last executing test programs: 20.289906912s ago: executing program 2 (id=1246): openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080), 0x2, 0x0) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x2}, &(0x7f0000000b80)=0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socket$inet6(0xa, 0x80003, 0xff) r3 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCSETSW2(r3, 0x402c542c, &(0x7f00000003c0)={0x802, 0x839c, 0x73, 0x0, 0x85, "ee7df608418a85860349646a5da08b12734500", 0x2, 0xffffffff}) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000240)) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_SET_CPUID2(r4, 0x4048aecb, &(0x7f0000000400)={0x3, 0x0, [{0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x20000}, {0x5e2796afef1a2f31, 0xffffffff, 0x0, 0x9, 0x1, 0x80000001, 0x1}, {0x80000001, 0x1e3, 0x7, 0x8, 0x5, 0x110, 0x3}]}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080), 0x185}}, 0x20) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioperm(0x0, 0x6, 0x8000000000004) connect$unix(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r5, 0x6, 0x1d, &(0x7f0000000100), &(0x7f0000000140)=0x14) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x1e0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}]}) r6 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x80, 0xfffffffffffffffd, 0x3, 0x2, 0x2, 0x2d7, 0x8000000000000000, 0x8000000000000000, 0x5, 0x7, 0x3, 0x3, 0x2, 0x5, 0x8d], 0xeeee8000, 0x285e96}) 19.907866001s ago: executing program 2 (id=1255): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r1, 0x28, 0x1, 0x0, &(0x7f0000000040)) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000003400000034000000020000000000000002000006"], 0x0, 0x4e}, 0x28) (async) mkdir(&(0x7f0000000000)='./mydev\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000100)='./mydev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/kmsg\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)='<1>', 0x3) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000016c0)={'wlan0\x00', 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) (async) munlock(&(0x7f0000ffd000/0x3000)=nil, 0x3000) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000340)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010028bd7021fddbdf253b00000008000300", @ANYRES32=r4, @ANYBLOB="30003300c0100500080211000001080211000000"], 0x4c}, 0x1, 0x0, 0x0, 0x20040090}, 0x28008004) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_SET_INTERFACE(r5, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000000)={{0x1, 0x1, 0x18, r5, {0x1}}, './file0\x00'}) ioctl$IOCTL_VMCI_INIT_CONTEXT(r6, 0x7a0, &(0x7f0000000080)={@host, 0x1}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r5, 0x0, 0x20000000) 19.907503797s ago: executing program 2 (id=1256): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_rdma(0x10, 0x3, 0x14) syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x161d02) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x8000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) setgroups(0x0, 0x0) r4 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xfffffffd, 0x1000, 0x0, 0xfffffffe}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r9 = syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x0, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, &(0x7f0000000300)=0x0) r12 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZEX(r12, 0x560a, &(0x7f0000000180)={0x7, 0xa5, 0x4, 0x2, 0x7, 0x2}) r13 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r9, 0x2) r14 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r14, r15, r16, r17, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) syz_ublk_setup_queues(r13, r11, &(0x7f0000000540)={0x0, 0xfa81, 0x4, 0x3, 0x28e, 0x0, r14}, &(0x7f0000000880)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb8c3, 0x1000, 0x2, 0x1af, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xddca, 0x2, 0x0, 0x330, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x766c, 0x8, 0x0, 0x20, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5027, 0x4, 0x0, 0x1fe}}], 0x4, &(0x7f0000001f40)={0x2e, 0x0, 0x0, r13, 0xc0107524, 0x0, 0x0, 0x0, 0x1, {0x10}, 0x0, r10, '\x00', {0x2, 0xb55, 0x0, 0x0}}, &(0x7f0000001fc0)) r18 = syz_genetlink_get_family_id$nl802154(&(0x7f0000003bc0), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000003ec0)={0x0, 0x0, &(0x7f0000003e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="006fba709972666c33bfd211ae9bc48038", @ANYRES16=r18, @ANYBLOB="010026bd7000ffdbdf251d0000000c00060001000000010000000c0006000000000000000000"], 0x2c}}, 0x40) 18.272859828s ago: executing program 2 (id=1274): unshare(0x100000) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) mknodat$loop(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1004, 0x1) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtaction={0x8c, 0x30, 0x1, 0x0, 0x0, {0x7a}, [{0x78, 0x1, [@m_police={0x74, 0x1, 0x0, 0x0, {{0xb}, {0x64, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c}, @TCA_POLICE_RESULT={0x8, 0x5, 0x10000000}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x8c}}, 0x0) bind$inet6(r2, &(0x7f0000000240)={0xa, 0x4e23, 0x100000, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, 0x1c) socket(0x11, 0x0, 0x1) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000300)) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000980)={0x10, 0x0, &(0x7f0000000280)=[@request_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x4c, 0xfffffffffffffffc, &(0x7f0000000440)="a664ce110bdf5306003498af2647f043cc587e474986c1c398022aa2c68722b283d9d059538ba36b609991f0f50797e07bda4ea49ba1e49d03c6b7b2c3f4a79c06a97155a1b34445f48ccd52"}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYRES64=0x0], 0x1c}}, 0x400800c) openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40000, 0x96) lseek(r0, 0x101, 0x1) 18.006119373s ago: executing program 2 (id=1277): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x100) fcntl$notify(r1, 0x402, 0x8000000b) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000)=0x20) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000040)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x8) 18.005783549s ago: executing program 2 (id=1278): socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x4, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x0, 0x1}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, 0x0, &(0x7f0000000300)='GPL\x00', 0x2, 0x100a, &(0x7f0000002500)=""/4106, 0x0, 0x2b}, 0x94) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xc, 0xffe0}, {0x0, 0x9}, {0xe, 0x9}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_FLAGS={0x8, 0xb, 0x3}]}}]}, 0x38}}, 0x2000a100) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000840)={r6, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) pread64(0xffffffffffffffff, 0x0, 0x0, 0x200) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x1c) mount(0x0, 0x0, 0x0, 0x8, 0x0) 7.534762575s ago: executing program 3 (id=1336): openat$dma_heap(0xffffffffffffff9c, &(0x7f0000003400), 0x1, 0x0) socket(0x1, 0x803, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, 0x0, 0x0, 0x5}, 0x94) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @local}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000000c060101000000000000000000000004050001009e"], 0x28}, 0x1, 0x0, 0x0, 0x5}, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) listen(0xffffffffffffffff, 0x5) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r5, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r7) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r6, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) read$FUSE(r1, &(0x7f00000021c0)={0x2020}, 0x2020) r8 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) syz_usb_connect(0x5, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r8, @ANYBLOB="79a9"], 0x0) syz_open_dev$audion(&(0x7f00000002c0), 0x3, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 4.317230634s ago: executing program 3 (id=1343): socket$nl_sock_diag(0x10, 0x3, 0x4) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x3, &(0x7f00000000c0)=0x6a, 0x4) (async) bind$inet(r0, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) (async) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000180)=0xb27, 0x4) (async) connect$inet(r0, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) (async) sendto$inet(r0, &(0x7f00000002c0)="01a4acc7cf28ab9f6c7fc745c30bfc165466072a660bbf56352083db9d40454a67f8010000004bd29585885c89773ca3ba28a1e85ffe2a9220e0ecd440e345b745bf2146835ad015c801f95be5b890e44fb3dfbe8e88a1e5176e584c9702", 0x5e, 0x404805e, 0x0, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000005000), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="540000000206010100000000000000000a00000005000400020000000d000300686173683a6e657400000000050001000600000005000500020000000900020073797a32000000000c000780050015008b5cc3000000"], 0x54}}, 0x80) ioctl$DVB_DVR_DMX_DQBUF(0xffffffffffffffff, 0xc0186f40, &(0x7f0000000040)={0x1, 0x20000000, 0x9, 0xb, 0x8, 0x6}) (async) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000280)={0x9}) (async) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x3) (async) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0xc50}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xff, 0x0, 0x4, 0x6, 0x7f, 0x20c}, {0xf1c2, 0x3, 0x38, 0xf, 0x84, 0x7, 0x3, 0x50, 0x0, 0x5, 0x4, 0x5, 0x3a}], 0xffffffff}) (async) openat$vimc2(0xffffffffffffff9c, &(0x7f0000003240), 0x2, 0x0) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(0x0, r5) sendmsg$NLBL_MGMT_C_ADD(r5, &(0x7f0000002c40)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB, @ANYRES16=r6], 0x1b0}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000080) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r7 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(0xffffffffffffffff, 0x29, 0x3b, &(0x7f0000000200)=ANY=[], 0x30) (async) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x4, 0x7fff, 0x3, 0x400000000], 0x80a0000}) (async) ioctl$KVM_RUN(r4, 0xae80, 0x0) 4.004659625s ago: executing program 3 (id=1347): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) getrlimit(0xb, &(0x7f0000000440)) r1 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x62f82, 0x0) mkdir(0x0, 0x1ff) mkdir(0x0, 0x1ff) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x3d4, 0x208, 0x2d0, 0xfeffffff, 0x2d0, 0x208, 0x3a8, 0x3a8, 0xffffffff, 0x3a8, 0x3a8, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 'veth0_to_bond\x00', 'veth1_to_team\x00', {}, {}, 0x6}, 0x0, 0x9c, 0xc0, 0x0, {}, [@common=@inet=@tcp={{0x2c}, {[], [], 0x0, 0x0, 0x2, 0x4}}]}, @common=@inet=@TCPMSS={0x24}}, {{@ip={@multicast1, @rand_addr=0x64010100, 0xffffff00, 0xff, 'tunl0\x00', 'ip6tnl0\x00', {0xff}, {}, 0x84, 0x1, 0x9}, 0x0, 0xf0, 0x124, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x0, 0x0, 0x0, 0x1, 0x7]}}}, @common=@set={{0x40}, {{0x0, [], 0x5}}}]}, @REDIRECT={0x34, 'REDIRECT\x00', 0x0, {0x1, {0x0, @broadcast, @remote, @icmp_id}}}}, {{@ip={@loopback, @dev={0xac, 0x14, 0x14, 0x15}, 0x0, 0x0, 'lo\x00', 'ip6tnl0\x00'}, 0x0, 0x70, 0xa4}, @NETMAP={0x34, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id, @icmp_id=0x64}}}}, {{@ip={@remote, @broadcast, 0x0, 0x0, 'pim6reg0\x00', 'wlan0\x00', {}, {0xff}}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@remote, @ipv4=@dev}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x430) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) recvmmsg(r2, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x6}], 0x2, 0x2, 0x0) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89a0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(r3, 0x0, 0x44000) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x800}, 0x1c) r4 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r5 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r5, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4}) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r5, 0x40146f2c, &(0x7f0000000040)={0x80, 0xffffffff, 0x0, 0x5}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) 3.21868384s ago: executing program 1 (id=1348): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x13) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) openat$hpet(0xffffffffffffff9c, 0x0, 0x262281, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000040)={0x0, 0x10c1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x8842, 0x3, 0x92, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x20, 0x1, 0x80003ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e8, 0x2000, 0x4003bfff, 0x1a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x723642762b6db36e, 0x1, 0x100026d}}], 0x1, 0x0, 0x0) 2.684153572s ago: executing program 32 (id=1278): socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x4, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x0, 0x1}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, 0x0, &(0x7f0000000300)='GPL\x00', 0x2, 0x100a, &(0x7f0000002500)=""/4106, 0x0, 0x2b}, 0x94) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xc, 0xffe0}, {0x0, 0x9}, {0xe, 0x9}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_FLAGS={0x8, 0xb, 0x3}]}}]}, 0x38}}, 0x2000a100) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000840)={r6, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) pread64(0xffffffffffffffff, 0x0, 0x0, 0x200) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x1c) mount(0x0, 0x0, 0x0, 0x8, 0x0) 2.54384348s ago: executing program 3 (id=1351): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000005a0000008500000022000000180100002020702500000000002020200100000000000000bfa1000000000000070100"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=@base={0x19, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000000008000000850000000500000095"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b40)={{r0}, &(0x7f0000000a40), &(0x7f0000000b00)=r1}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = accept4$llc(0xffffffffffffffff, &(0x7f0000000240)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000300)=0x10, 0x80000) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000340)={'wg2\x00'}) sendmmsg$unix(r3, &(0x7f0000003340)=[{{0x0, 0xfffffffffffffed1, &(0x7f0000000280)=[{&(0x7f0000000600)='4', 0x1}], 0x1, &(0x7f00000002c0)=[@rights={{0x10}}], 0x10, 0x40}}], 0x1, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r5, 0x0, 0x39011, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) ioctl$KDDELIO(r6, 0x4b35, 0x0) 2.505220135s ago: executing program 0 (id=1352): openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) openat$hpet(0xffffffffffffff9c, 0x0, 0x262281, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000040)={0x0, 0x10c1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x8842, 0x3, 0x92, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x20, 0x1, 0x80003ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e8, 0x2000, 0x4003bfff, 0x1a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x723642762b6db36e, 0x1, 0x100026d}}], 0x1, 0x0, 0x0) 2.423143366s ago: executing program 1 (id=1353): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000380)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r0, &(0x7f00000003c0)={'b', ' *:* ', 'w\x00'}, 0x8) syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$NLBL_UNLABEL_C_ACCEPT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x24008851}, 0x40040) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000f00)=ANY=[@ANYBLOB="300000001800dd8d0000000000000000020000000000000900000000060015000a0000000c00168008000100bc"], 0x30}, 0x1, 0x0, 0x0, 0x810}, 0x0) sendmmsg$alg(r1, &(0x7f0000000140), 0x4924b68, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r3], 0x3c}}, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x3c}}, 0x8000) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r6) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$BATADV_CMD_SET_HARDIF(r2, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x38, 0x0, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x20004000) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}, 0x1, 0x0, 0x0, 0x4044050}, 0x40) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2.372351198s ago: executing program 3 (id=1354): sendmmsg$alg(0xffffffffffffffff, &(0x7f00000029c0)=[{0x0, 0x0, &(0x7f0000001200)=[{&(0x7f0000000140)="ab9c4775ab22f72bebf3713ae2b09cc275d0a277a710b525b46198f429d751191a74371d3f8861cb7b87a1f2ac28886cb84e099aaafd4e1d0b3cd9944eb83a8cbcd962dd670c1f5082fbd460e842831dbf7b23174acd3051b9153ca008062cbe26888430df7785fdb89ac65ebcf1c5dab9669e55cfba124d749bfc163ba084bddc8f2fd6adc1ba43189e1a6221400e5f4c325a5ec3f2381524614b794562f4041a5698a716863f8179ca88ff37a28f73c60d28e33fef9188bc96f6c5c523ee6f36d1885a2b1bc25f89edecd45e9987bd6bb71a0b1ada7908974c10a2e0c2b113d89a0c75d04c0d07005dcb3c451a4e27816cd696a2e6a4ddbc8d7f729e33499e0d6eb49a11e7d6c69ea2fae10a5ea569308990a5a6ed5413905764ad69950f130c10f4a2a40f99a5e3486f2d15f62427af0a6635eb94a05c7b66b217329064d0f0ae63b02391505f7a3b7309eda5b35e8856b63351854ba6c1797ffa9cbd68b668227805b4eb43583693bea53e1c169302633ccb611bc64432674b93156f1d03ed1d8fb1877a488b1a508329d707a021359d37c49a954878dd3afd85a2b178d3013071a7bc648a450b741c18a20c1462d72d99307847c86ac3a0a805d72b74c570c2cecf0a44ae26ffd24c5d057c08f2ac70d12298325a675e323ae25e652529d454999ce84c690b2fcfc60b08fa87160bd687ef63133903c6e98191433dfa80651b4b056167919cd7f0864e8b13bda5e3e4d1f795847dc70d8092890ea11b906cd904bcf081e98a8b59c620b3650b7b70559f58644802baadf2f9d5886fbee964e909a68ea889256ae7554b2f99560eb0a201c016064ffdf354c99fa6a16e5ffad0cb625548b1369a32b462ab3880de860b9a20156910f7b9ce88e87c903631073a807c54c3e641ccd35af8bc9ddcd651f6b83aaed59753c8f4e5d2e211935dfa977a9ed0b9e6ca74b19ae5c825cf384f2547bc74edb6435b4815251ececa3aea5b5d79a7fe4580048aff65f69c062d2c0e189d891c9122c1fce888fd893ae581dc467ee45276730579945c236dc5725b2fb35d8e21618e6d7b480b6efcfea26da37d9e75a395b3cd4ee8b834d3b0c18d8efe8af5f2f04d32ceb64c717983f3776b3ffd1257e406b5f955f122955f874786e51e96698980d79bfba7e36479e4167dcb6fa4714f0317792f3ef0d6973f563a80ab8d338645b3ea59f47f7838637c653d13a8edcced9fee36d4fd4c0a9fe88b76724faa5c428efee01df7bb4c8cee7bae3e2fae0ff44029fc9edea0b8e53b6e706b10f52062a77eea8c89206ecc84b5a6dbcbff35118e3cfdd278966f1cb3b1cacc231c60a744f4ac37a330dc385bc82afba8b845ecd719ed54413562cd9e2627bf946d4377e8501d14d514a0f34abbbfa017d2a8ac734525bf909daa6f82b9a0e1142ccb53ae02ff360d9c40c6a3cdd66fc119676d028993ea17825ed5cf06d3f6e63d0d59547654bfe4a89921845c5d08cea318f01f7e2bbbc97a6c3063488ed72f6cbf4239f0dbb35748be34dbe023cd6bff74b94f9da703a16b7b84ba9d6c2e83de7516ec990b737bea57fc5aa140e1121ecf5d363939e4083c1e1b474e5cd29725b4d96e3178447619dc7778ec4766f33934e79b541f93830337bde18dd312863269bde739fe840d9c8a1cce4515fe149a1b8b49fdca1a25df2f1f6f8576bce11afc296658dba474e6f56aec7f132014d552fadaf8565870230e6343f5e83f65b8b0ffbb60026ae477666a071fa27c837baf104b4348d9b2b1eaf2e903f56e76af2571a0581707d124faa506fd57719afaf7400548e7c75cddd590ecea894a5c775dc2b618aeb2b9e2bd48312d7f7bf42bbe11e453db4b5cead6c52f9cf9e72560c6daec08072945035fee0caac6722aa5e0c4bccd4dff201cbb19638e3db1efcd8ee13498a815009f0de828383be1d119914264d5523f462cabe48b592c35d4036b012cec86aa5e8c309587874b6e2a7c2c6ad3c3239adad6a023fd5e0bddcf7dba0b8396fb02f8fce74d3aadfc7784d63581361677ee5ba5dce0574ff0a3329adfce76a3f249925e42ac84ac981ea9ae089b189d2dd9f17e85def562f163ca7017e1f9ba164e14bdb0fcdef13318ee75adf028b8ffe00b9d5ca2d8778bb371a4dd578f36d0d1fa217d6fa78fdec06dabc0b4ad9e2b8f9d4140ae57d1c97b8dfba23b34b2808af83815305816e63202a26434dca46df0e71baf5c6f59ed13e938a2a7620167b060fdde2180ef3c11b9ce0d391f12c897c7f072e1a7ad8bda9ef6f98ec6bb045b9b61e35ee639feffcb563b906bc882c0985e75dceffc2e211fde73e5b9b99537e8df4d2f41e862fbd9ecf38b8057a84f24cabc93dd155e7adbe9be655aaf767be3980a7c04202c77dd43360aa92a9a9d6d7381a2eba7db7f55f9ec211a418af3d8b2a13781983103c101f81608af87fb86b1798afae07f30435e8876cd90e2a3f2cdf5fecb3cc8e49dfe58b235184d9a514b7a928ab203ba4a57329429263c0c7d95b92be7ee769f4d8c2f27555950f6b02940edf51e4cbfdb6ad5270d88439f7693ab2d2d6bf1dd50e0f67c348b0bf1ae079c582540564cebb2a12095de0e52674e85b77b12d5708e9848eeeaaadb1a614aefc724755eb3c0df3fae92371a99bbc29679defe1f26d49536fed7ae82603870f1cf4970845a762818f1a91a7a3ba256a6a70a6e77234ddef057389404f122bea57dcc3ad0875b9fc7e0948881ed5384b8c93ea3888920bbae7a32a7ae97989fb26d0a42d21b446b256aa2513f9a3c7a5ca9da2689ac99e73c51f66d81d11f84972d90aece05062d0324028e5ae687b6460011464ea9ac70c95b3af12bbc7993f1f35cd71a9861570adb49311a45973999b53f8629889080d869aba01598b25975117bd791a8392d5aa6ca47a2e354f3d6c4998e3cf66de405edc53a62341efb71a1901fcebc4e67c1ef364bd91fae5e047b49595944c198a2cad894bf19efc4f15e2e06c547146cf0d724ba7bd53bdfba97570236cc5f8193ec4cbec6b7dafc70ed4ba879ac2177d16bb158397a994da149e630a286fcda5df595170a625751b21600f782605cf0865258a04564ef00e0256c094c895668d8e7f25c1f48ddc6656077c97e267f194a743537034af87bfe99a709419d717ffc91332411d8f8b1574ba50948a88b0ccdf50a8ba46ab16cb4d815f3a9a7f2f9b9847caade7fb1444a241670c02a936bd5230ab06c0e55840ff514884ef8db9761b305e3ce88b918db845c1a067f817ca1f3ab3594ee4a5391f7aaacda53aa3143625552432994cd7dd1a419bf8054f65bd37da7de540214fa3cde59036bbba619f60884e52b6b29f08e2d4d13a39cf42cccf115a13daea9f0d84da5a512d34494453074b02cff7cccb0b5a4c1113634a9a175905d3d4a862a9e583d85c98c18f306f6bc49e78136a5c68a3c7c8d399efaf2d3a46972b0dc092d28d66811f9a4de70fd33bba7afdfc7049bcbbc0d6895166b1e0cf6db0a7340445e96f053bcb6182223b8983bbae94b47092b63b7c58a71a6abad60b32e9f5862b91d2d95877c63068a0e7dc62956ea8113e57a0447b9d94d0cfd9831036a0d88c89efae1e641e608cbb84704ae07f21a37e7a3926301020405457d0b0315c2b6abe5c79f67bdcd98612c07b372e28121a578b1e181ad5646f1b039cadfdacd8f17f3c36cf01d5195c4a86457e7f4085613f8f165c3c582622823ca7c6404df2f1557d5a324755dd86d06ad539724bb6bb0df4edf402eea5f8dd358041fd540663ef29a2ff53c226edbd7c57c38bc27babd27f9d4314d082951d0dcf84585b1ef1fe3813e26dc68d38693bd5837a23b3733ee1d7d7de97c022b7909f7866a771f06d1971b8efc816329e5c4d1d87a608becd74211ca8e21ca7a5c3331885b333177acb26092227f07bdb60fb705e0b6595a3c7e89850dcfbca7cf736cc7097b568a5f6fd06d20a0cca92c4575f769ca845246c579fa30b61c3fce024080aca099237984151260923529161d76bd5b6167c0f38e53ac34b3d7240697b82027ba96144e20a3da3a32d2f1cf2fea0e29ffe300d81d56d8c6415b4531b7b9dcf7e91cdf62f0cdfd25798746f7ab839440883b4a1bd6571fc668080e01f4f8a7281c65178b33f811839040b2d0fcecd29da7e57ffe73ef25500f9f16b92cc79133f90613c093b47a4a4410ae36fc47213614de3c32871d3253a95ae827d06c02277a88ddd901f0c1122fac77dca50973531a2cc3c8e3cd50389df6f487220f570218b9c972a1cf2abd941887c444b5682e22be6ef43aecff8d1553ab2628c0940e0ede2fc24d772e647eccf06277234c8e0d1722476cd766848bbed89f0750e937ad281b4299822f1353d9d4d80abd2accf3a9c587304aa084063de389ca4c1615bd1b85ed8915d0103a3de6a1cdc00e0aa8ce7c8f53675db4883ed0890132541cb1c782fab90398becf0d148d3665c0ce11210483f454ce00297ecdc402af9956f6332111bb3d14ec5eca3515b567da284ac2dec96cb4a667ca82f0eb9bdcc7a02dbed8436a640d77e5d4487a1114bb998a0dfe0526567afcad6d3378b3614b0065293512d5ac92902b1660967a6791bd922b672bb8411eac71bc80cfe1c5dfb3ba591f5ef7d80a72a678ceb9035bcb7fbcd5e1c246d21c32e7e6e963bc893a191d41a2ef3260c868609be7697f5f62d04641cc4c40ca61aa66aa46fa59fd8dc3ae13e8b962fbd3e7e8b4a49d71dfca4ac39a005d54641051ddcd36080a93195dfd6b5677e7c26d1f8bc3f3f341cf2ccc6f175703770e239fcce10d5a0e94c98a61332dec60c187fd80316a16fff89b1ea1040d4774b4344edb0fdc17cdb6116168349a889907b460365295eb3abf0afbbeb627b0656871c8c482d0cccdd58e95bf5f10ff6d47efd83abb511fd5a905c6842d96f599422a4ed22b05ff34ee0ba5b6696fefd2237cf484f464dffc48a1d33cb0450c69f572fb983917558e228fad23aab79a23c9c5afec238c7dbcb36286983a57924d1d291912bc32fa80948ec585d0967477c11d6143961de5aaddc04ef85a742a0d64b371c249c3b7d58287dd59231bcd3d01dc9057de86eb03cd51a8f071dbcb87b23371dedc3bc6acc8e2e3038c0ca22d7e22a56964917abd72c13b1c6b5f9063e64f827336ea1cb3d6de3bab9edaa47aa573a26cbd44847d5b22d6a1837a9ac4c74513bc59d17266e8304947bc46a7c9a4c78728b0e7e6d5f782050a2dbbcbd3398bbb9e19dc5f3751d5c71643a4b0c63578ac05ab249d8ddbe037633bef6466cbfc77160b4552522ac6b78d06284ff93201f95ce7b93b65f4bc1dc7baed6444a023a57252b8678e969f98075ec2014a7ee2d0c5ce4ecdbc694ada6f0174234fca318f31dc0e285983538f44717dc2f65a940fee5a37440e3c2e18d284d6bccbf1becbcf760ed047f6de26782e6c4ad6a0f4de8822df3e1f6740", 0xf2d}], 0x1, 0x0, 0x0, 0x20000800}, {0x0, 0x0, &(0x7f0000001480), 0x0, 0x0, 0x0, 0x4008000}], 0x2, 0x40800) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 2.278269252s ago: executing program 3 (id=1355): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000200)=0x16, 0x4) connect$bt_l2cap(r0, &(0x7f0000000700)={0x1f, 0x0, @none, 0x1}, 0xe) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="14000000100001"], 0xc4}}, 0x20050890) landlock_create_ruleset(&(0x7f0000000040)={0x82, 0x10, 0x2, 0xc702, 0x8, 0x4}, 0x30, 0x2) socket(0x25, 0x2, 0x0) socket(0x1e, 0x4, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@hyper}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2aa340, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x40000073, 0x0, 0x8001}]}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r4, 0x4068aea3, &(0x7f0000000140)) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r1, 0x7a5, &(0x7f0000000100)={{@my=0x1, 0x400}, 0x1, 0x2, 0x1010002}) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES64], 0x0) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="92cb5a64a5285cbe1335418c53313893f59608018b448ac2f94f7d29de1572308705204f3b9bd13fb8c104226614ad2b44701aa2e438c8dab648f36331348074a389a5f3b1e07e4ed47c7e4e76fb83724d15e8471d711d42d7638688c769d22d157b394c75d22e49396ef455dc06782f7b991ada2e1201847dbfbfb2bc003e95907a8959ecb2b44a6aa4a1bafafb58551402ab9219b881047616b1aba7440700b7efb851da1ee9d2caa9a588571c479337705335d6231790dc8610caed2271a0dc98ca17c7346ec4ac89aa84173ec3b2f2dffa5ec6d2f8da82893d87c4b96be116c470c9bb4f474be29cfcbd982bba79", @ANYRES16, @ANYBLOB="c525080000000000000001"], 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x45080) r5 = openat$nvme_fabrics(0xffffff9c, &(0x7f00000001c0), 0x202000, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r7 = dup(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r7, 0x0) connect$pptp(r5, 0x0, 0xffffffffffffff9b) socketpair$unix(0x1, 0x1, 0x0, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r9 = dup(r8) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r10, 0x0, 0x0) write$binfmt_aout(r9, 0x0, 0xffffffdb) 2.213977106s ago: executing program 1 (id=1356): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x49) write(r0, &(0x7f0000000340)="08000000010000", 0x7) syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x418000) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000e80)={'ip6gre0\x00', &(0x7f0000000e00)={'ip6gre0\x00', 0x0, 0x29, 0x2, 0x4, 0x0, 0x8, @loopback, @mcast2, 0x700, 0x80, 0x2, 0x6}}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) getsockopt$bt_BT_POWER(r4, 0x112, 0x9, 0x0, &(0x7f0000000300)) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f0000001180)=0xe) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r3, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r3, 0x5008, 0x0) ioctl$SNDCTL_DSP_SYNC(r3, 0x5001, 0x0) ioctl$SNDCTL_DSP_GETOSPACE(r3, 0x8010500c, &(0x7f00000000c0)) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x15) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000180)=0xf9) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) ppoll(&(0x7f00000003c0)=[{r5}], 0x1, &(0x7f0000000280)={0x0, 0x989680}, 0x0, 0x0) 1.35027521s ago: executing program 0 (id=1357): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f00000002c0)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x6000, @mcast2}, 0x1c, 0x0}}], 0x1, 0x4000000) 1.278104593s ago: executing program 0 (id=1358): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x13) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x262281, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000040)={0x0, 0x10c1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x8842, 0x3, 0x92, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x20, 0x1, 0x80003ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e8, 0x2000, 0x4003bfff, 0x1a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x723642762b6db36e, 0x1, 0x100026d}}], 0x1, 0x0, 0x0) 1.178619518s ago: executing program 0 (id=1359): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) getrlimit(0xb, &(0x7f0000000440)) r1 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x62f82, 0x0) mkdir(0x0, 0x1ff) mkdir(0x0, 0x1ff) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x3d4, 0x208, 0x2d0, 0xfeffffff, 0x2d0, 0x208, 0x3a8, 0x3a8, 0xffffffff, 0x3a8, 0x3a8, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 'veth0_to_bond\x00', 'veth1_to_team\x00', {}, {}, 0x6}, 0x0, 0x9c, 0xc0, 0x0, {}, [@common=@inet=@tcp={{0x2c}, {[], [], 0x0, 0x0, 0x2, 0x4}}]}, @common=@inet=@TCPMSS={0x24}}, {{@ip={@multicast1, @rand_addr=0x64010100, 0xffffff00, 0xff, 'tunl0\x00', 'ip6tnl0\x00', {0xff}, {}, 0x84, 0x1, 0x9}, 0x0, 0xf0, 0x124, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x0, 0x0, 0x0, 0x1, 0x7]}}}, @common=@set={{0x40}, {{0x0, [], 0x5}}}]}, @REDIRECT={0x34, 'REDIRECT\x00', 0x0, {0x1, {0x0, @broadcast, @remote, @icmp_id}}}}, {{@ip={@loopback, @dev={0xac, 0x14, 0x14, 0x15}, 0x0, 0x0, 'lo\x00', 'ip6tnl0\x00'}, 0x0, 0x70, 0xa4}, @NETMAP={0x34, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id, @icmp_id=0x64}}}}, {{@ip={@remote, @broadcast, 0x0, 0x0, 'pim6reg0\x00', 'wlan0\x00', {}, {0xff}}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@remote, @ipv4=@dev}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x430) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) recvmmsg(r2, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x6}], 0x2, 0x2, 0x0) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89a0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(r3, 0x0, 0x44000) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x800}, 0x1c) r4 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r5 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r5, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4}) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r5, 0x40146f2c, &(0x7f0000000040)={0x80, 0xffffffff, 0x0, 0x5}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) 834.269261ms ago: executing program 4 (id=1349): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000005a0000008500000022000000180100002020702500000000002020200100000000000000bfa1000000000000070100"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=@base={0x19, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000000008000000850000000500000095"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b40)={{r0}, &(0x7f0000000a40), &(0x7f0000000b00)=r1}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = accept4$llc(0xffffffffffffffff, &(0x7f0000000240)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000300)=0x10, 0x80000) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000340)={'wg2\x00'}) sendmmsg$unix(r3, &(0x7f0000003340)=[{{0x0, 0xfffffffffffffed1, &(0x7f0000000280)=[{&(0x7f0000000600)='4', 0x1}], 0x1, &(0x7f00000002c0)=[@rights={{0x10}}], 0x10, 0x40}}], 0x1, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r5, 0x0, 0x39011, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) ioctl$KDDELIO(r6, 0x4b35, 0x0) 785.949944ms ago: executing program 4 (id=1360): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x13) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) openat$hpet(0xffffffffffffff9c, 0x0, 0x262281, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000040)={0x0, 0x10c1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x8842, 0x3, 0x92, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x20, 0x1, 0x80003ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e8, 0x2000, 0x4003bfff, 0x1a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x723642762b6db36e, 0x1, 0x100026d}}], 0x1, 0x0, 0x0) 538.11147ms ago: executing program 1 (id=1361): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000005a0000008500000022000000180100002020702500000000002020200100000000000000bfa1000000000000070100"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=@base={0x19, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000000008000000850000000500000095"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b40)={{r0}, &(0x7f0000000a40), &(0x7f0000000b00)=r1}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = accept4$llc(0xffffffffffffffff, &(0x7f0000000240)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000300)=0x10, 0x80000) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000340)={'wg2\x00'}) sendmmsg$unix(r3, &(0x7f0000003340)=[{{0x0, 0xfffffffffffffed1, &(0x7f0000000280)=[{&(0x7f0000000600)='4', 0x1}], 0x1, &(0x7f00000002c0)=[@rights={{0x10}}], 0x10, 0x40}}], 0x1, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r5, 0x0, 0x39011, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) ioctl$KDDELIO(r6, 0x4b35, 0x0) 480.024321ms ago: executing program 1 (id=1362): sendmmsg$alg(0xffffffffffffffff, &(0x7f00000029c0)=[{0x0, 0x0, &(0x7f0000001200)=[{&(0x7f0000000140)="ab9c4775ab22f72bebf3713ae2b09cc275d0a277a710b525b46198f429d751191a74371d3f8861cb7b87a1f2ac28886cb84e099aaafd4e1d0b3cd9944eb83a8cbcd962dd670c1f5082fbd460e842831dbf7b23174acd3051b9153ca008062cbe26888430df7785fdb89ac65ebcf1c5dab9669e55cfba124d749bfc163ba084bddc8f2fd6adc1ba43189e1a6221400e5f4c325a5ec3f2381524614b794562f4041a5698a716863f8179ca88ff37a28f73c60d28e33fef9188bc96f6c5c523ee6f36d1885a2b1bc25f89edecd45e9987bd6bb71a0b1ada7908974c10a2e0c2b113d89a0c75d04c0d07005dcb3c451a4e27816cd696a2e6a4ddbc8d7f729e33499e0d6eb49a11e7d6c69ea2fae10a5ea569308990a5a6ed5413905764ad69950f130c10f4a2a40f99a5e3486f2d15f62427af0a6635eb94a05c7b66b217329064d0f0ae63b02391505f7a3b7309eda5b35e8856b63351854ba6c1797ffa9cbd68b668227805b4eb43583693bea53e1c169302633ccb611bc64432674b93156f1d03ed1d8fb1877a488b1a508329d707a021359d37c49a954878dd3afd85a2b178d3013071a7bc648a450b741c18a20c1462d72d99307847c86ac3a0a805d72b74c570c2cecf0a44ae26ffd24c5d057c08f2ac70d12298325a675e323ae25e652529d454999ce84c690b2fcfc60b08fa87160bd687ef63133903c6e98191433dfa80651b4b056167919cd7f0864e8b13bda5e3e4d1f795847dc70d8092890ea11b906cd904bcf081e98a8b59c620b3650b7b70559f58644802baadf2f9d5886fbee964e909a68ea889256ae7554b2f99560eb0a201c016064ffdf354c99fa6a16e5ffad0cb625548b1369a32b462ab3880de860b9a20156910f7b9ce88e87c903631073a807c54c3e641ccd35af8bc9ddcd651f6b83aaed59753c8f4e5d2e211935dfa977a9ed0b9e6ca74b19ae5c825cf384f2547bc74edb6435b4815251ececa3aea5b5d79a7fe4580048aff65f69c062d2c0e189d891c9122c1fce888fd893ae581dc467ee45276730579945c236dc5725b2fb35d8e21618e6d7b480b6efcfea26da37d9e75a395b3cd4ee8b834d3b0c18d8efe8af5f2f04d32ceb64c717983f3776b3ffd1257e406b5f955f122955f874786e51e96698980d79bfba7e36479e4167dcb6fa4714f0317792f3ef0d6973f563a80ab8d338645b3ea59f47f7838637c653d13a8edcced9fee36d4fd4c0a9fe88b76724faa5c428efee01df7bb4c8cee7bae3e2fae0ff44029fc9edea0b8e53b6e706b10f52062a77eea8c89206ecc84b5a6dbcbff35118e3cfdd278966f1cb3b1cacc231c60a744f4ac37a330dc385bc82afba8b845ecd719ed54413562cd9e2627bf946d4377e8501d14d514a0f34abbbfa017d2a8ac734525bf909daa6f82b9a0e1142ccb53ae02ff360d9c40c6a3cdd66fc119676d028993ea17825ed5cf06d3f6e63d0d59547654bfe4a89921845c5d08cea318f01f7e2bbbc97a6c3063488ed72f6cbf4239f0dbb35748be34dbe023cd6bff74b94f9da703a16b7b84ba9d6c2e83de7516ec990b737bea57fc5aa140e1121ecf5d363939e4083c1e1b474e5cd29725b4d96e3178447619dc7778ec4766f33934e79b541f93830337bde18dd312863269bde739fe840d9c8a1cce4515fe149a1b8b49fdca1a25df2f1f6f8576bce11afc296658dba474e6f56aec7f132014d552fadaf8565870230e6343f5e83f65b8b0ffbb60026ae477666a071fa27c837baf104b4348d9b2b1eaf2e903f56e76af2571a0581707d124faa506fd57719afaf7400548e7c75cddd590ecea894a5c775dc2b618aeb2b9e2bd48312d7f7bf42bbe11e453db4b5cead6c52f9cf9e72560c6daec08072945035fee0caac6722aa5e0c4bccd4dff201cbb19638e3db1efcd8ee13498a815009f0de828383be1d119914264d5523f462cabe48b592c35d4036b012cec86aa5e8c309587874b6e2a7c2c6ad3c3239adad6a023fd5e0bddcf7dba0b8396fb02f8fce74d3aadfc7784d63581361677ee5ba5dce0574ff0a3329adfce76a3f249925e42ac84ac981ea9ae089b189d2dd9f17e85def562f163ca7017e1f9ba164e14bdb0fcdef13318ee75adf028b8ffe00b9d5ca2d8778bb371a4dd578f36d0d1fa217d6fa78fdec06dabc0b4ad9e2b8f9d4140ae57d1c97b8dfba23b34b2808af83815305816e63202a26434dca46df0e71baf5c6f59ed13e938a2a7620167b060fdde2180ef3c11b9ce0d391f12c897c7f072e1a7ad8bda9ef6f98ec6bb045b9b61e35ee639feffcb563b906bc882c0985e75dceffc2e211fde73e5b9b99537e8df4d2f41e862fbd9ecf38b8057a84f24cabc93dd155e7adbe9be655aaf767be3980a7c04202c77dd43360aa92a9a9d6d7381a2eba7db7f55f9ec211a418af3d8b2a13781983103c101f81608af87fb86b1798afae07f30435e8876cd90e2a3f2cdf5fecb3cc8e49dfe58b235184d9a514b7a928ab203ba4a57329429263c0c7d95b92be7ee769f4d8c2f27555950f6b02940edf51e4cbfdb6ad5270d88439f7693ab2d2d6bf1dd50e0f67c348b0bf1ae079c582540564cebb2a12095de0e52674e85b77b12d5708e9848eeeaaadb1a614aefc724755eb3c0df3fae92371a99bbc29679defe1f26d49536fed7ae82603870f1cf4970845a762818f1a91a7a3ba256a6a70a6e77234ddef057389404f122bea57dcc3ad0875b9fc7e0948881ed5384b8c93ea3888920bbae7a32a7ae97989fb26d0a42d21b446b256aa2513f9a3c7a5ca9da2689ac99e73c51f66d81d11f84972d90aece05062d0324028e5ae687b6460011464ea9ac70c95b3af12bbc7993f1f35cd71a9861570adb49311a45973999b53f8629889080d869aba01598b25975117bd791a8392d5aa6ca47a2e354f3d6c4998e3cf66de405edc53a62341efb71a1901fcebc4e67c1ef364bd91fae5e047b49595944c198a2cad894bf19efc4f15e2e06c547146cf0d724ba7bd53bdfba97570236cc5f8193ec4cbec6b7dafc70ed4ba879ac2177d16bb158397a994da149e630a286fcda5df595170a625751b21600f782605cf0865258a04564ef00e0256c094c895668d8e7f25c1f48ddc6656077c97e267f194a743537034af87bfe99a709419d717ffc91332411d8f8b1574ba50948a88b0ccdf50a8ba46ab16cb4d815f3a9a7f2f9b9847caade7fb1444a241670c02a936bd5230ab06c0e55840ff514884ef8db9761b305e3ce88b918db845c1a067f817ca1f3ab3594ee4a5391f7aaacda53aa3143625552432994cd7dd1a419bf8054f65bd37da7de540214fa3cde59036bbba619f60884e52b6b29f08e2d4d13a39cf42cccf115a13daea9f0d84da5a512d34494453074b02cff7cccb0b5a4c1113634a9a175905d3d4a862a9e583d85c98c18f306f6bc49e78136a5c68a3c7c8d399efaf2d3a46972b0dc092d28d66811f9a4de70fd33bba7afdfc7049bcbbc0d6895166b1e0cf6db0a7340445e96f053bcb6182223b8983bbae94b47092b63b7c58a71a6abad60b32e9f5862b91d2d95877c63068a0e7dc62956ea8113e57a0447b9d94d0cfd9831036a0d88c89efae1e641e608cbb84704ae07f21a37e7a3926301020405457d0b0315c2b6abe5c79f67bdcd98612c07b372e28121a578b1e181ad5646f1b039cadfdacd8f17f3c36cf01d5195c4a86457e7f4085613f8f165c3c582622823ca7c6404df2f1557d5a324755dd86d06ad539724bb6bb0df4edf402eea5f8dd358041fd540663ef29a2ff53c226edbd7c57c38bc27babd27f9d4314d082951d0dcf84585b1ef1fe3813e26dc68d38693bd5837a23b3733ee1d7d7de97c022b7909f7866a771f06d1971b8efc816329e5c4d1d87a608becd74211ca8e21ca7a5c3331885b333177acb26092227f07bdb60fb705e0b6595a3c7e89850dcfbca7cf736cc7097b568a5f6fd06d20a0cca92c4575f769ca845246c579fa30b61c3fce024080aca099237984151260923529161d76bd5b6167c0f38e53ac34b3d7240697b82027ba96144e20a3da3a32d2f1cf2fea0e29ffe300d81d56d8c6415b4531b7b9dcf7e91cdf62f0cdfd25798746f7ab839440883b4a1bd6571fc668080e01f4f8a7281c65178b33f811839040b2d0fcecd29da7e57ffe73ef25500f9f16b92cc79133f90613c093b47a4a4410ae36fc47213614de3c32871d3253a95ae827d06c02277a88ddd901f0c1122fac77dca50973531a2cc3c8e3cd50389df6f487220f570218b9c972a1cf2abd941887c444b5682e22be6ef43aecff8d1553ab2628c0940e0ede2fc24d772e647eccf06277234c8e0d1722476cd766848bbed89f0750e937ad281b4299822f1353d9d4d80abd2accf3a9c587304aa084063de389ca4c1615bd1b85ed8915d0103a3de6a1cdc00e0aa8ce7c8f53675db4883ed0890132541cb1c782fab90398becf0d148d3665c0ce11210483f454ce00297ecdc402af9956f6332111bb3d14ec5eca3515b567da284ac2dec96cb4a667ca82f0eb9bdcc7a02dbed8436a640d77e5d4487a1114bb998a0dfe0526567afcad6d3378b3614b0065293512d5ac92902b1660967a6791bd922b672bb8411eac71bc80cfe1c5dfb3ba591f5ef7d80a72a678ceb9035bcb7fbcd5e1c246d21c32e7e6e963bc893a191d41a2ef3260c868609be7697f5f62d04641cc4c40ca61aa66aa46fa59fd8dc3ae13e8b962fbd3e7e8b4a49d71dfca4ac39a005d54641051ddcd36080a93195dfd6b5677e7c26d1f8bc3f3f341cf2ccc6f175703770e239fcce10d5a0e94c98a61332dec60c187fd80316a16fff89b1ea1040d4774b4344edb0fdc17cdb6116168349a889907b460365295eb3abf0afbbeb627b0656871c8c482d0cccdd58e95bf5f10ff6d47efd83abb511fd5a905c6842d96f599422a4ed22b05ff34ee0ba5b6696fefd2237cf484f464dffc48a1d33cb0450c69f572fb983917558e228fad23aab79a23c9c5afec238c7dbcb36286983a57924d1d291912bc32fa80948ec585d0967477c11d6143961de5aaddc04ef85a742a0d64b371c249c3b7d58287dd59231bcd3d01dc9057de86eb03cd51a8f071dbcb87b23371dedc3bc6acc8e2e3038c0ca22d7e22a56964917abd72c13b1c6b5f9063e64f827336ea1cb3d6de3bab9edaa47aa573a26cbd44847d5b22d6a1837a9ac4c74513bc59d17266e8304947bc46a7c9a4c78728b0e7e6d5f782050a2dbbcbd3398bbb9e19dc5f3751d5c71643a4b0c63578ac05ab249d8ddbe037633bef6466cbfc77160b4552522ac6b78d06284ff93201f95ce7b93b65f4bc1dc7baed6444a023a57252b8678e969f98075ec2014a7ee2d0c5ce4ecdbc694ada6f0174234fca318f31dc0e285983538f44717dc2f65a940fee5a37440e3c2e18d284d6bccbf1becbcf760ed047f6de26782e6c4ad6a0f4de8822df3e1f6740", 0xf2d}], 0x1, 0x0, 0x0, 0x20000800}, {0x0, 0x0, &(0x7f0000001480), 0x0, 0x0, 0x0, 0x4008000}], 0x2, 0x40800) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 446.042348ms ago: executing program 4 (id=1363): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x13) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x262281, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000040)={0x0, 0x10c1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x8842, 0x3, 0x92, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x20, 0x1, 0x80003ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e8, 0x2000, 0x4003bfff, 0x1a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x723642762b6db36e, 0x1, 0x100026d}}], 0x1, 0x0, 0x0) 443.469092ms ago: executing program 1 (id=1364): openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x262281, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000040)={0x0, 0x10c1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x8842, 0x3, 0x92, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x20, 0x1, 0x80003ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e8, 0x2000, 0x4003bfff, 0x1a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x723642762b6db36e, 0x1, 0x100026d}}], 0x1, 0x0, 0x0) 286.002836ms ago: executing program 4 (id=1365): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x13) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x262281, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000040)={0x0, 0x10c1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x8842, 0x3, 0x92, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x20, 0x1, 0x80003ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e8, 0x2000, 0x4003bfff, 0x1a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x723642762b6db36e, 0x1, 0x100026d}}], 0x1, 0x0, 0x0) 69.00371ms ago: executing program 0 (id=1366): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x400007, 0x2) readlinkat(r1, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00', &(0x7f0000000080)=""/203, 0xcb) symlinkat(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ed) symlinkat(&(0x7f0000001e00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001f00)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config\x00', 0x501840, 0x0) write(r2, &(0x7f0000002100)='usbip-vudc.0', 0xc) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000240)=0x6, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000280)="0b032200eb1025120212475400f6a13bb1000000080086dd4803", 0x1a, 0x0, &(0x7f0000000140)={0x11, 0x0, r4}, 0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) alarm(0x80) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f00000001c0)={0x4, 0x2, {0x2, 0x1, 0x4, 0x3, 0x8}, 0x400}) alarm(0x59) sendmmsg$unix(r5, &(0x7f0000001b00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001a80)=[@rights={{0xc}}], 0xc, 0x4}}], 0x1, 0x4844) 4.379503ms ago: executing program 0 (id=1367): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x3, 0x0) syz_emit_ethernet(0xae, &(0x7f0000000500)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb86dd6012000800783afffe8000000000000000000000000000bbff02000000000000000000000000000186009078010000000000000000000000000aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1803000100e9ff06ffffaf64000000a20001fe906d26efe3efd57ab8607682ba10fe8ad024ffa2669af8f0cf1d4b2a26d9f21866930d4cacf367b4ce76c52753295ccd5bce63222ec4f9f93a20f0e730901966fa8172b0477988605f3a59a9e251063412bd101470c4e006a63df5cef3809ca2cdc0cad62ab4d79c02f0a2f9bac9837a99ce4cf36d9da5fcbe32651aa4ce3796d30d3397f8e67673059120dcb7d45a0b156f0979f48725bda1d3080457e426a2bd3aba1d817f9045c42afe5df6d7b3a911fdda435cb3aa1c46adf06f0773ddefa93bfce4ba2cefc72263c2bffcbbcf4a1528d58d7a49e0d14561c7316cdc957ea355ce36058defacb80444d78f2d58"], 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'veth0_to_bond\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newqdisc={0x38, 0x24, 0x3fe3aa0262d8c583, 0x4000000, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0xebaea3d5279c9aee}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0xffffffff}}]}, 0x38}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@delqdisc={0x2c, 0x25, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x5, 0xfffc}, {0xe}, {0xc, 0x3}}, [@TCA_RATE={0x6, 0x5, {0xc3, 0x3}}]}, 0x2c}}, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fcntl$lock(r4, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r4, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x9, 0x9}) 0s ago: executing program 4 (id=1368): socket$alg(0x26, 0x5, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) r0 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10) connect$llc(r0, &(0x7f0000000240)={0x1a, 0x20, 0x0, 0x9, 0x2, 0x0, @multicast}, 0x10) r1 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r1, &(0x7f0000000000)={0x1a, 0x337, 0x0, 0x0, 0x81, 0x42}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000440), 0xe, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000000104010100000000001b00000a1000000000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x44010) socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x8000000004) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r6, 0x8b01, &(0x7f0000000040)) writev(r5, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f00000001c0)="ee64", 0x2}], 0x2) r7 = socket$netlink(0x10, 0x3, 0x15) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x0, @dev={0xac, 0x14, 0x14, 0x1b}, 0xfffd, 0x0, 'dh\x00'}, 0x2c) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c00000010000000fcffffffffdb000400c6dd00", @ANYRES64=r3, @ANYBLOB="0000000000000000090001"], 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="04010000100053"], 0x104}, 0x1, 0x0, 0x0, 0xacbf9867a2405822}, 0x200080c0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000340)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[], 0x10}}, 0x2) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) ioctl$F2FS_IOC_GET_FEATURES(r5, 0x8004f50c, &(0x7f0000000140)) close_range(r8, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): ] usb 7-1: config index 0 descriptor too short (asked for 9, got 0) [ 136.938273][ T1484] usb 7-1: can't read configurations, error -22 [ 137.076723][ T1484] usb 7-1: new full-speed USB device number 10 using dummy_hcd [ 137.109024][ T1484] usb 7-1: not running at top speed; connect to a high speed hub [ 137.111667][ T1484] usb 7-1: New USB device found, idVendor=1b3d, idProduct=0179, bcdDevice=d1.2c [ 137.115588][ T1484] usb 7-1: config index 0 descriptor too short (asked for 9, got 0) [ 137.118367][ T1484] usb 7-1: can't read configurations, error -22 [ 137.122357][ T1484] usb usb7-port1: unable to enumerate USB device [ 137.158868][ T9] dvb_usb_rtl28xxu 8-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 137.181708][ T1484] usb 8-1: USB disconnect, device number 11 [ 138.396328][ T8100] overlayfs: missing 'lowerdir' [ 138.443792][ T8102] netlink: 4 bytes leftover after parsing attributes in process `syz.1.676'. [ 138.449740][ T8102] netlink: 20 bytes leftover after parsing attributes in process `syz.1.676'. [ 138.508110][ T8112] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 138.686208][ T8126] ALSA: mixer_oss: invalid OSS volume '' [ 138.703013][ T8126] MTD: Attempt to mount non-MTD device "/dev/sr0" [ 138.712592][ T8126] /dev/sr0: Can't open blockdev [ 138.715910][ T8126] netlink: 8 bytes leftover after parsing attributes in process `syz.1.682'. [ 138.781963][ T8124] netlink: 'syz.0.677': attribute type 4 has an invalid length. [ 138.852176][ T8125] netlink: 'syz.3.679': attribute type 4 has an invalid length. [ 139.329702][ T43] kauditd_printk_skb: 691 callbacks suppressed [ 139.329716][ T43] audit: type=1800 audit(1787143318.281:842): pid=8113 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.677" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 139.372103][ T8137] support for cryptoloop has been removed. Use dm-crypt instead. [ 139.409518][ T43] audit: type=1800 audit(1787143318.361:843): pid=8110 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.679" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 139.702587][ T8145] FAULT_INJECTION: forcing a failure. [ 139.702587][ T8145] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 139.707347][ T8145] CPU: 0 UID: 0 PID: 8145 Comm: syz.1.689 Not tainted syzkaller #0 PREEMPT(full) [ 139.707363][ T8145] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 139.707381][ T8145] Call Trace: [ 139.707400][ T8145] [ 139.707405][ T8145] dump_stack_lvl+0x100/0x190 [ 139.707517][ T8145] should_fail_ex.cold+0x5/0xa [ 139.707536][ T8145] ? prepare_alloc_pages+0x16d/0x5f0 [ 139.707567][ T8145] should_fail_alloc_page+0xeb/0x140 [ 139.707591][ T8145] prepare_alloc_pages+0x1f0/0x5f0 [ 139.707610][ T8145] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 139.707627][ T8145] ? rcu_is_watching+0x13/0xc0 [ 139.707653][ T8145] ? trace_mm_page_alloc+0x164/0x1c0 [ 139.707670][ T8145] ? __alloc_frozen_pages_noprof+0x2d1/0x2dc0 [ 139.707685][ T8145] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 139.707700][ T8145] ? is_bpf_text_address+0x8a/0x1a0 [ 139.707716][ T8145] ? bpf_ksym_find+0x124/0x1c0 [ 139.707731][ T8145] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 139.707749][ T8145] ? is_bpf_text_address+0x94/0x1a0 [ 139.707758][ T8145] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 139.707772][ T8145] ? __kernel_text_address+0xd/0x30 [ 139.707806][ T8145] alloc_pages_bulk_noprof+0x5de/0x13c0 [ 139.707822][ T8145] ? policy_nodemask+0xed/0x4f0 [ 139.707842][ T8145] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 139.707863][ T8145] __kasan_populate_vmalloc+0xf0/0x210 [ 139.707880][ T8145] alloc_vmap_area+0x95d/0x2bb0 [ 139.707900][ T8145] ? kasan_save_track+0x14/0x30 [ 139.707916][ T8145] ? __kasan_kmalloc+0xaa/0xb0 [ 139.707930][ T8145] ? __pfx_alloc_vmap_area+0x10/0x10 [ 139.707946][ T8145] ? __get_vm_area_node+0x124/0x350 [ 139.707969][ T8145] __get_vm_area_node+0x1ed/0x350 [ 139.707989][ T8145] __vmalloc_node_range_noprof+0x228/0x1630 [ 139.708000][ T8145] ? kernel_clone+0x176/0x9d0 [ 139.708020][ T8145] ? find_held_lock+0x2b/0x80 [ 139.708045][ T8145] ? kernel_clone+0x176/0x9d0 [ 139.708060][ T8145] ? __memcg_slab_post_alloc_hook+0x74c/0x1160 [ 139.708073][ T8145] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 139.708088][ T8145] ? trace_kmem_cache_alloc+0xdd/0x100 [ 139.708107][ T8145] ? kernel_clone+0x176/0x9d0 [ 139.708119][ T8145] __vmalloc_node_noprof+0xad/0xf0 [ 139.708130][ T8145] ? kernel_clone+0x176/0x9d0 [ 139.708144][ T8145] copy_process+0x803/0x8370 [ 139.708159][ T8145] ? __lock_acquire+0x4c5/0x1ec0 [ 139.708175][ T8145] ? __pfx_copy_process+0x10/0x10 [ 139.708190][ T8145] ? get_pid_task+0xfc/0x250 [ 139.708203][ T8145] ? get_pid_task+0xfc/0x250 [ 139.708219][ T8145] kernel_clone+0x176/0x9d0 [ 139.708232][ T8145] ? proc_fail_nth_write+0x9f/0x220 [ 139.708270][ T8145] ? __pfx_kernel_clone+0x10/0x10 [ 139.708286][ T8145] ? find_held_lock+0x2b/0x80 [ 139.708305][ T8145] ? ksys_write+0x190/0x250 [ 139.708322][ T8145] ? ksys_write+0x190/0x250 [ 139.708335][ T8145] __do_compat_sys_ia32_clone+0xd4/0x120 [ 139.708355][ T8145] ? __pfx___do_compat_sys_ia32_clone+0x10/0x10 [ 139.708372][ T8145] ? fput+0x7c/0x100 [ 139.708386][ T8145] ? ksys_write+0x1ac/0x250 [ 139.708397][ T8145] ? __pfx_ksys_write+0x10/0x10 [ 139.708411][ T8145] __do_fast_syscall_32+0x13a/0x8b0 [ 139.708491][ T8145] ? lockdep_hardirqs_on+0x7d/0x110 [ 139.708504][ T8145] do_fast_syscall_32+0x32/0x70 [ 139.708516][ T8145] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 139.708530][ T8145] RIP: 0023:0xf6fcefec [ 139.708545][ T8145] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 139.708556][ T8145] RSP: 002b:00000000f53bd4bc EFLAGS: 00000206 ORIG_RAX: 0000000000000078 [ 139.708568][ T8145] RAX: ffffffffffffffda RBX: 000000000c001200 RCX: 0000000000000000 [ 139.708575][ T8145] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 139.708581][ T8145] RBP: 00000000f73c4f80 R08: 0000000000000000 R09: 0000000000000000 [ 139.708586][ T8145] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 139.708592][ T8145] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 139.708605][ T8145] [ 139.708973][ T8145] syz.1.689: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 139.839392][ T8145] CPU: 0 UID: 0 PID: 8145 Comm: syz.1.689 Not tainted syzkaller #0 PREEMPT(full) [ 139.839407][ T8145] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 139.839413][ T8145] Call Trace: [ 139.839430][ T8145] [ 139.839434][ T8145] dump_stack_lvl+0x100/0x190 [ 139.839453][ T8145] warn_alloc.cold+0x94/0xa8 [ 139.839465][ T8145] ? __pfx_warn_alloc+0x10/0x10 [ 139.839478][ T8145] ? lockdep_hardirqs_on+0x7d/0x110 [ 139.839492][ T8145] ? __get_vm_area_node+0x2f0/0x350 [ 139.839512][ T8145] ? __get_vm_area_node+0x22b/0x350 [ 139.839531][ T8145] __vmalloc_node_range_noprof+0xccd/0x1630 [ 139.839542][ T8145] ? find_held_lock+0x2b/0x80 [ 139.839561][ T8145] ? kernel_clone+0x176/0x9d0 [ 139.839578][ T8145] ? __memcg_slab_post_alloc_hook+0x74c/0x1160 [ 139.839591][ T8145] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 139.839605][ T8145] ? trace_kmem_cache_alloc+0xdd/0x100 [ 139.839623][ T8145] ? kernel_clone+0x176/0x9d0 [ 139.839636][ T8145] __vmalloc_node_noprof+0xad/0xf0 [ 139.839646][ T8145] ? kernel_clone+0x176/0x9d0 [ 139.839660][ T8145] copy_process+0x803/0x8370 [ 139.839676][ T8145] ? __lock_acquire+0x4c5/0x1ec0 [ 139.839691][ T8145] ? __pfx_copy_process+0x10/0x10 [ 139.839706][ T8145] ? get_pid_task+0xfc/0x250 [ 139.839720][ T8145] ? get_pid_task+0xfc/0x250 [ 139.839736][ T8145] kernel_clone+0x176/0x9d0 [ 139.839749][ T8145] ? proc_fail_nth_write+0x9f/0x220 [ 139.839762][ T8145] ? __pfx_kernel_clone+0x10/0x10 [ 139.839778][ T8145] ? find_held_lock+0x2b/0x80 [ 139.839792][ T8145] ? ksys_write+0x190/0x250 [ 139.839804][ T8145] ? ksys_write+0x190/0x250 [ 139.839817][ T8145] __do_compat_sys_ia32_clone+0xd4/0x120 [ 139.839831][ T8145] ? __pfx___do_compat_sys_ia32_clone+0x10/0x10 [ 139.839849][ T8145] ? fput+0x7c/0x100 [ 139.839863][ T8145] ? ksys_write+0x1ac/0x250 [ 139.839874][ T8145] ? __pfx_ksys_write+0x10/0x10 [ 139.839888][ T8145] __do_fast_syscall_32+0x13a/0x8b0 [ 139.839901][ T8145] ? lockdep_hardirqs_on+0x7d/0x110 [ 139.839912][ T8145] do_fast_syscall_32+0x32/0x70 [ 139.839924][ T8145] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 139.839939][ T8145] RIP: 0023:0xf6fcefec [ 139.839959][ T8145] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 139.839964][ T8145] RSP: 002b:00000000f53bd4bc EFLAGS: 00000206 ORIG_RAX: 0000000000000078 [ 139.839974][ T8145] RAX: ffffffffffffffda RBX: 000000000c001200 RCX: 0000000000000000 [ 139.839980][ T8145] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 139.839986][ T8145] RBP: 00000000f73c4f80 R08: 0000000000000000 R09: 0000000000000000 [ 139.839992][ T8145] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 139.839997][ T8145] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 139.840010][ T8145] [ 139.840064][ T8145] Mem-Info: [ 139.928305][ T8145] active_anon:5617 inactive_anon:607 isolated_anon:0 [ 139.928305][ T8145] active_file:6765 inactive_file:45212 isolated_file:0 [ 139.928305][ T8145] unevictable:1000 dirty:97 writeback:0 [ 139.928305][ T8145] slab_reclaimable:7525 slab_unreclaimable:52734 [ 139.928305][ T8145] mapped:23884 shmem:1482 pagetables:1184 [ 139.928305][ T8145] sec_pagetables:308 bounce:0 [ 139.928305][ T8145] kernel_misc_reclaimable:0 [ 139.928305][ T8145] free:29509 free_pcp:13002 free_cma:0 [ 139.944596][ T8145] Node 0 active_anon:8kB inactive_anon:108kB active_file:12kB inactive_file:4kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:32kB dirty:4kB writeback:0kB shmem:4kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8512kB pagetables:1692kB sec_pagetables:1136kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 139.957978][ T8145] Node 1 active_anon:22460kB inactive_anon:2320kB active_file:27048kB inactive_file:180844kB unevictable:4000kB isolated(anon):0kB isolated(file):0kB mapped:95504kB dirty:384kB writeback:0kB shmem:5924kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5380kB pagetables:3044kB sec_pagetables:96kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 139.968714][ T8145] Node 0 DMA free:2064kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:8kB active_file:4kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:588kB local_pcp:80kB free_cma:0kB [ 139.978140][ T8145] lowmem_reserve[]: 0 279 279 279 279 [ 139.979919][ T8145] Node 0 DMA32 free:15768kB boost:0kB min:12656kB low:15820kB high:18984kB reserved_highatomic:0KB free_highatomic:0KB active_anon:8kB inactive_anon:100kB active_file:8kB inactive_file:4kB unevictable:0kB writepending:4kB zspages:0kB present:1032196kB managed:286432kB mlocked:0kB bounce:0kB free_pcp:11220kB local_pcp:3248kB free_cma:0kB [ 139.990054][ T8145] lowmem_reserve[]: 0 0 0 0 0 [ 139.991674][ T8145] Node 1 DMA32 free:100204kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22460kB inactive_anon:2320kB active_file:27048kB inactive_file:180844kB unevictable:4000kB writepending:484kB zspages:2980kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:40376kB local_pcp:10496kB free_cma:0kB [ 140.004285][ T8145] lowmem_reserve[]: 0 0 0 0 0 [ 140.005921][ T8145] Node 0 DMA: 18*4kB (U) 1*8kB (M) 8*16kB (UM) 10*32kB (UM) 4*64kB (UM) 4*128kB (UM) 1*256kB (M) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 2064kB [ 140.010820][ T8145] Node 0 DMA32: 104*4kB (UME) 87*8kB (UME) 62*16kB (UME) 47*32kB (E) 22*64kB (UME) 20*128kB (UME) 6*256kB (UM) 5*512kB (M) 2*1024kB (M) 1*2048kB (M) 0*4096kB = 15768kB [ 140.016205][ T8145] Node 1 DMA32: 240*4kB (UM) 179*8kB (M) 178*16kB (UME) 122*32kB (UME) 124*64kB (UME) 121*128kB (UME) 54*256kB (UME) 23*512kB (UME) 17*1024kB (UM) 6*2048kB (UM) 3*4096kB (UM) = 100152kB [ 140.022148][ T8145] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 140.025203][ T8145] Node 0 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 140.028244][ T8145] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 140.031264][ T8145] Node 1 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 140.034207][ T8145] 54414 total pagecache pages [ 140.035743][ T8145] 959 pages in swap cache [ 140.037213][ T8145] Free swap = 116728kB [ 140.038586][ T8145] Total swap = 124996kB [ 140.039967][ T8145] 524155 pages RAM [ 140.041231][ T8145] 0 pages HighMem/MovableOnly [ 140.042765][ T8145] 211654 pages reserved [ 140.044130][ T8145] 0 pages cma reserved [ 140.180658][ T8151] FAULT_INJECTION: forcing a failure. [ 140.180658][ T8151] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 140.184954][ T8151] CPU: 3 UID: 0 PID: 8151 Comm: syz.2.692 Not tainted syzkaller #0 PREEMPT(full) [ 140.184976][ T8151] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 140.184986][ T8151] Call Trace: [ 140.184992][ T8151] [ 140.184999][ T8151] dump_stack_lvl+0x100/0x190 [ 140.185032][ T8151] should_fail_ex.cold+0x5/0xa [ 140.185046][ T8151] _copy_from_user+0x2e/0xd0 [ 140.185070][ T8151] blkdev_common_ioctl+0x314/0x2b80 [ 140.185084][ T8151] ? tomoyo_path_number_perm+0x188/0x580 [ 140.185112][ T8151] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 140.185133][ T8151] ? get_pid_task+0x106/0x250 [ 140.185182][ T8151] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 140.185220][ T8151] ? do_vfs_ioctl+0x226/0x13e0 [ 140.185238][ T8151] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 140.185260][ T8151] ? find_held_lock+0x2b/0x80 [ 140.185275][ T8151] ? __fget_files+0x215/0x3d0 [ 140.185289][ T8151] compat_blkdev_ioctl+0x1e6/0x7b0 [ 140.185304][ T8151] ? __pfx_compat_blkdev_ioctl+0x10/0x10 [ 140.185320][ T8151] ? __pfx_compat_blkdev_ioctl+0x10/0x10 [ 140.185334][ T8151] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 140.185346][ T8151] __do_fast_syscall_32+0x13a/0x8b0 [ 140.185359][ T8151] ? lockdep_hardirqs_on+0x7d/0x110 [ 140.185371][ T8151] do_fast_syscall_32+0x32/0x70 [ 140.185383][ T8151] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 140.185397][ T8151] RIP: 0023:0xf7fb4fec [ 140.185412][ T8151] Code: Unable to access opcode bytes at 0xf7fb4fc2. [ 140.185417][ T8151] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 140.185427][ T8151] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000000127f [ 140.185434][ T8151] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 140.185440][ T8151] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 140.185445][ T8151] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 140.185451][ T8151] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 140.185463][ T8151] [ 140.501323][ T8164] tipc: Enabling of bearer rejected, failed to enable media [ 140.598868][ T8166] 9p: Bad value for 'rfdno' [ 140.759052][ T8169] FAULT_INJECTION: forcing a failure. [ 140.759052][ T8169] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 140.776813][ T8169] CPU: 0 UID: 0 PID: 8169 Comm: syz.0.699 Not tainted syzkaller #0 PREEMPT(full) [ 140.776833][ T8169] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 140.776840][ T8169] Call Trace: [ 140.776845][ T8169] [ 140.776850][ T8169] dump_stack_lvl+0x100/0x190 [ 140.776869][ T8169] should_fail_ex.cold+0x5/0xa [ 140.776881][ T8169] strncpy_from_user+0x3b/0x2d0 [ 140.776897][ T8169] bpf_prog_load+0x13d2/0x2fa0 [ 140.776915][ T8169] ? __pfx_bpf_prog_load+0x10/0x10 [ 140.776928][ T8169] ? __lock_acquire+0x4c5/0x1ec0 [ 140.776955][ T8169] __sys_bpf+0x18dc/0x4e80 [ 140.776972][ T8169] ? __pfx___sys_bpf+0x10/0x10 [ 140.776985][ T8169] ? find_held_lock+0x2b/0x80 [ 140.777000][ T8169] ? get_pid_task+0xfc/0x250 [ 140.777014][ T8169] ? get_pid_task+0xfc/0x250 [ 140.777031][ T8169] ? proc_fail_nth_write+0x9f/0x220 [ 140.777044][ T8169] ? find_held_lock+0x2b/0x80 [ 140.777061][ T8169] ? rcu_read_lock_any_held+0x6a/0x90 [ 140.777077][ T8169] ? find_held_lock+0x2b/0x80 [ 140.777090][ T8169] ? ksys_write+0x190/0x250 [ 140.777102][ T8169] ? ksys_write+0x190/0x250 [ 140.777123][ T8169] ? fput+0x7c/0x100 [ 140.777154][ T8169] ? __ia32_sys_bpf+0xcc/0x170 [ 140.777169][ T8169] __ia32_sys_bpf+0xcc/0x170 [ 140.777182][ T8169] ? __do_fast_syscall_32+0xb3/0x8b0 [ 140.777197][ T8169] __do_fast_syscall_32+0x13a/0x8b0 [ 140.777208][ T8169] ? lockdep_hardirqs_on+0x7d/0x110 [ 140.777220][ T8169] do_fast_syscall_32+0x32/0x70 [ 140.777231][ T8169] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 140.777246][ T8169] RIP: 0023:0xf6ffefec [ 140.777260][ T8169] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 140.777265][ T8169] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 140.777277][ T8169] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000680 [ 140.777283][ T8169] RDX: 00000000000000c1 RSI: 0000000000000000 RDI: 0000000000000000 [ 140.777289][ T8169] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 140.777295][ T8169] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 140.777300][ T8169] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 140.777313][ T8169] [ 141.130410][ T8176] support for cryptoloop has been removed. Use dm-crypt instead. [ 141.418669][ T8196] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 141.829453][ T8203] netlink: 'syz.3.712': attribute type 4 has an invalid length. [ 142.389777][ T43] audit: type=1800 audit(1787143321.341:844): pid=8200 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.712" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 142.555673][ T8212] netlink: 'syz.2.715': attribute type 4 has an invalid length. [ 142.602023][ T8220] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 142.754684][ T8225] netlink: 28 bytes leftover after parsing attributes in process `syz.1.721'. [ 142.971163][ T8230] netlink: 'syz.0.723': attribute type 10 has an invalid length. [ 142.982587][ T8230] team0: Port device dummy0 added [ 143.089196][ T43] audit: type=1800 audit(1787143322.041:845): pid=8209 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.715" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 143.945050][ T8260] binder: 8259:8260 ioctl 4010942a 80000240 returned -22 [ 144.235509][ T8266] netlink: 'syz.0.733': attribute type 4 has an invalid length. [ 144.345366][ T8274] jffs2: notice: (8274) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 144.456685][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 144.586885][ T8280] netlink: 32 bytes leftover after parsing attributes in process `syz.2.740'. [ 144.803079][ T43] audit: type=1800 audit(1787143323.751:846): pid=8258 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.733" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 145.320530][ T8298] trusted_key: syz.2.751 sent an empty control message without MSG_MORE. [ 145.492078][ T8312] binder: 8310:8312 ioctl c00c6211 0 returned -14 [ 146.066686][ T5819] usb 7-1: new low-speed USB device number 11 using dummy_hcd [ 146.071855][ T8348] netlink: 20 bytes leftover after parsing attributes in process `syz.3.763'. [ 146.217744][ T5819] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 146.223603][ T5819] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 146.227399][ T5819] usb 7-1: config 0 has no interface number 0 [ 146.229422][ T5819] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 146.232851][ T5819] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 146.236167][ T5819] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.240899][ T5819] usb 7-1: config 0 descriptor?? [ 146.243114][ T8339] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 146.248844][ T5819] iowarrior 7-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 146.462633][ T5819] usb 7-1: USB disconnect, device number 11 [ 147.069201][ T8345] ceph: No mds server is up or the cluster is laggy [ 147.357395][ T8372] netlink: 'syz.1.771': attribute type 4 has an invalid length. [ 147.887823][ T43] audit: type=1800 audit(1787143326.841:847): pid=8373 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.771" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 148.189226][ T43] audit: type=1800 audit(1787143327.141:848): pid=8395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.779" name="start_block" dev="configfs" ino=33827 res=0 errno=0 [ 148.568550][ T8399] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 149.013443][ T8418] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 149.023349][ T8418] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 150.838758][ T5736] Bluetooth: hci3: command tx timeout [ 150.892647][ T8437] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 151.500478][ T8445] device-mapper: ioctl: Unable to rename non-existent device, to uuid  [ 152.263061][ T8462] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 152.781940][ T43] audit: type=1800 audit(1787143331.731:849): pid=8472 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.808" name="start_block" dev="configfs" ino=33295 res=0 errno=0 [ 153.143425][ T8480] netlink: 'syz.2.810': attribute type 4 has an invalid length. [ 153.701236][ T8491] device-mapper: ioctl: Unable to rename non-existent device, to uuid  [ 153.717290][ T43] audit: type=1800 audit(1787143332.671:850): pid=8482 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.810" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 154.139749][ T8504] netlink: 'syz.1.817': attribute type 4 has an invalid length. [ 154.413347][ T8515] netlink: 20 bytes leftover after parsing attributes in process `syz.2.820'. [ 154.635210][ T43] audit: type=1800 audit(1787143333.581:851): pid=8505 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.817" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 155.063968][ T8527] netlink: 'syz.0.826': attribute type 4 has an invalid length. [ 155.401144][ T8510] ceph: No mds server is up or the cluster is laggy [ 155.417060][ T8533] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 155.576239][ T8537] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 155.679610][ T43] audit: type=1800 audit(1787143334.631:852): pid=8525 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.826" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 156.001964][ T8545] device-mapper: ioctl: Unable to rename non-existent device, to uuid  [ 156.037913][ T43] audit: type=1800 audit(1787143334.991:853): pid=8549 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.841" name="start_block" dev="configfs" ino=35933 res=0 errno=0 [ 157.008273][ T8573] netlink: 20 bytes leftover after parsing attributes in process `syz.0.842'. [ 157.098801][ T8582] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 158.027430][ T8568] ceph: No mds server is up or the cluster is laggy [ 158.122661][ T43] audit: type=1800 audit(1787143337.071:854): pid=8601 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.853" name="start_block" dev="configfs" ino=36009 res=0 errno=0 [ 160.058405][ T43] audit: type=1800 audit(1787143338.971:855): pid=8650 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.869" name="start_block" dev="configfs" ino=34676 res=0 errno=0 [ 160.338649][ T8679] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 161.194612][ T43] audit: type=1800 audit(1787143340.141:856): pid=8693 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.878" name="start_block" dev="configfs" ino=36202 res=0 errno=0 [ 161.979227][ T8717] netlink: 'syz.2.887': attribute type 4 has an invalid length. [ 162.479991][ T43] audit: type=1800 audit(1787143341.431:857): pid=8712 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.887" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 162.889361][ T43] audit: type=1800 audit(1787143341.841:858): pid=8741 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.898" name="start_block" dev="configfs" ino=36250 res=0 errno=0 [ 163.139896][ T8750] netlink: 28 bytes leftover after parsing attributes in process `syz.0.901'. [ 163.147185][ T8750] netlink: 24 bytes leftover after parsing attributes in process `syz.0.901'. [ 163.302359][ T8754] netlink: 20 bytes leftover after parsing attributes in process `syz.0.901'. [ 163.333133][ T8755] netlink: 12 bytes leftover after parsing attributes in process `syz.3.902'. [ 163.336255][ T8755] netlink: 4 bytes leftover after parsing attributes in process `syz.3.902'. [ 164.143838][ T8758] Console: switching to colour dummy device 80x25 [ 164.771355][ T8759] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 164.908138][ T8759] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 164.914669][ T8759] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 164.920109][ T8759] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 164.933126][ T8759] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 165.067599][ T8759] pci 0000:00:01.0: Adding to iommu group 1 [ 165.238096][ T8759] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 165.240265][ T8759] pci 0000:00:01.0: vgaarb: bridge control possible [ 165.242366][ T8759] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 165.277055][ T8772] netlink: 'syz.0.906': attribute type 4 has an invalid length. [ 165.302646][ T8759] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 165.306424][ T8759] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 165.332192][ T8759] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 165.709361][ T8759] [drm] Found bochs VGA, ID 0xb0c5. [ 165.712620][ T8759] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 165.728038][ T8759] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 165.745419][ T8783] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 165.760267][ T43] audit: type=1800 audit(1787143344.701:859): pid=8770 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.906" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 165.894885][ T8759] Console: switching to colour frame buffer device 160x50 [ 165.960370][ T8759] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 166.474258][ T8793] netlink: 8 bytes leftover after parsing attributes in process `syz.0.912'. [ 166.758143][ T8802] binder: 8801:8802 ioctl 540b 2 returned -22 [ 167.551086][ T8808] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 167.753846][ T8814] lo speed is unknown, defaulting to 1000 [ 167.757220][ T8814] lo speed is unknown, defaulting to 1000 [ 167.777198][ T8814] lo speed is unknown, defaulting to 1000 [ 167.781330][ T8816] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 167.821267][ T8814] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 167.826950][ T8814] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 167.833382][ T8814] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 167.851860][ T8814] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 167.885399][ T8814] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 167.912955][ T43] audit: type=1800 audit(1787143346.861:860): pid=8822 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.924" name="start_block" dev="configfs" ino=37410 res=0 errno=0 [ 167.940655][ T8821] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 167.982272][ T8814] lo speed is unknown, defaulting to 1000 [ 168.015595][ T8814] lo speed is unknown, defaulting to 1000 [ 168.041112][ T8814] lo speed is unknown, defaulting to 1000 [ 168.056460][ T8814] lo speed is unknown, defaulting to 1000 [ 168.108523][ T8812] smbdirect: ib_dev[syz2] removed [ 168.266717][ T1484] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 168.417288][ T1484] usb 7-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 168.421102][ T1484] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 168.424234][ T1484] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.429865][ T8827] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 168.433461][ T1484] opticon 7-1:1.0: opticon converter detected [ 168.447136][ T1484] usb 7-1: opticon converter now attached to ttyUSB0 [ 168.771610][ T8838] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 168.825552][ T8842] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 169.095181][ T1484] usb 7-1: USB disconnect, device number 12 [ 169.102703][ T1484] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 169.107164][ T1484] opticon 7-1:1.0: device disconnected [ 169.473997][ T8858] netlink: 8 bytes leftover after parsing attributes in process `syz.3.936'. [ 169.774011][ T8867] FAULT_INJECTION: forcing a failure. [ 169.774011][ T8867] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 169.778289][ T8867] CPU: 1 UID: 0 PID: 8867 Comm: syz.1.941 Not tainted syzkaller #0 PREEMPT(full) [ 169.778312][ T8867] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 169.778330][ T8867] Call Trace: [ 169.778354][ T8867] [ 169.778361][ T8867] dump_stack_lvl+0x100/0x190 [ 169.778506][ T8867] should_fail_ex.cold+0x5/0xa [ 169.778535][ T8867] _copy_from_user+0x2e/0xd0 [ 169.778586][ T8867] get_compat_msghdr+0xb3/0x480 [ 169.778687][ T8867] ? __pfx_get_compat_msghdr+0x10/0x10 [ 169.778717][ T8867] ___sys_sendmsg+0x1b6/0x1e0 [ 169.778764][ T8867] ? __pfx____sys_sendmsg+0x10/0x10 [ 169.778799][ T8867] ? find_held_lock+0x2b/0x80 [ 169.778851][ T8867] __sys_sendmsg+0x160/0x210 [ 169.778871][ T8867] ? __pfx___sys_sendmsg+0x10/0x10 [ 169.778897][ T8867] ? __pfx_ksys_write+0x10/0x10 [ 169.778936][ T8867] __do_fast_syscall_32+0x13a/0x8b0 [ 169.779020][ T8867] ? lockdep_hardirqs_on+0x7d/0x110 [ 169.779038][ T8867] do_fast_syscall_32+0x32/0x70 [ 169.779056][ T8867] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 169.779077][ T8867] RIP: 0023:0xf6fcefec [ 169.779099][ T8867] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 169.779114][ T8867] RSP: 002b:00000000f53bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 169.779131][ T8867] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000800000c0 [ 169.779141][ T8867] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000000 [ 169.779151][ T8867] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 169.779159][ T8867] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 169.779168][ T8867] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 169.779190][ T8867] [ 169.918195][ T8870] netlink: 'syz.0.942': attribute type 4 has an invalid length. [ 170.101982][ T8886] syz.1.950: vmalloc error: size 1768304430, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 170.107038][ T8886] CPU: 2 UID: 0 PID: 8886 Comm: syz.1.950 Not tainted syzkaller #0 PREEMPT(full) [ 170.107056][ T8886] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 170.107064][ T8886] Call Trace: [ 170.107070][ T8886] [ 170.107075][ T8886] dump_stack_lvl+0x100/0x190 [ 170.107094][ T8886] warn_alloc.cold+0x94/0xa8 [ 170.107108][ T8886] ? __pfx_warn_alloc+0x10/0x10 [ 170.107143][ T8886] __vmalloc_node_range_noprof+0x136c/0x1630 [ 170.107158][ T8886] ? sockopt_release_sock+0x57/0x70 [ 170.107180][ T8886] ? lock_acquire+0x1b9/0x370 [ 170.107195][ T8886] ? ip_set_sockfn_get+0x18e/0xd20 [ 170.107236][ T8886] ? __lock_acquire+0x4c5/0x1ec0 [ 170.107248][ T8886] ? trace_contention_end+0x126/0x160 [ 170.107264][ T8886] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 170.107277][ T8886] ? nf_sockopt_find.isra.0+0x2a/0x290 [ 170.107300][ T8886] ? rcu_is_watching+0x13/0xc0 [ 170.107322][ T8886] ? ip_set_sockfn_get+0x18e/0xd20 [ 170.107337][ T8886] __vmalloc_node_noprof+0xad/0xf0 [ 170.107348][ T8886] ? ip_set_sockfn_get+0x18e/0xd20 [ 170.107367][ T8886] ip_set_sockfn_get+0x18e/0xd20 [ 170.107383][ T8886] ? __pfx_ip_set_sockfn_get+0x10/0x10 [ 170.107399][ T8886] ? nf_sockopt_find.isra.0+0x222/0x290 [ 170.107412][ T8886] nf_getsockopt+0x7c/0xe0 [ 170.107425][ T8886] ip_getsockopt+0x192/0x1e0 [ 170.107446][ T8886] ? __pfx_ip_getsockopt+0x10/0x10 [ 170.107465][ T8886] raw_getsockopt+0x4d/0x1f0 [ 170.107488][ T8886] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 170.107507][ T8886] do_sock_getsockopt+0x50a/0x6e0 [ 170.107525][ T8886] ? __lock_acquire+0x4c5/0x1ec0 [ 170.107537][ T8886] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 170.107557][ T8886] ? find_held_lock+0x2b/0x80 [ 170.107575][ T8886] ? __fget_files+0x21f/0x3d0 [ 170.107596][ T8886] __sys_getsockopt+0x133/0x1d0 [ 170.107612][ T8886] ? __ia32_sys_getsockopt+0xbc/0x160 [ 170.107624][ T8886] __ia32_sys_getsockopt+0xbc/0x160 [ 170.107637][ T8886] ? __do_fast_syscall_32+0xb3/0x8b0 [ 170.107650][ T8886] ? lockdep_hardirqs_on+0x7d/0x110 [ 170.107662][ T8886] __do_fast_syscall_32+0x13a/0x8b0 [ 170.107674][ T8886] ? lockdep_hardirqs_on+0x7d/0x110 [ 170.107690][ T8886] do_fast_syscall_32+0x32/0x70 [ 170.107707][ T8886] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 170.107727][ T8886] RIP: 0023:0xf6fcefec [ 170.107741][ T8886] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 170.107760][ T8886] RSP: 002b:00000000f53bd50c EFLAGS: 00000292 ORIG_RAX: 000000000000016d [ 170.107778][ T8886] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000000000 [ 170.107788][ T8886] RDX: 0000000000000053 RSI: 0000000080000000 RDI: 0000000080000080 [ 170.107800][ T8886] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 170.107809][ T8886] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 170.107818][ T8886] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 170.107838][ T8886] [ 170.107855][ T8886] Mem-Info: [ 170.216075][ T8886] active_anon:6786 inactive_anon:527 isolated_anon:0 [ 170.216075][ T8886] active_file:6765 inactive_file:36965 isolated_file:0 [ 170.216075][ T8886] unevictable:1000 dirty:309 writeback:25 [ 170.216075][ T8886] slab_reclaimable:7548 slab_unreclaimable:54034 [ 170.216075][ T8886] mapped:24194 shmem:1480 pagetables:1225 [ 170.216075][ T8886] sec_pagetables:308 bounce:0 [ 170.216075][ T8886] kernel_misc_reclaimable:0 [ 170.216075][ T8886] free:33110 free_pcp:14489 free_cma:0 [ 170.231080][ T8886] Node 0 active_anon:12kB inactive_anon:104kB active_file:12kB inactive_file:4kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:32kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8480kB pagetables:1692kB sec_pagetables:1136kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 170.241679][ T8886] Node 1 active_anon:27132kB inactive_anon:2004kB active_file:27048kB inactive_file:147856kB unevictable:4000kB isolated(anon):0kB isolated(file):0kB mapped:96744kB dirty:1232kB writeback:100kB shmem:5920kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:2048kB kernel_stack:5340kB pagetables:3208kB sec_pagetables:96kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 170.252867][ T8886] Node 0 DMA free:1988kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:8kB active_file:4kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:768kB local_pcp:196kB free_cma:0kB [ 170.263225][ T8886] lowmem_reserve[]: 0 279 279 279 279 [ 170.265250][ T8886] Node 0 DMA32 free:13656kB boost:0kB min:12656kB low:15820kB high:18984kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12kB inactive_anon:96kB active_file:8kB inactive_file:4kB unevictable:0kB writepending:4kB zspages:0kB present:1032196kB managed:286432kB mlocked:0kB bounce:0kB free_pcp:13900kB local_pcp:3464kB free_cma:0kB [ 170.266829][ T5748] Bluetooth: hci0: command 0x0406 tx timeout [ 170.275535][ T5749] Bluetooth: hci1: command 0x0406 tx timeout [ 170.291242][ T8886] lowmem_reserve[]: 0 0 0 0 0 [ 170.292799][ T8886] Node 1 DMA32 free:116796kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:27052kB inactive_anon:2004kB active_file:27048kB inactive_file:147864kB unevictable:4000kB writepending:1112kB zspages:2976kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:43508kB local_pcp:12644kB free_cma:0kB [ 170.303841][ T8886] lowmem_reserve[]: 0 0 0 0 0 [ 170.309825][ T8886] Node 0 DMA: 9*4kB (UM) 4*8kB (UM) 4*16kB (UM) 12*32kB (UM) 3*64kB (UM) 4*128kB (UM) 1*256kB (M) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 1988kB [ 170.314907][ T8886] Node 0 DMA32: 104*4kB (UME) 87*8kB (UME) 62*16kB (UME) 47*32kB (E) 23*64kB (UME) 19*128kB (UME) 6*256kB (UM) 5*512kB (M) 2*1024kB (M) 0*2048kB 0*4096kB = 13656kB [ 170.327429][ T8886] Node 1 DMA32: 131*4kB (UM) 365*8kB (UM) 201*16kB (UME) 130*32kB (UME) 103*64kB (UME) 106*128kB (UME) 79*256kB (UME) 30*512kB (UME) 19*1024kB (UM) 3*2048kB (M) 6*4096kB (UM) = 116740kB [ 170.334797][ T8886] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 170.338817][ T8886] Node 0 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 170.341764][ T8886] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 170.344801][ T8886] Node 1 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 170.347916][ T8886] 46202 total pagecache pages [ 170.349428][ T8886] 977 pages in swap cache [ 170.350854][ T8886] Free swap = 116732kB [ 170.352171][ T8886] Total swap = 124996kB [ 170.353492][ T8886] 524155 pages RAM [ 170.354669][ T8886] 0 pages HighMem/MovableOnly [ 170.356362][ T8886] 211654 pages reserved [ 170.357871][ T8886] 0 pages cma reserved [ 170.930593][ T8902] netlink: 'syz.3.955': attribute type 1 has an invalid length. [ 170.958474][ T8902] bond2: entered promiscuous mode [ 170.960460][ T8902] 8021q: adding VLAN 0 to HW filter on device bond2 [ 171.281595][ T8914] netlink: 'syz.0.957': attribute type 4 has an invalid length. [ 171.466343][ T8925] faux_driver vgem: [drm] Unknown color mode 6; guessing buffer size. [ 171.856779][ T13] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 171.860757][ T13] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 171.865965][ T13] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 171.868858][ T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 171.872402][ T13] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 171.875166][ T13] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 171.878143][ T13] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 171.882581][ T13] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 171.899997][ T43] audit: type=1800 audit(1787143350.851:861): pid=8915 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.957" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 171.981165][ T8921] netlink: 'syz.3.960': attribute type 4 has an invalid length. [ 172.092189][ T43] audit: type=1800 audit(1787143351.041:862): pid=8926 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.960" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 172.118527][ T8928] syz.2.963 (8928): drop_caches: 2 [ 172.373981][ T8947] netlink: 24 bytes leftover after parsing attributes in process `syz.3.967'. [ 173.287388][ T8964] FAULT_INJECTION: forcing a failure. [ 173.287388][ T8964] name failslab, interval 1, probability 0, space 0, times 1 [ 173.299505][ T8964] CPU: 3 UID: 0 PID: 8964 Comm: syz.1.972 Not tainted syzkaller #0 PREEMPT(full) [ 173.299524][ T8964] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 173.299531][ T8964] Call Trace: [ 173.299535][ T8964] [ 173.299540][ T8964] dump_stack_lvl+0x100/0x190 [ 173.299559][ T8964] should_fail_ex.cold+0x5/0xa [ 173.299572][ T8964] should_failslab+0xc2/0x120 [ 173.299612][ T8964] __kmalloc_noprof+0xfc/0x820 [ 173.299630][ T8964] ? rcu_is_watching+0x13/0xc0 [ 173.299645][ T8964] ? tomoyo_realpath_from_path+0xb6/0x690 [ 173.299673][ T8964] tomoyo_realpath_from_path+0xb6/0x690 [ 173.299693][ T8964] tomoyo_path_number_perm+0x23c/0x580 [ 173.299707][ T8964] ? tomoyo_path_number_perm+0x22e/0x580 [ 173.299722][ T8964] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 173.299737][ T8964] ? get_pid_task+0x106/0x250 [ 173.299770][ T8964] ? find_held_lock+0x2b/0x80 [ 173.299785][ T8964] ? __fget_files+0x215/0x3d0 [ 173.299798][ T8964] ? hook_file_ioctl_common+0x140/0x440 [ 173.299812][ T8964] ? __fget_files+0x215/0x3d0 [ 173.299827][ T8964] ? __fget_files+0x21f/0x3d0 [ 173.299841][ T8964] security_file_ioctl_compat+0xd3/0x230 [ 173.299857][ T8964] __ia32_compat_sys_ioctl+0xc2/0x360 [ 173.299872][ T8964] __do_fast_syscall_32+0x13a/0x8b0 [ 173.299885][ T8964] ? lockdep_hardirqs_on+0x7d/0x110 [ 173.299897][ T8964] do_fast_syscall_32+0x32/0x70 [ 173.299909][ T8964] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 173.299923][ T8964] RIP: 0023:0xf6fcefec [ 173.299938][ T8964] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 173.299943][ T8964] RSP: 002b:00000000f539c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 173.299954][ T8964] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000001276 [ 173.299961][ T8964] RDX: 0000000000003800 RSI: 0000000000000000 RDI: 0000000000000000 [ 173.299967][ T8964] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 173.299973][ T8964] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 173.299979][ T8964] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 173.299992][ T8964] [ 173.300175][ T8964] ERROR: Out of memory at tomoyo_realpath_from_path. [ 173.570546][ T8966] netlink: 'syz.3.973': attribute type 4 has an invalid length. [ 173.913236][ T8984] netlink: 'syz.1.980': attribute type 4 has an invalid length. [ 174.128330][ T43] audit: type=1800 audit(1787143353.081:863): pid=8963 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.973" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 174.467577][ T43] audit: type=1800 audit(1787143353.421:864): pid=8981 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.980" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 174.737413][ T9005] FAULT_INJECTION: forcing a failure. [ 174.737413][ T9005] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 174.742237][ T9005] CPU: 0 UID: 0 PID: 9005 Comm: syz.1.989 Not tainted syzkaller #0 PREEMPT(full) [ 174.742253][ T9005] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.742260][ T9005] Call Trace: [ 174.742264][ T9005] [ 174.742269][ T9005] dump_stack_lvl+0x100/0x190 [ 174.742287][ T9005] should_fail_ex.cold+0x5/0xa [ 174.742300][ T9005] _copy_to_user+0x32/0xd0 [ 174.742328][ T9005] simple_read_from_buffer+0xcb/0x170 [ 174.742343][ T9005] proc_fail_nth_read+0x1af/0x230 [ 174.742361][ T9005] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 174.742373][ T9005] ? rw_verify_area+0xce/0x6d0 [ 174.742384][ T9005] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 174.742396][ T9005] vfs_read+0x1e4/0xb40 [ 174.742410][ T9005] ? __pfx_vfs_read+0x10/0x10 [ 174.742421][ T9005] ? find_held_lock+0x2b/0x80 [ 174.742436][ T9005] ? __fget_files+0x215/0x3d0 [ 174.742451][ T9005] ? __fget_files+0x21f/0x3d0 [ 174.742467][ T9005] ksys_read+0x12a/0x250 [ 174.742479][ T9005] ? __pfx_ksys_read+0x10/0x10 [ 174.742495][ T9005] do_int80_emulation+0x166/0x650 [ 174.742510][ T9005] asm_int80_emulation+0x1a/0x20 [ 174.742521][ T9005] RIP: 0023:0xf71074eb [ 174.742531][ T9005] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 174.742542][ T9005] RSP: 002b:00000000f53bd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 174.742553][ T9005] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53bd5d0 [ 174.742572][ T9005] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 174.742578][ T9005] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 174.742584][ T9005] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 174.742590][ T9005] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.742604][ T9005] [ 174.891792][ T9009] netlink: 20 bytes leftover after parsing attributes in process `syz.1.991'. [ 175.185928][ T43] audit: type=1800 audit(1787143354.131:865): pid=9020 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.995" name="start_block" dev="configfs" ino=40087 res=0 errno=0 [ 175.270116][ T9013] netlink: 'syz.1.992': attribute type 4 has an invalid length. [ 175.277317][ T43] audit: type=1800 audit(1787143354.231:866): pid=9024 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.997" name="start_block" dev="configfs" ino=39564 res=0 errno=0 [ 175.579310][ T9039] FAULT_INJECTION: forcing a failure. [ 175.579310][ T9039] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 175.583500][ T9039] CPU: 0 UID: 0 PID: 9039 Comm: syz.0.1004 Not tainted syzkaller #0 PREEMPT(full) [ 175.583516][ T9039] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 175.583523][ T9039] Call Trace: [ 175.583528][ T9039] [ 175.583532][ T9039] dump_stack_lvl+0x100/0x190 [ 175.583550][ T9039] should_fail_ex.cold+0x5/0xa [ 175.583563][ T9039] _copy_from_user+0x2e/0xd0 [ 175.583590][ T9039] get_compat_msghdr+0xb3/0x480 [ 175.583608][ T9039] ? __pfx_get_compat_msghdr+0x10/0x10 [ 175.583628][ T9039] ___sys_sendmsg+0x1b6/0x1e0 [ 175.583648][ T9039] ? __pfx____sys_sendmsg+0x10/0x10 [ 175.583671][ T9039] ? find_held_lock+0x2b/0x80 [ 175.583695][ T9039] __sys_sendmsg+0x160/0x210 [ 175.583709][ T9039] ? __pfx___sys_sendmsg+0x10/0x10 [ 175.583726][ T9039] ? __pfx_ksys_write+0x10/0x10 [ 175.583741][ T9039] __do_fast_syscall_32+0x13a/0x8b0 [ 175.583755][ T9039] ? lockdep_hardirqs_on+0x7d/0x110 [ 175.583768][ T9039] do_fast_syscall_32+0x32/0x70 [ 175.583780][ T9039] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 175.583794][ T9039] RIP: 0023:0xf6ffefec [ 175.583809][ T9039] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 175.583814][ T9039] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 175.583825][ T9039] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 175.583832][ T9039] RDX: 000000000400c804 RSI: 0000000000000000 RDI: 0000000000000000 [ 175.583838][ T9039] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 175.583844][ T9039] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 175.583850][ T9039] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 175.583863][ T9039] [ 175.784064][ T43] audit: type=1800 audit(1787143354.731:867): pid=9014 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.992" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 175.895099][ T9054] lo speed is unknown, defaulting to 1000 [ 175.898892][ T9054] lo speed is unknown, defaulting to 1000 [ 175.911172][ T9054] lo speed is unknown, defaulting to 1000 [ 175.919667][ T9054] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 175.924239][ T9054] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 175.929993][ T9054] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 176.016707][ T9054] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 176.200444][ T9054] lo speed is unknown, defaulting to 1000 [ 176.252831][ T9054] lo speed is unknown, defaulting to 1000 [ 176.282681][ T9054] lo speed is unknown, defaulting to 1000 [ 176.307424][ T9054] lo speed is unknown, defaulting to 1000 [ 176.759417][ T9062] FAULT_INJECTION: forcing a failure. [ 176.759417][ T9062] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 176.764029][ T9062] CPU: 0 UID: 0 PID: 9062 Comm: syz.2.1013 Not tainted syzkaller #0 PREEMPT(full) [ 176.764046][ T9062] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 176.764053][ T9062] Call Trace: [ 176.764058][ T9062] [ 176.764063][ T9062] dump_stack_lvl+0x100/0x190 [ 176.764095][ T9062] should_fail_ex.cold+0x5/0xa [ 176.764108][ T9062] _copy_from_user+0x2e/0xd0 [ 176.764121][ T9062] io_sync_cancel+0x16e/0x6d0 [ 176.764137][ T9062] ? trace_contention_end+0x126/0x160 [ 176.764150][ T9062] ? __pfx_io_sync_cancel+0x10/0x10 [ 176.764165][ T9062] ? __do_sys_io_uring_register+0x135/0x1bc0 [ 176.764184][ T9062] ? __pfx___mutex_lock+0x10/0x10 [ 176.764203][ T9062] ? __pfx_autoremove_wake_function+0x10/0x10 [ 176.764238][ T9062] __do_sys_io_uring_register+0x1419/0x1bc0 [ 176.764258][ T9062] ? __pfx___do_sys_io_uring_register+0x10/0x10 [ 176.764274][ T9062] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 176.764286][ T9062] ? __fget_files+0x21f/0x3d0 [ 176.764302][ T9062] ? fput+0x7c/0x100 [ 176.764317][ T9062] ? ksys_write+0x1ac/0x250 [ 176.764328][ T9062] ? __pfx_ksys_write+0x10/0x10 [ 176.764343][ T9062] __do_fast_syscall_32+0x13a/0x8b0 [ 176.764356][ T9062] ? lockdep_hardirqs_on+0x7d/0x110 [ 176.764367][ T9062] do_fast_syscall_32+0x32/0x70 [ 176.764379][ T9062] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 176.764394][ T9062] RIP: 0023:0xf7fb4fec [ 176.764408][ T9062] Code: Unable to access opcode bytes at 0xf7fb4fc2. [ 176.764413][ T9062] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 00000000000001ab [ 176.764424][ T9062] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000018 [ 176.764431][ T9062] RDX: 0000000080000200 RSI: 0000000000000001 RDI: 0000000000000000 [ 176.764437][ T9062] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 176.764443][ T9062] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 176.764449][ T9062] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 176.764462][ T9062] [ 176.885330][ T9068] gretap0: left promiscuous mode [ 177.810666][ T9078] netlink: 'syz.0.1018': attribute type 1 has an invalid length. [ 177.865296][ T9083] FAULT_INJECTION: forcing a failure. [ 177.865296][ T9083] name failslab, interval 1, probability 0, space 0, times 0 [ 177.872338][ T9083] CPU: 1 UID: 0 PID: 9083 Comm: syz.0.1020 Not tainted syzkaller #0 PREEMPT(full) [ 177.872354][ T9083] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 177.872361][ T9083] Call Trace: [ 177.872364][ T9083] [ 177.872369][ T9083] dump_stack_lvl+0x100/0x190 [ 177.872388][ T9083] should_fail_ex.cold+0x5/0xa [ 177.872401][ T9083] should_failslab+0xc2/0x120 [ 177.872419][ T9083] __kmalloc_noprof+0xfc/0x820 [ 177.872434][ T9083] ? rcu_is_watching+0x13/0xc0 [ 177.872449][ T9083] ? tomoyo_realpath_from_path+0xb6/0x690 [ 177.872470][ T9083] tomoyo_realpath_from_path+0xb6/0x690 [ 177.872489][ T9083] tomoyo_path_number_perm+0x23c/0x580 [ 177.872503][ T9083] ? tomoyo_path_number_perm+0x22e/0x580 [ 177.872518][ T9083] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 177.872533][ T9083] ? get_pid_task+0x106/0x250 [ 177.872560][ T9083] ? find_held_lock+0x2b/0x80 [ 177.872575][ T9083] ? __fget_files+0x215/0x3d0 [ 177.872587][ T9083] ? hook_file_ioctl_common+0x140/0x440 [ 177.872602][ T9083] ? __fget_files+0x215/0x3d0 [ 177.872617][ T9083] ? __fget_files+0x21f/0x3d0 [ 177.872631][ T9083] security_file_ioctl_compat+0xd3/0x230 [ 177.872647][ T9083] __ia32_compat_sys_ioctl+0xc2/0x360 [ 177.872661][ T9083] __do_fast_syscall_32+0x13a/0x8b0 [ 177.872675][ T9083] ? lockdep_hardirqs_on+0x7d/0x110 [ 177.872687][ T9083] do_fast_syscall_32+0x32/0x70 [ 177.872699][ T9083] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 177.872713][ T9083] RIP: 0023:0xf6ffefec [ 177.872727][ T9083] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 177.872731][ T9083] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 177.872743][ T9083] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000004014563c [ 177.872749][ T9083] RDX: 00000000800000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 177.872755][ T9083] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 177.872761][ T9083] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 177.872767][ T9083] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 177.872780][ T9083] [ 177.872785][ T9083] ERROR: Out of memory at tomoyo_realpath_from_path. [ 178.424810][ T9101] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1027'. [ 178.609127][ T9090] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 179.048935][ T9103] FAULT_INJECTION: forcing a failure. [ 179.048935][ T9103] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 179.053185][ T9103] CPU: 3 UID: 0 PID: 9103 Comm: syz.3.1029 Not tainted syzkaller #0 PREEMPT(full) [ 179.053200][ T9103] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 179.053207][ T9103] Call Trace: [ 179.053223][ T9103] [ 179.053229][ T9103] dump_stack_lvl+0x100/0x190 [ 179.053251][ T9103] should_fail_ex.cold+0x5/0xa [ 179.053264][ T9103] _copy_from_user+0x2e/0xd0 [ 179.053278][ T9103] get_compat_msghdr+0xb3/0x480 [ 179.053295][ T9103] ? __pfx_get_compat_msghdr+0x10/0x10 [ 179.053315][ T9103] ___sys_sendmsg+0x1b6/0x1e0 [ 179.053334][ T9103] ? __pfx____sys_sendmsg+0x10/0x10 [ 179.053357][ T9103] ? find_held_lock+0x2b/0x80 [ 179.053380][ T9103] __sys_sendmsg+0x160/0x210 [ 179.053394][ T9103] ? __pfx___sys_sendmsg+0x10/0x10 [ 179.053411][ T9103] ? __pfx_ksys_write+0x10/0x10 [ 179.053426][ T9103] __do_fast_syscall_32+0x13a/0x8b0 [ 179.053439][ T9103] ? lockdep_hardirqs_on+0x7d/0x110 [ 179.053451][ T9103] do_fast_syscall_32+0x32/0x70 [ 179.053463][ T9103] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 179.053477][ T9103] RIP: 0023:0xf7f47fec [ 179.053492][ T9103] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 179.053496][ T9103] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 179.053507][ T9103] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 179.053514][ T9103] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 179.053520][ T9103] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 179.053526][ T9103] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 179.053532][ T9103] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 179.053545][ T9103] [ 179.504750][ T81] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 179.507498][ T81] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 179.547770][ T9107] raw_sendmsg: syz.0.1031 forgot to set AF_INET. Fix it! [ 179.641401][ T9112] FAULT_INJECTION: forcing a failure. [ 179.641401][ T9112] name failslab, interval 1, probability 0, space 0, times 0 [ 179.645413][ T9112] CPU: 1 UID: 0 PID: 9112 Comm: syz.1.1032 Not tainted syzkaller #0 PREEMPT(full) [ 179.645428][ T9112] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 179.645435][ T9112] Call Trace: [ 179.645439][ T9112] [ 179.645444][ T9112] dump_stack_lvl+0x100/0x190 [ 179.645462][ T9112] should_fail_ex.cold+0x5/0xa [ 179.645474][ T9112] should_failslab+0xc2/0x120 [ 179.645492][ T9112] __kmalloc_noprof+0xfc/0x820 [ 179.645507][ T9112] ? rcu_is_watching+0x13/0xc0 [ 179.645522][ T9112] ? tomoyo_realpath_from_path+0xb6/0x690 [ 179.645542][ T9112] tomoyo_realpath_from_path+0xb6/0x690 [ 179.645562][ T9112] tomoyo_path_number_perm+0x23c/0x580 [ 179.645576][ T9112] ? tomoyo_path_number_perm+0x22e/0x580 [ 179.645591][ T9112] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 179.645606][ T9112] ? get_pid_task+0x106/0x250 [ 179.645632][ T9112] ? find_held_lock+0x2b/0x80 [ 179.645647][ T9112] ? __fget_files+0x215/0x3d0 [ 179.645660][ T9112] ? hook_file_ioctl_common+0x140/0x440 [ 179.645674][ T9112] ? __fget_files+0x215/0x3d0 [ 179.645689][ T9112] ? __fget_files+0x21f/0x3d0 [ 179.645703][ T9112] security_file_ioctl_compat+0xd3/0x230 [ 179.645719][ T9112] __ia32_compat_sys_ioctl+0xc2/0x360 [ 179.645733][ T9112] __do_fast_syscall_32+0x13a/0x8b0 [ 179.645746][ T9112] ? lockdep_hardirqs_on+0x7d/0x110 [ 179.645758][ T9112] do_fast_syscall_32+0x32/0x70 [ 179.645770][ T9112] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 179.645785][ T9112] RIP: 0023:0xf6fcefec [ 179.645799][ T9112] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 179.645804][ T9112] RSP: 002b:00000000f53bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 179.645815][ T9112] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000000ae80 [ 179.645821][ T9112] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 179.645827][ T9112] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 179.645833][ T9112] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 179.645839][ T9112] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 179.645852][ T9112] [ 179.645856][ T9112] ERROR: Out of memory at tomoyo_realpath_from_path. [ 180.039702][ T9137] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 180.096822][ T9129] nbd0: detected capacity change from 0 to 63 [ 180.962479][ T9154] FAULT_INJECTION: forcing a failure. [ 180.962479][ T9154] name failslab, interval 1, probability 0, space 0, times 0 [ 180.968733][ T9154] CPU: 1 UID: 0 PID: 9154 Comm: syz.3.1047 Not tainted syzkaller #0 PREEMPT(full) [ 180.968752][ T9154] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 180.968760][ T9154] Call Trace: [ 180.968765][ T9154] [ 180.968770][ T9154] dump_stack_lvl+0x100/0x190 [ 180.968788][ T9154] should_fail_ex.cold+0x5/0xa [ 180.968801][ T9154] should_failslab+0xc2/0x120 [ 180.968819][ T9154] __kmalloc_noprof+0xfc/0x820 [ 180.968835][ T9154] ? rcu_is_watching+0x13/0xc0 [ 180.968850][ T9154] ? tomoyo_realpath_from_path+0xb6/0x690 [ 180.968870][ T9154] tomoyo_realpath_from_path+0xb6/0x690 [ 180.968890][ T9154] tomoyo_path_number_perm+0x23c/0x580 [ 180.968904][ T9154] ? tomoyo_path_number_perm+0x22e/0x580 [ 180.968919][ T9154] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 180.968934][ T9154] ? get_pid_task+0x106/0x250 [ 180.968982][ T9154] ? find_held_lock+0x2b/0x80 [ 180.968999][ T9154] ? __fget_files+0x215/0x3d0 [ 180.969012][ T9154] ? hook_file_ioctl_common+0x140/0x440 [ 180.969027][ T9154] ? __fget_files+0x215/0x3d0 [ 180.969042][ T9154] ? __fget_files+0x21f/0x3d0 [ 180.969057][ T9154] security_file_ioctl_compat+0xd3/0x230 [ 180.969073][ T9154] __ia32_compat_sys_ioctl+0xc2/0x360 [ 180.969087][ T9154] __do_fast_syscall_32+0x13a/0x8b0 [ 180.969101][ T9154] ? lockdep_hardirqs_on+0x7d/0x110 [ 180.969113][ T9154] do_fast_syscall_32+0x32/0x70 [ 180.969129][ T9154] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 180.969144][ T9154] RIP: 0023:0xf7f47fec [ 180.969160][ T9154] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 180.969164][ T9154] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 180.969176][ T9154] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 180.969182][ T9154] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 180.969188][ T9154] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 180.969195][ T9154] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 180.969201][ T9154] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 180.969214][ T9154] [ 180.971500][ T9154] ERROR: Out of memory at tomoyo_realpath_from_path. [ 181.677495][ T65] block nbd0: Receive control failed (result -104) [ 181.893911][ T9162] sch_tbf: burst 1023 is lower than device lo mtu (65550) ! [ 182.174989][ T9166] FAULT_INJECTION: forcing a failure. [ 182.174989][ T9166] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 182.179641][ T9166] CPU: 1 UID: 0 PID: 9166 Comm: syz.2.1051 Not tainted syzkaller #0 PREEMPT(full) [ 182.179659][ T9166] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 182.179666][ T9166] Call Trace: [ 182.179671][ T9166] [ 182.179676][ T9166] dump_stack_lvl+0x100/0x190 [ 182.179694][ T9166] should_fail_ex.cold+0x5/0xa [ 182.179708][ T9166] _copy_from_user+0x2e/0xd0 [ 182.179723][ T9166] get_compat_msghdr+0xb3/0x480 [ 182.179741][ T9166] ? __pfx_get_compat_msghdr+0x10/0x10 [ 182.179762][ T9166] ___sys_sendmsg+0x1b6/0x1e0 [ 182.179782][ T9166] ? __pfx____sys_sendmsg+0x10/0x10 [ 182.179806][ T9166] ? find_held_lock+0x2b/0x80 [ 182.179829][ T9166] __sys_sendmsg+0x160/0x210 [ 182.179842][ T9166] ? __pfx___sys_sendmsg+0x10/0x10 [ 182.179859][ T9166] ? __pfx_ksys_write+0x10/0x10 [ 182.179875][ T9166] __do_fast_syscall_32+0x13a/0x8b0 [ 182.179888][ T9166] ? lockdep_hardirqs_on+0x7d/0x110 [ 182.179900][ T9166] do_fast_syscall_32+0x32/0x70 [ 182.179912][ T9166] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 182.179927][ T9166] RIP: 0023:0xf7fb4fec [ 182.179941][ T9166] Code: Unable to access opcode bytes at 0xf7fb4fc2. [ 182.179946][ T9166] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 182.179957][ T9166] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300 [ 182.179964][ T9166] RDX: 0000000020000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 182.179970][ T9166] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 182.179977][ T9166] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 182.179983][ T9166] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 182.179996][ T9166] [ 182.311585][ T9175] netlink: 'syz.2.1052': attribute type 1 has an invalid length. [ 182.314644][ T9175] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1052'. [ 182.648321][ T1159] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 182.656039][ T9185] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 182.666370][ T9189] input: syz1 as /devices/virtual/input/input8 [ 182.790028][ T9194] input: syz1 as /devices/virtual/input/input9 [ 182.818102][ T9194] FAULT_INJECTION: forcing a failure. [ 182.818102][ T9194] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 182.822431][ T9194] CPU: 0 UID: 0 PID: 9194 Comm: syz.3.1061 Not tainted syzkaller #0 PREEMPT(full) [ 182.822446][ T9194] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 182.822454][ T9194] Call Trace: [ 182.822458][ T9194] [ 182.822463][ T9194] dump_stack_lvl+0x100/0x190 [ 182.822493][ T9194] should_fail_ex.cold+0x5/0xa [ 182.822507][ T9194] _copy_from_user+0x2e/0xd0 [ 182.822521][ T9194] input_event_from_user+0x137/0x290 [ 182.822579][ T9194] ? __pfx_input_event_from_user+0x10/0x10 [ 182.822599][ T9194] uinput_write+0xb9f/0xf60 [ 182.822626][ T9194] ? __pfx_uinput_write+0x10/0x10 [ 182.822644][ T9194] ? bpf_lsm_file_permission+0x9/0x10 [ 182.822664][ T9194] ? security_file_permission+0x76/0x210 [ 182.822685][ T9194] ? rw_verify_area+0xce/0x6d0 [ 182.822697][ T9194] vfs_write+0x2aa/0x1050 [ 182.822709][ T9194] ? __pfx_uinput_write+0x10/0x10 [ 182.822726][ T9194] ? __pfx_vfs_write+0x10/0x10 [ 182.822737][ T9194] ? find_held_lock+0x2b/0x80 [ 182.822752][ T9194] ? __fget_files+0x215/0x3d0 [ 182.822764][ T9194] ? __fget_files+0x215/0x3d0 [ 182.822779][ T9194] ? __fget_files+0x21f/0x3d0 [ 182.822794][ T9194] ksys_write+0x1f8/0x250 [ 182.822806][ T9194] ? __pfx_ksys_write+0x10/0x10 [ 182.822817][ T9194] ? ksys_write+0x1ac/0x250 [ 182.822829][ T9194] ? __pfx_ksys_write+0x10/0x10 [ 182.822843][ T9194] __do_fast_syscall_32+0x13a/0x8b0 [ 182.822857][ T9194] ? lockdep_hardirqs_on+0x7d/0x110 [ 182.822869][ T9194] do_fast_syscall_32+0x32/0x70 [ 182.822881][ T9194] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 182.822895][ T9194] RIP: 0023:0xf7f47fec [ 182.822910][ T9194] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 182.822915][ T9194] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 182.822926][ T9194] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000a40 [ 182.822932][ T9194] RDX: 000000000000045c RSI: 0000000000000000 RDI: 0000000000000000 [ 182.822938][ T9194] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 182.822944][ T9194] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 182.822950][ T9194] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 182.822963][ T9194] [ 182.942172][ T9198] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 183.306438][ T9214] capability: warning: `syz.0.1069' uses deprecated v2 capabilities in a way that may be insecure [ 183.311204][ T9214] overlayfs: failed to create directory ./file0/work (errno: 13); mounting read-only [ 183.314316][ T9214] overlayfs: fs on '.' does not support file handles, falling back to index=off,nfs_export=off. [ 183.317844][ T9214] overlayfs: failed to get uuid (265/file2, err=-13); falling back to uuid=null. [ 183.352692][ T9216] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1070'. [ 183.357334][ T9216] FAULT_INJECTION: forcing a failure. [ 183.357334][ T9216] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 183.361214][ T9216] CPU: 1 UID: 0 PID: 9216 Comm: syz.0.1070 Not tainted syzkaller #0 PREEMPT(full) [ 183.361230][ T9216] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 183.361237][ T9216] Call Trace: [ 183.361242][ T9216] [ 183.361247][ T9216] dump_stack_lvl+0x100/0x190 [ 183.361264][ T9216] should_fail_ex.cold+0x5/0xa [ 183.361277][ T9216] _copy_from_user+0x2e/0xd0 [ 183.361290][ T9216] pppol2tp_setsockopt+0x221/0x510 [ 183.361333][ T9216] ? __pfx_pppol2tp_setsockopt+0x10/0x10 [ 183.361350][ T9216] ? aa_sock_opt_perm+0xff/0x1b0 [ 183.361363][ T9216] ? __pfx_pppol2tp_setsockopt+0x10/0x10 [ 183.361380][ T9216] do_sock_setsockopt+0xf3/0x1d0 [ 183.361399][ T9216] __sys_setsockopt+0x119/0x190 [ 183.361414][ T9216] __ia32_sys_setsockopt+0xbc/0x160 [ 183.361427][ T9216] ? __do_fast_syscall_32+0xb3/0x8b0 [ 183.361439][ T9216] ? lockdep_hardirqs_on+0x7d/0x110 [ 183.361450][ T9216] __do_fast_syscall_32+0x13a/0x8b0 [ 183.361462][ T9216] ? lockdep_hardirqs_on+0x7d/0x110 [ 183.361473][ T9216] do_fast_syscall_32+0x32/0x70 [ 183.361485][ T9216] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 183.361500][ T9216] RIP: 0023:0xf6ffefec [ 183.361514][ T9216] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 183.361519][ T9216] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 183.361530][ T9216] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000000111 [ 183.361537][ T9216] RDX: 0000000000000005 RSI: 0000000080000000 RDI: 0000000000000004 [ 183.361543][ T9216] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 183.361549][ T9216] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 183.361555][ T9216] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 183.361567][ T9216] [ 183.429619][ T9218] team0: Port device dummy0 removed [ 183.432269][ T9218] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 183.554491][ T9223] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 184.487417][ T9247] FAULT_INJECTION: forcing a failure. [ 184.487417][ T9247] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 184.492466][ T9247] CPU: 3 UID: 0 PID: 9247 Comm: syz.0.1080 Not tainted syzkaller #0 PREEMPT(full) [ 184.492482][ T9247] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 184.492495][ T9247] Call Trace: [ 184.492516][ T9247] [ 184.492522][ T9247] dump_stack_lvl+0x100/0x190 [ 184.492597][ T9247] should_fail_ex.cold+0x5/0xa [ 184.492617][ T9247] _copy_from_user+0x2e/0xd0 [ 184.492640][ T9247] io_sync_cancel+0x16e/0x6d0 [ 184.492655][ T9247] ? trace_contention_end+0x126/0x160 [ 184.492680][ T9247] ? __pfx_io_sync_cancel+0x10/0x10 [ 184.492693][ T9247] ? __do_sys_io_uring_register+0x135/0x1bc0 [ 184.492713][ T9247] ? __pfx___mutex_lock+0x10/0x10 [ 184.492773][ T9247] ? __pfx_autoremove_wake_function+0x10/0x10 [ 184.492804][ T9247] __do_sys_io_uring_register+0x1419/0x1bc0 [ 184.492824][ T9247] ? __pfx___do_sys_io_uring_register+0x10/0x10 [ 184.492840][ T9247] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 184.492852][ T9247] ? __fget_files+0x21f/0x3d0 [ 184.492873][ T9247] ? fput+0x7c/0x100 [ 184.492898][ T9247] ? ksys_write+0x1ac/0x250 [ 184.492910][ T9247] ? __pfx_ksys_write+0x10/0x10 [ 184.492924][ T9247] __do_fast_syscall_32+0x13a/0x8b0 [ 184.492960][ T9247] ? lockdep_hardirqs_on+0x7d/0x110 [ 184.492975][ T9247] do_fast_syscall_32+0x32/0x70 [ 184.492987][ T9247] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 184.493001][ T9247] RIP: 0023:0xf6ffefec [ 184.493021][ T9247] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 184.493035][ T9247] RSP: 002b:00000000f53cc50c EFLAGS: 00000292 ORIG_RAX: 00000000000001ab [ 184.493046][ T9247] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000018 [ 184.493053][ T9247] RDX: 0000000080000080 RSI: 0000000000000001 RDI: 0000000000000000 [ 184.493059][ T9247] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 184.493065][ T9247] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 184.493071][ T9247] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 184.493084][ T9247] [ 184.676017][ T9249] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 185.237810][ T9262] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 185.723601][ T9273] netlink: 'syz.2.1090': attribute type 1 has an invalid length. [ 185.726160][ T9273] netlink: 208 bytes leftover after parsing attributes in process `syz.2.1090'. [ 185.726515][ T9272] FAULT_INJECTION: forcing a failure. [ 185.726515][ T9272] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 185.733090][ T9272] CPU: 2 UID: 0 PID: 9272 Comm: syz.1.1091 Not tainted syzkaller #0 PREEMPT(full) [ 185.733106][ T9272] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 185.733113][ T9272] Call Trace: [ 185.733117][ T9272] [ 185.733122][ T9272] dump_stack_lvl+0x100/0x190 [ 185.733139][ T9272] should_fail_ex.cold+0x5/0xa [ 185.733153][ T9272] _copy_from_user+0x2e/0xd0 [ 185.733170][ T9272] get_compat_msghdr+0xb3/0x480 [ 185.733233][ T9272] ? __pfx_get_compat_msghdr+0x10/0x10 [ 185.733252][ T9272] ___sys_sendmsg+0x1b6/0x1e0 [ 185.733284][ T9272] ? __pfx____sys_sendmsg+0x10/0x10 [ 185.733307][ T9272] ? find_held_lock+0x2b/0x80 [ 185.733330][ T9272] __sys_sendmsg+0x160/0x210 [ 185.733344][ T9272] ? __pfx___sys_sendmsg+0x10/0x10 [ 185.733360][ T9272] ? __pfx_ksys_write+0x10/0x10 [ 185.733375][ T9272] __do_fast_syscall_32+0x13a/0x8b0 [ 185.733389][ T9272] ? lockdep_hardirqs_on+0x7d/0x110 [ 185.733401][ T9272] do_fast_syscall_32+0x32/0x70 [ 185.733413][ T9272] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 185.733428][ T9272] RIP: 0023:0xf6fcefec [ 185.733442][ T9272] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 185.733446][ T9272] RSP: 002b:00000000f53bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 185.733457][ T9272] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080000280 [ 185.733464][ T9272] RDX: 0000000000044840 RSI: 0000000000000000 RDI: 0000000000000000 [ 185.733470][ T9272] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 185.733476][ T9272] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 185.733482][ T9272] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 185.733495][ T9272] [ 185.900243][ T9275] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1092'. [ 186.049894][ T1159] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 186.057350][ T9278] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 186.244070][ T9292] netlink: 'syz.3.1095': attribute type 1 has an invalid length. [ 186.263448][ T9292] netlink: 'syz.3.1095': attribute type 2 has an invalid length. [ 186.506791][ T5737] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 186.651099][ T9303] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1098'. [ 186.653984][ T9302] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1098'. [ 186.699346][ T5737] usb 6-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 186.727862][ T5737] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 186.751462][ T5737] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 186.769550][ T9312] FAULT_INJECTION: forcing a failure. [ 186.769550][ T9312] name failslab, interval 1, probability 0, space 0, times 0 [ 186.771283][ T5737] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 186.780966][ T9312] CPU: 3 UID: 0 PID: 9312 Comm: syz.0.1102 Not tainted syzkaller #0 PREEMPT(full) [ 186.780985][ T9312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 186.780992][ T9312] Call Trace: [ 186.780997][ T9312] [ 186.781002][ T9312] dump_stack_lvl+0x100/0x190 [ 186.781021][ T9312] should_fail_ex.cold+0x5/0xa [ 186.781034][ T9312] should_failslab+0xc2/0x120 [ 186.781070][ T9312] __kmalloc_cache_noprof+0x91/0x6b0 [ 186.781098][ T9312] ? do_raw_spin_lock+0x128/0x260 [ 186.781119][ T9312] ? get_mountpoint+0x174/0x4f0 [ 186.781139][ T9312] get_mountpoint+0x174/0x4f0 [ 186.781156][ T9312] do_lock_mount.part.0+0x336/0xb10 [ 186.781184][ T9312] do_move_mount.isra.0+0x1bb/0xca0 [ 186.781203][ T9312] ? find_held_lock+0x2b/0x80 [ 186.781218][ T9312] ? __fget_files+0x215/0x3d0 [ 186.781233][ T9312] ? __pfx_do_move_mount.isra.0+0x10/0x10 [ 186.781250][ T9312] ? apparmor_move_mount+0x105/0x4d0 [ 186.781276][ T9312] __do_sys_move_mount+0x628/0x780 [ 186.781292][ T9312] ? __pfx___do_sys_move_mount+0x10/0x10 [ 186.781307][ T9312] ? fput+0x7c/0x100 [ 186.781321][ T9312] ? ksys_write+0x1ac/0x250 [ 186.781333][ T9312] ? __pfx_ksys_write+0x10/0x10 [ 186.781348][ T9312] __do_fast_syscall_32+0x13a/0x8b0 [ 186.781361][ T9312] ? lockdep_hardirqs_on+0x7d/0x110 [ 186.781374][ T9312] do_fast_syscall_32+0x32/0x70 [ 186.781386][ T9312] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 186.781400][ T9312] RIP: 0023:0xf6ffefec [ 186.781416][ T9312] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 186.781420][ T9312] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 00000000000001ad [ 186.781433][ T9312] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000 [ 186.781439][ T9312] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000046 [ 186.781445][ T9312] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 186.781451][ T9312] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 186.781457][ T9312] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 186.781470][ T9312] [ 186.809240][ T5737] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 186.889979][ T5737] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.893158][ T5737] usb 6-1: Product: syz [ 186.897625][ T5737] usb 6-1: Manufacturer: syz [ 186.899348][ T5737] usb 6-1: SerialNumber: syz [ 186.972481][ T5737] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 186.977367][ T5819] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 186.997796][ T5737] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 187.019615][ T5737] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 187.092319][ T9322] FAULT_INJECTION: forcing a failure. [ 187.092319][ T9322] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 187.098244][ T9322] CPU: 3 UID: 0 PID: 9322 Comm: syz.0.1107 Not tainted syzkaller #0 PREEMPT(full) [ 187.098268][ T9322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 187.098279][ T9322] Call Trace: [ 187.098285][ T9322] [ 187.098291][ T9322] dump_stack_lvl+0x100/0x190 [ 187.098316][ T9322] should_fail_ex.cold+0x5/0xa [ 187.098336][ T9322] _copy_to_user+0x32/0xd0 [ 187.098358][ T9322] simple_read_from_buffer+0xcb/0x170 [ 187.098379][ T9322] proc_fail_nth_read+0x1af/0x230 [ 187.098396][ T9322] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 187.098416][ T9322] ? rw_verify_area+0xce/0x6d0 [ 187.098433][ T9322] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 187.098452][ T9322] vfs_read+0x1e4/0xb40 [ 187.098473][ T9322] ? __pfx_vfs_read+0x10/0x10 [ 187.098487][ T9322] ? mntput_no_expire+0xe7/0x220 [ 187.098503][ T9322] ? mntput+0x70/0xa0 [ 187.098521][ T9322] ? __do_sys_file_getattr+0x30f/0x530 [ 187.098546][ T9322] ? __pfx___do_sys_file_getattr+0x10/0x10 [ 187.098573][ T9322] ksys_read+0x12a/0x250 [ 187.098592][ T9322] ? __pfx_ksys_read+0x10/0x10 [ 187.098616][ T9322] do_int80_emulation+0x166/0x650 [ 187.098634][ T9322] asm_int80_emulation+0x1a/0x20 [ 187.098651][ T9322] RIP: 0023:0xf71374eb [ 187.098665][ T9322] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 187.098681][ T9322] RSP: 002b:00000000f53ed4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 187.098699][ T9322] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53ed5d0 [ 187.098709][ T9322] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 187.098724][ T9322] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 187.098733][ T9322] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 187.098743][ T9322] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 187.098758][ T9322] [ 187.157771][ T5819] usb 8-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 187.198147][ T5819] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 187.201433][ T5819] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 187.204609][ T5819] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 187.212948][ T5819] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 187.218590][ T5819] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 187.226433][ T5819] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 187.234786][ T5819] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 187.234804][ T5819] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 187.234816][ T5819] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 187.234827][ T5819] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 187.234839][ T5819] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 187.234851][ T5819] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 187.234862][ T5819] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 187.234873][ T5819] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 187.234884][ T5819] usb 8-1: config 1 interface 0 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 14 [ 187.237433][ T5819] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.237447][ T5819] usb 8-1: Product: syz [ 187.237455][ T5819] usb 8-1: Manufacturer: syz [ 187.237462][ T5819] usb 8-1: SerialNumber: syz [ 187.239427][ T9310] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 187.284460][ T9310] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 187.284557][ T9310] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 187.284609][ T9310] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 187.284657][ T9310] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 187.284756][ T9310] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 187.284803][ T9310] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 187.284889][ T9310] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 187.284961][ T9310] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 187.285060][ T9310] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 187.285109][ T9310] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 187.287533][ T5819] keyspan 8-1:1.0: Keyspan 2 port adapter converter detected [ 187.288163][ T5819] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 7 [ 187.290299][ T5819] usb 8-1: Keyspan 2 port adapter converter now attached to ttyUSB2 [ 187.293021][ T5819] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 6 [ 187.293940][ T5819] usb 8-1: Keyspan 2 port adapter converter now attached to ttyUSB3 [ 187.311249][ T9327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 187.325869][ T9327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 187.525043][ T9310] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1101'. [ 187.530237][ T9310] netlink: 'syz.3.1101': attribute type 1 has an invalid length. [ 187.532969][ T9310] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1101'. [ 187.536046][ T9310] netlink: 'syz.3.1101': attribute type 1 has an invalid length. [ 187.540314][ T9310] netlink: 29 bytes leftover after parsing attributes in process `syz.3.1101'. [ 187.548089][ T5819] usb 8-1: USB disconnect, device number 12 [ 187.559621][ T5819] keyspan_2 ttyUSB2: Keyspan 2 port adapter converter now disconnected from ttyUSB2 [ 187.576389][ T5819] keyspan_2 ttyUSB3: Keyspan 2 port adapter converter now disconnected from ttyUSB3 [ 187.582050][ T5819] keyspan 8-1:1.0: device disconnected [ 187.633423][ T43] audit: type=1326 audit(1787143366.581:868): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9334 comm="syz.2.1112" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb4fec code=0x7ffc0000 [ 187.640794][ T43] audit: type=1326 audit(1787143366.581:869): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9334 comm="syz.2.1112" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb4fec code=0x7ffc0000 [ 187.647622][ T43] audit: type=1326 audit(1787143366.581:870): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9334 comm="syz.2.1112" exe="/syz-executor" sig=0 arch=40000003 syscall=77 compat=1 ip=0xf7fb4fec code=0x7ffc0000 [ 187.654412][ T43] audit: type=1326 audit(1787143366.581:871): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9334 comm="syz.2.1112" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb4fec code=0x7ffc0000 [ 187.661376][ T43] audit: type=1326 audit(1787143366.581:872): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9334 comm="syz.2.1112" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb4fec code=0x7ffc0000 [ 187.668270][ T43] audit: type=1326 audit(1787143366.581:873): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9334 comm="syz.2.1112" exe="/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf7fb4fec code=0x7ffc0000 [ 187.675054][ T43] audit: type=1326 audit(1787143366.581:874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9334 comm="syz.2.1112" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb4fec code=0x7ffc0000 [ 187.682108][ T43] audit: type=1326 audit(1787143366.581:875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9334 comm="syz.2.1112" exe="/syz-executor" sig=0 arch=40000003 syscall=361 compat=1 ip=0xf7fb4fec code=0x7ffc0000 [ 187.689116][ T43] audit: type=1326 audit(1787143366.581:876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9334 comm="syz.2.1112" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb4fec code=0x7ffc0000 [ 187.695741][ T43] audit: type=1326 audit(1787143366.581:877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9334 comm="syz.2.1112" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb4fec code=0x7ffc0000 [ 188.182223][ T9345] No control pipe specified [ 188.292899][ T9347] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 188.395589][ T9352] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 189.420027][ T1484] usb 6-1: USB disconnect, device number 4 [ 189.430586][ T9293] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 189.437075][ T1484] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 189.444739][ T1484] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 189.448438][ T1484] ti_usb_3410_5052 6-1:2.0: device disconnected [ 189.883382][ T9386] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 189.908904][ T9388] openvswitch: netlink: Missing key (keys=40, expected=100) [ 190.093188][ T9392] binder: 9391:9392 ioctl 4018620d 0 returned -22 [ 190.097997][ T9392] binder: 9391:9392 ioctl c0306201 80000040 returned -22 [ 190.101497][ T9392] binder: 9391:9392 ioctl c0306201 80000640 returned -22 [ 190.589179][ T5737] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 190.604708][ T9417] binder: BINDER_SET_CONTEXT_MGR already set [ 190.608060][ T9417] binder: 9416:9417 ioctl 4018620d 80000100 returned -16 [ 190.618786][ T9417] binder: BINDER_SET_CONTEXT_MGR already set [ 190.623278][ T9417] binder: 9416:9417 ioctl 4018620d 80000140 returned -16 [ 190.736821][ T5737] usb 6-1: Using ep0 maxpacket: 8 [ 190.739647][ T5737] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 190.744170][ T5737] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 190.747691][ T5737] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 190.751559][ T5737] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 190.755465][ T5737] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 190.759516][ T5737] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 190.764727][ T5737] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.974229][ T5737] usb 6-1: GET_CAPABILITIES returned 0 [ 190.975974][ T5737] usbtmc 6-1:16.0: can't read capabilities [ 191.124317][ T9426] FAULT_INJECTION: forcing a failure. [ 191.124317][ T9426] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 191.128529][ T9426] CPU: 1 UID: 0 PID: 9426 Comm: syz.0.1148 Not tainted syzkaller #0 PREEMPT(full) [ 191.128546][ T9426] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 191.128553][ T9426] Call Trace: [ 191.128558][ T9426] [ 191.128563][ T9426] dump_stack_lvl+0x100/0x190 [ 191.128581][ T9426] should_fail_ex.cold+0x5/0xa [ 191.128595][ T9426] _copy_from_user+0x2e/0xd0 [ 191.128608][ T9426] get_compat_msghdr+0xb3/0x480 [ 191.128624][ T9426] ? __pfx_get_compat_msghdr+0x10/0x10 [ 191.128644][ T9426] ___sys_sendmsg+0x1b6/0x1e0 [ 191.128666][ T9426] ? __pfx____sys_sendmsg+0x10/0x10 [ 191.128689][ T9426] ? find_held_lock+0x2b/0x80 [ 191.128711][ T9426] __sys_sendmsg+0x160/0x210 [ 191.128726][ T9426] ? __pfx___sys_sendmsg+0x10/0x10 [ 191.128743][ T9426] ? __pfx_ksys_write+0x10/0x10 [ 191.128759][ T9426] __do_fast_syscall_32+0x13a/0x8b0 [ 191.128772][ T9426] ? lockdep_hardirqs_on+0x7d/0x110 [ 191.128785][ T9426] do_fast_syscall_32+0x32/0x70 [ 191.128796][ T9426] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 191.128811][ T9426] RIP: 0023:0xf6ffefec [ 191.128826][ T9426] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 191.128830][ T9426] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 191.128842][ T9426] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080009b40 [ 191.128848][ T9426] RDX: 0000000024000840 RSI: 0000000000000000 RDI: 0000000000000000 [ 191.128854][ T9426] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 191.128860][ T9426] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 191.128866][ T9426] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 191.128879][ T9426] [ 191.179410][ T10] usb 6-1: USB disconnect, device number 5 [ 191.334976][ T9436] Console: switching to colour dummy device 80x25 [ 191.376685][ T9436] program syz.2.1152 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 191.381915][ T9436] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 191.400958][ T9436] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 191.403223][ T9436] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 191.405386][ T9436] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 191.408938][ T9436] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 191.420798][ T9436] pci 0000:00:01.0: Adding to iommu group 1 [ 191.427209][ T9436] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 191.429277][ T9436] pci 0000:00:01.0: vgaarb: bridge control possible [ 191.431207][ T9436] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 191.439621][ T9436] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 191.442342][ T9436] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 191.446298][ T9436] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 191.455463][ T9441] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 191.459108][ T9436] [drm] Found bochs VGA, ID 0xb0c5. [ 191.460740][ T9436] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 191.478194][ T9436] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 191.486659][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 191.506647][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 191.572746][ T9436] Console: switching to colour frame buffer device 160x50 [ 191.600225][ T9436] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 192.403381][ T9461] fuse: fd is not a fuse device [ 192.939315][ T9470] openvswitch: netlink: Missing key (keys=40, expected=100) [ 193.167899][ T9475] netlink: 1624 bytes leftover after parsing attributes in process `syz.3.1163'. [ 193.234591][ T43] kauditd_printk_skb: 25 callbacks suppressed [ 193.234675][ T43] audit: type=1326 audit(1787143372.181:903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9476 comm="syz.3.1164" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f47fec code=0x0 [ 193.335518][ T9482] netlink: 'syz.3.1164': attribute type 1 has an invalid length. [ 193.347244][ T5737] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 193.352480][ T9483] FAULT_INJECTION: forcing a failure. [ 193.352480][ T9483] name failslab, interval 1, probability 0, space 0, times 0 [ 193.355560][ T9482] 8021q: adding VLAN 0 to HW filter on device bond3 [ 193.359554][ T9483] CPU: 1 UID: 0 PID: 9483 Comm: syz.2.1167 Not tainted syzkaller #0 PREEMPT(full) [ 193.359582][ T9483] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 193.359602][ T9483] Call Trace: [ 193.359626][ T9483] [ 193.359634][ T9483] dump_stack_lvl+0x100/0x190 [ 193.359779][ T9483] should_fail_ex.cold+0x5/0xa [ 193.359811][ T9483] should_failslab+0xc2/0x120 [ 193.359854][ T9483] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 193.359890][ T9483] ? __alloc_skb+0x140/0x710 [ 193.359987][ T9483] __alloc_skb+0x140/0x710 [ 193.360008][ T9483] ? __pfx___alloc_skb+0x10/0x10 [ 193.360035][ T9483] tcp_stream_alloc_skb+0x34/0x660 [ 193.360084][ T9483] tcp_sendmsg_locked+0x13b2/0x44d0 [ 193.360126][ T9483] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 193.360154][ T9483] ? do_raw_spin_lock+0x128/0x260 [ 193.360193][ T9483] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 193.360220][ T9483] ? __local_bh_enable_ip+0xa5/0x120 [ 193.360254][ T9483] tcp_sendmsg+0x2e/0x50 [ 193.360277][ T9483] ? __pfx_tcp_sendmsg+0x10/0x10 [ 193.360301][ T9483] inet_sendmsg+0xb9/0x140 [ 193.360335][ T9483] __sys_sendto+0x453/0x4e0 [ 193.360354][ T9483] ? __pfx_inet_sendmsg+0x10/0x10 [ 193.360379][ T9483] ? __pfx___sys_sendto+0x10/0x10 [ 193.360416][ T9483] ? fput+0x7c/0x100 [ 193.360449][ T9483] ? ksys_write+0x1ac/0x250 [ 193.360472][ T9483] __ia32_sys_sendto+0xdd/0x1b0 [ 193.360492][ T9483] ? __do_fast_syscall_32+0xb3/0x8b0 [ 193.360578][ T9483] ? lockdep_hardirqs_on+0x7d/0x110 [ 193.360597][ T9483] __do_fast_syscall_32+0x13a/0x8b0 [ 193.360616][ T9483] ? lockdep_hardirqs_on+0x7d/0x110 [ 193.360636][ T9483] do_fast_syscall_32+0x32/0x70 [ 193.360657][ T9483] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 193.360679][ T9483] RIP: 0023:0xf7fb4fec [ 193.360703][ T9483] Code: Unable to access opcode bytes at 0xf7fb4fc2. [ 193.360719][ T9483] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 193.360739][ T9483] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800004c0 [ 193.360750][ T9483] RDX: 000000000000fdef RSI: 0000000000000805 RDI: 0000000000000000 [ 193.360761][ T9483] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 193.360771][ T9483] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 193.360781][ T9483] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 193.360805][ T9483] [ 193.435168][ T9486] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 193.507452][ T5737] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 193.515016][ T5737] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 193.519161][ T5737] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 193.522784][ T5737] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 193.525665][ T5737] usb 6-1: SerialNumber: syz [ 193.560879][ T9490] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1168'. [ 193.743784][ T9473] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1162'. [ 193.747317][ T9473] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1162'. [ 193.750197][ T9473] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1162'. [ 193.754022][ T9473] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1162'. [ 193.789535][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.791678][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.804862][ T9496] FAULT_INJECTION: forcing a failure. [ 193.804862][ T9496] name failslab, interval 1, probability 0, space 0, times 0 [ 193.810010][ T9496] CPU: 2 UID: 0 PID: 9496 Comm: syz.2.1170 Not tainted syzkaller #0 PREEMPT(full) [ 193.810033][ T9496] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 193.810044][ T9496] Call Trace: [ 193.810050][ T9496] [ 193.810057][ T9496] dump_stack_lvl+0x100/0x190 [ 193.810082][ T9496] should_fail_ex.cold+0x5/0xa [ 193.810102][ T9496] should_failslab+0xc2/0x120 [ 193.810126][ T9496] kmem_cache_alloc_noprof+0x91/0x6a0 [ 193.810148][ T9496] ? do_getname+0x35/0x390 [ 193.810175][ T9496] do_getname+0x35/0x390 [ 193.810199][ T9496] __ia32_compat_sys_execveat+0xc4/0x130 [ 193.810219][ T9496] __do_fast_syscall_32+0x13a/0x8b0 [ 193.810238][ T9496] ? lockdep_hardirqs_on+0x7d/0x110 [ 193.810257][ T9496] do_fast_syscall_32+0x32/0x70 [ 193.810274][ T9496] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 193.810295][ T9496] RIP: 0023:0xf7fb4fec [ 193.810317][ T9496] Code: Unable to access opcode bytes at 0xf7fb4fc2. [ 193.810324][ T9496] RSP: 002b:00000000f545550c EFLAGS: 00000292 ORIG_RAX: 0000000000000166 [ 193.810341][ T9496] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080001400 [ 193.810351][ T9496] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 193.810360][ T9496] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 193.810369][ T9496] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 193.810378][ T9496] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 193.810398][ T9496] [ 193.956396][ T5737] usb 6-1: USB disconnect, device number 6 [ 193.965530][ T9502] 9pnet_virtio: no channels available for device syz [ 194.030571][ T9503] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1171'. [ 194.967950][ T9534] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 195.180623][ T9541] nbd1: detected capacity change from 0 to 63 [ 195.191976][ T65] block nbd1: Receive control failed (result -104) [ 195.369772][ T9554] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 195.656697][ T9561] nbd2: detected capacity change from 0 to 63 [ 197.602024][ T9597] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 197.715649][ T65] block nbd2: Receive control failed (result -104) [ 198.290830][ T9605] FAULT_INJECTION: forcing a failure. [ 198.290830][ T9605] name failslab, interval 1, probability 0, space 0, times 0 [ 198.294827][ T9605] CPU: 2 UID: 0 PID: 9605 Comm: syz.2.1210 Not tainted syzkaller #0 PREEMPT(full) [ 198.294844][ T9605] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 198.294852][ T9605] Call Trace: [ 198.294857][ T9605] [ 198.294862][ T9605] dump_stack_lvl+0x100/0x190 [ 198.294880][ T9605] should_fail_ex.cold+0x5/0xa [ 198.294893][ T9605] should_failslab+0xc2/0x120 [ 198.294912][ T9605] __kmalloc_noprof+0xfc/0x820 [ 198.294927][ T9605] ? rcu_is_watching+0x13/0xc0 [ 198.294952][ T9605] ? tomoyo_realpath_from_path+0xb6/0x690 [ 198.295009][ T9605] tomoyo_realpath_from_path+0xb6/0x690 [ 198.295029][ T9605] tomoyo_path_number_perm+0x23c/0x580 [ 198.295047][ T9605] ? tomoyo_path_number_perm+0x22e/0x580 [ 198.295062][ T9605] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 198.295077][ T9605] ? get_pid_task+0x106/0x250 [ 198.295104][ T9605] ? find_held_lock+0x2b/0x80 [ 198.295119][ T9605] ? __fget_files+0x215/0x3d0 [ 198.295139][ T9605] ? hook_file_ioctl_common+0x140/0x440 [ 198.295154][ T9605] ? __fget_files+0x215/0x3d0 [ 198.295168][ T9605] ? __fget_files+0x21f/0x3d0 [ 198.295183][ T9605] security_file_ioctl_compat+0xd3/0x230 [ 198.295199][ T9605] __ia32_compat_sys_ioctl+0xc2/0x360 [ 198.295213][ T9605] __do_fast_syscall_32+0x13a/0x8b0 [ 198.295227][ T9605] ? lockdep_hardirqs_on+0x7d/0x110 [ 198.295239][ T9605] do_fast_syscall_32+0x32/0x70 [ 198.295251][ T9605] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 198.295265][ T9605] RIP: 0023:0xf7fb4fec [ 198.295280][ T9605] Code: Unable to access opcode bytes at 0xf7fb4fc2. [ 198.295284][ T9605] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 198.295296][ T9605] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000400c744d [ 198.295302][ T9605] RDX: 0000000080000180 RSI: 0000000000000000 RDI: 0000000000000000 [ 198.295309][ T9605] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 198.295315][ T9605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 198.295321][ T9605] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 198.295334][ T9605] [ 198.295339][ T9605] ERROR: Out of memory at tomoyo_realpath_from_path. [ 198.881091][ T9620] netlink: 'syz.3.1217': attribute type 1 has an invalid length. [ 198.936579][ T9622] FAULT_INJECTION: forcing a failure. [ 198.936579][ T9622] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 198.944310][ T9622] CPU: 0 UID: 0 PID: 9622 Comm: syz.1.1216 Not tainted syzkaller #0 PREEMPT(full) [ 198.944328][ T9622] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 198.944335][ T9622] Call Trace: [ 198.944340][ T9622] [ 198.944346][ T9622] dump_stack_lvl+0x100/0x190 [ 198.944364][ T9622] should_fail_ex.cold+0x5/0xa [ 198.944377][ T9622] save_fsave_header+0x14c/0x2f0 [ 198.944400][ T9622] ? __pfx_save_fsave_header+0x10/0x10 [ 198.944415][ T9622] ? copy_fpstate_to_sigframe+0x2b8/0xae0 [ 198.944427][ T9622] ? __local_bh_enable_ip+0xa5/0x120 [ 198.944457][ T9622] copy_fpstate_to_sigframe+0x755/0xae0 [ 198.944471][ T9622] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 198.944485][ T9622] ? posixtimer_deliver_signal+0x1a0/0x6e0 [ 198.944509][ T9622] ? x86_task_fpu+0x5f/0x90 [ 198.944527][ T9622] get_sigframe+0x3fb/0x940 [ 198.944547][ T9622] ? __pfx_get_sigframe+0x10/0x10 [ 198.944557][ T9622] ? rcu_is_watching+0x13/0xc0 [ 198.944572][ T9622] ? siginfo_layout+0x156/0x290 [ 198.944587][ T9622] ia32_setup_rt_frame+0xe7/0xaf0 [ 198.944604][ T9622] ? __pfx_ia32_setup_rt_frame+0x10/0x10 [ 198.944618][ T9622] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 198.944638][ T9622] ? fput+0x7c/0x100 [ 198.944653][ T9622] arch_do_signal_or_restart+0x459/0x7a0 [ 198.944665][ T9622] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 198.944684][ T9622] exit_to_user_mode_loop+0x139/0x700 [ 198.944697][ T9622] ? rcu_is_watching+0x13/0xc0 [ 198.944712][ T9622] __do_fast_syscall_32+0x59f/0x8b0 [ 198.944724][ T9622] ? lockdep_hardirqs_on+0x7d/0x110 [ 198.944736][ T9622] do_fast_syscall_32+0x32/0x70 [ 198.944748][ T9622] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 198.944762][ T9622] RIP: 0023:0xf6fcefea [ 198.944772][ T9622] Code: 19 85 d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 80 5d 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 198.944783][ T9622] RSP: 002b:00000000f53bd50c EFLAGS: 00000292 ORIG_RAX: 00000000000001aa [ 198.944795][ T9622] RAX: 00000000000001aa RBX: 0000000000000003 RCX: 00000000fffffdff [ 198.944801][ T9622] RDX: 000000000000e875 RSI: 0000000000000027 RDI: 0000000000000000 [ 198.944808][ T9622] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 198.944814][ T9622] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 198.944820][ T9622] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 198.944833][ T9622] [ 199.430138][ T9635] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 199.641138][ T9645] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 199.678010][ T5819] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 199.850058][ T5819] usb 8-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 199.888449][ T5819] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 199.907403][ T5819] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 199.913387][ T5819] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 199.921351][ T5819] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 199.934604][ T5819] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.938079][ T5819] usb 8-1: Product: syz [ 199.939941][ T5819] usb 8-1: Manufacturer: syz [ 199.941657][ T5819] usb 8-1: SerialNumber: syz [ 199.980718][ T5819] ti_usb_3410_5052 8-1:2.0: TI USB 5052 2 port adapter converter detected [ 199.993529][ T5819] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 200.036338][ T5819] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 201.070253][ T9662] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 201.144474][ T9665] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 201.216208][ T9675] netlink: 1688 bytes leftover after parsing attributes in process `syz.1.1237'. [ 201.349071][ T9680] syzkaller0: entered promiscuous mode [ 201.351218][ T9680] syzkaller0: entered allmulticast mode [ 201.489569][ T9683] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 201.491839][ T9683] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 201.514546][ T9683] vhci_hcd vhci_hcd.0: Device attached [ 201.740585][ T9695] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 201.776787][ T5737] usb 38-1: SetAddress Request (2) to port 0 [ 201.779920][ T5737] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 202.078515][ T9684] vhci_hcd: connection reset by peer [ 202.087049][ T5829] vhci_hcd vhci_hcd.0: stop threads [ 202.090396][ T5829] vhci_hcd vhci_hcd.0: release socket [ 202.095425][ T5829] vhci_hcd vhci_hcd.0: disconnect device [ 202.237383][ T24] usb 8-1: USB disconnect, device number 13 [ 202.265502][ T9630] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 202.301848][ T24] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 202.333329][ T24] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 202.346831][ T24] ti_usb_3410_5052 8-1:2.0: device disconnected [ 202.909725][ T9711] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.1250'. [ 203.010616][ T43] audit: type=1800 audit(1787143381.961:904): pid=9715 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1252" name="file0" dev="overlay" ino=1736 res=0 errno=0 [ 203.156831][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 203.176655][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 203.186696][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 203.432342][ T9732] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 203.434530][ T9732] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 203.443239][ T9732] vhci_hcd vhci_hcd.0: Device attached [ 203.454831][ T9738] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.1259'. [ 203.736706][ T850] usb 42-1: SetAddress Request (2) to port 0 [ 203.738727][ T850] usb 42-1: new SuperSpeed USB device number 2 using vhci_hcd [ 203.789877][ T9750] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 203.797854][ T9752] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 203.863217][ T9755] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 204.014210][ T9735] vhci_hcd: connection reset by peer [ 204.020778][ T5829] vhci_hcd vhci_hcd.2: stop threads [ 204.022522][ T5829] vhci_hcd vhci_hcd.2: release socket [ 204.024299][ T5829] vhci_hcd vhci_hcd.2: disconnect device [ 204.103196][ T9766] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.1269'. [ 204.216685][ T10] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 204.366691][ T10] usb 8-1: Using ep0 maxpacket: 8 [ 204.369078][ T10] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 204.373181][ T10] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 204.375715][ T10] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 204.379000][ T10] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 204.382161][ T10] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 204.385325][ T10] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 204.389600][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.616304][ T10] usb 8-1: usb_control_msg returned -32 [ 204.618246][ T10] usbtmc 8-1:16.0: can't read capabilities [ 204.834889][ T10] usb 8-1: USB disconnect, device number 14 [ 205.050335][ T9781] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 205.052452][ T9781] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 205.070248][ T9781] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 205.072301][ T9781] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 205.079450][ T9781] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 205.081505][ T9781] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 205.087689][ T9781] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 205.149813][ T9786] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.1279'. [ 205.627610][ T9792] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1282'. [ 205.664511][ T9796] netlink: 'syz.1.1284': attribute type 1 has an invalid length. [ 205.814174][ T9797] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 205.822020][ T9797] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 206.068355][ T9802] netlink: 'syz.3.1285': attribute type 4 has an invalid length. [ 206.113876][ T9802] netlink: 'syz.3.1285': attribute type 4 has an invalid length. [ 206.255523][ T9806] misc userio: No port type given on /dev/userio [ 206.299482][ T9802] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1285'. [ 206.342312][ T9808] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 206.826956][ T5737] usb 38-1: device descriptor read/8, error -110 [ 207.068200][ T5736] Bluetooth: hci0: command 0x0406 tx timeout [ 207.148332][ T5736] Bluetooth: hci3: command 0x0c1a tx timeout [ 207.148359][ T64] Bluetooth: hci1: command 0x0406 tx timeout [ 207.682295][ T5737] usb usb38-port1: attempt power cycle [ 207.924117][ T9820] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 207.929892][ T9820] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.223458][ T9824] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 208.237283][ T5737] usb usb38-port1: unable to enumerate USB device [ 208.364624][ T9820] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.368774][ T9820] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.573739][ T9820] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.577619][ T9820] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.655398][ T9829] jffs2: notice: (9829) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 208.829102][ T850] usb 42-1: device descriptor read/8, error -110 [ 208.839345][ T43] audit: type=1800 audit(1787143387.791:905): pid=9833 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1296" name="file0" dev="overlay" ino=1631 res=0 errno=0 [ 209.147588][ T64] Bluetooth: hci0: command 0x0406 tx timeout [ 209.217212][ T850] usb usb42-port1: attempt power cycle [ 209.228372][ T64] Bluetooth: hci1: command 0x0406 tx timeout [ 209.228901][ T5736] Bluetooth: hci3: command 0x0c1a tx timeout [ 209.759073][ T9847] sch_tbf: burst 32855 is lower than device lo mtu (11337746) ! [ 209.798119][ T850] usb usb42-port1: unable to enumerate USB device [ 210.121693][ T9850] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 210.263554][ T9842] syz.0.1299 (9842) used greatest stack depth: 19264 bytes left [ 210.435776][ T2239] block nbd0: Possible stuck request ffff8880277c7000: control (read@0,4096B). Runtime 30 seconds [ 210.609254][ T9859] mac80211_hwsim hwsim8 wlan0: left promiscuous mode [ 211.199591][ T9865] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1314'. [ 211.205739][ T9865] netlink: 348 bytes leftover after parsing attributes in process `syz.1.1314'. [ 211.212776][ T9865] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1314'. [ 211.219923][ T9865] netlink: 348 bytes leftover after parsing attributes in process `syz.1.1314'. [ 211.227018][ T9865] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1314'. [ 211.307327][ T5736] Bluetooth: hci3: command 0x0c1a tx timeout [ 211.542638][ T9867] can0: slcan on ttyS3. [ 211.714725][ T9866] can0 (unregistered): slcan off ttyS3. [ 211.740664][ T9885] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 211.838819][ T9894] sch_tbf: burst 32855 is lower than device lo mtu (11337746) ! [ 212.250026][ T9901] smbdirect: ib_dev[syz2] removed [ 212.769789][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 212.776402][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 212.808286][ T9915] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 214.194657][ T9941] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 214.667338][ T9950] nbd3: detected capacity change from 0 to 63 [ 215.533184][ T9956] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1336'. [ 215.986746][ T24] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 216.137446][ T65] block nbd3: Receive control failed (result -104) [ 216.157880][ T24] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 216.163555][ T24] usb 8-1: config 0 interface 0 altsetting 255 endpoint 0xE has an invalid bInterval 0, changing to 7 [ 216.173694][ T24] usb 8-1: config 0 interface 0 has no altsetting 0 [ 216.186670][ T24] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 216.195102][ T24] usb 8-1: Product: syz [ 216.199568][ T24] usb 8-1: Manufacturer: syz [ 216.205503][ T24] usb 8-1: SerialNumber: syz [ 216.227156][ T24] usb 8-1: config 0 descriptor?? [ 216.272003][ T24] usb 8-1: selecting invalid altsetting 0 [ 216.537386][ T24] usb 8-1: USB disconnect, device number 15 [ 217.696690][ T9977] nbd4: detected capacity change from 0 to 63 [ 218.385228][ T9978] Console: switching to colour dummy device 80x25 [ 218.701024][ T9987] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 220.337162][ T65] block nbd4: Receive control failed (result -104) [ 220.556823][ T64] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 220.569561][ T64] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 220.583104][ T64] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 220.595478][ T64] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 220.599669][ T64] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 220.603035][T10018] netlink: 'syz.1.1353': attribute type 1 has an invalid length. [ 220.637241][T10021] netlink: 1624 bytes leftover after parsing attributes in process `syz.3.1354'. [ 220.965929][T10015] bridge0: port 1(bridge_slave_0) entered blocking state [ 220.968335][T10015] bridge0: port 1(bridge_slave_0) entered disabled state [ 220.970675][T10015] bridge_slave_0: entered allmulticast mode [ 220.973831][T10015] bridge_slave_0: entered promiscuous mode [ 220.977468][T10015] bridge0: port 2(bridge_slave_1) entered blocking state [ 220.979880][T10015] bridge0: port 2(bridge_slave_1) entered disabled state [ 220.982320][T10015] bridge_slave_1: entered allmulticast mode [ 220.985198][T10015] bridge_slave_1: entered promiscuous mode [ 221.001862][T10015] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 221.006435][T10015] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 221.017072][ T24] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 221.021962][T10015] team0: Port device team_slave_0 added [ 221.025256][T10015] team0: Port device team_slave_1 added [ 221.040059][T10015] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 221.042274][T10015] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 221.050620][T10015] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 221.056145][T10015] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 221.059011][T10015] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 221.067326][T10015] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 221.100859][T10015] hsr_slave_0: entered promiscuous mode [ 221.103423][T10015] hsr_slave_1: entered promiscuous mode [ 221.105725][T10015] debugfs: 'hsr0' already exists in 'hsr' [ 221.107747][T10015] Cannot create hsr debugfs directory [ 221.116758][ T5819] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 221.188328][ T24] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 221.198859][ T24] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 221.203509][ T24] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 221.208450][ T24] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 221.213046][ T24] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 221.219980][ T24] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.224012][T10015] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 221.232657][ T24] usb 8-1: config 0 descriptor?? [ 221.237459][T10031] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 221.238388][T10015] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 221.244038][T10015] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 221.252324][T10015] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 221.256098][T10015] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 221.262899][T10015] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 221.268566][T10015] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 221.277253][ T5819] usb 6-1: Using ep0 maxpacket: 8 [ 221.282547][T10015] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 221.283562][ T5819] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 221.290374][ T5819] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 221.294886][ T5819] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 221.299232][ T5819] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 221.303843][ T5819] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 25712, setting to 1024 [ 221.308943][ T5819] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.313940][T10015] bridge0: port 2(bridge_slave_1) entered blocking state [ 221.316853][T10015] bridge0: port 2(bridge_slave_1) entered forwarding state [ 221.318698][T10035] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 221.319842][T10015] bridge0: port 1(bridge_slave_0) entered blocking state [ 221.325417][T10015] bridge0: port 1(bridge_slave_0) entered forwarding state [ 221.327538][ T5819] hub 6-1:1.0: bad descriptor, ignoring hub [ 221.336823][ T5819] hub 6-1:1.0: probe with driver hub failed with error -5 [ 221.344695][ T5819] cdc_wdm 6-1:1.0: skipping garbage [ 221.347553][ T5819] cdc_wdm 6-1:1.0: skipping garbage [ 221.357245][ T5819] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 221.364474][T10015] 8021q: adding VLAN 0 to HW filter on device bond0 [ 221.366296][ T5819] cdc_wdm 6-1:1.0: Unknown control protocol [ 221.378716][ T1166] bridge0: port 1(bridge_slave_0) entered disabled state [ 221.381821][ T1166] bridge0: port 2(bridge_slave_1) entered disabled state [ 221.398312][T10015] 8021q: adding VLAN 0 to HW filter on device team0 [ 221.412021][ T1166] bridge0: port 1(bridge_slave_0) entered blocking state [ 221.414962][ T1166] bridge0: port 1(bridge_slave_0) entered forwarding state [ 221.428864][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state [ 221.432124][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state [ 221.622409][ C3] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 221.625108][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 221.757672][T10015] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 221.920653][ T5819] usb 6-1: USB disconnect, device number 7 [ 221.929039][T10015] veth0_vlan: entered promiscuous mode [ 221.935145][T10015] veth1_vlan: entered promiscuous mode [ 221.970933][T10015] veth0_macvtap: entered promiscuous mode [ 221.975883][T10015] veth1_macvtap: entered promiscuous mode [ 221.991217][T10015] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 222.000341][T10015] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 222.073257][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 222.081220][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 222.099376][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 222.102603][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 222.126834][ T5785] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.142571][ T5785] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.177007][ T5785] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.181556][ T5785] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.668219][ T5736] Bluetooth: hci4: command tx timeout [ 223.024415][T10093] [ 223.025305][T10093] ============================================ [ 223.027351][T10093] WARNING: possible recursive locking detected [ 223.029337][T10093] syzkaller #0 Not tainted [ 223.030905][T10093] -------------------------------------------- [ 223.032900][T10093] syz.4.1368/10093 is trying to acquire lock: [ 223.034923][T10093] ffff8880232da160 (&rmidi->open_mutex){+.+.}-{4:4}, at: snd_rawmidi_kernel_open+0xa4/0x190 [ 223.038196][T10093] [ 223.038196][T10093] but task is already holding lock: [ 223.040551][T10093] ffff888013dd8960 (&rmidi->open_mutex){+.+.}-{4:4}, at: snd_rawmidi_open+0x296/0xba0 [ 223.043727][T10093] [ 223.043727][T10093] other info that might help us debug this: [ 223.046366][T10093] Possible unsafe locking scenario: [ 223.046366][T10093] [ 223.048738][T10093] CPU0 [ 223.049832][T10093] ---- [ 223.050934][T10093] lock(&rmidi->open_mutex); [ 223.052439][T10093] lock(&rmidi->open_mutex); [ 223.054133][T10093] [ 223.054133][T10093] *** DEADLOCK *** [ 223.054133][T10093] [ 223.056721][T10093] May be due to missing lock nesting notation [ 223.056721][T10093] [ 223.059360][T10093] locks held by syz.4.1368/10093: 2, last CPU#3: [ 223.061427][T10093] #0: ffff888013dd8960 (&rmidi->open_mutex){+.+.}-{4:4}, at: snd_rawmidi_open+0x296/0xba0 [ 223.065248][T10093] #1: ffff8880232da460 (&ump->open_mutex){+.+.}-{4:4}, at: snd_ump_legacy_open+0x120/0x4e0 [ 223.069530][T10093] [ 223.069530][T10093] stack backtrace: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 223.072003][T10093] CPU: 3 UID: 0 PID: 10093 Comm: syz.4.1368 Not tainted syzkaller #0 PREEMPT(full) [ 223.072030][T10093] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 223.072042][T10093] Call Trace: [ 223.072050][T10093] [ 223.072057][T10093] dump_stack_lvl+0x100/0x190 [ 223.072083][T10093] print_deadlock_bug.cold+0xbd/0xca [ 223.072116][T10093] __lock_acquire+0x1343/0x1ec0 [ 223.072143][T10093] lock_acquire+0x1b9/0x370 [ 223.072157][T10093] ? snd_rawmidi_kernel_open+0xa4/0x190 [ 223.072180][T10093] ? __pfx___might_resched+0x10/0x10 [ 223.072216][T10093] __mutex_lock+0x1a4/0x1bc0 [ 223.072240][T10093] ? snd_rawmidi_kernel_open+0xa4/0x190 [ 223.072261][T10093] ? snd_rawmidi_kernel_open+0xa4/0x190 [ 223.072281][T10093] ? __mutex_lock+0x26c/0x1bc0 [ 223.072301][T10093] ? snd_ump_legacy_open+0x120/0x4e0 [ 223.072324][T10093] ? __pfx___mutex_lock+0x10/0x10 [ 223.072343][T10093] ? __pfx___mutex_lock+0x10/0x10 [ 223.072368][T10093] ? snd_rawmidi_kernel_open+0xa4/0x190 [ 223.072387][T10093] snd_rawmidi_kernel_open+0xa4/0x190 [ 223.072408][T10093] snd_ump_legacy_open+0x367/0x4e0 [ 223.072430][T10093] open_substream+0x480/0x970 [ 223.072461][T10093] rawmidi_open_priv+0x595/0x6f0 [ 223.072480][T10093] snd_rawmidi_open+0x4c9/0xba0 [ 223.072502][T10093] ? __pfx_snd_rawmidi_open+0x10/0x10 [ 223.072523][T10093] ? __pfx_default_wake_function+0x10/0x10 [ 223.072545][T10093] ? do_raw_spin_lock+0x128/0x260 [ 223.072565][T10093] ? __pfx_snd_rawmidi_open+0x10/0x10 [ 223.072583][T10093] snd_open+0x201/0x450 [ 223.072606][T10093] ? __pfx_snd_open+0x10/0x10 [ 223.072627][T10093] chrdev_open+0x234/0x6a0 [ 223.072650][T10093] ? __pfx_chrdev_open+0x10/0x10 [ 223.072672][T10093] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 223.072696][T10093] do_dentry_open+0x6ab/0x14d0 [ 223.072718][T10093] ? __pfx_chrdev_open+0x10/0x10 [ 223.072738][T10093] vfs_open+0x82/0x3f0 [ 223.072788][T10093] path_openat+0x19fa/0x2440 [ 223.072813][T10093] ? __pfx_path_openat+0x10/0x10 [ 223.072842][T10093] do_file_open+0x20e/0x430 [ 223.072864][T10093] ? __pfx_do_file_open+0x10/0x10 [ 223.072895][T10093] ? _raw_spin_unlock+0x28/0x50 [ 223.072921][T10093] ? alloc_fd+0x471/0x7a0 [ 223.072953][T10093] do_sys_openat2+0x10f/0x1e0 [ 223.072983][T10093] ? __pfx_do_sys_openat2+0x10/0x10 [ 223.073011][T10093] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 223.073040][T10093] __ia32_compat_sys_openat+0x12d/0x210 [ 223.073067][T10093] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 223.073099][T10093] do_int80_emulation+0x166/0x650 [ 223.073122][T10093] asm_int80_emulation+0x1a/0x20 [ 223.073142][T10093] RIP: 0023:0xf71c74eb [ 223.073158][T10093] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 223.073177][T10093] RSP: 002b:00000000f548603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 223.073196][T10093] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f5486100 [ 223.073205][T10093] RDX: 0000000000141102 RSI: 0000000000000000 RDI: 0000000000000000 [ 223.073217][T10093] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 223.073229][T10093] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 223.073240][T10093] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 223.073257][T10093] [ 223.490061][ T24] usbhid 8-1:0.0: can't add hid device: -71 [ 223.492743][ T24] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 223.496267][ T24] usb 8-1: USB disconnect, device number 16 [ 224.030674][ T13] bond1 (unregistering): (slave gretap1): Releasing active interface [ 224.052422][ T13] bond0 (unregistering): Released all slaves [ 224.058008][ T13] bond1 (unregistering): Released all slaves [ 224.064728][ T13] bond2 (unregistering): Released all slaves [ 224.072989][ T13] bond3 (unregistering): Released all slaves [ 224.155254][ T13] tipc: Left network mode [ 224.182369][ T5447] 8021q: adding VLAN 0 to HW filter on device eth2 [ 224.292613][ T5447] 8021q: adding VLAN 0 to HW filter on device eth3 [ 224.393358][ T13] hsr_slave_0: left promiscuous mode [ 224.395554][ T13] hsr_slave_1: left promiscuous mode [ 224.494041][ T5447] 8021q: adding VLAN 0 to HW filter on device eth4 [ 224.609024][ T5447] 8021q: adding VLAN 0 to HW filter on device eth5 [ 224.890926][ T13] IPVS: stop unused estimator thread 0... [ 224.991606][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.290097][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.351582][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.421791][ T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.485041][ T13] bridge_slave_1: left allmulticast mode [ 225.487086][ T13] bridge_slave_1: left promiscuous mode [ 225.489163][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 225.493455][ T13] bridge_slave_0: left allmulticast mode [ 225.495236][ T13] bridge_slave_0: left promiscuous mode [ 225.497228][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 225.542348][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 225.547413][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 225.552064][ T13] bond0 (unregistering): Released all slaves [ 225.656303][ T5447] 8021q: adding VLAN 0 to HW filter on device eth6 [ 225.746278][ T5447] 8021q: adding VLAN 0 to HW filter on device eth7 [ 225.773026][ T13] hsr_slave_0: left promiscuous mode [ 225.775364][ T13] hsr_slave_1: left promiscuous mode [ 225.777979][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 225.781012][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 225.784377][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 225.787640][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 225.789458][ T2239] block nbd1: Possible stuck request ffff8880277f0000: control (read@0,1024B). Runtime 30 seconds [ 225.790586][ T30] block nbd2: Possible stuck request ffff88802785e000: control (read@0,1024B). Runtime 30 seconds [ 225.794536][ T2239] block nbd1: Possible stuck request ffff8880277f01c0: control (read@1024,1024B). Runtime 30 seconds [ 225.794580][ T2239] block nbd1: Possible stuck request ffff8880277f0380: control (read@2048,1024B). Runtime 30 seconds [ 225.798931][ T30] block nbd2: Possible stuck request ffff88802785e1c0: control (read@1024,1024B). Runtime 30 seconds [ 225.802285][ T2239] block nbd1: Possible stuck request ffff8880277f0540: control (read@3072,1024B). Runtime 30 seconds [ 225.806014][ T30] block nbd2: Possible stuck request ffff88802785e380: control (read@2048,1024B). Runtime 30 seconds [ 225.806124][ T13] veth1_macvtap: left promiscuous mode [ 225.806151][ T13] veth0_macvtap: left promiscuous mode [ 225.806191][ T13] veth1_vlan: left promiscuous mode [ 225.806216][ T13] veth0_vlan: left promiscuous mode [ 225.825714][ T30] block nbd2: Possible stuck request ffff88802785e540: control (read@3072,1024B). Runtime 30 seconds [ 225.894665][ T13] team0 (unregistering): Port device team_slave_1 removed [ 225.906310][ T13] team0 (unregistering): Port device team_slave_0 removed [ 225.933986][ T5447] 8021q: adding VLAN 0 to HW filter on device eth8 [ 226.040717][ T5447] 8021q: adding VLAN 0 to HW filter on device eth9