program: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$XFS_IOC_AG_GEOMETRY(r0, 0xc080583d, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r3, 0x0, 0x0) close(r2) socket(0x10, 0x803, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r5, 0x0, 0x4005) socketpair$unix(0x1, 0x5, 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000080), 0x3, 0x109082) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ehci-pci/unbind\x00', 0x1, 0x2) write(r6, &(0x7f0000000240)='0000:00:1d.7', 0xc) syz_mount_image$udf(&(0x7f00000000c0), &(0x7f0000000440)='./file0\x00', 0x1000a05, &(0x7f0000000100)=ANY=[@ANYBLOB="66696c657365743d3030303030303030303030313032352c726f6f746469723d30303030303030303030303030303030303030332c706172746974696f6e3d30303030303030303030303030303030303030302c6769643d69676e6f7265006e6f6164696e6963622cde6661736b3d30303030303030303030303030303030303030343732302c62733d30303230303030303030303230303030303030362c6769643d69676e6f72652c12e7090021b0d36853f83b3237931f7bf54d593a4b0e2a94b2208a0318c4095a29b12750ca47c7a60cd523accdee2710fd9dc6171d154f9426ce2b8e251b"], 0x1, 0xc44, &(0x7f0000000740)="$eJzs3V9sneddB/Df89rOsdONeOvIWljhFKSRek1Jk6zOGlROqGuYlKbWHO9ukk9sJxzVsS3bYWk1wOOGCy4mIcTFrixBhTTEVFE0cWmgSNtNL9CuuLJArSbEhUGTJiFVRu97npMcO07jxbHjtJ/P5nzfP8/znuf94/d1LT/vEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAxO+8cuHU8+lhtwIAOEiXxr926rTnPwB8olz23/8AAAAAAAAAAAAAAHDYpSji8UixcGkjTVbzbf0XW3M3bk6MjO5cbSBVNXuq8uVX//Onz5z98gvD5zr50fUftCfjtfHLF+ovz19fWJxZWpqZrk/Mtabmp4tdb2Hn+jP33aKh8gDUIuLG9NWrS/XTz53Zsvrm4Ae1x44Pnh9+5uRT7bI36xMjo6PjXWV6++770+9wtx4eR6KIk5Hi2e//JDUjojpgezwW97h29ttAtRND1U5MjIxWOzLbas4tlyvHOgeiiKh3VWp0jtEBnIs9aUSslM0vGzxU7t74QnOxeWV2pj7WXFxuLbfm58ZSu7Xl/tSjiHMpYjUi1mt3bq4viuiNFN89tpGuRERP5zh8qeoYfPd27P47a1+U7az3RawWj8A5O8RqUcSrkeKn756IqfKY5a/4YsSrZf4g4q0yX4pI5YVxNuL9Ha4jHk29UcSflef//Eaaru4HnfvKxa/Xvzp3db6rbOe+srfnw2a+eg78+TCwLQ/GIb839UcRzeqOv5Hu/4cdAAAAAAAAAAAAAAAAAB60gSjiyUjxyr/9QdWvOKp+6cfOD//u4Kdv9RlPEU/cYzsp/i+ei4iVYnd9co/kLsRjaSylh9yX+JOsP4r4w9z/79sPuzEAAAAAAAAAAAAAAAAAAACfaEX8OFK8+N6JtBrdY4q35q7VLzevzLZHhe2M/dsZM31zc3OzntrZyDmZcyXnas61nOs5o8j1czZyTuZcyblaRNQiYi3Pr+eMnlw/ZyPnZM6VnKs513Ku54zeXD9nI+dkzpWcqznXcq7njEMydi8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMdJEUV8GCm+882NFCkiGhGT0c612sNuHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQqqUi3okU9d9r3FrWGxGp+n/bifKfs9E4UuZnozFc5kvRuJCzWWVv49sPof3sTV8q4keRotb/9q0T/un2+e9rz926DOKtb92e+6XedvZ0Vg5+UHvs+LHzw6O/8sTdptNODRi62Jq7cbM+MTI6Ot61uDd/+me7lg3mzy0ezK4TEUtvvPl6c3Z2ZvH+J8pLYA/VH9bEwIPY94OdOPIoHufDMLGZr/aft3r0HoLGP6SJh3xj4kCUz//3I8VvvvfvnQd+5+e/T7Xnbj3h42d/dPv5/+L2De3T8//xrmUv5p9G+noj+pevL/Qdj+hfeuPNk63rzWsz12bmzp469ZXh4a+cOdV3JKL/autXI6I9NTtzas+HCgAAAAAAAAAAAAAAAOBgpSJ+O1I0f7SR6hFxs+qvNXh++JmTT/VET9Xfaku/rdfGL1+ovzx/fWFxZmlpZro+Mdeamp+e2e3H9VfdvSZGRvdlZ+5pYJ/bP9D/8vzCG4uta7+/vOP6o/0XriwtLzandl4dA1FENLqXDFUNnhgZrRo922rOVVXHduxM9/PrS0X8R6SYOltPT+dluf/f9h7+W/r/r2zf0D71//tM17LyM1Mq4meR4jf+/Il4umrn0bjjmOVyfx0phs59IZeLI2W5Thva7xVo9wwsy/5PpPj7D7eW7fSHfPx22ed3fWAfEeX5PxYp3vnT78Wv5WW9W97/sPP5P7p9Q7s8/5t/vK3ePc7/57qWHd3yvoIHs/+fdOX5PxkpXnr87fj1vKz3I97/0Xn3xolc+Nb7Ofbp+3+zq9Jg9bne/gEAAAAAAAAAABD577/+JlI8NdqbXsjLPrWLv/+b3r6hffr7r893LZt+MOMV3XMiDDEFAAAAwMdEXyrix5Hi2vLbt/pQb+3/3dX/87du/2JsJG1bW/2e7xeq9wY8yN//dRvMnzu5990GAAAAAAAAAAAAAAAAAACAQyWlIl7I46lP7jCe+kDEUpHLrUWKV/7r2VwuHS/LdcaBH6z+7b80P3fywuzs/FRzuXlldqY+vtCcminrfi5SbPzVF3Ldohpf/eltbemMxb4YKUb/tlO2PRZ7Z2zy9njg7bHYy7KfiRT/+Xdby3bGsf7F22VPl2X/MlJ84x93Lnv8dtkzZdnvRYoffqPeKXu0LNt5P+rnb5d9bmreq0IBAAAAAAAAAAAAAAAAAADYu75UxJ9Eiv++vnqrL38e/7+va7by1re6xvvf5mY1zv9gNf7/3abvZ/z/wTtrfLjZFrF57D73GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADrcURbwZKRYubaS1Wjnf1n+xNXfj5sTI6M7VBlJVs6cqX371P3/6zNkvvzB8rpMfXf9BezJeG798of7y/PWFxZmlpZnp+sRca2p+embXW9hr/e2GqgNQv/76jemrV5fqp587s2X1zcEPao8dHzw//MzJpzplJ0ZGR8e7yvT23fen3yHdZfmRKOIvIsWz3/9J+qdaRBF7Pxb3uHb220C1E0PVTkyMjFY7Mttqzi2XK8c6B6KIqHdVanSO0QGciz1pRKyUzS8bPFTu3vhCc7F5ZXamPtZcXG4tt+bnxlK7teX+1KOIcyliNSLWa3duri+KeD1SfPfYRvrnWkRP5zh86dL4106dvns7in3cx10o21nvi1gtHoFzdojVooh/iBQ/ffdE/EstojfaX/HFiFfL/EHEW9E+36m8MM5GvL/DdcSjqTeK+N/y/J/fSO/WyvtB575y8ev1ry6/0122c1955J8PB+mQ35v6o4gfVnf8jfSvvq8BAAAAAAAAAAAAAAAADpEifjlSvPjeiVT1D+50il5szV2rX25emW136+v0/eus3tzc3KyndjZSe8lknl/JuZpzLed6zihy/ZyNMvs3Nyfz/ErO1ZxrOddzRk+un7ORczLnSs7VnGs513NGb66fs5FzMudKztWcaznXc8Yh6bsHAAAAAAAAAAAAAAAAAAB8vBTV/1J855sbabPWHl96Mtq5ZjzQj73/DwAA///fMvaG") sendmmsg$alg(r3, &(0x7f0000006ec0), 0x0, 0x20040040) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$unix(r7, &(0x7f0000008380)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000090}}, {{&(0x7f0000000080)=@abs={0x1, 0x30, 0x4e22}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4}}], 0x2, 0x40008004) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) [ 95.213816][ T5277] Bluetooth: hci0: command tx timeout processing error - resetting ehci HC [ 95.416115][ T5319] syzkaller0: entered promiscuous mode [ 95.418486][ T5319] syzkaller0: entered allmulticast mode [ 95.477265][ T5319] ehci-pci 0000:00:1d.7: remove, state 1 [ 95.486780][ T5319] usb usb2: USB disconnect, device number 1 [ 95.494595][ T5319] usb 2-1: USB disconnect, device number 2 [ 95.587943][ T5320] loop0: detected capacity change from 0 to 2048 [ 95.674189][ T4701] usb 1-1: new full-speed USB device number 2 using uhci_hcd [ 95.723160][ T5320] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found! [ 95.799047][ T5320] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 95.843745][ T4701] usb 1-1: not running at top speed; connect to a high speed hub [ 95.882353][ T5320] UDF-fs: error (device loop0): udf_verify_fi: directory (ino 1376) has entry at pos 0 with unaligned length of impUse field [ 95.908709][ T4701] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 95.953343][ T4701] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 95.968159][ T4701] usb 1-1: Product: QEMU USB Tablet [ 95.980710][ T4701] usb 1-1: Manufacturer: QEMU [ 95.988081][ T4701] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 96.050672][ T4701] usb 1-1: can't set config #1, error -71 [ 96.058728][ T5319] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 96.246365][ T1239] usb 1-1: USB disconnect, device number 2 [ 96.584902][ T1239] usb 1-1: new full-speed USB device number 3 using uhci_hcd [ 96.754690][ T1239] usb 1-1: not running at top speed; connect to a high speed hub [ 96.762440][ T1239] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 96.818197][ T1239] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 96.825754][ T1239] usb 1-1: Product: QEMU USB Tablet [ 96.827912][ T1239] usb 1-1: Manufacturer: QEMU [ 96.834952][ T1239] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 96.931342][ T1239] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb1/1-1/1-1:1.0/0003:0627:0001.0002/input/input5 [ 97.039512][ T1239] hid-generic 0003:0627:0001.0002: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 97.167841][ T5275] ------------[ cut here ]------------ [ 97.171198][ T5275] kernel BUG at arch/x86/mm/physaddr.c:28! [ 97.185958][ T5275] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 97.188578][ T5275] CPU: 0 UID: 0 PID: 5275 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 97.192220][ T5275] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.196340][ T5275] RIP: 0010:__phys_addr+0xf7/0x100 [ 97.198472][ T5275] Code: c7 e9 56 57 90 e8 19 f2 bc 00 eb 8b 48 c7 c7 f0 0f 9c 8e 48 89 de 48 89 ca 49 89 ce e8 52 bb 98 03 4c 89 f1 e9 7b ff ff ff 90 <0f> 0b 90 0f 0b 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 97.206625][ T5275] RSP: 0018:ffffc9000e23f7b8 EFLAGS: 00010206 [ 97.209157][ T5275] RAX: 1ffffffff1c9e3e0 RBX: 7001000033d67330 RCX: 0000000800400013 [ 97.212693][ T5275] RDX: 0000000800400014 RSI: ffffea0000f9ce00 RDI: 7000888033d67330 [ 97.216001][ T5275] RBP: 7000888033d67330 R08: 0000000000000000 R09: ffffffff8236594e [ 97.219481][ T5275] R10: dffffc0000000000 R11: fffffbfff20aeda7 R12: ffffea0000000000 [ 97.223566][ T5275] R13: 0000000000000000 R14: 70008880b3d67330 R15: dffffc0000000000 [ 97.227280][ T5275] FS: 00007fa3f1f99880(0000) GS:ffff88808c549000(0000) knlGS:0000000000000000 [ 97.231111][ T5275] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.233710][ T5275] CR2: 00007f7e2691d890 CR3: 0000000042799000 CR4: 0000000000352ef0 [ 97.236686][ T5275] Call Trace: [ 97.238005][ T5275] [ 97.239193][ T5275] qlist_free_all+0x39/0x100 [ 97.240999][ T5275] kasan_quarantine_reduce+0x148/0x160 [ 97.243153][ T5275] __kasan_slab_alloc+0x22/0x80 [ 97.245063][ T5275] ? __kmalloc_cache_noprof+0x150/0x660 [ 97.247373][ T5275] __kmalloc_cache_noprof+0x2ab/0x660 [ 97.249742][ T5275] ? __kmalloc_cache_noprof+0x150/0x660 [ 97.252196][ T5275] ? kernfs_fop_open+0x3ac/0xce0 [ 97.254306][ T5275] ? kernfs_fop_open+0x3ac/0xce0 [ 97.256239][ T5275] kernfs_fop_open+0x3ac/0xce0 [ 97.258138][ T5275] ? __pfx_kernfs_fop_open+0x10/0x10 [ 97.260213][ T5275] do_dentry_open+0x816/0x1380 [ 97.262389][ T5275] vfs_open+0x3b/0x340 [ 97.264166][ T5275] ? path_openat+0x2e2d/0x3830 [ 97.266305][ T5275] path_openat+0x2e44/0x3830 [ 97.268315][ T5275] ? kasan_save_track+0x3e/0x80 [ 97.270471][ T5275] ? do_sys_openat2+0xcc/0x200 [ 97.272547][ T5275] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.275251][ T5275] do_file_open+0x23e/0x4a0 [ 97.277217][ T5275] ? __pfx_do_file_open+0x10/0x10 [ 97.279396][ T5275] ? _raw_spin_unlock+0x28/0x50 [ 97.281478][ T5275] ? alloc_fd+0x651/0x6c0 [ 97.283411][ T5275] do_sys_openat2+0x115/0x200 [ 97.285525][ T5275] ? __pfx_do_sys_openat2+0x10/0x10 [ 97.287678][ T5275] __x64_sys_openat+0x138/0x170 [ 97.289560][ T5275] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.291988][ T5275] do_syscall_64+0x174/0x580 [ 97.293953][ T5275] ? clear_bhb_loop+0x70/0xc0 [ 97.296016][ T5275] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.298453][ T5275] RIP: 0033:0x7fa3f18a7407 [ 97.300324][ T5275] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 97.308458][ T5275] RSP: 002b:00007ffeee124fb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 97.312021][ T5275] RAX: ffffffffffffffda RBX: 00007fa3f1f99880 RCX: 00007fa3f18a7407 [ 97.315330][ T5275] RDX: 0000000000080000 RSI: 00007ffeee1250e0 RDI: ffffffffffffff9c [ 97.318672][ T5275] RBP: 000056008ab54840 R08: 0000000000000000 R09: 0000000000000000 [ 97.322081][ T5275] R10: 0000000000000000 R11: 0000000000000202 R12: 000056008ab54930 [ 97.325521][ T5275] R13: 00007ffeee1250e0 R14: 0000560067e9cca4 R15: 0000560067e9cbcc [ 97.328920][ T5275] [ 97.330218][ T5275] Modules linked in: [ 97.333061][ T5275] ---[ end trace 0000000000000000 ]--- [ 97.340727][ T5277] Bluetooth: hci0: command tx timeout [ 97.437942][ T5275] RIP: 0010:__phys_addr+0xf7/0x100 [ 97.444540][ T5275] Code: c7 e9 56 57 90 e8 19 f2 bc 00 eb 8b 48 c7 c7 f0 0f 9c 8e 48 89 de 48 89 ca 49 89 ce e8 52 bb 98 03 4c 89 f1 e9 7b ff ff ff 90 <0f> 0b 90 0f 0b 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 97.462308][ T5275] RSP: 0018:ffffc9000e23f7b8 EFLAGS: 00010206 [ 97.470330][ T5275] RAX: 1ffffffff1c9e3e0 RBX: 7001000033d67330 RCX: 0000000800400013 [ 97.474112][ T5275] RDX: 0000000800400014 RSI: ffffea0000f9ce00 RDI: 7000888033d67330 [ 97.482435][ T5275] RBP: 7000888033d67330 R08: 0000000000000000 R09: ffffffff8236594e [ 97.490345][ T5275] R10: dffffc0000000000 R11: fffffbfff20aeda7 R12: ffffea0000000000 [ 97.498343][ T5275] R13: 0000000000000000 R14: 70008880b3d67330 R15: dffffc0000000000 [ 97.506251][ T5275] FS: 00007fa3f1f99880(0000) GS:ffff88808c549000(0000) knlGS:0000000000000000 [ 97.515386][ T5275] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.518324][ T5275] CR2: 000056008a9e9ec0 CR3: 0000000042799000 CR4: 0000000000352ef0 [ 97.526511][ T5275] Kernel panic - not syncing: Fatal exception [ 97.529248][ T5275] Kernel Offset: disabled [ 97.531069][ T5275] Rebooting in 86400 seconds..