last executing test programs: 17.721212917s ago: executing program 2 (id=590): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x9}}, 0xfd33) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c) 14.01648201s ago: executing program 2 (id=595): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfdffa000) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_CONTINUE(r4, 0xc020aa07, &(0x7f0000000380)={{&(0x7f0000ff9000/0x4000)=nil, 0x4000}, 0x1}) setns(0xc9, 0x0) r5 = gettid() sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0xa23, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_PID={0x8, 0x52, r5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008880}, 0x20000084) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000006c0)={0x55, 0x5, 0x1, {0x9, 0x1}, {0x2a, 0x2}, @cond=[{0x10, 0x92, 0x5, 0x1, 0x1, 0x83}, {0x271e, 0x4, 0x809, 0x7f, 0xfffe, 0x7ff}]}) r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0x1, 0x842b01) write$char_usb(r6, &(0x7f0000000040)="e2", 0x2250) syz_open_dev$sg(0x0, 0x7d97, 0x800) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f0000000180)={0x30, r7, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x101, 0x0, 0xe, 0x1}}}, ["", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x1f602261e4fb935}, 0x800) mount(&(0x7f00000006c0)=@sr0, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000000c0)='minix\x00', 0x204001, 0x0) r8 = syz_genetlink_get_family_id$ipvs(0x0, r0) sendmsg$IPVS_CMD_GET_DAEMON(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x6c, r8, 0x4, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x28}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x40}}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x5}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x8}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000000) 10.367069593s ago: executing program 0 (id=602): r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x4d, &(0x7f0000000040)=0x7, 0x4) syz_emit_ethernet(0x3e, &(0x7f0000000780)={@multicast, @multicast, @void, {@ipv6={0x86dd, @generic={0xc, 0x6, '\x00', 0x8, 0x0, 0xff, @empty, @mcast2, {[@hopopts={0xff}]}}}}}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) listen(r1, 0x80000001) sendmmsg(r1, 0x0, 0x0, 0xc8844) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40015) setsockopt(0xffffffffffffffff, 0x84, 0x7d, 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0x3, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x6, 0x2, 0x80, 0x0, 0x1, 0x91b1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000400}, 0x24000000) sendto$inet(r2, &(0x7f0000000900)="2e552f5d9fd8b0d9627c49f8f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) setsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, 0x0, 0x0) 10.074303207s ago: executing program 2 (id=603): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x2000, 0x0) socket$igmp6(0xa, 0x3, 0x2) ioctl$TUNSETIFF(r0, 0x400454da, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'dvmrp1\x00', 0x1}) r1 = openat$sndseq(0xffffff9c, &(0x7f0000001240), 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x10, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) read$FUSE(r1, &(0x7f00000093c0)={0x2020}, 0xdb983f296b9cca05) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a45320, &(0x7f0000000180)={{0x80, 0xf7}, 'port1\x00', 0x3fb, 0x2062f, 0x4, 0x6, 0x1, 0x1000, 0x2, 0x0, 0x7, 0xfd}) syz_io_uring_setup(0x31c5, &(0x7f0000000140)={0x0, 0xd73c, 0x2, 0x1}, 0x0, 0x0, &(0x7f0000000000)) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r2 = syz_open_procfs(0x0, 0x0) pread64(r2, &(0x7f0000000400)=""/92, 0x5c, 0x4000000000000f3) timer_create(0x1, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) mknodat$loop(0xffffffffffffff9c, 0x0, 0x1000, 0x0) acct(0x0) 8.620944803s ago: executing program 0 (id=608): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_udp(0x2, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r1 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) r3 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$TIOCSPTLCK(r3, 0x40045431, &(0x7f0000000000)) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x6) r5 = dup2(r4, r3) io_setup(0x209, &(0x7f0000002500)=0x0) io_submit(r6, 0x1, &(0x7f0000002680)=[&(0x7f0000002640)={0x0, 0x0, 0x0, 0x8, 0x1000, r5, 0x0}]) syz_usb_connect(0x6, 0x0, 0x0, 0x0) bind$can_j1939(r1, &(0x7f00000000c0)={0x1d, r2, 0x8000000000000003, {}, 0xfd}, 0x18) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=@deltclass={0x24, 0x29, 0x8, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xffff}, {0x1, 0x8}, {0x6, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0xfd27c4eff795f0e1}, 0x480c5) close(r1) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000001040)=@newsa={0x180, 0x10, 0x713, 0x0, 0x0, {{@in=@remote, @in6=@remote, 0x1000, 0x4}, {@in6=@remote, 0x0, 0x32}, @in6=@mcast1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @algo_auth_trunc={0x4c, 0x14, {{'cmac(aes)\x00'}}}]}, 0x180}}, 0x0) 8.099536959s ago: executing program 2 (id=609): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB, @ANYBLOB, @ANYRES32=0x0], 0x50) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0) syz_open_dev$cec(0x0, 0x0, 0x22581) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)}, 0x1c) openat$sw_sync_info(0xffffff9c, &(0x7f0000000100), 0x80400, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40047101, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bind$alg(r2, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r2, 0x0, 0x0, 0x80000) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) sendmsg$IPCTNL_MSG_CT_GET_DYING(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x40000c5}, 0x8814) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001bc0)={0x6, 0x1e, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x6}, {}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffeffff}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @initr0={0x18, 0x0, 0x0, 0x0, 0xe85, 0x0, 0x0, 0x0, 0x5}, @map_fd={0x18, 0x7, 0x1, 0x0, r0}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, 0x0, 0x5, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001b80), 0x0, 0x10, 0x7}, 0x94) 6.427527197s ago: executing program 2 (id=612): r0 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) readv(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)=""/9, 0x9}], 0x1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, 0x0, 0x0) r2 = fsmount(0xffffffffffffffff, 0x0, 0x88) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x1a8) fanotify_mark(0xffffffffffffffff, 0x451, 0x8001008, r3, 0x0) getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f00000001c0)={@multicast1, @local, 0x0}, &(0x7f0000000200)=0xc) sendmsg$nl_xfrm(r2, &(0x7f0000000840)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000540)=@expire={0x254, 0x18, 0x800, 0x70bd2c, 0x25dfdbfb, {{{@in6=@mcast2, @in=@loopback, 0x4e23, 0x3, 0x4e20, 0x1, 0x2, 0x20, 0x80, 0xa9, r4, 0xee00}, {@in=@empty, 0x4d6, 0x32}, @in=@empty, {0x3, 0x3c, 0x800, 0xfffffffffffffff8, 0xffffffffffffff80, 0x3, 0x9, 0xfffffffffffffffa}, {0x4, 0x8, 0x200, 0x9}, {0x7, 0x46bd}, 0x70bd27, 0x34ff, 0xa, 0x0, 0xfc}, 0x62}, [@replay_esn_val={0x34, 0x17, {0x6, 0x70bd26, 0x70bd27, 0x70bd29, 0x70bd26, 0x6, [0xffffffff, 0x5, 0x5, 0x7, 0x9, 0x5]}}, @algo_crypt={0x48, 0x2, {{'lrw(cast6)\x00'}}}, @sa={0xe0, 0x6, {{@in=@loopback, @in=@local, 0x4e23, 0x7, 0x4e23, 0x0, 0xa, 0x20, 0xa0, 0x11}, {@in=@local, 0x4d5, 0x33}, @in6=@local, {0x6, 0x0, 0xac8b, 0x3, 0x1, 0x4, 0xcc4, 0xa8}, {0x2, 0x4, 0x8, 0x101}, {0x7, 0x87}, 0x70bd2c, 0x3505, 0xa, 0x2, 0x4}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x3}]}, 0x254}, 0x1, 0x0, 0x0, 0x4}, 0x8004050) openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) prctl$PR_SET_MM_MAP(0x26, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) 5.971805722s ago: executing program 1 (id=613): unshare(0x20000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0/file1/file2\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file1/file2/file3\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1/file2/file3/file4\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file0/file1/file2/file3/file5\x00', 0x81c0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0/file6\x00', 0x1c0) mount$bind(&(0x7f0000000280)='./file0/file1/file2/file3\x00', &(0x7f00000002c0)='./file0/file1/file2/file3\x00', 0x0, 0x1000, 0x0) mount$bind(&(0x7f0000000300)='./file0/file1\x00', &(0x7f0000000340)='./file0/file6\x00', 0x0, 0x5000, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file6/file2\x00', 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file1/file2\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./file0/file2\x00', 0x0) r1 = landlock_create_ruleset(&(0x7f0000000440)={0x2004}, 0x30, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000480)='./file0/file2/file3/file4\x00', 0x0, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f00000004c0)={0x4, r2}, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) landlock_restrict_self(r1, 0x0) openat(r0, &(0x7f0000000500)='file3/file5\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000540)='file3/file5\x00', r0, &(0x7f0000000580)='file3/file4/file5\x00', 0x0) 5.916713582s ago: executing program 0 (id=614): r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000004ff0)={0x2, 0x4e20, @remote}, 0x10) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000140)) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000180)={0x0, 0x77, "6f5f8174d6d945467cecd1b50f584f2c3846dadf5c88c62658881b8e7ac35d15d7e6c7e685993ee76926870e46c4d72bf2c94c2db1b81b4b1c43b6e5add63b610582999c7f4615d58371c4b33f958d5dfc6756b727b9b77590a4882c96dad00f19a7eb1f323e3f9c2b4d9ffb2992d2faebdb37f7ae3f91"}, &(0x7f0000000240)=0x7f) getsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000280)={r3, 0x2, 0x4, 0xff, 0x718}, &(0x7f00000002c0)=0x14) gettid() r4 = openat$dir(0xffffff9c, &(0x7f0000000000)='./file0\x00', 0x4080, 0x2) readlinkat(r4, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = fcntl$dupfd(r0, 0x0, r5) syslog(0x2, &(0x7f0000001640)=""/153, 0x99) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'ip6gretap0\x00'}) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448d4, 0x0) listen(r6, 0xda8f) accept4(r0, 0x0, 0x0, 0x0) 5.508227753s ago: executing program 3 (id=615): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='raid1\n', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='2\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='1:0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000340)='1:1\n', 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0) write(r5, &(0x7f00000003c0)='0\n', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r6, &(0x7f0000000440)='1\n', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0) write(r7, &(0x7f00000004c0)='writemostly\n', 0xc) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r8, &(0x7f0000000640)='readonly\n', 0x9) 5.495364178s ago: executing program 1 (id=623): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r1, 0x89f7, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={@private=0xa010100, 0x37a08369eb9b72c6, 0x0, 0x10, 0x0, [{@broadcast}]}}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) socket$netlink(0x10, 0x3, 0xa) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r4) sendmsg$ETHTOOL_MSG_PAUSE_SET(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x3c, r5, 0x2799f5eec7981083, 0x70bd26, 0x25dfdbfc, {}, [@ETHTOOL_A_PAUSE_RX={0x5}, @ETHTOOL_A_PAUSE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20040080}, 0x80) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r6, &(0x7f0000000000)='7', 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) sendmsg$802154_dgram(r3, &(0x7f0000000100)={&(0x7f0000000080)={0x24, @short={0x2, 0xffff, 0xaaa1}}, 0x14, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4001010}, 0x4800) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0xc08, 0x80}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c8c0}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001780)=@newlink={0x20, 0x10, 0x403, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x429a4}}, 0x20}}, 0x8000) 4.504526542s ago: executing program 3 (id=616): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f0000000600), &(0x7f0000000640)={'syz', 0x2}, 0x0, 0x0, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @auto=[0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0x38, 0x30, 0x30, 0x30, 0x36, 0x31, 0x30, 0x37, 0x30, 0x31]}, &(0x7f0000000100)={0x0, "00112233444566778899aabbccddeeff00112233445566778899aabbccddeeff0011fb2fa087e1a5a490aabbccddeeff001122334455667788d9aabbccddeeff", 0x41}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x65, 0x38, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000840)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x38}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x39, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x3d}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61, 0x30, 0x66, 0x64, 0x30, 0x63, 0x66]}, &(0x7f0000000740)={0x0, "001122334b0c66778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbddddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x35, 0x30, 0x35, 0x30, 0x30, 0x30, 0x39, 0x51, 0x64, 0x62, 0x30, 0x64, 0x30, 0x30, 0x37]}, &(0x7f0000000580)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccdd2233445566778899aabbccddeeff00", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x38]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x34, 0x62, 0x30, 0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x31, 0x30, 0x37, 0x63, 0x66, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff0011223344556677878d486ca0bac53400112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x62, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35, 0x33, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) r2 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000480)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x38, 0x32, 0x30, 0x6e, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35, 0x30, 0x30, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x32, 0x30, 0x32, 0x30, 0x30, 0x30, 0x66, 0x30, 0x30, 0x62, 0xf]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x44}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f00000006c0)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @desc1}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aa00000000ff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$user(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)='c', 0x1, r0) keyctl$KEYCTL_MOVE(0x1e, r2, r0, r1, 0x0) 4.176183811s ago: executing program 0 (id=617): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = epoll_create(0xfe) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x10b}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000680)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, 0x0}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x110000000000) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000180)='m'}) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r4, &(0x7f0000000000)={0xc0002003}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000200)=0x8) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) 4.097012488s ago: executing program 3 (id=618): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000200)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x24, 0x3, 0x46d, 0xc082, 0x0, 0x0, "0600ff0901a10185107508950609018102090191028511750895130901810209019102c0"}}, 0x13c) read(r0, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000080)={0x0, 0x7, 0x10, 0x5, 0xb, 0x7, 0x51d6, 0x3eb, {0x0, @in6={{0xa, 0x72, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, 0xa}}, 0x8, 0x7f, 0x101, 0x1, 0x2}}, &(0x7f0000000140)=0xb0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000200)={r3, 0x3, 0x2}, &(0x7f0000000240)=0x8) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r4, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r4, 0x5001, 0x0) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f00000000c0)=0x7) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0xb}) shmat(0x0, &(0x7f000051b000/0x3000)=nil, 0x2000) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) sendmsg$key(r1, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x2, 0x400000000000003, 0x0, 0x5, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfbffffff}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @empty}}]}, 0x50}}, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r1, 0x8982, &(0x7f0000000280)={0x8, 'batadv0\x00', {'veth1_to_team\x00'}, 0x667}) write$UHID_INPUT2(r0, &(0x7f0000000440)={0xc, {0x2, "10ff"}}, 0x8) 3.948508574s ago: executing program 0 (id=619): timer_create(0x0, 0x0, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) readv(0xffffffffffffffff, &(0x7f0000000600)=[{0x0}], 0x1) eventfd(0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) r2 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r2, 0xc0045627, &(0x7f0000000100)=0x2) ppoll(&(0x7f0000000080)=[{r1, 0x42c0}], 0x1, 0x0, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 3.805863805s ago: executing program 1 (id=628): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) open_by_handle_at(r0, &(0x7f0000000000)=@orangefs_parent={0x28, 0x2, {{"66aea8f615f44155093443da4feb05a7", 0xaf8f}, {"9999373d99425dd09b0f4db922a68910", 0x4}}}, 0x202000) socket(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000001300), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f0000000040)={0xf000, 0x1000, 0x8}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 2.784094269s ago: executing program 0 (id=620): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='external:', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='raid5', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='2', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='65536', 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0) write(r5, &(0x7f0000000500)='ppl', 0x3) r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r6, &(0x7f0000000580)='1:0', 0x3) r7 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0) write(r7, &(0x7f00000007c0)='0', 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r8, &(0x7f0000000a40)='active', 0x6) 2.57239243s ago: executing program 3 (id=621): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./dev/ram0\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000001000)="fc4e2ba9", 0x4, 0x1000) pwrite64(r0, &(0x7f0000001004)="01", 0x1, 0x1004) pwrite64(r0, &(0x7f0000001008)="01", 0x1, 0x1008) pwrite64(r0, &(0x7f000000100c)='\b', 0x1, 0x1060) pwrite64(r0, &(0x7f0000001010)="10", 0x1, 0x1080) pwrite64(r0, &(0x7f0000001018)='\n', 0x1, 0x1088) pwrite64(r0, &(0x7f0000001020)='\b', 0x1, 0x1090) fsync(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='md0', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r2, &(0x7f0000000600)='1.2', 0x3) r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='1:0', 0x3) 2.358125712s ago: executing program 1 (id=622): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x69ee, 0xc00, 0x5, 0x50}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, r4, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r5, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x1c) 2.287562761s ago: executing program 2 (id=624): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0xc0, 0x104) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140), 0x8) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) syz_clone3(0x0, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) r2 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7"], 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r3, 0x0, 0x0) syz_usb_ep_write(r2, 0x81, 0x8, &(0x7f0000000080)="00012c615bc20000") read$char_usb(r3, 0x0, 0x0) syz_usb_disconnect(r2) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102"], 0x14}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.528752304s ago: executing program 3 (id=625): mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000840)='./config\x00', &(0x7f0000000880)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./img\x00', 0x42, 0x1ff) ftruncate(r0, 0x1000000) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000980)='1\n\x00', 0x2) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f00000009c0)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x2, 0x0) write(r1, 0x0, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x2, 0x0) write(r2, &(0x7f0000000ac0)='1\n\x00', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/nvmet/subsystems/testsubsys/namespaces/1/resv_enable\x00', 0x2, 0x0) write(r3, &(0x7f0000000b40)='1\n\x00', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000b80)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x2, 0x0) write(r4, &(0x7f0000000bc0)='1\n\x00', 0x2) 184.88023ms ago: executing program 1 (id=626): r0 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000080)={0xa, 0xe64, 0x3, @ipv4={'\x00', '\xff\xff', @empty}, 0x202}, 0x1c) r1 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r1, &(0x7f0000000480)={0xa, 0xe64, 0x3, @empty, 0x2}, 0x1c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) listen(r2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x0) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) 46.32229ms ago: executing program 3 (id=627): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r0, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000500)=""/245, 0xf5}], 0x1, &(0x7f0000000640)=""/5, 0x5}, 0x3}], 0x1, 0x23, 0x0) sendto$inet6(r0, &(0x7f0000000140)="d0", 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 0s ago: executing program 1 (id=629): landlock_create_ruleset(&(0x7f0000000180)={0x100, 0x6, 0x2, 0x0, 0x4}, 0x30, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xb2, &(0x7f0000000140)=""/178, 0x1f00, 0x6f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb5}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xef5}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) memfd_create(0x0, 0x8340b1aabcc04bec) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r3) prlimit64(r0, 0x8, &(0x7f0000000300)={0x8, 0x10}, &(0x7f0000000340)) add_key(&(0x7f0000000200)='cifs.idmap\x00', &(0x7f0000000240)={'syz', 0x0}, &(0x7f0000000280)="3038c4eb9f6a876bbcf1ee50d2400738d957b6c3613a9aa314ad06a5c2b2188543", 0xfffff, 0xfffffffffffffffe) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:40685' (ED25519) to the list of known hosts. syzkaller login: [ 90.811327][ T5733] cgroup: Unknown subsys name 'net' [ 91.002158][ T5733] cgroup: Unknown subsys name 'cpuset' [ 91.026740][ T5733] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 93.315326][ T35] cfg80211: failed to load regulatory.db [ 93.333217][ T5733] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 106.614611][ T5758] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 106.616080][ T5758] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 106.677390][ T5760] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 106.679289][ T5760] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 106.681941][ T5760] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 106.683491][ T5760] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 106.685896][ T5760] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 106.691197][ T5765] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 106.714222][ T5767] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 106.714760][ T5765] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 106.716383][ T5760] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 106.716640][ T5760] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 106.726650][ T5765] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 106.727013][ T5765] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 106.727060][ T5760] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 106.734770][ T67] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 106.735647][ T67] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 106.736312][ T67] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 106.773946][ T5758] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 106.780739][ T5094] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 108.549796][ T5753] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.549968][ T5753] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.550115][ T5753] bridge_slave_0: entered allmulticast mode [ 108.551617][ T5753] bridge_slave_0: entered promiscuous mode [ 108.709451][ T5753] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.709540][ T5753] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.709671][ T5753] bridge_slave_1: entered allmulticast mode [ 108.711200][ T5753] bridge_slave_1: entered promiscuous mode [ 108.803390][ T5094] Bluetooth: hci1: command tx timeout [ 108.803860][ T5763] Bluetooth: hci3: command tx timeout [ 108.804295][ T5763] Bluetooth: hci0: command tx timeout [ 108.804696][ T5763] Bluetooth: hci2: command tx timeout [ 108.854128][ T5753] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 108.860278][ T5753] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 108.917011][ T5754] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.917326][ T5754] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.917458][ T5754] bridge_slave_0: entered allmulticast mode [ 108.918207][ T5754] bridge_slave_0: entered promiscuous mode [ 108.936620][ T5754] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.936696][ T5754] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.936813][ T5754] bridge_slave_1: entered allmulticast mode [ 108.939511][ T5754] bridge_slave_1: entered promiscuous mode [ 108.966442][ T5753] team0: Port device team_slave_0 added [ 108.983401][ T5753] team0: Port device team_slave_1 added [ 108.986691][ T5754] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.053306][ T5754] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.124817][ T5754] team0: Port device team_slave_0 added [ 109.126223][ T5753] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.126233][ T5753] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.126247][ T5753] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.183254][ T5753] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.183269][ T5753] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.183290][ T5753] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.227337][ T5754] team0: Port device team_slave_1 added [ 109.416539][ T5754] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.416554][ T5754] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.416573][ T5754] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.491166][ T5754] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.491184][ T5754] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.491207][ T5754] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.561418][ T5759] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.561567][ T5759] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.561695][ T5759] bridge_slave_0: entered allmulticast mode [ 109.563537][ T5759] bridge_slave_0: entered promiscuous mode [ 109.567140][ T5761] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.567214][ T5761] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.567311][ T5761] bridge_slave_0: entered allmulticast mode [ 109.598145][ T5761] bridge_slave_0: entered promiscuous mode [ 109.608902][ T5761] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.608992][ T5761] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.609117][ T5761] bridge_slave_1: entered allmulticast mode [ 109.610866][ T5761] bridge_slave_1: entered promiscuous mode [ 109.620423][ T5753] hsr_slave_0: entered promiscuous mode [ 109.621274][ T5753] hsr_slave_1: entered promiscuous mode [ 109.653884][ T5759] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.654009][ T5759] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.654107][ T5759] bridge_slave_1: entered allmulticast mode [ 109.655466][ T5759] bridge_slave_1: entered promiscuous mode [ 109.720579][ T5759] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.723287][ T5761] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.798180][ T5759] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.821982][ T5761] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.828235][ T5754] hsr_slave_0: entered promiscuous mode [ 109.829406][ T5754] hsr_slave_1: entered promiscuous mode [ 109.830418][ T5754] debugfs: 'hsr0' already exists in 'hsr' [ 109.830503][ T5754] Cannot create hsr debugfs directory [ 109.931460][ T5759] team0: Port device team_slave_0 added [ 109.944828][ T5761] team0: Port device team_slave_0 added [ 109.947797][ T5761] team0: Port device team_slave_1 added [ 110.027462][ T5759] team0: Port device team_slave_1 added [ 110.043644][ T5761] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 110.043661][ T5761] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.043681][ T5761] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 110.126599][ T5761] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 110.126616][ T5761] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.126636][ T5761] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 110.250939][ T5759] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 110.250954][ T5759] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.250972][ T5759] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 110.256690][ T5759] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 110.256708][ T5759] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.256731][ T5759] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 110.362903][ T5761] hsr_slave_0: entered promiscuous mode [ 110.363684][ T5761] hsr_slave_1: entered promiscuous mode [ 110.364738][ T5761] debugfs: 'hsr0' already exists in 'hsr' [ 110.364754][ T5761] Cannot create hsr debugfs directory [ 110.370825][ T5759] hsr_slave_0: entered promiscuous mode [ 110.371991][ T5759] hsr_slave_1: entered promiscuous mode [ 110.375825][ T5759] debugfs: 'hsr0' already exists in 'hsr' [ 110.375848][ T5759] Cannot create hsr debugfs directory [ 110.706567][ T5753] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 110.740128][ T5753] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 110.789794][ T5753] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 110.830338][ T5753] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 110.831305][ T5753] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 110.864664][ T5753] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 110.893229][ T5094] Bluetooth: hci0: command tx timeout [ 110.893260][ T5094] Bluetooth: hci3: command tx timeout [ 110.893278][ T5094] Bluetooth: hci1: command tx timeout [ 110.893405][ T5763] Bluetooth: hci2: command tx timeout [ 110.927190][ T5753] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 110.954240][ T5753] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 111.177950][ T5754] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 111.213312][ T5754] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 111.229705][ T5754] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 111.236655][ T5754] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 111.237333][ T5754] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 111.244572][ T5754] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 111.245348][ T5754] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 111.270902][ T5754] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 111.454880][ T5753] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.510808][ T5753] 8021q: adding VLAN 0 to HW filter on device team0 [ 111.643559][ T5759] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 111.652293][ T5759] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 111.659827][ T5759] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 111.670948][ T5759] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 111.691530][ T92] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.691677][ T92] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.735339][ T92] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.735426][ T92] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.749952][ T5759] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 111.774375][ T5759] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 111.775604][ T5759] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 111.783246][ T5759] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 111.830356][ T5753] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 111.830382][ T5753] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 111.934733][ T5761] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 111.979579][ T5761] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 111.981074][ T5761] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 112.014167][ T5761] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 112.024640][ T5761] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 112.045828][ T5761] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 112.046637][ T5761] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 112.075090][ T5761] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 112.290085][ T5754] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.348858][ T5754] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.437333][ T5759] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.444833][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.444912][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.475795][ T1175] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.475882][ T1175] bridge0: port 2(bridge_slave_1) entered forwarding state [ 112.508624][ T5761] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.573703][ T5761] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.597499][ T92] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.597598][ T92] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.599584][ T92] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.599652][ T92] bridge0: port 2(bridge_slave_1) entered forwarding state [ 112.628174][ T5759] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.635145][ T92] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.635229][ T92] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.683877][ T230] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.684048][ T230] bridge0: port 2(bridge_slave_1) entered forwarding state [ 112.746030][ T5754] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 112.932233][ T5759] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 112.972871][ T67] Bluetooth: hci2: command tx timeout [ 112.972906][ T67] Bluetooth: hci1: command tx timeout [ 112.972928][ T67] Bluetooth: hci3: command tx timeout [ 112.972947][ T67] Bluetooth: hci0: command tx timeout [ 113.387707][ T5753] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 113.486163][ T5753] veth0_vlan: entered promiscuous mode [ 113.544279][ T5753] veth1_vlan: entered promiscuous mode [ 113.678117][ T5753] veth0_macvtap: entered promiscuous mode [ 113.736207][ T5753] veth1_macvtap: entered promiscuous mode [ 113.809363][ T5753] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 113.896222][ T5753] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 113.904285][ T5754] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.078014][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.221565][ T5759] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.455250][ T5754] veth0_vlan: entered promiscuous mode [ 114.499644][ T5754] veth1_vlan: entered promiscuous mode [ 114.632891][ T45] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.632911][ T45] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.690116][ T5761] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.704512][ T5800] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.704646][ T5800] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.714940][ T5759] veth0_vlan: entered promiscuous mode [ 114.787314][ T5759] veth1_vlan: entered promiscuous mode [ 114.798077][ T5754] veth0_macvtap: entered promiscuous mode [ 114.801676][ T5754] veth1_macvtap: entered promiscuous mode [ 114.818940][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.835914][ T92] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.835935][ T92] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.958579][ T5754] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 114.961966][ T5754] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 115.019707][ T5761] veth0_vlan: entered promiscuous mode [ 115.043464][ T5763] Bluetooth: hci0: command tx timeout [ 115.043493][ T5763] Bluetooth: hci3: command tx timeout [ 115.043508][ T5763] Bluetooth: hci1: command tx timeout [ 115.043523][ T5763] Bluetooth: hci2: command tx timeout [ 115.103950][ T5761] veth1_vlan: entered promiscuous mode [ 115.152796][ T5901] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.152844][ T5901] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.152873][ T5901] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.152902][ T5901] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.191410][ T5759] veth0_macvtap: entered promiscuous mode [ 115.200129][ T5759] veth1_macvtap: entered promiscuous mode [ 115.215730][ T5753] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 115.232420][ T5759] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 115.263369][ T5753] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 115.326322][ T5759] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 115.357748][ T5753] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 115.359129][ T5753] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 115.456435][ T5753] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 115.473612][ T5761] veth0_macvtap: entered promiscuous mode [ 115.506414][ T5761] veth1_macvtap: entered promiscuous mode [ 115.518572][ T5800] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.528513][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.528534][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.608217][ T5761] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 115.620343][ T5824] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.620435][ T5824] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.620479][ T5824] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.769146][ T5761] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 115.948256][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.948277][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.080516][ T5800] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.081168][ T5800] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.081506][ T5800] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.081806][ T5800] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.339547][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.339570][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.421359][ T230] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.421382][ T230] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.577734][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.577757][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.733931][ T45] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.733954][ T45] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50   @ [ 117.502475][ T5864] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 117.557913][ T5919] bridge_slave_0: left allmulticast mode [ 117.557940][ T5919] bridge_slave_0: left promiscuous mode [ 117.559835][ T5919] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.615890][ T5919] bridge_slave_1: left allmulticast mode [ 117.615916][ T5919] bridge_slave_1: left promiscuous mode [ 117.616160][ T5919] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.652646][ T5864] usb 5-1: Using ep0 maxpacket: 8 [ 117.653885][ T5864] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 117.662156][ T5864] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 117.662210][ T5864] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 117.662228][ T5864] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 117.662246][ T5864] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 117.662264][ T5864] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 117.662295][ T5864] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.713981][ T5919] bond0: (slave bond_slave_0): Releasing backup interface [ 117.731743][ T5919] bond0: (slave bond_slave_1): Releasing backup interface [ 117.801467][ T5919] team0: Port device team_slave_0 removed [ 117.837260][ T5919] team0: Port device team_slave_1 removed [ 117.838084][ T5919] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 117.838102][ T5919] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 117.843827][ T5919] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 117.843847][ T5919] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 117.905191][ T2573] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 117.922371][ T5919] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 118.014197][ T5920] team0: Mode changed to "activebackup" [ 118.039451][ T5923] vlan0: entered promiscuous mode [ 118.046328][ T5864] usb 5-1: usb_control_msg returned -32 [ 118.046363][ T5864] usbtmc 5-1:16.0: can't read capabilities [ 118.049645][ T5923] team0: Port device vlan0 added [ 118.075863][ T2573] usb 6-1: Using ep0 maxpacket: 32 [ 118.083838][ T2573] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 118.085114][ T2573] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.098811][ T2573] usb 6-1: config 0 descriptor?? [ 118.342559][ T5928] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7'. [ 118.345672][ T5864] usb 5-1: USB disconnect, device number 2 [ 118.349778][ T5913] usbtmc 5-1:16.0: usb_control_msg returned -71 [ 118.350752][ T5927] usbtmc 5-1:16.0: send_request_dev_dep_msg_in returned -19 [ 118.361614][ T2573] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 118.425325][ T2573] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 118.460874][ T2573] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 118.460920][ T2573] usb 6-1: media controller created [ 118.586475][ T2573] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 118.690765][ T5931] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 118.734313][ T2573] az6027: usb out operation failed. (-71) [ 118.734685][ T2573] az6027: usb out operation failed. (-71) [ 118.734696][ T2573] stb0899_attach: Driver disabled by Kconfig [ 118.734703][ T2573] az6027: no front-end attached [ 118.734703][ T2573] [ 118.735025][ T2573] az6027: usb out operation failed. (-71) [ 118.735036][ T2573] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 118.780497][ T2573] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb6/6-1/input/input5 [ 118.799795][ T2573] dvb-usb: schedule remote query interval to 400 msecs. [ 118.799818][ T2573] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 118.804887][ T2573] usb 6-1: USB disconnect, device number 2 [ 119.014801][ T2573] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 119.156604][ T5935] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 119.227178][ T5937] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 119.326635][ T5939] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 119.520927][ T5941] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 119.675849][ T5947] batman_adv: batadv0: Adding interface: veth0 [ 119.675868][ T5947] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 119.675896][ T5947] batman_adv: batadv0: Interface activated: veth0 [ 119.680119][ T5947] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 119.680146][ T5947] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 119.737721][ T5947] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 119.737744][ T5947] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 119.758582][ T5947] batman_adv: batadv0: Interface deactivated: veth0 [ 119.758609][ T5947] batman_adv: batadv0: Removing interface: veth0 [ 119.829426][ T5950] netlink: 'syz.2.16': attribute type 10 has an invalid length. [ 119.833013][ T5950] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.833498][ T5950] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.847062][ T5950] bridge0: port 2(bridge_slave_1) entered blocking state [ 119.847185][ T5950] bridge0: port 2(bridge_slave_1) entered forwarding state [ 119.849353][ T5950] bridge0: port 1(bridge_slave_0) entered blocking state [ 119.849508][ T5950] bridge0: port 1(bridge_slave_0) entered forwarding state [ 119.855447][ T5950] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 119.889232][ T5950] netlink: 4 bytes leftover after parsing attributes in process `syz.2.16'. [ 119.889309][ T5950] bridge_slave_1: left allmulticast mode [ 119.889329][ T5950] bridge_slave_1: left promiscuous mode [ 119.889562][ T5950] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.899843][ T5952] Zero length message leads to an empty skb [ 119.907464][ T5950] bridge_slave_0: left allmulticast mode [ 119.907491][ T5950] bridge_slave_0: left promiscuous mode [ 119.907681][ T5950] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.273849][ T5950] bond0: (slave bridge0): Releasing backup interface [ 121.513622][ T5961] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 121.730850][ T5963] jffs2: notice: (5963) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 121.766137][ T5963] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19'. [ 121.766160][ T5963] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19'. [ 121.899790][ T5963] Illegal XDP return value 38 on prog (id 2) dev N/A, expect packet loss! [ 122.050283][ T5966] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 122.110801][ T5968] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 122.306570][ T5972] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 122.403625][ T5975] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 122.506910][ T5975] syz.1.22 uses obsolete (PF_INET,SOCK_PACKET) [ 122.578650][ T5977] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 123.020979][ T5981] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 123.435960][ T5989] syz.1.29 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 123.960380][ T5994] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 124.565195][ T6005] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 124.965124][ T6008] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 125.080598][ T6010] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 125.107508][ T5998] FAULT_INJECTION: forcing a failure. [ 125.107508][ T5998] name failslab, interval 1, probability 0, space 0, times 1 [ 125.107546][ T5998] CPU: 0 UID: 0 PID: 5998 Comm: syz.2.32 Not tainted syzkaller #0 PREEMPT(full) [ 125.107573][ T5998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.107587][ T5998] Call Trace: [ 125.107595][ T5998] [ 125.107604][ T5998] dump_stack_lvl+0x100/0x190 [ 125.107643][ T5998] should_fail_ex.cold+0x5/0xa [ 125.107669][ T5998] should_failslab+0xc2/0x120 [ 125.107695][ T5998] kmem_cache_alloc_noprof+0x92/0x6a0 [ 125.107717][ T5998] ? security_file_alloc+0x34/0x2c0 [ 125.107741][ T5998] security_file_alloc+0x34/0x2c0 [ 125.107762][ T5998] init_file+0x95/0x480 [ 125.107791][ T5998] alloc_empty_file+0x79/0x1c0 [ 125.107819][ T5998] alloc_file_pseudo+0x183/0x290 [ 125.107845][ T5998] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 125.107869][ T5998] ? alloc_fd+0x471/0x7a0 [ 125.107891][ T5998] ? do_raw_spin_unlock+0x145/0x1e0 [ 125.107911][ T5998] __anon_inode_getfile+0xe8/0x280 [ 125.107942][ T5998] anon_inode_getfile_fmode+0x37/0xa0 [ 125.107972][ T5998] __do_sys_fanotify_init+0xa0d/0xe30 [ 125.107998][ T5998] __do_fast_syscall_32+0x13a/0x8b0 [ 125.108020][ T5998] ? lockdep_hardirqs_on+0x7d/0x110 [ 125.108083][ T5998] do_fast_syscall_32+0x32/0x70 [ 125.108105][ T5998] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 125.108128][ T5998] RIP: 0023:0xf7f16fec [ 125.108145][ T5998] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 125.108162][ T5998] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000152 [ 125.108181][ T5998] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 0000000000080000 [ 125.108194][ T5998] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 125.108205][ T5998] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 125.108226][ T5998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.108238][ T5998] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 125.108262][ T5998] [ 125.252088][ T6012] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 125.313480][ T6014] netlink: 4 bytes leftover after parsing attributes in process `syz.0.37'. [ 125.474153][ T6020] xt_connbytes: Forcing CT accounting to be enabled [ 125.474361][ T6020] xt_SECMARK: invalid mode: 0 [ 129.106771][ T6073] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 129.515579][ T6078] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 129.789019][ T6084] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 130.019332][ T6089] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 130.776427][ T42] audit: type=1326 audit(1790284970.342:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6095 comm="syz.1.53" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb5fec code=0x0 [ 131.492146][ T42] audit: type=1326 audit(1790284971.042:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6106 comm="syz.3.54" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf707efec code=0x0 [ 131.614718][ T6122] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 131.800603][ T6124] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 132.218947][ T6128] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 133.994818][ T6141] : renamed from bond_slave_0 (while UP) [ 134.397052][ T6150] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 134.461288][ T6152] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 135.014819][ T6142] FAULT_INJECTION: forcing a failure. [ 135.014819][ T6142] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 135.014852][ T6142] CPU: 1 UID: 0 PID: 6142 Comm: syz.0.63 Not tainted syzkaller #0 PREEMPT(full) [ 135.014877][ T6142] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 135.014888][ T6142] Call Trace: [ 135.014895][ T6142] [ 135.014902][ T6142] dump_stack_lvl+0x100/0x190 [ 135.014933][ T6142] should_fail_ex.cold+0x5/0xa [ 135.014958][ T6142] _copy_from_user+0x2e/0xd0 [ 135.014983][ T6142] copy_from_buffer+0x7f/0xc0 [ 135.015012][ T6142] copy_uabi_to_xstate+0xc0/0x650 [ 135.015042][ T6142] ? __pfx_copy_uabi_to_xstate+0x10/0x10 [ 135.015067][ T6142] ? lock_acquire+0x1d1/0x380 [ 135.015094][ T6142] ? __might_fault+0xc5/0x140 [ 135.015117][ T6142] ? __fpu_restore_sig+0xc06/0x13b0 [ 135.015142][ T6142] ? x86_task_fpu+0x5f/0x90 [ 135.015165][ T6142] __fpu_restore_sig+0xfeb/0x13b0 [ 135.015192][ T6142] ? __lock_acquire+0x5c0/0x1f40 [ 135.015228][ T6142] ? __pfx___fpu_restore_sig+0x10/0x10 [ 135.015257][ T6142] ? rcu_is_watching+0x13/0xc0 [ 135.015286][ T6142] ? __might_fault+0xc5/0x140 [ 135.015308][ T6142] fpu__restore_sig+0x151/0x190 [ 135.015335][ T6142] ia32_restore_sigcontext+0x456/0x620 [ 135.015355][ T6142] ? __pfx_ia32_restore_sigcontext+0x10/0x10 [ 135.015379][ T6142] ? rcu_is_watching+0x13/0xc0 [ 135.015398][ T6142] ? _raw_spin_unlock_irq+0x23/0x50 [ 135.015427][ T6142] ? lockdep_hardirqs_on+0x7d/0x110 [ 135.015451][ T6142] __do_compat_sys_rt_sigreturn+0x18c/0x270 [ 135.015471][ T6142] ? __pfx___ia32_compat_sys_rt_sigreturn+0x10/0x10 [ 135.015497][ T6142] do_int80_emulation+0x166/0x650 [ 135.015521][ T6142] asm_int80_emulation+0x1a/0x20 [ 135.015539][ T6142] RIP: 0023:0xf7f83fec [ 135.015555][ T6142] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 135.015571][ T6142] RSP: 002b:00000000f544650c EFLAGS: 00000292 [ 135.015586][ T6142] RAX: 0000000000000001 RBX: 0000000000000005 RCX: 0000000080000000 [ 135.015596][ T6142] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 135.015607][ T6142] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 135.015617][ T6142] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 135.015628][ T6142] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 135.015651][ T6142] [ 135.135506][ T45] IPVS: starting estimator thread 0... [ 135.517228][ T6160] IPVS: using max 28 ests per chain, 67200 per kthread [ 136.120451][ T42] audit: type=1326 audit(1790284975.692:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6162 comm="syz.2.70" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f16fec code=0x0 [ 138.536430][ T35] libceph: connect (1)[c::]:6789 error -101 [ 138.536774][ T35] libceph: mon0 (1)[c::]:6789 connect error [ 138.539859][ T35] libceph: connect (1)[c::]:6789 error -101 [ 138.540030][ T35] libceph: mon0 (1)[c::]:6789 connect error [ 138.541005][ T6196] ceph: No mds server is up or the cluster is laggy [ 138.657645][ T42] audit: type=1326 audit(1790284978.232:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6192 comm="syz.3.77" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf707efec code=0x0 [ 138.801752][ T35] libceph: connect (1)[c::]:6789 error -101 [ 138.801913][ T35] libceph: mon0 (1)[c::]:6789 connect error [ 138.975632][ T6098] syz.1.53 (6098) used greatest stack depth: 19416 bytes left [ 139.511725][ T6110] syz.0.55 (6110) used greatest stack depth: 18768 bytes left [ 139.811248][ T6212] binder_alloc: 6209: binder_alloc_buf, no vma [ 140.686092][ T6227] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 142.080807][ T6238] binder_alloc: 6237: binder_alloc_buf, no vma [ 142.685072][ T5527] libceph: connect (1)[c::]:6789 error -101 [ 142.685828][ T5527] libceph: mon0 (1)[c::]:6789 connect error [ 142.688882][ T6240] ceph: No mds server is up or the cluster is laggy [ 142.821587][ T6244] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 143.845345][ T6250] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 144.503365][ T1434] ieee802154 phy0 wpan0: encryption failed: -22 [ 144.503431][ T1434] ieee802154 phy1 wpan1: encryption failed: -22 [ 144.559760][ T42] audit: type=1326 audit(1790284984.142:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6258 comm="syz.1.94" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb5fec code=0x0 [ 144.768304][ T6172] syz.0.71 (6172) used greatest stack depth: 18112 bytes left [ 145.844506][ T92] IPVS: starting estimator thread 0... [ 145.993230][ T6271] IPVS: using max 27 ests per chain, 64800 per kthread [ 146.458969][ T45] IPVS: starting estimator thread 0... [ 146.476775][ T6278] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 146.542476][ T6283] IPVS: using max 28 ests per chain, 67200 per kthread [ 146.596845][ T42] audit: type=1326 audit(1790284986.172:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6273 comm="syz.1.106" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb5fec code=0x0 [ 147.222287][ T6296] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 147.285079][ T1486] libceph: connect (1)[c::]:6789 error -101 [ 147.285290][ T1486] libceph: mon0 (1)[c::]:6789 connect error [ 147.286546][ T6293] ceph: No mds server is up or the cluster is laggy [ 147.542816][ T1486] libceph: connect (1)[c::]:6789 error -101 [ 147.542970][ T1486] libceph: mon0 (1)[c::]:6789 connect error [ 147.579258][ T6300] binder: 6299:6300 ioctl c0306201 0 returned -14 [ 147.667968][ T6302] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 147.842510][ T92] IPVS: starting estimator thread 0... [ 147.924175][ T6307] IPVS: using max 22 ests per chain, 52800 per kthread [ 149.221241][ T6331] netlink: 8 bytes leftover after parsing attributes in process `syz.3.114'. [ 149.221266][ T6331] netlink: 4 bytes leftover after parsing attributes in process `syz.3.114'. [ 149.288100][ T6332] netlink: 'syz.3.114': attribute type 4 has an invalid length. [ 149.288122][ T6332] netlink: 152 bytes leftover after parsing attributes in process `syz.3.114'. [ 149.788274][ T6329] 8021q: adding VLAN 0 to HW filter on device bond1 [ 150.045276][ T6338] binder: 6337:6338 ioctl c0306201 0 returned -14 [ 150.129590][ T6331] 8021q: adding VLAN 0 to HW filter on device bond0 [ 150.194518][ T6340] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 150.264449][ T6331] bond1: (slave bond0): Enslaving as an active interface with a down link [ 150.267766][ T6332] .`: renamed from bond0 (while UP) [ 150.353223][ T6332] bond1: Primary slave changed to .`, reselecting active slave [ 150.587072][ T42] audit: type=1326 audit(1790284990.142:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6341 comm="syz.2.116" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f16fec code=0x0 [ 151.016924][ T6362] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 154.568434][ T6396] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 156.468698][ T6416] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 156.633280][ T42] audit: type=1326 audit(1790284996.212:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6419 comm="syz.3.136" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 156.634318][ T42] audit: type=1326 audit(1790284996.212:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6419 comm="syz.3.136" exe="/syz-executor" sig=0 arch=40000003 syscall=224 compat=1 ip=0xf707efec code=0x7ffc0000 [ 156.634461][ T42] audit: type=1326 audit(1790284996.212:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6419 comm="syz.3.136" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 156.635111][ T42] audit: type=1326 audit(1790284996.212:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6419 comm="syz.3.136" exe="/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf707efec code=0x7ffc0000 [ 156.635371][ T42] audit: type=1326 audit(1790284996.212:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6419 comm="syz.3.136" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 156.635942][ T42] audit: type=1326 audit(1790284996.212:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6419 comm="syz.3.136" exe="/syz-executor" sig=0 arch=40000003 syscall=260 compat=1 ip=0xf707efec code=0x7ffc0000 [ 156.636152][ T42] audit: type=1326 audit(1790284996.212:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6419 comm="syz.3.136" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf707efec code=0x7ffc0000 [ 156.636395][ T42] audit: type=1326 audit(1790284996.212:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6419 comm="syz.3.136" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf707f017 code=0x7ffc0000 [ 156.636564][ T42] audit: type=1326 audit(1790284996.212:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6419 comm="syz.3.136" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 156.662169][ T42] audit: type=1326 audit(1790284996.212:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6419 comm="syz.3.136" exe="/syz-executor" sig=0 arch=40000003 syscall=449 compat=1 ip=0xf707efec code=0x7ffc0000 [ 157.858170][ T6432] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 158.167217][ T6435] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 158.773667][ T6440] netlink: 'syz.0.143': attribute type 1 has an invalid length. [ 159.064699][ T6441] syzkaller0: entered promiscuous mode [ 159.064720][ T6441] syzkaller0: entered allmulticast mode [ 159.065796][ T6440] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 159.073580][ T5901] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 160.110502][ T6457] netlink: 'syz.0.148': attribute type 10 has an invalid length. [ 160.111760][ T6457] syz_tun: entered promiscuous mode [ 160.128530][ T6457] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 160.155135][ T5824] bond0: (slave bond_slave_0): interface is now down [ 160.155164][ T5824] bond0: (slave bond_slave_1): interface is now down [ 160.155176][ T5824] bond0: (slave syz_tun): interface is now down [ 160.174638][ T5824] bond0: (slave bond_slave_0): interface is now down [ 160.174661][ T5824] bond0: (slave bond_slave_1): interface is now down [ 160.174671][ T5824] bond0: (slave syz_tun): interface is now down [ 160.337312][ T5824] bond0: now running without any active interface! [ 162.455112][ T6469] netlink: 4 bytes leftover after parsing attributes in process `syz.0.151'. [ 162.519414][ T6468] netlink: 8 bytes leftover after parsing attributes in process `syz.2.152'. [ 164.756488][ T6509] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 165.279622][ T6521] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 166.371991][ T6540] Bluetooth: MGMT ver 1.23 [ 167.040315][ T6553] netlink: 4 bytes leftover after parsing attributes in process `syz.3.167'. [ 167.050048][ T6553] netlink: 4 bytes leftover after parsing attributes in process `syz.3.167'. [ 167.169631][ T6559] 0x000000000001-0x000000010001 : "" [ 167.407609][ T6559] ftl_cs: FTL header not found. [ 168.482573][ T5763] Bluetooth: hci2: command 0x0401 tx timeout [ 168.482705][ T67] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 170.380026][ T6591] overlayfs: missing 'lowerdir' [ 170.432113][ T6591] netlink: 8 bytes leftover after parsing attributes in process `syz.3.180'. [ 170.922666][ T5862] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 171.292840][ T5862] usb 8-1: Using ep0 maxpacket: 8 [ 171.293624][ T5862] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 171.294626][ T5862] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 171.294664][ T5862] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 171.294683][ T5862] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 171.294703][ T5862] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 171.294721][ T5862] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 171.294752][ T5862] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.669359][ T5862] usb 8-1: usb_control_msg returned -32 [ 171.669399][ T5862] usbtmc 8-1:16.0: can't read capabilities [ 171.871506][ T973] usb 8-1: USB disconnect, device number 2 [ 172.315734][ T6610] 0x000000000001-0x000000010001 : "" [ 172.322292][ T6610] ftl_cs: FTL header not found. [ 175.492784][ T5862] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 175.697440][ T5862] usb 7-1: Using ep0 maxpacket: 8 [ 175.698167][ T5862] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 175.699197][ T5862] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 175.699237][ T5862] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 175.699255][ T5862] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 175.699273][ T5862] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 175.699291][ T5862] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 175.699322][ T5862] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.015340][ T5862] usb 7-1: usb_control_msg returned -32 [ 176.015392][ T5862] usbtmc 7-1:16.0: can't read capabilities [ 176.364170][ T2573] usb 7-1: USB disconnect, device number 2 [ 176.370121][ T6649] usbtmc 7-1:16.0: usb_control_msg returned -71 [ 176.370250][ T6669] usbtmc 7-1:16.0: send_request_dev_dep_msg_in returned -19 [ 176.423298][ T6674] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 177.672302][ T6676] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 177.956043][ T6685] binder: BINDER_SET_CONTEXT_MGR already set [ 177.956060][ T6685] binder: 6681:6685 ioctl 4018620d 80004a80 returned -16 [ 178.106568][ T42] kauditd_printk_skb: 180 callbacks suppressed [ 178.106588][ T42] audit: type=1326 audit(1790285017.682:199): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6681 comm="syz.2.208" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f16fec code=0x7ffc0000 [ 178.106628][ T42] audit: type=1326 audit(1790285017.682:200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6681 comm="syz.2.208" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f16fec code=0x7ffc0000 [ 178.139604][ T42] audit: type=1326 audit(1790285017.712:201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6681 comm="syz.2.208" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f16fec code=0x7ffc0000 [ 178.161259][ T42] audit: type=1326 audit(1790285017.742:202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6681 comm="syz.2.208" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f16fec code=0x7ffc0000 [ 178.197000][ T42] audit: type=1326 audit(1790285017.772:203): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6681 comm="syz.2.208" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71175ab code=0x7ffc0000 [ 178.208710][ T42] audit: type=1326 audit(1790285017.772:204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6681 comm="syz.2.208" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf7f16fec code=0x7ffc0000 [ 178.208754][ T42] audit: type=1326 audit(1790285017.792:205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6681 comm="syz.2.208" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf7f16fec code=0x7ffc0000 [ 178.208788][ T42] audit: type=1326 audit(1790285017.792:206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6681 comm="syz.2.208" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f16fec code=0x7ffc0000 [ 178.208817][ T42] audit: type=1326 audit(1790285017.792:207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6681 comm="syz.2.208" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f16fec code=0x7ffc0000 [ 178.306777][ T42] audit: type=1326 audit(1790285017.882:208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6681 comm="syz.2.208" exe="/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf7f16fec code=0x7ffc0000 [ 178.999289][ T6679] geneve2: entered promiscuous mode [ 179.033768][ T5800] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 44420 - 0 [ 179.033838][ T5800] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 44420 - 0 [ 179.033875][ T5800] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 44420 - 0 [ 179.033898][ T5800] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 44420 - 0 [ 181.465623][ T6705] ======================================================= [ 181.465623][ T6705] WARNING: The mand mount option has been deprecated and [ 181.465623][ T6705] and is ignored by this kernel. Remove the mand [ 181.465623][ T6705] option from the mount to silence this warning. [ 181.465623][ T6705] ======================================================= [ 181.468687][ T6705] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 181.546812][ T6705] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 181.546917][ T6705] overlayfs: failed to look up (tracing) for ino (-66) [ 182.960321][ T6722] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 182.960345][ T6722] UDF-fs: Scanning with blocksize 512 failed [ 182.997217][ T6722] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 182.997237][ T6722] UDF-fs: Scanning with blocksize 1024 failed [ 182.997491][ T6722] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 182.997502][ T6722] UDF-fs: Scanning with blocksize 2048 failed [ 182.997637][ T6722] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 182.997647][ T6722] UDF-fs: Scanning with blocksize 4096 failed [ 183.439917][ T6731] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 184.865404][ T42] kauditd_printk_skb: 1 callbacks suppressed [ 184.865425][ T42] audit: type=1326 audit(1790285024.432:210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6748 comm="syz.3.227" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf707efec code=0x0 [ 186.775626][ T6760] netlink: 8 bytes leftover after parsing attributes in process `syz.3.230'. [ 186.873953][ T6765] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 187.267626][ T6767] bond0: (slave 34): Releasing backup interface [ 187.765144][ T6767] bond0: (slave bond_slave_1): Releasing backup interface [ 187.944269][ T6767] team0: Port device team_slave_0 removed [ 187.997637][ T6767] team0: Port device team_slave_1 removed [ 187.998343][ T6767] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 187.998359][ T6767] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 188.005778][ T6767] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 188.005800][ T6767] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 188.090224][ T6767] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 188.108696][ T6769] team0: Mode changed to "activebackup" [ 188.111330][ T6771] vlan0: entered promiscuous mode [ 188.143429][ T6771] team0: Port device vlan0 added [ 190.679421][ T6798] warning: `syz.0.238' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 192.760232][ T6825] binder: BINDER_SET_CONTEXT_MGR already set [ 192.760247][ T6825] binder: 6824:6825 ioctl 4018620d 80004a80 returned -16 [ 193.974358][ T42] audit: type=1326 audit(1790285033.552:211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6827 comm="syz.1.246" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb5fec code=0x0 [ 194.014148][ T6840] netlink: 104 bytes leftover after parsing attributes in process `syz.3.247'. [ 194.014169][ T6840] netlink: 104 bytes leftover after parsing attributes in process `syz.3.247'. [ 194.171254][ T6843] netlink: 8 bytes leftover after parsing attributes in process `syz.0.248'. [ 194.523051][ T6849] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 194.523080][ T6849] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 194.526079][ T6849] vhci_hcd vhci_hcd.0: Device attached [ 194.803024][ T5843] usb 41-1: new low-speed USB device number 2 using vhci_hcd [ 194.804938][ T1242] usb 7-1: new low-speed USB device number 3 using dummy_hcd [ 194.962696][ T1242] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 194.963241][ T1242] usb 7-1: config 0 has no interfaces? [ 194.963268][ T1242] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.994056][ T1242] usb 7-1: config 0 descriptor?? [ 195.220849][ T6851] usb 41-1: recv xbuf, 0 [ 195.223397][ T1242] usb 7-1: USB disconnect, device number 3 [ 195.230737][ T5824] vhci_hcd vhci_hcd.2: stop threads [ 195.231617][ T5824] vhci_hcd vhci_hcd.2: release socket [ 195.237655][ T5824] vhci_hcd vhci_hcd.2: disconnect device [ 195.288399][ T5843] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 195.695129][ T50] libceph: connect (1)[c::]:6789 error -101 [ 195.695275][ T50] libceph: mon0 (1)[c::]:6789 connect error [ 195.695393][ T6863] ceph: No mds server is up or the cluster is laggy [ 196.442675][ T5527] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 196.593622][ T5527] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 196.598015][ T5527] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 196.598045][ T5527] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 196.598064][ T5527] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 196.598109][ T5527] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 196.676856][ T5527] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 196.676881][ T5527] usb 6-1: Product: syz [ 196.676893][ T5527] usb 6-1: Manufacturer: syz [ 196.689004][ T5527] cdc_wdm 6-1:1.0: skipping garbage [ 196.689024][ T5527] cdc_wdm 6-1:1.0: skipping garbage [ 196.766756][ T5527] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 196.766781][ T5527] cdc_wdm 6-1:1.0: Unknown control protocol [ 196.938395][ T50] usb 6-1: USB disconnect, device number 3 [ 197.296630][ T42] audit: type=1326 audit(1790285036.872:212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6881 comm="syz.3.259" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf707efec code=0x0 [ 197.408201][ T5527] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 197.553464][ T5527] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 197.554808][ T5527] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 197.554836][ T5527] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 197.554854][ T5527] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 197.554896][ T5527] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 197.574101][ T5527] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 197.574123][ T5527] usb 6-1: Product: syz [ 197.574133][ T5527] usb 6-1: Manufacturer: syz [ 197.609929][ T5527] cdc_wdm 6-1:1.0: skipping garbage [ 197.609946][ T5527] cdc_wdm 6-1:1.0: skipping garbage [ 197.612091][ T5527] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 197.612108][ T5527] cdc_wdm 6-1:1.0: Unknown control protocol [ 198.928615][ T35] usb 6-1: USB disconnect, device number 4 [ 199.834884][ T6903] overlayfs: failed to resolve './file0': -2 [ 200.102657][ T6912] netlink: 8 bytes leftover after parsing attributes in process `syz.1.263'. [ 201.042952][ T6922] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 201.195703][ T6923] md: personality for level is not loaded! [ 201.296531][ T6927] Console: switching to colour dummy device 80x25 [ 201.421553][ T6930] process 'syz.3.269' launched './file2' with NULL argv: empty string added [ 204.602902][ T6949] tipc: Started in network mode [ 204.602925][ T6949] tipc: Node identity 4, cluster identity 4711 [ 204.602936][ T6949] tipc: Node number set to 4 [ 204.605774][ T6949] tipc: Enabled bearer , priority 0 [ 204.609420][ T6949] tipc: Resetting bearer [ 204.767359][ T6949] tipc: Disabling bearer [ 205.178514][ T6959] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 205.560334][ T6965] jffs2: notice: (6965) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 205.929245][ T1434] ieee802154 phy0 wpan0: encryption failed: -22 [ 205.929298][ T1434] ieee802154 phy1 wpan1: encryption failed: -22 [ 206.130622][ T6973] netlink: 8 bytes leftover after parsing attributes in process `syz.1.285'. [ 206.780897][ T6980] netlink: 4 bytes leftover after parsing attributes in process `syz.2.287'. [ 207.604572][ T6997] FAULT_INJECTION: forcing a failure. [ 207.604572][ T6997] name failslab, interval 1, probability 0, space 0, times 0 [ 207.604602][ T6997] CPU: 0 UID: 0 PID: 6997 Comm: syz.1.291 Not tainted syzkaller #0 PREEMPT(full) [ 207.604626][ T6997] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 207.604638][ T6997] Call Trace: [ 207.604644][ T6997] [ 207.604653][ T6997] dump_stack_lvl+0x100/0x190 [ 207.604684][ T6997] should_fail_ex.cold+0x5/0xa [ 207.604707][ T6997] should_failslab+0xc2/0x120 [ 207.604734][ T6997] __kmalloc_cache_noprof+0x91/0x6d0 [ 207.604755][ T6997] ? tcf_block_get_ext+0x3c8/0x1950 [ 207.604792][ T6997] tcf_block_get_ext+0x3c8/0x1950 [ 207.604815][ T6997] ? netlink_rcv_skb+0x159/0x420 [ 207.604839][ T6997] ? netlink_unicast+0x585/0x850 [ 207.604867][ T6997] tcf_block_get+0xa8/0x100 [ 207.604889][ T6997] ? __pfx_tcf_block_get+0x10/0x10 [ 207.604912][ T6997] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 207.604946][ T6997] sfb_init+0x33/0xc0 [ 207.604973][ T6997] ? __pfx_sfb_init+0x10/0x10 [ 207.605000][ T6997] qdisc_create+0x47b/0x1060 [ 207.605027][ T6997] ? nla_strcmp+0xff/0x130 [ 207.605047][ T6997] tc_modify_qdisc+0xdcf/0x2120 [ 207.605169][ T6997] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 207.605222][ T6997] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 207.605252][ T6997] rtnetlink_rcv_msg+0x3c9/0xe90 [ 207.605273][ T6997] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 207.605296][ T6997] ? ref_tracker_free+0x37e/0x6c0 [ 207.605318][ T6997] netlink_rcv_skb+0x159/0x420 [ 207.605344][ T6997] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 207.605365][ T6997] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 207.605400][ T6997] ? netlink_deliver_tap+0x1ae/0xcc0 [ 207.605427][ T6997] netlink_unicast+0x585/0x850 [ 207.605456][ T6997] ? __pfx_netlink_unicast+0x10/0x10 [ 207.605489][ T6997] netlink_sendmsg+0x8b0/0xda0 [ 207.605517][ T6997] ? __pfx_netlink_sendmsg+0x10/0x10 [ 207.605543][ T6997] ? apparmor_socket_sendmsg+0x165/0x280 [ 207.605574][ T6997] ____sys_sendmsg+0xa4d/0xbe0 [ 207.605595][ T6997] ? __pfx_netlink_sendmsg+0x10/0x10 [ 207.605623][ T6997] ? __pfx_____sys_sendmsg+0x10/0x10 [ 207.605653][ T6997] ___sys_sendmsg+0x190/0x1e0 [ 207.605677][ T6997] ? __pfx____sys_sendmsg+0x10/0x10 [ 207.605701][ T6997] ? futex_wait+0x11e/0x370 [ 207.605753][ T6997] ? find_held_lock+0x2b/0x80 [ 207.605800][ T6997] __sys_sendmsg+0x160/0x210 [ 207.605831][ T6997] ? __pfx___sys_sendmsg+0x10/0x10 [ 207.605877][ T6997] __do_fast_syscall_32+0x13a/0x8b0 [ 207.605901][ T6997] do_fast_syscall_32+0x32/0x70 [ 207.605923][ T6997] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 207.605950][ T6997] RIP: 0023:0xf7fb5fec [ 207.605973][ T6997] Code: Unable to access opcode bytes at 0xf7fb5fc2. [ 207.605981][ T6997] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 207.606000][ T6997] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000800000c0 [ 207.606012][ T6997] RDX: 000000002000400c RSI: 0000000000000000 RDI: 0000000000000000 [ 207.606024][ T6997] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 207.606036][ T6997] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 207.606049][ T6997] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 207.606074][ T6997] [ 212.106511][ T973] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 212.920836][ T7057] netlink: 36 bytes leftover after parsing attributes in process `syz.2.303'. [ 214.122388][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 215.944179][ T42] audit: type=1326 audit(1790285055.522:213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7061 comm="syz.3.308" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 215.944361][ T42] audit: type=1326 audit(1790285055.522:214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7061 comm="syz.3.308" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 216.145213][ T42] audit: type=1326 audit(1790285055.722:215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7065 comm="syz.0.309" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f83fec code=0x0 [ 217.615791][ T7087] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 219.756545][ T7098] netlink: 4 bytes leftover after parsing attributes in process `syz.2.315'. [ 219.820619][ T7098] netlink: 4 bytes leftover after parsing attributes in process `syz.2.315'. [ 219.879975][ T7100] netlink: 'syz.1.316': attribute type 1 has an invalid length. [ 220.005520][ T7100] 8021q: adding VLAN 0 to HW filter on device bond1 [ 220.365787][ T7103] bond1: (slave gretap1): making interface the new active one [ 220.427989][ T7103] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 220.989133][ T7116] Trying to write to read-only block-device nullb0 [ 221.185028][ T7109] orangefs_mount: mount request failed with -4 [ 221.817747][ T42] audit: type=1326 audit(1790285061.392:216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7119 comm="syz.3.321" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf707efec code=0x0 [ 222.144189][ T5862] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 222.303331][ T5862] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 222.304876][ T5862] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 222.304916][ T5862] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.322027][ T7130] syz_tun: entered allmulticast mode [ 222.358612][ T7130] syz_tun: left allmulticast mode [ 222.375036][ T5862] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 222.375971][ T5862] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 81 [ 222.376034][ T5862] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 1 [ 222.419183][ T5862] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 84 [ 222.419289][ T5862] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 2 [ 222.442217][ T5862] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 222.474445][ T5862] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 88 [ 222.474522][ T5862] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 222.478805][ T5862] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 222.779730][ T7138] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 222.859077][ T7138] md: array md0 already has disks! [ 222.956715][ T7140] IPv6: addrconf: prefix option has invalid lifetime [ 223.369756][ T7138] md: pers->run() failed ... [ 224.044241][ T7151] netlink: 4 bytes leftover after parsing attributes in process `syz.3.329'. [ 225.069876][ T65] usb 5-1: USB disconnect, device number 3 [ 225.185095][ T65] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 225.198602][ T65] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 225.199022][ T65] keyspan 5-1:1.0: device disconnected [ 228.889204][ T42] audit: type=1326 audit(1790285068.452:217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7174 comm="syz.0.335" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f83fec code=0x0 [ 230.056057][ T7188] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 230.298383][ T7195] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 231.033430][ T5864] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 231.228743][ T5864] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 231.272563][ T5864] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 231.272608][ T5864] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 231.278473][ T5864] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 231.278496][ T5864] usb 6-1: Product: syz [ 231.278507][ T5864] usb 6-1: Manufacturer: syz [ 231.278519][ T5864] usb 6-1: SerialNumber: syz [ 232.587294][ T7213] ubi0: attaching mtd0 [ 232.591682][ T7213] ubi0: scanning is finished [ 232.591732][ T7213] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 232.871106][ T5527] usb 6-1: USB disconnect, device number 5 [ 233.167950][ T7213] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 233.321218][ T7219] overlayfs: overlapping lowerdir path [ 233.330015][ T7219] overlayfs: overlapping lowerdir path [ 233.696387][ T5758] Bluetooth: hci1: command 0x0406 tx timeout [ 233.696428][ T5758] Bluetooth: hci2: command 0x0401 tx timeout [ 233.696449][ T5758] Bluetooth: hci0: command 0x0406 tx timeout [ 233.699025][ T5758] Bluetooth: hci3: command 0x0406 tx timeout [ 234.358279][ T7224] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 235.559854][ T42] audit: type=1326 audit(1790285075.122:218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7238 comm="syz.0.353" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f83fec code=0x7ffc0000 [ 235.559902][ T42] audit: type=1326 audit(1790285075.122:219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7238 comm="syz.0.353" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f83fec code=0x7ffc0000 [ 235.559937][ T42] audit: type=1326 audit(1790285075.122:220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7238 comm="syz.0.353" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f83fec code=0x7ffc0000 [ 235.559973][ T42] audit: type=1326 audit(1790285075.122:221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7238 comm="syz.0.353" exe="/syz-executor" sig=0 arch=40000003 syscall=320 compat=1 ip=0xf7f83fec code=0x7ffc0000 [ 235.560008][ T42] audit: type=1326 audit(1790285075.122:222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7238 comm="syz.0.353" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f83fec code=0x7ffc0000 [ 235.560043][ T42] audit: type=1326 audit(1790285075.122:223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7238 comm="syz.0.353" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f83fec code=0x7ffc0000 [ 235.560080][ T42] audit: type=1326 audit(1790285075.122:224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7238 comm="syz.0.353" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f83fec code=0x7ffc0000 [ 235.560116][ T42] audit: type=1326 audit(1790285075.122:225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7238 comm="syz.0.353" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f83fec code=0x7ffc0000 [ 235.560151][ T42] audit: type=1326 audit(1790285075.122:226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7238 comm="syz.0.353" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f83fec code=0x7ffc0000 [ 235.560185][ T42] audit: type=1326 audit(1790285075.122:227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7238 comm="syz.0.353" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f83fec code=0x7ffc0000 [ 235.582155][ T7239] kAFS: No cell specified [ 236.018368][ T7243] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 236.208868][ T56] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 236.363598][ T56] usb 5-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 236.364674][ T56] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 236.364696][ T56] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 236.367178][ T56] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.367198][ T56] usb 5-1: Product: syz [ 236.367209][ T56] usb 5-1: Manufacturer: syz [ 236.367221][ T56] usb 5-1: SerialNumber: syz [ 236.508279][ T7255] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 236.677864][ T56] usblp 5-1:1.0: usblp0: USB Bidirectional printer dev 4 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 236.987008][ T56] usb 5-1: USB disconnect, device number 4 [ 237.004129][ T56] usblp0: removed [ 237.088138][ T7266] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 237.917541][ T7270] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 238.146167][ T7272] syzkaller0: entered promiscuous mode [ 238.146290][ T7272] syzkaller0: entered allmulticast mode [ 239.144745][ T7291] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 240.007851][ T1242] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 240.172668][ T1242] usb 6-1: Using ep0 maxpacket: 16 [ 240.175231][ T1242] usb 6-1: unable to get BOS descriptor or descriptor too short [ 240.175270][ T1242] usb 6-1: New USB device found, idVendor=0d8c, idProduct=0201, bcdDevice= 0.40 [ 240.198044][ T1242] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 240.198064][ T1242] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 240.200106][ T1242] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.200128][ T1242] usb 6-1: Product: syz [ 240.200140][ T1242] usb 6-1: Manufacturer: syz [ 240.200150][ T1242] usb 6-1: SerialNumber: syz [ 242.732170][ T1242] usb 6-1: cannot find UAC_HEADER [ 243.006710][ T1242] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 243.011596][ T1242] usb 6-1: USB disconnect, device number 6 [ 243.116975][ T5768] udevd[5768]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 245.571010][ T7343] netlink: 28 bytes leftover after parsing attributes in process `syz.3.385'. [ 245.946226][ T7348] binder: 7347:7348 ioctl c0306201 0 returned -14 [ 248.306366][ T7387] netlink: 4 bytes leftover after parsing attributes in process `syz.2.397'. [ 249.869943][ T7402] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 252.958506][ T42] kauditd_printk_skb: 33 callbacks suppressed [ 252.958523][ T42] audit: type=1326 audit(1790285092.522:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7420 comm="syz.2.407" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f16fec code=0x0 [ 252.987652][ T7429] FAULT_INJECTION: forcing a failure. [ 252.987652][ T7429] name failslab, interval 1, probability 0, space 0, times 0 [ 252.987686][ T7429] CPU: 3 UID: 0 PID: 7429 Comm: syz.0.408 Not tainted syzkaller #0 PREEMPT(full) [ 252.987709][ T7429] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 252.987721][ T7429] Call Trace: [ 252.987728][ T7429] [ 252.987736][ T7429] dump_stack_lvl+0x100/0x190 [ 252.987770][ T7429] should_fail_ex.cold+0x5/0xa [ 252.987797][ T7429] should_failslab+0xc2/0x120 [ 252.987823][ T7429] __kmalloc_noprof+0xfc/0x840 [ 252.987845][ T7429] ? rcu_is_watching+0x13/0xc0 [ 252.987866][ T7429] ? tomoyo_realpath_from_path+0xb6/0x690 [ 252.987894][ T7429] tomoyo_realpath_from_path+0xb6/0x690 [ 252.987923][ T7429] tomoyo_check_open_permission+0x2af/0x3c0 [ 252.987956][ T7429] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 252.987994][ T7429] ? hook_file_open+0x248/0x8e0 [ 252.988040][ T7429] tomoyo_file_open+0x6b/0x90 [ 252.988066][ T7429] security_file_open+0xb5/0x1e0 [ 252.988088][ T7429] do_dentry_open+0x588/0x14d0 [ 252.988120][ T7429] vfs_open+0x82/0x3f0 [ 252.988152][ T7429] path_openat+0x19fa/0x2440 [ 252.988183][ T7429] ? __pfx_path_openat+0x10/0x10 [ 252.988216][ T7429] do_file_open+0x20e/0x430 [ 252.988244][ T7429] ? __pfx_do_file_open+0x10/0x10 [ 252.988288][ T7429] ? _raw_spin_unlock+0x28/0x50 [ 252.988317][ T7429] ? alloc_fd+0x471/0x7a0 [ 252.988347][ T7429] do_sys_openat2+0x10f/0x1e0 [ 252.988374][ T7429] ? __pfx_do_sys_openat2+0x10/0x10 [ 252.988401][ T7429] ? __fget_files+0x215/0x3d0 [ 252.988428][ T7429] __ia32_compat_sys_openat+0x12d/0x210 [ 252.988456][ T7429] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 252.988501][ T7429] __do_fast_syscall_32+0x13a/0x8b0 [ 252.988528][ T7429] do_fast_syscall_32+0x32/0x70 [ 252.988552][ T7429] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 252.988577][ T7429] RIP: 0023:0xf7f83fec [ 252.988599][ T7429] Code: Unable to access opcode bytes at 0xf7f83fc2. [ 252.988607][ T7429] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 252.988626][ T7429] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000040 [ 252.988638][ T7429] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 252.988648][ T7429] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 252.988658][ T7429] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 252.988669][ T7429] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 252.988693][ T7429] [ 252.988700][ T7429] ERROR: Out of memory at tomoyo_realpath_from_path. [ 256.052920][ T5843] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 256.512882][ T5843] usb 6-1: Using ep0 maxpacket: 8 [ 256.533035][ T5843] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 256.534939][ T5843] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 256.534983][ T5843] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 256.535003][ T5843] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 256.535022][ T5843] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 256.535041][ T5843] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 256.535075][ T5843] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 256.980476][ T5843] usb 6-1: usb_control_msg returned -32 [ 256.980516][ T5843] usbtmc 6-1:16.0: can't read capabilities [ 256.986658][ T7456] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 257.212131][ T7456] team0: No ports can be present during mode change [ 257.287833][ T7456] tipc: Started in network mode [ 257.287863][ T7456] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 257.288072][ T7456] tipc: Enabled bearer , priority 0 [ 257.508842][ T7461] overlayfs: overlapping lowerdir path [ 257.512094][ T7463] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 257.673770][ T7466] overlayfs: overlapping lowerdir path [ 258.105347][ T7473] usbtmc 6-1:16.0: usb_control_msg returned -32 [ 258.177447][ T7474] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.179396][ T7474] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.336778][ T35] tipc: Node number set to 11578026 [ 259.128809][ T42] audit: type=1326 audit(1790285098.702:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7483 comm="syz.0.423" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f83fec code=0x0 [ 259.890355][ T7496] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 260.073517][ T1242] usb 6-1: USB disconnect, device number 7 [ 260.718316][ T5864] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 260.941422][ T5864] usb 6-1: Using ep0 maxpacket: 32 [ 261.036171][ T5864] usb 6-1: unable to get BOS descriptor or descriptor too short [ 261.036221][ T5864] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 261.041944][ T5864] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 261.041969][ T5864] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 261.041984][ T5864] usb 6-1: config 14 has no interface number 0 [ 261.041997][ T5864] usb 6-1: config 14 has no interface number 1 [ 261.042041][ T5864] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 261.042060][ T5864] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 261.042079][ T5864] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 261.042098][ T5864] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 261.042117][ T5864] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 261.042136][ T5864] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 261.042157][ T5864] usb 6-1: config 14 interface 57 has no altsetting 0 [ 261.042170][ T5864] usb 6-1: config 14 interface 228 has no altsetting 0 [ 261.063879][ T5864] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.063988][ T5864] usb 6-1: Product: syz [ 261.064003][ T5864] usb 6-1: Manufacturer: syz [ 261.064015][ T5864] usb 6-1: SerialNumber: syz [ 261.601635][ T5864] legousbtower 6-1:14.57: interrupt endpoints not found [ 262.056444][ T5864] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 262.057964][ T5864] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 262.299761][ T7512] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 262.611143][ T7516] overlayfs: overlapping lowerdir path [ 262.693823][ T7519] overlayfs: overlapping lowerdir path [ 263.070150][ T9] usb 6-1: USB disconnect, device number 8 [ 263.298780][ T9] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 264.053091][ T65] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 264.132187][ T7529] netlink: 28 bytes leftover after parsing attributes in process `syz.1.434'. [ 264.210803][ T65] usb 8-1: Using ep0 maxpacket: 16 [ 264.240854][ T65] usb 8-1: unable to get BOS descriptor or descriptor too short [ 264.240938][ T65] usb 8-1: New USB device found, idVendor=0d8c, idProduct=0201, bcdDevice= 0.40 [ 264.242112][ T65] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 264.242129][ T65] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 264.260724][ T65] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.260746][ T65] usb 8-1: Product: syz [ 264.260758][ T65] usb 8-1: Manufacturer: syz [ 264.260769][ T65] usb 8-1: SerialNumber: syz [ 266.753308][ T65] usb 8-1: cannot find UAC_HEADER [ 266.880073][ T65] snd-usb-audio 8-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 266.884146][ T65] usb 8-1: USB disconnect, device number 4 [ 266.911614][ T5768] udevd[5768]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 267.365316][ T1434] ieee802154 phy0 wpan0: encryption failed: -22 [ 267.365363][ T1434] ieee802154 phy1 wpan1: encryption failed: -22 [ 269.952432][ T5527] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 270.123481][ T5527] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 270.124446][ T5527] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 270.124468][ T5527] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 270.124482][ T5527] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 270.124516][ T5527] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 270.125924][ T5527] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 270.125943][ T5527] usb 5-1: Product: syz [ 270.125954][ T5527] usb 5-1: Manufacturer: syz [ 270.138137][ T5527] cdc_wdm 5-1:1.0: skipping garbage [ 270.138152][ T5527] cdc_wdm 5-1:1.0: skipping garbage [ 270.140259][ T5527] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 270.140275][ T5527] cdc_wdm 5-1:1.0: Unknown control protocol [ 270.390380][ T5527] usb 5-1: USB disconnect, device number 5 [ 270.922508][ T65] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 271.078666][ T65] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 271.079888][ T65] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 271.079909][ T65] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 271.079922][ T65] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 271.079956][ T65] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 271.081409][ T65] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 271.081469][ T65] usb 5-1: Product: syz [ 271.081482][ T65] usb 5-1: Manufacturer: syz [ 271.086595][ T65] cdc_wdm 5-1:1.0: skipping garbage [ 271.086612][ T65] cdc_wdm 5-1:1.0: skipping garbage [ 271.109946][ T65] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 271.109966][ T65] cdc_wdm 5-1:1.0: Unknown control protocol [ 271.246383][ T7598] 8021q: adding VLAN 0 to HW filter on device .` [ 271.272548][ T9] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 271.469280][ T9] usb 7-1: Using ep0 maxpacket: 16 [ 271.480439][ T9] usb 7-1: unable to get BOS descriptor or descriptor too short [ 271.480482][ T9] usb 7-1: New USB device found, idVendor=0d8c, idProduct=0201, bcdDevice= 0.40 [ 271.481641][ T9] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 271.481659][ T9] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 271.489708][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.489732][ T9] usb 7-1: Product: syz [ 271.489744][ T9] usb 7-1: Manufacturer: syz [ 271.489757][ T9] usb 7-1: SerialNumber: syz [ 272.281669][ T5851] usb 5-1: USB disconnect, device number 6 [ 272.505104][ T9] usb 7-1: cannot find UAC_HEADER [ 272.590283][ T9] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 272.608043][ T9] usb 7-1: USB disconnect, device number 4 [ 272.632617][ T5768] udevd[5768]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 272.925875][ T7613] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 273.415794][ T7621] netlink: 4 bytes leftover after parsing attributes in process `syz.1.462'. [ 273.876233][ T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!! [ 274.660827][ T7632] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 274.935632][ T7636] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 276.255955][ T7662] netlink: 4 bytes leftover after parsing attributes in process `syz.1.472'. [ 276.257225][ T7662] netlink: 4 bytes leftover after parsing attributes in process `syz.1.472'. [ 277.131011][ T42] audit: type=1326 audit(1790285116.702:263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7672 comm="syz.3.474" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf707efec code=0x0 [ 277.522820][ T5843] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 277.673707][ T5843] usb 5-1: Using ep0 maxpacket: 16 [ 277.676726][ T5843] usb 5-1: unable to get BOS descriptor or descriptor too short [ 277.676769][ T5843] usb 5-1: New USB device found, idVendor=0d8c, idProduct=0201, bcdDevice= 0.40 [ 277.678161][ T5843] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 277.678180][ T5843] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 277.681066][ T5843] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.681086][ T5843] usb 5-1: Product: syz [ 277.681097][ T5843] usb 5-1: Manufacturer: syz [ 277.681107][ T5843] usb 5-1: SerialNumber: syz [ 278.455028][ T7696] bridge_slave_0: left allmulticast mode [ 278.455057][ T7696] bridge_slave_0: left promiscuous mode [ 278.455238][ T7696] bridge0: port 1(bridge_slave_0) entered disabled state [ 278.495542][ T7696] bridge_slave_1: left allmulticast mode [ 278.495576][ T7696] bridge_slave_1: left promiscuous mode [ 278.495759][ T7696] bridge0: port 2(bridge_slave_1) entered disabled state [ 278.704607][ T7696] bond0: (slave bond_slave_0): Releasing backup interface [ 278.743434][ T7696] bond0: (slave bond_slave_1): Releasing backup interface [ 278.784163][ T7696] team0: Port device team_slave_0 removed [ 278.805952][ T7696] team0: Port device team_slave_1 removed [ 278.806745][ T7696] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 278.806764][ T7696] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 278.864794][ T7696] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 278.864817][ T7696] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 278.885758][ T7696] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 278.886226][ T7698] team0: Mode changed to "activebackup" [ 278.903557][ T7700] tipc: Started in network mode [ 278.904762][ T7700] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 278.904933][ T7700] tipc: Enabled bearer , priority 0 [ 278.925399][ T7699] vlan0: entered promiscuous mode [ 278.973847][ T7699] team0: Port device vlan0 added [ 279.285565][ T7708] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 279.448771][ T5843] usb 5-1: cannot find UAC_HEADER [ 279.512819][ T35] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 279.540077][ T7704] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 279.540142][ T7704] overlayfs: failed to look up (tracing) for ino (-66) [ 279.592955][ T5843] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 279.665086][ T5843] usb 5-1: USB disconnect, device number 7 [ 279.666312][ T35] usb 8-1: Using ep0 maxpacket: 32 [ 279.667652][ T35] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 279.731107][ T5768] udevd[5768]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 279.789531][ T35] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 279.800848][ T35] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 279.800874][ T35] usb 8-1: Product: syz [ 279.800888][ T35] usb 8-1: Manufacturer: syz [ 279.800901][ T35] usb 8-1: SerialNumber: syz [ 279.827028][ T35] usb 8-1: config 0 descriptor?? [ 279.830552][ T7705] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 279.833469][ T35] hub 8-1:0.0: bad descriptor, ignoring hub [ 279.833490][ T35] hub 8-1:0.0: probe with driver hub failed with error -5 [ 280.357509][ T5851] tipc: Node number set to 11578026 [ 280.925489][ T7705] netlink: 8 bytes leftover after parsing attributes in process `syz.3.493'. [ 280.928359][ T7705] netlink: 8 bytes leftover after parsing attributes in process `syz.3.493'. [ 280.929231][ T7705] netlink: 8 bytes leftover after parsing attributes in process `syz.3.493'. [ 280.966804][ T7705] netlink: 8 bytes leftover after parsing attributes in process `syz.3.493'. [ 280.966942][ T7705] netlink: 8 bytes leftover after parsing attributes in process `syz.3.493'. [ 281.360481][ T5851] usb 8-1: USB disconnect, device number 5 [ 281.373016][ T7723] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 281.738727][ T7723] md: pers->run() failed ... [ 283.828247][ T7752] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 284.521617][ T7758] netlink: 'syz.3.501': attribute type 7 has an invalid length. [ 284.896117][ T5851] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 285.833752][ T5851] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 285.834757][ T5851] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 285.834777][ T5851] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 285.834805][ T5851] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.838337][ T5851] usb 5-1: config 0 descriptor?? [ 286.785712][ T7779] se_dev->se_dev_ptr already set for storage object [ 287.527243][ T7788] tipc: Enabling of bearer rejected, failed to enable media [ 288.054097][ T1242] usb 5-1: USB disconnect, device number 8 [ 288.269271][ T7794] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 288.392830][ T7792] null_blk: disk rnullb0 created [ 288.763980][ T7796] md: pers->run() failed ... [ 288.937996][ T7813] batman_adv: batadv0: Adding interface: veth0 [ 288.938014][ T7813] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 288.938395][ T7813] batman_adv: batadv0: Interface activated: veth0 [ 290.767136][ T7809] batman_adv: batadv0: Interface deactivated: veth0 [ 290.767164][ T7809] batman_adv: batadv0: Removing interface: veth0 [ 292.224577][ T7845] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 293.627576][ T42] audit: type=1326 audit(1790285133.182:264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7858 comm="syz.3.519" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf707efec code=0x0 [ 295.197221][ T7882] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 295.372971][ T65] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 295.458595][ T7884] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 295.535468][ T65] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 295.542895][ T65] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 295.542916][ T65] usb 7-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 295.542932][ T65] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 295.542966][ T65] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 295.542988][ T65] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 295.545166][ T65] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 295.545186][ T65] usb 7-1: Product: syz [ 295.545197][ T65] usb 7-1: Manufacturer: syz [ 295.549330][ T65] cdc_wdm 7-1:1.0: skipping garbage [ 295.549355][ T65] cdc_wdm 7-1:1.0: skipping garbage [ 295.608915][ T65] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 295.608935][ T65] cdc_wdm 7-1:1.0: Unknown control protocol [ 295.947818][ T7887] md: array md0 already has disks! [ 296.198155][ C1] cdc_wdm 7-1:1.0: Unexpected error -71 [ 296.199299][ T9] usb 7-1: USB disconnect, device number 5 [ 296.200080][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 296.200156][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 296.200171][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 296.345579][ T7887] md: pers->run() failed ... [ 296.345792][ T7889] md: could not open device unknown-block(1,0). [ 296.345834][ T7889] md: error, md_import_device() returned -16 [ 297.871761][ T42] audit: type=1326 audit(1790285137.442:265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7901 comm="syz.0.533" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f83fec code=0x0 [ 298.177860][ T7914] netlink: 4 bytes leftover after parsing attributes in process `syz.3.535'. [ 298.785987][ T7921] netlink: 'syz.1.537': attribute type 1 has an invalid length. [ 299.835722][ T65] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 299.992583][ T65] usb 7-1: Using ep0 maxpacket: 32 [ 299.999564][ T65] usb 7-1: unable to get BOS descriptor or descriptor too short [ 299.999606][ T65] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 300.000920][ T65] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 300.000943][ T65] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 300.000959][ T65] usb 7-1: config 14 has no interface number 0 [ 300.000978][ T65] usb 7-1: config 14 has no interface number 1 [ 300.001021][ T65] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 300.001039][ T65] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 300.001058][ T65] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 300.001079][ T65] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 300.001099][ T65] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 300.001119][ T65] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 300.001139][ T65] usb 7-1: config 14 interface 57 has no altsetting 0 [ 300.001154][ T65] usb 7-1: config 14 interface 228 has no altsetting 0 [ 300.008398][ T65] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 300.008423][ T65] usb 7-1: Product: syz [ 300.008434][ T65] usb 7-1: Manufacturer: syz [ 300.008445][ T65] usb 7-1: SerialNumber: syz [ 300.436508][ T7939] program syz.3.542 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 300.628325][ T65] legousbtower 7-1:14.57: interrupt endpoints not found [ 301.075741][ T65] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 301.077465][ T65] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 301.105769][ T7944] bond0: (slave syz_tun): Releasing backup interface [ 301.285545][ T7944] bridge_slave_0: left allmulticast mode [ 301.285576][ T7944] bridge_slave_0: left promiscuous mode [ 301.285780][ T7944] bridge0: port 1(bridge_slave_0) entered disabled state [ 301.315307][ T7944] bridge_slave_1: left allmulticast mode [ 301.315339][ T7944] bridge_slave_1: left promiscuous mode [ 301.315576][ T7944] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.572091][ T7944] bond0: (slave bond_slave_0): Releasing backup interface [ 301.582027][ T7944] bond0: (slave bond_slave_1): Releasing backup interface [ 301.599408][ T7944] team0: Port device team_slave_0 removed [ 301.662101][ T7944] team0: Port device team_slave_1 removed [ 301.711911][ T7944] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 301.725525][ T7945] team0: Port device xfrm0 added [ 301.725771][ T7946] tipc: Started in network mode [ 301.725793][ T7946] tipc: Node identity 1a89485fa6a7, cluster identity 4711 [ 301.725949][ T7946] tipc: Enabled bearer , priority 0 [ 302.061222][ T25] usb 7-1: USB disconnect, device number 6 [ 302.155162][ T25] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 302.843234][ T25] tipc: Node number set to 3157149791 [ 303.260028][ T42] audit: type=1326 audit(1790285142.822:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7958 comm="syz.3.547" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf707efec code=0x0 [ 305.088647][ T7982] Bluetooth: MGMT ver 1.23 [ 306.804016][ T7979] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 307.850008][ T8000] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 311.362015][ T8025] md: pers->run() failed ... [ 311.392876][ T8021] md: array md0 already has disks! [ 311.472733][ T8028] md: could not open device unknown-block(1,0). [ 311.472790][ T8028] md: error, md_import_device() returned -16 [ 311.989976][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 312.069241][ T8037] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 312.514024][ T8037] md/raid1:md0: not clean -- starting background reconstruction [ 312.514041][ T8037] md/raid1:md0: active with 2 out of 2 mirrors [ 312.517487][ T8037] md0: detected capacity change from 0 to 8192 [ 312.524886][ T8045] md_update_sb: can't update sb for read-only array md0 [ 313.363131][ T8045] md_update_sb: can't update sb for read-only array md0 [ 313.897545][ T8063] tipc: Resetting bearer [ 313.930478][ T8063] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 314.115023][ T8063] team0: Device xfrm0 is of different type [ 314.154721][ T8063] tipc: Enabling of bearer rejected, already enabled [ 314.342506][ T5843] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 314.512512][ T5843] usb 8-1: Using ep0 maxpacket: 8 [ 314.513247][ T5843] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 314.514409][ T5843] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 314.514448][ T5843] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 314.514466][ T5843] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 314.514485][ T5843] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 314.514504][ T5843] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 314.514536][ T5843] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.588752][ T5843] usb 8-1: usb_control_msg returned -32 [ 315.588883][ T5843] usbtmc 8-1:16.0: can't read capabilities [ 316.454106][ T8087] usbtmc 8-1:16.0: usb_control_msg returned -32 [ 316.591769][ T8067] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 316.592121][ T8067] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 318.030814][ T5843] usb 8-1: USB disconnect, device number 6 [ 318.404237][ T8093] xt_nfacct: accounting object `\$9ZM#mU|^c\F9YⳈ' does not exist [ 318.425745][ T8093] 9pnet_fd: Insufficient options for proto=fd [ 322.284396][ T8148] nbd1: detected capacity change from 0 to 18 [ 322.293695][ T5110] block nbd1: Send control failed (result -32) [ 322.293773][ T5110] block nbd1: Request send failed, requeueing [ 322.297343][ T5110] block nbd1: Dead connection, failed to find a fallback [ 322.297364][ T5110] block nbd1: shutting down sockets [ 322.297425][ T5110] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 322.297493][ T5110] Buffer I/O error on dev nbd1, logical block 0, async page read [ 322.299555][ T5110] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 322.299578][ T5110] Buffer I/O error on dev nbd1, logical block 0, async page read [ 322.301631][ T5110] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 322.301658][ T5110] Buffer I/O error on dev nbd1, logical block 0, async page read [ 322.301791][ T5110] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 322.301808][ T5110] Buffer I/O error on dev nbd1, logical block 0, async page read [ 322.301879][ T5110] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 322.301896][ T5110] Buffer I/O error on dev nbd1, logical block 0, async page read [ 322.301985][ T5110] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 322.302002][ T5110] Buffer I/O error on dev nbd1, logical block 0, async page read [ 322.302092][ T5110] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 322.302110][ T5110] Buffer I/O error on dev nbd1, logical block 0, async page read [ 322.302189][ T5110] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 322.302217][ T5110] Buffer I/O error on dev nbd1, logical block 0, async page read [ 322.302245][ T5768] ldm_validate_partition_table(): Disk read failed. [ 322.302401][ T5110] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 322.302420][ T5110] Buffer I/O error on dev nbd1, logical block 0, async page read [ 322.302502][ T5110] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 322.302520][ T5110] Buffer I/O error on dev nbd1, logical block 0, async page read [ 322.302676][ T5768] Dev nbd1: unable to read RDB block 0 [ 322.302875][ T5768] nbd1: unable to read partition table [ 322.303019][ T5768] nbd1: partition table beyond EOD, truncated [ 322.407730][ T8154] nbd1: detected capacity change from 18 to 0 [ 322.426511][ T5768] ldm_validate_partition_table(): Disk read failed. [ 322.426539][ T5768] Dev nbd1: unable to read RDB block 0 [ 322.426560][ T5768] nbd1: unable to read partition table [ 322.426722][ T5768] nbd1: partition table beyond EOD, truncated [ 322.665320][ T8148] pi3usb30532 0-0005: Error reading config register -6 [ 322.670991][ T8148] i2c i2c-0: new_device: Instantiated device pi3usb30532 at 0x05 [ 322.922841][ T5864] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 323.122513][ T5864] usb 5-1: Using ep0 maxpacket: 8 [ 323.123325][ T5864] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 323.124292][ T5864] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 323.124331][ T5864] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 323.124349][ T5864] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 323.124367][ T5864] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 323.124385][ T5864] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 323.124414][ T5864] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.232615][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 323.481256][ T5864] usb 5-1: usb_control_msg returned -32 [ 323.481294][ T5864] usbtmc 5-1:16.0: can't read capabilities [ 323.529503][ T8168] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 323.724695][ T8045] md_update_sb: can't update sb for read-only array md0 [ 323.819689][ T8045] md_update_sb: can't update sb for read-only array md0 [ 323.902618][ T8045] md_update_sb: can't update sb for read-only array md0 [ 324.081775][ T8175] md: resync of RAID array md0 [ 324.596119][ T8176] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 324.606334][ T8175] md: md0: resync done. [ 324.697229][ T8176] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 324.699040][ T8176] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 326.680910][ T65] usb 5-1: USB disconnect, device number 9 [ 327.566209][ T8206] MINIX-fs: blocksize too small for device [ 328.339530][ T8189] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 328.805377][ T1434] ieee802154 phy0 wpan0: encryption failed: -22 [ 328.805429][ T1434] ieee802154 phy1 wpan1: encryption failed: -22 [ 329.655231][ T8226] netlink: 4 bytes leftover after parsing attributes in process `syz.3.601'. [ 330.829850][ T8254] ublk0: read batch cmd buffer failed [ 330.829945][ T8254] ublk0: read batch cmd buffer failed [ 330.846664][ T8254] ublk0: read batch cmd buffer failed [ 330.846737][ T8254] ublk0: read batch cmd buffer failed [ 332.489411][ T42] audit: type=1326 audit(1790285172.062:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8264 comm="syz.3.607" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf707efec code=0x0 [ 334.805175][ T8316] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 334.898671][ T8319] netlink: 'syz.1.623': attribute type 1 has an invalid length. [ 335.036946][ T8325] FAULT_INJECTION: forcing a failure. [ 335.036946][ T8325] name failslab, interval 1, probability 0, space 0, times 0 [ 335.036980][ T8325] CPU: 3 UID: 0 PID: 8325 Comm: syz.1.623 Not tainted syzkaller #0 PREEMPT(full) [ 335.037002][ T8325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 335.037014][ T8325] Call Trace: [ 335.037021][ T8325] [ 335.037029][ T8325] dump_stack_lvl+0x100/0x190 [ 335.037060][ T8325] should_fail_ex.cold+0x5/0xa [ 335.037112][ T8325] should_failslab+0xc2/0x120 [ 335.037143][ T8325] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 335.037170][ T8325] ? __alloc_skb+0x140/0x710 [ 335.037209][ T8325] __alloc_skb+0x140/0x710 [ 335.037234][ T8325] ? __alloc_skb+0x5b7/0x710 [ 335.037260][ T8325] ? __pfx___alloc_skb+0x10/0x10 [ 335.037295][ T8325] __pskb_copy_fclone+0xf2/0xe30 [ 335.037320][ T8325] hwsim_hw_xmit+0x441/0x1540 [ 335.037351][ T8325] ? ieee802154_hold_queue+0x100/0x450 [ 335.037375][ T8325] ? __pfx_hwsim_hw_xmit+0x10/0x10 [ 335.037399][ T8325] ? ieee802154_hold_queue+0x2a4/0x450 [ 335.037418][ T8325] ? find_held_lock+0x2b/0x80 [ 335.037442][ T8325] ? mark_held_locks+0x40/0x70 [ 335.037468][ T8325] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 335.037499][ T8325] ? __pfx_hwsim_hw_xmit+0x10/0x10 [ 335.037526][ T8325] ieee802154_tx.isra.0+0x29f/0x570 [ 335.037554][ T8325] ieee802154_subif_start_xmit+0xc8/0xf0 [ 335.037583][ T8325] dev_hard_start_xmit+0x121/0x760 [ 335.037615][ T8325] sch_direct_xmit+0x1b2/0xc70 [ 335.037639][ T8325] ? lock_acquire+0x1d1/0x380 [ 335.037667][ T8325] ? __pfx_sch_direct_xmit+0x10/0x10 [ 335.037689][ T8325] ? do_raw_spin_lock+0x230/0x260 [ 335.037715][ T8325] __dev_queue_xmit+0x27ac/0x4970 [ 335.037745][ T8325] ? lock_acquire+0x1d1/0x380 [ 335.037774][ T8325] ? __pfx___dev_queue_xmit+0x10/0x10 [ 335.037796][ T8325] ? __might_fault+0xc5/0x140 [ 335.037812][ T8325] ? __might_fault+0xc5/0x140 [ 335.037836][ T8325] ? _copy_from_iter+0x270/0x1690 [ 335.037862][ T8325] ? ieee802154_header_create+0x3bf/0x5e0 [ 335.037893][ T8325] ? __pfx__copy_from_iter+0x10/0x10 [ 335.037934][ T8325] dgram_sendmsg+0xa0d/0xf50 [ 335.037959][ T8325] ? __pfx_dgram_sendmsg+0x10/0x10 [ 335.037984][ T8325] ? apparmor_socket_sendmsg+0x165/0x280 [ 335.038015][ T8325] ____sys_sendmsg+0xa4d/0xbe0 [ 335.038037][ T8325] ? __pfx_ieee802154_sock_sendmsg+0x10/0x10 [ 335.038070][ T8325] ? __pfx_____sys_sendmsg+0x10/0x10 [ 335.038099][ T8325] ? plist_check_list+0x1b8/0x280 [ 335.038126][ T8325] ? plist_del+0x308/0x510 [ 335.038155][ T8325] ___sys_sendmsg+0x190/0x1e0 [ 335.038181][ T8325] ? __pfx____sys_sendmsg+0x10/0x10 [ 335.038219][ T8325] ? futex_wake+0x220/0x5e0 [ 335.038255][ T8325] ? find_held_lock+0x2b/0x80 [ 335.038297][ T8325] __sys_sendmsg+0x160/0x210 [ 335.038326][ T8325] ? __pfx___sys_sendmsg+0x10/0x10 [ 335.038371][ T8325] __do_fast_syscall_32+0x13a/0x8b0 [ 335.038394][ T8325] ? lockdep_hardirqs_on+0x7d/0x110 [ 335.038418][ T8325] do_fast_syscall_32+0x32/0x70 [ 335.038440][ T8325] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 335.038463][ T8325] RIP: 0023:0xf7fb5fec [ 335.038485][ T8325] Code: Unable to access opcode bytes at 0xf7fb5fc2. [ 335.038494][ T8325] RSP: 002b:00000000f543450c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 335.038514][ T8325] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000100 [ 335.038528][ T8325] RDX: 0000000000004800 RSI: 0000000000000000 RDI: 0000000000000000 [ 335.038542][ T8325] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 335.038553][ T8325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 335.038564][ T8325] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 335.038588][ T8325] [ 335.155870][ T8319] 8021q: adding VLAN 0 to HW filter on device bond2 [ 335.529669][ T8319] 8021q: adding VLAN 0 to HW filter on device bond2 [ 335.530004][ T8319] bond2: (slave wireguard0): The slave device specified does not support setting the MAC address [ 335.545932][ T8319] bond2: (slave wireguard0): Error -95 calling set_mac_address [ 336.900455][ T42] audit: type=1326 audit(1790285176.442:268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8344 comm="syz.1.628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 336.900539][ T42] audit: type=1326 audit(1790285176.442:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8344 comm="syz.1.628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 336.900575][ T42] audit: type=1326 audit(1790285176.442:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8344 comm="syz.1.628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 336.900614][ T42] audit: type=1326 audit(1790285176.442:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8344 comm="syz.1.628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 336.900654][ T42] audit: type=1326 audit(1790285176.442:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8344 comm="syz.1.628" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 336.900687][ T42] audit: type=1326 audit(1790285176.442:273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8344 comm="syz.1.628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 336.900730][ T42] audit: type=1326 audit(1790285176.442:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8344 comm="syz.1.628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 336.900763][ T42] audit: type=1326 audit(1790285176.442:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8344 comm="syz.1.628" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 336.900791][ T42] audit: type=1326 audit(1790285176.442:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8344 comm="syz.1.628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 337.304318][ T2573] logitech-hidpp-device 0003:046D:C082.0002: hidraw1: USB HID v0.00 Device [syz0] on syz0 [ 337.533076][ T8350] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 337.721369][ T8348] fido_id[8348]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 337.785495][ T8357] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 337.964444][ T8350] md/raid:md0: device ram1 operational as raid disk 1 [ 337.964467][ T8350] md/raid:md0: device ram0 operational as raid disk 0 [ 338.337059][ T8350] md/raid:md0: raid level 5 active with 2 out of 2 devices, algorithm 2 [ 338.377123][ T8350] md/raid:md0: PPL space too small on ram0 [ 338.447195][ T65] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 338.803544][ T65] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 338.839164][ T65] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 338.839189][ T65] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 338.839203][ T65] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 338.839239][ T65] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 338.839258][ T65] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 338.892973][ T65] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 338.892996][ T65] usb 7-1: Product: syz [ 338.893007][ T65] usb 7-1: Manufacturer: syz [ 338.898800][ T65] cdc_wdm 7-1:1.0: skipping garbage [ 338.898819][ T65] cdc_wdm 7-1:1.0: skipping garbage [ 338.900401][ T65] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 338.900416][ T65] cdc_wdm 7-1:1.0: Unknown control protocol [ 339.104083][ T8365] cdc_wdm 7-1:1.0: Error submitting int urb - -90 [ 339.105466][ T65] usb 7-1: USB disconnect, device number 7 [ 340.037778][ T8388] nvmet: adding nsid 1 to subsystem testsubsys [ 340.172535][ T5094] Bluetooth: hci3: command 0x0406 tx timeout [ 340.435481][ T8350] ============================================================================= [ 340.435502][ T8350] BUG raid5-md0 (Not tainted): Objects remaining on __kmem_cache_shutdown() [ 340.435519][ T8350] ----------------------------------------------------------------------------- [ 340.435519][ T8350] [ 340.437574][ T8350] Object 0xffff8880586a8000 @offset=0 [ 340.437599][ T8350] Object 0xffff8880586a84d8 @offset=1240 [ 340.437613][ T8350] Object 0xffff8880586a89b0 @offset=2480 [ 340.437624][ T8350] Object 0xffff8880586a8e88 @offset=3720 [ 340.437636][ T8350] Object 0xffff8880586a9360 @offset=4960 [ 340.437647][ T8350] Object 0xffff8880586a9838 @offset=6200 [ 340.437659][ T8350] Object 0xffff8880586a9d10 @offset=7440 [ 340.437671][ T8350] Object 0xffff8880586aa1e8 @offset=8680 [ 340.437683][ T8350] Object 0xffff8880586aa6c0 @offset=9920 [ 340.437696][ T8350] Object 0xffff8880586aab98 @offset=11160 [ 340.437707][ T8350] Object 0xffff8880586ab070 @offset=12400 [ 340.437718][ T8350] Object 0xffff8880586ab548 @offset=13640 [ 340.437731][ T8350] Slab 0xffffea000161aa00 objects=26 used=12 fp=0xffff8880586aba20 flags=0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff) [ 340.437765][ T8350] Disabling lock debugging due to kernel taint [ 340.438021][ T8350] ------------[ cut here ]------------ [ 340.438031][ T8350] 1 [ 340.438037][ T8350] WARNING: mm/slub.c:1268 at __slab_err+0x15/0x20, CPU#0: syz.0.620/8350 [ 340.560432][ T8350] Modules linked in: [ 340.562063][ T8350] CPU: 0 UID: 0 PID: 8350 Comm: syz.0.620 Tainted: G B syzkaller #0 PREEMPT(full) [ 340.568797][ T8350] Tainted: [B]=BAD_PAGE [ 340.571370][ T8350] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 340.580313][ T8350] RIP: 0010:__slab_err+0x15/0x20 [ 340.597977][ T8350] Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e8 5b fd ff ff be 01 00 00 00 bf 05 00 00 00 e8 7c b4 a3 00 90 <0f> 0b 90 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 [ 340.607924][ T8350] RSP: 0018:ffffc90007eef920 EFLAGS: 00010046 [ 340.611753][ T8350] RAX: 0000000000080000 RBX: ffffc90007eef970 RCX: ffffc9000c231000 [ 340.617135][ T8350] RDX: 0000000000080000 RSI: ffffffff81c801dd RDI: ffff888021982580 [ 340.635243][ T8350] RBP: ffff88804ca26858 R08: 0000000000000007 R09: 0000000000000000 [ 340.644326][ T8350] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000007918 [ 340.658830][ T8350] R13: ffff8880586afdf0 R14: ffff88804ca26840 R15: ffffea000161aa00 [ 340.662149][ T8350] FS: 0000000000000000(0000) GS:ffff888096959000(0063) knlGS:00000000f5446b40 [ 340.665896][ T8350] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 340.682202][ T8350] CR2: 00000000f7428c68 CR3: 0000000054f2d000 CR4: 0000000000352ef0 [ 340.685618][ T8350] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 340.699170][ T8350] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 340.702423][ T8350] Call Trace: [ 340.727920][ T8350] [ 340.729152][ T8350] __kmem_cache_shutdown.cold+0x16e/0x177 [ 340.731710][ T8350] kmem_cache_destroy+0x7d/0x1a0 [ 340.734070][ T8350] free_conf+0x1cb/0x710 [ 340.739709][ T8350] raid5_run.cold+0x593/0xd51 [ 340.742880][ T8350] level_store+0x103f/0x1f60 [ 340.745349][ T8350] ? __pfx_level_store+0x10/0x10 [ 340.758547][ T8350] ? lock_acquire+0x1d1/0x380 [ 340.761848][ T8350] ? do_raw_spin_lock+0x128/0x260 [ 340.765904][ T8350] ? find_held_lock+0x2b/0x80 [ 340.769232][ T8350] ? md_attr_store+0x195/0x330 [ 340.773591][ T8350] ? md_attr_store+0x195/0x330 [ 340.776552][ T8350] md_attr_store+0x1c5/0x330 [ 340.778906][ T8350] ? __pfx_md_attr_store+0x10/0x10 [ 340.783154][ T8350] sysfs_kf_write+0xf2/0x150 [ 340.788050][ T8350] kernfs_fop_write_iter+0x3e0/0x5f0 [ 340.791779][ T8397] netlink: 'syz.2.630': attribute type 1 has an invalid length. [ 340.791802][ T8397] netlink: 240 bytes leftover after parsing attributes in process `syz.2.630'. [ 340.791815][ T8397] netlink: 'syz.2.630': attribute type 1 has an invalid length. [ 340.842289][ T8350] ? __pfx_sysfs_kf_write+0x10/0x10 [ 340.845838][ T8350] vfs_write+0x6af/0x1050 [ 340.849311][ T8350] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 340.860833][ T8350] ? __pfx_vfs_write+0x10/0x10 [ 340.879013][ T8350] ? find_held_lock+0x2b/0x80 [ 340.882065][ T8350] ksys_write+0x12a/0x250 [ 340.889696][ T8350] ? __pfx_ksys_write+0x10/0x10 [ 340.892901][ T8350] __do_fast_syscall_32+0x13a/0x8b0 [ 340.900358][ T8350] do_fast_syscall_32+0x32/0x70 [ 340.902856][ T8350] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 340.918299][ T8350] RIP: 0023:0xf7f83fec [ 340.925205][ T8350] Code: Unable to access opcode bytes at 0xf7f83fc2. [ 340.937792][ T8350] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 340.951999][ T8350] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000300 [ 340.955868][ T8350] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000000 [ 340.978908][ T8350] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 340.982684][ T8350] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 340.987244][ T8350] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 341.009016][ T8350] [ 341.010837][ T8350] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 341.013570][ T8350] CPU: 0 UID: 0 PID: 8350 Comm: syz.0.620 Tainted: G B syzkaller #0 PREEMPT(full) [ 341.038514][ T8350] Tainted: [B]=BAD_PAGE [ 341.040360][ T8350] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 341.044407][ T8350] Call Trace: [ 341.045727][ T8350] [ 341.047038][ T8350] dump_stack_lvl+0x100/0x190 [ 341.068418][ T8350] vpanic+0x553/0x970 [ 341.069897][ T8350] ? __pfx_vpanic+0x10/0x10 [ 341.071662][ T8350] ? lock_release+0x24d/0x310 [ 341.073399][ T8350] panic+0xd1/0xe0 [ 341.074793][ T8350] ? __pfx_panic+0x10/0x10 [ 341.076481][ T8350] check_panic_on_warn.cold+0x19/0x34 [ 341.098793][ T8350] ? __slab_err+0x15/0x20 [ 341.101029][ T8350] __warn.cold+0x191/0x318 [ 341.103602][ T8350] __report_bug+0x30f/0x440 [ 341.105459][ T8350] ? __slab_err+0x15/0x20 [ 341.107115][ T8350] ? __pfx___report_bug+0x10/0x10 [ 341.119421][ T8350] ? irq_work_queue+0xd1/0x100 [ 341.121621][ T8350] ? __wake_up_klogd+0xe5/0x140 [ 341.140142][ T8350] ? vprintk_emit+0x1c9/0x6b0 [ 341.142283][ T8350] ? __pfx_vprintk_emit+0x10/0x10 [ 341.150867][ T8350] ? __pfx_vprintk_emit+0x10/0x10 [ 341.153856][ T8350] ? __pfx_vprintk_emit+0x10/0x10 [ 341.160305][ T8350] ? __slab_err+0x15/0x20 [ 341.170905][ T8350] report_bug+0xb3/0x220 [ 341.179508][ T8350] ? __slab_err+0x15/0x20 [ 341.181355][ T8350] handle_bug+0x16a/0x2a0 [ 341.187901][ T8350] exc_invalid_op+0x17/0x50 [ 341.189913][ T8350] asm_exc_invalid_op+0x1a/0x20 [ 341.199662][ T8350] RIP: 0010:__slab_err+0x15/0x20 [ 341.201380][ T8350] Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e8 5b fd ff ff be 01 00 00 00 bf 05 00 00 00 e8 7c b4 a3 00 90 <0f> 0b 90 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 [ 341.236994][ T8350] RSP: 0018:ffffc90007eef920 EFLAGS: 00010046 [ 341.239455][ T8350] RAX: 0000000000080000 RBX: ffffc90007eef970 RCX: ffffc9000c231000 [ 341.242360][ T8350] RDX: 0000000000080000 RSI: ffffffff81c801dd RDI: ffff888021982580 [ 341.266386][ T8350] RBP: ffff88804ca26858 R08: 0000000000000007 R09: 0000000000000000 [ 341.269575][ T8350] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000007918 [ 341.273361][ T8350] R13: ffff8880586afdf0 R14: ffff88804ca26840 R15: ffffea000161aa00 [ 341.277184][ T8350] ? add_taint+0x6d/0xb0 [ 341.279461][ T8350] __kmem_cache_shutdown.cold+0x16e/0x177 [ 341.298671][ T8350] kmem_cache_destroy+0x7d/0x1a0 [ 341.301615][ T8350] free_conf+0x1cb/0x710 [ 341.313410][ T8350] raid5_run.cold+0x593/0xd51 [ 341.317068][ T8350] level_store+0x103f/0x1f60 [ 341.328432][ T8350] ? __pfx_level_store+0x10/0x10 [ 341.331001][ T8350] ? lock_acquire+0x1d1/0x380 [ 341.334748][ T8350] ? do_raw_spin_lock+0x128/0x260 [ 341.338844][ T8350] ? find_held_lock+0x2b/0x80 [ 341.359248][ T8350] ? md_attr_store+0x195/0x330 [ 341.367432][ T8350] ? md_attr_store+0x195/0x330 [ 341.373253][ T8350] md_attr_store+0x1c5/0x330 [ 341.375795][ T8350] ? __pfx_md_attr_store+0x10/0x10 [ 341.388611][ T8350] sysfs_kf_write+0xf2/0x150 [ 341.390799][ T8350] kernfs_fop_write_iter+0x3e0/0x5f0 [ 341.393345][ T8350] ? __pfx_sysfs_kf_write+0x10/0x10 [ 341.395147][ T8350] vfs_write+0x6af/0x1050 [ 341.397860][ T8350] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 341.400402][ T8350] ? __pfx_vfs_write+0x10/0x10 [ 341.426765][ T8350] ? find_held_lock+0x2b/0x80 [ 341.448757][ T8350] ksys_write+0x12a/0x250 [ 341.450869][ T8350] ? __pfx_ksys_write+0x10/0x10 [ 341.453236][ T8350] __do_fast_syscall_32+0x13a/0x8b0 [ 341.455343][ T8350] do_fast_syscall_32+0x32/0x70 [ 341.457143][ T8350] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 341.473728][ T8350] RIP: 0023:0xf7f83fec [ 341.476018][ T8350] Code: Unable to access opcode bytes at 0xf7f83fc2. [ 341.479986][ T8350] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 341.484068][ T8350] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000300 [ 341.497826][ T8350] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000000 [ 341.501823][ T8350] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 341.507890][ T8350] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 341.513830][ T8350] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 341.517997][ T8350] [ 341.528389][ T8350] Kernel Offset: disabled [ 341.529991][ T8350] Rebooting in 86400 seconds..