ? lockdep_hardirqs_on+0x7d/0x110 [ 175.755896][ T8011] __do_fast_syscall_32+0x13a/0x8b0 [ 175.755914][ T8011] ? lockdep_hardirqs_on+0x7d/0x110 [ 175.755933][ T8011] do_fast_syscall_32+0x32/0x70 [ 175.755951][ T8011] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 175.755974][ T8011] RIP: 0023:0xf706efec [ 175.756040][ T8011] Code: Unable to access opcode bytes at 0xf706efc2. [ 175.756058][ T8011] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 175.756076][ T8011] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000440 [ 175.756087][ T8011] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 175.756097][ T8011] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 175.756107][ T8011] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 175.756116][ T8011] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 175.756147][ T8011] [ 175.789883][ T8000] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 175.869327][ T8000] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 175.873845][ T8000] pci 0000:00:04.0: PCI bridge to [bus 01] [ 175.876327][ T8000] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 175.881884][ T8000] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 175.887138][ T8000] pci 0000:00:04.0: bridge window [mem 0xfe000000-0xfe1fffff 64bit pref] [ 175.897084][ T8000] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 175.912674][ T8000] [drm] Found bochs VGA, ID 0xb0c5. [ 175.914921][ T8000] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 175.931077][ T8000] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 176.127449][ T8000] Console: switching to colour frame buffer device 160x50 [ 176.171360][ T8000] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 176.173291][ T8023] input: syz0 as /devices/virtual/input/input24 [ 176.467494][ T8032] netlink: 'syz.2.512': attribute type 1 has an invalid length. [ 176.485834][ T8035] input: syz0 as /devices/virtual/input/input25 [ 176.529872][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 176.533007][ C0] bridge0: topology change detected, propagating [ 176.540586][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 176.543530][ C0] bridge0: topology change detected, propagating [ 176.607978][ T8032] bond6: entered promiscuous mode [ 176.616982][ T8032] 8021q: adding VLAN 0 to HW filter on device bond6 [ 176.686014][ T8029] overlay: Unknown parameter '/v98PIx@Q3}g{.$߂ ugG1e [ 181.988111][ T8158] dump_stack_lvl+0x100/0x190 [ 181.988240][ T8158] dump_header+0xfb/0x606 [ 181.988264][ T8158] oom_kill_process.cold+0xd/0x330 [ 181.988285][ T8158] out_of_memory+0x340/0x14f0 [ 181.988334][ T8158] ? __pfx_out_of_memory+0x10/0x10 [ 181.988357][ T8158] mem_cgroup_out_of_memory+0xc6/0x130 [ 181.988378][ T8158] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 181.988398][ T8158] ? find_held_lock+0x2b/0x80 [ 181.988447][ T8158] ? do_raw_spin_unlock+0x145/0x1e0 [ 181.988472][ T8158] ? _raw_spin_unlock+0x28/0x50 [ 181.988544][ T8158] try_charge_memcg+0x6e1/0xdf0 [ 181.988577][ T8158] ? __pfx_try_charge_memcg+0x10/0x10 [ 181.988611][ T8158] ? find_held_lock+0x2b/0x80 [ 181.988635][ T8158] ? rcu_read_unlock+0x17/0x60 [ 181.988649][ T8158] ? rcu_read_unlock+0x17/0x60 [ 181.988677][ T8158] __memcg_slab_post_alloc_hook+0x46c/0x1160 [ 181.988715][ T8158] ? kasan_save_track+0x14/0x30 [ 181.988740][ T8158] kmem_cache_alloc_node_noprof+0x4fc/0x6b0 [ 181.988762][ T8158] ? copy_process+0x5f0/0x8370 [ 181.988787][ T8158] ? copy_process+0x6a2/0x8370 [ 181.988816][ T8158] copy_process+0x6a2/0x8370 [ 181.988842][ T8158] ? __pfx___futex_wait+0x10/0x10 [ 181.988867][ T8158] ? __pfx_try_to_wake_up+0x10/0x10 [ 181.988887][ T8158] ? futex_hash+0x311/0x400 [ 181.988916][ T8158] ? __pfx_copy_process+0x10/0x10 [ 181.988939][ T8158] ? futex_wake+0x4ea/0x5e0 [ 181.988975][ T8158] kernel_clone+0x176/0x9d0 [ 181.989000][ T8158] ? __pfx_kernel_clone+0x10/0x10 [ 181.989039][ T8158] __do_compat_sys_ia32_clone+0xd4/0x120 [ 181.989063][ T8158] ? __pfx___do_compat_sys_ia32_clone+0x10/0x10 [ 181.989104][ T8158] __do_fast_syscall_32+0x13a/0x8b0 [ 181.989129][ T8158] do_fast_syscall_32+0x32/0x70 [ 181.989149][ T8158] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 181.989171][ T8158] RIP: 0023:0xf7f23fec [ 181.989211][ T8158] Code: Unable to access opcode bytes at 0xf7f23fc2. [ 181.989231][ T8158] RSP: 002b:00000000f53e64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000078 [ 181.989252][ T8158] RAX: ffffffffffffffda RBX: 0000000000000011 RCX: 000000000000ff70 [ 181.989263][ T8158] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 181.989272][ T8158] RBP: 00000000f53e65ec R08: 0000000000000000 R09: 0000000000000000 [ 181.989280][ T8158] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 181.989287][ T8158] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 181.989305][ T8158] [ 181.989423][ T8158] memory: usage 4kB, limit 8kB, failcnt 65 [ 182.121735][ T8158] memory+swap: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 182.126917][ T8158] kmem: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 182.133450][ T8158] Memory cgroup stats for /syz1/test: [ 182.133661][ T8158] cache 0 [ 182.138193][ T8158] rss 0 [ 182.139518][ T8158] rss_huge 0 [ 182.141498][ T8158] shmem 0 [ 182.142923][ T8158] mapped_file 0 [ 182.144503][ T8158] dirty 0 [ 182.145985][ T8158] writeback 0 [ 182.147682][ T8158] workingset_refault_anon 0 [ 182.150544][ T8158] workingset_refault_file 0 [ 182.152882][ T8158] swap 0 [ 182.154294][ T8158] swapcached 0 [ 182.155957][ T8158] pgpgin 0 [ 182.157438][ T8158] pgpgout 0 [ 182.159075][ T8158] pgfault 0 [ 182.161515][ T8158] pgmajfault 0 [ 182.163751][ T8158] inactive_anon 0 [ 182.165572][ T8158] active_anon 0 [ 182.167361][ T8158] inactive_file 0 [ 182.169182][ T8158] active_file 0 [ 182.171640][ T8158] unevictable 0 [ 182.173345][ T8158] hierarchical_memory_limit 8192 [ 182.175717][ T8158] hierarchical_memsw_limit 9223372036854771712 [ 182.178593][ T8158] total_cache 0 [ 182.180976][ T8158] total_rss 0 [ 182.182899][ T8158] total_rss_huge 0 [ 182.184887][ T8158] total_shmem 0 [ 182.186563][ T8158] total_mapped_file 0 [ 182.188443][ T8158] total_dirty 0 [ 182.190770][ T8158] total_writeback 0 [ 182.192530][ T8158] total_workingset_refault_anon 0 [ 182.194882][ T8158] total_workingset_refault_file 0 [ 182.196993][ T8158] total_swap 0 [ 182.201634][ T8158] total_swapcached 0 [ 182.203579][ T8158] total_pgpgin 0 [ 182.205443][ T8158] total_pgpgout 0 [ 182.207460][ T8158] total_pgfault 0 [ 182.209422][ T8158] total_pgmajfault 0 [ 182.212258][ T8158] total_inactive_anon 0 [ 182.214191][ T8158] total_active_anon 0 [ 182.215969][ T8158] total_inactive_file 0 [ 182.217680][ T8158] total_active_file 0 [ 182.219418][ T8158] total_unevictable 0 [ 182.222823][ T8158] anon_cost 0 [ 182.224419][ T8158] file_cost 0 [ 182.226015][ T8158] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.544,pid=8157,uid=0 [ 182.239869][ T8158] Memory cgroup out of memory: Killed process 8157 (syz.1.544) total-vm:102024kB, anon-rss:916kB, file-rss:22952kB, shmem-rss:0kB, UID:0 pgtables:112kB oom_score_adj:1000 [ 182.546941][ T8169] netlink: 'syz.0.548': attribute type 11 has an invalid length. [ 182.574075][ T8171] netlink: 20 bytes leftover after parsing attributes in process `syz.1.549'. [ 182.606180][ T8173] netlink: 'syz.0.548': attribute type 10 has an invalid length. [ 182.629412][ T8173] syz_tun: entered promiscuous mode [ 182.651682][ T8173] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 182.951854][ T8186] input: syz0 as /devices/virtual/input/input27 [ 183.502794][ T8208] netlink: 84 bytes leftover after parsing attributes in process `syz.3.555'. [ 183.553401][ T42] audit: type=1400 audit(1787299429.146:492): apparmor="STATUS" info="failed to unpack profile" error=-71 profile="unconfined" name="unknown" pid=8210 comm="syz.0.557" name="unknown" offset=16 [ 183.693908][ T8218] netlink: 20 bytes leftover after parsing attributes in process `syz.0.559'. [ 183.748463][ T8219] comedi comedi0: pc212e: a I/O base address must be specified [ 183.752985][ T8219] loop5: detected capacity change from 0 to 7 [ 183.810650][ T8223] input: syz0 as /devices/virtual/input/input28 [ 184.018522][ T8219] Dev loop5: unable to read RDB block 7 [ 184.024524][ C0] invalid error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800800 phys_seg 1 prio class 2 [ 184.028897][ C0] buffer_io_error: 42 callbacks suppressed [ 184.028915][ C0] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 184.058703][ T8219] loop5: unable to read partition table [ 184.067840][ T8219] loop5: partition table beyond EOD, truncated [ 184.077837][ T8219] loop_reread_partitions: partition scan of loop5 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 184.326693][ T8237] comedi: valid board names for 8255 driver are: [ 184.329277][ T8237] 8255 [ 184.330775][ T8237] comedi: valid board names for vmk80xx driver are: [ 184.333658][ T8237] vmk80xx [ 184.334802][ T8237] comedi: valid board names for usbduxsigma driver are: [ 184.337088][ T8237] usbduxsigma [ 184.338240][ T8237] comedi: valid board names for usbduxfast driver are: [ 184.341560][ T8237] usbduxfast [ 184.343054][ T8237] comedi: valid board names for usbdux driver are: [ 184.346059][ T8237] usbdux [ 184.347443][ T8237] comedi: valid board names for ni6501 driver are: [ 184.354554][ T8237] ni6501 [ 184.355699][ T8237] comedi: valid board names for dt9812 driver are: [ 184.360271][ T8237] dt9812 [ 184.363235][ T8237] comedi: valid board names for ni_labpc_cs driver are: [ 184.368844][ T8237] ni_labpc_cs [ 184.371985][ T8237] comedi: valid board names for ni_daq_700 driver are: [ 184.376235][ T8240] input: syz1 as /devices/virtual/input/input29 [ 184.381223][ T8237] ni_daq_700 [ 184.382662][ T8237] comedi: valid board names for labpc_pci driver are: [ 184.397437][ T8243] loop5: detected capacity change from 0 to 7 [ 184.402888][ T8237] labpc_pci [ 184.404049][ T8237] comedi: valid board names for adl_pci9118 driver are: [ 184.419701][ T8237] pci9118dg [ 184.430153][ T8237] pci9118hg [ 184.431453][ T8237] pci9118hr [ 184.432600][ T8237] comedi: valid board names for 8255_pci driver are: [ 184.435540][ T8237] 8255_pci [ 184.436938][ T8237] comedi: valid board names for s526 driver are: [ 184.459657][ T8237] s526 [ 184.461576][ T8237] comedi: valid board names for multiq3 driver are: [ 184.489328][ T8237] multiq3 [ 184.496248][ T8237] comedi: valid board names for pcmuio driver are: [ 184.535842][ T8237] pcmuio48 [ 184.543927][ T8237] pcmuio96 [ 184.561320][ T8250] FAULT_INJECTION: forcing a failure. [ 184.561320][ T8250] name failslab, interval 1, probability 0, space 0, times 0 [ 184.561495][ T8237] comedi: valid board names for pcmmio driver are: [ 184.566693][ T8250] CPU: 0 UID: 0 PID: 8250 Comm: syz.1.566 Tainted: G L syzkaller #0 PREEMPT(full) [ 184.566730][ T8250] Tainted: [L]=SOFTLOCKUP [ 184.566738][ T8250] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 184.566750][ T8250] Call Trace: [ 184.566759][ T8250] [ 184.566768][ T8250] dump_stack_lvl+0x100/0x190 [ 184.566794][ T8250] should_fail_ex.cold+0x5/0xa [ 184.566817][ T8250] should_failslab+0xc2/0x120 [ 184.566847][ T8250] __kmalloc_noprof+0xfc/0x820 [ 184.566873][ T8250] ? kasan_save_track+0x14/0x30 [ 184.566896][ T8250] ? aa_str_alloc+0x4a/0xb0 [ 184.566918][ T8250] aa_str_alloc+0x4a/0xb0 [ 184.566938][ T8250] aa_policy_init+0x1cd/0x240 [ 184.566961][ T8250] aa_alloc_profile+0xd1/0x520 [ 184.566984][ T8250] unpack_profile+0x3ed/0x4510 [ 184.567009][ T8250] ? is_bpf_text_address+0x8a/0x1a0 [ 184.567032][ T8250] ? bpf_ksym_find+0x124/0x1c0 [ 184.567061][ T8250] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 184.567093][ T8250] ? is_bpf_text_address+0x94/0x1a0 [ 184.567109][ T8250] ? kernel_text_address+0x8d/0x100 [ 184.567126][ T8250] ? __pfx_unpack_profile+0x10/0x10 [ 184.567154][ T8250] ? arch_stack_walk+0xa6/0xf0 [ 184.567196][ T8250] ? stack_trace_save+0x8e/0xc0 [ 184.567213][ T8250] ? __pfx_stack_trace_save+0x10/0x10 [ 184.567247][ T8250] ? aa_unpack_str+0xae/0x2b0 [ 184.567276][ T8250] aa_unpack+0x39e/0x1240 [ 184.567308][ T8250] ? __pfx_aa_unpack+0x10/0x10 [ 184.567346][ T8250] ? __lock_acquire+0x4c5/0x1ec0 [ 184.567374][ T8250] aa_replace_profiles+0x176/0x31c0 [ 184.567403][ T8250] ? __might_fault+0xc5/0x140 [ 184.567423][ T8250] ? __might_fault+0xc5/0x140 [ 184.567445][ T8250] ? __pfx_aa_replace_profiles+0x10/0x10 [ 184.567479][ T8250] ? _copy_from_user+0x59/0xd0 [ 184.567505][ T8250] policy_update+0x20b/0x340 [ 184.567537][ T8250] profile_load+0xaa/0x1a0 [ 184.567566][ T8250] vfs_write+0x2aa/0x1050 [ 184.567587][ T8250] ? __pfx_profile_load+0x10/0x10 [ 184.567611][ T8250] ? __pfx_vfs_write+0x10/0x10 [ 184.567629][ T8250] ? find_held_lock+0x2b/0x80 [ 184.567657][ T8250] ? __fget_files+0x215/0x3d0 [ 184.567679][ T8250] ? __fget_files+0x21f/0x3d0 [ 184.567707][ T8250] ksys_write+0x12a/0x250 [ 184.567728][ T8250] ? __pfx_ksys_write+0x10/0x10 [ 184.567748][ T8250] ? ksys_write+0x1ac/0x250 [ 184.567768][ T8250] ? __pfx_ksys_write+0x10/0x10 [ 184.567793][ T8250] __do_fast_syscall_32+0x13a/0x8b0 [ 184.567812][ T8250] ? lockdep_hardirqs_on+0x7d/0x110 [ 184.567833][ T8250] do_fast_syscall_32+0x32/0x70 [ 184.567856][ T8250] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 184.567881][ T8250] RIP: 0023:0xf7f23fec [ 184.567907][ T8250] Code: Unable to access opcode bytes at 0xf7f23fc2. [ 184.567916][ T8250] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 184.567933][ T8250] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400 [ 184.567943][ T8250] RDX: 000000000000003a RSI: 0000000000000000 RDI: 0000000000000000 [ 184.567953][ T8250] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 184.567969][ T8250] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 184.567981][ T8250] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 184.568009][ T8250] [ 184.568054][ T8250] ------------[ cut here ]------------ [ 184.582074][ T8237] pcmmio [ 184.582797][ T8250] AppArmor WARN aa_policy_destroy: (((!list_empty(&policy->profiles) && (&policy->profiles)->prev != ((void *) 0x122 + (0xdead000000000000UL))))): [ 184.582813][ T8250] WARNING: security/apparmor/lib.c:509 at aa_policy_destroy+0x78/0x1f0, CPU#0: syz.1.566/8250 [ 184.582863][ T8250] Modules linked in: [ 184.589675][ T8237] comedi: valid board names for pcmda12 driver are: [ 184.590206][ T8250] [ 184.590286][ T8250] CPU: 0 UID: 0 PID: 8250 Comm: syz.1.566 Tainted: G L syzkaller #0 PREEMPT(full) [ 184.590306][ T8250] Tainted: [L]=SOFTLOCKUP [ 184.590311][ T8250] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 184.590320][ T8250] RIP: 0010:aa_policy_destroy+0x7f/0x1f0 [ 184.590338][ T8250] Code: 00 0f 85 88 01 00 00 48 b8 22 01 00 00 00 00 ad de 48 39 43 28 74 18 e8 df b4 31 fd 48 8d 3d e8 f6 74 0c 48 c7 c6 c0 12 57 8c <67> 48 0f b9 3a e8 c7 b4 31 fd 48 8d 6b 10 48 b8 00 00 00 00 00 fc [ 184.607536][ T8237] pcmda12 [ 184.608840][ T8250] RSP: 0018:ffffc900035df678 EFLAGS: 00010293 [ 184.608858][ T8250] RAX: 0000000000000000 RBX: ffff888051414c00 RCX: 0000000000000000 [ 184.608878][ T8250] RDX: ffff8880248bcb00 RSI: ffffffff8c5712c0 RDI: ffffffff914d7da0 [ 184.608888][ T8250] RBP: ffff888051414c20 R08: 0000000000000005 R09: 0000000000000000 [ 184.608899][ T8250] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 [ 184.608908][ T8250] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000dc0 [ 184.608920][ T8250] FS: 0000000000000000(0000) GS:ffff8880969bd000(0063) knlGS:00000000f53e6b40 [ 184.608951][ T8250] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 184.616484][ T8243] Dev loop5: unable to read RDB block 7 [ 184.617373][ T8250] CR2: 00000000f7f24000 CR3: 000000006ebf5000 CR4: 0000000000352ef0 [ 184.619524][ T8237] comedi: valid board names for pcmad driver are: [ 184.621078][ T8250] Call Trace: [ 184.621090][ T8250] [ 184.621097][ T8250] aa_free_profile+0x82/0xca0 [ 184.624025][ C3] invalid error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800800 phys_seg 1 prio class 2 [ 184.624853][ T8250] ? aa_str_alloc+0x90/0xb0 [ 184.624883][ T8250] aa_alloc_profile+0x3ae/0x520 [ 184.624908][ T8250] unpack_profile+0x3ed/0x4510 [ 184.626986][ C3] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 184.628591][ T8250] ? is_bpf_text_address+0x8a/0x1a0 [ 184.633425][ T8237] pcmad12 [ 184.634682][ T8250] ? bpf_ksym_find+0x124/0x1c0 [ 184.639957][ T8243] loop5: unable to read partition table [ 184.640728][ T8250] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 184.640747][ T8237] pcmad16 [ 184.640759][ T8237] comedi: valid board names for ni_labpc driver are: [ 184.640768][ T8237] lab-pc-1200 [ 184.640775][ T8237] lab-pc-1200ai [ 184.640783][ T8237] lab-pc+ [ 184.640791][ T8237] comedi: valid board names for atmio16 driver are: [ 184.640800][ T8237] atmio16 [ 184.640807][ T8237] atmio16d [ 184.640816][ T8237] comedi: valid board names for ni_at_ao driver are: [ 184.640825][ T8237] at-ao-6 [ 184.640833][ T8237] at-ao-10 [ 184.640840][ T8237] comedi: valid board names for ni_at_a2150 driver are: [ 184.640850][ T8237] ni_at_a2150 [ 184.640858][ T8237] comedi: valid board names for adq12b driver are: [ 184.640868][ T8237] adq12b [ 184.640875][ T8237] comedi: valid board names for mpc624 driver are: [ 184.640884][ T8237] mpc624 [ 184.640891][ T8237] comedi: valid board names for c6xdigio driver are: [ 184.640902][ T8237] c6xdigio [ 184.640909][ T8237] comedi: valid board names for aio_iiro_16 driver are: [ 184.640918][ T8237] aio_iiro_16 [ 184.640925][ T8237] comedi: valid board names for aio_aio12_8 driver are: [ 184.640934][ T8237] aio_aio12_8 [ 184.640941][ T8237] aio_ai12_8 [ 184.640948][ T8237] aio_ao12_4 [ 184.640955][ T8237] comedi: valid board names for fl512 driver are: [ 184.640963][ T8237] fl512 [ 184.640970][ T8237] comedi: valid board names for dmm32at driver are: [ 184.640977][ T8237] dmm32at [ 184.640984][ T8237] comedi: valid board names for dt282x driver are: [ 184.640993][ T8237] dt2821 [ 184.640999][ T8237] dt2821-f [ 184.641007][ T8237] dt2821-g [ 184.641013][ T8237] dt2823 [ 184.641020][ T8237] dt2824-pgh [ 184.641027][ T8237] dt2824-pgl [ 184.641034][ T8237] dt2825 [ 184.641041][ T8237] dt2827 [ 184.641048][ T8237] dt2828 [ 184.641054][ T8237] dt2829 [ 184.641062][ T8237] dt21-ez [ 184.641069][ T8237] dt23-ez [ 184.641075][ T8237] dt24-ez [ 184.641082][ T8237] dt24-ez-pgl [ 184.641090][ T8237] comedi: valid board names for dt2817 driver are: [ 184.641682][ T8237] dt2817 [ 184.641691][ T8237] comedi: valid board names for dt2815 driver are: [ 184.641696][ T8237] dt2815 [ 184.641701][ T8237] comedi: valid board names for dt2814 driver are: [ 184.641706][ T8237] dt2814 [ 184.641710][ T8237] comedi: valid board names for dt2811 driver are: [ 184.641716][ T8237] dt2811-pgh [ 184.641720][ T8237] dt2811-pgl [ 184.641725][ T8237] comedi: valid board names for dt2801 driver are: [ 184.641730][ T8237] dt2801 [ 184.641734][ T8237] comedi: valid board names for das6402 driver are: [ 184.641740][ T8237] das6402-12 [ 184.641745][ T8237] das6402-16 [ 184.641749][ T8237] comedi: valid board names for das1800 driver are: [ 184.641755][ T8237] das-1701st [ 184.641759][ T8237] das-1701st-da [ 184.641764][ T8237] das-1702st [ 184.641768][ T8237] das-1702st-da [ 184.641772][ T8237] das-1702hr [ 184.641776][ T8237] das-1702hr-da [ 184.641781][ T8237] das-1701ao [ 184.641786][ T8237] das-1702ao [ 184.641792][ T8237] das-1801st [ 184.641798][ T8237] das-1801st-da [ 184.641804][ T8237] das-1802st [ 184.641809][ T8237] das-1802st-da [ 184.641815][ T8237] das-1802hr [ 184.641820][ T8237] das-1802hr-da [ 184.641825][ T8237] das-1801hc [ 184.641832][ T8237] das-1802hc [ 184.641837][ T8237] das-1801ao [ 184.641842][ T8237] das-1802ao [ 184.641847][ T8237] comedi: valid board names for das800 driver are: [ 184.641855][ T8237] das-800 [ 184.641861][ T8237] cio-das800 [ 184.641866][ T8237] das-801 [ 184.641872][ T8237] cio-das801 [ 184.641879][ T8237] das-802 [ 184.641884][ T8237] cio-das802 [ 184.641889][ T8237] cio-das802/16 [ 184.641895][ T8237] comedi: valid board names for isa-das08 driver are: [ 184.641901][ T8237] isa-das08 [ 184.641907][ T8237] das08-pgm [ 184.641912][ T8237] das08-pgh [ 184.641918][ T8237] das08-pgl [ 184.641923][ T8237] das08-aoh [ 184.641928][ T8237] das08-aol [ 184.641933][ T8237] das08-aom [ 184.641939][ T8237] das08/jr-ao [ 184.641945][ T8237] das08jr-16-ao [ 184.641950][ T8237] pc104-das08 [ 184.641956][ T8237] das08jr/16 [ 184.641961][ T8237] comedi: valid board names for das16m1 driver are: [ 184.641968][ T8237] das16m1 [ 184.641973][ T8237] comedi: valid board names for dac02 driver are: [ 184.641980][ T8237] dac02 [ 184.641985][ T8237] comedi: valid board names for rti802 driver are: [ 184.641991][ T8237] rti802 [ 184.641996][ T8237] comedi: valid board names for rti800 driver are: [ 184.642003][ T8237] rti800 [ 184.642007][ T8237] rti815 [ 184.642013][ T8237] comedi: valid board names for pcm3724 driver are: [ 184.642020][ T8237] pcm3724 [ 184.642025][ T8237] comedi: valid board names for pcl818 driver are: [ 184.642033][ T8237] pcl818l [ 184.642039][ T8237] pcl818h [ 184.642045][ T8237] pcl818hd [ 184.642052][ T8237] pcl818hg [ 184.642058][ T8237] pcl818 [ 184.642065][ T8237] pcl718 [ 184.642071][ T8237] pcm3718 [ 184.642077][ T8237] comedi: valid board names for pcl816 driver are: [ 184.642084][ T8237] pcl816 [ 184.642088][ T8237] pcl814b [ 184.642091][ T8237] comedi: valid board names for pcl812 driver are: [ 184.642097][ T8237] pcl812 [ 184.642101][ T8237] pcl812pg [ 184.642106][ T8237] acl8112pg [ 184.642109][ T8237] acl8112dg [ 184.642113][ T8237] acl8112hg [ 184.642117][ T8237] a821pgl [ 184.642121][ T8237] a821pglnda [ 184.642125][ T8237] a821pgh [ 184.642128][ T8237] a822pgl [ 184.642132][ T8237] a822pgh [ 184.642136][ T8237] a823pgl [ 184.642140][ T8237] a823pgh [ 184.642143][ T8237] pcl813 [ 184.642147][ T8237] pcl813b [ 184.642151][ T8237] acl8113 [ 184.642155][ T8237] iso813 [ 184.642159][ T8237] acl8216 [ 184.642163][ T8237] a826pg [ 184.642166][ T8237] comedi: valid board names for pcl730 driver are: [ 184.642173][ T8237] pcl730 [ 184.642178][ T8237] iso730 [ 184.642184][ T8237] acl7130 [ 184.642190][ T8237] pcm3730 [ 184.642196][ T8237] pcl725 [ 184.642202][ T8237] p8r8dio [ 184.642208][ T8237] acl7225b [ 184.642215][ T8237] p16r16dio [ 184.642221][ T8237] pcl733 [ 184.642227][ T8237] pcl734 [ 184.642233][ T8237] opmm-1616-xt [ 184.642240][ T8237] pearl-mm-p [ 184.642575][ T8243] loop5: partition table beyond EOD, truncated [ 184.643597][ T8250] ? is_bpf_text_address+0x94/0x1a0 [ 184.643618][ T8250] ? kernel_text_address+0x8d/0x100 [ 184.643632][ T8250] ? __pfx_unpack_profile+0x10/0x10 [ 184.643650][ T8250] ? arch_stack_walk+0xa6/0xf0 [ 184.647925][ T8243] loop_reread_partitions: partition scan of loop5 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 184.648540][ T8250] ? stack_trace_save+0x8e/0xc0 [ 184.652329][ T8237] ir104-pbf [ 184.653664][ T8250] ? __pfx_stack_trace_save+0x10/0x10 [ 184.653692][ T8250] ? aa_unpack_str+0xae/0x2b0 [ 184.656006][ T8237] comedi: valid board names for pcl726 driver are: [ 184.657333][ T8250] aa_unpack+0x39e/0x1240 [ 184.659545][ T8237] pcl726 [ 184.662065][ T8250] ? __pfx_aa_unpack+0x10/0x10 [ 184.662093][ T8250] ? __lock_acquire+0x4c5/0x1ec0 [ 184.664791][ T8237] pcl727 [ 184.667278][ T8250] aa_replace_profiles+0x176/0x31c0 [ 184.667312][ T8250] ? __might_fault+0xc5/0x140 [ 184.667327][ T8250] ? __might_fault+0xc5/0x140 [ 184.667341][ T8250] ? __pfx_aa_replace_profiles+0x10/0x10 [ 184.667367][ T8250] ? _copy_from_user+0x59/0xd0 [ 184.671271][ T8237] pcl728 [ 184.674351][ T8250] policy_update+0x20b/0x340 [ 184.677597][ T8237] acl6126 [ 184.678544][ T8250] profile_load+0xaa/0x1a0 [ 184.678567][ T8250] vfs_write+0x2aa/0x1050 [ 184.678580][ T8250] ? __pfx_profile_load+0x10/0x10 [ 184.678597][ T8250] ? __pfx_vfs_write+0x10/0x10 [ 184.681019][ T8237] acl6128 [ 184.682068][ T8250] ? find_held_lock+0x2b/0x80 [ 184.688144][ T8237] comedi: valid board names for pcl724 driver are: [ 184.691101][ T8250] ? __fget_files+0x215/0x3d0 [ 184.691126][ T8250] ? __fget_files+0x21f/0x3d0 [ 184.691142][ T8250] ksys_write+0x12a/0x250 [ 184.691154][ T8250] ? __pfx_ksys_write+0x10/0x10 [ 184.691164][ T8250] ? ksys_write+0x1ac/0x250 [ 184.691176][ T8250] ? __pfx_ksys_write+0x10/0x10 [ 184.693095][ T8237] pcl724 [ 184.695311][ T8250] __do_fast_syscall_32+0x13a/0x8b0 [ 184.695333][ T8250] ? lockdep_hardirqs_on+0x7d/0x110 [ 184.695346][ T8250] do_fast_syscall_32+0x32/0x70 [ 184.695359][ T8250] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 184.696340][ T8237] pcl722 [ 184.699922][ T8250] RIP: 0023:0xf7f23fec [ 184.701769][ T8237] pcl731 [ 184.704657][ T8250] Code: Unable to access opcode bytes at 0xf7f23fc2. [ 184.704669][ T8250] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 184.704682][ T8250] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400 [ 184.704690][ T8250] RDX: 000000000000003a RSI: 0000000000000000 RDI: 0000000000000000 [ 184.704697][ T8250] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 184.704703][ T8250] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 184.706781][ T8237] acl7122 [ 184.712478][ T8250] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 184.713883][ T8237] acl7124 [ 184.715704][ T8250] [ 184.719064][ T8237] pet48dio [ 184.721316][ T8250] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 184.721333][ T8250] CPU: 0 UID: 0 PID: 8250 Comm: syz.1.566 Tainted: G L syzkaller #0 PREEMPT(full) [ 184.721349][ T8250] Tainted: [L]=SOFTLOCKUP [ 184.721353][ T8250] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 184.721361][ T8250] Call Trace: [ 184.721367][ T8250] [ 184.721372][ T8250] dump_stack_lvl+0x100/0x190 [ 184.721390][ T8250] vpanic+0x553/0x970 [ 184.721401][ T8250] ? __pfx_vpanic+0x10/0x10 [ 184.721420][ T8250] panic+0xd1/0xe0 [ 184.721430][ T8250] ? __pfx_panic+0x10/0x10 [ 184.721446][ T8250] check_panic_on_warn.cold+0x19/0x34 [ 184.721458][ T8250] ? aa_policy_destroy+0x78/0x1f0 [ 184.721469][ T8250] __warn.cold+0x191/0x318 [ 184.721481][ T8250] __report_bug+0x30f/0x440 [ 184.721493][ T8250] ? aa_policy_destroy+0x78/0x1f0 [ 184.721505][ T8250] ? __pfx___report_bug+0x10/0x10 [ 184.721522][ T8250] report_bug_entry+0xe2/0x290 [ 184.721533][ T8250] ? aa_policy_destroy+0x7f/0x1f0 [ 184.721544][ T8250] handle_bug+0x1cd/0x2a0 [ 184.721558][ T8250] exc_invalid_op+0x17/0x50 [ 184.721571][ T8250] asm_exc_invalid_op+0x1a/0x20 [ 184.721582][ T8250] RIP: 0010:aa_policy_destroy+0x7f/0x1f0 [ 184.721594][ T8250] Code: 00 0f 85 88 01 00 00 48 b8 22 01 00 00 00 00 ad de 48 39 43 28 74 18 e8 df b4 31 fd 48 8d 3d e8 f6 74 0c 48 c7 c6 c0 12 57 8c <67> 48 0f b9 3a e8 c7 b4 31 fd 48 8d 6b 10 48 b8 00 00 00 00 00 fc [ 184.721605][ T8250] RSP: 0018:ffffc900035df678 EFLAGS: 00010293 [ 184.721615][ T8250] RAX: 0000000000000000 RBX: ffff888051414c00 RCX: 0000000000000000 [ 184.721622][ T8250] RDX: ffff8880248bcb00 RSI: ffffffff8c5712c0 RDI: ffffffff914d7da0 [ 184.721629][ T8250] RBP: ffff888051414c20 R08: 0000000000000005 R09: 0000000000000000 [ 184.721636][ T8250] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 [ 184.721642][ T8250] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000dc0 [ 184.721655][ T8250] ? aa_policy_destroy+0x71/0x1f0 [ 184.721666][ T8250] aa_free_profile+0x82/0xca0 [ 184.721680][ T8250] ? aa_str_alloc+0x90/0xb0 [ 184.721693][ T8250] aa_alloc_profile+0x3ae/0x520 [ 184.721708][ T8250] unpack_profile+0x3ed/0x4510 [ 184.721723][ T8250] ? is_bpf_text_address+0x8a/0x1a0 [ 184.721735][ T8250] ? bpf_ksym_find+0x124/0x1c0 [ 184.721751][ T8250] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 184.721769][ T8250] ? is_bpf_text_address+0x94/0x1a0 [ 184.721781][ T8250] ? kernel_text_address+0x8d/0x100 [ 184.721793][ T8250] ? __pfx_unpack_profile+0x10/0x10 [ 184.721808][ T8250] ? arch_stack_walk+0xa6/0xf0 [ 184.721829][ T8250] ? stack_trace_save+0x8e/0xc0 [ 184.721839][ T8250] ? __pfx_stack_trace_save+0x10/0x10 [ 184.721860][ T8250] ? aa_unpack_str+0xae/0x2b0 [ 184.721876][ T8250] aa_unpack+0x39e/0x1240 [ 184.721895][ T8250] ? __pfx_aa_unpack+0x10/0x10 [ 184.721914][ T8250] ? __lock_acquire+0x4c5/0x1ec0 [ 184.721929][ T8250] aa_replace_profiles+0x176/0x31c0 [ 184.721947][ T8250] ? __might_fault+0xc5/0x140 [ 184.721960][ T8250] ? __might_fault+0xc5/0x140 [ 184.721972][ T8250] ? __pfx_aa_replace_profiles+0x10/0x10 [ 184.721989][ T8250] ? _copy_from_user+0x59/0xd0 [ 184.722003][ T8250] policy_update+0x20b/0x340 [ 184.722020][ T8250] profile_load+0xaa/0x1a0 [ 184.722036][ T8250] vfs_write+0x2aa/0x1050 [ 184.722048][ T8250] ? __pfx_profile_load+0x10/0x10 [ 184.722064][ T8250] ? __pfx_vfs_write+0x10/0x10 [ 184.722074][ T8250] ? find_held_lock+0x2b/0x80 [ 184.722090][ T8250] ? __fget_files+0x215/0x3d0 [ 184.722104][ T8250] ? __fget_files+0x21f/0x3d0 [ 184.722119][ T8250] ksys_write+0x12a/0x250 [ 184.722131][ T8250] ? __pfx_ksys_write+0x10/0x10 [ 184.722141][ T8250] ? ksys_write+0x1ac/0x250 [ 184.722152][ T8250] ? __pfx_ksys_write+0x10/0x10 [ 184.722166][ T8250] __do_fast_syscall_32+0x13a/0x8b0 [ 184.722178][ T8250] ? lockdep_hardirqs_on+0x7d/0x110 [ 184.722190][ T8250] do_fast_syscall_32+0x32/0x70 [ 184.722202][ T8250] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 184.722216][ T8250] RIP: 0023:0xf7f23fec [ 184.722230][ T8250] Code: Unable to access opcode bytes at 0xf7f23fc2. [ 184.722235][ T8250] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 184.722262][ T8250] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400 [ 184.722271][ T8250] RDX: 000000000000003a RSI: 0000000000000000 RDI: 0000000000000000 [ 184.722278][ T8250] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 184.722284][ T8250] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 184.722291][ T8250] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 184.722303][ T8250] [ 184.725258][ T8250] Kernel Offset: disabled