last executing test programs: 5m34.20411779s ago: executing program 3 (id=1055): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000000280), 0x307017fdb7a66cb, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000040)=0x17, 0x4) ppoll(&(0x7f0000000380)=[{r0, 0x10110}, {r2, 0x300}, {r0, 0x200}, {r0, 0x10}, {r1, 0x2002}, {0xffffffffffffffff, 0x8420}, {r0, 0x7}], 0x7, 0x0, 0x0, 0x0) unshare(0x22020400) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) getsockopt$bt_BT_RCVMTU(r3, 0x12, 0xd, 0x0, &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000002c0)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000400)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000480), 0x651, 0x0) recvmmsg(r5, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000500)=0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0xa, 0x14, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) unshare(0x24020400) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000012, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000640)={'batadv_slave_0\x00'}) fsopen(&(0x7f0000000680)='pipefs\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) 5m33.30462395s ago: executing program 3 (id=1059): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x80, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x8c2b01) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000040)=[0xfffffffa, 0x9]) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f00000022c0)={0x50, 0x0, r2, {0x7, 0x1f, 0x4001ffe, 0xa68d7c519fc00ff1, 0xffbc, 0x6, 0x1d45, 0x0, 0x0, 0x0, 0x100}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000023c0)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000043c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000004440)={0x20, 0x0, 0x68cc, {0x0, 0x14}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000004480)='./file0\x00', 0x101001, 0x0) writev(r3, &(0x7f00000044c0)=[{&(0x7f0000004500)="bc", 0x1}], 0x1) ioctl$OCFS2_IOC_RESVSP(r3, 0x402c5828, &(0x7f0000004540)={0x2, 0x2, 0x5, 0x8001, 0x2, 0x10000}) syz_usb_connect(0x6, 0x371, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000002340), 0x6ad01, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000005, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000002380)={0x1, &(0x7f0000004580)=[{0x6, 0x4, 0x7, 0x7ffc0001}]}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f00000048c0)=ANY=[@ANYBLOB="020000000a00462000000009ff0200000000000000000000000000017f00000000f56a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fc604b39db2d54c4327048ac359382bc6199949f8cd636d1c952c7470803c11da64ea12a26a4d9faf36960c0b681ae018d4f1f5c5d70dd4e6fb3555dbdacd1c467"], 0x8c) sysfs$3(0x3) close(0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000004680)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000046c0), 0x842, 0x0) ptrace$ARCH_FORCE_TAGGED_SVA(0x1e, 0x0, 0x0, 0x4004) r5 = syz_open_dev$sndmidi(&(0x7f0000004700), 0x2, 0x141102) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000004740)={{0x1, 0x1, 0x18, r4, {0x8}}, './sys/bus/pci/rescan\x00'}) writev(r5, &(0x7f0000004780)=[{&(0x7f00000047c0)="94", 0xf000}, {0x0}], 0x2) r6 = openat2$dir(0xffffffffffffff9c, &(0x7f0000004800)='./file0\x00', &(0x7f0000004840)={0x40040, 0xd2, 0xf}, 0x18) unshare(0x20000) execveat(r6, &(0x7f0000004880)='\x00', 0x0, 0x0, 0x1000) 5m32.478054508s ago: executing program 3 (id=1064): syz_usb_connect$uac2(0x3, 0x8b, 0x0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0}) setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_xfrm(0x10, 0x3, 0x6) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@bridge_newvlan={0x24, 0x76, 0x400, 0x70bd28, 0x0, {0x7, 0x2}, [@BRIDGE_VLANDB_ENTRY={0xc, 0xd, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_STATE={0x5, 0x3, 0x3}}]}, 0x24}, 0x1, 0x5502000000000000, 0x0, 0x840}, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000200)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r2, 0x80487436, &(0x7f0000000240)) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xc, &(0x7f00000003c0)="c1", 0x1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, &(0x7f00000004c0)={'\x00', 0x4, 0x2, 0x1, 0x5, 0xad, 0xffffffffffffffff}) r6 = getpid() sched_setscheduler(r6, 0x2, 0x0) r7 = openat$vcsu(0xffffff9c, &(0x7f0000000540), 0x4000, 0x0) syz_clone3(&(0x7f0000000580)={0x4001000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x32}, &(0x7f0000000300)=""/13, 0xd, &(0x7f0000000340)=""/109, &(0x7f0000000500)=[r5, r6, 0x0], 0x3, {r7}}, 0x58) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYRES16=r1, @ANYBLOB="3d0e2abd7000000080002e000000080003005213508743faae24ff4cc8d94aa66b90b96b283913b7a21dbd745b62745ded843daaa59a5fb4ce882e2719c65d99e57d3fa66b4d3e9a0907e6222de1bc1c7038e373a8ee77529e64d1e2ab7c0ac97aa0809a865067c6a3d4a5c25f141213b46996afe33de3bdfd0ddd93ed3eff656605fec461ec2d20e598cce8209209dc6e53142fd31025314217047fdf94b9a54e1af4a555dcfef8b86ddc48d6392c483263d0bf4072caea6235fff76bc0db", @ANYRES32=r4, @ANYBLOB="0a003400020202020202000006006600f02200000400cc00"], 0x34}}, 0xc840) 5m31.864430835s ago: executing program 3 (id=1065): r0 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000400)={'/sys/block/md', @num=0x0, '/md/', @array='array_state\x00'}, 0x1, 0x0) write$md_sysfs(r0, &(0x7f0000000440)=@str='active', 0x6) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000140)={@in6={{0xa, 0x0, 0xe, @loopback}}, 0x0, 0x0, 0x46, 0x0, "2431d0edd9b36cb74d7df7671eacf04be3b08353efa3641776f56c7556fd3713097bd0072577bc6fefb4cdc9e94e420b0ea4fbc5b07a32056eff5e6c42784b46ddab72b1b8fc87f208ad6db80d8dfe25"}, 0xd8) bind$inet6(r2, &(0x7f0000000240)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000280)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x14, 0x6, 0x0, @dev={0xfe, 0x80, '\x00', 0x34}, @local, {[], {{0x2, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0xffff, 0x0, 0x11}}}}}}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)={0x1c, r3, 0x800, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24008090}, 0x45c9fcf4bdf3eb61) 5m31.864079843s ago: executing program 3 (id=1066): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) 5m30.673779794s ago: executing program 3 (id=1069): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) (fail_nth: 1) 5m15.562254315s ago: executing program 32 (id=1069): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) (fail_nth: 1) 10.085233189s ago: executing program 2 (id=2696): r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000003440)=[{{&(0x7f0000000080)={0xa, 0x4e22, 0xbedd, @mcast1, 0xa5}, 0x1c, 0x0, 0x0, &(0x7f0000001dc0)=[@flowinfo={{0x10, 0x29, 0xb, 0xffe0}}], 0x10}}], 0x1, 0x4884) (fail_nth: 1) 10.084520872s ago: executing program 2 (id=2697): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="120100020000004051045f500001010203020902350001020080300904000005ff00000007058102000200070501020002000705"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) close(0x4) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 9.592844911s ago: executing program 0 (id=2701): r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/mtrr\x00', 0x2, 0x0) keyctl$unlink(0x9, 0x0, 0xfffffffffffffffe) ioctl(r1, 0xc0104d08, &(0x7f00000002c0)) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c005c55953733044f4d7000fbdbdf2501000000050067000024980e4861064dca29f3090085"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x24008080) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000aac000000060a010400000000000000000a0000010900010073797a310000000080000480500001800b0001007461726765740000400002802c0003007339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c7000000000000000000000000000000000800024000000000080001004c4544002c0001800b0001006e756d67656e00001c0002800800014000000016080003400000000008000240000000090900020073797a32"], 0xd4}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) socket$nl_generic(0x10, 0x3, 0x10) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/mtrr\x00', 0x2, 0x0) (async) keyctl$unlink(0x9, 0x0, 0xfffffffffffffffe) (async) ioctl(r1, 0xc0104d08, &(0x7f00000002c0)) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c005c55953733044f4d7000fbdbdf2501000000050067000024980e4861064dca29f3090085"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x24008080) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000aac000000060a010400000000000000000a0000010900010073797a310000000080000480500001800b0001007461726765740000400002802c0003007339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c7000000000000000000000000000000000800024000000000080001004c4544002c0001800b0001006e756d67656e00001c0002800800014000000016080003400000000008000240000000090900020073797a32"], 0xd4}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) (async) 9.501574993s ago: executing program 0 (id=2703): syz_clone(0x48000080, &(0x7f0000000000)="3d3e489f992200ce3e000000006d14", 0xf, 0x0, &(0x7f0000000040), 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r0 = userfaultfd(0x801) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) read$FUSE(r1, &(0x7f0000000340)={0x2020}, 0xfffffec1) read$FUSE(r1, &(0x7f0000002380)={0x2020}, 0xfffffce2) timer_create(0x0, 0x0, &(0x7f00000043c0)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x12, r0, 0xec776000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000004400)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0300"/21], 0x50) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000004440)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000004480)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f00000044c0)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x3, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x2000003e}, 0x0) syz_clone(0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2}, &(0x7f0000000240)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000280)={0x0, 0x4, 0x10003, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f00000002c0), 0x0, 0x800) connect$vsock_stream(r3, &(0x7f0000004500)={0x28, 0x0, 0x0, @local}, 0x10) timer_settime(r2, 0x1, &(0x7f0000004540), 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000004580)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f00000045c0)=0x2, 0x4) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000004600)=0x52, 0x4) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) 8.612746501s ago: executing program 4 (id=2704): openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x22902, 0x0) socket$key(0xf, 0x3, 0x2) openat$null(0xffffffffffffff9c, 0x0, 0x38ec1, 0x0) socket$key(0xf, 0x3, 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) io_setup(0x8, &(0x7f0000000080)) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x138}, 0x8001) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) ioctl$IOMMU_DESTROY$stdev(r4, 0x3b80, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000280)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000380)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000980)={0x28, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f00000009c0)=[{{&(0x7f0000000a00), 0x6e, 0x0}}, {{&(0x7f0000000a80), 0x6e, &(0x7f0000000b00)=[{&(0x7f0000000b40)=""/205, 0xcd}, {&(0x7f0000000c40)=""/4096, 0x1000}, {&(0x7f0000001c40)=""/101, 0x65}, {0x0}], 0x4}}], 0x2, 0x2040, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000001cc0)={0x0, 0x0, &(0x7f0000001d00)={&(0x7f0000001d40)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x1}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x1}, @NL80211_ATTR_STA_SUPPORTED_RATES={0xa, 0x13, [{0x4, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}]}, 0x44}}, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000001dc0)={0x0, 0x0, &(0x7f0000001e00)={&(0x7f0000001e40)={0x34, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x34}}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) bind$packet(r5, &(0x7f0000001e80)={0x11, 0x300, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) write(r5, &(0x7f0000001ec0)="0802110000010802110000000800450000280000000040007ce70a0000010a", 0x1f) sendmsg$NL80211_CMD_DEL_INTERFACE(r0, &(0x7f0000001f00)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000001f80)={0x1c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x0) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) 8.468046016s ago: executing program 0 (id=2707): setresuid(0x0, 0xee00, 0x0) (async) capset(&(0x7f00000000c0)={0x20080522}, &(0x7f0000000100)={0x200002, 0x200003, 0x803, 0x4, 0x7}) (async) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x61) (async) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) syz_clone3(&(0x7f0000000280)={0x204a00000, 0x0, 0x0, 0x0, {0x1a}, 0x0, 0x0, 0x0, 0x0, 0x0, {r0}}, 0x58) (async) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='ns\x00') getdents(r1, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) (async) rmdir(&(0x7f0000000340)='./cgroup/../file0\x00') (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x4) (async) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r2, &(0x7f0000000240)='8', 0x1) (async) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) unshare(0x40000000) 8.173052447s ago: executing program 4 (id=2708): r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0) syz_io_uring_complete(r2, r3) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000140)='ns/ipc\x00') setuid(0xee01) syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000002ac0)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r0, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) 7.956350931s ago: executing program 4 (id=2709): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000380), 0x318, 0x0) recvmmsg(r2, &(0x7f00000003c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000400)={0x20000014}) ustat(0x801, &(0x7f0000000080)) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f0000000440)={0xa0000001}) ppoll(&(0x7f0000000480)=[{r4, 0x1}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f00000004c0)={0x4}) r5 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r6 = syz_create_resource$futex(&(0x7f0000000140)=0x1) futex(r6, 0x85, 0x0, 0x0, 0x0, 0x2) close(r0) setpriority(0x0, 0x0, 0x2a14b53) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x9, 0x0, 0x7fc00100}]}) io_uring_setup(0x666, &(0x7f00000001c0)={0x0, 0x284f, 0x40, 0xfffffffe, 0x235}) syz_io_uring_submit(0x0, r5, 0x0, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x4, 0x0, @fd=r7, 0x0, 0x0, 0x8, {0x11}, 0x1}) close(0x3) socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000700)=0x2005, 0x4) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) 7.332765615s ago: executing program 1 (id=2710): r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000000100)=[{{&(0x7f0000000180)={0xa, 0x4e20, 0x47e4, @dev={0xfe, 0x80, '\x00', 0x3a}, 0x7}, 0x1c, 0x0, 0x0, &(0x7f0000000300)=[@rthdr_2292={{0x28, 0x29, 0x39, {0x73, 0x2, 0x2, 0x1, 0x0, [@local]}}}], 0x28}}], 0x1, 0x0) (fail_nth: 2) 6.574430769s ago: executing program 2 (id=2711): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioctl$UI_SET_ABSBIT(0xffffffffffffffff, 0x40045567, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_clone(0x0, 0x0, 0x9, 0x0, 0x0, 0x0) wait4(r1, 0x0, 0x80000000, 0x0) ptrace(0x10, r1) r2 = syz_pidfd_open(r1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0xffff, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) waitid$P_PIDFD(0x3, r2, 0x0, 0xa000000c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="0210ef050a0000002dbd7000ffdbdf25080012"], 0x50}}, 0x840) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) capset(&(0x7f0000000000)={0x0, r1}, &(0x7f0000000080)={0x7fff, 0x0, 0x8, 0x6, 0xc88, 0x4}) ioctl$BINDER_GET_EXTENDED_ERROR(r0, 0xc00c6211, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$rfkill(0xffffffffffffff9c, 0x0, 0x6ad01, 0x0) tgkill(r1, r1, 0x39) writev(r5, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) r6 = syz_clone(0x4020000, &(0x7f0000000100)="f26e473c45b48087b3cbd79fe8cc81df176bfd0dcfeb135ca010c9d6d621e548a95b2ab83f8ededf54bd7ba12e1bb6b66542d1f097131c51cfb19469f94f01f69f48b6f43744f8296c5e462ef03180584dc6995cc5262e1b4c8614abb1161090de8bd255687c10e4726b6be427d8439ec2c7982f2623c18228a59a9c05011666cfe03201f05cfe0333cd526e482d01a90cd882f31480eec352b14b187b89eb56fd7e2ccdfa9bf89a113f36eb0bd45b", 0xaf, &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)="63ecb3e32d46fa166a6914fe5f89469c344961e805985a5402b075ee6dd24b55530095d3a2341b45820f2911c7255e64e6d93b0f8e2b16574ce243793e8d102c68e627eca45b646c796459e2b95736bfa3462d5a8428fb0879a4603638c45bbf773d68ee08d165307d7962292eb84251506ef0414bfb35759384f7eb7379d87d52eb1b3cc1578b939130368bea5f203179950cb0a7543060df16cf50bb7b16ec615e7e") prlimit64(r6, 0x8, &(0x7f0000000340)={0x0, 0xfffffffb}, &(0x7f00000003c0)) close(r5) 6.573902958s ago: executing program 1 (id=2712): mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) socket$netlink(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(r0, &(0x7f0000000180)='./file0\x00', 0x416d, 0x39) socket$nl_generic(0x10, 0x3, 0x10) r2 = shmget(0x1, 0x8000, 0x200, &(0x7f0000ff8000/0x8000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/uts\x00') r4 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f0000000080)=0x1) ioctl$NS_GET_USERNS(r3, 0xb701, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r5, &(0x7f0000000140), 0x0) openat$comedi(0xffffff9c, 0x0, 0x50000, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r6, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4) r7 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000540)={'veth0_to_hsr\x00', 0x0}) r9 = socket(0x2d, 0x2, 0x0) bind$xdp(r9, &(0x7f0000000580)={0x2d, 0x0, r8, 0xc}, 0x10) r10 = socket(0x2d, 0x2, 0x0) bind$xdp(r9, &(0x7f00000005c0)={0x2d, 0x0, 0x0, 0xc, r1}, 0x10) close(r10) bind$inet(r6, &(0x7f00000002c0)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r6, &(0x7f0000000300)=[{{&(0x7f0000000340)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000380)=[{&(0x7f00000003c0)="b9cd14c222ee", 0x4b}], 0x1}}], 0x49, 0x20008000) recvmmsg(r6, &(0x7f0000000400)=[{{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, &(0x7f0000000440)=[{0x0}, {&(0x7f0000000480)=""/180, 0xb4}], 0x2}, 0x1}], 0x2, 0x100, 0x0) 6.559624559s ago: executing program 4 (id=2713): r0 = socket$key(0xf, 0x3, 0x2) r1 = gettid() rt_sigtimedwait(&(0x7f0000000000)={[0xe]}, 0x0, 0x0, 0x8) r2 = socket$inet6(0xa, 0x2, 0x0) add_key(&(0x7f0000000640)='asymmetric\x00', 0x0, &(0x7f0000000780)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f3231323230343234323233323429436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b39fdca02c99800be89b7ef5ef71e2", 0x559, 0xfffffffffffffffb) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, 0x0, 0x0) tkill(r1, 0x4) r3 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x1000, 0x40002, 0x1e1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, r3, r4, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x3, 0x462, 0x0, 0x0, 0x1000, 0x7, 0x0, 0x0, 0x13}}}, &(0x7f0000000240)) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000e00)=r6, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="990000001700010007080000"], 0xff2e}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x8031, 0xffffffffffffffff, 0x4000) munlock(&(0x7f000051e000/0x7000)=nil, 0x7000) sendmsg$key(r0, &(0x7f00000006c0)={0x40000000, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=ANY=[@ANYRES32=r0], 0x10}}, 0x40) 5.642342806s ago: executing program 0 (id=2714): r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000240)={0x0, 0x100, 0x100}, &(0x7f00000002c0)=0x0, &(0x7f0000000340)=0x0, &(0x7f00000006c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000700)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000780)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, &(0x7f00000007c0)=0x0) r8 = syz_open_dev$ublk_chdev(&(0x7f0000000800), r5, 0x2) syz_ublk_setup_queues(r8, r7, &(0x7f0000000840)={0x0, 0x3e0e, 0x0, 0x3, 0x28e, 0x0, r1}, &(0x7f00000008c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb8c3, 0x40000, 0x2, 0x1af, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6, 0x2, 0x0, 0x330, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7669, 0x4000, 0x0, 0x2db, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5027, 0x2, 0x400, 0x1fe, 0x0, r1}}], 0x4, &(0x7f0000000b40)={0x2e, 0x0, 0x0, r8, 0xc0107525, 0x0, 0x20000700, 0x0, 0x1, {0x10}, 0x0, r6, '\x00', {0x3, 0xb52, 0x100104, 0x0}}, &(0x7f0000000bc0)) 5.395945403s ago: executing program 1 (id=2715): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32, @ANYBLOB="0000009230adac0000000000000000000000004e", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x15, 0x17, &(0x7f00000007c0)=ANY=[@ANYBLOB="1807000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000180100002020702500000000002020207b1bf8ff00000000bda1000000000000a7010000f8ffffffb702000008000000b7030000000000007209000006000000bf91000000000000b5020000000000008500000085000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32, @ANYBLOB="0000009230adac0000000000000000000000004e", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x15, 0x17, &(0x7f00000007c0)=ANY=[@ANYBLOB="1807000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000180100002020702500000000002020207b1bf8ff00000000bda1000000000000a7010000f8ffffffb702000008000000b7030000000000007209000006000000bf91000000000000b5020000000000008500000085000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) 4.830054115s ago: executing program 1 (id=2716): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000004c0)='14', 0x2) mknodat$loop(r0, 0x0, 0x40, 0x0) socket(0x2b, 0x80801, 0x1) 4.498932152s ago: executing program 1 (id=2717): mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) socket$netlink(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(r0, &(0x7f0000000180)='./file0\x00', 0x416d, 0x39) socket$nl_generic(0x10, 0x3, 0x10) r2 = shmget(0x1, 0x8000, 0x200, &(0x7f0000ff8000/0x8000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/uts\x00') r4 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f0000000080)=0x1) ioctl$NS_GET_USERNS(r3, 0xb701, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r5, &(0x7f0000000140), 0x0) openat$comedi(0xffffff9c, 0x0, 0x50000, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r6, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4) r7 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000540)={'veth0_to_hsr\x00', 0x0}) r9 = socket(0x2d, 0x2, 0x0) bind$xdp(r9, &(0x7f0000000580)={0x2d, 0x0, r8, 0xc}, 0x10) r10 = socket(0x2d, 0x2, 0x0) bind$xdp(r9, &(0x7f00000005c0)={0x2d, 0x0, 0x0, 0xc, r1}, 0x10) close(r10) bind$inet(r6, &(0x7f00000002c0)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r6, &(0x7f0000000300)=[{{&(0x7f0000000340)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000380)=[{&(0x7f00000003c0)="b9cd14c222ee", 0x4b}], 0x1}}], 0x49, 0x20008000) recvmmsg(r6, &(0x7f0000000400)=[{{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, &(0x7f0000000440)=[{0x0}, {&(0x7f0000000480)=""/180, 0xb4}], 0x2}, 0x1}], 0x2, 0x100, 0x0) 4.263065507s ago: executing program 0 (id=2718): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC=0x0], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r2, 0x0, 0x0) write$char_usb(r1, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 4.131769233s ago: executing program 4 (id=2719): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./mnt\x00', 0x1ff) mount$nfs(0x0, &(0x7f0000000400)='./mnt\x00', &(0x7f0000000440), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='addr=127.0.0.1,port=204049']) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_io_uring_setup(0x3b88, &(0x7f0000000fc0)={0x0, 0xa009b5, 0x10, 0x3, 0x2bc}, &(0x7f0000001040), &(0x7f0000001080), &(0x7f00000010c0)) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000001100)=[{&(0x7f0000001140)=""/27, 0x1b}], 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r4 = openat$sr(0xffffff9c, &(0x7f0000000840), 0x0, 0x0) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000008c0), r1) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000009c0)={'ip_vti0\x00', &(0x7f0000000900)={'syztnl2\x00', 0x0, 0x7, 0x80, 0x9, 0x100, {{0x25, 0x4, 0x1, 0x2f, 0x94, 0x65, 0x0, 0x5, 0x2f, 0x0, @multicast2, @local, {[@timestamp={0x44, 0x14, 0x9, 0x0, 0xd, [0x3, 0x8, 0x1ff, 0x9]}, @timestamp_addr={0x44, 0x44, 0x59, 0x1, 0x8, [{@multicast2}, {@remote, 0x1ff}, {@dev={0xac, 0x14, 0x14, 0x43}, 0x8}, {@rand_addr=0x64010100, 0x5}, {@remote, 0x9}, {@dev={0xac, 0x14, 0x14, 0xe}, 0xe98c}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xb0a8}, {@multicast1, 0x3}]}, @ssrr={0x89, 0x1f, 0x3f, [@local, @private=0xa010101, @empty, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010102, @multicast1]}, @generic={0x94, 0x7, "8013363eb9"}, @noop]}}}}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000cc0)={0xffffffffffffffff, 0xe0, &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000a00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x8, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000a80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xdb, &(0x7f0000000ac0)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x40, 0x10, &(0x7f0000000b00), &(0x7f0000000b40), 0x8, 0x4c, 0x8, 0x8, &(0x7f0000000b80)}}, 0x10) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0500000004000000080000000f00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000088b02084a1297b3116899d6adca8636e7a06928678da3106e542df7bb8135102d08e31c0d9fc9afecfc36d5ddf9d4266d9e2054f7cffd70c8674917257db4bfd13c89bd24ef04867f3edfce306e9274462c33286bb9d40b2020000379ae55af4cd5f427bbbd932ff5dcf0667abc3ba5e1e7d2b05c8ab871457c0387a057f06b10547355113727d858703c9ce94dd173115f9a40d4950afd516"], 0x50) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001200)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000001010000000000000000000800"/28], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001280)={r9}, 0x4) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000012c0)=@base={0xe, 0x4, 0x8, 0xb}, 0x50) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000001340)={0x11, 0x19, &(0x7f0000000540)=ANY=[@ANYRESDEC=r4, @ANYBLOB="8f71741f8d3f3f0d6fa8e6061e2907b6429edb4ad3b363202b69e9771019ec9cd56f6e5e3ff4e31aa26d3c398981b6d87e067160e02c3a5851509950b04b8b379e6254cb4da24e3935206aa7cfc0e886f6a7a2b271b13f9de07449353532902873db3e5c4b52ba0a903e97ccf66db273c9a1a64d208095eb75d126959860efb62127ea040458bbca990d11a6d76023f4c2f3fd7f247155d1e3d1af7e57596ee55397e6e8642868037decf3503eaaceb50e5fe6e8f80e411da4f71d7038b63aa18ca1b9dbf76c85e02a"], &(0x7f0000001500)='GPL\x00', 0x3, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000001540)={r10, r8}, 0xc) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000d00)={'syzkaller0\x00', 0x0}) r13 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r13, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000dc0)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r12, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$ETHTOOL_MSG_EEE_GET(r4, &(0x7f0000000f80)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000f40)={&(0x7f0000001400)=ANY=[@ANYBLOB="b4000000", @ANYRES16=r5, @ANYBLOB="220825bd7000fedbdf251700000020000180140002006272696467655f736c6176655f30000008000300010000000c00018008000300040000004000018008000100baf721e5883993d7e7994724fafbb31cbf", @ANYRES32=r6, @ANYBLOB="140002007465616d5f736c6176655f310000000008000300030000000800030000000000080003000100000008000100", @ANYRES32=r7, @ANYBLOB="340001801400020074756e6c30000000000000000000000008000100", @ANYRES32=r12, @ANYBLOB="140002006261746164765f736c6176655f310000"], 0xb4}, 0x1, 0x0, 0x0, 0x88000}, 0x4000840) sendmsg$DEVLINK_CMD_PORT_GET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="658c2abd7000fcdbdf25050000000e0001006ed82e657464657673696d0000000f0002006e657464657673696d30000008b374000200"], 0x3c}, 0x1, 0x0, 0x0, 0x4000895}, 0x8000) sendmsg$DEVLINK_CMD_TRAP_GET(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000340)={&(0x7f0000001580)=ANY=[@ANYBLOB="ac18002b8e27f9fe3f6600e55aa954605f00", @ANYRES16=r3, @ANYBLOB="000425bd7000fddbdf253d000000080001007063690011000200303030303a30303a31302e30000000001c008200736f757263655f6d61635f69735f6d756c746963617374000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c008200736f757263655f6d61635f69735f6d756c746963617374000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c008200736f757263655f6d61635f69735f6d756c746963617374000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c008200736f757263655f6d61635f69735f6d756c74696361737400080001007063690011000200303030303a30303a31302e30000000001c008200736f757263655f6d61635f69735f6d756c746963617374000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c008200736f757263655f6d61635f69735f6d756c74696361737400080001007063690011000200303030303a30303a31302e30000000001c008200736f757263655f6d61635f69735f6d756c74696361737400"], 0x1ac}, 0x1, 0x0, 0x0, 0x1}, 0x80) sendmmsg$inet6(r0, &(0x7f0000003440)=[{{&(0x7f0000000080)={0xa, 0x4e22, 0xbedd, @loopback, 0xa5}, 0x1c, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="100000002950a622b188f79a9850bf0d45320000000b0000d7b071060247227971c5ad71174b3e757569192dba57de9e3f9e371e020825cc51e223ad6ee708ebe45d0892ed2370cdf6aa110e7f8f475b85c726a678886a36d4980638870c108d9a2e4c75022ea68fe900000000000000"], 0x10}}], 0x1, 0x4004884) r14 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1f, 0x5, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000001100000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3a) 2.449544728s ago: executing program 2 (id=2720): openat$comedi(0xffffffffffffff9c, 0x0, 0x80400, 0x0) openat(0xffffffffffffffff, &(0x7f0000000000)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0xc, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000280), 0x2, 0x4a102) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000340)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0x2, 0x7, 0x2) socket(0x10, 0x2, 0x0) rseq(&(0x7f0000000380)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000003c0)=0x1, 0x4) bind$rds(r1, &(0x7f0000000400)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r1, &(0x7f0000000440)={&(0x7f0000000480)={0x2, 0x4e21, @local}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000500)=""/111, 0x6f}], 0x1, &(0x7f0000000580)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x42}], 0x18, 0x40080}, 0x4000000) recvmmsg(r1, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/216, 0x34}, 0x10001}], 0x2, 0x40010000, 0x0) clock_adjtime(0x0, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000700), 0x7, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r2, 0xc0f8565c, &(0x7f0000000740)={0x1ff, 0x5, 0x1, {0x1, @pix={0xff, 0xa, 0x31324d4e, 0x0, 0x9, 0xffffff61, 0x9, 0x9, 0x0, 0x7, 0x2, 0x6}}, 0xd5a}) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$sysfs(0xffffff9c, &(0x7f0000000840)='/sys/power/pm_test', 0x4000, 0x4) sendmmsg$alg(r3, &(0x7f0000000880)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)=[@iv={0x10}, @iv={0x10}], 0x20, 0x4880}, {0x0, 0x0, &(0x7f0000000940)=[{0x0}, {&(0x7f0000000980)="a27e751b506316d107c78c782937d6f33110862675b0cf4dd973f8161521f90c77ae4f26", 0x24}, {&(0x7f00000009c0)="946bcac2250f0a616e8f94e1baf7b9138cced2ccf8f2b4fe1e1a49f73250e614790249b84c8ee0ac47c0522e6c5da4f2f6b159d442a2d87aea70f7bdaf01436c4dce087aaff4696c77b8e973c587ecd7bb5fb2112e02f5df43bfa918e9f3026c9dff6f89975f76fcbecb71b5e8513c81f57cdeb0f24b6f767bc017ceea83", 0x7e}], 0x3, &(0x7f0000000a40)=[@op={0x10, 0x117, 0x3, 0x1}], 0x10}, {0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000ac0)="3398a4", 0x3}], 0x1, &(0x7f0000000b00)=[@assoc={0x10, 0x117, 0x4, 0x9}, @op={0x10, 0x117, 0x3, 0x1}, @op={0x10}], 0x30, 0x804c044}, {0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000b80)="a0ea6ea3427cef817dd7f81fd0efb568b0042fa10ff6e6e4e392e66e8a34d95fe4c9992b92ec54c266480c85ff0a76466f1ce133f0cc4a6590e68fe866b01294bbcd429977fc947d8c9303e5c96ce7a2457b795806086a68f4f32f4b2176d8ba50d133f85ead618af914d9787ba92896babebf4051c3f9e2c84e15ef7a0b9d30129b4d5d9e254dc15d6614384e817bf75584609c24a00c06c9d319", 0x9b}, {&(0x7f0000000c40)="22509617adb91afa439b1f9b00ab2e15ab77ecc52cf6f6a79073d4a1f8166a86c20833c2527209467f628723fdbb88bad4b80d4c8a63d029eefb08cf461f2d433478", 0x42}, {&(0x7f0000000cc0)="059af19a024c264d6e2a18d4bdcf804e2a17fee1863f29cda5134d6197b20382f5ff8b4d346a3bcf96877ea76e6ce26157409b0aca740a4806e568b7b16951be81bc3ea73611fe43127c2a8bb9b80c3b040dd6c4ba23f70ec96b57444fe9ccd69c5d43024e04ab16d43d6b7147ccfc448f573f5427a47cf6e7360ae611cf13d8cf03c736daaadc8187a36c559901c37f67d42921a2c8ff5c2d1f417d40b047b97ee0087bc2b896c44822e3876a58e27b32645bc00ad073733b35f160c47a569b7bb06ad4d65bd64dc2b6295132bb035fce916b5a230d3b6b308b122e360d7b8a28a2", 0xe2}, {0x0}, {&(0x7f0000000dc0)="e6195fc805a6f8c49b717a2366b3610d2f1b646ffc85b7155922cdecf64ecd4d21849bcbfe4b8a5e4bbe74ea48beb9330f6ef93d5de44210850678c387ee6fdd0ed5efade60c12cf6cb08c683343934f1fc156a85e2c243d1abb962a425de7a1d2a7fc91e8c8928825204bf4615cf7e06d754e7e42cbca7b3c776c20174c5c8f8324b08633a7e517f6fbde324c557b78280872b174f30ee2fd8c06a7be9cd2", 0x9f}, {&(0x7f0000000e80)="9f151fd0f92644ca6a7fa73237bff578a7875549783e18c77f5d88a2323668c9334e5450243cfff2df0d5d1ebcc6052ae3e0edbc082b6e3163418151b361bd166bbde8b59a67f88095cacb949d0d68753be0ccfe6b51f180b0b71c098bd0049d74ea0ae906f016a3606b1cf40aa4872e9b30f00a7ce7e51b363651be2c6f59b3d656d7627d34afcdad559c475461c394ac41d328cdccc4f11e8fd078c9b1d1207801e6cbf31922692048e3ac4a84", 0xae}, {&(0x7f0000000f40)="f9bee3476b931125ba7ae463e3c95db05048f2a4a5cd858a744e9058a13c7720eb751bac0f701da57b44befb73d2d5da9e7b9fbd6c544f2cb45df193860fd17352c817740c817af933b1cb9f2a83f81e013b0a369869c6ea4c83e01703d5900be2d6beda7efd6cc05677c70146b3771c5b9a1f0b72fd72fd35dbec03f7201b919810cbc3991b36604f72abc45b7eeae32bb72a0ab1d635ea248b0e75bced85d5a4040b776fd2ecda93974fba7f", 0xad}], 0x7, &(0x7f0000001000)=[@op={0x10}, @iv={0xa4, 0x117, 0x2, 0x91, "ce0faff8d5f8795f6467cda21010882ca780911951398e64c9322a6af2f3b766d1abba4dee1c7c5a883aaadba192581e7a1d2a90d97d3ef1a2d97de1010061888c0b016b9a17bc624b7ac63fd7f4d50a02f58a1c639c4e3a3fb3206ad7326b2eb150391e18285943f0ca2f1703d893ff4b593a9d71358f359b6998c020704356647b5239d7dc96072c2c285ce633fe8c3e"}, @op={0x10}], 0xc4, 0x4800}], 0x4, 0x190) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x102) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x2, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/kmsg\x00', 0x101001, 0x42) io_setup(0x101, &(0x7f0000000140)=0x0) io_submit(r5, 0x1, &(0x7f0000000300)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0xa, r4, 0x0, 0x4000, 0x1, 0x0, 0x0, r4}]) 2.360753097s ago: executing program 1 (id=2721): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="120100020000004051045f500001010203020902350001020080300904000005ff00000007058102000200070501020002000705820200020007050202"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) close(0x4) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 1.361912273s ago: executing program 2 (id=2722): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f0000000040)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x1200000, 0x7}]}) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f00000000c0)={0x2, 0x0, [{0x1b, 0x0, 0xfee00d00}, {0x832, 0x0, 0x40000}]}) ioctl$KVM_GET_MSRS_cpu(r4, 0xc008ae88, &(0x7f0000000100)={0x1, 0x0, [{0x839}]}) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r5, 0x28, 0x2, &(0x7f0000000300)=0x33, 0x8) connect$vsock_stream(r5, &(0x7f0000000340)={0x28, 0x0, 0x2711}, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000180)={0x1f, 0xffff, 0x3}, 0x6) write(r6, &(0x7f00000001c0)="5600000011002914000602080000000000000400200000", 0x17) r7 = syz_open_dev$vim2m(&(0x7f0000000200), 0x12, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r7, 0xc0405602, &(0x7f00000002c0)={0x11, 0x0, 0x0, "ad2896b02c596364ab192cb8b873aa00", 0x33424752}) r8 = accept4(r0, 0x0, 0x0, 0x0) sendto(r8, &(0x7f0000000000), 0xfeb5, 0x0, 0x0, 0x0) recvfrom(r1, &(0x7f0000000240)=""/70, 0x46, 0x0, 0x0, 0x0) 241.007673ms ago: executing program 0 (id=2723): r0 = epoll_create1(0x80000) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000180)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f00000001c0)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f0000000200)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x20004040) socket(0x10, 0x803, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r2, &(0x7f00000003c0), 0x8) vmsplice(r3, &(0x7f0000000400)=[{&(0x7f0000000440)='w', 0x1}], 0x1000000000000181, 0x1) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_int(r4, 0x6, 0x3, 0x0, &(0x7f0000000100)) socket$inet6(0xa, 0x2, 0x0) r5 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r5, &(0x7f0000000040)="1ba0000016001d0d89fdc5cbdd045798707bed4dca141a780f0f8e", 0xff3b, 0x0, 0x0, 0x0) recvfrom(r5, 0x0, 0x0, 0x100, 0x0, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r6, 0x8916, &(0x7f00000000c0)={@private2={0xfc, 0x2, '\x00', 0x6}, 0x4f, r7}) recvfrom$inet6(r5, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f0000000280)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r8, 0x7a0, &(0x7f00000002c0)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r8, 0x7a8, &(0x7f0000000300)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e, 0xfffffffffffffff9, 0x0, 0x0, 0xfffffffc}) close(r8) epoll_create1(0x0) dup2(r1, r0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000000480)={0xa0000001}) 87.541183ms ago: executing program 4 (id=2724): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./security\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x141102) writev(r0, &(0x7f0000000280)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000300)=[@in={0x2, 0x4e20, @empty}], 0x10) r2 = syz_open_dev$sg(&(0x7f0000000340), 0x0, 0x802) writev(r2, &(0x7f0000000380)=[{&(0x7f0000000400)="2efdda9d240103005a90f57f02703aeff0f64eb9ee07962c220852f426072a00"/42, 0x2a}], 0x1) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000440)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)={0x2, 0x4, 0x4, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0xfffffffd}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x1ff) mount(&(0x7f0000000580)=@filename='mtd0\x00', &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000640)='./file0\x00') setxattr$system_posix_acl(0x0, &(0x7f00000000c0)='system.posix_acl_default\x00', 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000006c0)='memory.events\x00', 0x275a, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000700)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000740)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_GET_EVENT(r3, &(0x7f0000000780)={0xc, 0x8, 0xfa00, {0x0}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r3, &(0x7f00000007c0)={0x18, 0x110, 0xfa00, {r4, 0x7fffffff, 0x12, 0x0, 0x0, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e20, @loopback}}}, 0x118) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000900)={0x209d, 0x0, 0x4, 0x1f}, 0x10) write(r5, &(0x7f0000000940)="1800000016005f0214fffffffffffff80700000001000000", 0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000000980)='./file2\x00', 0x0) openat$hpet(0xffffffffffffff9c, 0x0, 0x80080, 0x0) 0s ago: executing program 2 (id=2725): pause() r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @broadcast}, 0x10) pause() connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) setsockopt$inet_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000280)='espintcp', 0x8) write(r0, &(0x7f0000000380)="a52e", 0x2) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x1002}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16, @ANYBLOB="01070000000000000000670000f4070001"], 0x28}, 0x1, 0x0, 0x0, 0x85}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010000500"/20, @ANYRESHEX=r1, @ANYRESOCT=r4, @ANYRES32=r4], 0x3c}}, 0x0) write(r1, &(0x7f0000000240)="ffffffffffff0011223344554305000f32001800000100112233445500112233445500ff0000", 0xfdef) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = getpid() ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0186405, &(0x7f00000006c0)={0x7fffffff, 0x1, {0x0}, {0xee01}, 0x7, 0x6}) recvfrom$binder_report(0xffffffffffffffff, &(0x7f0000000700)={""/44, 0x0}, 0x80, 0x10061, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000780)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000800)=0x0) r11 = syz_open_dev$audion(&(0x7f0000000880), 0x2464, 0x4c8001) syz_clone3(&(0x7f00000008c0)={0x4000, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), {0x1f}, &(0x7f00000005c0)=""/42, 0x2a, &(0x7f0000000600)=""/177, &(0x7f0000000840)=[r6, r7, r8, r9, r10], 0x5, {r11}}, 0x58) listen(r5, 0x5) eventfd2(0x0, 0x0) io_setup(0x4, &(0x7f0000000200)=0x0) io_pgetevents(r12, 0x2, 0x2, &(0x7f0000000440)=[{}, {}], 0x0, 0x0) io_submit(r12, 0x1, &(0x7f0000000480)=[&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x5, 0x0, r5, 0x0}]) shutdown(r5, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40046607, &(0x7f0000000000)=0x452) kernel console output (not intermixed with test programs): : device descriptor read/64, error -71 [ 775.700742][T15947] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2506'. [ 775.722433][ T3416] usb usb6-port1: attempt power cycle [ 776.353448][T15963] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2513'. [ 776.517355][ T3416] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 776.618175][ T3416] usb 6-1: device descriptor read/8, error -71 [ 776.911037][T15961] pim6reg: entered allmulticast mode [ 776.911764][T15948] pim6reg: left allmulticast mode [ 777.092896][ T5902] net_ratelimit: 30 callbacks suppressed [ 777.092912][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 777.092927][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 777.092940][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 777.092953][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 777.132093][ T3416] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 777.602356][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 777.602387][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 777.602404][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 777.602423][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 777.748641][ T3416] usb 6-1: device descriptor read/8, error -71 [ 777.804045][ T5165] usb 7-1: new high-speed USB device number 96 using dummy_hcd [ 777.889875][ T3416] usb usb6-port1: unable to enumerate USB device [ 777.918739][T15951] pci 0000:00:03.0: [1af4:1005] type 00 class 0x00ff00 conventional PCI endpoint [ 777.925168][T15951] pci 0000:00:03.0: BAR 0 [io 0xc0a0-0xc0bf] [ 777.925254][T15951] pci 0000:00:03.0: BAR 1 [mem 0xfeaf7000-0xfeaf7fff] [ 777.925491][T15951] pci 0000:00:03.0: BAR 4 [mem 0xfe200000-0xfe203fff 64bit pref] [ 777.941448][T15951] pci 0000:00:03.0: Adding to iommu group 3 [ 777.945677][T15968] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000080: 0x00c0 instead [ 777.945720][T15968] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000084: 0x0030 instead [ 777.945745][T15968] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000000c0: 0x0030 instead [ 777.945764][T15968] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000000c4: 0x0024 instead [ 777.945781][T15968] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000000d4: 0x0057 instead [ 777.945797][T15968] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000000dc: 0xfff1 instead [ 777.945813][T15968] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000000e4: 0x000c instead [ 777.945828][T15968] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000000e8: 0x6e69 instead [ 777.945843][T15968] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000000ec: 0x7365 instead [ 777.945867][T15968] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000100: 0x7973 instead [ 777.945884][T15968] jffs2: Further such events for this erase block will not be printed [ 777.946332][T15968] jffs2: Empty flash at 0x00001434 ends at 0x00001438 [ 777.955347][T15951] pci 0000:00:03.0: BAR 4 [mem 0x580200000-0x580203fff 64bit pref]: assigned [ 777.958711][T15951] pci 0000:00:03.0: BAR 1 [mem 0x81001000-0x81001fff]: assigned [ 777.960282][T15951] pci 0000:00:03.0: BAR 0 [io 0x2020-0x203f]: assigned [ 777.978748][ T5165] usb 7-1: Using ep0 maxpacket: 32 [ 778.042608][ T5165] usb 7-1: New USB device found: idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 778.043796][ T5165] usb 7-1: config index 0 descriptor too short (expected 156, got 27) [ 778.043829][ T5165] usb 7-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 778.043868][ T5165] usb 7-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 778.043894][ T5165] usb 7-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 778.043917][ T5165] usb 7-1: config 0 interface 0 has no altsetting 0 [ 778.046563][ T5165] usb 7-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 778.046585][ T5165] usb 7-1: Product: syz [ 778.046597][ T5165] usb 7-1: Manufacturer: syz [ 778.046610][ T5165] usb 7-1: SerialNumber: syz [ 778.049164][ T5165] usb 7-1: config 0 descriptor?? [ 778.083392][T15951] hwrng_fill thread creation failed [ 778.093083][ T5165] ldusb 7-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 778.094618][ T5165] ldusb 7-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 778.124878][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 778.124910][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 778.167567][T15971] netlink: 'syz.4.2518': attribute type 1 has an invalid length. [ 778.180599][T15971] netlink: 'syz.4.2518': attribute type 10 has an invalid length. [ 778.180620][T15971] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2518'. [ 778.182787][T15971] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 778.255846][T15977] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 778.363454][T15966] ldusb 7-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 778.364199][ T5165] usb 7-1: USB disconnect, device number 96 [ 778.364300][ C3] ldusb 7-1:0.0: usb_submit_urb failed (-19) [ 778.370622][ T5165] ldusb 7-1:0.0: LD USB Device #0 now disconnected [ 778.380458][T15982] ldusb: No device or device unplugged -19 [ 778.435001][T15968] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 778.435019][T15968] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 64 [ 778.521298][T15981] block nbd0: NBD_DISCONNECT [ 778.784142][ T43] kauditd_printk_skb: 2415 callbacks suppressed [ 778.784162][ T43] audit: type=1326 audit(1794365627.340:49655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15985 comm="syz.1.2523" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7fc00000 [ 778.784207][ T43] audit: type=1326 audit(1794365627.350:49656): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15985 comm="syz.1.2523" exe="/syz-executor" sig=0 arch=40000003 syscall=332 compat=1 ip=0xf73aefbc code=0x7fc00000 [ 778.784244][ T43] audit: type=1326 audit(1794365627.350:49657): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15985 comm="syz.1.2523" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7fc00000 [ 778.784279][ T43] audit: type=1326 audit(1794365627.350:49658): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15985 comm="syz.1.2523" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7fc00000 [ 778.784314][ T43] audit: type=1326 audit(1794365627.350:49659): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15985 comm="syz.1.2523" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7fc00000 [ 778.784349][ T43] audit: type=1326 audit(1794365627.350:49660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15985 comm="syz.1.2523" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7fc00000 [ 778.784384][ T43] audit: type=1326 audit(1794365627.350:49661): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15985 comm="syz.1.2523" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7fc00000 [ 778.784419][ T43] audit: type=1326 audit(1794365627.350:49662): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15985 comm="syz.1.2523" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7fc00000 [ 778.784454][ T43] audit: type=1326 audit(1794365627.350:49663): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15985 comm="syz.1.2523" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7fc00000 [ 778.784488][ T43] audit: type=1326 audit(1794365627.350:49664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15985 comm="syz.1.2523" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7fc00000 [ 779.392112][ T30] usb 7-1: new high-speed USB device number 97 using dummy_hcd [ 779.522118][ T30] usb 7-1: device descriptor read/64, error -71 [ 779.607571][T16011] netlink: 'syz.0.2529': attribute type 1 has an invalid length. [ 779.620239][T16011] netlink: 'syz.0.2529': attribute type 10 has an invalid length. [ 779.620254][T16011] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2529'. [ 779.620333][T16011] bridge0: port 4(batadv0) entered blocking state [ 779.620437][T16011] bridge0: port 4(batadv0) entered disabled state [ 779.627455][T16011] batadv0: failed to initialize vlan filtering on this port [ 779.637264][T16011] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 779.772215][ T30] usb 7-1: new high-speed USB device number 98 using dummy_hcd [ 779.776287][T16018] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2530'. [ 779.904293][ T30] usb 7-1: device descriptor read/64, error -71 [ 780.026544][ T30] usb usb7-port1: attempt power cycle [ 780.312158][ T3416] usb 9-1: new high-speed USB device number 34 using dummy_hcd [ 780.372209][ T30] usb 7-1: new high-speed USB device number 99 using dummy_hcd [ 780.402922][ T30] usb 7-1: device descriptor read/8, error -71 [ 780.465441][ T3416] usb 9-1: Using ep0 maxpacket: 32 [ 780.466739][ T3416] usb 9-1: New USB device found: idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 780.467765][ T3416] usb 9-1: config index 0 descriptor too short (expected 156, got 27) [ 780.467799][ T3416] usb 9-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 780.467830][ T3416] usb 9-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 780.467859][ T3416] usb 9-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 780.467881][ T3416] usb 9-1: config 0 interface 0 has no altsetting 0 [ 780.469800][ T3416] usb 9-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 780.469821][ T3416] usb 9-1: Product: syz [ 780.469833][ T3416] usb 9-1: Manufacturer: syz [ 780.469858][ T3416] usb 9-1: SerialNumber: syz [ 780.471861][ T3416] usb 9-1: config 0 descriptor?? [ 780.477732][ T3416] ldusb 9-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 780.481230][ T3416] ldusb 9-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 780.652180][ T30] usb 7-1: new high-speed USB device number 100 using dummy_hcd [ 780.682838][ T30] usb 7-1: device descriptor read/8, error -71 [ 780.785943][T16023] ldusb 9-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 780.786293][ T5165] usb 9-1: USB disconnect, device number 34 [ 780.786330][T16029] ldusb 9-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 780.786425][ C0] ldusb 9-1:0.0: usb_submit_urb failed (-19) [ 780.790406][ T5165] ldusb 9-1:0.0: LD USB Device #0 now disconnected [ 780.806304][ T30] usb usb7-port1: unable to enumerate USB device [ 781.581128][T16037] FAULT_INJECTION: forcing a failure. [ 781.581128][T16037] name failslab, interval 1, probability 0, space 0, times 0 [ 781.581150][T16037] CPU: 0 UID: 0 PID: 16037 Comm: syz.4.2536 Tainted: G L syzkaller #0 PREEMPT(full) [ 781.581168][T16037] Tainted: [L]=SOFTLOCKUP [ 781.581173][T16037] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 781.581180][T16037] Call Trace: [ 781.581186][T16037] [ 781.581194][T16037] dump_stack_lvl+0x100/0x190 [ 781.581229][T16037] should_fail_ex.cold+0x5/0xa [ 781.581258][T16037] should_failslab+0xc2/0x120 [ 781.581284][T16037] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 781.581309][T16037] ? __alloc_skb+0x140/0x710 [ 781.581343][T16037] __alloc_skb+0x140/0x710 [ 781.581371][T16037] ? __alloc_skb+0x5b7/0x710 [ 781.581398][T16037] ? __pfx___alloc_skb+0x10/0x10 [ 781.581439][T16037] send_monitor_note+0xe8/0x540 [ 781.581477][T16037] ? __pfx_send_monitor_note+0x10/0x10 [ 781.581498][T16037] ? apparmor_capable+0x1d7/0x4d0 [ 781.581520][T16037] ? bpf_lsm_capable+0x9/0x10 [ 781.581537][T16037] hci_sock_bind+0xd4d/0x18b0 [ 781.581551][T16037] ? __pfx_hci_sock_bind+0x10/0x10 [ 781.581563][T16037] ? apparmor_socket_bind+0x13d/0x220 [ 781.581581][T16037] __sys_bind+0x1a9/0x260 [ 781.581598][T16037] ? __pfx___sys_bind+0x10/0x10 [ 781.581613][T16037] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 781.581637][T16037] ? __might_fault+0xc5/0x140 [ 781.581653][T16037] ? __might_fault+0xc5/0x140 [ 781.581671][T16037] __ia32_sys_bind+0x71/0xb0 [ 781.581707][T16037] __do_fast_syscall_32+0x14d/0x8e0 [ 781.581726][T16037] ? lockdep_hardirqs_on+0x7d/0x110 [ 781.581744][T16037] do_fast_syscall_32+0x32/0x70 [ 781.581763][T16037] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 781.581778][T16037] RIP: 0023:0xf7f13fbc [ 781.581789][T16037] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 781.581800][T16037] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000169 [ 781.581813][T16037] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000940 [ 781.581821][T16037] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000000 [ 781.581828][T16037] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 781.581835][T16037] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 781.581842][T16037] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 781.581857][T16037] [ 781.835313][T16041] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2537'. [ 782.222228][ T5912] net_ratelimit: 33 callbacks suppressed [ 782.222249][ T5912] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 782.222271][ T5912] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 782.222290][ T5912] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 782.222305][ T5912] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 782.304711][T16047] netlink: 'syz.2.2539': attribute type 1 has an invalid length. [ 782.315845][T16047] netlink: 'syz.2.2539': attribute type 10 has an invalid length. [ 782.315864][T16047] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2539'. [ 782.315885][T16047] batadv0: entered promiscuous mode [ 782.315900][T16047] batadv0: entered allmulticast mode [ 782.316529][T16047] bridge0: port 3(batadv0) entered blocking state [ 782.316668][T16047] bridge0: port 3(batadv0) entered disabled state [ 782.318615][T16047] batman_adv: batadv0: Local translation table size (104) exceeds maximum table response size (-320); Ignoring new VLAN: 1 [ 782.321001][T16047] batadv0: failed to initialize vlan filtering on this port [ 782.325831][T16047] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 782.328222][T16047] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 782.742315][ T5912] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 782.742347][ T5912] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 782.742366][ T5912] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 782.742383][ T5912] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 783.372236][ T25] usb 7-1: new high-speed USB device number 101 using dummy_hcd [ 783.502173][ T25] usb 7-1: device descriptor read/64, error -71 [ 783.642157][T13546] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 783.762369][ T25] usb 7-1: new high-speed USB device number 102 using dummy_hcd [ 783.892170][ T25] usb 7-1: device descriptor read/64, error -71 [ 784.002696][ T25] usb usb7-port1: attempt power cycle [ 784.278336][T16073] Invalid ELF header magic: != ELF [ 784.293493][T16073] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 784.294977][T16073] overlay: Unknown parameter '/' [ 784.352110][ T25] usb 7-1: new high-speed USB device number 103 using dummy_hcd [ 784.374059][ T25] usb 7-1: device descriptor read/8, error -71 [ 784.535035][T16075] netlink: 124 bytes leftover after parsing attributes in process `syz.1.2548'. [ 784.577809][T16077] team_slave_0: Device is already in use. [ 784.613490][ T25] usb 7-1: new high-speed USB device number 104 using dummy_hcd [ 784.645053][ T25] usb 7-1: device descriptor read/8, error -71 [ 784.762540][ T25] usb usb7-port1: unable to enumerate USB device [ 785.118471][T16088] pim6reg: entered allmulticast mode [ 785.269228][T16087] pim6reg: left allmulticast mode [ 785.373901][T16087] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2552'. [ 786.017719][T16100] libceph: resolve 'c' (ret=-3): failed [ 786.091052][T16101] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 786.098479][T16103] FAULT_INJECTION: forcing a failure. [ 786.098479][T16103] name failslab, interval 1, probability 0, space 0, times 0 [ 786.098509][T16103] CPU: 3 UID: 0 PID: 16103 Comm: syz.0.2557 Tainted: G L syzkaller #0 PREEMPT(full) [ 786.098534][T16103] Tainted: [L]=SOFTLOCKUP [ 786.098541][T16103] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 786.098554][T16103] Call Trace: [ 786.098561][T16103] [ 786.098570][T16103] dump_stack_lvl+0x100/0x190 [ 786.098608][T16103] should_fail_ex.cold+0x5/0xa [ 786.098634][T16103] should_failslab+0xc2/0x120 [ 786.098660][T16103] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 786.098682][T16103] ? __alloc_skb+0x5b7/0x710 [ 786.098712][T16103] ? __alloc_skb+0x140/0x710 [ 786.098742][T16103] __alloc_skb+0x140/0x710 [ 786.098768][T16103] ? __alloc_skb+0x5b7/0x710 [ 786.098797][T16103] ? __pfx___alloc_skb+0x10/0x10 [ 786.098835][T16103] netlink_alloc_large_skb+0x69/0x150 [ 786.098858][T16103] netlink_sendmsg+0x755/0x10c0 [ 786.098886][T16103] ? __pfx_netlink_sendmsg+0x10/0x10 [ 786.098920][T16103] ? apparmor_socket_sendmsg+0x165/0x280 [ 786.098951][T16103] ? ____sys_sendmsg+0xa99/0xc30 [ 786.098972][T16103] ____sys_sendmsg+0xa99/0xc30 [ 786.098994][T16103] ? __pfx_netlink_sendmsg+0x10/0x10 [ 786.099029][T16103] ? __pfx_____sys_sendmsg+0x10/0x10 [ 786.099064][T16103] ___sys_sendmsg+0x190/0x1e0 [ 786.099089][T16103] ? __pfx____sys_sendmsg+0x10/0x10 [ 786.099126][T16103] ? find_held_lock+0x2b/0x80 [ 786.099169][T16103] __sys_sendmsg+0x160/0x210 [ 786.099222][T16103] ? __pfx___sys_sendmsg+0x10/0x10 [ 786.099265][T16103] __do_fast_syscall_32+0x14d/0x8e0 [ 786.099291][T16103] ? lockdep_hardirqs_on+0x7d/0x110 [ 786.099324][T16103] do_fast_syscall_32+0x32/0x70 [ 786.099356][T16103] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 786.099381][T16103] RIP: 0023:0xf7f72fbc [ 786.099395][T16103] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 786.099412][T16103] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 786.099433][T16103] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000340 [ 786.099446][T16103] RDX: 000000002404c840 RSI: 0000000000000000 RDI: 0000000000000000 [ 786.099459][T16103] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 786.099470][T16103] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 786.099482][T16103] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 786.099506][T16103] [ 786.101904][ T43] kauditd_printk_skb: 6385 callbacks suppressed [ 786.101920][ T43] audit: type=1800 audit(1794365634.660:56050): pid=16101 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2553" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=-22 [ 786.350321][ T43] audit: type=1326 audit(1794365634.910:56051): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.2559" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72fbc code=0x7ffc0000 [ 786.353359][ T43] audit: type=1326 audit(1794365634.910:56052): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.2559" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72fbc code=0x7ffc0000 [ 786.354457][ T43] audit: type=1326 audit(1794365634.910:56053): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.2559" exe="/syz-executor" sig=0 arch=40000003 syscall=76 compat=1 ip=0xf7f72fbc code=0x7ffc0000 [ 786.354634][ T43] audit: type=1326 audit(1794365634.920:56054): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.2559" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72fbc code=0x7ffc0000 [ 786.355036][ T43] audit: type=1326 audit(1794365634.920:56055): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.2559" exe="/syz-executor" sig=0 arch=40000003 syscall=427 compat=1 ip=0xf7f72fbc code=0x7ffc0000 [ 786.355145][ T43] audit: type=1326 audit(1794365634.920:56056): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.2559" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72fbc code=0x7ffc0000 [ 786.355560][ T43] audit: type=1326 audit(1794365634.920:56057): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.2559" exe="/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf7f72fbc code=0x7ffc0000 [ 786.421735][T16117] vlan2: entered promiscuous mode [ 786.421749][T16117] bond0: entered promiscuous mode [ 786.421758][T16117] bond_slave_0: entered promiscuous mode [ 786.422151][T16117] bond_slave_1: entered promiscuous mode [ 786.547409][ T43] audit: type=1326 audit(1794365635.110:56058): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.2559" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72fbc code=0x7ffc0000 [ 786.550281][ T43] audit: type=1326 audit(1794365635.110:56059): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.2559" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72fbc code=0x7ffc0000 [ 786.872267][ T5165] usb 7-1: new high-speed USB device number 105 using dummy_hcd [ 787.022110][ T5165] usb 7-1: Using ep0 maxpacket: 32 [ 787.022946][ T5165] usb 7-1: New USB device found: idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 787.024122][ T5165] usb 7-1: config index 0 descriptor too short (expected 156, got 27) [ 787.024180][ T5165] usb 7-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 787.024211][ T5165] usb 7-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 787.024234][ T5165] usb 7-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 787.024257][ T5165] usb 7-1: config 0 interface 0 has no altsetting 0 [ 787.036410][ T5165] usb 7-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 787.036434][ T5165] usb 7-1: Product: syz [ 787.036449][ T5165] usb 7-1: Manufacturer: syz [ 787.036462][ T5165] usb 7-1: SerialNumber: syz [ 787.038454][ T5165] usb 7-1: config 0 descriptor?? [ 787.055596][ T5165] ldusb 7-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 787.057115][ T5165] ldusb 7-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 787.078806][T16124] pim6reg: entered allmulticast mode [ 787.193819][T16123] pim6reg: left allmulticast mode [ 787.266300][T16123] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2563'. [ 787.352299][T10436] net_ratelimit: 32 callbacks suppressed [ 787.352381][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 787.352409][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 787.352431][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 787.352449][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 787.353216][T16107] ceph: No mds server is up or the cluster is laggy [ 787.435523][ T30] usb 7-1: USB disconnect, device number 105 [ 787.435575][ C3] ldusb 7-1:0.0: usb_submit_urb failed (-19) [ 787.440262][T16120] ldusb 7-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 787.440761][ T30] ldusb 7-1:0.0: LD USB Device #0 now disconnected [ 787.446656][T16125] ldusb: No device or device unplugged -19 [ 787.705824][T16134] netlink: 124 bytes leftover after parsing attributes in process `syz.1.2565'. [ 787.862390][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 787.862471][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 787.862497][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 787.862517][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 787.955972][T16138] TC_ACT_REPEAT abuse ? [ 788.362570][ T25] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 788.383512][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 788.492192][ T25] usb 6-1: device descriptor read/64, error -71 [ 788.707066][T16148] comedi comedi2: pcl816: I/O base address not correctly aligned [ 788.709410][T16148] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 788.862162][ T25] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 789.136492][T16151] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.2572'. [ 789.330997][ T25] usb 6-1: device descriptor read/64, error -71 [ 789.447340][ T25] usb usb6-port1: attempt power cycle [ 789.709279][T16159] team0 (unregistering): Port device team_slave_0 removed [ 789.717285][T16159] team0 (unregistering): Port device team_slave_1 removed [ 789.838314][T16164] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2577'. [ 789.893834][ T25] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 789.925249][ T25] usb 6-1: device descriptor read/8, error -71 [ 790.162091][ T25] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 790.257092][ T25] usb 6-1: device descriptor read/8, error -71 [ 790.286671][T16172] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 790.364076][ T25] usb usb6-port1: unable to enumerate USB device [ 790.391740][T16177] MTD: Attempt to mount non-MTD device "/dev/sr0" [ 790.404633][T16177] romfs: unable to set blocksize [ 790.404633][T16177] [ 790.490056][T16178] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2581'. [ 791.391007][T16194] FAULT_INJECTION: forcing a failure. [ 791.391007][T16194] name failslab, interval 1, probability 0, space 0, times 0 [ 791.391039][T16194] CPU: 0 UID: 0 PID: 16194 Comm: syz.2.2587 Tainted: G L syzkaller #0 PREEMPT(full) [ 791.391067][T16194] Tainted: [L]=SOFTLOCKUP [ 791.391076][T16194] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 791.391087][T16194] Call Trace: [ 791.391095][T16194] [ 791.391102][T16194] dump_stack_lvl+0x100/0x190 [ 791.391140][T16194] should_fail_ex.cold+0x5/0xa [ 791.391171][T16194] should_failslab+0xc2/0x120 [ 791.391197][T16194] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 791.391237][T16194] ? __alloc_skb+0x5b7/0x710 [ 791.391267][T16194] ? __alloc_skb+0x140/0x710 [ 791.391302][T16194] __alloc_skb+0x140/0x710 [ 791.391336][T16194] ? __alloc_skb+0x5b7/0x710 [ 791.391365][T16194] ? __pfx___alloc_skb+0x10/0x10 [ 791.391399][T16194] netlink_alloc_large_skb+0x69/0x150 [ 791.391421][T16194] netlink_sendmsg+0x755/0x10c0 [ 791.391445][T16194] ? __pfx_netlink_sendmsg+0x10/0x10 [ 791.391472][T16194] ? apparmor_socket_sendmsg+0x165/0x280 [ 791.391504][T16194] ? ____sys_sendmsg+0xa99/0xc30 [ 791.391528][T16194] ____sys_sendmsg+0xa99/0xc30 [ 791.391551][T16194] ? __pfx_netlink_sendmsg+0x10/0x10 [ 791.391573][T16194] ? __pfx_____sys_sendmsg+0x10/0x10 [ 791.391609][T16194] ___sys_sendmsg+0x190/0x1e0 [ 791.391638][T16194] ? __pfx____sys_sendmsg+0x10/0x10 [ 791.391674][T16194] ? find_held_lock+0x2b/0x80 [ 791.391721][T16194] __sys_sendmsg+0x160/0x210 [ 791.391754][T16194] ? __pfx___sys_sendmsg+0x10/0x10 [ 791.391799][T16194] __do_fast_syscall_32+0x14d/0x8e0 [ 791.391830][T16194] ? lockdep_hardirqs_on+0x7d/0x110 [ 791.391862][T16194] do_fast_syscall_32+0x32/0x70 [ 791.391893][T16194] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 791.391918][T16194] RIP: 0023:0xf7fb2fbc [ 791.391935][T16194] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 791.391955][T16194] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 791.391977][T16194] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000440 [ 791.391992][T16194] RDX: 0000000000008000 RSI: 0000000000000000 RDI: 0000000000000000 [ 791.392005][T16194] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 791.392016][T16194] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 791.392027][T16194] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 791.392051][T16194] [ 791.569286][ T30] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 791.600006][ T43] kauditd_printk_skb: 1 callbacks suppressed [ 791.600024][ T43] audit: type=1326 audit(1794365640.160:56061): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16200 comm="syz.1.2590" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7ffc0000 [ 791.600286][ T43] audit: type=1326 audit(1794365640.160:56062): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16200 comm="syz.1.2590" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7ffc0000 [ 791.601233][ T43] audit: type=1326 audit(1794365640.160:56063): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16200 comm="syz.1.2590" exe="/syz-executor" sig=0 arch=40000003 syscall=76 compat=1 ip=0xf73aefbc code=0x7ffc0000 [ 791.601400][ T43] audit: type=1326 audit(1794365640.160:56064): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16200 comm="syz.1.2590" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7ffc0000 [ 791.601583][ T43] audit: type=1326 audit(1794365640.160:56065): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16200 comm="syz.1.2590" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7ffc0000 [ 791.602393][ T43] audit: type=1326 audit(1794365640.160:56066): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16200 comm="syz.1.2590" exe="/syz-executor" sig=0 arch=40000003 syscall=427 compat=1 ip=0xf73aefbc code=0x7ffc0000 [ 791.605111][ T43] audit: type=1326 audit(1794365640.170:56067): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16200 comm="syz.1.2590" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7ffc0000 [ 791.605151][ T43] audit: type=1326 audit(1794365640.170:56068): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16200 comm="syz.1.2590" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7ffc0000 [ 791.605530][ T43] audit: type=1326 audit(1794365640.170:56069): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16200 comm="syz.1.2590" exe="/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf73aefbc code=0x7ffc0000 [ 791.605718][ T43] audit: type=1326 audit(1794365640.170:56070): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16200 comm="syz.1.2590" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73aefbc code=0x7ffc0000 [ 791.614444][T16207] vlan2: entered promiscuous mode [ 791.614461][T16207] bond0: entered promiscuous mode [ 791.614474][T16207] bond_slave_0: entered promiscuous mode [ 791.614632][T16207] bond_slave_1: entered promiscuous mode [ 791.822674][ T30] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 792.332772][ T30] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 792.492306][ T5902] net_ratelimit: 27 callbacks suppressed [ 792.492323][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 792.492338][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 792.492350][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 792.492362][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 792.602079][T16201] ceph: No mds server is up or the cluster is laggy [ 792.702301][ T25] usb 9-1: new high-speed USB device number 35 using dummy_hcd [ 792.832216][ T25] usb 9-1: device descriptor read/64, error -71 [ 793.002178][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 793.002201][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 793.002215][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 793.002227][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 793.072386][ T25] usb 9-1: new high-speed USB device number 36 using dummy_hcd [ 793.202174][ T25] usb 9-1: device descriptor read/64, error -71 [ 793.245332][T16232] FAULT_INJECTION: forcing a failure. [ 793.245332][T16232] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 793.245366][T16232] CPU: 1 UID: 0 PID: 16232 Comm: syz.1.2600 Tainted: G L syzkaller #0 PREEMPT(full) [ 793.245391][T16232] Tainted: [L]=SOFTLOCKUP [ 793.245398][T16232] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 793.245410][T16232] Call Trace: [ 793.245417][T16232] [ 793.245440][T16232] dump_stack_lvl+0x100/0x190 [ 793.245475][T16232] should_fail_ex.cold+0x5/0xa [ 793.245509][T16232] _copy_to_user+0x32/0xd0 [ 793.245543][T16232] simple_read_from_buffer+0xcb/0x170 [ 793.245568][T16232] proc_fail_nth_read+0x1af/0x230 [ 793.245594][T16232] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 793.245620][T16232] ? rw_verify_area+0xce/0x6d0 [ 793.245664][T16232] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 793.245693][T16232] vfs_read+0x1e4/0xb30 [ 793.245716][T16232] ? lock_acquire+0x1d1/0x380 [ 793.245736][T16232] ? __fget_files+0x34/0x3d0 [ 793.245757][T16232] ? __pfx_vfs_read+0x10/0x10 [ 793.245775][T16232] ? find_held_lock+0x2b/0x80 [ 793.245801][T16232] ? __fget_files+0x215/0x3d0 [ 793.245837][T16232] ? __fget_files+0x21f/0x3d0 [ 793.245870][T16232] ksys_read+0x12a/0x250 [ 793.245889][T16232] ? __pfx_ksys_read+0x10/0x10 [ 793.245916][T16232] do_int80_emulation+0x16a/0x670 [ 793.245947][T16232] asm_int80_emulation+0x1a/0x20 [ 793.245966][T16232] RIP: 0023:0xf710fc6b [ 793.245986][T16232] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 793.246006][T16232] RSP: 002b:00000000f53c64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 793.246025][T16232] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f53c65d0 [ 793.246037][T16232] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 793.246048][T16232] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 793.246058][T16232] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 793.246069][T16232] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 793.246094][T16232] [ 793.312498][ T25] usb usb9-port1: attempt power cycle [ 793.436859][T16237] comedi comedi2: pcl816: I/O base address not correctly aligned [ 793.439430][T16237] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 793.512528][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 793.512560][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 793.652182][ T25] usb 9-1: new high-speed USB device number 37 using dummy_hcd [ 793.672769][ T25] usb 9-1: device descriptor read/8, error -71 [ 793.922495][ T25] usb 9-1: new high-speed USB device number 38 using dummy_hcd [ 793.942775][ T25] usb 9-1: device descriptor read/8, error -71 [ 794.053669][ T25] usb usb9-port1: unable to enumerate USB device [ 794.931223][T16254] infiniband syz1: set active [ 794.931357][T16254] infiniband syz1: added ipvlan1 [ 794.946582][T16254] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 794.946619][T16254] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 794.946660][T16254] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 794.971716][T16254] RDS/IB: syz1: added [ 794.971766][T16254] smc: adding ib device syz1 with port count 1 [ 794.971785][T16254] smc: ib device syz1 port 1 has no pnetid [ 795.556984][ C3] vcan0: j1939_tp_rxtimer: 0xffff888077d04400: rx timeout, send abort [ 795.895671][T16276] CIFS: Attempting to mount //127.0.0.1/test [ 795.906084][T16276] CIFS: VFS: Error connecting to socket. Aborting operation. [ 795.906214][T16276] CIFS: VFS: cifs_mount failed w/return code = -111 [ 795.972342][ T993] usb 9-1: new high-speed USB device number 39 using dummy_hcd [ 796.025457][T16276] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2611'. [ 796.025482][T16276] netlink: 5740 bytes leftover after parsing attributes in process `syz.2.2611'. [ 796.057064][ C3] vcan0: j1939_tp_rxtimer: 0xffff888077d04400: abort rx timeout. Force session deactivation [ 796.059492][ C3] vcan0: j1939_tp_rxtimer: 0xffff888077d04800: rx timeout, send abort [ 796.132237][ T993] usb 9-1: Using ep0 maxpacket: 32 [ 796.133784][ T993] usb 9-1: New USB device found: idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 796.134961][ T993] usb 9-1: config index 0 descriptor too short (expected 156, got 27) [ 796.134995][ T993] usb 9-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 796.135027][ T993] usb 9-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 796.135051][ T993] usb 9-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 796.135074][ T993] usb 9-1: config 0 interface 0 has no altsetting 0 [ 796.138423][ T993] usb 9-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 796.138446][ T993] usb 9-1: Product: syz [ 796.138461][ T993] usb 9-1: Manufacturer: syz [ 796.138476][ T993] usb 9-1: SerialNumber: syz [ 796.140969][ T993] usb 9-1: config 0 descriptor?? [ 796.144374][ T993] ldusb 9-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 796.149706][ T993] ldusb 9-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 796.451905][T16274] ldusb 9-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 796.458118][ T5924] usb 9-1: USB disconnect, device number 39 [ 796.458247][ C0] ldusb 9-1:0.0: usb_submit_urb failed (-19) [ 796.458498][T16279] ldusb 9-1:0.0: Couldn't submit HID_REQ_SET_REPORT -19 [ 796.471577][ T5924] ldusb 9-1:0.0: LD USB Device #0 now disconnected [ 796.559568][ C3] vcan0: j1939_tp_rxtimer: 0xffff888077d04800: abort rx timeout. Force session deactivation [ 797.207988][T16284] lo: entered allmulticast mode [ 797.214300][T16285] netlink: 'syz.2.2614': attribute type 10 has an invalid length. [ 797.218050][T16285] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 797.218239][T16285] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 797.218260][T16285] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 797.307728][T16291] FAULT_INJECTION: forcing a failure. [ 797.307728][T16291] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 797.307760][T16291] CPU: 0 UID: 0 PID: 16291 Comm: syz.2.2615 Tainted: G L syzkaller #0 PREEMPT(full) [ 797.307786][T16291] Tainted: [L]=SOFTLOCKUP [ 797.307793][T16291] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 797.307804][T16291] Call Trace: [ 797.307814][T16291] [ 797.307821][T16291] dump_stack_lvl+0x100/0x190 [ 797.307855][T16291] should_fail_ex.cold+0x5/0xa [ 797.307883][T16291] _copy_to_user+0x32/0xd0 [ 797.307916][T16291] mptcp_getsockopt_full_info+0x2a7/0x6a0 [ 797.307949][T16291] ? __pfx_mptcp_getsockopt_full_info+0x10/0x10 [ 797.308014][T16291] ? __lock_acquire+0x5c0/0x1f40 [ 797.308055][T16291] ? mptcp_getsockopt+0x16a/0xe50 [ 797.308077][T16291] ? find_held_lock+0x2b/0x80 [ 797.308104][T16291] ? mptcp_getsockopt+0x16a/0xe50 [ 797.308125][T16291] ? mptcp_getsockopt+0x16a/0xe50 [ 797.308148][T16291] ? __local_bh_enable_ip+0xa5/0x120 [ 797.308173][T16291] mptcp_getsockopt+0x35a/0xe50 [ 797.308196][T16291] ? __pfx_mptcp_getsockopt+0x10/0x10 [ 797.308220][T16291] ? lock_acquire+0x1d1/0x380 [ 797.308239][T16291] ? get_pid_task+0x2a/0x250 [ 797.308269][T16291] ? aa_sock_opt_perm+0x114/0x1e0 [ 797.308295][T16291] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 797.308320][T16291] do_sock_getsockopt+0x415/0x570 [ 797.308352][T16291] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 797.308386][T16291] ? __fget_files+0x34/0x3d0 [ 797.308410][T16291] ? find_held_lock+0x2b/0x80 [ 797.308443][T16291] ? __fget_files+0x21f/0x3d0 [ 797.308472][T16291] __sys_getsockopt+0x133/0x1d0 [ 797.308503][T16291] ? __might_fault+0xc5/0x140 [ 797.308533][T16291] ? __ia32_sys_getsockopt+0xbc/0x160 [ 797.308561][T16291] __ia32_sys_getsockopt+0xbc/0x160 [ 797.308590][T16291] ? __might_fault+0x111/0x140 [ 797.308615][T16291] __do_fast_syscall_32+0x14d/0x8e0 [ 797.308645][T16291] ? lockdep_hardirqs_on+0x7d/0x110 [ 797.308680][T16291] do_fast_syscall_32+0x32/0x70 [ 797.308709][T16291] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 797.308734][T16291] RIP: 0023:0xf7fb2fbc [ 797.308749][T16291] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 797.308768][T16291] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 000000000000016d [ 797.308788][T16291] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000000011c [ 797.308801][T16291] RDX: 0000000000000004 RSI: 0000000080001340 RDI: 0000000080001400 [ 797.308813][T16291] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 797.308824][T16291] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 797.308836][T16291] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 797.308861][T16291] [ 797.391069][T16292] pimreg: entered allmulticast mode [ 797.400362][T16289] comedi comedi2: pcl816: I/O base address not correctly aligned [ 797.405305][T16289] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 797.518455][T16282] lo: left allmulticast mode [ 797.518566][T16282] pimreg: left allmulticast mode [ 797.636116][T10436] net_ratelimit: 30 callbacks suppressed [ 797.636138][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 797.636160][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 797.636180][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 797.636227][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 797.993822][T16308] ip6gretap0: entered promiscuous mode [ 797.994568][T16308] bond0: (slave ip6gretap0): Enslaving as an active interface with an up link [ 797.998072][T16308] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2618'. [ 798.040069][T16310] FAULT_INJECTION: forcing a failure. [ 798.040069][T16310] name failslab, interval 1, probability 0, space 0, times 0 [ 798.040100][T16310] CPU: 3 UID: 0 PID: 16310 Comm: syz.0.2619 Tainted: G L syzkaller #0 PREEMPT(full) [ 798.040144][T16310] Tainted: [L]=SOFTLOCKUP [ 798.040152][T16310] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 798.040163][T16310] Call Trace: [ 798.040170][T16310] [ 798.040178][T16310] dump_stack_lvl+0x100/0x190 [ 798.040220][T16310] should_fail_ex.cold+0x5/0xa [ 798.040250][T16310] should_failslab+0xc2/0x120 [ 798.040281][T16310] __kmalloc_cache_noprof+0x91/0x6d0 [ 798.040311][T16310] ? tcp_sendmsg_fastopen+0x24d/0x750 [ 798.040341][T16310] tcp_sendmsg_fastopen+0x24d/0x750 [ 798.040371][T16310] ? look_up_lock_class+0x64/0x120 [ 798.040403][T16310] tcp_sendmsg_locked+0x28ba/0x46b0 [ 798.040430][T16310] ? __lock_acquire+0x5c0/0x1f40 [ 798.040460][T16310] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 798.040481][T16310] ? lock_acquire+0x1d1/0x380 [ 798.040506][T16310] ? do_raw_spin_lock+0x128/0x260 [ 798.040534][T16310] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 798.040564][T16310] ? __local_bh_enable_ip+0xa5/0x120 [ 798.040586][T16310] tcp_sendmsg+0x2e/0x50 [ 798.040603][T16310] ? __pfx_tcp_sendmsg+0x10/0x10 [ 798.040622][T16310] inet_sendmsg+0xb9/0x140 [ 798.040646][T16310] __sys_sendto+0x470/0x4e0 [ 798.040676][T16310] ? __pfx_inet_sendmsg+0x10/0x10 [ 798.040696][T16310] ? __pfx___sys_sendto+0x10/0x10 [ 798.040740][T16310] ? find_held_lock+0x2b/0x80 [ 798.040765][T16310] ? __might_fault+0xc5/0x140 [ 798.040791][T16310] ? __might_fault+0xc5/0x140 [ 798.040824][T16310] __ia32_sys_sendto+0xdd/0x1b0 [ 798.040851][T16310] ? __might_fault+0x111/0x140 [ 798.040874][T16310] __do_fast_syscall_32+0x14d/0x8e0 [ 798.040902][T16310] ? lockdep_hardirqs_on+0x7d/0x110 [ 798.040930][T16310] do_fast_syscall_32+0x32/0x70 [ 798.040962][T16310] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 798.040990][T16310] RIP: 0023:0xf7f72fbc [ 798.041008][T16310] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 798.041027][T16310] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 798.041046][T16310] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 798.041058][T16310] RDX: 0000000000000000 RSI: 00000000200007fd RDI: 0000000080000140 [ 798.041069][T16310] RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 [ 798.041080][T16310] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 798.041091][T16310] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 798.041119][T16310] [ 798.088243][T16312] FAULT_INJECTION: forcing a failure. [ 798.088243][T16312] name failslab, interval 1, probability 0, space 0, times 0 [ 798.088272][T16312] CPU: 2 UID: 0 PID: 16312 Comm: syz.0.2620 Tainted: G L syzkaller #0 PREEMPT(full) [ 798.088299][T16312] Tainted: [L]=SOFTLOCKUP [ 798.088306][T16312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 798.088318][T16312] Call Trace: [ 798.088325][T16312] [ 798.088334][T16312] dump_stack_lvl+0x100/0x190 [ 798.088375][T16312] should_fail_ex.cold+0x5/0xa [ 798.088404][T16312] should_failslab+0xc2/0x120 [ 798.088430][T16312] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 798.088452][T16312] ? __alloc_skb+0x5b7/0x710 [ 798.088480][T16312] ? __alloc_skb+0x140/0x710 [ 798.088513][T16312] __alloc_skb+0x140/0x710 [ 798.088540][T16312] ? __alloc_skb+0x5b7/0x710 [ 798.088568][T16312] ? __pfx___alloc_skb+0x10/0x10 [ 798.088597][T16312] ? is_bpf_text_address+0x94/0x1a0 [ 798.088631][T16312] netlink_alloc_large_skb+0x69/0x150 [ 798.088653][T16312] netlink_sendmsg+0x755/0x10c0 [ 798.088678][T16312] ? __pfx_netlink_sendmsg+0x10/0x10 [ 798.088704][T16312] ? apparmor_socket_sendmsg+0x165/0x280 [ 798.088736][T16312] ? ____sys_sendmsg+0xa99/0xc30 [ 798.088758][T16312] ____sys_sendmsg+0xa99/0xc30 [ 798.088780][T16312] ? __pfx_netlink_sendmsg+0x10/0x10 [ 798.088803][T16312] ? __pfx_____sys_sendmsg+0x10/0x10 [ 798.088839][T16312] ___sys_sendmsg+0x190/0x1e0 [ 798.088865][T16312] ? __pfx____sys_sendmsg+0x10/0x10 [ 798.088902][T16312] ? find_held_lock+0x2b/0x80 [ 798.088944][T16312] __sys_sendmsg+0x160/0x210 [ 798.088976][T16312] ? __pfx___sys_sendmsg+0x10/0x10 [ 798.089016][T16312] __do_fast_syscall_32+0x14d/0x8e0 [ 798.089045][T16312] ? lockdep_hardirqs_on+0x7d/0x110 [ 798.089074][T16312] do_fast_syscall_32+0x32/0x70 [ 798.089102][T16312] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 798.089124][T16312] RIP: 0023:0xf7f72fbc [ 798.089139][T16312] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 798.089157][T16312] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 798.089176][T16312] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800001c0 [ 798.089188][T16312] RDX: 0000000020044000 RSI: 0000000000000000 RDI: 0000000000000000 [ 798.089199][T16312] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 798.089210][T16312] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 798.089221][T16312] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 798.089245][T16312] [ 798.142263][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 798.142294][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 798.142314][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 798.142336][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 798.159336][T16316] FAULT_INJECTION: forcing a failure. [ 798.159336][T16316] name failslab, interval 1, probability 0, space 0, times 0 [ 798.159366][T16316] CPU: 2 UID: 0 PID: 16316 Comm: syz.1.2623 Tainted: G L syzkaller #0 PREEMPT(full) [ 798.159393][T16316] Tainted: [L]=SOFTLOCKUP [ 798.159401][T16316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 798.159415][T16316] Call Trace: [ 798.159422][T16316] [ 798.159430][T16316] dump_stack_lvl+0x100/0x190 [ 798.159464][T16316] should_fail_ex.cold+0x5/0xa [ 798.159494][T16316] should_failslab+0xc2/0x120 [ 798.159520][T16316] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 798.159543][T16316] ? __alloc_skb+0x5b7/0x710 [ 798.159572][T16316] ? __alloc_skb+0x140/0x710 [ 798.159605][T16316] __alloc_skb+0x140/0x710 [ 798.159633][T16316] ? __alloc_skb+0x5b7/0x710 [ 798.159660][T16316] ? __pfx___alloc_skb+0x10/0x10 [ 798.159697][T16316] netlink_alloc_large_skb+0x69/0x150 [ 798.159719][T16316] netlink_sendmsg+0x755/0x10c0 [ 798.159743][T16316] ? __pfx_netlink_sendmsg+0x10/0x10 [ 798.159770][T16316] ? apparmor_socket_sendmsg+0x165/0x280 [ 798.159801][T16316] ? ____sys_sendmsg+0xa99/0xc30 [ 798.159823][T16316] ____sys_sendmsg+0xa99/0xc30 [ 798.159845][T16316] ? __pfx_netlink_sendmsg+0x10/0x10 [ 798.159867][T16316] ? __pfx_____sys_sendmsg+0x10/0x10 [ 798.159903][T16316] ___sys_sendmsg+0x190/0x1e0 [ 798.159931][T16316] ? __pfx____sys_sendmsg+0x10/0x10 [ 798.159968][T16316] ? find_held_lock+0x2b/0x80 [ 798.160014][T16316] __sys_sendmsg+0x160/0x210 [ 798.160045][T16316] ? __pfx___sys_sendmsg+0x10/0x10 [ 798.160089][T16316] __do_fast_syscall_32+0x14d/0x8e0 [ 798.160120][T16316] ? lockdep_hardirqs_on+0x7d/0x110 [ 798.160151][T16316] do_fast_syscall_32+0x32/0x70 [ 798.160182][T16316] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 798.160207][T16316] RIP: 0023:0xf73aefbc [ 798.160224][T16316] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 798.160249][T16316] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 798.160270][T16316] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800000c0 [ 798.160284][T16316] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 798.160297][T16316] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 798.160309][T16316] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 798.160322][T16316] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 798.160346][T16316] [ 798.201022][T16318] FAULT_INJECTION: forcing a failure. [ 798.201022][T16318] name failslab, interval 1, probability 0, space 0, times 0 [ 798.201052][T16318] CPU: 0 UID: 0 PID: 16318 Comm: syz.1.2624 Tainted: G L syzkaller #0 PREEMPT(full) [ 798.201073][T16318] Tainted: [L]=SOFTLOCKUP [ 798.201079][T16318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 798.201090][T16318] Call Trace: [ 798.201097][T16318] [ 798.201104][T16318] dump_stack_lvl+0x100/0x190 [ 798.201138][T16318] should_fail_ex.cold+0x5/0xa [ 798.201164][T16318] should_failslab+0xc2/0x120 [ 798.201184][T16318] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 798.201205][T16318] ? __alloc_skb+0x5b7/0x710 [ 798.201233][T16318] ? __alloc_skb+0x140/0x710 [ 798.201262][T16318] __alloc_skb+0x140/0x710 [ 798.201283][T16318] ? __alloc_skb+0x5b7/0x710 [ 798.201309][T16318] ? __pfx___alloc_skb+0x10/0x10 [ 798.201343][T16318] netlink_alloc_large_skb+0x69/0x150 [ 798.201358][T16318] netlink_sendmsg+0x755/0x10c0 [ 798.201373][T16318] ? __pfx_netlink_sendmsg+0x10/0x10 [ 798.201389][T16318] ? apparmor_socket_sendmsg+0x165/0x280 [ 798.201408][T16318] ? ____sys_sendmsg+0xa99/0xc30 [ 798.201426][T16318] ____sys_sendmsg+0xa99/0xc30 [ 798.201446][T16318] ? __pfx_netlink_sendmsg+0x10/0x10 [ 798.201468][T16318] ? __pfx_____sys_sendmsg+0x10/0x10 [ 798.201503][T16318] ___sys_sendmsg+0x190/0x1e0 [ 798.201528][T16318] ? __pfx____sys_sendmsg+0x10/0x10 [ 798.201563][T16318] ? find_held_lock+0x2b/0x80 [ 798.201626][T16318] __sys_sendmsg+0x160/0x210 [ 798.201657][T16318] ? __pfx___sys_sendmsg+0x10/0x10 [ 798.201703][T16318] __do_fast_syscall_32+0x14d/0x8e0 [ 798.201731][T16318] ? lockdep_hardirqs_on+0x7d/0x110 [ 798.201760][T16318] do_fast_syscall_32+0x32/0x70 [ 798.201787][T16318] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 798.201811][T16318] RIP: 0023:0xf73aefbc [ 798.201826][T16318] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 798.201844][T16318] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 798.201863][T16318] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000140 [ 798.201875][T16318] RDX: 0000000000008000 RSI: 0000000000000000 RDI: 0000000000000000 [ 798.201886][T16318] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 798.201897][T16318] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 798.201908][T16318] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 798.201932][T16318] [ 798.652961][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 798.652990][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 798.983957][T16320] virtio_blk virtio3: 1/0/0 default/read/poll queues [ 798.988010][T16320] virtio_blk virtio3: [vda] 262144 512-byte logical blocks (134 MB/128 MiB) [ 799.113296][T16353] FAULT_INJECTION: forcing a failure. [ 799.113296][T16353] name failslab, interval 1, probability 0, space 0, times 0 [ 799.113327][T16353] CPU: 2 UID: 0 PID: 16353 Comm: syz.1.2631 Tainted: G L syzkaller #0 PREEMPT(full) [ 799.113353][T16353] Tainted: [L]=SOFTLOCKUP [ 799.113360][T16353] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 799.113373][T16353] Call Trace: [ 799.113382][T16353] [ 799.113390][T16353] dump_stack_lvl+0x100/0x190 [ 799.113427][T16353] should_fail_ex.cold+0x5/0xa [ 799.113456][T16353] should_failslab+0xc2/0x120 [ 799.113480][T16353] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 799.113504][T16353] ? __alloc_skb+0x5b7/0x710 [ 799.113534][T16353] ? __alloc_skb+0x140/0x710 [ 799.113567][T16353] __alloc_skb+0x140/0x710 [ 799.113595][T16353] ? __alloc_skb+0x5b7/0x710 [ 799.113645][T16353] ? __pfx___alloc_skb+0x10/0x10 [ 799.113681][T16353] netlink_alloc_large_skb+0x69/0x150 [ 799.113712][T16353] netlink_sendmsg+0x755/0x10c0 [ 799.113737][T16353] ? __pfx_netlink_sendmsg+0x10/0x10 [ 799.113765][T16353] ? apparmor_socket_sendmsg+0x165/0x280 [ 799.113798][T16353] ? ____sys_sendmsg+0xa99/0xc30 [ 799.113821][T16353] ____sys_sendmsg+0xa99/0xc30 [ 799.113844][T16353] ? __pfx_netlink_sendmsg+0x10/0x10 [ 799.113866][T16353] ? __pfx_____sys_sendmsg+0x10/0x10 [ 799.113902][T16353] ___sys_sendmsg+0x190/0x1e0 [ 799.113930][T16353] ? __pfx____sys_sendmsg+0x10/0x10 [ 799.113967][T16353] ? find_held_lock+0x2b/0x80 [ 799.114009][T16353] __sys_sendmsg+0x160/0x210 [ 799.114039][T16353] ? __pfx___sys_sendmsg+0x10/0x10 [ 799.114083][T16353] __do_fast_syscall_32+0x14d/0x8e0 [ 799.114114][T16353] ? lockdep_hardirqs_on+0x7d/0x110 [ 799.114142][T16353] do_fast_syscall_32+0x32/0x70 [ 799.114173][T16353] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 799.114200][T16353] RIP: 0023:0xf73aefbc [ 799.114217][T16353] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 799.114237][T16353] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 799.114256][T16353] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800006c0 [ 799.114269][T16353] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 799.114281][T16353] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 799.114292][T16353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 799.114304][T16353] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 799.114331][T16353] [ 799.117164][T16355] FAULT_INJECTION: forcing a failure. [ 799.117164][T16355] name failslab, interval 1, probability 0, space 0, times 0 [ 799.117193][T16355] CPU: 0 UID: 0 PID: 16355 Comm: syz.2.2630 Tainted: G L syzkaller #0 PREEMPT(full) [ 799.117220][T16355] Tainted: [L]=SOFTLOCKUP [ 799.117227][T16355] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 799.117238][T16355] Call Trace: [ 799.117244][T16355] [ 799.117252][T16355] dump_stack_lvl+0x100/0x190 [ 799.117283][T16355] should_fail_ex.cold+0x5/0xa [ 799.117310][T16355] should_failslab+0xc2/0x120 [ 799.117333][T16355] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 799.117353][T16355] ? __alloc_skb+0x5b7/0x710 [ 799.117379][T16355] ? __alloc_skb+0x140/0x710 [ 799.117410][T16355] __alloc_skb+0x140/0x710 [ 799.117435][T16355] ? __alloc_skb+0x5b7/0x710 [ 799.117461][T16355] ? __pfx___alloc_skb+0x10/0x10 [ 799.117495][T16355] netlink_alloc_large_skb+0x69/0x150 [ 799.117515][T16355] netlink_sendmsg+0x755/0x10c0 [ 799.117537][T16355] ? __pfx_netlink_sendmsg+0x10/0x10 [ 799.117561][T16355] ? apparmor_socket_sendmsg+0x165/0x280 [ 799.117589][T16355] ? ____sys_sendmsg+0xa99/0xc30 [ 799.117635][T16355] ____sys_sendmsg+0xa99/0xc30 [ 799.117655][T16355] ? __pfx_netlink_sendmsg+0x10/0x10 [ 799.117674][T16355] ? __pfx_____sys_sendmsg+0x10/0x10 [ 799.117707][T16355] ___sys_sendmsg+0x190/0x1e0 [ 799.117731][T16355] ? __pfx____sys_sendmsg+0x10/0x10 [ 799.117765][T16355] ? find_held_lock+0x2b/0x80 [ 799.117806][T16355] __sys_sendmsg+0x160/0x210 [ 799.117834][T16355] ? __pfx___sys_sendmsg+0x10/0x10 [ 799.117875][T16355] __do_fast_syscall_32+0x14d/0x8e0 [ 799.117903][T16355] ? lockdep_hardirqs_on+0x7d/0x110 [ 799.117930][T16355] do_fast_syscall_32+0x32/0x70 [ 799.117957][T16355] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 799.117980][T16355] RIP: 0023:0xf7fb2fbc [ 799.118010][T16355] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 799.118027][T16355] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 799.118046][T16355] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000440 [ 799.118057][T16355] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 799.118068][T16355] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 799.118078][T16355] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 799.118089][T16355] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 799.118113][T16355] [ 799.174823][T16359] lo: entered allmulticast mode [ 799.278130][T16361] pimreg: entered allmulticast mode [ 799.409494][T16358] lo: left allmulticast mode [ 799.409568][T16358] pimreg: left allmulticast mode [ 799.471244][T16372] ntfs3: unknown option "ecryptfs_sig". Use uid,gid,umask,dmask,fmask,sys_immutable,discard,force,sparse,nohidden,hide_dot_files,windows_names,showmeta,acl,iocharset,prealloc,nocase,delalloc,ads,ugm [ 799.471266][T16372] ntfs3: Unknown parameter 'ecryptfs_sig' [ 799.716993][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880627dc400: rx timeout, send abort [ 800.218840][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880627dc400: abort rx timeout. Force session deactivation [ 800.218952][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880627dc000: rx timeout, send abort [ 800.267649][T16386] FAULT_INJECTION: forcing a failure. [ 800.267649][T16386] name failslab, interval 1, probability 0, space 0, times 0 [ 800.267675][T16386] CPU: 3 UID: 0 PID: 16386 Comm: syz.2.2639 Tainted: G L syzkaller #0 PREEMPT(full) [ 800.267691][T16386] Tainted: [L]=SOFTLOCKUP [ 800.267696][T16386] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 800.267703][T16386] Call Trace: [ 800.267708][T16386] [ 800.267713][T16386] dump_stack_lvl+0x100/0x190 [ 800.267736][T16386] should_fail_ex.cold+0x5/0xa [ 800.267755][T16386] should_failslab+0xc2/0x120 [ 800.267771][T16386] __kmalloc_cache_noprof+0x91/0x6d0 [ 800.267788][T16386] ? sctp_has_association+0xdd/0x270 [ 800.267837][T16386] ? sctp_association_new+0xbb/0x2990 [ 800.267860][T16386] sctp_association_new+0xbb/0x2990 [ 800.267882][T16386] sctp_connect_new_asoc+0x1a8/0x770 [ 800.267903][T16386] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 800.267921][T16386] ? sctp_endpoint_lookup_assoc+0x15c/0x2a0 [ 800.267938][T16386] ? sctp_endpoint_lookup_assoc+0x15c/0x2a0 [ 800.267958][T16386] ? apparmor_sctp_bind_connect+0x65/0xa0 [ 800.267976][T16386] sctp_sendmsg+0x1743/0x22e0 [ 800.267999][T16386] ? __pfx_sctp_sendmsg+0x10/0x10 [ 800.268021][T16386] ? tomoyo_socket_sendmsg_permission+0x14e/0x3c0 [ 800.268039][T16386] ? aa_sock_msg_perm+0x11e/0x200 [ 800.268055][T16386] ? __pfx_sctp_sendmsg+0x10/0x10 [ 800.268075][T16386] inet_sendmsg+0x11c/0x140 [ 800.268088][T16386] __sys_sendto+0x470/0x4e0 [ 800.268105][T16386] ? __pfx_inet_sendmsg+0x10/0x10 [ 800.268117][T16386] ? __pfx___sys_sendto+0x10/0x10 [ 800.268146][T16386] ? find_held_lock+0x2b/0x80 [ 800.268167][T16386] ? __might_fault+0xc5/0x140 [ 800.268183][T16386] ? __might_fault+0xc5/0x140 [ 800.268200][T16386] __ia32_sys_sendto+0xdd/0x1b0 [ 800.268217][T16386] ? __might_fault+0x111/0x140 [ 800.268233][T16386] __do_fast_syscall_32+0x14d/0x8e0 [ 800.268252][T16386] ? lockdep_hardirqs_on+0x7d/0x110 [ 800.268271][T16386] do_fast_syscall_32+0x32/0x70 [ 800.268290][T16386] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 800.268305][T16386] RIP: 0023:0xf7fb2fbc [ 800.268315][T16386] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 800.268327][T16386] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 800.268340][T16386] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000640 [ 800.268348][T16386] RDX: 000000000000fffd RSI: 00000000200000d0 RDI: 0000000080000680 [ 800.268355][T16386] RBP: 000000000000001c R08: 0000000000000000 R09: 0000000000000000 [ 800.268363][T16386] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 800.268370][T16386] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 800.268386][T16386] [ 800.439823][T16395] trusted_key: encrypted_key: insufficient parameters specified [ 800.453080][T16395] FAULT_INJECTION: forcing a failure. [ 800.453080][T16395] name failslab, interval 1, probability 0, space 0, times 0 [ 800.453137][T16395] CPU: 3 UID: 0 PID: 16395 Comm: syz.2.2644 Tainted: G L syzkaller #0 PREEMPT(full) [ 800.453167][T16395] Tainted: [L]=SOFTLOCKUP [ 800.453177][T16395] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 800.453190][T16395] Call Trace: [ 800.453198][T16395] [ 800.453207][T16395] dump_stack_lvl+0x100/0x190 [ 800.453242][T16395] should_fail_ex.cold+0x5/0xa [ 800.453272][T16395] should_failslab+0xc2/0x120 [ 800.453297][T16395] __kmalloc_cache_noprof+0x91/0x6d0 [ 800.453329][T16395] ? zonefs_init_fs_context+0x43/0x100 [ 800.453378][T16395] zonefs_init_fs_context+0x43/0x100 [ 800.453405][T16395] alloc_fs_context+0x607/0xf40 [ 800.453442][T16395] __ia32_sys_fsopen+0x16d/0x2d0 [ 800.453466][T16395] __do_fast_syscall_32+0x14d/0x8e0 [ 800.453502][T16395] do_fast_syscall_32+0x32/0x70 [ 800.453534][T16395] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 800.453560][T16395] RIP: 0023:0xf7fb2fbc [ 800.453578][T16395] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 800.453626][T16395] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 00000000000001ae [ 800.453650][T16395] RAX: ffffffffffffffda RBX: 0000000080000680 RCX: 0000000000000000 [ 800.453663][T16395] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 800.453677][T16395] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 800.453690][T16395] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 800.453702][T16395] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 800.453724][T16395] [ 800.718992][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880627dc000: abort rx timeout. Force session deactivation [ 800.984746][T16408] netlink: 'syz.4.2648': attribute type 10 has an invalid length. [ 800.984768][T16408] netlink: 55 bytes leftover after parsing attributes in process `syz.4.2648'. [ 801.213214][T16413] FAULT_INJECTION: forcing a failure. [ 801.213214][T16413] name failslab, interval 1, probability 0, space 0, times 0 [ 801.213263][T16413] CPU: 2 UID: 0 PID: 16413 Comm: syz.0.2649 Tainted: G L syzkaller #0 PREEMPT(full) [ 801.213305][T16413] Tainted: [L]=SOFTLOCKUP [ 801.213322][T16413] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 801.213343][T16413] Call Trace: [ 801.213357][T16413] [ 801.213370][T16413] dump_stack_lvl+0x100/0x190 [ 801.213427][T16413] should_fail_ex.cold+0x5/0xa [ 801.213476][T16413] should_failslab+0xc2/0x120 [ 801.213525][T16413] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 801.213564][T16413] ? __alloc_skb+0x5b7/0x710 [ 801.213643][T16413] ? __alloc_skb+0x140/0x710 [ 801.213700][T16413] __alloc_skb+0x140/0x710 [ 801.213738][T16413] ? __alloc_skb+0x5b7/0x710 [ 801.213781][T16413] ? __pfx___alloc_skb+0x10/0x10 [ 801.213847][T16413] netlink_alloc_large_skb+0x69/0x150 [ 801.213886][T16413] netlink_sendmsg+0x755/0x10c0 [ 801.213924][T16413] ? __pfx_netlink_sendmsg+0x10/0x10 [ 801.213979][T16413] ? apparmor_socket_sendmsg+0x165/0x280 [ 801.214037][T16413] ? ____sys_sendmsg+0xa99/0xc30 [ 801.214071][T16413] ____sys_sendmsg+0xa99/0xc30 [ 801.214104][T16413] ? __pfx_netlink_sendmsg+0x10/0x10 [ 801.214143][T16413] ? __pfx_____sys_sendmsg+0x10/0x10 [ 801.214205][T16413] ___sys_sendmsg+0x190/0x1e0 [ 801.214243][T16413] ? __pfx____sys_sendmsg+0x10/0x10 [ 801.214300][T16413] ? find_held_lock+0x2b/0x80 [ 801.214377][T16413] __sys_sendmsg+0x160/0x210 [ 801.214422][T16413] ? __pfx___sys_sendmsg+0x10/0x10 [ 801.214493][T16413] __do_fast_syscall_32+0x14d/0x8e0 [ 801.214544][T16413] ? lockdep_hardirqs_on+0x7d/0x110 [ 801.214590][T16413] do_fast_syscall_32+0x32/0x70 [ 801.214636][T16413] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 801.214680][T16413] RIP: 0023:0xf7f72fbc [ 801.214705][T16413] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 801.214735][T16413] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 801.214765][T16413] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800008c0 [ 801.214784][T16413] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 801.214804][T16413] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 801.214824][T16413] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 801.214853][T16413] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 801.214896][T16413] [ 801.261530][T16415] FAULT_INJECTION: forcing a failure. [ 801.261530][T16415] name failslab, interval 1, probability 0, space 0, times 0 [ 801.261565][T16415] CPU: 2 UID: 0 PID: 16415 Comm: syz.0.2650 Tainted: G L syzkaller #0 PREEMPT(full) [ 801.261622][T16415] Tainted: [L]=SOFTLOCKUP [ 801.261632][T16415] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 801.261644][T16415] Call Trace: [ 801.261652][T16415] [ 801.261663][T16415] dump_stack_lvl+0x100/0x190 [ 801.261713][T16415] should_fail_ex.cold+0x5/0xa [ 801.261747][T16415] should_failslab+0xc2/0x120 [ 801.261779][T16415] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 801.261803][T16415] ? __alloc_skb+0x5b7/0x710 [ 801.261838][T16415] ? __alloc_skb+0x140/0x710 [ 801.261876][T16415] __alloc_skb+0x140/0x710 [ 801.261909][T16415] ? __alloc_skb+0x5b7/0x710 [ 801.261942][T16415] ? __pfx___alloc_skb+0x10/0x10 [ 801.262035][T16415] netlink_alloc_large_skb+0x69/0x150 [ 801.262063][T16415] netlink_sendmsg+0x755/0x10c0 [ 801.262092][T16415] ? __pfx_netlink_sendmsg+0x10/0x10 [ 801.262122][T16415] ? apparmor_socket_sendmsg+0x165/0x280 [ 801.262159][T16415] ? ____sys_sendmsg+0xa99/0xc30 [ 801.262185][T16415] ____sys_sendmsg+0xa99/0xc30 [ 801.262211][T16415] ? __pfx_netlink_sendmsg+0x10/0x10 [ 801.262238][T16415] ? __pfx_____sys_sendmsg+0x10/0x10 [ 801.262279][T16415] ___sys_sendmsg+0x190/0x1e0 [ 801.262311][T16415] ? __pfx____sys_sendmsg+0x10/0x10 [ 801.262354][T16415] ? find_held_lock+0x2b/0x80 [ 801.262402][T16415] __sys_sendmsg+0x160/0x210 [ 801.262431][T16415] ? __pfx___sys_sendmsg+0x10/0x10 [ 801.262473][T16415] __do_fast_syscall_32+0x14d/0x8e0 [ 801.262504][T16415] ? lockdep_hardirqs_on+0x7d/0x110 [ 801.262534][T16415] do_fast_syscall_32+0x32/0x70 [ 801.262563][T16415] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 801.262587][T16415] RIP: 0023:0xf7f72fbc [ 801.262602][T16415] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 801.262622][T16415] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 801.262643][T16415] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 801.262655][T16415] RDX: 0000000000000802 RSI: 0000000000000000 RDI: 0000000000000000 [ 801.262667][T16415] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 801.262677][T16415] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 801.262694][T16415] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 801.262717][T16415] [ 801.853612][T16440] CIFS: Attempting to mount //127.0.0.1/test [ 801.854261][T16440] CIFS: VFS: Error connecting to socket. Aborting operation. [ 801.854282][T16440] CIFS: VFS: cifs_mount failed w/return code = -111 [ 801.870591][T16442] netlink: 'syz.2.2659': attribute type 1 has an invalid length. [ 801.902273][ T3416] usb 6-1: new high-speed USB device number 83 using dummy_hcd [ 801.996835][T16440] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2658'. [ 801.996857][T16440] netlink: 5740 bytes leftover after parsing attributes in process `syz.4.2658'. [ 802.040992][T16446] syzkaller0: entered promiscuous mode [ 802.041007][T16446] syzkaller0: entered allmulticast mode [ 802.072183][ T3416] usb 6-1: Using ep0 maxpacket: 32 [ 802.072826][ T3416] usb 6-1: New USB device found: idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 802.073827][ T3416] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 802.073857][ T3416] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 802.073889][ T3416] usb 6-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 802.073911][ T3416] usb 6-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 802.073934][ T3416] usb 6-1: config 0 interface 0 has no altsetting 0 [ 802.076114][ T3416] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 802.076128][ T3416] usb 6-1: Product: syz [ 802.076137][ T3416] usb 6-1: Manufacturer: syz [ 802.076145][ T3416] usb 6-1: SerialNumber: syz [ 802.077793][ T3416] usb 6-1: config 0 descriptor?? [ 802.081506][ T3416] ldusb 6-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 802.083372][ T3416] ldusb 6-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 802.183231][T16453] FAULT_INJECTION: forcing a failure. [ 802.183231][T16453] name failslab, interval 1, probability 0, space 0, times 0 [ 802.183254][T16453] CPU: 3 UID: 0 PID: 16453 Comm: syz.2.2662 Tainted: G L syzkaller #0 PREEMPT(full) [ 802.183272][T16453] Tainted: [L]=SOFTLOCKUP [ 802.183277][T16453] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 802.183285][T16453] Call Trace: [ 802.183290][T16453] [ 802.183295][T16453] dump_stack_lvl+0x100/0x190 [ 802.183321][T16453] should_fail_ex.cold+0x5/0xa [ 802.183339][T16453] should_failslab+0xc2/0x120 [ 802.183358][T16453] __kmalloc_noprof+0xfc/0x840 [ 802.183371][T16453] ? x509_get_sig_params+0x443/0x710 [ 802.183406][T16453] x509_get_sig_params+0x443/0x710 [ 802.183427][T16453] x509_cert_parse+0x4e9/0x910 [ 802.183446][T16453] x509_key_preparse+0x65/0x9c0 [ 802.183467][T16453] asymmetric_key_preparse+0xce/0x1d0 [ 802.183482][T16453] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 802.183498][T16453] __key_create_or_update+0x3f6/0xe30 [ 802.183522][T16453] ? __pfx___key_create_or_update+0x10/0x10 [ 802.183543][T16453] ? lookup_user_key+0x58c/0x14f0 [ 802.183562][T16453] ? __pfx_lookup_user_key+0x10/0x10 [ 802.183591][T16453] key_create_or_update+0x42/0x60 [ 802.183614][T16453] __do_sys_add_key+0x2e8/0x460 [ 802.183630][T16453] ? __pfx___do_sys_add_key+0x10/0x10 [ 802.183650][T16453] __do_fast_syscall_32+0x14d/0x8e0 [ 802.183669][T16453] ? lockdep_hardirqs_on+0x7d/0x110 [ 802.183688][T16453] do_fast_syscall_32+0x32/0x70 [ 802.183708][T16453] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 802.183724][T16453] RIP: 0023:0xf7fb2fbc [ 802.183735][T16453] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 802.183748][T16453] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 000000000000011e [ 802.183761][T16453] RAX: ffffffffffffffda RBX: 0000000080000300 RCX: 0000000000000000 [ 802.183769][T16453] RDX: 0000000080000580 RSI: 0000000000000559 RDI: 00000000fffffffd [ 802.183777][T16453] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 802.183784][T16453] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 802.183791][T16453] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 802.183807][T16453] [ 802.317706][T16459] FAULT_INJECTION: forcing a failure. [ 802.317706][T16459] name failslab, interval 1, probability 0, space 0, times 0 [ 802.317738][T16459] CPU: 1 UID: 0 PID: 16459 Comm: syz.2.2665 Tainted: G L syzkaller #0 PREEMPT(full) [ 802.317767][T16459] Tainted: [L]=SOFTLOCKUP [ 802.317774][T16459] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 802.317801][T16459] Call Trace: [ 802.317808][T16459] [ 802.317815][T16459] dump_stack_lvl+0x100/0x190 [ 802.317856][T16459] should_fail_ex.cold+0x5/0xa [ 802.317884][T16459] should_failslab+0xc2/0x120 [ 802.317909][T16459] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 802.317932][T16459] ? __alloc_skb+0x5b7/0x710 [ 802.317961][T16459] ? __alloc_skb+0x140/0x710 [ 802.317991][T16459] __alloc_skb+0x140/0x710 [ 802.318017][T16459] ? __alloc_skb+0x5b7/0x710 [ 802.318042][T16459] ? __pfx___alloc_skb+0x10/0x10 [ 802.318074][T16459] netlink_alloc_large_skb+0x69/0x150 [ 802.318093][T16459] netlink_sendmsg+0x755/0x10c0 [ 802.318118][T16459] ? __pfx_netlink_sendmsg+0x10/0x10 [ 802.318145][T16459] ? apparmor_socket_sendmsg+0x165/0x280 [ 802.318175][T16459] ? ____sys_sendmsg+0xa99/0xc30 [ 802.318197][T16459] ____sys_sendmsg+0xa99/0xc30 [ 802.318217][T16459] ? __pfx_netlink_sendmsg+0x10/0x10 [ 802.318235][T16459] ? __pfx_____sys_sendmsg+0x10/0x10 [ 802.318263][T16459] ___sys_sendmsg+0x190/0x1e0 [ 802.318289][T16459] ? __pfx____sys_sendmsg+0x10/0x10 [ 802.318323][T16459] ? find_held_lock+0x2b/0x80 [ 802.318365][T16459] __sys_sendmsg+0x160/0x210 [ 802.318396][T16459] ? __pfx___sys_sendmsg+0x10/0x10 [ 802.318439][T16459] __do_fast_syscall_32+0x14d/0x8e0 [ 802.318470][T16459] ? lockdep_hardirqs_on+0x7d/0x110 [ 802.318499][T16459] do_fast_syscall_32+0x32/0x70 [ 802.318528][T16459] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 802.318553][T16459] RIP: 0023:0xf7fb2fbc [ 802.318584][T16459] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 802.318604][T16459] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 802.318625][T16459] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000380 [ 802.318639][T16459] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 802.318651][T16459] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 802.318663][T16459] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 802.318675][T16459] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 802.318698][T16459] [ 802.391970][ T3416] usb 6-1: USB disconnect, device number 83 [ 802.392115][ C1] ldusb 6-1:0.0: usb_submit_urb failed (-19) [ 802.392158][T16429] ldusb 6-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 802.392283][T16460] ldusb 6-1:0.0: Couldn't submit HID_REQ_SET_REPORT -19 [ 802.394651][ T3416] ldusb 6-1:0.0: LD USB Device #0 now disconnected [ 802.487464][T16468] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2666'. [ 802.732457][ T5902] net_ratelimit: 33 callbacks suppressed [ 802.732478][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 802.732500][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 802.732520][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 802.732540][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 802.924590][T16487] FAULT_INJECTION: forcing a failure. [ 802.924590][T16487] name failslab, interval 1, probability 0, space 0, times 0 [ 802.924621][T16487] CPU: 2 UID: 0 PID: 16487 Comm: syz.0.2671 Tainted: G L syzkaller #0 PREEMPT(full) [ 802.924647][T16487] Tainted: [L]=SOFTLOCKUP [ 802.924654][T16487] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 802.924666][T16487] Call Trace: [ 802.924674][T16487] [ 802.924681][T16487] dump_stack_lvl+0x100/0x190 [ 802.924722][T16487] should_fail_ex.cold+0x5/0xa [ 802.924750][T16487] should_failslab+0xc2/0x120 [ 802.924775][T16487] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 802.924796][T16487] ? __alloc_skb+0x5b7/0x710 [ 802.924825][T16487] ? __alloc_skb+0x140/0x710 [ 802.924857][T16487] __alloc_skb+0x140/0x710 [ 802.924884][T16487] ? __alloc_skb+0x5b7/0x710 [ 802.924912][T16487] ? __pfx___alloc_skb+0x10/0x10 [ 802.924948][T16487] netlink_alloc_large_skb+0x69/0x150 [ 802.924970][T16487] netlink_sendmsg+0x755/0x10c0 [ 802.924994][T16487] ? __pfx_netlink_sendmsg+0x10/0x10 [ 802.925019][T16487] ? apparmor_socket_sendmsg+0x165/0x280 [ 802.925050][T16487] ? ____sys_sendmsg+0xa99/0xc30 [ 802.925071][T16487] ____sys_sendmsg+0xa99/0xc30 [ 802.925092][T16487] ? __pfx_netlink_sendmsg+0x10/0x10 [ 802.925114][T16487] ? __pfx_____sys_sendmsg+0x10/0x10 [ 802.925148][T16487] ___sys_sendmsg+0x190/0x1e0 [ 802.925174][T16487] ? __pfx____sys_sendmsg+0x10/0x10 [ 802.925210][T16487] ? find_held_lock+0x2b/0x80 [ 802.925255][T16487] __sys_sendmsg+0x160/0x210 [ 802.925286][T16487] ? __pfx___sys_sendmsg+0x10/0x10 [ 802.925329][T16487] __do_fast_syscall_32+0x14d/0x8e0 [ 802.925359][T16487] ? lockdep_hardirqs_on+0x7d/0x110 [ 802.925389][T16487] do_fast_syscall_32+0x32/0x70 [ 802.925418][T16487] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 802.925442][T16487] RIP: 0023:0xf7f72fbc [ 802.925458][T16487] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 802.925475][T16487] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 802.925495][T16487] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 802.925507][T16487] RDX: 000000000000c000 RSI: 0000000000000000 RDI: 0000000000000000 [ 802.925545][T16487] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 802.925577][T16487] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 802.925611][T16487] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 802.925637][T16487] [ 802.981015][T16495] FAULT_INJECTION: forcing a failure. [ 802.981015][T16495] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 802.981044][T16495] CPU: 1 UID: 0 PID: 16495 Comm: syz.0.2673 Tainted: G L syzkaller #0 PREEMPT(full) [ 802.981070][T16495] Tainted: [L]=SOFTLOCKUP [ 802.981078][T16495] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 802.981089][T16495] Call Trace: [ 802.981095][T16495] [ 802.981103][T16495] dump_stack_lvl+0x100/0x190 [ 802.981138][T16495] should_fail_ex.cold+0x5/0xa [ 802.981164][T16495] _copy_from_iter+0x1f4/0x16c0 [ 802.981187][T16495] ? __lock_acquire+0x5c0/0x1f40 [ 802.981210][T16495] ? __pfx__copy_from_iter+0x10/0x10 [ 802.981233][T16495] ? lock_acquire+0x1d1/0x380 [ 802.981252][T16495] ? aa_file_perm+0x197/0x14d0 [ 802.981280][T16495] tun_get_user+0x3ba/0x3ee0 [ 802.981319][T16495] ? __lock_acquire+0x5c0/0x1f40 [ 802.981341][T16495] ? __pfx_tun_get_user+0x10/0x10 [ 802.981367][T16495] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 802.981402][T16495] ? find_held_lock+0x2b/0x80 [ 802.981430][T16495] ? tun_get+0x191/0x370 [ 802.981448][T16495] ? tun_get+0x191/0x370 [ 802.981476][T16495] tun_chr_write_iter+0xdc/0x200 [ 802.981501][T16495] vfs_write+0x6af/0x1040 [ 802.981525][T16495] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 802.981551][T16495] ? __pfx_vfs_write+0x10/0x10 [ 802.981571][T16495] ? find_held_lock+0x2b/0x80 [ 802.981634][T16495] ksys_write+0x12a/0x250 [ 802.981658][T16495] ? __pfx_ksys_write+0x10/0x10 [ 802.981703][T16495] __do_fast_syscall_32+0x14d/0x8e0 [ 802.981734][T16495] ? lockdep_hardirqs_on+0x7d/0x110 [ 802.981765][T16495] do_fast_syscall_32+0x32/0x70 [ 802.981794][T16495] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 802.981819][T16495] RIP: 0023:0xf7f72fbc [ 802.981835][T16495] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 802.981855][T16495] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 802.981874][T16495] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800003c0 [ 802.981888][T16495] RDX: 0000000000000073 RSI: 0000000000000000 RDI: 0000000000000000 [ 802.981899][T16495] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 802.981911][T16495] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 802.981925][T16495] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 802.981950][T16495] [ 803.213072][ T25] usb 9-1: new high-speed USB device number 40 using dummy_hcd [ 803.227603][T16502] FAULT_INJECTION: forcing a failure. [ 803.227603][T16502] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 803.227635][T16502] CPU: 2 UID: 0 PID: 16502 Comm: syz.1.2676 Tainted: G L syzkaller #0 PREEMPT(full) [ 803.227662][T16502] Tainted: [L]=SOFTLOCKUP [ 803.227670][T16502] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 803.227683][T16502] Call Trace: [ 803.227691][T16502] [ 803.227699][T16502] dump_stack_lvl+0x100/0x190 [ 803.227735][T16502] should_fail_ex.cold+0x5/0xa [ 803.227765][T16502] _copy_to_user+0x32/0xd0 [ 803.227800][T16502] bpf_prog_test_run_syscall+0x5cc/0xb30 [ 803.227836][T16502] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 803.227869][T16502] ? fput+0x7c/0x100 [ 803.227898][T16502] ? __bpf_prog_get+0x97/0x290 [ 803.227925][T16502] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 803.227958][T16502] __sys_bpf+0x1d13/0x4b60 [ 803.227986][T16502] ? __pfx___sys_bpf+0x10/0x10 [ 803.228005][T16502] ? lock_acquire+0x1d1/0x380 [ 803.228025][T16502] ? get_pid_task+0x2a/0x250 [ 803.228051][T16502] ? find_held_lock+0x2b/0x80 [ 803.228079][T16502] ? get_pid_task+0xfc/0x250 [ 803.228103][T16502] ? get_pid_task+0xfc/0x250 [ 803.228135][T16502] ? proc_fail_nth_write+0x9f/0x220 [ 803.228163][T16502] ? find_held_lock+0x2b/0x80 [ 803.228197][T16502] ? rcu_read_lock_any_held+0x6a/0x90 [ 803.228227][T16502] ? find_held_lock+0x2b/0x80 [ 803.228261][T16502] ? ksys_write+0x190/0x250 [ 803.228282][T16502] ? ksys_write+0x190/0x250 [ 803.228321][T16502] ? lock_acquire+0x1d1/0x380 [ 803.228341][T16502] ? __might_fault+0xc5/0x140 [ 803.228366][T16502] ? find_held_lock+0x2b/0x80 [ 803.228399][T16502] ? __ia32_sys_bpf+0xcc/0x170 [ 803.228419][T16502] __ia32_sys_bpf+0xcc/0x170 [ 803.228441][T16502] ? __might_fault+0x111/0x140 [ 803.228466][T16502] __do_fast_syscall_32+0x14d/0x8e0 [ 803.228495][T16502] ? lockdep_hardirqs_on+0x7d/0x110 [ 803.228526][T16502] do_fast_syscall_32+0x32/0x70 [ 803.228556][T16502] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 803.228582][T16502] RIP: 0023:0xf73aefbc [ 803.228598][T16502] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 803.228618][T16502] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 803.228638][T16502] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000340 [ 803.228652][T16502] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 803.228664][T16502] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 803.228677][T16502] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 803.228690][T16502] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 803.228717][T16502] [ 803.256467][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 803.256487][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 803.256501][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 803.256514][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 803.280019][T16504] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2677'. [ 803.772410][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 803.772445][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 804.092515][ T25] usb 9-1: New USB device found: idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 804.093951][ T25] usb 9-1: config 0 has an invalid interface number: 50 but max is 0 [ 804.093973][ T25] usb 9-1: config 0 has no interface number 0 [ 804.094007][ T25] usb 9-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 804.096153][ T25] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 804.096172][ T25] usb 9-1: Product: syz [ 804.096188][ T25] usb 9-1: Manufacturer: syz [ 804.096203][ T25] usb 9-1: SerialNumber: syz [ 804.125806][T16538] FAULT_INJECTION: forcing a failure. [ 804.125806][T16538] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 804.125829][T16538] CPU: 0 UID: 0 PID: 16538 Comm: syz.0.2681 Tainted: G L syzkaller #0 PREEMPT(full) [ 804.125846][T16538] Tainted: [L]=SOFTLOCKUP [ 804.125850][T16538] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 804.125857][T16538] Call Trace: [ 804.125863][T16538] [ 804.125868][T16538] dump_stack_lvl+0x100/0x190 [ 804.125891][T16538] should_fail_ex.cold+0x5/0xa [ 804.125909][T16538] _copy_to_user+0x32/0xd0 [ 804.125931][T16538] put_cmsg_compat+0x21f/0x6f0 [ 804.125951][T16538] ? __pfx_put_cmsg_compat+0x10/0x10 [ 804.125971][T16538] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 804.125991][T16538] put_cmsg+0x512/0x5d0 [ 804.126008][T16538] ? skb_copy_datagram_iter+0xa1/0x250 [ 804.126026][T16538] packet_recvmsg+0x799/0x1650 [ 804.126047][T16538] ? __pfx_packet_recvmsg+0x10/0x10 [ 804.126064][T16538] ? __lock_acquire+0x5c0/0x1f40 [ 804.126081][T16538] ? aa_sock_msg_perm+0x11e/0x200 [ 804.126098][T16538] ? __pfx_packet_recvmsg+0x10/0x10 [ 804.126116][T16538] sock_recvmsg+0x1d5/0x220 [ 804.126131][T16538] ____sys_recvmsg+0x21e/0x6a0 [ 804.126148][T16538] ? __pfx_____sys_recvmsg+0x10/0x10 [ 804.126167][T16538] ? __lock_acquire+0x5c0/0x1f40 [ 804.126183][T16538] ___sys_recvmsg+0x16a/0x1a0 [ 804.126199][T16538] ? __pfx____sys_recvmsg+0x10/0x10 [ 804.126218][T16538] ? lock_acquire+0x1d1/0x380 [ 804.126256][T16538] do_recvmmsg+0x548/0x750 [ 804.126292][T16538] ? __pfx_do_recvmmsg+0x10/0x10 [ 804.126335][T16538] ? find_held_lock+0x2b/0x80 [ 804.126363][T16538] ? ksys_write+0x190/0x250 [ 804.126384][T16538] ? ksys_write+0x190/0x250 [ 804.126409][T16538] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 804.126431][T16538] __sys_recvmmsg+0x21f/0x270 [ 804.126443][T16538] ? __pfx___sys_recvmmsg+0x10/0x10 [ 804.126455][T16538] ? __might_fault+0xc5/0x140 [ 804.126471][T16538] ? __might_fault+0xc5/0x140 [ 804.126489][T16538] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 804.126506][T16538] ? __might_fault+0x111/0x140 [ 804.126522][T16538] __do_fast_syscall_32+0x14d/0x8e0 [ 804.126540][T16538] ? lockdep_hardirqs_on+0x7d/0x110 [ 804.126559][T16538] do_fast_syscall_32+0x32/0x70 [ 804.126578][T16538] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 804.126594][T16538] RIP: 0023:0xf7f72fbc [ 804.126605][T16538] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 804.126617][T16538] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 804.126629][T16538] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000480 [ 804.126638][T16538] RDX: 0000000000000179 RSI: 0000000000000000 RDI: 0000000000000000 [ 804.126645][T16538] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 804.126652][T16538] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 804.126659][T16538] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 804.126674][T16538] [ 804.555390][ T25] usb 9-1: config 0 descriptor?? [ 804.564802][ T25] yurex 9-1:0.50: USB YUREX device now attached to Yurex #0 [ 804.761923][ T5165] usb 9-1: USB disconnect, device number 40 [ 804.765668][ T5165] yurex 9-1:0.50: USB YUREX #0 now disconnected [ 805.462100][ T3416] usb 7-1: new high-speed USB device number 106 using dummy_hcd [ 805.481952][T16563] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2686'. [ 805.502094][ T42] usb 6-1: new low-speed USB device number 84 using dummy_hcd [ 805.612116][ T3416] usb 7-1: Using ep0 maxpacket: 32 [ 805.613978][ T3416] usb 7-1: New USB device found: idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 805.614978][ T3416] usb 7-1: config index 0 descriptor too short (expected 156, got 27) [ 805.615012][ T3416] usb 7-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 805.615045][ T3416] usb 7-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 805.615069][ T3416] usb 7-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 805.615093][ T3416] usb 7-1: config 0 interface 0 has no altsetting 0 [ 805.617331][ T3416] usb 7-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 805.617354][ T3416] usb 7-1: Product: syz [ 805.617367][ T3416] usb 7-1: Manufacturer: syz [ 805.617380][ T3416] usb 7-1: SerialNumber: syz [ 805.619746][ T3416] usb 7-1: config 0 descriptor?? [ 805.624515][ T3416] ldusb 7-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 805.626005][ T3416] ldusb 7-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 805.652105][ T42] usb 6-1: Invalid ep0 maxpacket: 64 [ 805.782136][ T42] usb 6-1: new low-speed USB device number 85 using dummy_hcd [ 805.930897][T16554] ldusb 7-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 805.931210][ C3] ldusb 7-1:0.0: usb_submit_urb failed (-19) [ 805.931213][ T30] usb 7-1: USB disconnect, device number 106 [ 805.931293][T16567] ldusb 7-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 805.932154][ T42] usb 6-1: Invalid ep0 maxpacket: 64 [ 805.932379][ T42] usb usb6-port1: attempt power cycle [ 805.935320][ T30] ldusb 7-1:0.0: LD USB Device #0 now disconnected [ 806.272116][ T42] usb 6-1: new low-speed USB device number 86 using dummy_hcd [ 806.292585][ T42] usb 6-1: Invalid ep0 maxpacket: 64 [ 806.308900][ T43] kauditd_printk_skb: 4922 callbacks suppressed [ 806.308922][ T43] audit: type=1326 audit(1794365910.865:60993): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16572 comm="syz.0.2689" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f72fbc code=0x0 [ 806.422184][ T42] usb 6-1: new low-speed USB device number 87 using dummy_hcd [ 806.442900][ T42] usb 6-1: Invalid ep0 maxpacket: 64 [ 806.443187][ T42] usb usb6-port1: unable to enumerate USB device [ 806.454659][T16578] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 806.454683][T16578] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 806.458917][T16578] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 806.458939][T16578] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 806.679073][T16581] PKCS7: Unsupported SignedData version [ 806.752294][T16589] FAULT_INJECTION: forcing a failure. [ 806.752294][T16589] name failslab, interval 1, probability 0, space 0, times 0 [ 806.752315][T16589] CPU: 2 UID: 0 PID: 16589 Comm: syz.2.2694 Tainted: G L syzkaller #0 PREEMPT(full) [ 806.752334][T16589] Tainted: [L]=SOFTLOCKUP [ 806.752340][T16589] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 806.752350][T16589] Call Trace: [ 806.752357][T16589] [ 806.752365][T16589] dump_stack_lvl+0x100/0x190 [ 806.752397][T16589] should_fail_ex.cold+0x5/0xa [ 806.752422][T16589] should_failslab+0xc2/0x120 [ 806.752446][T16589] __kmalloc_noprof+0xfc/0x840 [ 806.752467][T16589] ? bpf_test_init.isra.0+0x88/0x100 [ 806.752496][T16589] bpf_test_init.isra.0+0x88/0x100 [ 806.752515][T16589] bpf_prog_test_run_xdp+0x587/0x1670 [ 806.752539][T16589] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 806.752562][T16589] ? fput+0x7c/0x100 [ 806.752579][T16589] ? __bpf_prog_get+0x97/0x290 [ 806.752596][T16589] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 806.752617][T16589] __sys_bpf+0x1d13/0x4b60 [ 806.752634][T16589] ? __pfx___sys_bpf+0x10/0x10 [ 806.752645][T16589] ? lock_acquire+0x1d1/0x380 [ 806.752659][T16589] ? get_pid_task+0x2a/0x250 [ 806.752675][T16589] ? find_held_lock+0x2b/0x80 [ 806.752691][T16589] ? get_pid_task+0xfc/0x250 [ 806.752706][T16589] ? get_pid_task+0xfc/0x250 [ 806.752725][T16589] ? proc_fail_nth_write+0x9f/0x220 [ 806.752743][T16589] ? find_held_lock+0x2b/0x80 [ 806.752763][T16589] ? rcu_read_lock_any_held+0x6a/0x90 [ 806.752781][T16589] ? find_held_lock+0x2b/0x80 [ 806.752798][T16589] ? ksys_write+0x190/0x250 [ 806.752811][T16589] ? ksys_write+0x190/0x250 [ 806.752833][T16589] ? lock_acquire+0x1d1/0x380 [ 806.752845][T16589] ? __might_fault+0xc5/0x140 [ 806.752861][T16589] ? find_held_lock+0x2b/0x80 [ 806.752880][T16589] ? __ia32_sys_bpf+0xcc/0x170 [ 806.752893][T16589] __ia32_sys_bpf+0xcc/0x170 [ 806.752906][T16589] ? __might_fault+0x111/0x140 [ 806.752922][T16589] __do_fast_syscall_32+0x14d/0x8e0 [ 806.752942][T16589] ? lockdep_hardirqs_on+0x7d/0x110 [ 806.752961][T16589] do_fast_syscall_32+0x32/0x70 [ 806.752979][T16589] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 806.752995][T16589] RIP: 0023:0xf7fb2fbc [ 806.753005][T16589] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 806.753017][T16589] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 806.753030][T16589] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080007880 [ 806.753038][T16589] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 806.753046][T16589] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 806.753053][T16589] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 806.753061][T16589] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 806.753075][T16589] [ 806.785323][T16594] FAULT_INJECTION: forcing a failure. [ 806.785323][T16594] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 806.785353][T16594] CPU: 3 UID: 0 PID: 16594 Comm: syz.2.2696 Tainted: G L syzkaller #0 PREEMPT(full) [ 806.785381][T16594] Tainted: [L]=SOFTLOCKUP [ 806.785388][T16594] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 806.785398][T16594] Call Trace: [ 806.785406][T16594] [ 806.785413][T16594] dump_stack_lvl+0x100/0x190 [ 806.785449][T16594] should_fail_ex.cold+0x5/0xa [ 806.785481][T16594] _copy_from_user+0x2e/0xd0 [ 806.785516][T16594] get_compat_msghdr+0xb3/0x480 [ 806.785543][T16594] ? __pfx_get_compat_msghdr+0x10/0x10 [ 806.785593][T16594] ? _kstrtoull+0x144/0x200 [ 806.785619][T16594] ? __pfx__kstrtoull+0x10/0x10 [ 806.785646][T16594] ___sys_sendmsg+0x1b6/0x1e0 [ 806.785676][T16594] ? __pfx____sys_sendmsg+0x10/0x10 [ 806.785698][T16594] ? __lock_acquire+0x5c0/0x1f40 [ 806.785725][T16594] ? __fget_files+0x34/0x3d0 [ 806.785768][T16594] __sys_sendmmsg+0x304/0x440 [ 806.785792][T16594] ? __pfx___sys_sendmmsg+0x10/0x10 [ 806.785813][T16594] ? find_held_lock+0x2b/0x80 [ 806.785863][T16594] ? __might_fault+0xc5/0x140 [ 806.785888][T16594] ? find_held_lock+0x2b/0x80 [ 806.785917][T16594] ? __might_fault+0xc5/0x140 [ 806.785942][T16594] ? __might_fault+0xc5/0x140 [ 806.785972][T16594] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 806.785999][T16594] __do_fast_syscall_32+0x14d/0x8e0 [ 806.786026][T16594] ? lockdep_hardirqs_on+0x7d/0x110 [ 806.786057][T16594] do_fast_syscall_32+0x32/0x70 [ 806.786088][T16594] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 806.786115][T16594] RIP: 0023:0xf7fb2fbc [ 806.786131][T16594] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 806.786147][T16594] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 806.786165][T16594] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080003440 [ 806.786176][T16594] RDX: 0000000000000001 RSI: 0000000000004884 RDI: 0000000000000000 [ 806.786189][T16594] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 806.786200][T16594] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 806.786213][T16594] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 806.786240][T16594] [ 807.062089][ T25] usb 7-1: new high-speed USB device number 107 using dummy_hcd [ 807.112237][T16602] syzkaller0: entered promiscuous mode [ 807.112263][T16602] syzkaller0: entered allmulticast mode [ 807.220930][T16607] FAULT_INJECTION: forcing a failure. [ 807.220930][T16607] name failslab, interval 1, probability 0, space 0, times 0 [ 807.220961][T16607] CPU: 2 UID: 0 PID: 16607 Comm: syz.0.2700 Tainted: G L syzkaller #0 PREEMPT(full) [ 807.220986][T16607] Tainted: [L]=SOFTLOCKUP [ 807.220993][T16607] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 807.221004][T16607] Call Trace: [ 807.221011][T16607] [ 807.221019][T16607] dump_stack_lvl+0x100/0x190 [ 807.221053][T16607] should_fail_ex.cold+0x5/0xa [ 807.221080][T16607] should_failslab+0xc2/0x120 [ 807.221104][T16607] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 807.221124][T16607] ? __alloc_skb+0x5b7/0x710 [ 807.221150][T16607] ? __alloc_skb+0x140/0x710 [ 807.221180][T16607] __alloc_skb+0x140/0x710 [ 807.221205][T16607] ? __alloc_skb+0x5b7/0x710 [ 807.221230][T16607] ? __pfx___alloc_skb+0x10/0x10 [ 807.221271][T16607] netlink_alloc_large_skb+0x69/0x150 [ 807.221292][T16607] netlink_sendmsg+0x755/0x10c0 [ 807.221315][T16607] ? __pfx_netlink_sendmsg+0x10/0x10 [ 807.221340][T16607] ? apparmor_socket_sendmsg+0x165/0x280 [ 807.221368][T16607] ? ____sys_sendmsg+0xa99/0xc30 [ 807.221389][T16607] ____sys_sendmsg+0xa99/0xc30 [ 807.221410][T16607] ? __pfx_netlink_sendmsg+0x10/0x10 [ 807.221430][T16607] ? __pfx_____sys_sendmsg+0x10/0x10 [ 807.221464][T16607] ___sys_sendmsg+0x190/0x1e0 [ 807.221488][T16607] ? __pfx____sys_sendmsg+0x10/0x10 [ 807.221522][T16607] ? find_held_lock+0x2b/0x80 [ 807.221588][T16607] __sys_sendmsg+0x160/0x210 [ 807.221619][T16607] ? __pfx___sys_sendmsg+0x10/0x10 [ 807.221659][T16607] __do_fast_syscall_32+0x14d/0x8e0 [ 807.221687][T16607] ? lockdep_hardirqs_on+0x7d/0x110 [ 807.221715][T16607] do_fast_syscall_32+0x32/0x70 [ 807.221742][T16607] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 807.221764][T16607] RIP: 0023:0xf7f72fbc [ 807.221779][T16607] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 807.221796][T16607] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 807.221814][T16607] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 807.221826][T16607] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 807.221837][T16607] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 807.221847][T16607] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 807.221858][T16607] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 807.221882][T16607] [ 807.242634][ T25] usb 7-1: New USB device found: idVendor=0451, idProduct=505f, bcdDevice=1.00 [ 807.243685][ T25] usb 7-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 807.243721][ T25] usb 7-1: config 2 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 807.243738][ T25] usb 7-1: config 2 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 807.245513][ T25] usb 7-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 807.245547][ T25] usb 7-1: config 2 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 807.245584][ T25] usb 7-1: config 2 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 807.247637][ T25] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 807.247657][ T25] usb 7-1: Product: syz [ 807.247669][ T25] usb 7-1: Manufacturer: syz [ 807.247682][ T25] usb 7-1: SerialNumber: syz [ 807.254772][ T25] ti_usb_3410_5052 7-1:2.0: TI USB 5052 2 port adapter converter detected [ 807.255038][ T25] ti_usb_3410_5052 7-1:2.0: missing endpoints [ 807.872741][ T5902] net_ratelimit: 32 callbacks suppressed [ 807.872806][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 807.872824][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 807.872837][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 807.872850][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 808.394146][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 808.394175][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 808.394195][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 808.394218][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 808.564548][T16639] rxe_eth0 speed is unknown, defaulting to 1000 [ 808.912343][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 808.912377][ T5902] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 809.018590][T16639] lo speed is unknown, defaulting to 1000 [ 809.295792][ T43] audit: type=1326 audit(1794365913.855:60994): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16649 comm="syz.4.2709" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f13fbc code=0x7fc00000 [ 809.295841][ T43] audit: type=1326 audit(1794365913.855:60995): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16649 comm="syz.4.2709" exe="/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf7f13fbc code=0x7fc00000 [ 809.295878][ T43] audit: type=1326 audit(1794365913.855:60996): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16649 comm="syz.4.2709" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f13fbc code=0x7fc00000 [ 809.295913][ T43] audit: type=1326 audit(1794365913.855:60997): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16649 comm="syz.4.2709" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f13fbc code=0x7fc00000 [ 809.295942][ T43] audit: type=1326 audit(1794365913.855:60998): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16649 comm="syz.4.2709" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f13fbc code=0x7fc00000 [ 809.295979][ T43] audit: type=1326 audit(1794365913.855:60999): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16649 comm="syz.4.2709" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f13fbc code=0x7fc00000 [ 809.296015][ T43] audit: type=1326 audit(1794365913.855:61000): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16649 comm="syz.4.2709" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f13fbc code=0x7fc00000 [ 809.296050][ T43] audit: type=1326 audit(1794365913.855:61001): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16649 comm="syz.4.2709" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f13fbc code=0x7fc00000 [ 809.296085][ T43] audit: type=1326 audit(1794365913.855:61002): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16649 comm="syz.4.2709" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f13fbc code=0x7fc00000 [ 809.919241][T15217] usb 7-1: USB disconnect, device number 107 [ 810.055935][T16658] FAULT_INJECTION: forcing a failure. [ 810.055935][T16658] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 810.055956][T16658] CPU: 3 UID: 0 PID: 16658 Comm: syz.1.2710 Tainted: G L syzkaller #0 PREEMPT(full) [ 810.055973][T16658] Tainted: [L]=SOFTLOCKUP [ 810.055978][T16658] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 810.055985][T16658] Call Trace: [ 810.055990][T16658] [ 810.055998][T16658] dump_stack_lvl+0x100/0x190 [ 810.056030][T16658] should_fail_ex.cold+0x5/0xa [ 810.056058][T16658] _copy_from_user+0x2e/0xd0 [ 810.056088][T16658] move_addr_to_kernel+0x65/0x170 [ 810.056113][T16658] get_compat_msghdr+0x3c7/0x480 [ 810.056140][T16658] ? __pfx_get_compat_msghdr+0x10/0x10 [ 810.056167][T16658] ? _kstrtoull+0x144/0x200 [ 810.056187][T16658] ? __pfx__kstrtoull+0x10/0x10 [ 810.056207][T16658] ___sys_sendmsg+0x1b6/0x1e0 [ 810.056237][T16658] ? __pfx____sys_sendmsg+0x10/0x10 [ 810.056260][T16658] ? __lock_acquire+0x5c0/0x1f40 [ 810.056286][T16658] ? __fget_files+0x34/0x3d0 [ 810.056311][T16658] __sys_sendmmsg+0x304/0x440 [ 810.056324][T16658] ? __pfx___sys_sendmmsg+0x10/0x10 [ 810.056335][T16658] ? find_held_lock+0x2b/0x80 [ 810.056384][T16658] ? __might_fault+0xc5/0x140 [ 810.056401][T16658] ? find_held_lock+0x2b/0x80 [ 810.056418][T16658] ? __might_fault+0xc5/0x140 [ 810.056433][T16658] ? __might_fault+0xc5/0x140 [ 810.056450][T16658] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 810.056468][T16658] __do_fast_syscall_32+0x14d/0x8e0 [ 810.056487][T16658] ? lockdep_hardirqs_on+0x7d/0x110 [ 810.056506][T16658] do_fast_syscall_32+0x32/0x70 [ 810.056524][T16658] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 810.056539][T16658] RIP: 0023:0xf73aefbc [ 810.056550][T16658] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 810.056562][T16658] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 810.056575][T16658] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 810.056583][T16658] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 810.056590][T16658] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 810.056598][T16658] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 810.056605][T16658] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 810.056620][T16658] [ 812.022490][ T1136] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0 [ 812.022518][ T1136] ata1.00: irq_stat 0x40000000 [ 812.022535][ T1136] ata1.00: failed command: READ DMA EXT [ 812.022545][ T1136] ata1.00: cmd 25/00:40:f6:66:0a/00:05:00:00:00/e0 tag 14 dma 688128 in [ 812.022545][ T1136] res 41/04:40:f6:66:0a/00:05:00:00:00/e0 Emask 0x1 (device error) [ 812.022597][ T1136] ata1.00: status: { DRDY ERR } [ 812.022610][ T1136] ata1.00: error: { ABRT } [ 812.027519][ T1136] ata1.00: configured for UDMA/100 [ 812.027659][ T1136] sd 0:0:0:0: [sda] tag#14 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s [ 812.027686][ T1136] sd 0:0:0:0: [sda] tag#14 Sense Key : Aborted Command [current] [ 812.027733][ T1136] sd 0:0:0:0: [sda] tag#14 Add. Sense: No additional sense information [ 812.027759][ T1136] sd 0:0:0:0: [sda] tag#14 CDB: Read(10) 28 00 00 0a 66 f6 00 05 40 00 [ 812.027772][ T1136] blk_print_req_error: 6 callbacks suppressed [ 812.027780][ T1136] I/O error, dev sda, sector 681718 op 0x0:(READ) flags 0x84700 phys_seg 168 prio class 2 [ 812.030203][ T1136] ata1: EH complete [ 812.326101][T16679] FAULT_INJECTION: forcing a failure. [ 812.326101][T16679] name failslab, interval 1, probability 0, space 0, times 0 [ 812.326125][T16679] CPU: 1 UID: 0 PID: 16679 Comm: syz.1.2716 Tainted: G L syzkaller #0 PREEMPT(full) [ 812.326144][T16679] Tainted: [L]=SOFTLOCKUP [ 812.326149][T16679] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 812.326157][T16679] Call Trace: [ 812.326162][T16679] [ 812.326168][T16679] dump_stack_lvl+0x100/0x190 [ 812.326196][T16679] should_fail_ex.cold+0x5/0xa [ 812.326217][T16679] should_failslab+0xc2/0x120 [ 812.326237][T16679] __kmalloc_noprof+0xfc/0x840 [ 812.326251][T16679] ? lsm_blob_alloc+0x68/0x90 [ 812.326269][T16679] lsm_blob_alloc+0x68/0x90 [ 812.326283][T16679] security_sk_alloc+0x2d/0x290 [ 812.326302][T16679] sk_prot_alloc+0x1d1/0x2a0 [ 812.326321][T16679] sk_alloc+0x36/0xe80 [ 812.326342][T16679] inet6_create+0x385/0x12b0 [ 812.326378][T16679] ? inet6_create+0x7f/0x12b0 [ 812.326397][T16679] __sock_create+0x339/0x860 [ 812.326417][T16679] smc_create+0x163/0x290 [ 812.326440][T16679] __sock_create+0x339/0x860 [ 812.326458][T16679] __sys_socket+0x14d/0x260 [ 812.326476][T16679] ? __pfx___sys_socket+0x10/0x10 [ 812.326494][T16679] ? __might_fault+0xc5/0x140 [ 812.326514][T16679] __ia32_sys_socket+0x72/0xb0 [ 812.326531][T16679] __do_fast_syscall_32+0x14d/0x8e0 [ 812.326555][T16679] do_fast_syscall_32+0x32/0x70 [ 812.326579][T16679] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 812.326597][T16679] RIP: 0023:0xf73aefbc [ 812.326608][T16679] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 812.326622][T16679] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 812.326636][T16679] RAX: ffffffffffffffda RBX: 000000000000002b RCX: 0000000000080801 [ 812.326644][T16679] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 812.326652][T16679] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 812.326660][T16679] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 812.326668][T16679] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 812.326683][T16679] [ 813.032450][T10436] net_ratelimit: 30 callbacks suppressed [ 813.032473][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 813.032496][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 813.032517][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 813.032538][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 813.552258][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 813.552290][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 813.552313][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 813.552335][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 814.063126][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 814.063159][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 814.924529][ T1449] ieee802154 phy0 wpan0: encryption failed: -22 [ 814.924585][ T1449] ieee802154 phy1 wpan1: encryption failed: -22 [ 815.092121][ T3416] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 815.242909][ T3416] usb 6-1: New USB device found: idVendor=0451, idProduct=505f, bcdDevice=1.00 [ 815.245290][ T3416] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 815.245332][ T3416] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 815.245350][ T3416] usb 6-1: config 2 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 815.245368][ T3416] usb 6-1: config 2 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 815.246543][ T3416] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 815.246580][ T3416] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 815.246598][ T3416] usb 6-1: config 2 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 815.246616][ T3416] usb 6-1: config 2 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 815.436580][ T3416] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 815.436604][ T3416] usb 6-1: Product: syz [ 815.436617][ T3416] usb 6-1: Manufacturer: syz [ 815.436629][ T3416] usb 6-1: SerialNumber: syz [ 815.452306][ T3416] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 815.467139][ T3416] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 815.486200][ T3416] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 816.154967][T16697] Bluetooth: MGMT ver 1.23 [ 816.203234][ T1136] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0 [ 816.203262][ T1136] ata1.00: irq_stat 0x40000000 [ 816.203279][ T1136] ata1.00: failed command: READ DMA EXT [ 816.203292][ T1136] ata1.00: cmd 25/00:e8:1e:2e:01/00:05:00:00:00/e0 tag 14 dma 774144 in [ 816.203292][ T1136] res 41/04:e8:1e:2e:01/00:05:00:00:00/e0 Emask 0x1 (device error) [ 816.203346][ T1136] ata1.00: status: { DRDY ERR } [ 816.203360][ T1136] ata1.00: error: { ABRT } [ 816.204216][ T1136] ata1.00: configured for UDMA/100 [ 816.204381][ T1136] sd 0:0:0:0: [sda] tag#14 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s [ 816.204423][ T1136] sd 0:0:0:0: [sda] tag#14 Sense Key : Aborted Command [current] [ 816.204455][ T1136] sd 0:0:0:0: [sda] tag#14 Add. Sense: No additional sense information [ 816.204492][ T1136] sd 0:0:0:0: [sda] tag#14 CDB: Read(10) 28 00 00 01 2e 1e 00 05 e8 00 [ 816.204516][ T1136] I/O error, dev sda, sector 77342 op 0x0:(READ) flags 0x84700 phys_seg 168 prio class 2 [ 816.204641][ T1136] ata1: EH complete [ 816.337602][ T1136] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0 [ 816.337635][ T1136] ata1.00: irq_stat 0x40000000 [ 816.337652][ T1136] ata1.00: failed command: READ DMA EXT [ 816.337663][ T1136] ata1.00: cmd 25/00:40:7e:47:01/00:05:00:00:00/e0 tag 30 dma 688128 in [ 816.337663][ T1136] res 41/04:40:7e:47:01/00:05:00:00:00/e0 Emask 0x1 (device error) [ 816.337712][ T1136] ata1.00: status: { DRDY ERR } [ 816.337724][ T1136] ata1.00: error: { ABRT } [ 816.338761][ T1136] ata1.00: configured for UDMA/100 [ 816.338922][ T1136] sd 0:0:0:0: [sda] tag#30 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s [ 816.338961][ T1136] sd 0:0:0:0: [sda] tag#30 Sense Key : Aborted Command [current] [ 816.338994][ T1136] sd 0:0:0:0: [sda] tag#30 Add. Sense: No additional sense information [ 816.339028][ T1136] sd 0:0:0:0: [sda] tag#30 CDB: Read(10) 28 00 00 01 47 7e 00 05 40 00 [ 816.339049][ T1136] I/O error, dev sda, sector 83838 op 0x0:(READ) flags 0x84700 phys_seg 168 prio class 2 [ 816.341509][ T1136] ata1: EH complete [ 816.723135][T16692] ti_usb_3410_5052_2 ttyUSB0: ti_open - no interrupt urb [ 817.426195][ T1136] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0 [ 817.426214][ T1136] ata1.00: irq_stat 0x40000000 [ 817.426225][ T1136] ata1.00: failed command: READ DMA EXT [ 817.426232][ T1136] ata1.00: cmd 25/00:58:76:24:01/00:07:00:00:00/e0 tag 30 dma 962560 in [ 817.426232][ T1136] res 41/04:58:76:24:01/00:07:00:00:00/e0 Emask 0x1 (device error) [ 817.426264][ T1136] ata1.00: status: { DRDY ERR } [ 817.426273][ T1136] ata1.00: error: { ABRT } [ 817.426988][ T1136] ata1.00: configured for UDMA/100 [ 817.427216][ T1136] sd 0:0:0:0: [sda] tag#30 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s [ 817.427243][ T1136] sd 0:0:0:0: [sda] tag#30 Sense Key : Aborted Command [current] [ 817.427263][ T1136] sd 0:0:0:0: [sda] tag#30 Add. Sense: No additional sense information [ 817.427283][ T1136] sd 0:0:0:0: [sda] tag#30 CDB: Read(10) 28 00 00 01 24 76 00 07 58 00 [ 817.427296][ T1136] I/O error, dev sda, sector 74870 op 0x0:(READ) flags 0x84700 phys_seg 168 prio class 2 [ 817.427380][ T1136] ata1: EH complete [ 818.057430][T16670] ------------[ cut here ]------------ [ 818.057441][T16670] current->flags & PF_MEMALLOC [ 818.057461][T16670] WARNING: mm/page_alloc.c:4824 at __alloc_frozen_pages_noprof+0x1e0b/0x31e0, CPU#2: syz.2.2711/16670 [ 818.064483][T16670] Modules linked in: [ 818.066087][T16670] CPU: 2 UID: 0 PID: 16670 Comm: syz.2.2711 Tainted: G L syzkaller #0 PREEMPT(full) [ 818.069749][T16670] Tainted: [L]=SOFTLOCKUP [ 818.071490][T16670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 818.075035][T16670] RIP: 0010:__alloc_frozen_pages_noprof+0x1e0b/0x31e0 [ 818.077674][T16670] Code: 38 d0 7c 08 84 d2 0f 85 56 13 00 00 65 48 8b 05 43 7c 41 13 c7 84 24 a0 00 00 00 00 80 00 00 f6 40 2d 08 0f 84 0d e7 ff ff 90 <0f> 0b 90 e9 04 e7 ff ff 90 0f 0b 90 e9 63 f8 ff ff 8b 84 24 a0 00 [ 818.084435][T16670] RSP: 0000:ffffc9000555d8b8 EFLAGS: 00010202 [ 818.086755][T16670] RAX: ffff88801effa580 RBX: 0000000000000000 RCX: 1ffff1100fffad69 [ 818.089866][T16670] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88801effa5ac [ 818.092660][T16670] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000002e66 [ 818.096037][T16670] R10: ffff88807ffd7217 R11: 0000000000000001 R12: 0000000000000000 [ 818.098688][T16670] R13: 0000000000000000 R14: ffffffff9cca2064 R15: 0000000000048c40 [ 818.101806][T16670] FS: 0000000000000000(0000) GS:ffff888095479000(0063) knlGS:00000000f5424b40 [ 818.105064][T16670] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 818.108191][T16670] CR2: 000000000c2a9380 CR3: 000000006d950000 CR4: 0000000000352ef0 [ 818.111014][T16670] Call Trace: [ 818.112336][T16670] [ 818.113479][T16670] ? lock_acquire+0x1d1/0x380 [ 818.115109][T16670] ? unwind_next_frame+0xbd/0x2090 [ 818.116623][T16670] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 818.119027][T16670] ? rcu_is_watching+0x13/0xc0 [ 818.120966][T16670] ? update_curr_dl_se+0x4aa/0xca0 [ 818.122715][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.124592][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.126661][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.128456][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.130391][T16670] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 818.132905][T16670] ? policy_nodemask+0xed/0x5e0 [ 818.134493][T16670] alloc_pages_mpol+0x201/0x560 [ 818.136253][T16670] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 818.138397][T16670] ? filemap_get_entry+0x22d/0x450 [ 818.140000][T16670] ? filemap_get_entry+0x22d/0x450 [ 818.141831][T16670] folio_alloc_noprof+0x22/0x250 [ 818.143704][T16670] filemap_alloc_folio_noprof.part.0+0x3db/0x440 [ 818.145664][T16670] ? __pfx_filemap_alloc_folio_noprof.part.0+0x10/0x10 [ 818.148425][T16670] ? lock_acquire+0x1d1/0x380 [ 818.149959][T16670] ? ext4_get_group_info+0x177/0x4b0 [ 818.151911][T16670] ? find_held_lock+0x2b/0x80 [ 818.154095][T16670] __filemap_get_folio_mpol+0x64e/0x11d0 [ 818.156091][T16670] ext4_mb_load_buddy_gfp+0x708/0x1b20 [ 818.158317][T16670] ext4_discard_preallocations+0x584/0x10c0 [ 818.160431][T16670] ? __pfx_ext4_discard_preallocations+0x10/0x10 [ 818.162755][T16670] ? __pfx_xa_destroy+0x10/0x10 [ 818.164702][T16670] ? inode_wait_for_writeback+0x171/0x390 [ 818.166529][T16670] ? inode_lru_isolate+0x30/0x11d0 [ 818.168479][T16670] ext4_clear_inode+0x6e/0x280 [ 818.170322][T16670] ext4_evict_inode+0x1de/0x1890 [ 818.171919][T16670] ? evict+0x37e/0xad0 [ 818.172296][T10436] net_ratelimit: 30 callbacks suppressed [ 818.172316][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 818.172338][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 818.172357][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 818.172374][T10436] batman_adv: batadv0: Local translation table size (60) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 818.195958][T16670] ? __pfx_ext4_evict_inode+0x10/0x10 [ 818.197796][T16670] evict+0x3c2/0xad0 [ 818.199328][T16670] ? _raw_spin_unlock+0x28/0x50 [ 818.200866][T16670] ? __list_lru_walk_one+0x26d/0x550 [ 818.202926][T16670] ? __pfx_evict+0x10/0x10 [ 818.204847][T16670] ? xa_load+0x149/0x2c0 [ 818.206336][T16670] ? xa_load+0x149/0x2c0 [ 818.208104][T16670] dispose_list+0x117/0x1e0 [ 818.209917][T16670] prune_icache_sb+0xea/0x150 [ 818.211721][T16670] ? list_lru_count_one+0x147/0x320 [ 818.213644][T16670] ? __pfx_prune_icache_sb+0x10/0x10 [ 818.215573][T16670] super_cache_scan+0x37c/0x560 [ 818.217371][T16670] do_shrink_slab+0x411/0x1200 [ 818.218838][T16670] shrink_slab+0xa78/0x12d0 [ 818.220505][T16670] ? shrink_slab+0x68b/0x12d0 [ 818.222425][T16670] ? __pfx_shrink_slab+0x10/0x10 [ 818.224268][T16670] ? page_counter_calculate_protection+0x348/0x730 [ 818.226478][T16670] shrink_node+0x7c1/0x4410 [ 818.227898][T16670] ? __pfx_shrink_node+0x10/0x10 [ 818.229421][T16670] ? queue_work_on+0x11b/0x1e0 [ 818.230923][T16670] ? lockdep_hardirqs_on+0x7d/0x110 [ 818.232616][T16670] ? queue_work_on+0x141/0x1e0 [ 818.234204][T16670] ? do_try_to_free_pages+0x2da/0x1500 [ 818.235991][T16670] do_try_to_free_pages+0x2da/0x1500 [ 818.237720][T16670] try_to_free_pages+0x2a0/0x740 [ 818.239239][T16670] ? __pfx_try_to_free_pages+0x10/0x10 [ 818.240869][T16670] ? find_held_lock+0x2b/0x80 [ 818.242508][T16670] ? fs_reclaim_acquire+0x70/0x100 [ 818.244097][T16670] ? fs_reclaim_acquire+0x70/0x100 [ 818.246050][T16670] __alloc_frozen_pages_noprof+0x1057/0x31e0 [ 818.248375][T16670] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 818.251038][T16670] ? lock_acquire+0x1d1/0x380 [ 818.252872][T16670] ? do_raw_spin_lock+0x128/0x260 [ 818.254522][T16670] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 818.256266][T16670] ? find_held_lock+0x2b/0x80 [ 818.257993][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.259873][T16670] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 818.262214][T16670] ? policy_nodemask+0xed/0x5e0 [ 818.263881][T16670] alloc_pages_mpol+0x201/0x560 [ 818.265416][T16670] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 818.267066][T16670] folio_alloc_mpol_noprof+0x36/0x260 [ 818.268712][T16670] shmem_alloc_folio+0x135/0x160 [ 818.270264][T16670] shmem_alloc_and_add_folio+0x371/0xd40 [ 818.272241][T16670] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 818.274715][T16670] ? shmem_allowable_huge_orders+0x1d7/0x470 [ 818.277370][T16670] ? vm_normal_page+0x1d1/0x380 [ 818.279662][T16670] shmem_get_folio_gfp+0x758/0x1af0 [ 818.281892][T16670] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 818.284192][T16670] ? __pfx_follow_page_pte+0x10/0x10 [ 818.286451][T16670] shmem_write_begin+0x1a4/0x420 [ 818.288584][T16670] ? __pfx_shmem_write_begin+0x10/0x10 [ 818.290884][T16670] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 818.293896][T16670] ? lockdep_hardirqs_on+0x7d/0x110 [ 818.296297][T16670] generic_perform_write+0x292/0xa40 [ 818.298672][T16670] ? __pfx_generic_perform_write+0x10/0x10 [ 818.301152][T16670] ? file_update_time_flags+0x38c/0x520 [ 818.303518][T16670] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 818.305891][T16670] shmem_file_write_iter+0x10e/0x140 [ 818.308061][T16670] __kernel_write_iter+0x2ac/0x920 [ 818.310370][T16670] ? __pfx___kernel_write_iter+0x10/0x10 [ 818.312396][T16670] ? __up_read+0x333/0x980 [ 818.314130][T16670] ? dump_user_range+0x7e0/0xe90 [ 818.316131][T16670] dump_user_range+0xa0d/0xe90 [ 818.318064][T16670] ? __pfx_dump_user_range+0x10/0x10 [ 818.319827][T16670] ? elf_coredump_extra_notes_write+0xbb/0x450 [ 818.321757][T16670] ? __pfx_elf_coredump_extra_notes_write+0x10/0x10 [ 818.323890][T16670] ? __pfx_writenote+0x10/0x10 [ 818.325390][T16670] elf_core_dump+0x31f7/0x4300 [ 818.326992][T16670] ? __pfx_elf_core_dump+0x10/0x10 [ 818.328572][T16670] ? __kasan_kmalloc+0xaa/0xb0 [ 818.330076][T16670] ? __kvmalloc_node_noprof+0x35b/0x9b0 [ 818.331758][T16670] ? coredump_write+0x37b/0x1c20 [ 818.333809][T16670] ? do_coredump.constprop.0+0x9bb/0x25e0 [ 818.335815][T16670] ? vfs_coredump+0x9b0/0x1180 [ 818.337427][T16670] ? arch_do_signal_or_restart+0x91/0x7a0 [ 818.339816][T16670] ? irqentry_exit+0x542/0xab0 [ 818.341795][T16670] ? asm_exc_page_fault+0x26/0x30 [ 818.343883][T16670] ? lock_acquire+0x1d1/0x380 [ 818.345921][T16670] ? do_coredump.constprop.0+0x9bb/0x25e0 [ 818.348468][T16670] ? coredump_write+0xd88/0x1c20 [ 818.350532][T16670] coredump_write+0xd88/0x1c20 [ 818.352630][T16670] ? __pfx_coredump_write+0x10/0x10 [ 818.354733][T16670] ? __pfx_make_vfsuid+0x10/0x10 [ 818.356742][T16670] do_coredump.constprop.0+0x9bb/0x25e0 [ 818.358911][T16670] ? __pfx_do_coredump.constprop.0+0x10/0x10 [ 818.361434][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.363857][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.366041][T16670] ? trace_kmalloc+0xeb/0x110 [ 818.368103][T16670] ? lock_acquire+0x1d1/0x380 [ 818.370033][T16670] ? cgroup1_freezing+0x27/0x3b0 [ 818.371799][T16670] ? find_held_lock+0x2b/0x80 [ 818.373536][T16670] ? cgroup1_freezing+0x12c/0x3b0 [ 818.375397][T16670] ? cgroup1_freezing+0x12c/0x3b0 [ 818.377405][T16670] ? find_held_lock+0x2b/0x80 [ 818.379390][T16670] ? vfs_coredump+0x6f8/0x1180 [ 818.381431][T16670] ? rcu_is_watching+0x13/0xc0 [ 818.383222][T16670] vfs_coredump+0x9b0/0x1180 [ 818.385002][T16670] ? __pfx_vfs_coredump+0x10/0x10 [ 818.387040][T16670] ? rcu_is_watching+0x13/0xc0 [ 818.388928][T16670] get_signal+0x1fba/0x22e0 [ 818.390596][T16670] ? __pfx_get_signal+0x10/0x10 [ 818.392751][T16670] ? __pfx_force_sig_fault+0x10/0x10 [ 818.394920][T16670] arch_do_signal_or_restart+0x91/0x7a0 [ 818.396886][T16670] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 818.398727][T16670] irqentry_exit+0x542/0xab0 [ 818.400153][T16670] asm_exc_page_fault+0x26/0x30 [ 818.402184][T16670] RIP: 0023:0xf7fb2fbc [ 818.403740][T16670] Code: Unable to access opcode bytes at 0xf7fb2f92. [ 818.406424][T16670] RSP: 002b:00000000800001a0 EFLAGS: 00010246 [ 818.408764][T16670] RAX: 0000000000000000 RBX: 0000000004020000 RCX: 00000000800001a0 [ 818.411871][T16670] RDX: 00000000800001c0 RSI: 0000000080000200 RDI: 0000000080000240 [ 818.415162][T16670] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 818.418457][T16670] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 818.421504][T16670] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 818.424679][T16670] [ 818.425925][T16670] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 818.428735][T16670] CPU: 2 UID: 0 PID: 16670 Comm: syz.2.2711 Tainted: G L syzkaller #0 PREEMPT(full) [ 818.432912][T16670] Tainted: [L]=SOFTLOCKUP [ 818.434829][T16670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 818.438958][T16670] Call Trace: [ 818.440305][T16670] [ 818.441620][T16670] dump_stack_lvl+0x100/0x190 [ 818.443482][T16670] vpanic+0x2dc/0x6f8 [ 818.445083][T16670] panic+0xd1/0xe0 [ 818.446606][T16670] ? __pfx_panic+0x10/0x10 [ 818.448379][T16670] check_panic_on_warn.cold+0x19/0x34 [ 818.450467][T16670] ? __alloc_frozen_pages_noprof+0x1e0b/0x31e0 [ 818.452851][T16670] __warn.cold+0x191/0x321 [ 818.454664][T16670] __report_bug+0x30f/0x440 [ 818.456621][T16670] ? __alloc_frozen_pages_noprof+0x1e0b/0x31e0 [ 818.459007][T16670] ? __pfx___report_bug+0x10/0x10 [ 818.460969][T16670] ? __zone_watermark_ok+0x281/0x500 [ 818.463090][T16670] ? get_page_from_freelist+0x1d51/0x2c80 [ 818.465410][T16670] ? __alloc_frozen_pages_noprof+0x1e0b/0x31e0 [ 818.468006][T16670] report_bug+0xb3/0x220 [ 818.469820][T16670] ? __alloc_frozen_pages_noprof+0x1e0b/0x31e0 [ 818.472476][T16670] handle_bug+0x16a/0x2a0 [ 818.474278][T16670] exc_invalid_op+0x17/0x50 [ 818.476313][T16670] asm_exc_invalid_op+0x1a/0x20 [ 818.478598][T16670] RIP: 0010:__alloc_frozen_pages_noprof+0x1e0b/0x31e0 [ 818.481490][T16670] Code: 38 d0 7c 08 84 d2 0f 85 56 13 00 00 65 48 8b 05 43 7c 41 13 c7 84 24 a0 00 00 00 00 80 00 00 f6 40 2d 08 0f 84 0d e7 ff ff 90 <0f> 0b 90 e9 04 e7 ff ff 90 0f 0b 90 e9 63 f8 ff ff 8b 84 24 a0 00 [ 818.489165][T16670] RSP: 0000:ffffc9000555d8b8 EFLAGS: 00010202 [ 818.491820][T16670] RAX: ffff88801effa580 RBX: 0000000000000000 RCX: 1ffff1100fffad69 [ 818.495264][T16670] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88801effa5ac [ 818.498672][T16670] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000002e66 [ 818.501825][T16670] R10: ffff88807ffd7217 R11: 0000000000000001 R12: 0000000000000000 [ 818.505131][T16670] R13: 0000000000000000 R14: ffffffff9cca2064 R15: 0000000000048c40 [ 818.508969][T16670] ? __alloc_frozen_pages_noprof+0x2ad/0x31e0 [ 818.511868][T16670] ? lock_acquire+0x1d1/0x380 [ 818.514168][T16670] ? unwind_next_frame+0xbd/0x2090 [ 818.516574][T16670] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 818.519527][T16670] ? rcu_is_watching+0x13/0xc0 [ 818.521720][T16670] ? update_curr_dl_se+0x4aa/0xca0 [ 818.524037][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.526182][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.528121][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.530298][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.532509][T16670] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 818.534519][T16670] ? policy_nodemask+0xed/0x5e0 [ 818.536365][T16670] alloc_pages_mpol+0x201/0x560 [ 818.538457][T16670] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 818.540208][T16670] ? filemap_get_entry+0x22d/0x450 [ 818.542258][T16670] ? filemap_get_entry+0x22d/0x450 [ 818.544122][T16670] folio_alloc_noprof+0x22/0x250 [ 818.546181][T16670] filemap_alloc_folio_noprof.part.0+0x3db/0x440 [ 818.549070][T16670] ? __pfx_filemap_alloc_folio_noprof.part.0+0x10/0x10 [ 818.551937][T16670] ? lock_acquire+0x1d1/0x380 [ 818.554129][T16670] ? ext4_get_group_info+0x177/0x4b0 [ 818.556515][T16670] ? find_held_lock+0x2b/0x80 [ 818.558537][T16670] __filemap_get_folio_mpol+0x64e/0x11d0 [ 818.560866][T16670] ext4_mb_load_buddy_gfp+0x708/0x1b20 [ 818.563122][T16670] ext4_discard_preallocations+0x584/0x10c0 [ 818.565610][T16670] ? __pfx_ext4_discard_preallocations+0x10/0x10 [ 818.568287][T16670] ? __pfx_xa_destroy+0x10/0x10 [ 818.570400][T16670] ? inode_wait_for_writeback+0x171/0x390 [ 818.572809][T16670] ? inode_lru_isolate+0x30/0x11d0 [ 818.575013][T16670] ext4_clear_inode+0x6e/0x280 [ 818.577051][T16670] ext4_evict_inode+0x1de/0x1890 [ 818.579156][T16670] ? evict+0x37e/0xad0 [ 818.580903][T16670] ? __pfx_ext4_evict_inode+0x10/0x10 [ 818.583227][T16670] evict+0x3c2/0xad0 [ 818.584909][T16670] ? _raw_spin_unlock+0x28/0x50 [ 818.586960][T16670] ? __list_lru_walk_one+0x26d/0x550 [ 818.589161][T16670] ? __pfx_evict+0x10/0x10 [ 818.590673][T16670] ? xa_load+0x149/0x2c0 [ 818.592071][T16670] ? xa_load+0x149/0x2c0 [ 818.593669][T16670] dispose_list+0x117/0x1e0 [ 818.595503][T16670] prune_icache_sb+0xea/0x150 [ 818.597500][T16670] ? list_lru_count_one+0x147/0x320 [ 818.599678][T16670] ? __pfx_prune_icache_sb+0x10/0x10 [ 818.601763][T16670] super_cache_scan+0x37c/0x560 [ 818.603592][T16670] do_shrink_slab+0x411/0x1200 [ 818.605556][T16670] shrink_slab+0xa78/0x12d0 [ 818.607404][T16670] ? shrink_slab+0x68b/0x12d0 [ 818.609187][T16670] ? __pfx_shrink_slab+0x10/0x10 [ 818.611196][T16670] ? page_counter_calculate_protection+0x348/0x730 [ 818.613780][T16670] shrink_node+0x7c1/0x4410 [ 818.615510][T16670] ? __pfx_shrink_node+0x10/0x10 [ 818.617471][T16670] ? queue_work_on+0x11b/0x1e0 [ 818.619473][T16670] ? lockdep_hardirqs_on+0x7d/0x110 [ 818.621391][T16670] ? queue_work_on+0x141/0x1e0 [ 818.623071][T16670] ? do_try_to_free_pages+0x2da/0x1500 [ 818.624891][T16670] do_try_to_free_pages+0x2da/0x1500 [ 818.626704][T16670] try_to_free_pages+0x2a0/0x740 [ 818.628365][T16670] ? __pfx_try_to_free_pages+0x10/0x10 [ 818.630192][T16670] ? find_held_lock+0x2b/0x80 [ 818.631844][T16670] ? fs_reclaim_acquire+0x70/0x100 [ 818.633536][T16670] ? fs_reclaim_acquire+0x70/0x100 [ 818.635513][T16670] __alloc_frozen_pages_noprof+0x1057/0x31e0 [ 818.637964][T16670] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 818.640336][T16670] ? lock_acquire+0x1d1/0x380 [ 818.642100][T16670] ? do_raw_spin_lock+0x128/0x260 [ 818.643999][T16670] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 818.646133][T16670] ? find_held_lock+0x2b/0x80 [ 818.647956][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.649892][T16670] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 818.651754][T16670] ? policy_nodemask+0xed/0x5e0 [ 818.653693][T16670] alloc_pages_mpol+0x201/0x560 [ 818.655260][T16670] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 818.657248][T16670] folio_alloc_mpol_noprof+0x36/0x260 [ 818.659299][T16670] shmem_alloc_folio+0x135/0x160 [ 818.660876][T16670] shmem_alloc_and_add_folio+0x371/0xd40 [ 818.663000][T16670] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 818.665085][T16670] ? shmem_allowable_huge_orders+0x1d7/0x470 [ 818.667535][T16670] ? vm_normal_page+0x1d1/0x380 [ 818.669588][T16670] shmem_get_folio_gfp+0x758/0x1af0 [ 818.671753][T16670] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 818.674066][T16670] ? __pfx_follow_page_pte+0x10/0x10 [ 818.676275][T16670] shmem_write_begin+0x1a4/0x420 [ 818.678449][T16670] ? __pfx_shmem_write_begin+0x10/0x10 [ 818.680764][T16670] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 818.683605][T16670] ? lockdep_hardirqs_on+0x7d/0x110 [ 818.685809][T16670] generic_perform_write+0x292/0xa40 [ 818.688132][T16670] ? __pfx_generic_perform_write+0x10/0x10 [ 818.691698][T16670] ? file_update_time_flags+0x38c/0x520 [ 818.694280][T16670] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 818.696762][T16670] shmem_file_write_iter+0x10e/0x140 [ 818.698873][T16670] __kernel_write_iter+0x2ac/0x920 [ 818.700909][T16670] ? __pfx___kernel_write_iter+0x10/0x10 [ 818.703181][T16670] ? __up_read+0x333/0x980 [ 818.705011][T16670] ? dump_user_range+0x7e0/0xe90 [ 818.707025][T16670] dump_user_range+0xa0d/0xe90 [ 818.708948][T16670] ? __pfx_dump_user_range+0x10/0x10 [ 818.711064][T16670] ? elf_coredump_extra_notes_write+0xbb/0x450 [ 818.713531][T16670] ? __pfx_elf_coredump_extra_notes_write+0x10/0x10 [ 818.716207][T16670] ? __pfx_writenote+0x10/0x10 [ 818.718124][T16670] elf_core_dump+0x31f7/0x4300 [ 818.720073][T16670] ? __pfx_elf_core_dump+0x10/0x10 [ 818.722154][T16670] ? __kasan_kmalloc+0xaa/0xb0 [ 818.724104][T16670] ? __kvmalloc_node_noprof+0x35b/0x9b0 [ 818.726432][T16670] ? coredump_write+0x37b/0x1c20 [ 818.728487][T16670] ? do_coredump.constprop.0+0x9bb/0x25e0 [ 818.730761][T16670] ? vfs_coredump+0x9b0/0x1180 [ 818.732713][T16670] ? arch_do_signal_or_restart+0x91/0x7a0 [ 818.735007][T16670] ? irqentry_exit+0x542/0xab0 [ 818.736941][T16670] ? asm_exc_page_fault+0x26/0x30 [ 818.738958][T16670] ? lock_acquire+0x1d1/0x380 [ 818.740828][T16670] ? do_coredump.constprop.0+0x9bb/0x25e0 [ 818.743035][T16670] ? coredump_write+0xd88/0x1c20 [ 818.744962][T16670] coredump_write+0xd88/0x1c20 [ 818.746902][T16670] ? __pfx_coredump_write+0x10/0x10 [ 818.748972][T16670] ? __pfx_make_vfsuid+0x10/0x10 [ 818.750951][T16670] do_coredump.constprop.0+0x9bb/0x25e0 [ 818.753204][T16670] ? __pfx_do_coredump.constprop.0+0x10/0x10 [ 818.755662][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.757582][T16670] ? __lock_acquire+0x5c0/0x1f40 [ 818.759507][T16670] ? trace_kmalloc+0xeb/0x110 [ 818.761403][T16670] ? lock_acquire+0x1d1/0x380 [ 818.763301][T16670] ? cgroup1_freezing+0x27/0x3b0 [ 818.765330][T16670] ? find_held_lock+0x2b/0x80 [ 818.767264][T16670] ? cgroup1_freezing+0x12c/0x3b0 [ 818.769271][T16670] ? cgroup1_freezing+0x12c/0x3b0 [ 818.771339][T16670] ? find_held_lock+0x2b/0x80 [ 818.773260][T16670] ? vfs_coredump+0x6f8/0x1180 [ 818.775190][T16670] ? rcu_is_watching+0x13/0xc0 [ 818.777156][T16670] vfs_coredump+0x9b0/0x1180 [ 818.779073][T16670] ? __pfx_vfs_coredump+0x10/0x10 [ 818.781225][T16670] ? rcu_is_watching+0x13/0xc0 [ 818.783297][T16670] get_signal+0x1fba/0x22e0 [ 818.785217][T16670] ? __pfx_get_signal+0x10/0x10 [ 818.787173][T16670] ? __pfx_force_sig_fault+0x10/0x10 [ 818.789222][T16670] arch_do_signal_or_restart+0x91/0x7a0 [ 818.791409][T16670] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 818.793848][T16670] irqentry_exit+0x542/0xab0 [ 818.795714][T16670] asm_exc_page_fault+0x26/0x30 [ 818.797650][T16670] RIP: 0023:0xf7fb2fbc [ 818.799153][T16670] Code: Unable to access opcode bytes at 0xf7fb2f92. [ 818.801742][T16670] RSP: 002b:00000000800001a0 EFLAGS: 00010246 [ 818.804231][T16670] RAX: 0000000000000000 RBX: 0000000004020000 RCX: 00000000800001a0 [ 818.807507][T16670] RDX: 00000000800001c0 RSI: 0000000080000200 RDI: 0000000080000240 [ 818.810689][T16670] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 818.813811][T16670] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 818.816945][T16670] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 818.820017][T16670] [ 818.822018][T16670] Kernel Offset: disabled [ 818.823744][T16670] Rebooting in 86400 seconds..