last executing test programs: 2m57.860950645s ago: executing program 0 (id=252): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x1c3443, 0x8) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x2) syz_open_dev$vim2m(0x0, 0x47b, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) shmctl$SHM_STAT_ANY(0x0, 0xf, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff07000000000000000000008500000011000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x3, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ac0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8000}, [@call={0x85, 0x0, 0x0, 0x75}]}, 0x0, 0x7}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r2, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xd81, &(0x7f0000000640)={@local, @broadcast, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, "00ea00", 0xd4b, 0x11, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, @local, {[], {0x4e1d, 0x4e20, 0xd4b, 0x0, @opaque="39fe88b9f7ad46b80134984a4363b6a3af4d200f270393c932df998b2312bf8723240ce4469cf8fa6a102cdec2ce7f0ff1b7a4a61cdf65d9ef921e76b219c61ec6d2906bf7b256ccbd511ab95e9cff7cf3d9878f3b9f30c74ced8e3f3cd74e525bd45f17922a157dff6873b69244999ac2089a2149083bb37fd951fd0675a3507d796642ad8e744f0d43f5b44ad3e872759c8b9a2ae8a1f6d147c22a8e28eadec1acb2d0be401f52595dced061be64742ce4205a5fb6bc48d894663952cc22fc05e638c1518e6d9fded7d028fedc13104d37769dd6637ef49ed15ac8105c6b145a40dc7d1e6d3a145f07d54ab71ec774849e501cdaa7888794143adf54453b8277eea9a95054f3b740b9b5da093c1c128374cc2db28fa576722cc83dd4bbb121a43f6e44fc10873f950de4cdcecffc67abcdff7e2a4d830b5c530d795f03f0b4d22e49a75108302fa2f626505f6953ae8dbb58cda1eae8263125041f227d346e081f7f83c54d09fe45df076d4f2737474f559d9d12306cfe50e673f05f1ec71f8e2c96e9b859cce6151a81c9bce6acbb95492c40a5af77e64c374b93673dbe53d43770e146c87baf33ecf33b85120530e38ee69a82e941a0277cac040378474a85f80ecdc14193e4e5fe9ef2a8d029c84176918083092cfc03840e8a21033ef087d5755dec5115614cc56057c4545a52af10136c0b8bbd6905522628e3f377aeb42a5d2aae5845567c399c60ed0e408fcd0135811d6058310b7213b796f7c74d4a4cdc59033800828f44a8afdde47edaf1028e2d7ef6941fe78328bd2fa4bb6561ae3676ea2504a3af887c4bd85833ce94d8608ded0e8eef420480455532758dac16744f7ae7a2e95bca704783d920e3bc282fa68759173bddde6a2a7f0fae5b6b5c3ae4390b2ad60e7cc536bede2eb9d633d3b2c81e33bb78349134e28304738d25b523f3fc7b353767f1a93066b9b22c5bc6ac80778fc89cc12b2f13d465600542a579c4986740089a333e489c1209521f1958d5fcf413be36fca5684b21a741a7b83e0ff7583a3ff938595e0976b38d13709f468d48e7a90eefee80af331cff62e1d1ac2bdd16c6d42287e74768a492d485bce16ba01eeae272ef2c100b467605c2870f8aff3609db9a1193aa071585c1eab3bc822c9f54ea0db90b48f8d81bcd80ad9bb80af426bccedfdbf7184003b1ca111e72ad99b8ea67d19013daabbd3e81b0e1e1c5cfa9f8de89827145f802794426df1f5d14162307440335fbc5232b6d2cb60f99ac49c2ac38f97c765a296bdb6432bd16872a1bf62439ae9300e71fda25bbf84dd5b29e85f09d3631922ee6f2560ddc23ad5b3c87142664d5c1d1abdf8cfa8a76d4a7a32f7b574b1cb5b5a3e0b8a93196b7277b8a925d10bca136e808d2b2a2e30a2d3fffb88b1506b6f06de85eed86dda5728b8c9f971c5d4aebfdf4b667c13c7bd49d49750185e017aae5fc64bbeecb059372d826002e92ed9da1a146fe7450861d89d51abf55d84dbc078646903c8603bb1866bc15d19a8feafa1fd604d2e47865b542d20e669aa8e92e398c39582210464ce5b1d352a5cd6a60dc796963c92ad2544a54e0d1a3a7acf2bf9e113a12d141bcb0748149be8f45ded2475ee0a2ed59bed3e5288110ecc8b258eb224b2e8030717fdbdcb5e1d70960e1c58a3760c60fa667cf7c6c7d28d847adc8334ae790d932e3da2313c3dea9a3366d3eb0c57e77cb840bed474891ea015166e611c554b311cdae8a06a68711ef871ac3d408a434ecb148718bc992d5099bd0f0e55d5b3fbe74e13b908894dca691dc5a69bb150c6334bd0650ce8aa6b1aa752ef789d83dffcc5d4966e6e659505fc1fc222fd3a0c7b121c21237e40cb6f97743f2870ebc192e3e66e1fc19f47546953de876c6fcf371c4c68b8527a25a9a65644dba8d8654a4c38241829a0acb00e5b7176fe9e469d4ccf93bf737a1ef1dbde40a81b40c45437664eb181aad6f79cf2911701baddcce431f885e43512f928fc98a80f6d76778de2d21592bb94960f3a42d3f553dfe515ad3f5f5e589d471ff3838d018b07677f8e257173b6659f88ea9f9199188b7bc664c690bc657edca158d9bc4dba27f0f8740e90d6cbc572d08757fbd0f166049c72b0160cff2ec54b9d7da5b32bf2a11ebf7058bb1b2b02f57c83dba0ff9c4af11176d22b77acefc9fb87d16175294775a22db12a035853ea4ffa5cc317c6c7a24a8661c9c893a0909f292da564e2a5a0e327eb46ecd1488ab1926fdb54ebcd2b9536d97ed87ddd3331c1b8de851899308e023d6712597110126a0c88e2ad0caa54963582d7f062fbcd4821c035cbd8fd4fa8b2894d943351b3234909f3de25f03cc3c38d42234b5090baf152c331398e315b917493e70069661ae03e5ac193a8645c8c9435af3d5994cc73e86a222af24ad78c25f46654ddb630162a36dfbcb57c986ffc42e26f80ac8bbca5b4e382c3daf0bf951a42a3528f62f891e9a7564380851d6d51e15435053a300ee81963b267d0dd96930d4b1dff038a06ad827f98e57752d64f85f7862a2b0cd9341dd9fd324db4bcb5ab03c3a4f7efb8ee2d69f65a16a6dfda187ec24b5c5f97f424a1b052a4eed2d8b1155ccddfa360e430073cb99fb118a7768e5799077813c74c29d0e49dc01739318ba2d9cd8319a4c85479959afad7c23cf0c40f8b079068df72d140c2f49b27ddfc82bdf0355bcca0ddf52e7326f354bd2bb780eba424db86b20c5e4c8562d4a68c9f3f28276121fa5d75e6f9be0baa4d8d56ae41b3c8a3a50ddbcc8c762d30e5bd98cb0bbb023ef76efa960a5b0644e642331e5e5b56ee8b1722f43e1a0ad33a7f5211c39d777371c7c4bc60e4e4a8136b9ffb3762660861254915a627d901e7f09e77d93f93eecd2f00f1c72f2623da1d4ea17c15151e1501fdce56fb094bef1ee215cbc41564bfd43eb3c30a1a2b924c6c9d6145a9e0ef25de04eaed62a54cf9061a473d510e08c1246068b1ee01ae0cb2da7382cf63955eb6bd025acc33aa7c0adb64b867b0123d3b57b6c937c428fb773abb3ef832ec3e069756b50e30261740ce5c5e1f673081cd67a29cbd2ed86e8babeb95aa4e7251b11d19ca13c4ad47ed49e0c6f90098a2574327cb6de0b1e9be60f7f6bc79cb3adb882450c0651b5dafc0baca9675b04f6261f20f4e2da3d17ad0fcdbe0ce17f4be934883989a8848055667684f25148b43e6c7bb6c2e1e9b101d131650a8bcf009205dd578dba87cd1aadb75cd27ac099995a23a6d783f41855afbb199b609cf79e87dfd239c88b7c38eb7965be4daca8e862e533debab6fcb6dd26178f8f783bf3f6358146ccee4dbdf85f32f413722a66312484f53f971fe305a46156a61cb38f53dff44eb5ccc0bc6547a3041d33e343e0fe89a523b209625e84dec859a0f6f891c638ed2d7eca07f1a641d159ce2882d3e269f16bee8529d2df4524408e0d4624685657e44253c5b4f4c79da55bf0b50de22619a52f4d0f4b2048e452a7996f5034f049f7c64b38be4019b74de34d066830c22fd55ef6d2ad84b3375e8918035569d372c1a369f6b0658a891ac0d2331ca4be845c63fc8e10a9c43d5e710e9907c3a9012aabdda484474485af632e6f2de698fb6590f1b135e9419623577d6161bcf7b4325c81c9115fde09114f4557433843219eecbd621ea0e84e6fbfdcebca03926786b0d818f0b49e4eac0bc40101457f027d86ed01331fc0b907680484c9afb4a375497f9c77fee24e29972bd002464232f08ab6d77db79985553c0fc9b29192479711d4661ea0da2ac69c8c33293369f111f348a11b4b444fc3b7ae7730aa0cbdc0fb4f299da7f025b153d514d143497137af6ffafee1eb01f391c6c1dab9a660c065dd035ad29b4a07265d14dce3b132d9af39f6ebadc4487b2e4cc272b814c491496bdc988f7a263f7a5f922c203bc1f9a95d27af0b0a72ae35d2a3d0bde10859da379b9a803acec884e64116bda1b41fc691ec23ef0fe0395d1bb1b53aeceab13f8cfc5edf509c9b1a7d9c82569ed2f24a0a9097d06cbf885d397ae07dc2eba51e4123d9a2933a9624fd486781c5735138b1a94956bf291eac9dc9df59d23a8a4ba09ab890f23b79a1025ea86f8637978d9f2e58909943ea2035b3afd4800bbd6dc2a151e375e632fd2572aee6704cfe93c8b18d353069a201908268ab7936df5fb040014d4058c2ed1de09cb5a04c55e0df55cefffe974165e229f4c692fe3df86bd542a1e60834d6d4a7bf645fca13c9c83b88399af5eafe1feedb14d0deb1a4b62b9d2d7e1e16a3b020a4dba97fb316733dbcddb4bbb44dc184fb837720034d6e121c77a8afcd9febdf85f6d68738a6ea83bce3648d7561f336750607987a6bfe4f2d3da75dc3866483e2776ac248a7123a811216af25b31dd30556c95f755c40baf5225a86805a91561f9e021e4ea2ac52cc9ee0f1aba4bd050c1182f01f2edc36f18edb6e8c4d1bcbaf775537ca7cfcd684fa261592f602631b9f23b9941857b08e3799ab93307879ebf2f51ef77acfe0423a31e5a60fe9f075414ef6fcd6abb9662b84dc75660391c8e8aef6bccd60e460c10647c1c772e68f50581595d57d5653b14d272e6c35e57036f98288f3d0e98cdc273b4544a0873851abf6dce72fe6dc62636192763249224505e2d1fa45d177e27d42d5c41be1cbb1996a7b034011e5ac02650e8a6193c744f4afcf73476cf307789c419360c5992c5796ec15aa4455582d6bb4d376cf192639e047b462e9fdf286228b1048d63cf63cfb0cb484"}}}}}}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) 2m57.45710167s ago: executing program 0 (id=253): openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r0, 0x800442d2, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x18d001, 0x20) bpf$MAP_CREATE(0x0, 0x0, 0x48) syz_usb_connect(0x3, 0x3d, &(0x7f0000000340)=ANY=[], 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap$snddsp_control(&(0x7f0000ffb000/0x4000)=nil, 0x1000, 0x2000000, 0x11, r1, 0x83000000) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r1) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000180)={'syztnl1\x00', &(0x7f0000000100)={'sit0\x00', 0x0, 0x700, 0x10, 0x3ff, 0xff, {{0x14, 0x4, 0x1, 0xf, 0x50, 0x65, 0x0, 0x9, 0x29, 0x0, @rand_addr=0x64010101, @remote, {[@timestamp={0x44, 0x28, 0x27, 0x0, 0x0, [0x1, 0x7e, 0x8, 0x992e, 0xdad, 0x0, 0x5, 0x4, 0xb0fb]}, @ssrr={0x89, 0xb, 0xa1, [@multicast1, @multicast1]}, @end, @noop, @ra={0x94, 0x4, 0x1}]}}}}}) openat$ttynull(0xffffff9c, &(0x7f0000000300), 0x404a82, 0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x8c, r2, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x3ff}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x62}, @MPTCP_PM_ATTR_ADDR={0x20, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r3}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00'}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x8000804}, 0x48004) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000040)="99", 0x1}, {&(0x7f0000000480)="b2", 0x1}], 0x2) 2m56.709156517s ago: executing program 0 (id=264): r0 = syz_open_dev$I2C(&(0x7f0000000080), 0x1, 0x40) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000004980)={0x1, 0xfb, 0x5, &(0x7f0000000040)={0xb, "2e133846d8d2f48292e0a037ded86ac154d9c36cff8bbcfa8c781acfc84c1e7cdf"}}) r1 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x518, 0x31c, 0x18c, 0x203, 0x0, 0x19030000, 0x450, 0x2e0, 0x2e0, 0x450, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d4, 0x31c, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x0, 0x0, 0x8, 0x2000000}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xffffffff}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x0, 0x0, 0xe}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x3}, {0x2, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x8}, {}, {0x16}, {0x0, 0xff}, {}, {0x7}, {0x0, 0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0x101}, {}, {0x0, 0x0, 0x5}, {}, {0x0, 0x0, 0x0, 0x9}, {0xfffc, 0x0, 0x0, 0x10}, {}, {0xfffe}, {}, {}, {}, {0xfffe, 0xfb}, {}, {0x7a04}, {}, {}, {0x20, 0x6}, {}, {}, {}, {0x0, 0x1, 0x0, 0x800}, {}, {0xb8c, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {0x3}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {0x10}, {0x0, 0xfd}, {0x0, 0x0, 0x0, 0x51}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0xb}, {0x4, 0x2}]}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x2, 'syz0\x00', {0x8001}}}}, {{@uncond, 0x0, 0xec, 0x134, 0x0, {}, [@inet=@rpfilter={{0x24}, {0xb}}, @inet=@rpfilter={{0x24}, {0xd}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x574) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x14, 0x0, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="00221c0000005501030025ff0904a00901a1007508a7280586f209309102c261abc0699892648ac7ede5a38c4c11d910b6f4551839715cb2edb46db9a70cc56aacba044747a93adf1dfecf6c5cb5d110186aba13ab94ab97779cca62b262d9060871453741ea089be83a182d84019dff75f9c24c01c147530730a10fee658b4ae50c368ccd01e8fb17cb94edea48674b4026b7919d69b35e995402de42e193bc2f50c4", @ANYRES64=r2, @ANYRESOCT=r2], 0x0}, 0x0) r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000007008500000073"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fgetxattr(r5, &(0x7f0000000240)=@known='trusted.overlay.metacopy\x00', &(0x7f0000000280)=""/180, 0xb4) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r5}, 0xc) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000400)={0x2, 0x100}) 2m55.850412267s ago: executing program 0 (id=263): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./dev\x00', &(0x7f0000000480)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./dev/mapper/control\x00', 0x2, 0x82) ioctl(r0, 0xc178fd0c, &(0x7f0000000138)="0400000000000000000000007801") mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) 2m55.581496752s ago: executing program 0 (id=265): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) (async) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000000)={[0xffff, 0x8, 0x0, 0x6, 0x4, 0x8, 0x0, 0x8, 0x5bacb1a5, 0x7, 0x5, 0x4, 0x4b3, 0x800, 0x81, 0x6], 0xdddd0000, 0x300080}) (async) ioctl$SIOCSIFHWADDR(r0, 0x89fc, &(0x7f0000000340)={'bond0\x00', @random="00009e0c1100"}) 2m55.251322889s ago: executing program 0 (id=267): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x8, 0xff}, 0x9c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x0, 0x6, 0xffff1896, 0x1f4, 0x26, 0x4, 0x1a}, 0x9c) 2m55.194287094s ago: executing program 32 (id=267): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x8, 0xff}, 0x9c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x0, 0x6, 0xffff1896, 0x1f4, 0x26, 0x4, 0x1a}, 0x9c) 5.154537938s ago: executing program 3 (id=1337): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, &(0x7f0000000000)={0x1, &(0x7f0000000500)=[{0x6, 0x4, 0x6}]}, 0x8) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x44, &(0x7f0000000000)={0x4d, 0x0}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000000)={0xf030000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000100)={0x0, 'veth0_to_batadv\x00', {0x1}, 0x2a}) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0xfff}, 0x50) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, 0x27, 0x1, 0x7fffd, 0x1000, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008090) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x15, 0x1c, &(0x7f0000000100)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xa, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x8, 0x20}, {}, {0x7, 0x0, 0xc}, {0x18, 0x6}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.799398322s ago: executing program 2 (id=1340): socket$inet6(0xa, 0x1, 0x0) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) write$binfmt_aout(r0, &(0x7f0000000200)=ANY=[], 0xc8) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000080)={0xf0f03f, 0x6e}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x20004450) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) write$proc_mixer(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="50484f4e45494e0e0400000000000065272030303030303030301430303030303030303030300a4449474954414c310a"], 0x30) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="b405f592196cd61a20fe534b0c02000034000000010000000000000600000000000000950000000000000000bf3fb6589c90737a597486369d72"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc9, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x34, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x1, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xf8}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000400)={0x0, &(0x7f0000000140)=[0x0], &(0x7f0000000180)=[0x0], 0x0, 0x0, 0x1, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r4, 0xc06864a2, &(0x7f00000002c0)={0x0, 0x0, r5, 0x0, 0x80, 0x5, 0x9, 0x0, {0x9, 0x1000, 0x101c, 0x10, 0x4, 0x401, 0x100, 0xa, 0x0, 0x52, 0x43, 0x7e9, 0x401, 0x9aa5, "cb630dab3a0338057401a192419598961f50dc45c87d55a52a28b8f01c0e0e7a"}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) r8 = openat(r7, &(0x7f0000000140)='test\x00', 0x42, 0x93) write(r8, &(0x7f0000000000)="102128f9", 0x4) ftruncate(r8, 0x3) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x1, 0x0, 0x337740ff}, {0x6, 0x1, 0x12, 0xffffffff}]}, 0x8) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000080)={0x0, 0xfff5, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000200000000000000000000000000a20000000000a01030000000000000000010000010900010073797a310000000054000000030a01040000000000000000010000000900030073797a31000000000900010073797a310000000028000480080002401886c3010800014000000005140003006d61637674617030000003000000000028000000000a05000000000000000000010000080900010073797a31000000000800024000000001140000001100010000000000000000000300000a205f544c137ae6d56e2f27198557fddf52585790c4"], 0xc4}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f00000003c0)={&(0x7f0000000280)=[r5, r6], 0x2}) socket$inet6_tcp(0xa, 0x1, 0x0) 3.768208603s ago: executing program 1 (id=1343): epoll_create(0x84) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000280)={0x7}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = fsopen(&(0x7f0000000140)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x9) fchdir(r2) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f0000000240)={0x13, 0x10, 0x7, {0x0, r4, 0x3}}, 0x18) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) renameat2(r5, &(0x7f0000000200)='./file0\x00', r5, &(0x7f0000000180)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0xaa0a1000, 0x0, 0x0, 0x0, 0x0, 0x0) munlockall() r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380000004100071efefffffffeffffff017d0000040042800c00018006000600800a00001400028010000b800c000a3a065be5a972c7e80629f3a08e566af31b7b4a5e4bc14e0c468c39a92cbda245dc0be702973c7cb3930e9e1c"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./proc\x00', 0x1f9) mount(0x0, &(0x7f0000000e80)='./proc\x00', &(0x7f0000000ec0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x10c) write(r7, &(0x7f0000000200)='\\x01020304 2000000000 0 0 0 krb5 \\x00000000ff', 0x2d) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r8 = socket$pppl2tp(0x18, 0x1, 0x1) r9 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r8, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r9, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r10 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x9) ioctl$KVM_SET_PIT2(r10, 0x4070aea0, &(0x7f0000000040)={[{0x6, 0x2, 0x5, 0x10, 0x1, 0x98, 0x31, 0x4, 0x2, 0x5, 0x6, 0x6, 0x81}, {0x7, 0x2000, 0x9, 0x7, 0x9, 0xff, 0x9, 0x3, 0x0, 0x3, 0xa, 0x6, 0xed91}, {0x8, 0x6, 0x50, 0x8, 0x4, 0x4, 0x9, 0x7f, 0x0, 0x0, 0xe3, 0xf, 0x8}], 0xfffffff7}) r11 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r11, &(0x7f0000000280)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0xffff, 0x4, 0x0, {0xa, 0x0, 0xfffffffe, @empty, 0x6}}}, 0x32) 3.76793027s ago: executing program 3 (id=1344): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, &(0x7f0000000000)={0x1, &(0x7f0000000500)=[{0x6, 0x4, 0x6}]}, 0x8) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x44, &(0x7f0000000000)={0x4d, 0x0}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000000)={0xf030000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'veth0_to_batadv\x00', {0x1}, 0x2a}) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0xfff}, 0x50) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, 0x27, 0x1, 0x7fffd, 0x1000, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008090) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x15, 0x1c, &(0x7f0000000100)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xa, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x8, 0x20}, {}, {0x7, 0x0, 0xc}, {0x18, 0x6}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.071749919s ago: executing program 1 (id=1345): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000040)) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x40000090, 0x0, 0x10}]}) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000100)={0x1, 0x0, [{0x10, 0x4, 0x0, 0x0, @sint}]}) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000140)={0x10, 0x1}) 3.070551927s ago: executing program 4 (id=1346): socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) epoll_create1(0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/diskstats\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) socket$inet6_udp(0xa, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) pipe2(&(0x7f0000000080), 0x800) socket$inet6(0xa, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x88002, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x0, @local}, {0x2, 0x4e23, @loopback}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 2.950674627s ago: executing program 2 (id=1348): syz_emit_ethernet(0x6a, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffff00000000000008004500005c0000000000119078000000000000000000001b590048907803000000000000004b3f7633015aff9fa5e7a843ed3ed4f938752184f1af202914ef0f501fd4f4fc0d232b48a86ef0222fb6364766977f816acb8f51148dba1a"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) syz_emit_ethernet(0x3b6, &(0x7f0000000780)=ANY=[@ANYBLOB], 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407b0603230001000000010902270001010080320904000003ff0000000705810240000007050202400000070583030a"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./dev/ttyUSB0\x00', 0x28d00, 0x0) syz_open_pts(0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x22f00, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @in6={0xa, 0x4e20, 0x0, @loopback, 0x3}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000000c0)={r1, 0x24, 0x9, 0xfffffe04, 0x0, 0xffffff7c}, 0x14) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$USBDEVFS_CONNECTINFO(r2, 0x40085511, &(0x7f0000000000)) setsockopt$packet_int(r2, 0x107, 0x0, 0x0, 0x0) 2.900213239s ago: executing program 4 (id=1349): r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') r5 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) r6 = landlock_create_ruleset(&(0x7f0000000080)={0x2832, 0x0, 0x2}, 0x18, 0x0) landlock_restrict_self(r6, 0x0) landlock_restrict_self(r5, 0x0) landlock_restrict_self(r5, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x141042, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000480), 0xffffffffffffffff) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) setsockopt$bt_l2cap_L2CAP_OPTIONS(r4, 0x6, 0x1, &(0x7f0000019080)={0x0, 0x354, 0xf2, 0x9, 0xe1, 0x1, 0xc}, 0xc) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) sendmsg$NFC_CMD_FW_DOWNLOAD(0xffffffffffffffff, &(0x7f0000019100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, 0x0}, 0x4004) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) syz_usb_connect(0x1, 0x2d, &(0x7f0000000640)=ANY=[@ANYBLOB="ad4a86dc70433dd6f8a85443ab38b15a58fe0eb59703047d5571bf29a82700fe1734b9a74056b59b0e2d534edd5e4c396e6174b681e44274322b259523f48736dedd2ea2ccd0cea65b31a03e87340b4d935f18d5027685a4b202bef47cec059d6b79a9f30825167a408e161070803795ee89a532ddd1cbd346f4eb15664ebbd161c5ce5fdc1dafb0c3ae1e887ec4e2b3fd77b196e5c23cab31be1618dd6e8b9b3727187a3b89a1e17d5aa9000000000000000063970512bff512df3b09a5f295428cdcbb6be7f9f436654b334ba2494563881d53"], 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c0000004700070128bd700000000000017c000006000480"], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0xd}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xdc}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) 2.897943628s ago: executing program 1 (id=1350): r0 = socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f211066865578ac0109029c000100000400090400bf900b64ea0009058703"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r1, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(0xffffffffffffffff, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d02, 0x0, 0x9}]}) mount(0x0, 0x0, &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$setregs(0x4212, r5, 0x58, &(0x7f0000000080)) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d02}]}) r6 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) getdents(r6, &(0x7f0000001fc0)=""/184, 0xb8) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) r10 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r10, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r10, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES32=r11, @ANYBLOB="01980000000000002000128008000100736974001400028006000e000600000008000100", @ANYRES32=r10], 0x40}, 0x1, 0x0, 0x0, 0x4000881}, 0x0) sendto$packet(r0, &(0x7f0000000600)="05d936277c6f54222002097844ffcf8bd1846f7f83477ca1b278e3e4018a34844b9d62cbd7cd2a62", 0x28, 0x8c1, &(0x7f00000000c0)={0x11, 0x86dd, r11, 0x1, 0x4, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) 2.685360752s ago: executing program 3 (id=1351): openat$audio1(0xffffffffffffff9c, 0x0, 0x129202, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x2b, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000040)={0x20, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0x6}}, 0x20) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r4 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x3) mount(0x0, &(0x7f0000003c40)='./file0\x00', &(0x7f0000000040)='proc\x00', 0x0, &(0x7f0000000200)='gid=1\x00nk]e\xb2}\x9c6\b\xc1\x04\xbb\xbe \x9f\xe7\x8c\xc6\x06y\x89sd\xeb\xf4\x94\x1f\xdf\x91A!\xf9}\xee\xe7\x89\xcf\x99\n[\'\xca\xb3\x84\xb6j\xb9\x8c#\xf4\xf0\x96\x8e\xaa\x04\x82\x99f7\xf3\xd8\x17\xfc\x00\x00\x00\x00\x9c$Nn\x13\x8f\xf7\b\x00\x00\x00/\xf5|H\xe1\xbd0\x0fz\xbat\x0e-\x95c.j\xdd\xbe\x1dc3\xca\xd5\x91\xc8\x12f\x90\xac\x97\xdb\x06\x10?]\")\xb4\xe7tD6G\"<') read$FUSE(r4, &(0x7f00000047c0)={0x2020}, 0x2020) r5 = socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x167) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001300), 0x40, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0x2) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x1) ioctl$TIOCVHANGUP(r6, 0x5437, 0x0) lsetxattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)=@known='trusted.overlay.impure\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './dev'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYRES16=0x0, @ANYRES16=r3, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r7, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}, 0x1, 0x0, 0x0, 0x6000042}, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 2.318142558s ago: executing program 2 (id=1352): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, 0x27, 0x1, 0x7fffd, 0x1000, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008090) 2.314459908s ago: executing program 2 (id=1353): r0 = socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x1, 0x40055}, &(0x7f00000000c0)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r5, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d02, 0x0, 0x9}]}) mount(0x0, 0x0, &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r9 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r9) ptrace$setregs(0x4212, r9, 0x58, &(0x7f0000000080)) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d02}]}) r10 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) getdents(r10, &(0x7f0000001fc0)=""/184, 0xb8) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) ioctl$KVM_RUN(r13, 0xae80, 0x0) r14 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r14, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r14, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r14, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES32=r15, @ANYBLOB="01980000000000002000128008000100736974001400028006000e000600000008000100", @ANYRES32=r14], 0x40}, 0x1, 0x0, 0x0, 0x4000881}, 0x0) sendto$packet(r0, &(0x7f0000000600)="05d936277c6f54222002097844ffcf8bd1846f7f83477ca1b278e3e4018a34844b9d62cbd7cd2a62", 0x28, 0x8c1, &(0x7f00000000c0)={0x11, 0x86dd, r15, 0x1, 0x4, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) 2.05152729s ago: executing program 3 (id=1354): getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), r0) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fcdbdf2503000000140001800d0001006574683a6772653000000000f6c94d75fe8775ae3d4f743785d429492200525363d6e0a5cbe34135fac2e8c29539740f8f4662a40a4c7029dce81d26d73b8213eff1a27f2935d72965bcbf217ce8f8c2002168a00a8308c534024c47157190dc7d7292617a0abf3be09f6b2a6f858d20bdb02b4478bad3b404fab78daa1ca74a926742cbc3d9ec5efabdd1c06e91298374d35500e075ef3639835c4498b42d715bce4a4c4e343c9cfc1bbdef94fc8cae038a06b451d2f0b7849638e0748e37da6a0c78f05c0b10efc04f2e82f9cb88eddb47d1da16d6b4ffb5b080cd324a5af5fe31126be17d31186c2d3bce6413fb45d1155ea7"], 0x28}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6(0xa, 0x6, 0x7) connect$inet6(r2, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f0000000780), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYRES64=0x0], 0x0, 0x34}, 0xffffffffffffffa5) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x3, &(0x7f0000000100)=ANY=[], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f00000005c0)={0x0, 0x1}, 0x8}, 0x94) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CURSOR(0xffffffffffffffff, 0xc01c64a3, &(0x7f0000000100)={0x1, 0x0, 0x3, 0xfffffffc, 0x326, 0x89e, 0x1}) connect$bt_l2cap(r5, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(r5, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) 2.031058942s ago: executing program 2 (id=1355): socket(0x10, 0x3, 0x0) socketpair(0x27, 0x4, 0x9, &(0x7f0000000000)) readlinkat(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, &(0x7f00000014c0)=ANY=[@ANYBLOB], 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x40) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$KVM_SET_GSI_ROUTING(r0, 0x4008ae6a, &(0x7f00000005c0)={0x1, 0x0, [{0x0, 0x1, 0x1, 0x0, @msi={0x5, 0x1, 0x2, 0x3}}]}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sg(0x0, 0x0, 0x802) writev(r3, 0x0, 0x0) poll(&(0x7f0000000140)=[{r3, 0x44}], 0x1, 0xe6) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x4, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x2284, &(0x7f0000000000)) 1.962038969s ago: executing program 1 (id=1356): getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), r0) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fcdbdf2503000000140001800d0001006574683a6772653000000000f6c94d75fe8775ae3d4f743785d429492200525363d6e0a5cbe34135fac2e8c29539740f8f4662a40a4c7029dce81d26d73b8213eff1a27f2935d72965bcbf217ce8f8c2002168a00a8308c534024c47157190dc7d7292617a0abf3be09f6b2a6f858d20bdb02b4478bad3b404fab78daa1ca74a926742cbc3d9ec5efabdd1c06e91298374d35500e075ef3639835c4498b42d715bce4a4c4e343c9cfc1bbdef94fc8cae038a06b451d2f0b7849638e0748e37da6a0c78f05c0b10efc04f2e82f9cb88eddb47d1da16d6b4ffb5b080cd324a5af5fe31126be17d31186c2d3bce6413fb45d1155ea7"], 0x28}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6(0xa, 0x6, 0x7) connect$inet6(r3, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f0000000780), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYRES64=0x0], 0x0, 0x34}, 0xffffffffffffffa5) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x3, &(0x7f0000000100)=ANY=[], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, 0x0, r5, 0x8, &(0x7f00000005c0)={0x0, 0x1}, 0x8}, 0x94) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CURSOR(0xffffffffffffffff, 0xc01c64a3, &(0x7f0000000100)={0x1, 0x0, 0x3, 0xfffffffc, 0x326, 0x89e, 0x1}) connect$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(r6, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, 0x0, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='nfs\x00', 0x229845c, 0x0) ioctl$VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000180)={0x1, @win={{0x0, 0x8000, 0x2, 0x2}, 0x2, 0x0, &(0x7f0000000340)={{0xae04, 0x5, 0x6, 0x7}}, 0x8, &(0x7f00000003c0)="8274afbe70c5d8d90a9e78d93f4f57b42b3cd4f02b8cdd406dc1862155ed637fab3e331e05d79f94d93bba15569c4da7e5961ca1229ad0f4702379d1c22b9febc080607d", 0x4}}) pipe2$9p(&(0x7f00000001c0), 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000002f00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f000001a840)=[{}, {}, {}, {}], 0x0, 0x0, 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) 1.697035399s ago: executing program 4 (id=1357): socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) epoll_create1(0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/diskstats\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) socket$inet6_udp(0xa, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) pipe2(&(0x7f0000000080), 0x800) socket$inet6(0xa, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x88002, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x0, @local}, {0x2, 0x4e23, @loopback}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 617.50079ms ago: executing program 3 (id=1358): socket$inet6(0xa, 0x1, 0x0) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) write$binfmt_aout(r0, &(0x7f0000000200)=ANY=[], 0xc8) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000080)={0xf0f03f, 0x6e}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x20004450) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) write$proc_mixer(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="50484f4e45494e0e0400000000000065272030303030303030301430303030303030303030300a4449474954414c310a"], 0x30) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="b405f592196cd61a20fe534b0c02000034000000010000000000000600000000000000950000000000000000bf3fb6589c90737a597486369d72"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc9, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x34, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x1, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xf8}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000400)={0x0, &(0x7f0000000140)=[0x0], &(0x7f0000000180)=[0x0], 0x0, 0x0, 0x1, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r4, 0xc06864a2, &(0x7f00000002c0)={0x0, 0x0, r5, 0x0, 0x80, 0x5, 0x9, 0x0, {0x9, 0x1000, 0x101c, 0x10, 0x4, 0x401, 0x100, 0xa, 0x0, 0x52, 0x43, 0x7e9, 0x401, 0x9aa5, "cb630dab3a0338057401a192419598961f50dc45c87d55a52a28b8f01c0e0e7a"}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) r8 = openat(r7, &(0x7f0000000140)='test\x00', 0x42, 0x93) write(r8, &(0x7f0000000000)="102128f9", 0x4) ftruncate(r8, 0x3) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x1, 0x0, 0x337740ff}, {0x6, 0x1, 0x12, 0xffffffff}]}, 0x8) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000080)={0x0, 0xfff5, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000200000000000000000000000000a20000000000a01030000000000000000010000010900010073797a310000000054000000030a01040000000000000000010000000900030073797a31000000000900010073797a310000000028000480080002401886c3010800014000000005140003006d61637674617030000003000000000028000000000a05000000000000000000010000080900010073797a31000000000800024000000001140000001100010000000000000000000300000a205f544c137ae6d56e2f27198557fddf52585790c4"], 0xc4}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f00000003c0)={&(0x7f0000000280)=[r5, r6], 0x2}) socket$inet6_tcp(0xa, 0x1, 0x0) 549.111857ms ago: executing program 4 (id=1359): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000040)) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x40000090, 0x0, 0x10}]}) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000140)={0x10, 0x1}) 394.577369ms ago: executing program 2 (id=1360): syz_emit_ethernet(0x6a, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffff00000000000008004500005c0000000000119078000000000000000000001b590048907803000000000000004b3f7633015aff9fa5e7a843ed3ed4f938752184f1af202914ef0f501fd4f4fc0d232b48a86ef0222fb6364766977f816acb8f51148dba1a"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) syz_emit_ethernet(0x3b6, &(0x7f0000000780)=ANY=[@ANYBLOB], 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407b0603230001000000010902270001010080320904000003ff0000000705810240000007050202400000070583030a"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./dev/ttyUSB0\x00', 0x28d00, 0x0) syz_open_pts(0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x22f00, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @in6={0xa, 0x4e20, 0x0, @loopback, 0x3}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000000c0)={r1, 0x24, 0x9, 0xfffffe04, 0x0, 0xffffff7c}, 0x14) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$USBDEVFS_CONNECTINFO(r2, 0x40085511, &(0x7f0000000000)) setsockopt$packet_int(r2, 0x107, 0x0, 0x0, 0x0) 270.189821ms ago: executing program 1 (id=1361): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, 0x27, 0x1, 0x7fffd, 0x1000, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008090) 269.374208ms ago: executing program 1 (id=1362): openat$audio1(0xffffffffffffff9c, 0x0, 0x129202, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x2b, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000040)={0x20, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0x6}}, 0x20) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r4 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x3) mount(0x0, &(0x7f0000003c40)='./file0\x00', &(0x7f0000000040)='proc\x00', 0x0, &(0x7f0000000200)='gid=1\x00nk]e\xb2}\x9c6\b\xc1\x04\xbb\xbe \x9f\xe7\x8c\xc6\x06y\x89sd\xeb\xf4\x94\x1f\xdf\x91A!\xf9}\xee\xe7\x89\xcf\x99\n[\'\xca\xb3\x84\xb6j\xb9\x8c#\xf4\xf0\x96\x8e\xaa\x04\x82\x99f7\xf3\xd8\x17\xfc\x00\x00\x00\x00\x9c$Nn\x13\x8f\xf7\b\x00\x00\x00/\xf5|H\xe1\xbd0\x0fz\xbat\x0e-\x95c.j\xdd\xbe\x1dc3\xca\xd5\x91\xc8\x12f\x90\xac\x97\xdb\x06\x10?]\")\xb4\xe7tD6G\"<') read$FUSE(r4, &(0x7f00000047c0)={0x2020}, 0x2020) r5 = socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x167) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001300), 0x40, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0x2) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x1) ioctl$TIOCVHANGUP(r6, 0x5437, 0x0) lsetxattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)=@known='trusted.overlay.impure\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './dev'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYRES16=0x0, @ANYRES16=r3, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r7, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}, 0x1, 0x0, 0x0, 0x6000042}, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 180.301394ms ago: executing program 4 (id=1363): ioctl$FE_READ_BER(0xffffffffffffffff, 0x80046f46, &(0x7f0000000100)) dup(0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) close(r0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r1, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt(r1, 0x84, 0x80, &(0x7f0000000000)="1400000009000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x400, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) sendto$inet6(r1, &(0x7f00000004c0)="b0", 0x1, 0x40811, &(0x7f0000000240)={0xa, 0x4e23, 0x1ff, @loopback, 0x4}, 0x1c) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e22, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7ff}}}, 0x84) 130.081631ms ago: executing program 3 (id=1364): r0 = socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f211066865578ac0109029c000100000400090400bf900b64ea0009058703"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r1, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(0xffffffffffffffff, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d02, 0x0, 0x9}]}) mount(0x0, 0x0, &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$setregs(0x4212, r5, 0x58, &(0x7f0000000080)) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d02}]}) r6 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) getdents(r6, &(0x7f0000001fc0)=""/184, 0xb8) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) r10 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r10, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r10, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES32=r11, @ANYBLOB="01980000000000002000128008000100736974001400028006000e000600000008000100", @ANYRES32=r10], 0x40}, 0x1, 0x0, 0x0, 0x4000881}, 0x0) sendto$packet(r0, &(0x7f0000000600)="05d936277c6f54222002097844ffcf8bd1846f7f83477ca1b278e3e4018a34844b9d62cbd7cd2a62", 0x28, 0x8c1, &(0x7f00000000c0)={0x11, 0x86dd, r11, 0x1, 0x4, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) 0s ago: executing program 4 (id=1365): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/freeze_filesystems', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) get_mempolicy(0x0, 0x0, 0x2, &(0x7f0000240000/0x1000)=nil, 0x3) r1 = syz_io_uring_setup(0x43bb, &(0x7f0000000040)={0x0, 0x3a99, 0x40, 0x0, 0x2a5, 0x0, r0}, &(0x7f00000000c0), &(0x7f0000000180), &(0x7f00000001c0)) open_by_handle_at(r1, &(0x7f0000001180)=ANY=[@ANYBLOB="0c00000003000000c6a1000000020000070400001e25973191fe4c"], 0x101000) io_uring_setup(0xf06, &(0x7f00000003c0)={0x0, 0xefa9, 0x800, 0x43, 0x161}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x601c2, 0x0) ftruncate(r2, 0x8800000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(r6, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r6, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r7, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtaction={0xe78, 0x30, 0x25, 0x0, 0x0, {}, [{0xe64, 0x1, [@m_pedit={0xe60, 0x1, 0x0, 0x0, {{0xa}, {0xe34, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x10, 0x5, 0x0, 0x1, [{0xc, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0xffff}]}]}, @TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x2}, [{}, {}, {0x0, 0xd, 0x0, 0x0, 0x0, 0xffffffff}, {0x0, 0x4}, {0x0, 0x0, 0x7, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x4000, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, {0x0, 0x800}, {0x7}, {}, {0x0, 0x0, 0x0, 0x200}, {}, {}, {}, {0x82}, {0x0, 0x0, 0x0, 0xd0ca}, {0x2, 0x2000000, 0x0, 0x0, 0x0, 0x40000}, {0x0, 0x0, 0x0, 0x8000}, {0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, {}, {0x0, 0x0, 0xc}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0xfffffffd, 0x0, 0x0, 0x0, 0xfffff0c0}, {}, {}, {0x0, 0x0, 0x2}, {0x0, 0x0, 0x6}, {0x0, 0x0, 0x0, 0x0, 0x80000000}, {0xffffffff}, {}, {}, {0x0, 0xb380}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {}, {0x0, 0x101}, {0x849}, {}, {}, {}, {0x10, 0x0, 0x0, 0x3}, {0x0, 0x3}, {0x3ff}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {0xfffffffc}, {0x0, 0x0, 0x80000000}, {}, {}, {0x0, 0xffffffff}, {0x0, 0x0, 0x400000}, {0x5, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x400000}, {0x0, 0x20000}, {0x0, 0x0, 0x9, 0xfffffffd}, {}, {0x0, 0xb}, {0x0, 0x0, 0x0, 0x7fff}, {0x0, 0x0, 0x7}, {0x0, 0x2000000, 0x0, 0x0, 0xfffffffe}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {0x0, 0xc16}, {}, {}, {0x0, 0x0, 0x20000000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {0x0, 0x0, 0x0, 0xfffffffe, 0x4}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, {}, {0x0, 0x0, 0x0, 0x400004}, {0x100}, {0x0, 0xfffffffc, 0x65040211}, {0x0, 0x0, 0x0, 0xfffffff7}, {0x0, 0x0, 0x4, 0x0, 0x0, 0x70}, {}, {0x0, 0x400, 0x0, 0x0, 0xfffffff8}, {}, {0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x0, 0x0, 0xfffffffe, 0x5}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x3, 0x0, 0xfffffffc}, {}, {0x0, 0x7}, {}, {}, {0x0, 0xfffffffc}, {}, {0x0, 0x0, 0x3, 0x0, 0x0, 0xfffffffd}, {0x5, 0x0, 0x0, 0x0, 0x800}, {}, {0x0, 0x0, 0x0, 0x6, 0xffff}, {0x2}, {}, {}, {}, {}, {}, {}, {0x0, 0x8, 0x0, 0x0, 0x7}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, {}, {}, {0x0, 0x0, 0x7}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x8}, {}, {}, {}, {0x0, 0x0, 0x0, 0x8a}, {}, {}, {0x0, 0x0, 0x1}], [{}, {}, {}, {0x4}, {}, {0x5}, {}, {0x4}, {}, {}, {0x1}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {0x5}, {}, {}, {}, {0x5, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2, 0x1}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {0x2}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {0x1}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe78}}, 0x0) syz_clone3(0x0, 0x0) read$FUSE(r2, &(0x7f0000002f40)={0x2020}, 0xfffffd24) socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) close_range(0xffffffffffffffff, r4, 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r8, &(0x7f0000000400)='1', 0x1) openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/pci/rescan\x00', 0x1, 0x0) r9 = io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0x20000, 0x3800, 0x4}) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r9, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x1, 0x2, 0x0, &(0x7f0000000300)={&(0x7f0000002000), 0x0, 0x1}}, 0x1) kernel console output (not intermixed with test programs): h_read+0x10/0x10 [ 220.864480][ T9155] vfs_read+0x1e4/0xb40 [ 220.864490][ T9155] ? lock_acquire+0x1d1/0x380 [ 220.864505][ T9155] ? __fget_files+0x34/0x3d0 [ 220.864515][ T9155] ? __pfx_vfs_read+0x10/0x10 [ 220.864524][ T9155] ? find_held_lock+0x2b/0x80 [ 220.864540][ T9155] ? __fget_files+0x215/0x3d0 [ 220.864553][ T9155] ? __fget_files+0x21f/0x3d0 [ 220.864567][ T9155] ksys_read+0x12a/0x250 [ 220.864577][ T9155] ? __pfx_ksys_read+0x10/0x10 [ 220.864591][ T9155] do_int80_emulation+0x166/0x650 [ 220.864608][ T9155] asm_int80_emulation+0x1a/0x20 [ 220.864619][ T9155] RIP: 0023:0xf71f75ab [ 220.864628][ T9155] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 220.864639][ T9155] RSP: 002b:00000000f54ad4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 220.864650][ T9155] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f54ad5d0 [ 220.864657][ T9155] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 220.864663][ T9155] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 220.864669][ T9155] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 220.864675][ T9155] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 220.864689][ T9155] [ 221.076157][ T9162] FAULT_INJECTION: forcing a failure. [ 221.076157][ T9162] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 221.076205][ T9162] CPU: 0 UID: 0 PID: 9162 Comm: syz.4.902 Tainted: G L syzkaller #0 PREEMPT(full) [ 221.076234][ T9162] Tainted: [L]=SOFTLOCKUP [ 221.076239][ T9162] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 221.076246][ T9162] Call Trace: [ 221.076250][ T9162] [ 221.076256][ T9162] dump_stack_lvl+0x100/0x190 [ 221.076276][ T9162] should_fail_ex.cold+0x5/0xa [ 221.076290][ T9162] _copy_to_user+0x32/0xd0 [ 221.076304][ T9162] simple_read_from_buffer+0xcb/0x170 [ 221.076317][ T9162] proc_fail_nth_read+0x1af/0x230 [ 221.076336][ T9162] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 221.076354][ T9162] ? rw_verify_area+0xce/0x6d0 [ 221.076370][ T9162] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 221.076387][ T9162] vfs_read+0x1e4/0xb40 [ 221.076397][ T9162] ? lock_acquire+0x1d1/0x380 [ 221.076413][ T9162] ? __fget_files+0x34/0x3d0 [ 221.076423][ T9162] ? __pfx_vfs_read+0x10/0x10 [ 221.076432][ T9162] ? find_held_lock+0x2b/0x80 [ 221.076443][ T9162] ? __fget_files+0x215/0x3d0 [ 221.076457][ T9162] ? __fget_files+0x21f/0x3d0 [ 221.076471][ T9162] ksys_read+0x12a/0x250 [ 221.076481][ T9162] ? __pfx_ksys_read+0x10/0x10 [ 221.076495][ T9162] do_int80_emulation+0x166/0x650 [ 221.076512][ T9162] asm_int80_emulation+0x1a/0x20 [ 221.076524][ T9162] RIP: 0023:0xf71375ab [ 221.076533][ T9162] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 221.076544][ T9162] RSP: 002b:00000000f53f64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 221.076556][ T9162] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f53f65d0 [ 221.076563][ T9162] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 221.076569][ T9162] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 221.076575][ T9162] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 221.076581][ T9162] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 221.076595][ T9162] [ 221.357061][ T9180] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.357517][ T9180] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.593404][ T9187] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.593700][ T9187] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.659356][ T9189] overlayfs: workdir and upperdir must reside under the same mount [ 221.857083][ T9193] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.857645][ T9193] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.975306][ T9205] FAULT_INJECTION: forcing a failure. [ 221.975306][ T9205] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 221.976550][ T9205] CPU: 1 UID: 0 PID: 9205 Comm: syz.2.911 Tainted: G L syzkaller #0 PREEMPT(full) [ 221.976568][ T9205] Tainted: [L]=SOFTLOCKUP [ 221.976573][ T9205] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 221.976579][ T9205] Call Trace: [ 221.976583][ T9205] [ 221.976587][ T9205] dump_stack_lvl+0x100/0x190 [ 221.976605][ T9205] should_fail_ex.cold+0x5/0xa [ 221.976619][ T9205] _copy_from_user+0x2e/0xd0 [ 221.976631][ T9205] get_compat_msghdr+0xb3/0x480 [ 221.976648][ T9205] ? __pfx_get_compat_msghdr+0x10/0x10 [ 221.976680][ T9205] ___sys_sendmsg+0x1b6/0x1e0 [ 221.976698][ T9205] ? __pfx____sys_sendmsg+0x10/0x10 [ 221.976721][ T9205] ? find_held_lock+0x2b/0x80 [ 221.976741][ T9205] __sys_sendmsg+0x160/0x210 [ 221.976753][ T9205] ? __pfx___sys_sendmsg+0x10/0x10 [ 221.976769][ T9205] ? __pfx_ksys_write+0x10/0x10 [ 221.976783][ T9205] __do_fast_syscall_32+0x13a/0x8b0 [ 221.976797][ T9205] ? lockdep_hardirqs_on+0x7d/0x110 [ 221.976811][ T9205] do_fast_syscall_32+0x32/0x70 [ 221.976825][ T9205] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 221.976839][ T9205] RIP: 0023:0xf70befec [ 221.976852][ T9205] Code: Unable to access opcode bytes at 0xf70befc2. [ 221.976856][ T9205] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 221.976867][ T9205] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000340 [ 221.976874][ T9205] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 221.976880][ T9205] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 221.976887][ T9205] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 221.976893][ T9205] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 221.976906][ T9205] [ 222.169752][ T9215] jffs2: notice: (9215) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 222.924404][ T9231] FAULT_INJECTION: forcing a failure. [ 222.924404][ T9231] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 222.924477][ T9231] CPU: 2 UID: 0 PID: 9231 Comm: syz.4.918 Tainted: G L syzkaller #0 PREEMPT(full) [ 222.924509][ T9231] Tainted: [L]=SOFTLOCKUP [ 222.924514][ T9231] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 222.924520][ T9231] Call Trace: [ 222.924525][ T9231] [ 222.924529][ T9231] dump_stack_lvl+0x100/0x190 [ 222.924549][ T9231] should_fail_ex.cold+0x5/0xa [ 222.924564][ T9231] _copy_to_iter+0x1f3/0x1720 [ 222.924577][ T9231] ? __pfx___skb_try_recv_datagram+0x10/0x10 [ 222.924597][ T9231] ? __pfx__copy_to_iter+0x10/0x10 [ 222.924608][ T9231] ? is_bpf_text_address+0x94/0x1a0 [ 222.924625][ T9231] ? __skb_recv_datagram+0x1b2/0x220 [ 222.924646][ T9231] simple_copy_to_iter+0x46/0x90 [ 222.924663][ T9231] __skb_datagram_iter+0x129/0x900 [ 222.924679][ T9231] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 222.924705][ T9231] ? skb_recv_datagram+0x88/0xc0 [ 222.924730][ T9231] skb_copy_datagram_iter+0xa1/0x250 [ 222.924755][ T9231] netlink_recvmsg+0x27e/0xa90 [ 222.924782][ T9231] ? __pfx_netlink_recvmsg+0x10/0x10 [ 222.924809][ T9231] ? aa_sock_msg_perm+0x11e/0x200 [ 222.924829][ T9231] ? __pfx_netlink_recvmsg+0x10/0x10 [ 222.924855][ T9231] sock_recvmsg+0x1d5/0x220 [ 222.924880][ T9231] sock_read_iter+0x2b0/0x3a0 [ 222.924903][ T9231] ? __pfx_sock_read_iter+0x10/0x10 [ 222.924931][ T9231] ? bpf_lsm_file_permission+0x9/0x10 [ 222.924953][ T9231] ? security_file_permission+0x76/0x210 [ 222.924977][ T9231] ? rw_verify_area+0xce/0x6d0 [ 222.925000][ T9231] ? __pfx_sock_read_iter+0x10/0x10 [ 222.925023][ T9231] vfs_read+0x960/0xb40 [ 222.925042][ T9231] ? __pfx_vfs_read+0x10/0x10 [ 222.925055][ T9231] ? find_held_lock+0x2b/0x80 [ 222.925087][ T9231] ksys_read+0x1f8/0x250 [ 222.925103][ T9231] ? __pfx_ksys_read+0x10/0x10 [ 222.925116][ T9231] ? ksys_write+0x1ac/0x250 [ 222.925132][ T9231] ? __pfx_ksys_write+0x10/0x10 [ 222.925151][ T9231] __do_fast_syscall_32+0x13a/0x8b0 [ 222.925173][ T9231] ? lockdep_hardirqs_on+0x7d/0x110 [ 222.925195][ T9231] do_fast_syscall_32+0x32/0x70 [ 222.925216][ T9231] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 222.925230][ T9231] RIP: 0023:0xf7f34fec [ 222.925246][ T9231] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 222.925254][ T9231] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000003 [ 222.925270][ T9231] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000580 [ 222.925281][ T9231] RDX: 000000000000003f RSI: 0000000000000000 RDI: 0000000000000000 [ 222.925290][ T9231] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 222.925300][ T9231] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 222.925309][ T9231] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 222.925333][ T9231] [ 223.168228][ T9247] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 223.170632][ T9247] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 223.236040][ T9253] overlayfs: failed to resolve './dev': -2 [ 224.275036][ T9266] jffs2: notice: (9266) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 224.389087][ T9269] netlink: 8 bytes leftover after parsing attributes in process `syz.4.927'. [ 224.464606][ T9261] netlink: 'syz.1.925': attribute type 29 has an invalid length. [ 224.491013][ T5792] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 224.491083][ T5792] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 224.491148][ T5792] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 224.491168][ T5792] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 224.565435][ T9273] FAULT_INJECTION: forcing a failure. [ 224.565435][ T9273] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 224.565507][ T9273] CPU: 0 UID: 0 PID: 9273 Comm: syz.4.930 Tainted: G L syzkaller #0 PREEMPT(full) [ 224.565534][ T9273] Tainted: [L]=SOFTLOCKUP [ 224.565539][ T9273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 224.565546][ T9273] Call Trace: [ 224.565550][ T9273] [ 224.565555][ T9273] dump_stack_lvl+0x100/0x190 [ 224.565574][ T9273] should_fail_ex.cold+0x5/0xa [ 224.565588][ T9273] _copy_to_user+0x32/0xd0 [ 224.565601][ T9273] simple_read_from_buffer+0xcb/0x170 [ 224.565614][ T9273] proc_fail_nth_read+0x1af/0x230 [ 224.565632][ T9273] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 224.565655][ T9273] ? rw_verify_area+0xce/0x6d0 [ 224.565671][ T9273] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 224.565688][ T9273] vfs_read+0x1e4/0xb40 [ 224.565698][ T9273] ? lock_acquire+0x1d1/0x380 [ 224.565713][ T9273] ? __fget_files+0x34/0x3d0 [ 224.565724][ T9273] ? __pfx_vfs_read+0x10/0x10 [ 224.565733][ T9273] ? find_held_lock+0x2b/0x80 [ 224.565744][ T9273] ? __fget_files+0x215/0x3d0 [ 224.565757][ T9273] ? __fget_files+0x21f/0x3d0 [ 224.565773][ T9273] ksys_read+0x12a/0x250 [ 224.565783][ T9273] ? __pfx_ksys_read+0x10/0x10 [ 224.565797][ T9273] do_int80_emulation+0x166/0x650 [ 224.565813][ T9273] asm_int80_emulation+0x1a/0x20 [ 224.565824][ T9273] RIP: 0023:0xf71375ab [ 224.565833][ T9273] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 224.565844][ T9273] RSP: 002b:00000000f53f64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 224.565855][ T9273] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f53f65d0 [ 224.565862][ T9273] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 224.565868][ T9273] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 224.565875][ T9273] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 224.565881][ T9273] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 224.565894][ T9273] [ 224.711102][ T9282] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 224.711346][ T9282] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 224.785099][ T9286] overlayfs: failed to resolve './dev': -2 [ 225.460444][ T9291] netlink: 'syz.2.934': attribute type 1 has an invalid length. [ 225.691185][ T42] audit: type=1326 audit(1787984583.059:4025): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9303 comm="syz.2.937" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf70befec code=0x0 [ 226.481882][ T9309] 9p: Bad value for 'rfdno' [ 226.617661][ T9314] netlink: 4 bytes leftover after parsing attributes in process `syz.2.940'. [ 226.654951][ T9309] Console: switching to colour dummy device 80x25 [ 226.821223][ T9321] jffs2: notice: (9321) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 227.926636][ T9327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 227.934733][ T9327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 228.056433][ T9328] overlayfs: failed to resolve './dev': -2 [ 228.123200][ T9315] netlink: 8 bytes leftover after parsing attributes in process `syz.2.940'. [ 228.123266][ T9315] netlink: 24 bytes leftover after parsing attributes in process `syz.2.940'. [ 228.126959][ T9312] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 228.146344][ T9331] ima: rule for LSM 'u' is undefined [ 228.148550][ T9330] ima: policy update failed [ 228.150064][ T42] audit: type=1807 audit(1787984585.509:4026): action=measure func=FILE_CHECK obj_type=u res=0 [ 228.150096][ T42] audit: type=1802 audit(1787984585.509:4027): pid=9331 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.4.943" res=0 errno=0 [ 228.150115][ T42] audit: type=1802 audit(1787984585.509:4028): pid=9330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.4.943" res=0 errno=0 [ 228.173357][ T9312] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 228.173567][ T9312] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 228.174007][ T9312] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 228.179738][ T9312] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 228.218792][ T9312] pci 0000:00:01.0: Adding to iommu group 1 [ 228.230306][ T9312] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 228.230341][ T9312] pci 0000:00:01.0: vgaarb: bridge control possible [ 228.230350][ T9312] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 228.253692][ T9312] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 228.253905][ T9312] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 228.264678][ T9312] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 228.279350][ T9312] [drm] Found bochs VGA, ID 0xb0c5. [ 228.279476][ T9312] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 228.295020][ T9312] bochs-drm 0000:00:01.0: probe with driver bochs-drm failed with error -4 [ 228.526346][ T9347] FAULT_INJECTION: forcing a failure. [ 228.526346][ T9347] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 228.531025][ T9347] CPU: 3 UID: 0 PID: 9347 Comm: syz.4.949 Tainted: G L syzkaller #0 PREEMPT(full) [ 228.531055][ T9347] Tainted: [L]=SOFTLOCKUP [ 228.531061][ T9347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 228.531072][ T9347] Call Trace: [ 228.531079][ T9347] [ 228.531085][ T9347] dump_stack_lvl+0x100/0x190 [ 228.531158][ T9347] should_fail_ex.cold+0x5/0xa [ 228.531173][ T9347] _copy_to_user+0x32/0xd0 [ 228.531209][ T9347] simple_read_from_buffer+0xcb/0x170 [ 228.531222][ T9347] proc_fail_nth_read+0x1af/0x230 [ 228.531240][ T9347] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 228.531258][ T9347] ? rw_verify_area+0xce/0x6d0 [ 228.531274][ T9347] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 228.531291][ T9347] vfs_read+0x1e4/0xb40 [ 228.531301][ T9347] ? lock_acquire+0x1d1/0x380 [ 228.531316][ T9347] ? __fget_files+0x34/0x3d0 [ 228.531327][ T9347] ? __pfx_vfs_read+0x10/0x10 [ 228.531336][ T9347] ? find_held_lock+0x2b/0x80 [ 228.531347][ T9347] ? __fget_files+0x215/0x3d0 [ 228.531360][ T9347] ? __fget_files+0x21f/0x3d0 [ 228.531374][ T9347] ksys_read+0x12a/0x250 [ 228.531384][ T9347] ? __pfx_ksys_read+0x10/0x10 [ 228.531405][ T9347] do_int80_emulation+0x166/0x650 [ 228.531454][ T9347] asm_int80_emulation+0x1a/0x20 [ 228.531471][ T9347] RIP: 0023:0xf71375ab [ 228.531485][ T9347] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 228.531501][ T9347] RSP: 002b:00000000f53f64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 228.531518][ T9347] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f53f65d0 [ 228.531529][ T9347] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 228.531539][ T9347] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 228.531548][ T9347] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 228.531558][ T9347] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 228.531580][ T9347] [ 228.647381][ T9356] FAULT_INJECTION: forcing a failure. [ 228.647381][ T9356] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 228.648922][ T9356] CPU: 2 UID: 0 PID: 9356 Comm: syz.3.953 Tainted: G L syzkaller #0 PREEMPT(full) [ 228.648951][ T9356] Tainted: [L]=SOFTLOCKUP [ 228.648957][ T9356] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 228.648968][ T9356] Call Trace: [ 228.648975][ T9356] [ 228.648982][ T9356] dump_stack_lvl+0x100/0x190 [ 228.649010][ T9356] should_fail_ex.cold+0x5/0xa [ 228.649032][ T9356] _copy_from_user+0x2e/0xd0 [ 228.649051][ T9356] get_compat_msghdr+0xb3/0x480 [ 228.649123][ T9356] ? __pfx_get_compat_msghdr+0x10/0x10 [ 228.649153][ T9356] ___sys_sendmsg+0x1b6/0x1e0 [ 228.649177][ T9356] ? __pfx____sys_sendmsg+0x10/0x10 [ 228.649215][ T9356] ? find_held_lock+0x2b/0x80 [ 228.649246][ T9356] __sys_sendmsg+0x160/0x210 [ 228.649266][ T9356] ? __pfx___sys_sendmsg+0x10/0x10 [ 228.649291][ T9356] ? __pfx_ksys_write+0x10/0x10 [ 228.649313][ T9356] __do_fast_syscall_32+0x13a/0x8b0 [ 228.649334][ T9356] ? lockdep_hardirqs_on+0x7d/0x110 [ 228.649355][ T9356] do_fast_syscall_32+0x32/0x70 [ 228.649377][ T9356] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 228.649399][ T9356] RIP: 0023:0xf700efec [ 228.649420][ T9356] Code: Unable to access opcode bytes at 0xf700efc2. [ 228.649427][ T9356] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 228.649452][ T9356] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 228.649463][ T9356] RDX: 0000000004008000 RSI: 0000000000000000 RDI: 0000000000000000 [ 228.649474][ T9356] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 228.649483][ T9356] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 228.649498][ T9356] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 228.649521][ T9356] [ 229.480652][ T9368] 9p: Bad value for 'rfdno' [ 229.627788][ T9371] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 229.638675][ T9371] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 229.639196][ T9371] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 229.639846][ T9371] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 229.642274][ T9371] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 229.774043][ T9371] pci 0000:00:01.0: Adding to iommu group 1 [ 229.774779][ T9376] overlayfs: workdir and upperdir must reside under the same mount [ 229.801855][ T9378] FAULT_INJECTION: forcing a failure. [ 229.801855][ T9378] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 229.803091][ T9378] CPU: 1 UID: 0 PID: 9378 Comm: syz.3.961 Tainted: G L syzkaller #0 PREEMPT(full) [ 229.803125][ T9378] Tainted: [L]=SOFTLOCKUP [ 229.803130][ T9378] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 229.803137][ T9378] Call Trace: [ 229.803173][ T9378] [ 229.803178][ T9378] dump_stack_lvl+0x100/0x190 [ 229.803282][ T9378] should_fail_ex.cold+0x5/0xa [ 229.803296][ T9378] _copy_from_user+0x2e/0xd0 [ 229.803345][ T9378] get_compat_msghdr+0xb3/0x480 [ 229.803380][ T9378] ? __pfx_get_compat_msghdr+0x10/0x10 [ 229.803401][ T9378] ___sys_sendmsg+0x1b6/0x1e0 [ 229.803421][ T9378] ? __pfx____sys_sendmsg+0x10/0x10 [ 229.803444][ T9378] ? find_held_lock+0x2b/0x80 [ 229.803465][ T9378] __sys_sendmsg+0x160/0x210 [ 229.803479][ T9378] ? __pfx___sys_sendmsg+0x10/0x10 [ 229.803494][ T9378] ? __pfx_ksys_write+0x10/0x10 [ 229.803508][ T9378] __do_fast_syscall_32+0x13a/0x8b0 [ 229.803545][ T9378] ? lockdep_hardirqs_on+0x7d/0x110 [ 229.803560][ T9378] do_fast_syscall_32+0x32/0x70 [ 229.803575][ T9378] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 229.803589][ T9378] RIP: 0023:0xf700efec [ 229.803603][ T9378] Code: Unable to access opcode bytes at 0xf700efc2. [ 229.803626][ T9378] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 229.803638][ T9378] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 229.803645][ T9378] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 229.803651][ T9378] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 229.803658][ T9378] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 229.803664][ T9378] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 229.803677][ T9378] [ 229.815848][ T9371] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 229.815866][ T9371] pci 0000:00:01.0: vgaarb: bridge control possible [ 229.815875][ T9371] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 229.830867][ T9371] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 229.831028][ T9371] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 229.834679][ T9371] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 229.853616][ T9371] [drm] Found bochs VGA, ID 0xb0c5. [ 229.853628][ T9371] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 229.887027][ T9371] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 229.996695][ T9388] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 229.998298][ T9388] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 230.063948][ T9388] overlayfs: workdir and upperdir must reside under the same mount [ 230.154967][ T9371] Console: switching to colour frame buffer device 160x50 [ 230.163697][ T9371] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 230.523243][ T9399] jffs2: notice: (9399) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 230.900931][ T9409] FAULT_INJECTION: forcing a failure. [ 230.900931][ T9409] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 230.901005][ T9409] CPU: 3 UID: 0 PID: 9409 Comm: syz.1.969 Tainted: G L syzkaller #0 PREEMPT(full) [ 230.901032][ T9409] Tainted: [L]=SOFTLOCKUP [ 230.901039][ T9409] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 230.901050][ T9409] Call Trace: [ 230.901098][ T9409] [ 230.901106][ T9409] dump_stack_lvl+0x100/0x190 [ 230.901180][ T9409] should_fail_ex.cold+0x5/0xa [ 230.901203][ T9409] _copy_from_user+0x2e/0xd0 [ 230.901247][ T9409] get_compat_msghdr+0xb3/0x480 [ 230.901295][ T9409] ? __pfx_get_compat_msghdr+0x10/0x10 [ 230.901330][ T9409] ___sys_sendmsg+0x1b6/0x1e0 [ 230.901358][ T9409] ? __pfx____sys_sendmsg+0x10/0x10 [ 230.901396][ T9409] ? find_held_lock+0x2b/0x80 [ 230.901432][ T9409] __sys_sendmsg+0x160/0x210 [ 230.901455][ T9409] ? __pfx___sys_sendmsg+0x10/0x10 [ 230.901483][ T9409] ? __pfx_ksys_write+0x10/0x10 [ 230.901507][ T9409] __do_fast_syscall_32+0x13a/0x8b0 [ 230.901560][ T9409] ? lockdep_hardirqs_on+0x7d/0x110 [ 230.901586][ T9409] do_fast_syscall_32+0x32/0x70 [ 230.901610][ T9409] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 230.901633][ T9409] RIP: 0023:0xf704efec [ 230.901653][ T9409] Code: Unable to access opcode bytes at 0xf704efc2. [ 230.901687][ T9409] RSP: 002b:00000000f543d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 230.901706][ T9409] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080001040 [ 230.901718][ T9409] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 230.901729][ T9409] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 230.901741][ T9409] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 230.901752][ T9409] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 230.901776][ T9409] [ 233.034144][ T9425] jffs2: notice: (9425) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 233.259566][ T9431] FAULT_INJECTION: forcing a failure. [ 233.259566][ T9431] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 233.267117][ T9431] CPU: 1 UID: 0 PID: 9431 Comm: syz.2.975 Tainted: G L syzkaller #0 PREEMPT(full) [ 233.267150][ T9431] Tainted: [L]=SOFTLOCKUP [ 233.267156][ T9431] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 233.267166][ T9431] Call Trace: [ 233.267187][ T9431] [ 233.267194][ T9431] dump_stack_lvl+0x100/0x190 [ 233.267224][ T9431] should_fail_ex.cold+0x5/0xa [ 233.267246][ T9431] _copy_from_user+0x2e/0xd0 [ 233.267263][ T9431] get_compat_msghdr+0xb3/0x480 [ 233.267287][ T9431] ? __pfx_get_compat_msghdr+0x10/0x10 [ 233.267315][ T9431] ___sys_sendmsg+0x1b6/0x1e0 [ 233.267341][ T9431] ? __pfx____sys_sendmsg+0x10/0x10 [ 233.267372][ T9431] ? find_held_lock+0x2b/0x80 [ 233.267404][ T9431] __sys_sendmsg+0x160/0x210 [ 233.267423][ T9431] ? __pfx___sys_sendmsg+0x10/0x10 [ 233.267445][ T9431] ? __pfx_ksys_write+0x10/0x10 [ 233.267465][ T9431] __do_fast_syscall_32+0x13a/0x8b0 [ 233.267487][ T9431] ? lockdep_hardirqs_on+0x7d/0x110 [ 233.267508][ T9431] do_fast_syscall_32+0x32/0x70 [ 233.267529][ T9431] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 233.267551][ T9431] RIP: 0023:0xf70befec [ 233.267572][ T9431] Code: Unable to access opcode bytes at 0xf70befc2. [ 233.267579][ T9431] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 233.267597][ T9431] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 233.267607][ T9431] RDX: 000000000000c010 RSI: 0000000000000000 RDI: 0000000000000000 [ 233.267616][ T9431] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 233.267625][ T9431] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 233.267634][ T9431] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 233.267653][ T9431] [ 233.374555][ T9433] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.374901][ T9433] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.448976][ T9434] overlayfs: workdir and upperdir must reside under the same mount [ 233.933970][ T9442] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 233.934003][ T9442] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 233.943204][ T9442] vhci_hcd vhci_hcd.0: Device attached [ 234.273083][ T5936] usb 40-1: SetAddress Request (2) to port 0 [ 234.273561][ T5936] usb 40-1: new SuperSpeed USB device number 2 using vhci_hcd [ 234.673996][ T9458] jffs2: notice: (9458) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 235.620993][ T9443] vhci_hcd: connection reset by peer [ 235.697687][ T5792] vhci_hcd vhci_hcd.1: stop threads [ 235.698930][ T5792] vhci_hcd vhci_hcd.1: release socket [ 235.700137][ T5792] vhci_hcd vhci_hcd.1: disconnect device [ 236.538967][ T9482] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 236.539401][ T9482] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 236.615510][ T9482] overlayfs: workdir and upperdir must reside under the same mount [ 236.706321][ T9484] FAULT_INJECTION: forcing a failure. [ 236.706321][ T9484] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 236.706387][ T9484] CPU: 3 UID: 0 PID: 9484 Comm: syz.2.990 Tainted: G L syzkaller #0 PREEMPT(full) [ 236.706415][ T9484] Tainted: [L]=SOFTLOCKUP [ 236.706420][ T9484] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 236.706428][ T9484] Call Trace: [ 236.706434][ T9484] [ 236.706439][ T9484] dump_stack_lvl+0x100/0x190 [ 236.706460][ T9484] should_fail_ex.cold+0x5/0xa [ 236.706475][ T9484] _copy_from_user+0x2e/0xd0 [ 236.706489][ T9484] get_compat_msghdr+0xb3/0x480 [ 236.706506][ T9484] ? __pfx_get_compat_msghdr+0x10/0x10 [ 236.706525][ T9484] ___sys_sendmsg+0x1b6/0x1e0 [ 236.706544][ T9484] ? __pfx____sys_sendmsg+0x10/0x10 [ 236.706566][ T9484] ? find_held_lock+0x2b/0x80 [ 236.706587][ T9484] __sys_sendmsg+0x160/0x210 [ 236.706600][ T9484] ? __pfx___sys_sendmsg+0x10/0x10 [ 236.706616][ T9484] ? __pfx_ksys_write+0x10/0x10 [ 236.706630][ T9484] __do_fast_syscall_32+0x13a/0x8b0 [ 236.706645][ T9484] ? lockdep_hardirqs_on+0x7d/0x110 [ 236.706660][ T9484] do_fast_syscall_32+0x32/0x70 [ 236.706732][ T9484] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 236.706752][ T9484] RIP: 0023:0xf70befec [ 236.706767][ T9484] Code: Unable to access opcode bytes at 0xf70befc2. [ 236.706772][ T9484] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 236.706783][ T9484] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000ac0 [ 236.706794][ T9484] RDX: 0000000000001048 RSI: 0000000000000000 RDI: 0000000000000000 [ 236.706805][ T9484] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 236.706814][ T9484] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 236.706824][ T9484] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 236.706844][ T9484] [ 236.836353][ T9487] jffs2: notice: (9487) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 236.928055][ T9490] netlink: 'syz.3.992': attribute type 1 has an invalid length. [ 236.939199][ T9490] bond5: entered promiscuous mode [ 236.939439][ T9490] 8021q: adding VLAN 0 to HW filter on device bond5 [ 236.948547][ T9490] bond5: (slave bridge4): making interface the new active one [ 236.948576][ T9490] bridge4: entered promiscuous mode [ 236.949256][ T9490] bond5: (slave bridge4): Enslaving as an active interface with an up link [ 237.579326][ T9504] FAULT_INJECTION: forcing a failure. [ 237.579326][ T9504] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 237.579390][ T9504] CPU: 2 UID: 0 PID: 9504 Comm: syz.3.997 Tainted: G L syzkaller #0 PREEMPT(full) [ 237.579418][ T9504] Tainted: [L]=SOFTLOCKUP [ 237.579423][ T9504] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 237.579430][ T9504] Call Trace: [ 237.579435][ T9504] [ 237.579440][ T9504] dump_stack_lvl+0x100/0x190 [ 237.579461][ T9504] should_fail_ex.cold+0x5/0xa [ 237.579478][ T9504] _copy_to_user+0x32/0xd0 [ 237.579493][ T9504] simple_read_from_buffer+0xcb/0x170 [ 237.579507][ T9504] proc_fail_nth_read+0x1af/0x230 [ 237.579526][ T9504] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 237.579545][ T9504] ? rw_verify_area+0xce/0x6d0 [ 237.579561][ T9504] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 237.579579][ T9504] vfs_read+0x1e4/0xb40 [ 237.579589][ T9504] ? lock_acquire+0x1d1/0x380 [ 237.579604][ T9504] ? __fget_files+0x34/0x3d0 [ 237.579615][ T9504] ? __pfx_vfs_read+0x10/0x10 [ 237.579624][ T9504] ? find_held_lock+0x2b/0x80 [ 237.579636][ T9504] ? __fget_files+0x215/0x3d0 [ 237.579649][ T9504] ? __fget_files+0x21f/0x3d0 [ 237.579664][ T9504] ksys_read+0x12a/0x250 [ 237.579686][ T9504] ? __pfx_ksys_read+0x10/0x10 [ 237.579700][ T9504] do_int80_emulation+0x166/0x650 [ 237.579718][ T9504] asm_int80_emulation+0x1a/0x20 [ 237.579729][ T9504] RIP: 0023:0xf71475ab [ 237.579739][ T9504] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 237.579750][ T9504] RSP: 002b:00000000f53fd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 237.579762][ T9504] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f53fd5d0 [ 237.579768][ T9504] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 237.579775][ T9504] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 237.579781][ T9504] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 237.579788][ T9504] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 237.579801][ T9504] [ 237.760299][ T9507] jffs2: notice: (9507) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 237.949152][ T9514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 237.959298][ T9514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 237.992713][ T9513] netlink: 'syz.2.999': attribute type 5 has an invalid length. [ 238.525384][ T9522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 238.529531][ T9522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 238.625094][ T9522] overlayfs: workdir and upperdir must reside under the same mount [ 238.864252][ T9524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 238.864623][ T9524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 239.082769][ T9532] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1007'. [ 239.188810][ T9537] FAULT_INJECTION: forcing a failure. [ 239.188810][ T9537] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 239.188874][ T9537] CPU: 0 UID: 0 PID: 9537 Comm: syz.4.1009 Tainted: G L syzkaller #0 PREEMPT(full) [ 239.188900][ T9537] Tainted: [L]=SOFTLOCKUP [ 239.188906][ T9537] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 239.188916][ T9537] Call Trace: [ 239.188923][ T9537] [ 239.188930][ T9537] dump_stack_lvl+0x100/0x190 [ 239.188959][ T9537] should_fail_ex.cold+0x5/0xa [ 239.188982][ T9537] _copy_from_user+0x2e/0xd0 [ 239.189003][ T9537] get_compat_msghdr+0xb3/0x480 [ 239.189030][ T9537] ? __pfx_get_compat_msghdr+0x10/0x10 [ 239.189061][ T9537] ___sys_sendmsg+0x1b6/0x1e0 [ 239.189091][ T9537] ? __pfx____sys_sendmsg+0x10/0x10 [ 239.189126][ T9537] ? find_held_lock+0x2b/0x80 [ 239.189157][ T9537] __sys_sendmsg+0x160/0x210 [ 239.189177][ T9537] ? __pfx___sys_sendmsg+0x10/0x10 [ 239.189201][ T9537] ? __pfx_ksys_write+0x10/0x10 [ 239.189218][ T9537] __do_fast_syscall_32+0x13a/0x8b0 [ 239.189233][ T9537] ? lockdep_hardirqs_on+0x7d/0x110 [ 239.189247][ T9537] do_fast_syscall_32+0x32/0x70 [ 239.189261][ T9537] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 239.189275][ T9537] RIP: 0023:0xf7f34fec [ 239.189288][ T9537] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 239.189294][ T9537] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 239.189305][ T9537] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000040 [ 239.189312][ T9537] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 239.189318][ T9537] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 239.189324][ T9537] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 239.189330][ T9537] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 239.189343][ T9537] [ 239.351050][ T5936] usb 40-1: device descriptor read/8, error -110 [ 239.742111][ T5936] usb usb40-port1: attempt power cycle [ 239.840540][ T9565] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 239.846833][ T9565] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 239.921223][ T9566] overlayfs: workdir and upperdir must reside under the same mount [ 241.328681][ T9579] overlayfs: missing 'lowerdir' [ 241.485617][ T5936] usb usb40-port1: unable to enumerate USB device [ 241.835609][ T9584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.867446][ T9584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 242.216265][ T9592] FAULT_INJECTION: forcing a failure. [ 242.216265][ T9592] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 242.216361][ T9592] CPU: 3 UID: 0 PID: 9592 Comm: syz.3.1026 Tainted: G L syzkaller #0 PREEMPT(full) [ 242.216391][ T9592] Tainted: [L]=SOFTLOCKUP [ 242.216398][ T9592] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 242.216410][ T9592] Call Trace: [ 242.216418][ T9592] [ 242.216428][ T9592] dump_stack_lvl+0x100/0x190 [ 242.216459][ T9592] should_fail_ex.cold+0x5/0xa [ 242.216486][ T9592] _copy_to_user+0x32/0xd0 [ 242.216511][ T9592] simple_read_from_buffer+0xcb/0x170 [ 242.216535][ T9592] proc_fail_nth_read+0x1af/0x230 [ 242.216569][ T9592] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 242.216602][ T9592] ? rw_verify_area+0xce/0x6d0 [ 242.216630][ T9592] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 242.216660][ T9592] vfs_read+0x1e4/0xb40 [ 242.216680][ T9592] ? lock_acquire+0x1d1/0x380 [ 242.216707][ T9592] ? __fget_files+0x34/0x3d0 [ 242.216746][ T9592] ? __pfx_vfs_read+0x10/0x10 [ 242.216765][ T9592] ? find_held_lock+0x2b/0x80 [ 242.216786][ T9592] ? __fget_files+0x215/0x3d0 [ 242.216812][ T9592] ? __fget_files+0x21f/0x3d0 [ 242.216842][ T9592] ksys_read+0x12a/0x250 [ 242.216861][ T9592] ? __pfx_ksys_read+0x10/0x10 [ 242.216890][ T9592] do_int80_emulation+0x166/0x650 [ 242.216921][ T9592] asm_int80_emulation+0x1a/0x20 [ 242.216942][ T9592] RIP: 0023:0xf71475ab [ 242.216966][ T9592] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 242.216986][ T9592] RSP: 002b:00000000f53fd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 242.217005][ T9592] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f53fd5d0 [ 242.217018][ T9592] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 242.217029][ T9592] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 242.217041][ T9592] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 242.217053][ T9592] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 242.217080][ T9592] [ 242.400140][ T9602] MTD: Couldn't look up './dev/mtdblock0': -2 [ 242.573665][ T9604] jffs2: notice: (9604) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 242.575126][ T9603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 242.621104][ T9603] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 243.154704][ T9608] overlayfs: workdir and upperdir must reside under the same mount [ 243.391683][ T42] audit: type=1804 audit(1787984600.749:4029): pid=9610 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1031" name="bus" dev="ramfs" ino=35140 res=1 errno=0 [ 244.012735][ T9624] jffs2: notice: (9624) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 244.071311][ T5936] page_pool_release_retry() stalled pool shutdown: id 36, 10 inflight 60 sec [ 244.137244][ T9629] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1037'. [ 244.148625][ T9631] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 244.150113][ T9631] FAULT_INJECTION: forcing a failure. [ 244.150113][ T9631] name failslab, interval 1, probability 0, space 0, times 0 [ 244.150141][ T9631] CPU: 2 UID: 0 PID: 9631 Comm: syz.2.1036 Tainted: G L syzkaller #0 PREEMPT(full) [ 244.150160][ T9631] Tainted: [L]=SOFTLOCKUP [ 244.150164][ T9631] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 244.150172][ T9631] Call Trace: [ 244.150178][ T9631] [ 244.150184][ T9631] dump_stack_lvl+0x100/0x190 [ 244.150203][ T9631] should_fail_ex.cold+0x5/0xa [ 244.150219][ T9631] should_failslab+0xc2/0x120 [ 244.150235][ T9631] __kmalloc_noprof+0xfc/0x840 [ 244.150246][ T9631] ? rcu_is_watching+0x13/0xc0 [ 244.150257][ T9631] ? tomoyo_realpath_from_path+0xb6/0x690 [ 244.150279][ T9631] tomoyo_realpath_from_path+0xb6/0x690 [ 244.150299][ T9631] tomoyo_path_perm+0x276/0x460 [ 244.150312][ T9631] ? tomoyo_path_perm+0x262/0x460 [ 244.150327][ T9631] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 244.150342][ T9631] ? __lock_acquire+0x4c5/0x1ec0 [ 244.150370][ T9631] ? __fget_files+0x21f/0x3d0 [ 244.150385][ T9631] security_inode_getattr+0x116/0x280 [ 244.150402][ T9631] vfs_fstat+0x4b/0xe0 [ 244.150418][ T9631] __do_compat_sys_ia32_fstat64+0x8b/0x100 [ 244.150436][ T9631] ? __pfx___do_compat_sys_ia32_fstat64+0x10/0x10 [ 244.150460][ T9631] ? ksys_write+0x1ac/0x250 [ 244.150470][ T9631] ? __pfx_ksys_write+0x10/0x10 [ 244.150499][ T9631] __do_fast_syscall_32+0x13a/0x8b0 [ 244.150517][ T9631] ? lockdep_hardirqs_on+0x7d/0x110 [ 244.150532][ T9631] do_fast_syscall_32+0x32/0x70 [ 244.150547][ T9631] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 244.150561][ T9631] RIP: 0023:0xf70befec [ 244.150578][ T9631] Code: Unable to access opcode bytes at 0xf70befc2. [ 244.150584][ T9631] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 00000000000000c5 [ 244.150595][ T9631] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 244.150602][ T9631] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 244.150609][ T9631] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 244.150615][ T9631] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 244.150621][ T9631] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 244.150635][ T9631] [ 244.150709][ T9631] ERROR: Out of memory at tomoyo_realpath_from_path. [ 244.158606][ T9629] batman_adv: batadv0: Adding interface: macsec1 [ 244.158618][ T9629] batman_adv: batadv0: The MTU of interface macsec1 is too small (1418) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 244.158633][ T9629] batman_adv: batadv0: Not using interface macsec1 (retrying later): interface not active [ 244.248287][ T9636] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 244.248541][ T9636] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 244.448749][ T9640] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 244.450028][ T9640] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 245.175782][ T9652] FAULT_INJECTION: forcing a failure. [ 245.175782][ T9652] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 245.175827][ T9652] CPU: 0 UID: 0 PID: 9652 Comm: syz.2.1043 Tainted: G L syzkaller #0 PREEMPT(full) [ 245.175854][ T9652] Tainted: [L]=SOFTLOCKUP [ 245.175860][ T9652] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 245.175866][ T9652] Call Trace: [ 245.175870][ T9652] [ 245.175875][ T9652] dump_stack_lvl+0x100/0x190 [ 245.175893][ T9652] should_fail_ex.cold+0x5/0xa [ 245.175908][ T9652] _copy_to_user+0x32/0xd0 [ 245.175924][ T9652] simple_read_from_buffer+0xcb/0x170 [ 245.175937][ T9652] proc_fail_nth_read+0x1af/0x230 [ 245.175955][ T9652] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 245.175973][ T9652] ? rw_verify_area+0xce/0x6d0 [ 245.175989][ T9652] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 245.176007][ T9652] vfs_read+0x1e4/0xb40 [ 245.176017][ T9652] ? lock_acquire+0x1d1/0x380 [ 245.176031][ T9652] ? __fget_files+0x34/0x3d0 [ 245.176042][ T9652] ? __pfx_vfs_read+0x10/0x10 [ 245.176051][ T9652] ? find_held_lock+0x2b/0x80 [ 245.176071][ T9652] ? __fget_files+0x215/0x3d0 [ 245.176085][ T9652] ? __fget_files+0x21f/0x3d0 [ 245.176102][ T9652] ksys_read+0x12a/0x250 [ 245.176113][ T9652] ? __pfx_ksys_read+0x10/0x10 [ 245.176127][ T9652] do_int80_emulation+0x166/0x650 [ 245.176144][ T9652] asm_int80_emulation+0x1a/0x20 [ 245.176155][ T9652] RIP: 0023:0xf71f75ab [ 245.176164][ T9652] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 245.176175][ T9652] RSP: 002b:00000000f54ad4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 245.176186][ T9652] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f54ad5d0 [ 245.176193][ T9652] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 245.176199][ T9652] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 245.176206][ T9652] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 245.176212][ T9652] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 245.176225][ T9652] [ 245.341454][ T9655] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 245.341526][ T9655] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.343010][ T9655] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 245.438035][ T9655] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 245.438095][ T9655] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.438355][ T9655] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 245.536127][ T9655] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 245.536211][ T9655] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.536490][ T9655] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 245.552833][ T9662] comedi comedi0: dt2801: I/O base address or length out of range [ 245.609460][ T9655] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 245.609518][ T9655] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.609534][ T9655] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 245.720934][ T5792] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 245.725728][ T5792] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 245.728896][ T5792] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 245.731763][ T5792] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 245.734573][ T5792] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 245.737462][ T5792] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 245.740304][ T5792] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 245.743062][ T5792] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 245.745915][ T5792] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 245.749245][ T5792] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 245.752367][ T5792] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 245.755212][ T5792] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 246.043409][ T9666] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1049'. [ 246.371545][ T9672] FAULT_INJECTION: forcing a failure. [ 246.371545][ T9672] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 246.371618][ T9672] CPU: 1 UID: 0 PID: 9672 Comm: syz.2.1050 Tainted: G L syzkaller #0 PREEMPT(full) [ 246.371655][ T9672] Tainted: [L]=SOFTLOCKUP [ 246.371660][ T9672] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 246.371667][ T9672] Call Trace: [ 246.371671][ T9672] [ 246.371676][ T9672] dump_stack_lvl+0x100/0x190 [ 246.371694][ T9672] should_fail_ex.cold+0x5/0xa [ 246.371709][ T9672] _copy_from_user+0x2e/0xd0 [ 246.371721][ T9672] get_compat_msghdr+0xb3/0x480 [ 246.371737][ T9672] ? __pfx_get_compat_msghdr+0x10/0x10 [ 246.371757][ T9672] ___sys_sendmsg+0x1b6/0x1e0 [ 246.371775][ T9672] ? __pfx____sys_sendmsg+0x10/0x10 [ 246.371798][ T9672] ? find_held_lock+0x2b/0x80 [ 246.371819][ T9672] __sys_sendmsg+0x160/0x210 [ 246.371832][ T9672] ? __pfx___sys_sendmsg+0x10/0x10 [ 246.371848][ T9672] ? __pfx_ksys_write+0x10/0x10 [ 246.371861][ T9672] __do_fast_syscall_32+0x13a/0x8b0 [ 246.371876][ T9672] ? lockdep_hardirqs_on+0x7d/0x110 [ 246.371891][ T9672] do_fast_syscall_32+0x32/0x70 [ 246.371905][ T9672] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 246.371919][ T9672] RIP: 0023:0xf70befec [ 246.371932][ T9672] Code: Unable to access opcode bytes at 0xf70befc2. [ 246.371937][ T9672] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 246.371948][ T9672] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080002680 [ 246.371954][ T9672] RDX: 0000000000004000 RSI: 0000000000000000 RDI: 0000000000000000 [ 246.371961][ T9672] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 246.371967][ T9672] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 246.371973][ T9672] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 246.371987][ T9672] [ 246.407355][ T9674] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1048'. [ 246.441156][ T9669] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1048'. [ 246.524309][ T9676] jffs2: notice: (9676) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 246.770220][ T9674] hsr_slave_1 (unregistering): left promiscuous mode [ 246.901148][ T9686] hpfs: hpfs_map_sector(): read error [ 246.923562][ T9692] rnbd_client L607: Mapping device /dev/ram0 on session s1, (access_mode: rw, nr_poll_queues: 0) [ 246.943022][ T9692] rtrs_client L2095: : Failed to resolve address, err: -ENODEV [ 246.943466][ T9692] rtrs_client L2636: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 246.945461][ T9693] loop0: detected capacity change from 0 to 1 [ 247.213076][ T9700] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 247.216367][ T9700] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 247.356375][ T9706] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 247.778726][ T9711] FAULT_INJECTION: forcing a failure. [ 247.778726][ T9711] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 247.786344][ T9711] CPU: 3 UID: 0 PID: 9711 Comm: syz.1.1060 Tainted: G L syzkaller #0 PREEMPT(full) [ 247.786397][ T9711] Tainted: [L]=SOFTLOCKUP [ 247.786404][ T9711] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 247.786415][ T9711] Call Trace: [ 247.786423][ T9711] [ 247.786433][ T9711] dump_stack_lvl+0x100/0x190 [ 247.786465][ T9711] should_fail_ex.cold+0x5/0xa [ 247.786493][ T9711] _copy_to_user+0x32/0xd0 [ 247.786534][ T9711] simple_read_from_buffer+0xcb/0x170 [ 247.786557][ T9711] proc_fail_nth_read+0x1af/0x230 [ 247.786586][ T9711] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 247.786618][ T9711] ? rw_verify_area+0xce/0x6d0 [ 247.786647][ T9711] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 247.786678][ T9711] vfs_read+0x1e4/0xb40 [ 247.786700][ T9711] ? lock_acquire+0x1d1/0x380 [ 247.786723][ T9711] ? __fget_files+0x34/0x3d0 [ 247.786741][ T9711] ? __pfx_vfs_read+0x10/0x10 [ 247.786755][ T9711] ? find_held_lock+0x2b/0x80 [ 247.786773][ T9711] ? __fget_files+0x215/0x3d0 [ 247.786798][ T9711] ? __fget_files+0x21f/0x3d0 [ 247.786827][ T9711] ksys_read+0x12a/0x250 [ 247.786855][ T9711] ? __pfx_ksys_read+0x10/0x10 [ 247.786884][ T9711] do_int80_emulation+0x166/0x650 [ 247.786912][ T9711] asm_int80_emulation+0x1a/0x20 [ 247.786930][ T9711] RIP: 0023:0xf71875ab [ 247.786945][ T9711] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 247.786961][ T9711] RSP: 002b:00000000f543d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 247.786982][ T9711] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f543d5d0 [ 247.786996][ T9711] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 247.787007][ T9711] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 247.787018][ T9711] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 247.787030][ T9711] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 247.787057][ T9711] [ 248.510927][ T9724] jffs2: notice: (9724) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 248.891363][ T9734] FAULT_INJECTION: forcing a failure. [ 248.891363][ T9734] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 248.891424][ T9734] CPU: 0 UID: 0 PID: 9734 Comm: syz.3.1066 Tainted: G L syzkaller #0 PREEMPT(full) [ 248.891452][ T9734] Tainted: [L]=SOFTLOCKUP [ 248.891457][ T9734] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 248.891464][ T9734] Call Trace: [ 248.891469][ T9734] [ 248.891474][ T9734] dump_stack_lvl+0x100/0x190 [ 248.891493][ T9734] should_fail_ex.cold+0x5/0xa [ 248.891522][ T9734] _copy_to_user+0x32/0xd0 [ 248.891540][ T9734] simple_read_from_buffer+0xcb/0x170 [ 248.891553][ T9734] proc_fail_nth_read+0x1af/0x230 [ 248.891572][ T9734] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 248.891591][ T9734] ? rw_verify_area+0xce/0x6d0 [ 248.891607][ T9734] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 248.891625][ T9734] vfs_read+0x1e4/0xb40 [ 248.891635][ T9734] ? lock_acquire+0x1d1/0x380 [ 248.891651][ T9734] ? __fget_files+0x34/0x3d0 [ 248.891662][ T9734] ? __pfx_vfs_read+0x10/0x10 [ 248.891671][ T9734] ? find_held_lock+0x2b/0x80 [ 248.891682][ T9734] ? __fget_files+0x215/0x3d0 [ 248.891696][ T9734] ? __fget_files+0x21f/0x3d0 [ 248.891711][ T9734] ksys_read+0x12a/0x250 [ 248.891721][ T9734] ? __pfx_ksys_read+0x10/0x10 [ 248.891736][ T9734] do_int80_emulation+0x166/0x650 [ 248.891753][ T9734] asm_int80_emulation+0x1a/0x20 [ 248.891764][ T9734] RIP: 0023:0xf71475ab [ 248.891773][ T9734] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 248.891784][ T9734] RSP: 002b:00000000f53fd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 248.891796][ T9734] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f53fd5d0 [ 248.891803][ T9734] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 248.891810][ T9734] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 248.891816][ T9734] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 248.891822][ T9734] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 248.891837][ T9734] [ 249.179047][ T9740] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.182990][ T9740] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.505290][ T9742] geneve0: entered promiscuous mode [ 249.510386][ T9742] batman_adv: batadv0: Interface activated: macsec1 [ 249.585826][ T9759] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.586125][ T9759] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 250.157011][ T9768] jffs2: notice: (9768) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 250.404854][ T9777] tipc: Started in network mode [ 250.404904][ T9777] tipc: Node identity , cluster identity 4711 [ 250.404929][ T9777] tipc: Failed to obtain node identity [ 250.404955][ T9777] tipc: Enabling of bearer rejected, failed to enable media [ 251.710589][ T9790] FAULT_INJECTION: forcing a failure. [ 251.710589][ T9790] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 251.715828][ T9790] CPU: 3 UID: 0 PID: 9790 Comm: syz.4.1077 Tainted: G L syzkaller #0 PREEMPT(full) [ 251.715859][ T9790] Tainted: [L]=SOFTLOCKUP [ 251.715864][ T9790] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 251.715871][ T9790] Call Trace: [ 251.715876][ T9790] [ 251.715882][ T9790] dump_stack_lvl+0x100/0x190 [ 251.715902][ T9790] should_fail_ex.cold+0x5/0xa [ 251.715916][ T9790] _copy_from_user+0x2e/0xd0 [ 251.715929][ T9790] get_compat_msghdr+0xb3/0x480 [ 251.715945][ T9790] ? __pfx_get_compat_msghdr+0x10/0x10 [ 251.715966][ T9790] ___sys_sendmsg+0x1b6/0x1e0 [ 251.715986][ T9790] ? __pfx____sys_sendmsg+0x10/0x10 [ 251.716009][ T9790] ? find_held_lock+0x2b/0x80 [ 251.716029][ T9790] __sys_sendmsg+0x160/0x210 [ 251.716043][ T9790] ? __pfx___sys_sendmsg+0x10/0x10 [ 251.716059][ T9790] ? __pfx_ksys_write+0x10/0x10 [ 251.716072][ T9790] __do_fast_syscall_32+0x13a/0x8b0 [ 251.716087][ T9790] ? lockdep_hardirqs_on+0x7d/0x110 [ 251.716102][ T9790] do_fast_syscall_32+0x32/0x70 [ 251.716116][ T9790] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 251.716130][ T9790] RIP: 0023:0xf7f34fec [ 251.716144][ T9790] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 251.716148][ T9790] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 251.716160][ T9790] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 251.716167][ T9790] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 251.716173][ T9790] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 251.716179][ T9790] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 251.716185][ T9790] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 251.716199][ T9790] [ 251.751274][ T9793] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_vlan, syncid = 0, id = 0 [ 251.813787][ T9796] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 251.814430][ T9796] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 251.815674][ T9798] fuse: Unknown parameter '0000000000000000000000000000000000000000000003' [ 251.822860][ T9798] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1087'. [ 251.855646][ T9796] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 251.856024][ T9796] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 252.049305][ T9808] kernel profiling enabled (shift: 7) [ 252.189082][ T9811] FAULT_INJECTION: forcing a failure. [ 252.189082][ T9811] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 252.189204][ T9811] CPU: 1 UID: 0 PID: 9811 Comm: syz.4.1090 Tainted: G L syzkaller #0 PREEMPT(full) [ 252.189221][ T9811] Tainted: [L]=SOFTLOCKUP [ 252.189225][ T9811] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 252.189231][ T9811] Call Trace: [ 252.189235][ T9811] [ 252.189240][ T9811] dump_stack_lvl+0x100/0x190 [ 252.189257][ T9811] should_fail_ex.cold+0x5/0xa [ 252.189272][ T9811] _copy_from_user+0x2e/0xd0 [ 252.189284][ T9811] copy_from_sockptr_offset.constprop.0+0x12c/0x150 [ 252.189301][ T9811] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 252.189335][ T9811] do_sock_getsockopt+0x2d0/0x6e0 [ 252.189352][ T9811] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 252.189370][ T9811] ? __fget_files+0x34/0x3d0 [ 252.189381][ T9811] ? find_held_lock+0x2b/0x80 [ 252.189396][ T9811] ? __fget_files+0x21f/0x3d0 [ 252.189410][ T9811] __sys_getsockopt+0x133/0x1d0 [ 252.189426][ T9811] ? __ia32_sys_getsockopt+0xbc/0x160 [ 252.189438][ T9811] __ia32_sys_getsockopt+0xbc/0x160 [ 252.189449][ T9811] ? __do_fast_syscall_32+0xb3/0x8b0 [ 252.189470][ T9811] ? lockdep_hardirqs_on+0x7d/0x110 [ 252.189483][ T9811] __do_fast_syscall_32+0x13a/0x8b0 [ 252.189496][ T9811] ? lockdep_hardirqs_on+0x7d/0x110 [ 252.189510][ T9811] do_fast_syscall_32+0x32/0x70 [ 252.189525][ T9811] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 252.189538][ T9811] RIP: 0023:0xf7f34fec [ 252.189552][ T9811] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 252.189557][ T9811] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 000000000000016d [ 252.189568][ T9811] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000114 [ 252.189575][ T9811] RDX: 0000000000002710 RSI: 0000000080000580 RDI: 0000000080000040 [ 252.189582][ T9811] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 252.189588][ T9811] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 252.189594][ T9811] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 252.189607][ T9811] [ 252.825018][ T9817] jffs2: notice: (9817) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 252.843031][ T9820] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 252.843366][ T9820] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 252.861439][ T9822] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 252.864195][ T9822] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 253.936492][ T9833] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 253.940222][ T9833] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 254.078816][ T9843] qrtr: Invalid version 0 [ 254.085020][ T9843] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1092'. [ 254.104142][ T9843] jffs2: notice: (9843) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 254.136680][ T9843] syzkaller1: entered promiscuous mode [ 254.136732][ T9843] syzkaller1: entered allmulticast mode [ 254.384229][ T9852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 254.386650][ T9852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 254.797922][ T9869] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1098'. [ 254.803482][ T9869] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1098'. [ 254.933039][ T9877] jffs2: notice: (9877) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 255.279656][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.279761][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.638562][ T9905] ptrace attach of "/syz-executor exec"[5738] was attempted by "/syz-executor exec"[9905] [ 255.654465][ T9905] netlink: 'syz.3.1103': attribute type 10 has an invalid length. [ 255.716116][ T9905] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 255.720067][ T9905] team0: Port device netdevsim1 added [ 255.748460][ T9912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 255.751641][ T9912] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 255.823683][ T9907] FAULT_INJECTION: forcing a failure. [ 255.823683][ T9907] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 255.823747][ T9907] CPU: 1 UID: 0 PID: 9907 Comm: syz.4.1104 Tainted: G L syzkaller #0 PREEMPT(full) [ 255.823774][ T9907] Tainted: [L]=SOFTLOCKUP [ 255.823780][ T9907] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 255.823798][ T9907] Call Trace: [ 255.823802][ T9907] [ 255.823806][ T9907] dump_stack_lvl+0x100/0x190 [ 255.823877][ T9907] should_fail_ex.cold+0x5/0xa [ 255.823892][ T9907] _copy_from_user+0x2e/0xd0 [ 255.823924][ T9907] get_compat_msghdr+0xb3/0x480 [ 255.823959][ T9907] ? __pfx_get_compat_msghdr+0x10/0x10 [ 255.823979][ T9907] ___sys_sendmsg+0x1b6/0x1e0 [ 255.823996][ T9907] ? __pfx____sys_sendmsg+0x10/0x10 [ 255.824021][ T9907] ? find_held_lock+0x2b/0x80 [ 255.824041][ T9907] __sys_sendmsg+0x160/0x210 [ 255.824054][ T9907] ? __pfx___sys_sendmsg+0x10/0x10 [ 255.824070][ T9907] ? __pfx_ksys_write+0x10/0x10 [ 255.824084][ T9907] __do_fast_syscall_32+0x13a/0x8b0 [ 255.824119][ T9907] ? lockdep_hardirqs_on+0x7d/0x110 [ 255.824133][ T9907] do_fast_syscall_32+0x32/0x70 [ 255.824148][ T9907] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 255.824161][ T9907] RIP: 0023:0xf7f34fec [ 255.824175][ T9907] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 255.824179][ T9907] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 255.824191][ T9907] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 255.824198][ T9907] RDX: 0000000000008810 RSI: 0000000000000000 RDI: 0000000000000000 [ 255.824204][ T9907] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 255.824210][ T9907] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 255.824216][ T9907] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 255.824230][ T9907] [ 255.848411][ T9919] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 255.848653][ T9919] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 255.848748][ T9917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 255.850342][ T9917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 255.919160][ T9922] overlayfs: workdir and upperdir must reside under the same mount [ 256.095840][ T9917] overlayfs: workdir and upperdir must reside under the same mount [ 256.334080][ T9930] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 256.335485][ T9930] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 256.887086][ T9944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 256.887438][ T9944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 256.901324][ T9946] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 256.902380][ T9946] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 256.969604][ T9948] ata1.00: invalid cdb length 6 [ 257.428934][ T9952] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 257.429223][ T9952] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.173728][ T9970] FAULT_INJECTION: forcing a failure. [ 258.173728][ T9970] name failslab, interval 1, probability 0, space 0, times 0 [ 258.177692][ T9970] CPU: 3 UID: 0 PID: 9970 Comm: syz.4.1121 Tainted: G L syzkaller #0 PREEMPT(full) [ 258.177721][ T9970] Tainted: [L]=SOFTLOCKUP [ 258.177726][ T9970] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 258.177733][ T9970] Call Trace: [ 258.177737][ T9970] [ 258.177742][ T9970] dump_stack_lvl+0x100/0x190 [ 258.177760][ T9970] should_fail_ex.cold+0x5/0xa [ 258.177775][ T9970] should_failslab+0xc2/0x120 [ 258.177807][ T9970] kmem_cache_alloc_noprof+0x92/0x6a0 [ 258.177821][ T9970] ? do_getname+0x35/0x390 [ 258.177838][ T9970] do_getname+0x35/0x390 [ 258.177853][ T9970] do_sys_openat2+0xc7/0x1e0 [ 258.177868][ T9970] ? __pfx_do_sys_openat2+0x10/0x10 [ 258.177884][ T9970] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 258.177902][ T9970] __ia32_compat_sys_openat+0x12d/0x210 [ 258.177918][ T9970] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 258.177933][ T9970] ? fput+0x7c/0x100 [ 258.177945][ T9970] ? ksys_write+0x1ac/0x250 [ 258.177955][ T9970] ? __pfx_ksys_write+0x10/0x10 [ 258.177968][ T9970] __do_fast_syscall_32+0x13a/0x8b0 [ 258.177982][ T9970] ? lockdep_hardirqs_on+0x7d/0x110 [ 258.177996][ T9970] do_fast_syscall_32+0x32/0x70 [ 258.178010][ T9970] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 258.178025][ T9970] RIP: 0023:0xf7f34fec [ 258.178038][ T9970] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 258.178042][ T9970] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 258.178054][ T9970] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000500 [ 258.178060][ T9970] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 258.178067][ T9970] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 258.178073][ T9970] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 258.178079][ T9970] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 258.178093][ T9970] [ 258.574692][ T9976] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.575010][ T9976] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.827870][ T9986] ip6gre1: entered promiscuous mode [ 258.827924][ T9986] ip6gre1: entered allmulticast mode [ 259.160284][ T9991] FAULT_INJECTION: forcing a failure. [ 259.160284][ T9991] name failslab, interval 1, probability 0, space 0, times 0 [ 259.160377][ T9991] CPU: 0 UID: 0 PID: 9991 Comm: syz.2.1129 Tainted: G L syzkaller #0 PREEMPT(full) [ 259.160404][ T9991] Tainted: [L]=SOFTLOCKUP [ 259.160410][ T9991] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 259.160417][ T9991] Call Trace: [ 259.160432][ T9991] [ 259.160439][ T9991] dump_stack_lvl+0x100/0x190 [ 259.160458][ T9991] should_fail_ex.cold+0x5/0xa [ 259.160473][ T9991] should_failslab+0xc2/0x120 [ 259.160488][ T9991] kmem_cache_alloc_noprof+0x92/0x6a0 [ 259.160501][ T9991] ? do_getname+0x35/0x390 [ 259.160529][ T9991] do_getname+0x35/0x390 [ 259.160548][ T9991] do_sys_openat2+0xc7/0x1e0 [ 259.160563][ T9991] ? __pfx_do_sys_openat2+0x10/0x10 [ 259.160580][ T9991] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 259.160598][ T9991] __ia32_compat_sys_openat+0x12d/0x210 [ 259.160614][ T9991] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 259.160629][ T9991] ? fput+0x7c/0x100 [ 259.160642][ T9991] ? ksys_write+0x1ac/0x250 [ 259.160652][ T9991] ? __pfx_ksys_write+0x10/0x10 [ 259.160666][ T9991] __do_fast_syscall_32+0x13a/0x8b0 [ 259.160681][ T9991] ? lockdep_hardirqs_on+0x7d/0x110 [ 259.160695][ T9991] do_fast_syscall_32+0x32/0x70 [ 259.160709][ T9991] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 259.160724][ T9991] RIP: 0023:0xf70befec [ 259.160737][ T9991] Code: Unable to access opcode bytes at 0xf70befc2. [ 259.160743][ T9991] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 259.160754][ T9991] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000600 [ 259.160761][ T9991] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 259.160768][ T9991] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 259.160774][ T9991] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 259.160780][ T9991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 259.160794][ T9991] [ 259.474450][ T9995] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 259.477377][ T9995] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 259.694639][ T9999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 259.695988][ T9999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 259.750355][ T9997] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 260.374417][T10020] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1141'. [ 260.474042][T10022] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 260.477005][T10022] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 260.506879][T10024] FAULT_INJECTION: forcing a failure. [ 260.506879][T10024] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 260.507327][T10024] CPU: 0 UID: 0 PID: 10024 Comm: syz.4.1144 Tainted: G L syzkaller #0 PREEMPT(full) [ 260.507365][T10024] Tainted: [L]=SOFTLOCKUP [ 260.507370][T10024] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 260.507377][T10024] Call Trace: [ 260.507382][T10024] [ 260.507386][T10024] dump_stack_lvl+0x100/0x190 [ 260.507404][T10024] should_fail_ex.cold+0x5/0xa [ 260.507419][T10024] _copy_from_user+0x2e/0xd0 [ 260.507431][T10024] get_compat_msghdr+0xb3/0x480 [ 260.507448][T10024] ? __pfx_get_compat_msghdr+0x10/0x10 [ 260.507467][T10024] ? do_raw_spin_unlock+0x145/0x1e0 [ 260.507486][T10024] ? debug_object_assert_init+0x1c4/0x310 [ 260.507500][T10024] ? rcu_is_watching+0x13/0xc0 [ 260.507512][T10024] ___sys_sendmsg+0x1b6/0x1e0 [ 260.507530][T10024] ? __pfx____sys_sendmsg+0x10/0x10 [ 260.507553][T10024] ? find_held_lock+0x2b/0x80 [ 260.507573][T10024] __sys_sendmsg+0x160/0x210 [ 260.507586][T10024] ? __pfx___sys_sendmsg+0x10/0x10 [ 260.507601][T10024] ? exit_to_user_mode_loop+0x166/0x700 [ 260.507617][T10024] ? rcu_is_watching+0x13/0xc0 [ 260.507645][T10024] __do_fast_syscall_32+0x13a/0x8b0 [ 260.507660][T10024] ? lockdep_hardirqs_on+0x7d/0x110 [ 260.507675][T10024] do_fast_syscall_32+0x32/0x70 [ 260.507689][T10024] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.507703][T10024] RIP: 0023:0xf7f34fec [ 260.507717][T10024] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 260.507722][T10024] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 260.507733][T10024] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 260.507739][T10024] RDX: 000000000000c000 RSI: 0000000000000000 RDI: 0000000000000000 [ 260.507746][T10024] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 260.507753][T10024] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 260.507759][T10024] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 260.507773][T10024] [ 260.909760][T10035] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1145'. [ 261.080909][T10038] jffs2: notice: (10038) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 261.876267][T10048] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1148'. [ 261.966543][T10052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 261.990770][T10052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 261.999116][T10054] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 262.002564][T10054] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 262.053710][T10060] FAULT_INJECTION: forcing a failure. [ 262.053710][T10060] name failslab, interval 1, probability 0, space 0, times 0 [ 262.053803][T10060] CPU: 2 UID: 0 PID: 10060 Comm: syz.4.1154 Tainted: G L syzkaller #0 PREEMPT(full) [ 262.053832][T10060] Tainted: [L]=SOFTLOCKUP [ 262.053837][T10060] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 262.053844][T10060] Call Trace: [ 262.053848][T10060] [ 262.053854][T10060] dump_stack_lvl+0x100/0x190 [ 262.053877][T10060] should_fail_ex.cold+0x5/0xa [ 262.053892][T10060] should_failslab+0xc2/0x120 [ 262.053907][T10060] kmem_cache_alloc_noprof+0x92/0x6a0 [ 262.053920][T10060] ? do_getname+0x35/0x390 [ 262.053938][T10060] do_getname+0x35/0x390 [ 262.053954][T10060] do_sys_openat2+0xc7/0x1e0 [ 262.053969][T10060] ? __pfx_do_sys_openat2+0x10/0x10 [ 262.053985][T10060] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 262.054003][T10060] __ia32_compat_sys_openat+0x12d/0x210 [ 262.054019][T10060] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 262.054034][T10060] ? fput+0x7c/0x100 [ 262.054047][T10060] ? ksys_write+0x1ac/0x250 [ 262.054056][T10060] ? __pfx_ksys_write+0x10/0x10 [ 262.054074][T10060] __do_fast_syscall_32+0x13a/0x8b0 [ 262.054089][T10060] ? lockdep_hardirqs_on+0x7d/0x110 [ 262.054104][T10060] do_fast_syscall_32+0x32/0x70 [ 262.054119][T10060] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 262.054135][T10060] RIP: 0023:0xf7f34fec [ 262.054148][T10060] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 262.054153][T10060] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 262.054164][T10060] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000800 [ 262.054171][T10060] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 262.054178][T10060] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 262.054183][T10060] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 262.054190][T10060] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 262.054204][T10060] [ 262.105253][T10062] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 262.105837][T10062] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 262.176417][T10062] overlayfs: workdir and upperdir must reside under the same mount [ 262.550354][T10065] overlay: Unknown parameter 'fscontext' [ 262.590352][T10065] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1156'. [ 262.618984][T10069] FAULT_INJECTION: forcing a failure. [ 262.618984][T10069] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 262.619076][T10069] CPU: 0 UID: 0 PID: 10069 Comm: syz.3.1158 Tainted: G L syzkaller #0 PREEMPT(full) [ 262.619107][T10069] Tainted: [L]=SOFTLOCKUP [ 262.619113][T10069] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 262.619120][T10069] Call Trace: [ 262.619126][T10069] [ 262.619132][T10069] dump_stack_lvl+0x100/0x190 [ 262.619153][T10069] should_fail_ex.cold+0x5/0xa [ 262.619168][T10069] _copy_to_user+0x32/0xd0 [ 262.619183][T10069] simple_read_from_buffer+0xcb/0x170 [ 262.619197][T10069] proc_fail_nth_read+0x1af/0x230 [ 262.619216][T10069] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 262.619235][T10069] ? rw_verify_area+0xce/0x6d0 [ 262.619251][T10069] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 262.619269][T10069] vfs_read+0x1e4/0xb40 [ 262.619279][T10069] ? lock_acquire+0x1d1/0x380 [ 262.619294][T10069] ? __fget_files+0x34/0x3d0 [ 262.619305][T10069] ? __pfx_vfs_read+0x10/0x10 [ 262.619314][T10069] ? find_held_lock+0x2b/0x80 [ 262.619341][T10069] ? __fget_files+0x215/0x3d0 [ 262.619354][T10069] ? __fget_files+0x21f/0x3d0 [ 262.619369][T10069] ksys_read+0x12a/0x250 [ 262.619379][T10069] ? __pfx_ksys_read+0x10/0x10 [ 262.619393][T10069] do_int80_emulation+0x166/0x650 [ 262.619410][T10069] asm_int80_emulation+0x1a/0x20 [ 262.619422][T10069] RIP: 0023:0xf71475ab [ 262.619431][T10069] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 262.619442][T10069] RSP: 002b:00000000f53fd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 262.619454][T10069] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f53fd5d0 [ 262.619461][T10069] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 262.619468][T10069] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 262.619474][T10069] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 262.619480][T10069] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 262.619494][T10069] [ 262.733721][T10078] jffs2: notice: (10078) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 263.569796][T10100] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.570037][T10100] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.618007][T10104] FAULT_INJECTION: forcing a failure. [ 263.618007][T10104] name failslab, interval 1, probability 0, space 0, times 0 [ 263.618066][T10104] CPU: 2 UID: 0 PID: 10104 Comm: syz.1.1166 Tainted: G L syzkaller #0 PREEMPT(full) [ 263.618093][T10104] Tainted: [L]=SOFTLOCKUP [ 263.618098][T10104] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 263.618106][T10104] Call Trace: [ 263.618110][T10104] [ 263.618114][T10104] dump_stack_lvl+0x100/0x190 [ 263.618133][T10104] should_fail_ex.cold+0x5/0xa [ 263.618147][T10104] should_failslab+0xc2/0x120 [ 263.618162][T10104] kmem_cache_alloc_noprof+0x92/0x6a0 [ 263.618174][T10104] ? do_getname+0x35/0x390 [ 263.618191][T10104] do_getname+0x35/0x390 [ 263.618206][T10104] do_sys_openat2+0xc7/0x1e0 [ 263.618221][T10104] ? __pfx_do_sys_openat2+0x10/0x10 [ 263.618237][T10104] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 263.618254][T10104] __ia32_compat_sys_openat+0x12d/0x210 [ 263.618270][T10104] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 263.618285][T10104] ? fput+0x7c/0x100 [ 263.618297][T10104] ? ksys_write+0x1ac/0x250 [ 263.618308][T10104] ? __pfx_ksys_write+0x10/0x10 [ 263.618320][T10104] __do_fast_syscall_32+0x13a/0x8b0 [ 263.618335][T10104] ? lockdep_hardirqs_on+0x7d/0x110 [ 263.618349][T10104] do_fast_syscall_32+0x32/0x70 [ 263.618363][T10104] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 263.618378][T10104] RIP: 0023:0xf704efec [ 263.618390][T10104] Code: Unable to access opcode bytes at 0xf704efc2. [ 263.618395][T10104] RSP: 002b:00000000f543d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 263.618407][T10104] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000400 [ 263.618413][T10104] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 263.618420][T10104] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 263.618426][T10104] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 263.618432][T10104] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 263.618446][T10104] [ 263.668094][T10108] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1168'. [ 263.706296][T10106] sctp: [Deprecated]: syz.3.1167 (pid 10106) Use of int in maxseg socket option. [ 263.706296][T10106] Use struct sctp_assoc_value instead [ 263.867441][T10113] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 263.867506][T10113] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 263.867567][T10113] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 263.869247][T10113] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 263.873747][T10113] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 264.199419][T10119] syzkaller0: entered promiscuous mode [ 264.199469][T10119] syzkaller0: entered allmulticast mode [ 264.222317][T10119] TC_ACT_REPEAT abuse ? [ 264.316004][T10125] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 264.316372][T10125] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 264.358461][T10126] jffs2: notice: (10126) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 264.378256][T10128] overlayfs: workdir and upperdir must reside under the same mount [ 264.464791][T10130] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 264.465180][T10130] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 264.626153][T10134] overlayfs: workdir and upperdir must reside under the same mount [ 264.990674][T10147] syzkaller0: entered promiscuous mode [ 264.992882][T10147] syzkaller0: entered allmulticast mode [ 265.001313][T10147] FAULT_INJECTION: forcing a failure. [ 265.001313][T10147] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 265.001461][T10147] CPU: 0 UID: 0 PID: 10147 Comm: syz.3.1178 Tainted: G L syzkaller #0 PREEMPT(full) [ 265.001477][T10147] Tainted: [L]=SOFTLOCKUP [ 265.001481][T10147] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 265.001488][T10147] Call Trace: [ 265.001492][T10147] [ 265.001496][T10147] dump_stack_lvl+0x100/0x190 [ 265.001527][T10147] should_fail_ex.cold+0x5/0xa [ 265.001542][T10147] _copy_from_user+0x2e/0xd0 [ 265.001554][T10147] get_compat_msghdr+0xb3/0x480 [ 265.001570][T10147] ? __pfx_get_compat_msghdr+0x10/0x10 [ 265.001590][T10147] ___sys_sendmsg+0x1b6/0x1e0 [ 265.001608][T10147] ? __pfx____sys_sendmsg+0x10/0x10 [ 265.001631][T10147] ? find_held_lock+0x2b/0x80 [ 265.001652][T10147] __sys_sendmsg+0x160/0x210 [ 265.001665][T10147] ? __pfx___sys_sendmsg+0x10/0x10 [ 265.001684][T10147] __do_fast_syscall_32+0x13a/0x8b0 [ 265.001699][T10147] ? lockdep_hardirqs_on+0x7d/0x110 [ 265.001713][T10147] do_fast_syscall_32+0x32/0x70 [ 265.001728][T10147] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 265.001742][T10147] RIP: 0023:0xf700efec [ 265.001770][T10147] Code: Unable to access opcode bytes at 0xf700efc2. [ 265.001777][T10147] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 265.001788][T10147] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000080 [ 265.001795][T10147] RDX: 0000000000004005 RSI: 0000000000000000 RDI: 0000000000000000 [ 265.001801][T10147] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 265.001807][T10147] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 265.001813][T10147] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 265.001827][T10147] [ 265.530729][T10161] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 265.539398][T10161] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 265.604027][T10163] syzkaller0: entered promiscuous mode [ 265.604086][T10163] syzkaller0: entered allmulticast mode [ 266.372360][T10176] jffs2: notice: (10176) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 266.561321][T10181] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.561714][T10181] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 267.607435][T10210] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 267.618581][T10210] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 268.221837][T10212] netlink: 'syz.4.1199': attribute type 2 has an invalid length. [ 268.221925][T10212] netlink: 'syz.4.1199': attribute type 7 has an invalid length. [ 268.230261][T10212] Uý: entered promiscuous mode [ 268.265558][T10214] FAULT_INJECTION: forcing a failure. [ 268.265558][T10214] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 268.265632][T10214] CPU: 2 UID: 0 PID: 10214 Comm: syz.2.1198 Tainted: G L syzkaller #0 PREEMPT(full) [ 268.265661][T10214] Tainted: [L]=SOFTLOCKUP [ 268.265667][T10214] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 268.265673][T10214] Call Trace: [ 268.265677][T10214] [ 268.265683][T10214] dump_stack_lvl+0x100/0x190 [ 268.265702][T10214] should_fail_ex.cold+0x5/0xa [ 268.265718][T10214] _copy_from_user+0x2e/0xd0 [ 268.265731][T10214] get_compat_msghdr+0xb3/0x480 [ 268.265766][T10214] ? __pfx_get_compat_msghdr+0x10/0x10 [ 268.265784][T10214] ? _kstrtoull+0x144/0x200 [ 268.265798][T10214] ? __pfx__kstrtoull+0x10/0x10 [ 268.265813][T10214] ___sys_sendmsg+0x1b6/0x1e0 [ 268.265832][T10214] ? __pfx____sys_sendmsg+0x10/0x10 [ 268.265848][T10214] ? __lock_acquire+0x4c5/0x1ec0 [ 268.265868][T10214] ? __fget_files+0x34/0x3d0 [ 268.265890][T10214] __sys_sendmmsg+0x309/0x440 [ 268.265904][T10214] ? __pfx___sys_sendmmsg+0x10/0x10 [ 268.265916][T10214] ? find_held_lock+0x2b/0x80 [ 268.265931][T10214] ? __mutex_unlock_slowpath+0x35d/0x930 [ 268.265954][T10214] ? fput+0x7c/0x100 [ 268.265967][T10214] ? ksys_write+0x1ac/0x250 [ 268.265980][T10214] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 268.265996][T10214] ? lockdep_hardirqs_on+0x7d/0x110 [ 268.266012][T10214] __do_fast_syscall_32+0x13a/0x8b0 [ 268.266026][T10214] ? lockdep_hardirqs_on+0x7d/0x110 [ 268.266041][T10214] do_fast_syscall_32+0x32/0x70 [ 268.266056][T10214] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 268.266070][T10214] RIP: 0023:0xf70befec [ 268.266083][T10214] Code: Unable to access opcode bytes at 0xf70befc2. [ 268.266088][T10214] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 268.266102][T10214] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080008240 [ 268.266109][T10214] RDX: 0000000000000002 RSI: 0000000000040800 RDI: 0000000000000000 [ 268.266115][T10214] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 268.266122][T10214] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 268.266128][T10214] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 268.266142][T10214] [ 268.365522][T10222] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 268.366276][T10222] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.002081][T10235] FAULT_INJECTION: forcing a failure. [ 269.002081][T10235] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 269.002150][T10235] CPU: 1 UID: 0 PID: 10235 Comm: syz.3.1208 Tainted: G L syzkaller #0 PREEMPT(full) [ 269.002187][T10235] Tainted: [L]=SOFTLOCKUP [ 269.002192][T10235] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 269.002199][T10235] Call Trace: [ 269.002203][T10235] [ 269.002208][T10235] dump_stack_lvl+0x100/0x190 [ 269.002227][T10235] should_fail_ex.cold+0x5/0xa [ 269.002242][T10235] _copy_from_user+0x2e/0xd0 [ 269.002254][T10235] get_compat_msghdr+0xb3/0x480 [ 269.002270][T10235] ? __pfx_get_compat_msghdr+0x10/0x10 [ 269.002290][T10235] ___sys_sendmsg+0x1b6/0x1e0 [ 269.002307][T10235] ? __pfx____sys_sendmsg+0x10/0x10 [ 269.002330][T10235] ? find_held_lock+0x2b/0x80 [ 269.002350][T10235] __sys_sendmsg+0x160/0x210 [ 269.002363][T10235] ? __pfx___sys_sendmsg+0x10/0x10 [ 269.002380][T10235] ? __pfx_ksys_write+0x10/0x10 [ 269.002398][T10235] __do_fast_syscall_32+0x13a/0x8b0 [ 269.002412][T10235] ? lockdep_hardirqs_on+0x7d/0x110 [ 269.002427][T10235] do_fast_syscall_32+0x32/0x70 [ 269.002441][T10235] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 269.002456][T10235] RIP: 0023:0xf700efec [ 269.002468][T10235] Code: Unable to access opcode bytes at 0xf700efc2. [ 269.002473][T10235] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 269.002484][T10235] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000ac0 [ 269.002491][T10235] RDX: 0000000000001048 RSI: 0000000000000000 RDI: 0000000000000000 [ 269.002498][T10235] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 269.002504][T10235] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 269.002510][T10235] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 269.002524][T10235] [ 269.247459][T10244] tipc: Enabled bearer , priority 10 [ 269.352075][T10255] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 269.355798][T10255] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.573690][ T5744] Bluetooth: hci2: ISO packet for unknown connection handle 256 [ 270.103196][T10261] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 270.111843][T10261] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 270.188605][T10262] overlayfs: workdir and upperdir must reside under the same mount [ 270.593852][T10279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 270.594436][T10279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 270.637997][T10281] syzkaller0: entered promiscuous mode [ 270.638119][T10281] syzkaller0: entered allmulticast mode [ 270.816461][T10293] FAULT_INJECTION: forcing a failure. [ 270.816461][T10293] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 270.816554][T10293] CPU: 2 UID: 0 PID: 10293 Comm: syz.3.1222 Tainted: G L syzkaller #0 PREEMPT(full) [ 270.816593][T10293] Tainted: [L]=SOFTLOCKUP [ 270.816601][T10293] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 270.816612][T10293] Call Trace: [ 270.816619][T10293] [ 270.816627][T10293] dump_stack_lvl+0x100/0x190 [ 270.816655][T10293] should_fail_ex.cold+0x5/0xa [ 270.816679][T10293] _copy_from_user+0x2e/0xd0 [ 270.816700][T10293] get_compat_msghdr+0xb3/0x480 [ 270.816726][T10293] ? __pfx_get_compat_msghdr+0x10/0x10 [ 270.816760][T10293] ___sys_sendmsg+0x1b6/0x1e0 [ 270.816789][T10293] ? __pfx____sys_sendmsg+0x10/0x10 [ 270.816827][T10293] ? find_held_lock+0x2b/0x80 [ 270.816869][T10293] __sys_sendmsg+0x160/0x210 [ 270.816890][T10293] ? __pfx___sys_sendmsg+0x10/0x10 [ 270.816918][T10293] ? __pfx_ksys_write+0x10/0x10 [ 270.816940][T10293] __do_fast_syscall_32+0x13a/0x8b0 [ 270.816965][T10293] ? lockdep_hardirqs_on+0x7d/0x110 [ 270.816990][T10293] do_fast_syscall_32+0x32/0x70 [ 270.817014][T10293] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 270.817037][T10293] RIP: 0023:0xf700efec [ 270.817056][T10293] Code: Unable to access opcode bytes at 0xf700efc2. [ 270.817065][T10293] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 270.817083][T10293] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000ac0 [ 270.817095][T10293] RDX: 0000000000001048 RSI: 0000000000000000 RDI: 0000000000000000 [ 270.817105][T10293] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 270.817116][T10293] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 270.817127][T10293] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 270.817151][T10293] [ 270.881195][T10295] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 270.882032][T10295] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 270.901109][T10297] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 270.901321][T10297] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 270.968816][T10300] overlayfs: workdir and upperdir must reside under the same mount [ 271.009985][T10301] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 271.010220][T10301] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 271.010730][ T5890] wiimote 0005:057E:0306.0007: hidraw1: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 271.011285][T10301] FAULT_INJECTION: forcing a failure. [ 271.011285][T10301] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 271.011303][T10301] CPU: 0 UID: 0 PID: 10301 Comm: syz.4.1231 Tainted: G L syzkaller #0 PREEMPT(full) [ 271.011318][T10301] Tainted: [L]=SOFTLOCKUP [ 271.011322][T10301] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 271.011329][T10301] Call Trace: [ 271.011333][T10301] [ 271.011338][T10301] dump_stack_lvl+0x100/0x190 [ 271.011356][T10301] should_fail_ex.cold+0x5/0xa [ 271.011370][T10301] _copy_from_user+0x2e/0xd0 [ 271.011383][T10301] uhid_char_write+0x16d/0xfe0 [ 271.011400][T10301] vfs_write+0x2aa/0x1050 [ 271.011411][T10301] ? __pfx_uhid_char_write+0x10/0x10 [ 271.011425][T10301] ? lock_acquire+0x1d1/0x380 [ 271.011440][T10301] ? __fget_files+0x34/0x3d0 [ 271.011451][T10301] ? __pfx_vfs_write+0x10/0x10 [ 271.011460][T10301] ? find_held_lock+0x2b/0x80 [ 271.011471][T10301] ? __fget_files+0x215/0x3d0 [ 271.011486][T10301] ? __fget_files+0x215/0x3d0 [ 271.011500][T10301] ? __fget_files+0x21f/0x3d0 [ 271.011515][T10301] ksys_write+0x1f8/0x250 [ 271.011524][T10301] ? __pfx_ksys_write+0x10/0x10 [ 271.011534][T10301] ? ksys_write+0x1ac/0x250 [ 271.011544][T10301] ? __pfx_ksys_write+0x10/0x10 [ 271.011557][T10301] __do_fast_syscall_32+0x13a/0x8b0 [ 271.011571][T10301] ? lockdep_hardirqs_on+0x7d/0x110 [ 271.011586][T10301] do_fast_syscall_32+0x32/0x70 [ 271.011600][T10301] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 271.011614][T10301] RIP: 0023:0xf7f34fec [ 271.011628][T10301] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 271.011632][T10301] RSP: 002b:00000000f53d550c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 271.011643][T10301] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000080 [ 271.011650][T10301] RDX: 0000000000000009 RSI: 0000000000000000 RDI: 0000000000000000 [ 271.011656][T10301] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 271.011662][T10301] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 271.011668][T10301] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 271.011682][T10301] [ 271.013567][ T5890] wiimote 0005:057E:0306.0007: New device registered [ 271.444266][T10306] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1226'. [ 271.553226][T10313] tipc: Started in network mode [ 271.555359][T10313] tipc: Node identity , cluster identity 4711 [ 271.556520][T10313] tipc: Failed to obtain node identity [ 271.556547][T10313] tipc: Enabling of bearer rejected, failed to enable media [ 271.570339][T10311] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 271.570594][T10311] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 271.658178][T10318] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1230'. [ 271.659829][T10318] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1230'. [ 271.710983][T10320] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 271.714841][T10320] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 271.789409][T10324] overlayfs: workdir and upperdir must reside under the same mount [ 272.080952][ T5890] wiimote 0005:057E:0306.0007: detected device: Nintendo Wii Remote (Gen 1) [ 272.162133][ T5890] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0007/input/input8 [ 272.180275][ T5890] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0007/input/input9 [ 272.184921][ T5890] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0007/input/input7 [ 272.258075][T10338] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 272.259090][T10338] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 272.506196][T10341] qrtr: Invalid version 0 [ 272.508919][T10341] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1235'. [ 272.536103][T10341] jffs2: notice: (10341) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 272.584268][T10341] syzkaller1: entered promiscuous mode [ 272.584399][T10341] syzkaller1: entered allmulticast mode [ 272.645139][T10347] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 272.649861][T10347] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 272.651320][ T854] wiimote 0005:057E:0306.0008: hidraw2: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 272.651556][ T854] wiimote 0005:057E:0306.0008: New device registered [ 272.892434][ T908] wiimote 0005:057E:0306.0009: hidraw3: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 272.896503][ T908] wiimote 0005:057E:0306.0009: New device registered [ 273.041261][ T5744] Bluetooth: hci2: command 0x0c1a tx timeout [ 273.357437][T10361] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1240'. [ 273.363222][T10361] veth1_macvtap: left promiscuous mode [ 273.411744][T10362] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1240'. [ 273.596794][T10349] wiimote 0005:057E:0306.0009: Device removed [ 273.671943][ T5201] wiimote 0005:057E:0306.0008: detected device: Nintendo Wii Remote (Gen 1) [ 273.672442][ T5201] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 273.672463][ T5201] CPU: 2 UID: 0 PID: 5201 Comm: kworker/2:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 273.672490][ T5201] Tainted: [L]=SOFTLOCKUP [ 273.672497][ T5201] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 273.672510][ T5201] Workqueue: events wiimote_init_worker [ 273.672604][ T5201] Call Trace: [ 273.672631][ T5201] [ 273.672638][ T5201] dump_stack_lvl+0x100/0x190 [ 273.672665][ T5201] sysfs_warn_dup.cold+0x1c/0x28 [ 273.672695][ T5201] sysfs_do_create_link_sd+0x113/0x140 [ 273.672745][ T5201] sysfs_create_link+0x61/0xc0 [ 273.672773][ T5201] device_add+0x675/0x1970 [ 273.672804][ T5201] ? __pfx_device_add+0x10/0x10 [ 273.672829][ T5201] ? lockdep_init_map_type+0x5c/0x250 [ 273.672859][ T5201] ? __raw_spin_lock_init+0x3a/0x110 [ 273.672892][ T5201] __power_supply_register.part.0+0x9b5/0x1390 [ 273.672929][ T5201] ? __pfx___power_supply_register.part.0+0x10/0x10 [ 273.672961][ T5201] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 273.672989][ T5201] ? kasprintf+0xc7/0x100 [ 273.673011][ T5201] ? __pfx_kasprintf+0x10/0x10 [ 273.673035][ T5201] ? trace_kmalloc+0xeb/0x110 [ 273.673059][ T5201] ? __kasan_kmalloc+0xaa/0xb0 [ 273.673086][ T5201] power_supply_register+0xce/0x110 [ 273.673117][ T5201] wiimod_battery_probe+0x21e/0x370 [ 273.673147][ T5201] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 273.673174][ T5201] ? input_ff_create+0x256/0x310 [ 273.673194][ T5201] ? __pfx_wiimod_rumble_play+0x10/0x10 [ 273.673235][ T5201] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 273.673262][ T5201] wiimote_init_worker+0xd55/0x2730 [ 273.673296][ T5201] ? __pfx_wiimote_init_worker+0x10/0x10 [ 273.673321][ T5201] ? lock_acquire+0x1d1/0x380 [ 273.673347][ T5201] ? process_one_work+0xa2c/0x1b10 [ 273.673372][ T5201] ? process_one_work+0x906/0x1b10 [ 273.673396][ T5201] ? process_one_work+0x906/0x1b10 [ 273.673423][ T5201] process_one_work+0xac7/0x1b10 [ 273.673458][ T5201] ? __pfx_process_one_work+0x10/0x10 [ 273.673483][ T5201] ? lock_acquire+0x1d1/0x380 [ 273.673515][ T5201] ? __pfx_wiimote_init_worker+0x10/0x10 [ 273.673544][ T5201] worker_thread+0x5ef/0xe50 [ 273.673575][ T5201] ? __pfx_worker_thread+0x10/0x10 [ 273.673600][ T5201] ? kthread+0x13a/0x450 [ 273.673619][ T5201] ? __pfx_worker_thread+0x10/0x10 [ 273.673641][ T5201] kthread+0x373/0x450 [ 273.673661][ T5201] ? __pfx_kthread+0x10/0x10 [ 273.673684][ T5201] ret_from_fork+0x730/0xd60 [ 273.673714][ T5201] ? __pfx_ret_from_fork+0x10/0x10 [ 273.673780][ T5201] ? __switch_to+0x800/0x10f0 [ 273.673803][ T5201] ? __pfx_kthread+0x10/0x10 [ 273.673823][ T5201] ret_from_fork_asm+0x1a/0x30 [ 273.673850][ T5201] [ 273.676290][ T5201] wiimote 0005:057E:0306.0008: cannot register battery device [ 273.913893][ T908] wiimote 0005:057E:0306.0009: detected device: Nintendo Wii Remote (Gen 1) [ 273.914206][ T908] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 273.914220][ T908] CPU: 3 UID: 0 PID: 908 Comm: kworker/3:2 Tainted: G L syzkaller #0 PREEMPT(full) [ 273.914235][ T908] Tainted: [L]=SOFTLOCKUP [ 273.914239][ T908] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 273.914246][ T908] Workqueue: events wiimote_init_worker [ 273.914273][ T908] Call Trace: [ 273.914277][ T908] [ 273.914282][ T908] dump_stack_lvl+0x100/0x190 [ 273.914298][ T908] sysfs_warn_dup.cold+0x1c/0x28 [ 273.914314][ T908] sysfs_do_create_link_sd+0x113/0x140 [ 273.914328][ T908] sysfs_create_link+0x61/0xc0 [ 273.914340][ T908] device_add+0x675/0x1970 [ 273.914356][ T908] ? __pfx_device_add+0x10/0x10 [ 273.914371][ T908] ? lockdep_init_map_type+0x5c/0x250 [ 273.914387][ T908] ? __raw_spin_lock_init+0x3a/0x110 [ 273.914406][ T908] __power_supply_register.part.0+0x9b5/0x1390 [ 273.914430][ T908] ? __pfx___power_supply_register.part.0+0x10/0x10 [ 273.914460][ T908] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 273.914501][ T908] ? kasprintf+0xc7/0x100 [ 273.914523][ T908] ? __pfx_kasprintf+0x10/0x10 [ 273.914546][ T908] ? trace_kmalloc+0xeb/0x110 [ 273.914568][ T908] ? __kasan_kmalloc+0xaa/0xb0 [ 273.914584][ T908] power_supply_register+0xce/0x110 [ 273.914602][ T908] wiimod_battery_probe+0x21e/0x370 [ 273.914619][ T908] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 273.914641][ T908] ? input_ff_create+0x256/0x310 [ 273.914660][ T908] ? __pfx_wiimod_rumble_play+0x10/0x10 [ 273.914699][ T908] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 273.914724][ T908] wiimote_init_worker+0xd55/0x2730 [ 273.914756][ T908] ? __pfx_wiimote_init_worker+0x10/0x10 [ 273.914779][ T908] ? lock_acquire+0x1d1/0x380 [ 273.914802][ T908] ? process_one_work+0xa2c/0x1b10 [ 273.914827][ T908] ? process_one_work+0x906/0x1b10 [ 273.914850][ T908] ? process_one_work+0x906/0x1b10 [ 273.914876][ T908] process_one_work+0xac7/0x1b10 [ 273.914904][ T908] ? __pfx_process_one_work+0x10/0x10 [ 273.914918][ T908] ? lock_acquire+0x1d1/0x380 [ 273.914936][ T908] ? __pfx_wiimote_init_worker+0x10/0x10 [ 273.914952][ T908] worker_thread+0x5ef/0xe50 [ 273.914970][ T908] ? kthread+0x13a/0x450 [ 273.914981][ T908] ? __pfx_worker_thread+0x10/0x10 [ 273.914993][ T908] kthread+0x373/0x450 [ 273.915004][ T908] ? __pfx_kthread+0x10/0x10 [ 273.915016][ T908] ret_from_fork+0x730/0xd60 [ 273.915034][ T908] ? __pfx_ret_from_fork+0x10/0x10 [ 273.915052][ T908] ? __switch_to+0x800/0x10f0 [ 273.915066][ T908] ? __pfx_kthread+0x10/0x10 [ 273.915078][ T908] ret_from_fork_asm+0x1a/0x30 [ 273.915095][ T908] [ 273.917080][ T908] wiimote 0005:057E:0306.0009: cannot register battery device [ 273.924253][T10301] wiimote 0005:057E:0306.0007: Device removed [ 274.779393][T10379] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.780124][T10379] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.849503][T10380] overlayfs: workdir and upperdir must reside under the same mount [ 275.406807][T10384] tipc: Enabling of bearer rejected, already enabled [ 275.684778][T10347] wiimote 0005:057E:0306.0008: Device removed [ 276.396948][T10396] device-mapper: ioctl: only supply one of name or uuid, cmd(12) [ 278.679641][T10400] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 278.679889][T10400] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 279.556892][T10426] qrtr: Invalid version 0 [ 279.563935][T10426] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1251'. [ 279.570150][T10426] jffs2: notice: (10426) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 280.051204][T10452] jffs2: notice: (10452) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 280.257920][T10463] jffs2: notice: (10463) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 280.974190][T10471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 280.974665][T10471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 281.092103][T10475] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 281.092369][T10475] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 281.154409][T10476] overlayfs: failed to resolve './dev': -2 [ 281.178981][T10478] tipc: Started in network mode [ 281.179037][T10478] tipc: Node identity , cluster identity 4711 [ 281.179172][T10478] tipc: Failed to obtain node identity [ 281.179185][T10478] tipc: Enabling of bearer rejected, failed to enable media [ 281.364575][T10483] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1262'. [ 281.553453][T10486] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 281.667459][T10491] qrtr: Invalid version 0 [ 281.672469][T10491] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1266'. [ 281.678565][T10491] jffs2: notice: (10491) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 281.699767][T10491] syzkaller1: entered promiscuous mode [ 281.701589][T10491] syzkaller1: entered allmulticast mode [ 282.877302][T10513] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1271'. [ 283.056772][T10519] loop4: detected capacity change from 0 to 7 [ 283.067187][T10519] Dev loop4: unable to read RDB block 7 [ 283.069635][T10519] loop4: unable to read partition table [ 283.072189][T10519] loop4: partition table beyond EOD, truncated [ 283.074678][T10519] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 283.139425][T10521] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 283.140469][T10521] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 283.191982][T10523] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 283.192255][T10523] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 283.252839][T10523] overlayfs: workdir and upperdir must reside under the same mount [ 283.525573][T10526] qrtr: Invalid version 0 [ 283.529868][T10526] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1276'. [ 283.554219][T10526] jffs2: notice: (10526) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 283.610913][T10526] syzkaller1: entered promiscuous mode [ 283.611302][T10526] syzkaller1: entered allmulticast mode [ 283.853103][T10535] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1281'. [ 283.908701][T10534] bridge_slave_0: left allmulticast mode [ 283.908898][T10534] bridge_slave_0: left promiscuous mode [ 283.909001][T10534] bridge0: port 1(bridge_slave_0) entered disabled state [ 283.916459][T10534] bridge_slave_1: left allmulticast mode [ 283.916476][T10534] bridge_slave_1: left promiscuous mode [ 283.916572][T10534] bridge0: port 2(bridge_slave_1) entered disabled state [ 283.945335][T10534] bond0: (slave bond_slave_0): Releasing backup interface [ 283.977728][T10534] bond0: (slave bond_slave_1): Releasing backup interface [ 283.986545][T10543] trusted_key: syz.3.1282 sent an empty control message without MSG_MORE. [ 283.995061][T10534] team0: Port device team_slave_0 removed [ 284.001764][T10534] team0: Port device team_slave_1 removed [ 284.002301][T10534] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 284.002313][T10534] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 284.005041][T10534] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 284.005055][T10534] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 284.008204][T10534] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 284.028366][T10538] team0: Mode changed to "loadbalance" [ 284.029202][T10544] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1279'. [ 284.039794][T10544] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1279'. [ 284.278772][T10555] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 284.279009][T10555] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 284.283963][T10556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 284.284268][T10556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 284.336192][T10555] overlayfs: workdir and upperdir must reside under the same mount [ 284.611144][T10558] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 284.616105][T10558] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 284.940562][T10561] input: syz1 as /devices/virtual/input/input12 [ 284.946624][T10561] db_root: cannot open: ./my_ [ 284.946963][T10564] qrtr: Invalid version 0 [ 284.948101][T10564] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1289'. [ 284.954642][T10564] jffs2: notice: (10564) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 284.978083][T10564] syzkaller1: entered promiscuous mode [ 284.978135][T10564] syzkaller1: entered allmulticast mode [ 285.080971][T10568] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1292'. [ 285.110096][T10568] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1292'. [ 285.377452][T10585] team0: entered promiscuous mode [ 285.379196][T10585] team_slave_0: entered promiscuous mode [ 285.379327][T10585] team_slave_1: entered promiscuous mode [ 285.379556][T10585] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1298'. [ 285.387728][T10585] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 285.432790][T10587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 285.433166][T10587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 285.512961][T10590] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 285.514160][T10590] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 285.584150][T10591] overlayfs: workdir and upperdir must reside under the same mount [ 286.005768][T10596] qrtr: Invalid version 0 [ 286.007820][T10596] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1302'. [ 286.014182][T10596] jffs2: notice: (10596) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 286.034195][T10596] syzkaller1: entered promiscuous mode [ 286.036387][T10596] syzkaller1: entered allmulticast mode [ 286.287984][T10607] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 286.288473][T10607] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 286.292361][T10607] program syz.1.1306 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 286.338102][T10610] FAULT_INJECTION: forcing a failure. [ 286.338102][T10610] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 286.338220][T10610] CPU: 3 UID: 0 PID: 10610 Comm: syz.4.1305 Tainted: G L syzkaller #0 PREEMPT(full) [ 286.338253][T10610] Tainted: [L]=SOFTLOCKUP [ 286.338258][T10610] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 286.338265][T10610] Call Trace: [ 286.338303][T10610] [ 286.338308][T10610] dump_stack_lvl+0x100/0x190 [ 286.338363][T10610] should_fail_ex.cold+0x5/0xa [ 286.338377][T10610] _copy_from_user+0x2e/0xd0 [ 286.338409][T10610] sctp_setsockopt+0x8cc/0xb370 [ 286.338443][T10610] ? __pfx_sctp_setsockopt+0x10/0x10 [ 286.338456][T10610] ? aa_sock_opt_perm+0x114/0x1e0 [ 286.338468][T10610] ? sock_common_setsockopt+0x2e/0xf0 [ 286.338483][T10610] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 286.338499][T10610] do_sock_setsockopt+0xf3/0x1d0 [ 286.338515][T10610] __sys_setsockopt+0x119/0x190 [ 286.338529][T10610] __ia32_sys_setsockopt+0xbc/0x160 [ 286.338547][T10610] ? __do_fast_syscall_32+0xb3/0x8b0 [ 286.338592][T10610] ? lockdep_hardirqs_on+0x7d/0x110 [ 286.338611][T10610] __do_fast_syscall_32+0x13a/0x8b0 [ 286.338634][T10610] ? lockdep_hardirqs_on+0x7d/0x110 [ 286.338656][T10610] do_fast_syscall_32+0x32/0x70 [ 286.338678][T10610] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 286.338700][T10610] RIP: 0023:0xf7f34fec [ 286.338720][T10610] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 286.338754][T10610] RSP: 002b:00000000f53d550c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 286.338772][T10610] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000084 [ 286.338785][T10610] RDX: 0000000000000005 RSI: 0000000080000100 RDI: 0000000000000084 [ 286.338795][T10610] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 286.338803][T10610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 286.338811][T10610] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 286.338834][T10610] [ 286.759856][T10616] bond2: entered promiscuous mode [ 287.086285][T10640] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 287.086682][T10640] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 288.152467][T10668] qrtr: Invalid version 0 [ 288.153597][T10668] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1314'. [ 288.161799][T10664] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 288.162122][T10664] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 288.173624][T10665] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 288.176321][T10665] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 288.181066][T10668] jffs2: notice: (10668) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 288.213025][T10668] syzkaller1: entered promiscuous mode [ 288.213071][T10668] syzkaller1: entered allmulticast mode [ 288.224068][T10664] overlayfs: workdir and upperdir must reside under the same mount [ 288.246609][T10673] tipc: Enabling of bearer rejected, already enabled [ 288.248744][T10665] overlayfs: workdir and upperdir must reside under the same mount [ 288.934373][T10687] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 288.935830][T10687] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 289.039413][ T42] audit: type=1326 audit(1787984646.399:4030): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10685 comm="syz.2.1318" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 289.041610][ T42] audit: type=1326 audit(1787984646.409:4031): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10685 comm="syz.2.1318" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 289.043882][ T42] audit: type=1326 audit(1787984646.409:4032): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10685 comm="syz.2.1318" exe="/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf70befec code=0x7ffc0000 [ 289.048608][ T42] audit: type=1326 audit(1787984646.409:4033): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10685 comm="syz.2.1318" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf70befec code=0x7ffc0000 [ 289.049743][ T42] audit: type=1326 audit(1787984646.409:4034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10685 comm="syz.2.1318" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf70befec code=0x7ffc0000 [ 289.051358][ T42] audit: type=1326 audit(1787984646.419:4035): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10685 comm="syz.2.1318" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 289.054752][ T42] audit: type=1326 audit(1787984646.419:4036): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10685 comm="syz.2.1318" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 289.056732][ T42] audit: type=1326 audit(1787984646.419:4037): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10685 comm="syz.2.1318" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71f75ab code=0x7ffc0000 [ 289.057172][ T42] audit: type=1326 audit(1787984646.419:4038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10685 comm="syz.2.1318" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 289.057980][ T42] audit: type=1326 audit(1787984646.419:4039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10685 comm="syz.2.1318" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 289.287923][T10694] ip6erspan0: entered promiscuous mode [ 289.382205][T10697] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 289.382672][T10697] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 290.277368][T10714] tipc: Started in network mode [ 290.279258][T10714] tipc: Node identity 2000004, cluster identity 4711 [ 290.282064][T10714] tipc: Node number set to 33554436 [ 290.315985][T10712] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 290.316249][T10712] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 290.356456][T10717] tipc: Enabled bearer , priority 10 [ 290.391955][T10720] overlayfs: workdir and upperdir must reside under the same mount [ 290.666374][T10724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 290.685457][T10724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 290.723921][T10726] qrtr: Invalid version 0 [ 290.725966][T10726] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1330'. [ 290.740301][T10726] jffs2: notice: (10726) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 290.766456][T10726] syzkaller1: entered promiscuous mode [ 290.766497][T10726] syzkaller1: entered allmulticast mode [ 291.246912][T10733] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 291.247969][T10733] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 291.314838][T10735] overlayfs: workdir and upperdir must reside under the same mount [ 291.347640][T10731] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 291.444500][T10737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 291.445026][T10737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 291.478136][T10741] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 291.478446][T10741] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 291.506966][T10737] overlayfs: workdir and upperdir must reside under the same mount [ 291.643994][T10743] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 291.644635][T10743] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 291.749227][T10747] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 291.753717][T10747] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 292.078367][T10754] tipc: Started in network mode [ 292.078410][T10754] tipc: Node identity , cluster identity 4711 [ 292.078657][T10754] tipc: Failed to obtain node identity [ 292.078796][T10754] tipc: Enabling of bearer rejected, failed to enable media [ 292.201141][T10755] overlayfs: workdir and upperdir must reside under the same mount [ 293.191789][T10762] tipc: Enabled bearer , priority 10 [ 293.229590][T10764] qrtr: Invalid version 0 [ 293.231838][T10764] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1340'. [ 293.337023][T10768] jffs2: notice: (10768) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 293.760480][T10772] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 294.248459][T10784] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 294.248777][T10784] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 294.407065][T10791] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 294.407325][T10791] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 294.507278][T10795] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 294.507501][T10795] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 294.615115][T10799] overlayfs: workdir and upperdir must reside under the same mount [ 295.176743][T10817] tipc: Enabling of bearer rejected, already enabled [ 295.361032][T10825] tipc: Started in network mode [ 295.361064][T10825] tipc: Node identity , cluster identity 4711 [ 295.366253][T10825] tipc: Failed to obtain node identity [ 295.379595][T10825] tipc: Enabling of bearer rejected, failed to enable media [ 296.852201][T10838] qrtr: Invalid version 0 [ 296.854891][T10838] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1358'. [ 296.898176][T10838] jffs2: notice: (10838) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 296.932075][T10844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 296.932706][T10844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 297.026708][T10846] overlayfs: workdir and upperdir must reside under the same mount [ 297.071644][T10850] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 297.072011][T10850] misc raw-gadget: fail, usb_gadget_register_driver returned -16 qemu-system-x86_64: vtd_irte_get: detected non-present IRTE (index=15, high=0x0, low=0x0) [ 297.310142][T10856] ------------[ cut here ]------------ [ 297.310187][T10856] remove_proc_entry: removing non-empty directory 'irq/20', leaking at least 'pc212e' [ 297.310229][T10856] WARNING: fs/proc/generic.c:747 at remove_proc_entry+0x4e7/0x610, CPU#0: syz.4.1365/10856 [ 297.320112][T10856] Modules linked in: [ 297.322315][T10856] CPU: 0 UID: 0 PID: 10856 Comm: syz.4.1365 Tainted: G L syzkaller #0 PREEMPT(full) [ 297.327140][T10856] Tainted: [L]=SOFTLOCKUP [ 297.328471][T10856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 297.331774][T10856] RIP: 0010:remove_proc_entry+0x4f5/0x610 [ 297.334341][T10856] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 c7 00 00 00 48 8d 3d 99 4f 8b 0e 49 8b 95 d0 00 00 00 48 c7 c6 40 65 0b 8c <67> 48 0f b9 3a e9 2a fe ff ff e8 dc 21 4b ff 48 8d 7d 18 48 b8 00 [ 297.341016][T10856] RSP: 0018:ffffc90003c6f6a0 EFLAGS: 00010246 [ 297.343028][T10856] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffff88805156c85c [ 297.346125][T10856] RDX: ffff88801e6ccadc RSI: ffffffff8c0b6540 RDI: ffffffff914b60d0 [ 297.349004][T10856] RBP: ffff88805156c838 R08: ffff88805aca99dc R09: ffffed100a2ad8f3 [ 297.351858][T10856] R10: ffff88805156c79b R11: 0000000000000000 R12: ffff88805156c780 [ 297.354611][T10856] R13: ffff88801e6cca00 R14: ffff88805aca99b8 R15: dffffc0000000000 [ 297.357028][T10856] FS: 0000000000000000(0000) GS:ffff888096968000(0063) knlGS:00000000f50b4b40 [ 297.359884][T10856] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 297.362503][T10856] CR2: 00000000f50b3ff4 CR3: 000000007392b000 CR4: 0000000000352ef0 [ 297.366227][T10856] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 297.369975][T10856] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 297.373205][T10856] Call Trace: [ 297.374634][T10856] [ 297.375852][T10856] ? __pfx_remove_proc_entry+0x10/0x10 [ 297.377982][T10856] ? mtree_load+0x3a4/0xb50 [ 297.379615][T10856] ? __pfx_mtree_load+0x10/0x10 [ 297.381172][T10856] ? rcu_is_watching+0x13/0xc0 [ 297.382656][T10856] unregister_irq_proc+0x206/0x2a0 [ 297.384202][T10856] ? __pfx_unregister_irq_proc+0x10/0x10 [ 297.386167][T10856] free_desc+0x89/0x330 [ 297.387712][T10856] ? __pfx_free_desc+0x10/0x10 [ 297.389765][T10856] ? kasan_quarantine_put+0x104/0x240 [ 297.392699][T10856] ? lockdep_hardirqs_on+0x7d/0x110 [ 297.395078][T10856] ? irq_domain_free_irqs+0x370/0x5c0 [ 297.397291][T10856] irq_free_descs+0x84/0xc0 [ 297.399167][T10856] irq_domain_free_irqs+0x46a/0x5c0 [ 297.401303][T10856] mp_unmap_irq+0xf8/0x130 [ 297.403140][T10856] ? __pfx_acpi_unregister_gsi_ioapic+0x10/0x10 [ 297.405689][T10856] acpi_unregister_gsi_ioapic+0x40/0x60 [ 297.407920][T10856] acpi_unregister_gsi+0x25/0x40 [ 297.409971][T10856] acpi_pci_irq_disable+0x275/0x360 [ 297.412498][T10856] ? __pfx_acpi_pci_irq_disable+0x10/0x10 [ 297.415176][T10856] pcibios_disable_device+0x89/0xb0 [ 297.417638][T10856] do_pci_disable_device+0x9f/0x100 [ 297.419788][T10856] ? __pfx_do_pci_disable_device+0x10/0x10 [ 297.422519][T10856] pci_disable_device+0x130/0x270 [ 297.424545][T10856] pci_device_remove+0xb2/0x1d0 [ 297.426215][T10856] ? __pfx_pci_device_remove+0x10/0x10 [ 297.428123][T10856] device_remove+0xcb/0x180 [ 297.429707][T10856] device_release_driver_internal+0x44e/0x620 [ 297.431900][T10856] pci_stop_bus_device+0x120/0x160 [ 297.433740][T10856] pci_stop_and_remove_bus_device+0x58/0xa0 [ 297.436130][T10856] pci_stop_and_remove_bus_device_locked+0x1a/0x20 [ 297.438437][T10856] remove_store+0x123/0x140 [ 297.439970][T10856] ? __pfx_remove_store+0x10/0x10 [ 297.441675][T10856] ? find_held_lock+0x2b/0x80 [ 297.443266][T10856] ? sysfs_file_kobj+0xe4/0x290 [ 297.444848][T10856] ? sysfs_file_kobj+0xe4/0x290 [ 297.446427][T10856] ? __pfx_remove_store+0x10/0x10 [ 297.448105][T10856] dev_attr_store+0x58/0x80 [ 297.449629][T10856] ? __pfx_dev_attr_store+0x10/0x10 [ 297.451773][T10856] sysfs_kf_write+0xf2/0x150 [ 297.453453][T10856] kernfs_fop_write_iter+0x3e0/0x5f0 [ 297.455735][T10856] ? __pfx_sysfs_kf_write+0x10/0x10 [ 297.457735][T10856] vfs_write+0x6af/0x1050 [ 297.459113][T10856] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 297.461001][T10856] ? __pfx_vfs_write+0x10/0x10 [ 297.462478][T10856] ? find_held_lock+0x2b/0x80 [ 297.464001][T10856] ksys_write+0x12a/0x250 [ 297.465599][T10856] ? __pfx_ksys_write+0x10/0x10 [ 297.467417][T10856] __do_fast_syscall_32+0x13a/0x8b0 [ 297.469235][T10856] do_fast_syscall_32+0x32/0x70 [ 297.471320][T10856] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 297.474189][T10856] RIP: 0023:0xf7f34fec [ 297.476184][T10856] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 297.479841][T10856] RSP: 002b:00000000f50b450c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 297.483921][T10856] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 0000000080000400 [ 297.487072][T10856] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 297.490246][T10856] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 297.493310][T10856] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 297.496261][T10856] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 297.499368][T10856] [ 297.500485][T10856] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 297.502997][T10856] CPU: 0 UID: 0 PID: 10856 Comm: syz.4.1365 Tainted: G L syzkaller #0 PREEMPT(full) [ 297.506408][T10856] Tainted: [L]=SOFTLOCKUP [ 297.507806][T10856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 297.511300][T10856] Call Trace: [ 297.512702][T10856] [ 297.513806][T10856] dump_stack_lvl+0x100/0x190 [ 297.515639][T10856] vpanic+0x553/0x970 [ 297.517238][T10856] ? __pfx_vpanic+0x10/0x10 [ 297.518884][T10856] panic+0xd1/0xe0 [ 297.520202][T10856] ? __pfx_panic+0x10/0x10 [ 297.521736][T10856] check_panic_on_warn.cold+0x19/0x34 [ 297.523842][T10856] ? remove_proc_entry+0x4e7/0x610 [ 297.525887][T10856] __warn.cold+0x191/0x318 [ 297.527668][T10856] __report_bug+0x30f/0x440 [ 297.529471][T10856] ? remove_proc_entry+0x4e7/0x610 [ 297.531710][T10856] ? __pfx___report_bug+0x10/0x10 [ 297.533477][T10856] ? __do_fast_syscall_32+0x13a/0x8b0 [ 297.535317][T10856] ? do_raw_spin_lock+0x128/0x260 [ 297.537310][T10856] ? find_held_lock+0x2b/0x80 [ 297.538833][T10856] ? proc_entry_rundown+0x158/0x1e0 [ 297.540464][T10856] ? proc_entry_rundown+0x158/0x1e0 [ 297.542065][T10856] report_bug_entry+0xe2/0x290 [ 297.543617][T10856] ? remove_proc_entry+0x4f5/0x610 [ 297.545248][T10856] handle_bug+0x1cd/0x2a0 [ 297.546655][T10856] exc_invalid_op+0x17/0x50 [ 297.548552][T10856] asm_exc_invalid_op+0x1a/0x20 [ 297.550673][T10856] RIP: 0010:remove_proc_entry+0x4f5/0x610 [ 297.553078][T10856] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 c7 00 00 00 48 8d 3d 99 4f 8b 0e 49 8b 95 d0 00 00 00 48 c7 c6 40 65 0b 8c <67> 48 0f b9 3a e9 2a fe ff ff e8 dc 21 4b ff 48 8d 7d 18 48 b8 00 [ 297.560538][T10856] RSP: 0018:ffffc90003c6f6a0 EFLAGS: 00010246 [ 297.562503][T10856] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffff88805156c85c [ 297.565169][T10856] RDX: ffff88801e6ccadc RSI: ffffffff8c0b6540 RDI: ffffffff914b60d0 [ 297.568202][T10856] RBP: ffff88805156c838 R08: ffff88805aca99dc R09: ffffed100a2ad8f3 [ 297.571243][T10856] R10: ffff88805156c79b R11: 0000000000000000 R12: ffff88805156c780 [ 297.573592][T10856] R13: ffff88801e6cca00 R14: ffff88805aca99b8 R15: dffffc0000000000 [ 297.576417][T10856] ? __pfx_remove_proc_entry+0x10/0x10 [ 297.578691][T10856] ? mtree_load+0x3a4/0xb50 [ 297.580623][T10856] ? __pfx_mtree_load+0x10/0x10 [ 297.582562][T10856] ? rcu_is_watching+0x13/0xc0 [ 297.584452][T10856] unregister_irq_proc+0x206/0x2a0 [ 297.586372][T10856] ? __pfx_unregister_irq_proc+0x10/0x10 [ 297.588639][T10856] free_desc+0x89/0x330 [ 297.590312][T10856] ? __pfx_free_desc+0x10/0x10 [ 297.592330][T10856] ? kasan_quarantine_put+0x104/0x240 [ 297.594717][T10856] ? lockdep_hardirqs_on+0x7d/0x110 [ 297.596938][T10856] ? irq_domain_free_irqs+0x370/0x5c0 [ 297.598746][T10856] irq_free_descs+0x84/0xc0 [ 297.600153][T10856] irq_domain_free_irqs+0x46a/0x5c0 [ 297.601990][T10856] mp_unmap_irq+0xf8/0x130 [ 297.603516][T10856] ? __pfx_acpi_unregister_gsi_ioapic+0x10/0x10 [ 297.605984][T10856] acpi_unregister_gsi_ioapic+0x40/0x60 [ 297.608011][T10856] acpi_unregister_gsi+0x25/0x40 [ 297.609562][T10856] acpi_pci_irq_disable+0x275/0x360 [ 297.611378][T10856] ? __pfx_acpi_pci_irq_disable+0x10/0x10 [ 297.613508][T10856] pcibios_disable_device+0x89/0xb0 [ 297.615482][T10856] do_pci_disable_device+0x9f/0x100 [ 297.617651][T10856] ? __pfx_do_pci_disable_device+0x10/0x10 [ 297.619973][T10856] pci_disable_device+0x130/0x270 [ 297.622008][T10856] pci_device_remove+0xb2/0x1d0 [ 297.623971][T10856] ? __pfx_pci_device_remove+0x10/0x10 [ 297.626136][T10856] device_remove+0xcb/0x180 [ 297.628149][T10856] device_release_driver_internal+0x44e/0x620 [ 297.630764][T10856] pci_stop_bus_device+0x120/0x160 [ 297.632608][T10856] pci_stop_and_remove_bus_device+0x58/0xa0 [ 297.634513][T10856] pci_stop_and_remove_bus_device_locked+0x1a/0x20 [ 297.637051][T10856] remove_store+0x123/0x140 [ 297.638597][T10856] ? __pfx_remove_store+0x10/0x10 [ 297.640749][T10856] ? find_held_lock+0x2b/0x80 [ 297.642631][T10856] ? sysfs_file_kobj+0xe4/0x290 [ 297.644368][T10856] ? sysfs_file_kobj+0xe4/0x290 [ 297.646166][T10856] ? __pfx_remove_store+0x10/0x10 [ 297.648225][T10856] dev_attr_store+0x58/0x80 [ 297.650087][T10856] ? __pfx_dev_attr_store+0x10/0x10 [ 297.652279][T10856] sysfs_kf_write+0xf2/0x150 [ 297.653916][T10856] kernfs_fop_write_iter+0x3e0/0x5f0 [ 297.656005][T10856] ? __pfx_sysfs_kf_write+0x10/0x10 [ 297.658120][T10856] vfs_write+0x6af/0x1050 [ 297.659883][T10856] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 297.662147][T10856] ? __pfx_vfs_write+0x10/0x10 [ 297.663601][T10856] ? find_held_lock+0x2b/0x80 [ 297.665103][T10856] ksys_write+0x12a/0x250 [ 297.666470][T10856] ? __pfx_ksys_write+0x10/0x10 [ 297.667971][T10856] __do_fast_syscall_32+0x13a/0x8b0 [ 297.669823][T10856] do_fast_syscall_32+0x32/0x70 [ 297.671481][T10856] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 297.673645][T10856] RIP: 0023:0xf7f34fec [ 297.674985][T10856] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 297.677248][T10856] RSP: 002b:00000000f50b450c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 297.680039][T10856] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 0000000080000400 [ 297.682599][T10856] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 297.685157][T10856] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 297.688429][T10856] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 297.690991][T10856] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 297.693547][T10856] [ 297.695740][T10856] Kernel Offset: disabled [ 297.697540][T10856] Rebooting in 86400 seconds.. KVM: injection failed, MSI lost (Operation not permitted)