last executing test programs: 5m15.294898879s ago: executing program 1 (id=2541): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ppoll(&(0x7f0000000100)=[{r0, 0x4000}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r0, 0x40045402, &(0x7f0000000140)=0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000083c0)={{0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000080)={0x4, 0x29dc5, 0x0, 0x0, 0xd}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) 5m14.351192033s ago: executing program 1 (id=2553): userfaultfd(0x801) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b4000000000b00007910000000000000c3100009a1000000950074000000000031fb0d3a4231020004399d17d34e075fdcda533ab1aa71ab1d764152e6cb25dadc7ded5dbe11b62ac5ea9fca11027d19e93adb604a7d3deb92de3141e8ed7ac5b8902070213cdfdc5d6c4890cdeb50347c32060581172b94c6ba22a2b58eb6cbad46ed6e7965a2ba103b0b36f790bb41931f9a3d4dd127c1b4e49f7468f5e603950c4f67581c92ef8a7e8ece17d5f5b169391ef409c39c263895739e3d702c128b35d5fc23469240c61e150e2bae385f9ac9b03c22b0f7050c166b835298c5911f1053a723aee89051c24e1900ab97fa52d2e06dce0248a829ed46a520db4c1432080bbf707ad2f8af8118ee7d434a960ed6be4455ba57cb06459b64689e77ce95823a5533f5b11118906fd2fc29b3697c637d3693d4b4aade6f9202e6cfa6d7507f88af38b6109ad8f82b1d600a5447831df835d7000000218b0222004f98a7a0caddc397d8414be912b4e7536fefd951fe23a56fbf9fc643c6604268b5ccc13b996aaed0a6f6470566c8f534e5d486b2141646b35fd4472be8195fd917446a8abb1c2cd5dc09e2d75ec00ede2841e497d5178cf9445c7bb11f3c5cfdcae8c476d3fb75cac727143f92798a44864b49366b6cf228d9bc1d99ab2104e3c2e17ec46fbce102c158ff3748f1eb90b83d8be0dfcefbeed222009b41ad34d8656daf41e23322e58d91811feffc39ec11b11cc611f6fbfd999c3bef10caa2e8692259d40d69ed3d85ec2813b007b8ce6384a28798f445ad7fc451865fe45a06977f7a785f8e97544aad1f844f2a4799944e0daf6d4c3a7d30b7d89781ca607048c50945c45d5a6f2c5145416176fd64c559e6a272b92c92052a9005aaa25d09613aba2e7d429ae40c249e7996e4bc213c24699889ea320c40f32dcdaa19893e17c57d7e8c51d5f320d99e8c2521c339c33bf6c41fde029061c088"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='smaps_rollup\x00') r0 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') open_by_handle_at(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="10000000f1000000", @ANYRES8=r0], 0x0) 5m14.177564187s ago: executing program 1 (id=2557): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) read(r0, &(0x7f0000000840)=""/40, 0x28) 5m13.045201208s ago: executing program 1 (id=2569): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x93cd, 0x10000, 0x0, 0x4e}, &(0x7f0000000980)=0x0, &(0x7f0000000640)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 5m12.929669775s ago: executing program 1 (id=2572): setns(0xc9, 0x0) socket(0x2, 0x80805, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={r1, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) 5m11.792703268s ago: executing program 1 (id=2582): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x1c}}, 0x8800) r0 = landlock_create_ruleset(&(0x7f00000002c0)={0x120, 0xd, 0x1}, 0x30, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) landlock_restrict_self(r0, 0xe) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10) 5m11.522298278s ago: executing program 32 (id=2582): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x1c}}, 0x8800) r0 = landlock_create_ruleset(&(0x7f00000002c0)={0x120, 0xd, 0x1}, 0x30, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) landlock_restrict_self(r0, 0xe) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10) 3m54.291690286s ago: executing program 0 (id=3090): r0 = syz_open_procfs(0x0, &(0x7f0000000100)='map_files\x00') syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x90, 0x0, 0x0, {0x2, 0x7, 0x0, 0x6, 0x8, 0x4, {0x6, 0x8000, 0x100000000, 0x0, 0x203, 0x55d, 0xfffffffa, 0x0, 0x80010000, 0x2000, 0x1002, 0x0, 0x0, 0xb4f3, 0xe}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) fchdir(r0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB='-'], 0x27) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) 3m54.101006341s ago: executing program 0 (id=3093): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) write$cgroup_pid(r1, &(0x7f00000001c0), 0x12) 3m53.890938194s ago: executing program 0 (id=3095): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x111, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r1, 0x0, 0x0, 0x30, 0x0, @in={0x2, 0x4e24, @loopback}, @ib={0x1b, 0xfffe, 0x7fffffe, {"7d900600080000000900"}, 0x80000001, 0xfffffffffffffffe, 0x6}}}, 0x118) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x111, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r3, 0x0, 0x0, 0x30, 0x0, @in={0x2, 0x4e24, @loopback}, @ib={0x1b, 0xfffe, 0x7fffffe, {"7d900600080000000900"}, 0x80000001, 0xfffffffffffffffe, 0x6}}}, 0x118) 3m53.770335156s ago: executing program 0 (id=3096): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) io_uring_enter(r0, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) 3m53.60055463s ago: executing program 0 (id=3097): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='nfsd 127.0.0.1 2147483647 *\n\x00', 0x1c) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='* / 2147483647 0 0 0 0 fsloc 1 server1 /\n\x00', 0x29) 3m51.846306412s ago: executing program 0 (id=3109): sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010028bd7000fedbdf250900000028000280080002000200008008000100002000001400038008"], 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x24040021) r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000013000100000000000000000007000001", @ANYRES32=r2, @ANYBLOB="00000000000000001c001a8018000480140006"], 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x4004000) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xfff0) 3m51.741929992s ago: executing program 33 (id=3109): sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010028bd7000fedbdf250900000028000280080002000200008008000100002000001400038008"], 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x24040021) r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000013000100000000000000000007000001", @ANYRES32=r2, @ANYBLOB="00000000000000001c001a8018000480140006"], 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x4004000) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xfff0) 5.048053837s ago: executing program 5 (id=4903): r0 = socket$kcm(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='bond_slave_0\x00', 0x10) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @broadcast}, 0x10) r1 = socket$kcm(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='veth1\x00', 0x10) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x10) 4.898037791s ago: executing program 5 (id=4905): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$xdp(0x2c, 0x3, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x482, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x7, r0, 0x0}]) 4.432859944s ago: executing program 5 (id=4913): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r0, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random='\x00\x00\x00\x00\x00 '}) 4.189748474s ago: executing program 5 (id=4914): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x40) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0xf3a, 0x0) 3.866096213s ago: executing program 5 (id=4918): syz_ublk_setup_io_uring(0x800020, &(0x7f0000000040)={0x0, 0x6240, 0x2000}, 0x0, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xcf0b, 0x0, 0x3, 0x11}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0x8, 0x0, 0x0, 0x4, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x101, 0x11, 0x5, 0x0, 0x0) 1.709867981s ago: executing program 3 (id=4939): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4, 0x1ff, @ipv4={'\x00', '\xff\xff', @loopback}, 0x10}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) setsockopt$inet6_tcp_int(r0, 0x11a, 0x3, &(0x7f0000000000)=0x3f9, 0x4) 1.581810648s ago: executing program 3 (id=4941): r0 = timerfd_create(0x9, 0x80000) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x482, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x7, r1, 0x0}]) timerfd_settime(r0, 0x3, &(0x7f0000000240)={{}, {0x0, 0x989680}}, 0x0) 1.336915661s ago: executing program 4 (id=4944): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r0, &(0x7f0000000c40)=[{&(0x7f0000000080)="2e1221b23bb601c494d3df173e75963d86dd9d90491c3248320001dbb8910529cb572d4fa1f1eb5690", 0x29}, {&(0x7f0000000300)="0400000002e87fda30", 0x9}, {&(0x7f0000000180)="5d6d5a39fc44e10be7265c681a2064dc", 0x10}], 0x3) 1.216398646s ago: executing program 3 (id=4946): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xa, 0x3, 0x2, 0x3, 0x0, 0xffffffffffffffff, 0x3}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x6, 0x5}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x11, 0x15, &(0x7f0000000800)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1000009}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x61800, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2, r1}, 0xc) 1.077793638s ago: executing program 2 (id=4947): mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x1000003, 0x20031, 0xffffffffffffffff, 0xffffe000) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}, 0x1}) madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9) 866.113714ms ago: executing program 3 (id=4948): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 714.294645ms ago: executing program 2 (id=4949): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000500)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f0000000700)='nfsd 127.0.0.1 2147483647 127.0.0.1\n', 0x24) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000b00)='127.0.0.1 4 00000000 2147483647 /\n', 0x22) 709.224452ms ago: executing program 4 (id=4950): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05000000050000000200000007"], 0x50) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c000000ffbfffff01"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x2, r1}, 0x38) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xd, &(0x7f00000009c0)=ANY=[@ANYBLOB="180000000300000000000000eb40000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000400)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0x5a, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r2, r0}, 0xc) 709.000011ms ago: executing program 5 (id=4951): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000040)={0x17, 0xffffffff, 0x3ff, 0x1, 0xa, "9591c289333bef7d35119544ed641462d4304c"}) 645.466115ms ago: executing program 2 (id=4952): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x2}}, 0x20) r2 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x800a}}) io_uring_enter(r2, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f00000001c0)={0x18, 0x110, 0xfa00, {r1, 0x7fffffff, 0x12, 0x0, 0x0, @in={0x2, 0x4e20, @rand_addr=0x64010100}, @in6={0xa, 0x4e1f, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x80000001}}}, 0x118) 588.778566ms ago: executing program 4 (id=4953): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r2 = socket$packet(0x11, 0x3, 0x300) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xf, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000006000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000ebff00008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000040)=r3, 0x4) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000001c00)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000001b40)={0x14, 0x3, 0x6, 0x401, 0x0, 0x0, {0x1, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x40) 528.307797ms ago: executing program 3 (id=4954): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {}, {0x1, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x884}, 0x2) 405.599001ms ago: executing program 2 (id=4955): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x14985, 0x3, 0x3}, 0x18, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000003000)=@file={0x1, './file0\x00'}, 0x6e) landlock_restrict_self(r0, 0x1) connect$unix(r1, &(0x7f00000002c0)=@file={0x1, './file0\x00'}, 0x6e) 261.839749ms ago: executing program 4 (id=4956): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_pressure(r0, &(0x7f0000000040)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r1, &(0x7f0000000080)={'some', 0x20, 0x2000000008, 0x20, 0x10000000fffff}, 0x2f) r2 = openat$cgroup_pressure(r0, &(0x7f0000000140)='memory.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r2, &(0x7f0000000080)={'some', 0x20, 0x2000000008, 0x20, 0x10000000fffff}, 0x2f) 185.879007ms ago: executing program 2 (id=4957): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r1, &(0x7f0000000100), 0x12) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="840000001000010027bd700402d4df2500000000", @ANYRES32=r3, @ANYBLOB="94e40700100c000064001280110001006272696467655f736c617665000000004c000580080003"], 0x84}}, 0x200088c2) 79.970892ms ago: executing program 4 (id=4958): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) chdir(&(0x7f0000000000)='./proc/fs/nfsd\x00') r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x104) getdents(r0, &(0x7f00000000c0)=""/29, 0x1d) getdents(r0, 0x0, 0x58) 79.648735ms ago: executing program 3 (id=4959): add_key(0x0, 0x0, &(0x7f0000000200)='0', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1b2) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/cpu1/hotplug/target\x00', 0x1, 0x114) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)='1', 0x1) 149.638µs ago: executing program 2 (id=4960): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) 0s ago: executing program 4 (id=4961): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r0, 0xfffffffc) accept4$inet6(r0, 0x0, 0x0, 0x800) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x6, @ipv4={'\x00', '\xff\xff', @empty}, 0x4c}, 0x1c) kernel console output (not intermixed with test programs): ength: 249 > 1 [ 269.272991][ T5096] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 269.308833][ T5096] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 269.366418][T13613] netlink: 1319 bytes leftover after parsing attributes in process `syz.4.3114'. [ 269.366437][ T5096] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 269.390484][ T5096] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 270.268973][ T5833] bond2: left allmulticast mode [ 270.269077][ T5833] bond2: left promiscuous mode [ 270.269327][ T5833] bridge0: port 3(bond2) entered disabled state [ 270.288939][ T5833] bridge_slave_1: left allmulticast mode [ 270.289047][ T5833] bridge_slave_1: left promiscuous mode [ 270.289248][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state [ 270.307461][ T5833] bridge_slave_0: left allmulticast mode [ 270.307534][ T5833] bridge_slave_0: left promiscuous mode [ 270.327110][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state [ 270.346431][T13634] vhci_hcd vhci_hcd.0: Expecting SOCK_STREAM - found 3 [ 270.411083][ T5833] bridge0: left allmulticast mode [ 270.663650][ T43] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 270.867987][ T43] usb 9-1: Using ep0 maxpacket: 8 [ 270.869770][ T43] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 270.871604][ T43] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 270.871666][ T43] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 270.871708][ T43] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 270.871740][ T43] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 270.871770][ T43] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 270.871815][ T43] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.937889][ T64] Bluetooth: hci0: Malformed MSFT vendor event: 0x02 [ 271.092103][ T43] usb 9-1: usb_control_msg returned -32 [ 271.092212][ T43] usbtmc 9-1:16.0: can't read capabilities [ 271.231014][ T5833] bond3 (unregistering): (slave ipip0): Releasing backup interface [ 271.231112][ T5833] ipip0 (unregistering): left promiscuous mode [ 271.314363][ T43] usb 9-1: USB disconnect, device number 4 [ 271.375128][ T5833] bond1 (unregistering): (slave geneve2): Releasing active interface [ 271.456742][T13660] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3129'. [ 271.462916][ T1158] smbdirect: ib_dev[syz1] removed [ 271.482986][ T5833] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 271.614139][T13663] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3130'. [ 271.616015][T13663] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 271.616053][T13663] IPv6: NLM_F_CREATE should be set when creating new route [ 271.729021][ T64] Bluetooth: hci2: command tx timeout [ 271.809661][ T5833] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 271.948321][ T5833] bond0 (unregistering): (slave veth0_to_bond): Releasing backup interface [ 271.983625][ T5833] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 272.024922][ T5833] bond0 (unregistering): Released all slaves [ 272.030045][ T5833] bond1 (unregistering): Released all slaves [ 272.058405][ T5833] bond2 (unregistering): Released all slaves [ 272.068852][ T5833] bond3 (unregistering): Released all slaves [ 272.080317][ T5833] bond4 (unregistering): Released all slaves [ 272.183032][ T5453] 8021q: adding VLAN 0 to HW filter on device eth6 [ 272.366902][T13610] lo speed is unknown, defaulting to 1000 [ 272.545710][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 272.545973][ C3] bridge0: port 1(bridge_slave_0) entered learning state [ 272.963412][ T5453] 8021q: adding VLAN 0 to HW filter on device eth7 [ 273.468448][T13610] bridge0: port 1(bridge_slave_0) entered blocking state [ 273.468650][T13610] bridge0: port 1(bridge_slave_0) entered disabled state [ 273.468848][T13610] bridge_slave_0: entered allmulticast mode [ 273.470616][T13610] bridge_slave_0: entered promiscuous mode [ 273.473401][T13610] bridge0: port 2(bridge_slave_1) entered blocking state [ 273.473576][T13610] bridge0: port 2(bridge_slave_1) entered disabled state [ 273.473710][T13610] bridge_slave_1: entered allmulticast mode [ 273.474944][T13610] bridge_slave_1: entered promiscuous mode [ 273.555834][T13610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 273.574714][T13610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 273.840313][ T64] Bluetooth: hci2: command tx timeout [ 273.912083][T13610] team0: Port device team_slave_0 added [ 273.914926][T13610] team0: Port device team_slave_1 added [ 273.973129][T13610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 273.979754][T13610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 273.980212][T13610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 273.982369][T13610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 273.982609][T13610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 273.989120][T13610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 274.102267][T13610] hsr_slave_0: entered promiscuous mode [ 274.103122][T13610] hsr_slave_1: entered promiscuous mode [ 274.103920][T13610] debugfs: 'hsr0' already exists in 'hsr' [ 274.103941][T13610] Cannot create hsr debugfs directory [ 274.107195][ T5453] 8021q: adding VLAN 0 to HW filter on device eth8 [ 275.113795][T13741] ip6erspan0: entered allmulticast mode [ 275.527848][ T5096] Bluetooth: hci3: unexpected event for opcode 0x0c24 [ 275.891246][ T5096] Bluetooth: hci2: command tx timeout [ 276.484293][T13744] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 276.597959][ T5453] 8021q: adding VLAN 0 to HW filter on device eth9 [ 276.869637][ T5833] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 276.919081][T13775] 9p: Invalid gid '0x00000000ffffffff' [ 277.025662][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 277.057070][ T5833] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 277.252969][T13778] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 277.253530][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 277.291790][T13778] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 277.675721][ T5817] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 277.977475][ T5096] Bluetooth: hci2: command tx timeout [ 278.394981][ T5833] team0 (unregistering): Port device team_slave_1 removed [ 278.490744][ T5833] team0 (unregistering): Port device team_slave_0 removed [ 278.729177][T13789] loop5: detected capacity change from 0 to 7 [ 278.734947][T13789] Dev loop5: unable to read RDB block 7 [ 278.734986][T13789] loop5: unable to read partition table [ 278.735174][T13789] loop5: partition table beyond EOD, truncated [ 278.735236][T13789] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 279.427579][T13744] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.480142][T13778] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 279.483721][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 279.528194][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 279.533234][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 279.538783][T13778] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 279.846338][T13744] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.020979][T13610] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 280.090724][T13610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 280.107262][T13610] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 280.155029][T13610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 280.168432][T13610] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 280.207011][T13610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 280.207959][T13610] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 280.428035][T13610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 280.560858][T13744] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.970400][T13610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 281.091190][ T5833] IPVS: stop unused estimator thread 0... [ 281.147212][ T7554] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.168294][ T7554] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.227476][ T5816] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.227562][ T5816] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.240710][T13610] 8021q: adding VLAN 0 to HW filter on device team0 [ 281.288474][ T1158] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.288632][ T1158] bridge0: port 1(bridge_slave_0) entered forwarding state [ 281.290641][ T1158] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.290738][ T1158] bridge0: port 2(bridge_slave_1) entered forwarding state [ 281.344039][T13748] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 281.614326][T13610] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 281.728762][T13748] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.263767][ T44] audit: type=1326 audit(1787914956.116:177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13845 comm="syz.3.3183" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x7ffc0000 [ 282.263945][ T44] audit: type=1326 audit(1787914956.116:178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13845 comm="syz.3.3183" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x7ffc0000 [ 282.302658][T13748] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.515977][ T44] audit: type=1326 audit(1787914956.376:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13845 comm="syz.3.3183" exe="/syz-executor" sig=0 arch=40000003 syscall=26 compat=1 ip=0xf702efec code=0x7ffc0000 [ 282.516071][ T44] audit: type=1326 audit(1787914956.376:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13845 comm="syz.3.3183" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x7ffc0000 [ 282.516160][ T44] audit: type=1326 audit(1787914956.376:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13845 comm="syz.3.3183" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x7ffc0000 [ 282.518280][ T44] audit: type=1326 audit(1787914956.376:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13845 comm="syz.3.3183" exe="/syz-executor" sig=0 arch=40000003 syscall=26 compat=1 ip=0xf702efec code=0x7ffc0000 [ 282.518365][ T44] audit: type=1326 audit(1787914956.376:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13845 comm="syz.3.3183" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x7ffc0000 [ 282.519073][ T44] audit: type=1326 audit(1787914956.376:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13845 comm="syz.3.3183" exe="/syz-executor" sig=0 arch=40000003 syscall=26 compat=1 ip=0xf702efec code=0x7ffc0000 [ 282.519150][ T44] audit: type=1326 audit(1787914956.376:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13845 comm="syz.3.3183" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x7ffc0000 [ 282.520036][ T44] audit: type=1326 audit(1787914956.376:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13845 comm="syz.3.3183" exe="/syz-executor" sig=0 arch=40000003 syscall=26 compat=1 ip=0xf702efec code=0x7ffc0000 [ 282.996723][T13748] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.087468][T13610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 284.052779][T13610] veth0_vlan: entered promiscuous mode [ 284.085167][T13610] veth1_vlan: entered promiscuous mode [ 284.207853][T13610] veth0_macvtap: entered promiscuous mode [ 284.247415][T13610] veth1_macvtap: entered promiscuous mode [ 284.282900][T13610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 284.323713][T13610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 284.648427][ T7549] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 284.649264][ T7549] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 284.649340][ T7549] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 284.649388][ T7549] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 284.834192][ T1172] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 284.834246][ T1172] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 285.035742][ T1172] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 285.056518][ T1172] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 285.170497][T13898] 9p: Bad value for 'rfdno' [ 285.489572][T13912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 285.495679][T13912] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 286.279983][T13920] bridge0: port 3(batadv0) entered blocking state [ 286.280172][T13920] bridge0: port 3(batadv0) entered disabled state [ 286.280629][T13920] batadv0: entered allmulticast mode [ 286.286629][T13920] batadv0: entered promiscuous mode [ 286.287468][T13920] bridge0: port 3(batadv0) entered blocking state [ 286.287603][T13920] bridge0: port 3(batadv0) entered listening state [ 286.535846][ T7549] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.535939][ T7549] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.629119][ T12] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.645504][ T7549] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.736461][ T7549] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 286.736550][ T7549] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 287.261226][ T5817] net_ratelimit: 3 callbacks suppressed [ 287.261317][ T5817] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 287.848283][T13965] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3221'. [ 287.890727][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 287.890822][ C0] bridge0: topology change detected, propagating [ 287.898980][ C3] bridge0: port 1(bridge_slave_0) entered forwarding state [ 287.899007][ C3] bridge0: topology change detected, propagating [ 288.017239][T13971] binder: 13970:13971 ioctl c0306201 800001c0 returned -14 [ 289.022811][T13995] overlayfs: failed to clone lowerpath [ 290.646426][ T5849] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 290.837586][ T5849] usb 9-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 290.838898][ T5849] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 290.839234][ T5849] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.153027][ T5817] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 291.228434][ T5849] qmi_wwan 9-1:1.0: cdc-wdm0: USB WDM device [ 291.263897][ T5849] wwan wwan0: port wwan0qmi0 attached [ 291.375513][ T5817] usb 10-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 291.397194][ T5817] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 291.397273][ T5817] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 291.397550][ T5817] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 291.397701][ T5817] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.421957][ T5817] usb 10-1: config 0 descriptor?? [ 291.549275][ T5849] qmi_wwan 9-1:1.0 wwan0: register 'qmi_wwan' at usb-dummy_hcd.4-1, WWAN/QMI device, e6:41:bd:bf:69:a6 [ 291.654641][ T5826] usb 9-1: USB disconnect, device number 5 [ 291.691664][ T5826] qmi_wwan 9-1:1.0 wwan0: unregister 'qmi_wwan' usb-dummy_hcd.4-1, WWAN/QMI device [ 291.866659][ T5826] wwan wwan0: port wwan0qmi0 disconnected [ 291.946854][ T5817] plantronics 0003:047F:FFFF.000B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 293.091411][ C0] plantronics 0003:047F:FFFF.000B: usb_submit_urb(ctrl) failed: -1 [ 293.163418][ T5817] usb 10-1: USB disconnect, device number 2 [ 293.247211][ T64] Bluetooth: hci3: command 0x0406 tx timeout [ 296.222406][T13846] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.985185][T14122] syz.5.3273: page allocation failure: order:0, mode:0x144cca(GFP_HIGHUSER_MOVABLE|__GFP_RETRY_MAYFAIL|__GFP_COMP), nodemask=0,cpuset=/,mems_allowed=0-1 [ 296.985614][T14122] CPU: 1 UID: 0 PID: 14122 Comm: syz.5.3273 Tainted: G L syzkaller #0 PREEMPT(full) [ 296.985656][T14122] Tainted: [L]=SOFTLOCKUP [ 296.985664][T14122] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 296.985674][T14122] Call Trace: [ 296.985679][T14122] [ 296.985686][T14122] dump_stack_lvl+0x100/0x190 [ 296.985716][T14122] warn_alloc.cold+0x9e/0xb2 [ 296.985737][T14122] ? __pfx_warn_alloc+0x10/0x10 [ 296.985773][T14122] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 296.985800][T14122] ? __pfx_get_page_from_freelist+0x10/0x10 [ 296.985838][T14122] __alloc_frozen_pages_noprof+0xcb6/0x3300 [ 296.985884][T14122] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 296.985917][T14122] ? find_held_lock+0x2b/0x80 [ 296.985937][T14122] ? debug_check_no_obj_freed+0x31f/0x630 [ 296.985968][T14122] ? debug_check_no_obj_freed+0x31f/0x630 [ 296.985999][T14122] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 296.986023][T14122] ? cpuset_nodemask_valid_mems_allowed+0x5f/0x80 [ 296.986042][T14122] ? policy_nodemask+0xed/0x4f0 [ 296.986067][T14122] alloc_pages_mpol+0x201/0x550 [ 296.986091][T14122] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 296.986112][T14122] ? __free_frozen_pages+0x751/0x10f0 [ 296.986141][T14122] folio_alloc_mpol_noprof+0x36/0x260 [ 296.986171][T14122] alloc_migration_target_by_mpol+0x2c1/0x650 [ 296.986203][T14122] ? __pfx_alloc_migration_target_by_mpol+0x10/0x10 [ 296.986249][T14122] ? __pfx___might_resched+0x10/0x10 [ 296.986278][T14122] migrate_pages_batch+0x5c4/0x4680 [ 296.986306][T14122] ? check_slab_allocation+0xe0/0xf0 [ 296.986328][T14122] ? __pfx_alloc_migration_target_by_mpol+0x10/0x10 [ 296.986362][T14122] ? migrate_pages_sync+0x12c/0x880 [ 296.986389][T14122] ? migrate_pages_sync+0x588/0x880 [ 296.986420][T14122] ? __pfx_migrate_pages_batch+0x10/0x10 [ 296.986450][T14122] ? __pfx_migrate_pages_sync+0x10/0x10 [ 296.986486][T14122] migrate_pages+0x1950/0x2850 [ 296.986515][T14122] ? lock_acquire+0x1d1/0x380 [ 296.986539][T14122] ? current_cpuset_is_being_rebound+0x24/0x370 [ 296.986572][T14122] ? __pfx_alloc_migration_target_by_mpol+0x10/0x10 [ 296.986608][T14122] ? __pfx_migrate_pages+0x10/0x10 [ 296.986640][T14122] ? do_mbind+0x555/0xfd0 [ 296.986677][T14122] do_mbind+0x5a4/0xfd0 [ 296.986742][T14122] ? __pfx_do_mbind+0x10/0x10 [ 296.986772][T14122] ? madvise_unlock+0xa9/0x220 [ 296.986808][T14122] ? __pfx_get_nodes+0x10/0x10 [ 296.986837][T14122] kernel_mbind+0x1b7/0x200 [ 296.986868][T14122] ? __pfx_kernel_mbind+0x10/0x10 [ 296.986900][T14122] __do_fast_syscall_32+0x13a/0x8b0 [ 296.986927][T14122] do_fast_syscall_32+0x32/0x70 [ 296.986951][T14122] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 296.986975][T14122] RIP: 0023:0xf702efec [ 296.986999][T14122] Code: Unable to access opcode bytes at 0xf702efc2. [ 296.987008][T14122] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000112 [ 296.987027][T14122] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000600000 [ 296.987040][T14122] RDX: 0000000000000002 RSI: 0000000080000000 RDI: 0000000000000008 [ 296.987052][T14122] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 296.987064][T14122] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 296.987076][T14122] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 296.987101][T14122] [ 296.987125][T14122] Mem-Info: [ 296.987135][T14122] active_anon:14819 inactive_anon:17701 isolated_anon:12 [ 296.987135][T14122] active_file:13157 inactive_file:22963 isolated_file:0 [ 296.987135][T14122] unevictable:1000 dirty:192 writeback:0 [ 296.987135][T14122] slab_reclaimable:6322 slab_unreclaimable:56531 [ 296.987135][T14122] mapped:22946 shmem:24575 pagetables:1434 [ 296.987135][T14122] sec_pagetables:313 bounce:0 [ 296.987135][T14122] kernel_misc_reclaimable:0 [ 296.987135][T14122] free:33561 free_pcp:0 free_cma:0 [ 296.987184][T14122] Node 0 active_anon:44kB inactive_anon:32kB active_file:104kB inactive_file:220kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:0kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:9504kB pagetables:1368kB sec_pagetables:1136kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 296.987232][T14122] Node 0 DMA free:2864kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:16kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 296.987282][T14122] lowmem_reserve[]: 0 278 278 278 278 [ 296.987315][T14122] Node 0 DMA32 free:23496kB boost:18432kB min:31060kB low:34216kB high:37372kB reserved_highatomic:0kB free_highatomic:0kB active_anon:28kB inactive_anon:32kB active_file:104kB inactive_file:220kB unevictable:2000kB writepending:0kB zspages:676kB present:1032196kB managed:284760kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 296.987368][T14122] lowmem_reserve[]: 0 0 0 0 0 [ 296.987399][T14122] Node 0 DMA: 82*4kB (U) 17*8kB (U) 3*16kB (U) 20*32kB (U) 11*64kB (U) 2*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 2880kB [ 296.987538][T14122] Node 0 DMA32: 769*4kB (UME) 157*8kB (UME) 52*16kB (UM) 172*32kB (UME) 49*64kB (UME) 22*128kB (UME) 7*256kB (UME) 8*512kB (UM) 1*1024kB (M) 0*2048kB 0*4096kB = 23532kB [ 296.987677][T14122] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 296.987692][T14122] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 296.987707][T14122] 60894 total pagecache pages [ 296.987714][T14122] 202 pages in swap cache [ 296.987721][T14122] Free swap = 76772kB [ 296.987727][T14122] Total swap = 124996kB [ 296.987735][T14122] 524155 pages RAM [ 296.987741][T14122] 0 pages HighMem/MovableOnly [ 296.987747][T14122] 212073 pages reserved [ 296.987753][T14122] 0 pages cma reserved [ 297.284804][T14133] jffs2: notice: (14133) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (0 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 297.716792][ T5109] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 297.876511][ T5109] usb 10-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 297.877482][ T5109] usb 10-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 297.877510][ T5109] usb 10-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 297.877538][ T5109] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.911527][T14137] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 297.914563][ T5109] usb 10-1: Quirk or no altset; falling back to MIDI 1.0 [ 298.040057][T14143] 8021q: adding VLAN 0 to HW filter on device bond1 [ 298.041044][T14143] bridge0: port 3(bond1) entered blocking state [ 298.041252][T14143] bridge0: port 3(bond1) entered disabled state [ 298.041450][T14143] bond1: entered allmulticast mode [ 298.069897][T14143] bond1: entered promiscuous mode [ 298.115983][T14143] bridge0: port 3(bond1) entered blocking state [ 298.116164][T14143] bridge0: port 3(bond1) entered forwarding state [ 298.235976][ T582] bridge0: port 3(bond1) entered disabled state [ 298.438598][ T5109] usb 10-1: USB disconnect, device number 3 [ 299.684889][ T35] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 299.864268][ T35] usb 10-1: Using ep0 maxpacket: 8 [ 299.879476][ T35] usb 10-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 299.904440][ T35] usb 10-1: config 0 has an invalid interface number: 55 but max is 0 [ 299.919318][ T35] usb 10-1: config 0 has no interface number 0 [ 299.928140][ T35] usb 10-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 299.928170][ T35] usb 10-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 299.928190][ T35] usb 10-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 299.928211][ T35] usb 10-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 299.928244][ T35] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 299.946107][T14167] all (unregistering): Released all slaves [ 300.027320][ T35] usb 10-1: config 0 descriptor?? [ 300.104395][ T35] ldusb 10-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 300.623304][T14171] netlink: 'syz.2.3289': attribute type 10 has an invalid length. [ 300.837282][T14171] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 301.338982][ T1345] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 301.341645][ C3] bridge0: port 3(batadv0) entered learning state [ 301.506234][ T1345] usb 9-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 301.507984][ T1345] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 301.508031][ T1345] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 301.508051][ T1345] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 301.508072][ T1345] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 301.510488][ T1345] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 301.510510][ T1345] usb 9-1: Product: syz [ 301.510522][ T1345] usb 9-1: Manufacturer: syz [ 301.510533][ T1345] usb 9-1: SerialNumber: syz [ 301.556063][ T1345] usbserial_generic 9-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 301.556086][ T1345] usbserial_generic 9-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 301.556115][ T1345] usbserial_generic 9-1:1.0: generic converter detected [ 301.583587][ T1345] usb 9-1: generic converter now attached to ttyUSB0 [ 301.784654][ T1345] usb 9-1: USB disconnect, device number 6 [ 301.788974][ T1345] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 301.789709][ T1345] usbserial_generic 9-1:1.0: device disconnected [ 302.332241][ T5826] usb 10-1: USB disconnect, device number 4 [ 302.379798][ T5826] ldusb 10-1:0.55: LD USB Device #0 now disconnected [ 303.590373][T14199] jffs2: notice: (14199) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (0 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 303.625944][T14198] FAULT_INJECTION: forcing a failure. [ 303.625944][T14198] name failslab, interval 1, probability 0, space 0, times 0 [ 303.625986][T14198] CPU: 0 UID: 0 PID: 14198 Comm: syz.4.3299 Tainted: G L syzkaller #0 PREEMPT(full) [ 303.626014][T14198] Tainted: [L]=SOFTLOCKUP [ 303.626022][T14198] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 303.626035][T14198] Call Trace: [ 303.626043][T14198] [ 303.626053][T14198] dump_stack_lvl+0x100/0x190 [ 303.626088][T14198] should_fail_ex.cold+0x5/0xa [ 303.626115][T14198] should_failslab+0xc2/0x120 [ 303.626149][T14198] __kmalloc_cache_noprof+0x91/0x6d0 [ 303.626179][T14198] ? percpu_ref_init+0xec/0x3f0 [ 303.626234][T14198] ? __pfx_free_ioctx_users+0x10/0x10 [ 303.626259][T14198] percpu_ref_init+0xec/0x3f0 [ 303.626283][T14198] ? __init_waitqueue_head+0xca/0x150 [ 303.626316][T14198] ioctx_alloc+0x2f0/0x21a0 [ 303.626338][T14198] ? irqentry_exit+0x24d/0xa10 [ 303.626363][T14198] ? irqentry_exit+0x24d/0xa10 [ 303.626427][T14198] ? __pfx_ioctx_alloc+0x10/0x10 [ 303.626456][T14198] ? __might_fault+0x111/0x140 [ 303.626492][T14198] __ia32_compat_sys_io_setup+0xc8/0x220 [ 303.626523][T14198] __do_fast_syscall_32+0x13a/0x8b0 [ 303.626555][T14198] do_fast_syscall_32+0x32/0x70 [ 303.626582][T14198] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 303.626614][T14198] RIP: 0023:0xf7f75fec [ 303.626638][T14198] Code: Unable to access opcode bytes at 0xf7f75fc2. [ 303.626648][T14198] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 00000000000000f5 [ 303.626669][T14198] RAX: ffffffffffffffda RBX: 000000000000007f RCX: 0000000080001440 [ 303.626708][T14198] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 303.626719][T14198] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 303.626729][T14198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 303.626739][T14198] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 303.626759][T14198] [ 304.125775][T14212] block nbd4: Cannot add socket to a running device [ 304.876883][T14207] block nbd4: shutting down sockets [ 305.342095][T14220] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 305.607638][T14220] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 305.861883][T13846] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 305.917203][T14220] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.213156][T14220] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.502692][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 306.787420][ T7549] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.843427][ T5816] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.908682][ T5816] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.942141][ T5816] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 307.391189][ T43] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 307.641399][ T43] usb 9-1: New USB device found, idVendor=05e0, idProduct=0600, bcdDevice= 1.00 [ 307.643237][ T43] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 37, changing to 9 [ 307.643358][ T43] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 10008, setting to 1024 [ 307.645899][ T43] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.645951][ T43] usb 9-1: Product: syz [ 307.645983][ T43] usb 9-1: Manufacturer: syz [ 307.646013][ T43] usb 9-1: SerialNumber: syz [ 307.649249][T14245] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 307.703797][ T43] symbolserial 9-1:1.0: symbol converter detected [ 307.706337][ T43] usb 9-1: symbol converter now attached to ttyUSB0 [ 307.968221][ T43] usb 9-1: USB disconnect, device number 7 [ 307.986080][ T43] symbol ttyUSB0: symbol converter now disconnected from ttyUSB0 [ 307.986529][ T43] symbolserial 9-1:1.0: device disconnected [ 308.942953][ T44] kauditd_printk_skb: 1 callbacks suppressed [ 308.943071][ T44] audit: type=1326 audit(1787914982.786:188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14280 comm="syz.4.3332" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f75fec code=0x0 [ 309.696794][T14293] jffs2: notice: (14293) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (0 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 310.369979][T14312] can0: slcan on ptm0. [ 310.641849][T14311] can0 (unregistered): slcan off ptm0. [ 312.370398][T14359] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 312.490209][T14359] rtrs_client L2095: : Failed to resolve address, err: -ENODEV [ 312.490379][T14359] rtrs_client L2636: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 313.431737][T14380] jffs2: notice: (14380) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (0 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 313.579548][ T5849] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 313.766409][ T5849] usb 9-1: Using ep0 maxpacket: 8 [ 313.768566][ T5849] usb 9-1: New USB device found, idVendor=0d46, idProduct=2011, bcdDevice= 1.00 [ 313.769992][ T5849] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 313.770037][ T5849] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 313.770092][ T5849] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 313.790015][ T5849] kobil_sct 9-1:1.0: KOBIL USB smart card terminal converter detected [ 313.793594][ T5849] usb 9-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 314.678134][ T43] usb 9-1: USB disconnect, device number 8 [ 314.695194][ T43] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 314.695837][ T43] kobil_sct 9-1:1.0: device disconnected [ 314.857043][T14404] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 314.960907][ T582] IPVS: starting estimator thread 0... [ 315.052232][T14409] IPVS: using max 31 ests per chain, 74400 per kthread [ 315.752655][T14417] i2c i2c-0: delete_device: Can't find device in list [ 316.054238][ T5817] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 316.700680][ C3] bridge0: port 3(batadv0) entered forwarding state [ 316.700764][ C3] bridge0: topology change detected, propagating [ 316.702422][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 316.713637][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 316.714057][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.714215][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 319.840421][T14490] syzkaller1: entered promiscuous mode [ 319.840521][T14490] syzkaller1: entered allmulticast mode [ 320.126906][T14494] netlink: 'syz.2.3418': attribute type 1 has an invalid length. [ 320.215996][T14500] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3414'. [ 320.217635][T14500] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3414'. [ 320.856718][ T5096] Bluetooth: hci2: unexpected event 0x04 length: 11 > 10 [ 320.863550][ T5096] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:200' [ 320.863628][ T5096] CPU: 3 UID: 0 PID: 5096 Comm: kworker/u34:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 320.863677][ T5096] Tainted: [L]=SOFTLOCKUP [ 320.863685][ T5096] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 320.863700][ T5096] Workqueue: hci2 hci_rx_work [ 320.863736][ T5096] Call Trace: [ 320.863744][ T5096] [ 320.863754][ T5096] dump_stack_lvl+0x100/0x190 [ 320.863783][ T5096] sysfs_warn_dup.cold+0x1c/0x28 [ 320.863814][ T5096] sysfs_create_dir_ns+0x24b/0x2b0 [ 320.863835][ T5096] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 320.863856][ T5096] ? find_held_lock+0x2b/0x80 [ 320.863877][ T5096] ? kobject_add_internal+0x25f/0x930 [ 320.863902][ T5096] ? kobject_add_internal+0x25f/0x930 [ 320.863931][ T5096] ? do_raw_spin_unlock+0x145/0x1e0 [ 320.863962][ T5096] kobject_add_internal+0x2c8/0x930 [ 320.863993][ T5096] kobject_add+0x16a/0x1e0 [ 320.864018][ T5096] ? __pfx_kobject_add+0x10/0x10 [ 320.864044][ T5096] ? class_to_subsys+0x10f/0x150 [ 320.864073][ T5096] ? kobject_put+0xb9/0x640 [ 320.864095][ T5096] ? _raw_spin_unlock+0x28/0x50 [ 320.864120][ T5096] device_add+0x294/0x1970 [ 320.864144][ T5096] ? __pfx_dev_set_name+0x10/0x10 [ 320.864172][ T5096] ? __pfx_device_add+0x10/0x10 [ 320.864194][ T5096] ? find_held_lock+0x2b/0x80 [ 320.864214][ T5096] ? hci_find_link_key+0x1a4/0x3c0 [ 320.864236][ T5096] ? hci_find_link_key+0x1a4/0x3c0 [ 320.864272][ T5096] hci_conn_add_sysfs+0x1a3/0x260 [ 320.864299][ T5096] hci_conn_complete_evt+0x5bb/0x13f0 [ 320.864335][ T5096] ? __pfx_hci_conn_complete_evt+0x10/0x10 [ 320.864367][ T5096] ? __skb_clone+0x570/0x760 [ 320.864397][ T5096] ? skb_pull_data+0x15f/0x1e0 [ 320.864425][ T5096] hci_event_packet+0x8e9/0xcd0 [ 320.864458][ T5096] ? __pfx_hci_conn_complete_evt+0x10/0x10 [ 320.864488][ T5096] ? __pfx_hci_event_packet+0x10/0x10 [ 320.864523][ T5096] ? lockdep_hardirqs_on+0x7d/0x110 [ 320.864550][ T5096] hci_rx_work+0x451/0xfc0 [ 320.864585][ T5096] process_one_work+0xac7/0x1b10 [ 320.864621][ T5096] ? __pfx_process_one_work+0x10/0x10 [ 320.864645][ T5096] ? lock_acquire+0x1d1/0x380 [ 320.864676][ T5096] ? __pfx_hci_rx_work+0x10/0x10 [ 320.864710][ T5096] worker_thread+0x5ef/0xe50 [ 320.864741][ T5096] ? __pfx_worker_thread+0x10/0x10 [ 320.864764][ T5096] ? kthread+0x13a/0x450 [ 320.864782][ T5096] ? __pfx_worker_thread+0x10/0x10 [ 320.864803][ T5096] kthread+0x373/0x450 [ 320.864821][ T5096] ? __pfx_kthread+0x10/0x10 [ 320.864843][ T5096] ret_from_fork+0x730/0xd60 [ 320.864872][ T5096] ? __pfx_ret_from_fork+0x10/0x10 [ 320.864903][ T5096] ? __switch_to+0x800/0x10f0 [ 320.864928][ T5096] ? __pfx_kthread+0x10/0x10 [ 320.864950][ T5096] ret_from_fork_asm+0x1a/0x30 [ 320.864994][ T5096] [ 320.865036][ T5096] kobject: kobject_add_internal failed for hci2:200 with -EEXIST, don't try to register things with the same name in the same directory. [ 320.865086][ T5096] Bluetooth: hci2: failed to register connection device [ 321.034974][ T64] Bluetooth: hci2: command tx timeout [ 321.265569][T14520] pim6reg: entered allmulticast mode [ 321.281368][T14520] pim6reg: left allmulticast mode [ 321.281415][T14519] FAULT_INJECTION: forcing a failure. [ 321.281415][T14519] name failslab, interval 1, probability 0, space 0, times 0 [ 321.281460][T14519] CPU: 2 UID: 0 PID: 14519 Comm: syz.3.3429 Tainted: G L syzkaller #0 PREEMPT(full) [ 321.281500][T14519] Tainted: [L]=SOFTLOCKUP [ 321.281507][T14519] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 321.281516][T14519] Call Trace: [ 321.281522][T14519] [ 321.281528][T14519] dump_stack_lvl+0x100/0x190 [ 321.281555][T14519] should_fail_ex.cold+0x5/0xa [ 321.281578][T14519] should_failslab+0xc2/0x120 [ 321.281597][T14519] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 321.281613][T14519] ? tcp_assign_congestion_control+0x18c/0x860 [ 321.281639][T14519] ? __d_alloc+0x35/0xa50 [ 321.281660][T14519] __d_alloc+0x35/0xa50 [ 321.281684][T14519] d_alloc_pseudo+0x1c/0xc0 [ 321.281707][T14519] alloc_file_pseudo+0x118/0x290 [ 321.281726][T14519] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 321.281744][T14519] ? alloc_fd+0x471/0x7a0 [ 321.281769][T14519] sock_alloc_file+0x50/0x210 [ 321.281788][T14519] __sys_socket+0x1c0/0x260 [ 321.281814][T14519] ? xfd_validate_state+0x129/0x190 [ 321.281842][T14519] ? __pfx___sys_socket+0x10/0x10 [ 321.281876][T14519] __ia32_sys_socket+0x72/0xb0 [ 321.281903][T14519] ? lockdep_hardirqs_on+0x7d/0x110 [ 321.281926][T14519] __do_fast_syscall_32+0x13a/0x8b0 [ 321.281954][T14519] do_fast_syscall_32+0x32/0x70 [ 321.281978][T14519] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 321.282001][T14519] RIP: 0023:0xf702efec [ 321.282021][T14519] Code: Unable to access opcode bytes at 0xf702efc2. [ 321.282028][T14519] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 321.282045][T14519] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000000001 [ 321.282055][T14519] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 321.282064][T14519] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 321.282075][T14519] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 321.282104][T14519] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 321.282123][T14519] [ 321.954837][ T9] libceph: connect (2)127.0.0.1:6789 error -101 [ 321.960271][ T9] libceph: ceph_tcp_connect failed: -101 [ 321.960330][ T9] libceph: mon0 (2)127.0.0.1:6789 connect error [ 321.993311][T14529] netlink: 'syz.2.3423': attribute type 14 has an invalid length. [ 321.993336][T14529] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3423'. [ 322.047354][T14530] netlink: 'syz.2.3423': attribute type 14 has an invalid length. [ 322.047409][T14530] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3423'. [ 322.199826][T14532] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3425'. [ 322.224888][ T9] libceph: connect (2)127.0.0.1:6789 error -101 [ 322.225010][ T9] libceph: ceph_tcp_connect failed: -101 [ 322.225020][ T9] libceph: mon0 (2)127.0.0.1:6789 connect error [ 322.616038][T14544] overlayfs: failed to clone lowerpath [ 322.709087][T14524] ceph: No mds server is up or the cluster is laggy [ 322.722577][ T9] libceph: connect (2)127.0.0.1:6789 error -101 [ 322.726052][ T9] libceph: ceph_tcp_connect failed: -101 [ 322.736848][ T9] libceph: mon0 (2)127.0.0.1:6789 connect error [ 323.111820][ T64] Bluetooth: hci2: command tx timeout [ 323.212702][T14555] FAULT_INJECTION: forcing a failure. [ 323.212702][T14555] name failslab, interval 1, probability 0, space 0, times 0 [ 323.212762][T14555] CPU: 1 UID: 0 PID: 14555 Comm: syz.4.3432 Tainted: G L syzkaller #0 PREEMPT(full) [ 323.212800][T14555] Tainted: [L]=SOFTLOCKUP [ 323.212806][T14555] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 323.212816][T14555] Call Trace: [ 323.212822][T14555] [ 323.212829][T14555] dump_stack_lvl+0x100/0x190 [ 323.212858][T14555] should_fail_ex.cold+0x5/0xa [ 323.212879][T14555] should_failslab+0xc2/0x120 [ 323.212903][T14555] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 323.212923][T14555] ? __d_alloc+0x35/0xa50 [ 323.212946][T14555] __d_alloc+0x35/0xa50 [ 323.212966][T14555] d_alloc_pseudo+0x1c/0xc0 [ 323.212989][T14555] alloc_file_pseudo+0x118/0x290 [ 323.213012][T14555] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 323.213035][T14555] ? hugetlbfs_get_inode+0x3f5/0x700 [ 323.213063][T14555] hugetlb_file_setup+0x2a8/0x5b0 [ 323.213089][T14555] ksys_mmap_pgoff+0x242/0x610 [ 323.213110][T14555] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 323.213135][T14555] __do_fast_syscall_32+0x13a/0x8b0 [ 323.213159][T14555] do_fast_syscall_32+0x32/0x70 [ 323.213179][T14555] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 323.213199][T14555] RIP: 0023:0xf7f75fec [ 323.213217][T14555] Code: Unable to access opcode bytes at 0xf7f75fc2. [ 323.213225][T14555] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 00000000000000c0 [ 323.213246][T14555] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000ff5000 [ 323.213257][T14555] RDX: 0000000000000001 RSI: 000000000005c832 RDI: 00000000ffffffff [ 323.213266][T14555] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 323.213276][T14555] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 323.213286][T14555] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 323.213309][T14555] [ 323.286983][ T9] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 323.417027][T14558] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3435'. [ 323.472846][ T9] usb 10-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 323.473791][ T9] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 323.473819][ T9] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 323.473837][ T9] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 323.473871][ T9] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.500430][ T9] usb 10-1: config 0 descriptor?? [ 323.783897][T14561] pim6reg1: entered promiscuous mode [ 323.784058][T14561] pim6reg1: entered allmulticast mode [ 323.888926][T14564] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 324.005378][ T9] plantronics 0003:047F:FFFF.000C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 324.102756][T14565] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 324.128089][T14565] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 324.263156][T14574] netlink: 'syz.3.3443': attribute type 4 has an invalid length. [ 324.293901][ T5849] lo speed is unknown, defaulting to 1000 [ 324.295543][ T5849] syz_device_name_32_chars_1234567: Port: 1 Link DOWN [ 325.175428][ T64] Bluetooth: hci2: command tx timeout [ 325.538290][T14587] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3449'. [ 325.946625][T14599] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 325.947032][T14599] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 326.147375][ T77] usb 10-1: USB disconnect, device number 5 [ 326.293091][ T5817] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 327.248272][ T64] Bluetooth: hci2: command tx timeout [ 327.924039][T14631] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3464'. [ 328.108924][T14636] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3466'. [ 328.489396][T14644] db_root: cannot open: /dev/sequencer2 [ 328.489445][T14644] db_root: not a directory: /dev/sequencer2 [ 328.628213][T14648] veth0_vlan: left promiscuous mode [ 328.634519][T14648] veth0_vlan: entered promiscuous mode [ 328.836770][T14648] 8021q: adding VLAN 0 to HW filter on device bond2 [ 328.837882][T14648] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 328.864361][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 328.896731][ T582] bridge0: port 1(bridge_slave_0) entered blocking state [ 328.896842][ T582] bridge0: port 1(bridge_slave_0) entered forwarding state [ 329.271760][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 330.046454][T14677] jffs2: notice: (14677) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (0 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 330.983910][T14702] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 330.987030][T14702] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 331.410237][ T5826] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 331.587763][ T5826] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 331.612989][ T5826] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 331.627393][ T43] usb 10-1: new full-speed USB device number 6 using dummy_hcd [ 331.643791][ T5826] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 331.643861][ T5826] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 331.687906][ T5826] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 331.687968][ T5826] usb 9-1: Product: syz [ 331.688038][ T5826] usb 9-1: Manufacturer: syz [ 331.688075][ T5826] usb 9-1: SerialNumber: syz [ 331.796628][ T43] usb 10-1: not running at top speed; connect to a high speed hub [ 331.796703][ T43] usb 10-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 331.797785][ T43] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 331.797840][ T43] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.828121][ T43] keyspan 10-1:1.0: Keyspan 2 port adapter converter detected [ 331.828331][ T43] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 81 [ 331.828503][ T43] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 1 [ 331.830497][ T43] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 84 [ 331.830591][ T43] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 2 [ 331.850879][ T43] usb 10-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 331.852293][ T43] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 88 [ 331.852362][ T43] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 6 [ 331.853992][ T43] usb 10-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 332.002468][ T5826] usblp 9-1:1.0: usblp0: USB Unidirectional printer dev 9 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 332.519247][ T5825] usb 10-1: USB disconnect, device number 6 [ 332.538942][ T5825] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 332.554486][ T5825] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 332.555158][ T5825] keyspan 10-1:1.0: device disconnected [ 332.637699][T14726] netlink: 'syz.2.3499': attribute type 4 has an invalid length. [ 332.741152][ T5109] usb 9-1: USB disconnect, device number 9 [ 332.793517][ T5109] usblp0: removed [ 333.108080][T14741] jffs2: notice: (14741) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (0 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 333.145755][T14744] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3504'. [ 334.485689][ T5109] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 334.648379][T14787] hsr0: entered promiscuous mode [ 334.666803][ T5109] usb 9-1: Using ep0 maxpacket: 32 [ 334.670991][ T5109] usb 9-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 334.672005][ T5109] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 334.672052][ T5109] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 334.672104][ T5109] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 334.674665][ T5109] usb 9-1: config 0 descriptor?? [ 334.686619][T14787] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3522'. [ 334.713748][T14787] hsr_slave_0: left promiscuous mode [ 334.755368][T14787] hsr_slave_1: left promiscuous mode [ 334.772791][T14787] hsr0 (unregistering): left promiscuous mode [ 335.198961][ T5109] savu 0003:1E7D:2D5A.000D: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.4-1/input0 [ 335.462108][ T5825] usb 9-1: USB disconnect, device number 10 [ 337.546112][T14849] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3546'. [ 337.599896][T14851] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3544'. [ 338.541856][T14868] team0 (unregistering): Port device team_slave_0 removed [ 338.629137][T14868] team0 (unregistering): Port device team_slave_1 removed [ 338.761489][T14868] team0 (unregistering): Port device dummy0 removed [ 338.939328][T14882] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3557'. [ 339.385592][ T5826] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 339.554856][ T5826] usb 9-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 339.570209][ T5826] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 339.579037][ T5826] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.593551][ T5826] usb 9-1: Product: syz [ 339.596600][ T5826] usb 9-1: Manufacturer: syz [ 339.615590][ T5826] usb 9-1: SerialNumber: syz [ 339.906311][ T5826] usb 9-1: USB disconnect, device number 11 [ 340.131913][T14906] binder: 14905:14906 ioctl c0306201 800001c0 returned -14 [ 340.596026][ T43] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 340.787736][ T43] usb 10-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 340.792799][ T43] usb 10-1: config 0 has an invalid interface number: 50 but max is 0 [ 340.792827][ T43] usb 10-1: config 0 has no interface number 0 [ 340.792860][ T43] usb 10-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 340.794891][ T43] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.794911][ T43] usb 10-1: Product: syz [ 340.794924][ T43] usb 10-1: Manufacturer: syz [ 340.794935][ T43] usb 10-1: SerialNumber: syz [ 340.797116][ T43] usb 10-1: config 0 descriptor?? [ 340.824089][ T43] yurex 10-1:0.50: USB YUREX device now attached to Yurex #0 [ 341.060194][T13846] usb 10-1: USB disconnect, device number 7 [ 341.062758][T13846] yurex 10-1:0.50: USB YUREX #0 now disconnected [ 341.927761][T14934] lo: entered allmulticast mode [ 341.934397][T14933] lo: left allmulticast mode [ 342.698617][T14961] CIFS: Attempting to mount //127.0.0.1/share [ 342.699140][T14961] CIFS: VFS: Error connecting to socket. Aborting operation. [ 342.699550][T14961] CIFS: VFS: cifs_mount failed w/return code = -101 [ 342.924414][T14968] FAULT_INJECTION: forcing a failure. [ 342.924414][T14968] name failslab, interval 1, probability 0, space 0, times 0 [ 342.924500][T14968] CPU: 0 UID: 0 PID: 14968 Comm: syz.3.3595 Tainted: G L syzkaller #0 PREEMPT(full) [ 342.924542][T14968] Tainted: [L]=SOFTLOCKUP [ 342.924550][T14968] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 342.924562][T14968] Call Trace: [ 342.924570][T14968] [ 342.924578][T14968] dump_stack_lvl+0x100/0x190 [ 342.924611][T14968] should_fail_ex.cold+0x5/0xa [ 342.924638][T14968] should_failslab+0xc2/0x120 [ 342.924664][T14968] kmem_cache_alloc_noprof+0x92/0x6a0 [ 342.924685][T14968] ? __pfx___thp_vma_allowable_orders+0x10/0x10 [ 342.924715][T14968] ? __khugepaged_enter+0x92/0x3a0 [ 342.924749][T14968] __khugepaged_enter+0x92/0x3a0 [ 342.924779][T14968] khugepaged_enter_vma+0x13a/0x2c0 [ 342.924810][T14968] hugepage_madvise+0xa8/0xd0 [ 342.924839][T14968] madvise_vma_behavior+0x10c5/0x2350 [ 342.924868][T14968] ? mas_prev+0xa4/0x100 [ 342.924913][T14968] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 342.924938][T14968] ? mas_walk+0x260/0x310 [ 342.924960][T14968] ? find_vma_prev+0xd8/0x150 [ 342.924981][T14968] ? __pfx_find_vma_prev+0x10/0x10 [ 342.925003][T14968] ? lock_acquire+0x1d1/0x380 [ 342.925037][T14968] madvise_walk_vmas+0x30e/0xc50 [ 342.925073][T14968] ? __pfx_madvise_walk_vmas+0x10/0x10 [ 342.925097][T14968] ? __lock_acquire+0x4c5/0x1ec0 [ 342.925126][T14968] ? __pfx_futex_wake_mark+0x10/0x10 [ 342.925164][T14968] madvise_do_behavior+0x1ea/0x510 [ 342.925192][T14968] ? __pfx___might_resched+0x10/0x10 [ 342.925220][T14968] ? __pfx_madvise_do_behavior+0x10/0x10 [ 342.925258][T14968] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 342.925289][T14968] do_madvise+0x238/0x290 [ 342.925315][T14968] ? __pfx_do_madvise+0x10/0x10 [ 342.925340][T14968] ? do_futex+0x190/0x440 [ 342.925363][T14968] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 342.925407][T14968] __ia32_sys_madvise+0xa7/0x110 [ 342.925435][T14968] ? lockdep_hardirqs_on+0x7d/0x110 [ 342.925457][T14968] __do_fast_syscall_32+0x13a/0x8b0 [ 342.925487][T14968] do_fast_syscall_32+0x32/0x70 [ 342.925512][T14968] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 342.925537][T14968] RIP: 0023:0xf702efec [ 342.925558][T14968] Code: Unable to access opcode bytes at 0xf702efc2. [ 342.925568][T14968] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 00000000000000db [ 342.925589][T14968] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000800000 [ 342.925603][T14968] RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000000 [ 342.925615][T14968] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 342.925628][T14968] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 342.925641][T14968] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 342.925669][T14968] [ 344.176018][T14993] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3606'. [ 344.176130][T14993] netlink: 'syz.4.3606': attribute type 10 has an invalid length. [ 344.176208][T14993] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3606'. [ 344.182133][T14993] geneve2: entered promiscuous mode [ 344.182190][T14993] geneve2: entered allmulticast mode [ 344.519314][T15010] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 344.519314][T15010] [ 344.519387][T15010] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 344.519965][T15010] CIFS: Attempting to mount //127.0.0.1/share [ 344.520981][T15010] CIFS: VFS: Error connecting to socket. Aborting operation. [ 344.521292][T15010] CIFS: VFS: cifs_mount failed w/return code = -101 [ 345.551082][T15028] netlink: 188 bytes leftover after parsing attributes in process `syz.2.3620'. [ 345.760028][T15032] loop8: detected capacity change from 0 to 7 [ 345.765771][T15032] Dev loop8: unable to read RDB block 7 [ 345.765809][T15032] loop8: unable to read partition table [ 345.765974][T15032] loop8: partition table beyond EOD, truncated [ 345.765990][T15032] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 346.159058][ T5109] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 346.325442][ T5109] usb 10-1: Using ep0 maxpacket: 32 [ 346.326257][ T5109] usb 10-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 346.327299][ T5109] usb 10-1: config index 0 descriptor too short (expected 29220, got 36) [ 346.327319][ T5109] usb 10-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 346.327335][ T5109] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 346.327368][ T5109] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 346.327385][ T5109] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 346.327402][ T5109] usb 10-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 346.327433][ T5109] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 346.330071][ T5109] usb 10-1: config 0 descriptor?? [ 346.391666][T15060] FAULT_INJECTION: forcing a failure. [ 346.391666][T15060] name failslab, interval 1, probability 0, space 0, times 0 [ 346.391887][T15060] CPU: 1 UID: 0 PID: 15060 Comm: syz.3.3631 Tainted: G L syzkaller #0 PREEMPT(full) [ 346.391920][T15060] Tainted: [L]=SOFTLOCKUP [ 346.391927][T15060] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 346.391938][T15060] Call Trace: [ 346.391949][T15060] [ 346.391960][T15060] dump_stack_lvl+0x100/0x190 [ 346.392011][T15060] should_fail_ex.cold+0x5/0xa [ 346.392034][T15060] should_failslab+0xc2/0x120 [ 346.392060][T15060] kmem_cache_alloc_noprof+0x92/0x6a0 [ 346.392077][T15060] ? mas_prev+0xa4/0x100 [ 346.392100][T15060] ? vm_area_alloc+0x1f/0x160 [ 346.392128][T15060] vm_area_alloc+0x1f/0x160 [ 346.392148][T15060] __mmap_region+0x107c/0x32c0 [ 346.392175][T15060] ? __lock_acquire+0x4c5/0x1ec0 [ 346.392198][T15060] ? __pfx___mmap_region+0x10/0x10 [ 346.392247][T15060] ? do_raw_spin_lock+0x128/0x260 [ 346.392284][T15060] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 346.392315][T15060] ? hrtimer_reprogram+0x165/0x6c0 [ 346.392405][T15060] ? find_held_lock+0x2b/0x80 [ 346.392470][T15060] ? __pfx_mt_find+0x10/0x10 [ 346.392501][T15060] mmap_region+0x3db/0x6d0 [ 346.392536][T15060] ? __pfx_mmap_region+0x10/0x10 [ 346.392575][T15060] ? find_vma_intersection+0xc0/0x140 [ 346.392599][T15060] ? __pfx_find_vma_intersection+0x10/0x10 [ 346.392621][T15060] ? security_mmap_addr+0x71/0x1e0 [ 346.392647][T15060] ? __get_unmapped_area+0x255/0x3e0 [ 346.392674][T15060] do_mmap+0x12c7/0x1c30 [ 346.392704][T15060] ? lock_acquire+0x1d1/0x380 [ 346.392729][T15060] ? __pfx_do_mmap+0x10/0x10 [ 346.392751][T15060] ? futex_wait+0x11e/0x370 [ 346.392820][T15060] ? __pfx_down_write_killable+0x10/0x10 [ 346.392860][T15060] vm_mmap_pgoff+0x28d/0x470 [ 346.392893][T15060] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 346.392919][T15060] ? __pfx_do_futex+0x10/0x10 [ 346.392954][T15060] ksys_mmap_pgoff+0xe4/0x610 [ 346.392984][T15060] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 346.393020][T15060] __do_fast_syscall_32+0x13a/0x8b0 [ 346.393053][T15060] do_fast_syscall_32+0x32/0x70 [ 346.393080][T15060] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 346.393109][T15060] RIP: 0023:0xf702efec [ 346.393139][T15060] Code: Unable to access opcode bytes at 0xf702efc2. [ 346.393151][T15060] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 00000000000000c0 [ 346.393177][T15060] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000001000 [ 346.393192][T15060] RDX: 0000000000000002 RSI: 0000000004199831 RDI: 00000000ffffffff [ 346.393206][T15060] RBP: 0000000010000000 R08: 0000000000000000 R09: 0000000000000000 [ 346.393219][T15060] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 346.393232][T15060] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 346.393262][T15060] [ 346.673794][ T5109] usblp 10-1:0.0: usblp0: USB Bidirectional printer dev 8 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 346.874183][T13846] usb 10-1: USB disconnect, device number 8 [ 346.888578][T13846] usblp0: removed [ 349.574906][ T64] Bluetooth: hci1: command 0x0406 tx timeout [ 349.576021][ T43] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 349.755130][ T43] usb 9-1: Using ep0 maxpacket: 8 [ 349.756484][ T43] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 349.758030][ T43] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 349.758076][ T43] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 349.758098][ T43] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 349.758121][ T43] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 349.758143][ T43] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 349.758194][ T43] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 350.034013][ T43] usb 9-1: usb_control_msg returned -32 [ 350.034111][ T43] usbtmc 9-1:16.0: can't read capabilities [ 350.409490][T15145] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 350.416819][T15145] @0Ù: renamed from bond_slave_1 (while UP) [ 350.477059][T15148] usbtmc 9-1:16.0: control status returned 0 [ 350.691331][ T77] usb 9-1: USB disconnect, device number 12 [ 352.258010][T15184] jffs2: notice: (15184) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (0 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 352.970045][T15199] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3689'. [ 353.423079][ T43] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 353.507854][T15211] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3693'. [ 353.613483][ T43] usb 10-1: Using ep0 maxpacket: 16 [ 354.199135][ T43] usb 10-1: unable to get BOS descriptor or descriptor too short [ 354.199231][ T43] usb 10-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 354.202925][ T43] usb 10-1: unable to read config index 0 descriptor/start: -71 [ 354.202960][ T43] usb 10-1: can't read configurations, error -71 [ 356.824468][ T44] audit: type=1326 audit(1787915030.686:189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15292 comm="syz.3.3729" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x7ffc0000 [ 356.825020][ T44] audit: type=1326 audit(1787915030.686:190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15292 comm="syz.3.3729" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x7ffc0000 [ 356.842700][ T44] audit: type=1326 audit(1787915030.696:191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15292 comm="syz.3.3729" exe="/syz-executor" sig=0 arch=40000003 syscall=42 compat=1 ip=0xf702efec code=0x7ffc0000 [ 356.844138][ T44] audit: type=1326 audit(1787915030.696:192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15292 comm="syz.3.3729" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x7ffc0000 [ 356.844335][ T44] audit: type=1326 audit(1787915030.696:193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15292 comm="syz.3.3729" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x7ffc0000 [ 356.865827][ T44] audit: type=1326 audit(1787915030.726:194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15292 comm="syz.3.3729" exe="/syz-executor" sig=0 arch=40000003 syscall=245 compat=1 ip=0xf702efec code=0x7ffc0000 [ 356.866407][ T44] audit: type=1326 audit(1787915030.726:195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15292 comm="syz.3.3729" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x7ffc0000 [ 356.866639][ T44] audit: type=1326 audit(1787915030.726:196): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15292 comm="syz.3.3729" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x7ffc0000 [ 356.868606][ T44] audit: type=1326 audit(1787915030.726:197): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15292 comm="syz.3.3729" exe="/syz-executor" sig=0 arch=40000003 syscall=247 compat=1 ip=0xf702efec code=0x7ffc0000 [ 356.948987][ T44] audit: type=1326 audit(1787915030.806:198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15292 comm="syz.3.3729" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x7ffc0000 [ 358.814110][T15334] bridge0: port 2(bridge_slave_1) entered disabled state [ 358.814687][T15334] bridge0: port 1(bridge_slave_0) entered disabled state [ 359.221290][T15334] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 359.267372][T15334] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 359.880405][ T7556] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.880520][ T7556] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.880581][ T7556] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.880628][ T7556] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.934616][T15356] bridge0: entered allmulticast mode [ 360.860897][T15380] batadv_slave_0: entered promiscuous mode [ 360.861805][T15380] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3762'. [ 360.862310][T15380] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 360.984834][T15380] batadv_slave_0 (unregistering): left promiscuous mode [ 360.984957][T15380] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 361.241747][T15387] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3764'. [ 361.242871][T15387] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3764'. [ 361.819252][T15405] FAULT_INJECTION: forcing a failure. [ 361.819252][T15405] name failslab, interval 1, probability 0, space 0, times 0 [ 361.819353][T15405] CPU: 2 UID: 0 PID: 15405 Comm: syz.5.3772 Tainted: G L syzkaller #0 PREEMPT(full) [ 361.819401][T15405] Tainted: [L]=SOFTLOCKUP [ 361.819412][T15405] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 361.819426][T15405] Call Trace: [ 361.819432][T15405] [ 361.819442][T15405] dump_stack_lvl+0x100/0x190 [ 361.819477][T15405] should_fail_ex.cold+0x5/0xa [ 361.819515][T15405] should_failslab+0xc2/0x120 [ 361.819543][T15405] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 361.819569][T15405] ? __d_alloc+0x35/0xa50 [ 361.819598][T15405] __d_alloc+0x35/0xa50 [ 361.819623][T15405] d_alloc_pseudo+0x1c/0xc0 [ 361.819653][T15405] alloc_file_pseudo+0x118/0x290 [ 361.819681][T15405] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 361.819709][T15405] ? _raw_spin_unlock+0x28/0x50 [ 361.819730][T15405] ? alloc_fd+0x471/0x7a0 [ 361.819755][T15405] __anon_inode_getfile+0xe8/0x280 [ 361.819788][T15405] __anon_inode_getfd+0x5c/0xe0 [ 361.819819][T15405] map_create+0x19e1/0x30d0 [ 361.819888][T15405] ? __pfx_map_create+0x10/0x10 [ 361.819919][T15405] ? lock_acquire+0x1d1/0x380 [ 361.819946][T15405] ? __might_fault+0xc5/0x140 [ 361.819976][T15405] ? __might_fault+0xc5/0x140 [ 361.820015][T15405] __sys_bpf+0x12a0/0x4a30 [ 361.820043][T15405] ? __pfx___sys_bpf+0x10/0x10 [ 361.820061][T15405] ? __pfx_futex_hash+0x10/0x10 [ 361.820092][T15405] ? get_pid_task+0xfc/0x250 [ 361.820113][T15405] ? get_pid_task+0xfc/0x250 [ 361.820142][T15405] ? find_held_lock+0x2b/0x80 [ 361.820171][T15405] ? rcu_read_lock_any_held+0x6a/0x90 [ 361.820195][T15405] ? find_held_lock+0x2b/0x80 [ 361.820215][T15405] ? ksys_write+0x190/0x250 [ 361.820234][T15405] ? ksys_write+0x190/0x250 [ 361.820271][T15405] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 361.820297][T15405] ? xfd_validate_state+0x129/0x190 [ 361.820333][T15405] ? __ia32_sys_bpf+0xcc/0x170 [ 361.820352][T15405] __ia32_sys_bpf+0xcc/0x170 [ 361.820373][T15405] ? __do_fast_syscall_32+0xb3/0x8b0 [ 361.820402][T15405] __do_fast_syscall_32+0x13a/0x8b0 [ 361.820432][T15405] do_fast_syscall_32+0x32/0x70 [ 361.820461][T15405] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 361.820487][T15405] RIP: 0023:0xf702efec [ 361.820525][T15405] Code: Unable to access opcode bytes at 0xf702efc2. [ 361.820535][T15405] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 361.820559][T15405] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000000 [ 361.820574][T15405] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 361.820589][T15405] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 361.820601][T15405] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 361.820613][T15405] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 361.820643][T15405] [ 362.181578][T15409] lo speed is unknown, defaulting to 1000 [ 362.710826][T15423] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3780'. [ 363.076184][ T44] kauditd_printk_skb: 3 callbacks suppressed [ 363.076283][ T44] audit: type=1326 audit(1787915036.936:202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15431 comm="syz.4.3783" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f75fec code=0x0 [ 363.315842][T15437] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3793'. [ 363.349891][T15437] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3793'. [ 365.072550][T15479] netlink: 'syz.4.3802': attribute type 12 has an invalid length. [ 366.397277][T13846] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 366.590508][T13846] usb 9-1: New USB device found, idVendor=06cd, idProduct=0107, bcdDevice= 1.00 [ 366.591525][T13846] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 366.591592][T13846] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 366.591629][T13846] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 366.591664][T13846] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 366.591699][T13846] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 366.591732][T13846] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 366.591766][T13846] usb 9-1: config 1 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 366.594736][T13846] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.594775][T13846] usb 9-1: Product: syz [ 366.594815][T13846] usb 9-1: Manufacturer: syz [ 366.594845][T13846] usb 9-1: SerialNumber: syz [ 366.616002][T15511] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 366.616294][T15511] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 366.616384][T15511] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 366.618380][T13846] keyspan 9-1:1.0: Keyspan 1 port adapter converter detected [ 366.618966][T13846] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 84 [ 366.621093][T13846] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 82 [ 366.621176][T13846] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 2 [ 366.683451][T13846] usb 9-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 367.343407][ T5109] usb 9-1: USB disconnect, device number 13 [ 367.377918][ T5109] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 367.384532][ T5109] keyspan 9-1:1.0: device disconnected [ 368.037847][T15558] netlink: 'syz.2.3835': attribute type 1 has an invalid length. [ 368.095009][T15558] 8021q: adding VLAN 0 to HW filter on device bond3 [ 368.198217][T15562] bond3: (slave geneve2): making interface the new active one [ 368.307130][T15562] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 368.527116][T15571] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3840'. [ 369.806492][ T1345] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 369.968457][ T1345] usb 10-1: Using ep0 maxpacket: 32 [ 370.003699][ T1345] usb 10-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 370.030098][ T1345] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 370.042784][ T1345] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 370.058649][ T1345] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.100758][ T1345] usb 10-1: config 0 descriptor?? [ 370.600217][ T1345] savu 0003:1E7D:2D5A.000E: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.5-1/input0 [ 370.955978][T13846] usb 10-1: USB disconnect, device number 11 [ 371.376973][T15636] overlayfs: failed to clone upperpath [ 374.015775][T15692] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3880'. [ 374.061197][T15692] hsr_slave_1 (unregistering): left promiscuous mode [ 374.249476][T15697] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 374.249923][T15697] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 374.293955][T15697] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 374.294443][T15697] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 374.326689][ T44] audit: type=1800 audit(1787915048.176:203): pid=15699 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3883" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 374.556271][T15705] sysfs: cannot create duplicate filename '/devices/platform/vidtv.0/i2c-1/1-0002' [ 374.556349][T15705] CPU: 1 UID: 0 PID: 15705 Comm: syz.5.3885 Tainted: G L syzkaller #0 PREEMPT(full) [ 374.556392][T15705] Tainted: [L]=SOFTLOCKUP [ 374.556401][T15705] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 374.556411][T15705] Call Trace: [ 374.556416][T15705] [ 374.556422][T15705] dump_stack_lvl+0x100/0x190 [ 374.556455][T15705] sysfs_warn_dup.cold+0x1c/0x28 [ 374.556480][T15705] sysfs_create_dir_ns+0x24b/0x2b0 [ 374.556500][T15705] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 374.556528][T15705] ? find_held_lock+0x2b/0x80 [ 374.556551][T15705] ? kobject_add_internal+0x25f/0x930 [ 374.556577][T15705] ? kobject_add_internal+0x25f/0x930 [ 374.556605][T15705] ? do_raw_spin_unlock+0x145/0x1e0 [ 374.556634][T15705] kobject_add_internal+0x2c8/0x930 [ 374.556662][T15705] kobject_add+0x16a/0x1e0 [ 374.556690][T15705] ? __pfx_kobject_add+0x10/0x10 [ 374.556716][T15705] ? __kasan_kmalloc+0xaa/0xb0 [ 374.556735][T15705] ? lockdep_init_map_type+0x5c/0x250 [ 374.556761][T15705] ? class_to_subsys+0x114/0x150 [ 374.556788][T15705] device_add+0x294/0x1970 [ 374.556814][T15705] ? lockdep_init_map_type+0x5c/0x250 [ 374.556839][T15705] ? __pfx_device_add+0x10/0x10 [ 374.556861][T15705] ? lockdep_init_map_type+0x5c/0x250 [ 374.556885][T15705] ? __init_waitqueue_head+0xca/0x150 [ 374.556921][T15705] i2c_new_client_device+0x660/0xd30 [ 374.556960][T15705] new_device_store+0x20f/0x420 [ 374.556989][T15705] ? __pfx_new_device_store+0x10/0x10 [ 374.557020][T15705] ? find_held_lock+0x2b/0x80 [ 374.557037][T15705] ? sysfs_file_kobj+0xe4/0x290 [ 374.557066][T15705] ? sysfs_file_kobj+0xe4/0x290 [ 374.557096][T15705] ? __pfx_new_device_store+0x10/0x10 [ 374.557124][T15705] dev_attr_store+0x58/0x80 [ 374.557148][T15705] ? __pfx_dev_attr_store+0x10/0x10 [ 374.557169][T15705] sysfs_kf_write+0xf2/0x150 [ 374.557201][T15705] kernfs_fop_write_iter+0x3e0/0x5f0 [ 374.557227][T15705] ? __pfx_sysfs_kf_write+0x10/0x10 [ 374.557259][T15705] vfs_write+0x6af/0x1050 [ 374.557278][T15705] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 374.557308][T15705] ? __pfx_vfs_write+0x10/0x10 [ 374.557323][T15705] ? find_held_lock+0x2b/0x80 [ 374.557360][T15705] ksys_write+0x12a/0x250 [ 374.557377][T15705] ? __pfx_ksys_write+0x10/0x10 [ 374.557402][T15705] __do_fast_syscall_32+0x13a/0x8b0 [ 374.557429][T15705] do_fast_syscall_32+0x32/0x70 [ 374.557453][T15705] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 374.557477][T15705] RIP: 0023:0xf702efec [ 374.557501][T15705] Code: Unable to access opcode bytes at 0xf702efc2. [ 374.557509][T15705] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 374.557536][T15705] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 374.557551][T15705] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 374.557563][T15705] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 374.557575][T15705] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 374.557587][T15705] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 374.557615][T15705] [ 374.589801][T15705] kobject: kobject_add_internal failed for 1-0002 with -EEXIST, don't try to register things with the same name in the same directory. [ 374.589852][T15705] i2c i2c-1: Failed to register i2c client isp1301 at 0x02 (-17) [ 374.654316][T15705] sysfs: cannot create duplicate filename '/devices/platform/vidtv.0/i2c-1/1-002c' [ 374.654335][T15705] CPU: 1 UID: 0 PID: 15705 Comm: syz.5.3885 Tainted: G L syzkaller #0 PREEMPT(full) [ 374.654393][T15705] Tainted: [L]=SOFTLOCKUP [ 374.654400][T15705] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 374.654418][T15705] Call Trace: [ 374.654423][T15705] [ 374.654430][T15705] dump_stack_lvl+0x100/0x190 [ 374.654459][T15705] sysfs_warn_dup.cold+0x1c/0x28 [ 374.654485][T15705] sysfs_create_dir_ns+0x24b/0x2b0 [ 374.654503][T15705] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 374.654523][T15705] ? find_held_lock+0x2b/0x80 [ 374.654546][T15705] ? kobject_add_internal+0x25f/0x930 [ 374.654572][T15705] ? kobject_add_internal+0x25f/0x930 [ 374.654606][T15705] ? do_raw_spin_unlock+0x145/0x1e0 [ 374.654643][T15705] kobject_add_internal+0x2c8/0x930 [ 374.654677][T15705] kobject_add+0x16a/0x1e0 [ 374.654704][T15705] ? __pfx_kobject_add+0x10/0x10 [ 374.654733][T15705] ? __kasan_kmalloc+0xaa/0xb0 [ 374.654757][T15705] ? lockdep_init_map_type+0x5c/0x250 [ 374.654782][T15705] ? class_to_subsys+0x114/0x150 [ 374.654810][T15705] device_add+0x294/0x1970 [ 374.654835][T15705] ? lockdep_init_map_type+0x5c/0x250 [ 374.654861][T15705] ? __pfx_device_add+0x10/0x10 [ 374.654882][T15705] ? lockdep_init_map_type+0x5c/0x250 [ 374.654907][T15705] ? __init_waitqueue_head+0xca/0x150 [ 374.654938][T15705] i2c_new_client_device+0x660/0xd30 [ 374.654974][T15705] new_device_store+0x20f/0x420 [ 374.655006][T15705] ? __pfx_new_device_store+0x10/0x10 [ 374.655038][T15705] ? find_held_lock+0x2b/0x80 [ 374.655056][T15705] ? sysfs_file_kobj+0xe4/0x290 [ 374.655084][T15705] ? sysfs_file_kobj+0xe4/0x290 [ 374.655113][T15705] ? __pfx_new_device_store+0x10/0x10 [ 374.655141][T15705] dev_attr_store+0x58/0x80 [ 374.655160][T15705] ? __pfx_dev_attr_store+0x10/0x10 [ 374.655182][T15705] sysfs_kf_write+0xf2/0x150 [ 374.655212][T15705] kernfs_fop_write_iter+0x3e0/0x5f0 [ 374.655236][T15705] ? __pfx_sysfs_kf_write+0x10/0x10 [ 374.655286][T15705] vfs_write+0x6af/0x1050 [ 374.655307][T15705] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 374.655340][T15705] ? __pfx_vfs_write+0x10/0x10 [ 374.655356][T15705] ? find_held_lock+0x2b/0x80 [ 374.655395][T15705] ksys_write+0x12a/0x250 [ 374.655517][T15705] ? __pfx_ksys_write+0x10/0x10 [ 374.655543][T15705] __do_fast_syscall_32+0x13a/0x8b0 [ 374.655573][T15705] do_fast_syscall_32+0x32/0x70 [ 374.655599][T15705] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 374.655625][T15705] RIP: 0023:0xf702efec [ 374.655648][T15705] Code: Unable to access opcode bytes at 0xf702efc2. [ 374.655656][T15705] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 374.655674][T15705] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000100 [ 374.655687][T15705] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 374.655700][T15705] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 374.655713][T15705] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 374.655726][T15705] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 374.655754][T15705] [ 374.655938][T15705] kobject: kobject_add_internal failed for 1-002c with -EEXIST, don't try to register things with the same name in the same directory. [ 374.655976][T15705] i2c i2c-1: Failed to register i2c client isp1301 at 0x2c (-17) [ 374.658070][T13846] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 374.849909][T13846] usb 9-1: Using ep0 maxpacket: 8 [ 375.142595][T13846] usb 9-1: unable to get BOS descriptor or descriptor too short [ 375.142645][T13846] usb 9-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 375.157042][T13846] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 375.157073][T13846] usb 9-1: can't read configurations, error -71 [ 376.696233][T15738] 9p: Bad value for 'wfdno' [ 376.973802][ T1345] kernel write not supported for file /gssd/clntXX/gssd (pid: 1345 comm: kworker/2:2) [ 378.127781][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.127872][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.802254][T15793] netlink: 'syz.2.3922': attribute type 1 has an invalid length. [ 378.886093][T15793] bond4: entered promiscuous mode [ 378.892189][T15793] 8021q: adding VLAN 0 to HW filter on device bond4 [ 379.032730][T15795] 8021q: adding VLAN 0 to HW filter on device bond4 [ 379.033170][T15795] bond4: (slave ipip1): The slave device specified does not support setting the MAC address [ 379.033194][T15795] bond4: (slave ipip1): Setting fail_over_mac to active for active-backup mode [ 379.100834][T15795] bond4: (slave ipip1): making interface the new active one [ 379.100884][T15795] ipip1: entered promiscuous mode [ 379.140874][T15795] bond4: (slave ipip1): Enslaving as an active interface with an up link [ 381.694157][ T5817] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 381.882205][ T5817] usb 9-1: Using ep0 maxpacket: 8 [ 381.919325][ T5817] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 381.920576][ T5817] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 381.921061][ T5817] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 381.921124][ T5817] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 381.921175][ T5817] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 381.921202][ T5817] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 381.921245][ T5817] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 382.216600][ T5817] usb 9-1: usb_control_msg returned -32 [ 382.216732][ T5817] usbtmc 9-1:16.0: can't read capabilities [ 382.408476][T15856] 9pnet: p9_errstr2errno: server reported unknown error 0x0000 [ 382.949861][T15866] usbtmc 9-1:16.0: usb_clear_halt returned -32 [ 383.161762][ T5109] usb 9-1: USB disconnect, device number 16 [ 385.113080][T15911] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 385.967938][T15924] all: renamed from bridge_slave_0 (while UP) [ 387.367652][T15948] sctp: [Deprecated]: syz.3.3987 (pid 15948) Use of int in max_burst socket option deprecated. [ 387.367652][T15948] Use struct sctp_assoc_value instead [ 389.562226][T15995] kernel read not supported for file /cpuacct.usage_percpu (pid: 15995 comm: syz.4.4003) [ 389.562694][ T44] audit: type=1800 audit(1787915063.416:204): pid=15995 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.4003" name="cpuacct.usage_percpu" dev="mqueue" ino=57196 res=0 errno=0 [ 390.330993][T16015] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4016'. [ 390.844735][T16028] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4021'. [ 390.851419][T16028] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4021'. [ 390.938854][T16031] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4021'. [ 390.938961][T16031] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4021'. [ 391.104040][T16031] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4021'. [ 391.104147][T16031] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4021'. [ 391.133601][T16028] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4021'. [ 391.133660][T16028] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4021'. [ 391.339741][T16031] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4021'. [ 392.289075][T16065] lo speed is unknown, defaulting to 1000 [ 393.715455][T16088] lo speed is unknown, defaulting to 1000 [ 395.378340][T16115] fuse: fd is not a fuse device [ 396.940564][T16136] lo speed is unknown, defaulting to 1000 [ 397.436304][T16148] ceph: No mds server is up or the cluster is laggy [ 398.637900][T16167] hub 1-0:1.0: USB hub found [ 398.659438][T16167] hub 1-0:1.0: 2 ports detected [ 398.989978][ T12] tipc: Subscription rejected, illegal request [ 399.234205][T16185] netlink: 'syz.5.4076': attribute type 13 has an invalid length. [ 399.306593][T16185] gretap0: refused to change device tx_queue_len [ 399.308330][T16185] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 400.244298][T16207] netlink: 'syz.2.4088': attribute type 1 has an invalid length. [ 400.340788][T16207] 8021q: adding VLAN 0 to HW filter on device bond5 [ 400.405368][T16215] bond5: (slave geneve3): making interface the new active one [ 400.476519][T16215] bond5: (slave geneve3): Enslaving as an active interface with an up link [ 400.831413][T16230] __nla_validate_parse: 6 callbacks suppressed [ 400.831534][T16230] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4095'. [ 402.418415][T16256] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4102'. [ 402.425422][T16256] netlink: 72 bytes leftover after parsing attributes in process `syz.4.4102'. [ 402.603424][T16260] netlink: 51 bytes leftover after parsing attributes in process `syz.2.4103'. [ 402.875452][T16266] ip6tnl1: entered allmulticast mode [ 402.879312][T16265] netlink: 276 bytes leftover after parsing attributes in process `syz.2.4114'. [ 403.510058][T16270] syzkaller1: entered promiscuous mode [ 403.510182][T16270] syzkaller1: entered allmulticast mode [ 403.843118][T16287] tls_set_device_offload_rx: netdev not found [ 404.446352][T16296] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4113'. [ 404.457312][T16296] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4113'. [ 404.477315][T16296] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4113'. [ 409.070078][T16384] fuse: fd is not a fuse device [ 409.158173][T16383] lo speed is unknown, defaulting to 1000 [ 410.039371][ T5096] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 410.039457][ T5096] CPU: 0 UID: 0 PID: 5096 Comm: kworker/u34:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 410.039511][ T5096] Tainted: [L]=SOFTLOCKUP [ 410.039521][ T5096] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 410.039535][ T5096] Workqueue: hci2 hci_rx_work [ 410.039580][ T5096] Call Trace: [ 410.039587][ T5096] [ 410.039595][ T5096] dump_stack_lvl+0x100/0x190 [ 410.039627][ T5096] sysfs_warn_dup.cold+0x1c/0x28 [ 410.039663][ T5096] sysfs_create_dir_ns+0x24b/0x2b0 [ 410.039685][ T5096] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 410.039705][ T5096] ? find_held_lock+0x2b/0x80 [ 410.039723][ T5096] ? kobject_add_internal+0x25f/0x930 [ 410.039750][ T5096] ? kobject_add_internal+0x25f/0x930 [ 410.039779][ T5096] ? do_raw_spin_unlock+0x145/0x1e0 [ 410.039808][ T5096] kobject_add_internal+0x2c8/0x930 [ 410.039838][ T5096] kobject_add+0x16a/0x1e0 [ 410.039862][ T5096] ? __pfx_kobject_add+0x10/0x10 [ 410.039885][ T5096] ? class_to_subsys+0x10f/0x150 [ 410.039912][ T5096] ? kobject_put+0xb9/0x640 [ 410.039934][ T5096] ? _raw_spin_unlock+0x28/0x50 [ 410.039960][ T5096] device_add+0x294/0x1970 [ 410.039983][ T5096] ? __pfx_dev_set_name+0x10/0x10 [ 410.040008][ T5096] ? __pfx_device_add+0x10/0x10 [ 410.040151][ T5096] ? mgmt_send_event_skb+0x2fb/0x460 [ 410.040186][ T5096] hci_conn_add_sysfs+0x1a3/0x260 [ 410.040212][ T5096] le_conn_complete_evt+0x122f/0x2130 [ 410.040260][ T5096] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 410.040285][ T5096] ? hci_event_packet+0x186/0xcd0 [ 410.040316][ T5096] hci_le_conn_complete_evt+0x23c/0x3a0 [ 410.040346][ T5096] ? skb_pull_data+0x15f/0x1e0 [ 410.040373][ T5096] hci_le_meta_evt+0x34a/0x5f0 [ 410.040393][ T5096] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 410.040425][ T5096] hci_event_packet+0x51c/0xcd0 [ 410.040452][ T5096] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 410.040472][ T5096] ? __pfx_hci_event_packet+0x10/0x10 [ 410.040503][ T5096] ? lockdep_hardirqs_on+0x7d/0x110 [ 410.040529][ T5096] hci_rx_work+0x451/0xfc0 [ 410.040560][ T5096] process_one_work+0xac7/0x1b10 [ 410.040646][ T5096] ? __pfx_process_one_work+0x10/0x10 [ 410.040675][ T5096] ? lock_acquire+0x1d1/0x380 [ 410.040707][ T5096] ? __pfx_hci_rx_work+0x10/0x10 [ 410.040737][ T5096] worker_thread+0x5ef/0xe50 [ 410.040768][ T5096] ? __pfx_worker_thread+0x10/0x10 [ 410.040789][ T5096] ? kthread+0x13a/0x450 [ 410.040806][ T5096] ? __pfx_worker_thread+0x10/0x10 [ 410.040824][ T5096] kthread+0x373/0x450 [ 410.040842][ T5096] ? __pfx_kthread+0x10/0x10 [ 410.040862][ T5096] ret_from_fork+0x730/0xd60 [ 410.040890][ T5096] ? __pfx_ret_from_fork+0x10/0x10 [ 410.040918][ T5096] ? __switch_to+0x800/0x10f0 [ 410.040942][ T5096] ? __pfx_kthread+0x10/0x10 [ 410.040963][ T5096] ret_from_fork_asm+0x1a/0x30 [ 410.041004][ T5096] [ 410.041155][ T5096] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 410.041213][ T5096] Bluetooth: hci2: failed to register connection device [ 412.354101][T16452] gadgetfs: bound to dummy_udc driver [ 412.503331][T16456] overlay: filesystem on ./file0 not supported as upperdir [ 414.086361][T16481] process '/newroot/1210/file0' started with executable stack [ 415.098107][T16513] bond0: (slave syz_tun): Releasing backup interface [ 415.207353][T16513] batadv0: left allmulticast mode [ 415.207396][T16513] batadv0: left promiscuous mode [ 415.207589][T16513] bridge0: port 3(batadv0) entered disabled state [ 415.218703][T16513] bridge_slave_0: left allmulticast mode [ 415.218753][T16513] bridge_slave_0: left promiscuous mode [ 415.218968][T16513] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.221532][T16513] bridge_slave_1: left allmulticast mode [ 415.221579][T16513] bridge_slave_1: left promiscuous mode [ 415.221746][T16513] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.465074][T16513] bond0: (slave veth0_to_bond): Releasing backup interface [ 415.504838][T16513] veth0_to_bond: left promiscuous mode [ 415.522491][T16513] bond0: (slave bond_slave_0): Releasing backup interface [ 415.577355][T16513] bond_slave_0: left promiscuous mode [ 415.602198][T16513] bond0: (slave c@0Ù): Releasing backup interface [ 415.619316][T16513] @0Ù: left promiscuous mode [ 415.625827][T16513] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 415.625886][T16513] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 415.639236][T16513] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 415.708003][T16521] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 416.315746][ T5096] Bluetooth: hci2: command 0x0406 tx timeout [ 417.641964][T16576] o2cb: This node has not been configured. [ 417.642084][T16576] o2cb: Cluster check failed. Fix errors before retrying. [ 417.642198][T16576] (syz.5.4231,16576,3):user_dlm_register:674 ERROR: status = -22 [ 417.643310][T16576] (syz.5.4231,16576,3):dlmfs_mkdir:437 ERROR: Error -22 could not register domain "file1" [ 418.607453][T16599] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4246'. [ 418.612750][T16601] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4239'. [ 418.661970][T16603] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4240'. [ 420.870977][T16665] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4270'. [ 420.871077][T16665] netlink: 'syz.2.4270': attribute type 7 has an invalid length. [ 420.871418][T16665] netlink: 'syz.2.4270': attribute type 8 has an invalid length. [ 420.871579][T16665] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4270'. [ 421.109382][T16669] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4271'. [ 422.277420][T16689] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4278'. [ 422.390706][T16689] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4278'. [ 422.414307][T16692] netlink: 'syz.5.4279': attribute type 10 has an invalid length. [ 422.454979][T16692] syz_tun: entered promiscuous mode [ 422.492706][T16692] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 422.895026][T16692] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 424.532967][T16740] overlayfs: failed to clone upperpath [ 424.709548][T16749] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4301'. [ 424.961679][T16757] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4305'. [ 425.350549][T16768] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4309'. [ 425.352302][T16768] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4309'. [ 426.116452][T16788] netlink: 'syz.2.4313': attribute type 12 has an invalid length. [ 426.116546][T16788] netlink: 'syz.2.4313': attribute type 29 has an invalid length. [ 426.116588][T16788] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4313'. [ 426.116629][T16788] netlink: 'syz.2.4313': attribute type 1 has an invalid length. [ 426.116660][T16788] netlink: 'syz.2.4313': attribute type 2 has an invalid length. [ 426.245926][T16793] could not open pipe file descriptor [ 426.992152][T16818] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4330'. [ 426.992282][T16818] netlink: 'syz.3.4330': attribute type 10 has an invalid length. [ 426.992782][T16818] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4330'. [ 427.194014][T16828] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4334'. [ 427.194152][T16828] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4334'. [ 427.194628][T16828] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4334'. [ 427.430793][T16838] netlink: 'syz.4.4336': attribute type 1 has an invalid length. [ 428.161628][T16856] batadv_slave_1: entered promiscuous mode [ 428.177738][T16855] batadv_slave_1: left promiscuous mode [ 430.731131][T16906] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4367'. [ 430.854147][T16914] fuse: fd is not a fuse device [ 430.877767][T16908] 8021q: adding VLAN 0 to HW filter on device bond0 [ 430.886709][T16908] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 431.139641][T16908] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 431.141586][T16908] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 431.160054][T16908] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 431.180496][T16908] veth1_vlan: left promiscuous mode [ 431.181419][T16908] veth0_vlan: left promiscuous mode [ 431.182687][T16908] veth0_vlan: entered promiscuous mode [ 431.184774][T16908] veth1_vlan: entered promiscuous mode [ 431.191366][T16908] veth1_macvtap: left promiscuous mode [ 431.192451][T16908] veth0_macvtap: left promiscuous mode [ 431.193651][T16908] veth0_macvtap: entered promiscuous mode [ 431.211496][T16908] veth1_macvtap: entered promiscuous mode [ 431.258276][T16908] 8021q: adding VLAN 0 to HW filter on device eth0 [ 431.262737][T16908] 8021q: adding VLAN 0 to HW filter on device eth1 [ 431.264373][T16908] 8021q: adding VLAN 0 to HW filter on device eth2 [ 431.266552][T16908] 8021q: adding VLAN 0 to HW filter on device eth3 [ 431.267475][T16908] 8021q: adding VLAN 0 to HW filter on device bond1 [ 431.302670][T16304] bridge0: port 1(bridge_slave_0) entered blocking state [ 431.318413][T16304] bridge0: port 1(bridge_slave_0) entered listening state [ 431.320271][T16304] bridge0: port 2(bridge_slave_1) entered blocking state [ 431.320353][T16304] bridge0: port 2(bridge_slave_1) entered listening state [ 431.415724][ T7552] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.415842][ T7552] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.415901][ T7552] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.417637][ T7554] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.711445][T16925] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 432.321163][ T44] audit: type=1326 audit(1787915106.186:205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16936 comm="syz.4.4382" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f75fec code=0x0 [ 432.376940][ T5109] page_pool_release_retry() stalled pool shutdown: id 98, 1 inflight 60 sec [ 433.980699][T16973] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4395'. [ 433.981374][T16973] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4395'. [ 434.356582][T16983] netlink: 'syz.4.4399': attribute type 12 has an invalid length. [ 434.356660][T16983] netlink: 'syz.4.4399': attribute type 29 has an invalid length. [ 434.356709][T16983] netlink: 148 bytes leftover after parsing attributes in process `syz.4.4399'. [ 434.356744][T16983] netlink: 'syz.4.4399': attribute type 3 has an invalid length. [ 434.356770][T16983] netlink: 'syz.4.4399': attribute type 2 has an invalid length. [ 434.356798][T16983] netlink: 35 bytes leftover after parsing attributes in process `syz.4.4399'. [ 434.483337][T16985] FAULT_INJECTION: forcing a failure. [ 434.483337][T16985] name failslab, interval 1, probability 0, space 0, times 0 [ 434.483417][T16985] CPU: 0 UID: 0 PID: 16985 Comm: syz.5.4401 Tainted: G L syzkaller #0 PREEMPT(full) [ 434.483456][T16985] Tainted: [L]=SOFTLOCKUP [ 434.483463][T16985] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 434.483474][T16985] Call Trace: [ 434.483481][T16985] [ 434.483488][T16985] dump_stack_lvl+0x100/0x190 [ 434.483518][T16985] should_fail_ex.cold+0x5/0xa [ 434.483541][T16985] should_failslab+0xc2/0x120 [ 434.483564][T16985] kmem_cache_alloc_noprof+0x92/0x6a0 [ 434.483582][T16985] ? rcu_read_lock_any_held+0x6a/0x90 [ 434.483599][T16985] ? do_getname+0x35/0x390 [ 434.483632][T16985] do_getname+0x35/0x390 [ 434.483657][T16985] do_sys_openat2+0xc7/0x1e0 [ 434.483680][T16985] ? __pfx_do_sys_openat2+0x10/0x10 [ 434.483700][T16985] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 434.483728][T16985] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 434.483752][T16985] __ia32_compat_sys_openat+0x12d/0x210 [ 434.483776][T16985] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 434.483812][T16985] do_int80_emulation+0x166/0x650 [ 434.483837][T16985] asm_int80_emulation+0x1a/0x20 [ 434.483855][T16985] RIP: 0023:0xf71675ab [ 434.483872][T16985] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 434.483889][T16985] RSP: 002b:00000000f541d03c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 434.483909][T16985] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f541d100 [ 434.483920][T16985] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 434.483930][T16985] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 434.483941][T16985] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 434.483952][T16985] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 434.483977][T16985] [ 434.892227][T16999] FAULT_INJECTION: forcing a failure. [ 434.892227][T16999] name failslab, interval 1, probability 0, space 0, times 0 [ 434.912467][T16999] CPU: 3 UID: 0 PID: 16999 Comm: syz.5.4406 Tainted: G L syzkaller #0 PREEMPT(full) [ 434.912516][T16999] Tainted: [L]=SOFTLOCKUP [ 434.912524][T16999] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 434.912536][T16999] Call Trace: [ 434.912544][T16999] [ 434.912554][T16999] dump_stack_lvl+0x100/0x190 [ 434.912594][T16999] should_fail_ex.cold+0x5/0xa [ 434.912623][T16999] should_failslab+0xc2/0x120 [ 434.912648][T16999] kmem_cache_alloc_noprof+0x92/0x6a0 [ 434.912668][T16999] ? prepare_creds+0x2c/0x950 [ 434.912696][T16999] prepare_creds+0x2c/0x950 [ 434.912723][T16999] __sys_setreuid+0x109/0xb00 [ 434.912758][T16999] __do_fast_syscall_32+0x13a/0x8b0 [ 434.912787][T16999] do_fast_syscall_32+0x32/0x70 [ 434.912813][T16999] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 434.912840][T16999] RIP: 0023:0xf702efec [ 434.912867][T16999] Code: Unable to access opcode bytes at 0xf702efc2. [ 434.912875][T16999] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000046 [ 434.912898][T16999] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000000ee01 [ 434.912914][T16999] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 434.912927][T16999] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 434.912937][T16999] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 434.912948][T16999] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 434.912975][T16999] [ 435.154178][T17003] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4409'. [ 436.422296][T17032] loop8: detected capacity change from 0 to 7 [ 436.444507][T17032] Dev loop8: unable to read RDB block 7 [ 436.444604][T17032] loop8: unable to read partition table [ 436.444791][T17032] loop8: partition table beyond EOD, truncated [ 436.444809][T17032] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 437.541594][T17062] syzkaller1: entered promiscuous mode [ 437.541724][T17062] syzkaller1: entered allmulticast mode [ 439.579174][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.579311][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.104633][T17120] netlink: 'syz.5.4454': attribute type 4 has an invalid length. [ 440.159674][T17120] netlink: 'syz.5.4454': attribute type 17 has an invalid length. [ 441.036349][T17136] vcan0: tx address claim with broadcast sa [ 441.789480][T17153] batadv_slave_1: entered promiscuous mode [ 441.791067][T17152] batadv_slave_1: left promiscuous mode [ 442.969599][T17193] netlink: 'syz.2.4484': attribute type 1 has an invalid length. [ 442.969670][T17193] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.4484'. [ 442.970091][T17193] netlink: 'syz.2.4484': attribute type 1 has an invalid length. [ 442.970263][T17193] netlink: 2016 bytes leftover after parsing attributes in process `syz.2.4484'. [ 443.315630][T17199] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4488'. [ 444.430643][T17225] 9pnet_virtio: no channels available for device syz [ 446.612573][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 446.612851][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 448.765646][ T7552] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 448.765770][ T7552] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.765891][ T7552] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 448.765944][ T7552] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.766076][ T7552] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 448.766130][ T7552] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.766194][ T7552] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 448.766247][ T7552] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.870422][ T854] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 449.073820][T17235] lo speed is unknown, defaulting to 1000 [ 449.086522][ T854] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 449.087610][ T854] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 449.087663][ T854] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 449.087697][ T854] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 449.087750][ T854] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 449.090092][ T854] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 449.090120][ T854] usb 10-1: Product: syz [ 449.090147][ T854] usb 10-1: Manufacturer: syz [ 449.097870][T17251] device-mapper: ioctl: device name cannot contain '/' [ 449.112190][ T854] cdc_wdm 10-1:1.0: skipping garbage [ 449.112212][ T854] cdc_wdm 10-1:1.0: skipping garbage [ 449.119527][ T854] cdc_wdm 10-1:1.0: cdc-wdm0: USB WDM device [ 449.119548][ T854] cdc_wdm 10-1:1.0: Unknown control protocol [ 449.402732][ C1] wdm_int_callback: 10 callbacks suppressed [ 449.402773][ C1] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 449.402790][ C1] wdm_int_callback: 10 callbacks suppressed [ 449.402802][ C1] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 449.403106][ T5826] usb 10-1: USB disconnect, device number 12 [ 450.274238][T17267] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4514'. [ 450.283873][T17267] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4514'. [ 450.373110][T17269] CIFS: Attempting to mount //::1/share [ 451.211500][T17269] CIFS: VFS: Error connecting to socket. Aborting operation. [ 451.211584][T17269] CIFS: VFS: cifs_mount failed w/return code = -4 [ 452.453714][T17311] netlink: 9275 bytes leftover after parsing attributes in process `syz.4.4535'. [ 453.356532][T17332] binder: 17329:17332 ioctl c0306201 80000480 returned -14 [ 453.903656][ T44] audit: type=1804 audit(1787915127.756:206): pid=17345 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.4549" name="/newroot/328/file0" dev="tmpfs" ino=1754 res=1 errno=0 [ 454.491580][T17358] lo speed is unknown, defaulting to 1000 [ 454.826900][T17369] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4566'. [ 454.827098][T17369] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4566'. [ 454.961494][T17369] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4566'. [ 454.961713][T17369] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4566'. [ 455.069302][ T43] libceph: connect (1)[c::]:6789 error -99 [ 455.069512][ T43] libceph: mon0 (1)[c::]:6789 connect error [ 455.122141][ T5826] libceph: connect (1)[c::]:6789 error -99 [ 455.122487][ T5826] libceph: mon0 (1)[c::]:6789 connect error [ 455.261406][T17387] netlink: 'syz.5.4563': attribute type 4 has an invalid length. [ 455.313205][T17390] netlink: 'syz.5.4563': attribute type 4 has an invalid length. [ 455.321200][ T1345] libceph: connect (1)[c::]:6789 error -99 [ 455.321358][ T1345] libceph: mon0 (1)[c::]:6789 connect error [ 455.407416][T12179] libceph: connect (1)[c::]:6789 error -99 [ 455.407650][T12179] libceph: mon0 (1)[c::]:6789 connect error [ 455.755121][T17374] ceph: No mds server is up or the cluster is laggy [ 455.759548][T17380] ceph: No mds server is up or the cluster is laggy [ 455.822466][ T43] libceph: connect (1)[c::]:6789 error -99 [ 455.822694][ T43] libceph: mon0 (1)[c::]:6789 connect error [ 455.922077][ T5826] libceph: connect (1)[c::]:6789 error -99 [ 455.922327][ T5826] libceph: mon0 (1)[c::]:6789 connect error [ 456.965911][T17419] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4574'. [ 457.865433][ T5826] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 458.062400][ T5826] usb 10-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 458.080188][ T5826] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 458.080245][ T5826] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 458.080292][ T5826] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 458.080328][ T5826] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 458.080377][ T5826] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 458.226669][T17432] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 458.226871][T17432] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 458.226970][T17432] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 458.227051][T17432] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 458.276781][ T5826] cxacru 10-1:1.0: send of cm 0x90 failed (-71) [ 458.310806][T17450] cxacru 10-1:1.0: Direct firmware load for cxacru-fw.bin failed with error -2 [ 458.310899][T17450] cxacru 10-1:1.0: Falling back to sysfs fallback for: cxacru-fw.bin [ 459.418836][T17471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 459.423609][T17471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.529289][ T5849] usb 10-1: USB disconnect, device number 13 [ 459.874557][T17478] netlink: 'syz.2.4600': attribute type 10 has an invalid length. [ 459.874811][T17478] bridge0: port 2(bridge_slave_1) entered disabled state [ 459.875217][T17478] bridge0: port 1(bridge_slave_0) entered disabled state [ 459.962734][T17478] bridge0: port 2(bridge_slave_1) entered blocking state [ 459.962872][T17478] bridge0: port 2(bridge_slave_1) entered forwarding state [ 459.963184][T17478] bridge0: port 1(bridge_slave_0) entered blocking state [ 459.963268][T17478] bridge0: port 1(bridge_slave_0) entered forwarding state [ 460.053355][T17478] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 461.970245][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 461.970346][ C1] bridge0: topology change detected, propagating [ 461.970641][ C1] bridge0: port 2(bridge_slave_1) entered forwarding state [ 461.970675][ C1] bridge0: topology change detected, propagating [ 464.177447][T17550] FAULT_INJECTION: forcing a failure. [ 464.177447][T17550] name failslab, interval 1, probability 0, space 0, times 0 [ 464.177749][T17550] CPU: 3 UID: 0 PID: 17550 Comm: syz.4.4630 Tainted: G L syzkaller #0 PREEMPT(full) [ 464.177791][T17550] Tainted: [L]=SOFTLOCKUP [ 464.177799][T17550] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 464.177810][T17550] Call Trace: [ 464.177817][T17550] [ 464.177825][T17550] dump_stack_lvl+0x100/0x190 [ 464.177856][T17550] should_fail_ex.cold+0x5/0xa [ 464.177880][T17550] should_failslab+0xc2/0x120 [ 464.177904][T17550] __kmalloc_cache_noprof+0x91/0x6d0 [ 464.177957][T17550] ? refill_pi_state_cache+0x91/0x260 [ 464.177985][T17550] refill_pi_state_cache+0x91/0x260 [ 464.178007][T17550] futex_requeue+0x8a4/0x22e0 [ 464.178030][T17550] ? __pfx_futex_wake_mark+0x10/0x10 [ 464.178054][T17550] ? find_held_lock+0x2b/0x80 [ 464.178073][T17550] ? __pfx_futex_requeue+0x10/0x10 [ 464.178109][T17550] ? rcu_read_lock_any_held+0x6a/0x90 [ 464.178128][T17550] ? find_held_lock+0x2b/0x80 [ 464.178152][T17550] do_futex+0x3ae/0x440 [ 464.178172][T17550] ? __pfx_do_futex+0x10/0x10 [ 464.178190][T17550] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 464.178224][T17550] __ia32_sys_futex_time32+0x2f4/0x470 [ 464.178256][T17550] ? fput+0x7c/0x100 [ 464.178283][T17550] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 464.178309][T17550] ? ksys_write+0x1ac/0x250 [ 464.178333][T17550] ? __pfx_ksys_write+0x10/0x10 [ 464.178364][T17550] __do_fast_syscall_32+0x13a/0x8b0 [ 464.178397][T17550] do_fast_syscall_32+0x32/0x70 [ 464.178428][T17550] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 464.178459][T17550] RIP: 0023:0xf7f75fec [ 464.178499][T17550] Code: Unable to access opcode bytes at 0xf7f75fc2. [ 464.178511][T17550] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 464.178537][T17550] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000000000c [ 464.178555][T17550] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000080048000 [ 464.178570][T17550] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 464.178584][T17550] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 464.178598][T17550] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 464.178632][T17550] [ 464.660722][T17559] gadgetfs: bound to dummy_udc driver [ 465.109591][T17575] overlayfs: workdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 465.963072][ T44] audit: type=1800 audit(1787915139.806:207): pid=17601 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.4649" name="dbroot" dev="configfs" ino=65939 res=0 errno=0 [ 466.575444][T17618] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4657'. [ 466.575553][T17618] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4657'. [ 466.881662][T17630] vivid-000: disconnect [ 466.929125][ T77] vivid-000: reconnect [ 467.033087][T17644] fuse_uring_cmd: 3150 callbacks suppressed [ 467.036630][T17644] No fuse device found [ 467.036712][T17644] No fuse device found [ 467.067105][T17644] No fuse device found [ 467.079550][T17644] No fuse device found [ 467.079669][T17644] No fuse device found [ 467.079713][T17644] No fuse device found [ 467.079755][T17644] No fuse device found [ 467.079798][T17644] No fuse device found [ 467.079840][T17644] No fuse device found [ 467.079884][T17644] No fuse device found [ 468.524878][T17674] loop4: detected capacity change from 0 to 7 [ 468.535703][T17674] Dev loop4: unable to read RDB block 7 [ 468.535789][T17674] loop4: unable to read partition table [ 468.536168][T17674] loop4: partition table beyond EOD, truncated [ 468.536185][T17674] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 469.196025][T17694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 469.196439][T17694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 469.244304][T17680] lo speed is unknown, defaulting to 1000 [ 469.479337][T17696] lo speed is unknown, defaulting to 1000 [ 469.974925][T17703] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4694'. [ 469.977461][T17703] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4694'. [ 470.139989][T17707] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 472.366491][T17757] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4717'. [ 473.216519][T17765] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.251539][T17781] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4724'. [ 473.350760][T17779] lo speed is unknown, defaulting to 1000 [ 473.464258][T17786] IPv4: Oversized IP packet from 127.202.26.0 [ 473.753996][T17765] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.938758][T17765] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.158520][T17765] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.452941][ T7554] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.506104][ T7554] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.590640][ T7557] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.651273][ T5816] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.823662][T17798] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4731'. [ 474.837165][T17798] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4731'. [ 474.841546][T17798] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4731'. [ 476.169320][T17840] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4747'. [ 476.221550][T17840] 8021q: adding VLAN 0 to HW filter on device bond6 [ 476.360181][T17842] 8021q: adding VLAN 0 to HW filter on device bond6 [ 476.360614][T17842] bond6: (slave gre1): The slave device specified does not support setting the MAC address [ 476.361635][T17842] bond6: (slave gre1): Error -95 calling set_mac_address [ 478.656008][T17885] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4765'. [ 478.683883][T17885] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4765'. [ 478.858420][T17888] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4764'. [ 480.002300][T17898] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 482.396729][ T25] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 482.667051][ T25] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 482.865468][T17984] netlink: 'syz.3.4804': attribute type 10 has an invalid length. [ 482.943168][T17986] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4803'. [ 482.963037][T17986] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4803'. [ 483.275846][T17992] netlink: 'syz.3.4808': attribute type 10 has an invalid length. [ 483.335906][T17992] dummy0: entered promiscuous mode [ 483.365913][T17992] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 483.378806][ T1345] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 483.381538][T17993] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 483.381575][T17993] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 483.381609][T17993] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 483.417394][T17993] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 483.441582][T17972] ceph: No mds server is up or the cluster is laggy [ 483.647874][T18003] fuse: fd is not a fuse device [ 483.715800][T18003] fuse: fd is not a fuse device [ 483.716781][T18003] fuse: fd is not a fuse device [ 483.870021][T18001] lo speed is unknown, defaulting to 1000 [ 484.329109][T18015] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4816'. [ 484.781282][T18028] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 485.859405][T18034] A link change request failed with some changes committed already. Interface sit2 may have been left with an inconsistent configuration, please check. [ 487.010314][ T44] audit: type=1326 audit(1787915160.866:208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18051 comm="syz.5.4825" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf702efec code=0x0 [ 489.880671][T18115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 489.881211][T18115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.211786][T18122] netlink: 1319 bytes leftover after parsing attributes in process `syz.2.4854'. [ 490.757547][T18142] vhci_hcd vhci_hcd.0: Expecting SOCK_STREAM - found 3 [ 490.788582][T18144] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.790567][T18144] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.922529][ T5096] Bluetooth: hci2: Malformed MSFT vendor event: 0x02 [ 491.735538][T18156] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4867'. [ 492.010291][T18160] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4868'. [ 492.020315][T18160] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 492.020334][T18160] IPv6: NLM_F_CREATE should be set when creating new route [ 494.607871][ T5096] Bluetooth: hci1: unexpected event for opcode 0x0c24 [ 494.804040][T18209] 9p: Invalid gid '0x00000000ffffffff' [ 495.181456][T18220] loop5: detected capacity change from 0 to 7 [ 495.217768][T18220] Dev loop5: unable to read RDB block 7 [ 495.217876][T18220] loop5: unable to read partition table [ 495.219494][T18220] loop5: partition table beyond EOD, truncated [ 495.219787][T18220] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 497.312606][T18287] bridge0: port 4(syz_tun) entered blocking state [ 497.312742][T18287] bridge0: port 4(syz_tun) entered disabled state [ 497.312914][T18287] syz_tun: entered allmulticast mode [ 497.369387][T18287] syz_tun: entered promiscuous mode [ 497.372132][T18287] bridge0: port 4(syz_tun) entered blocking state [ 497.372235][T18287] bridge0: port 4(syz_tun) entered listening state [ 497.378095][T18287] bridge0: port 5(batadv0) entered blocking state [ 497.378162][T18287] bridge0: port 5(batadv0) entered disabled state [ 497.378294][T18287] batadv0: entered allmulticast mode [ 497.379721][T18287] batadv0: entered promiscuous mode [ 497.389390][ T12] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 497.389411][ T12] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 497.424860][T18287] bridge0: port 5(batadv0) entered blocking state [ 497.424941][T18287] bridge0: port 5(batadv0) entered listening state [ 498.788000][T18320] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4935'. [ 500.661063][T18367] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4957'. [ 501.012124][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.012203][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.088597][ T28] numa_remove_cpu cpu 1 node 0: mask now 0,2-3 [ 501.088630][ T28] numa_remove_cpu cpu 1 node 1: mask now 0,2-3 [ 501.100157][ T28] ================================================================== [ 501.100175][ T28] BUG: KASAN: slab-use-after-free in irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 501.100215][ T28] Read of size 8 at addr ffff88806cfa99a8 by task migration/1/28 [ 501.100232][ T28] [ 501.100243][ T28] CPU: 1 UID: 0 PID: 28 Comm: migration/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 501.100271][ T28] Tainted: [L]=SOFTLOCKUP [ 501.100278][ T28] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 501.100289][ T28] Stopper: multi_cpu_stop+0x0/0x4b0 <- __stop_cpus.constprop.0+0xb1/0x140 [ 501.100339][ T28] Call Trace: [ 501.100348][ T28] [ 501.100361][ T28] dump_stack_lvl+0x100/0x190 [ 501.100385][ T28] print_report+0x13d/0x4b0 [ 501.100413][ T28] ? __virt_addr_valid+0x239/0x430 [ 501.100441][ T28] ? irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 501.100470][ T28] kasan_report+0xdf/0x1c0 [ 501.100494][ T28] ? irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 501.100525][ T28] irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 501.100555][ T28] ? native_cpu_disable+0x54/0x80 [ 501.100583][ T28] ? __pfx_take_cpu_down+0x10/0x10 [ 501.100609][ T28] fixup_irqs+0x2b/0x280 [ 501.100636][ T28] ? __pfx_take_cpu_down+0x10/0x10 [ 501.100661][ T28] native_cpu_disable+0x59/0x80 [ 501.100687][ T28] take_cpu_down+0xb6/0x190 [ 501.100714][ T28] multi_cpu_stop+0x16a/0x4b0 [ 501.100744][ T28] ? __stop_cpus.constprop.0+0xb1/0x140 [ 501.100772][ T28] ? __pfx_multi_cpu_stop+0x10/0x10 [ 501.100800][ T28] cpu_stopper_thread+0x21e/0x450 [ 501.100831][ T28] ? __pfx_cpu_stopper_thread+0x10/0x10 [ 501.100859][ T28] smpboot_thread_fn+0x3d3/0xab0 [ 501.100897][ T28] ? kthread+0x13a/0x450 [ 501.100914][ T28] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 501.100942][ T28] kthread+0x373/0x450 [ 501.100960][ T28] ? __pfx_kthread+0x10/0x10 [ 501.100980][ T28] ret_from_fork+0x730/0xd60 [ 501.101008][ T28] ? __pfx_ret_from_fork+0x10/0x10 [ 501.101036][ T28] ? __switch_to+0x800/0x10f0 [ 501.101058][ T28] ? __pfx_kthread+0x10/0x10 [ 501.101077][ T28] ret_from_fork_asm+0x1a/0x30 [ 501.101110][ T28] [ 501.101117][ T28] [ 501.101122][ T28] Allocated by task 12: [ 501.101131][ T28] kasan_save_stack+0x30/0x50 [ 501.101150][ T28] kasan_save_track+0x14/0x30 [ 501.101166][ T28] __kasan_kmalloc+0xaa/0xb0 [ 501.101182][ T28] __kmalloc_node_track_caller_noprof+0x33d/0x870 [ 501.101201][ T28] kmalloc_reserve+0xe8/0x350 [ 501.101221][ T28] pskb_expand_head+0x249/0x10e0 [ 501.101237][ T28] batadv_skb_head_push+0xec/0x280 [ 501.101261][ T28] batadv_send_skb_packet+0xe9/0x6e0 [ 501.101282][ T28] batadv_iv_send_outstanding_bat_ogm_packet+0x6a2/0x7d0 [ 501.101304][ T28] process_one_work+0xac7/0x1b10 [ 501.101324][ T28] worker_thread+0x5ef/0xe50 [ 501.101342][ T28] kthread+0x373/0x450 [ 501.101358][ T28] ret_from_fork+0x730/0xd60 [ 501.101382][ T28] ret_from_fork_asm+0x1a/0x30 [ 501.101409][ T28] [ 501.101413][ T28] Freed by task 12: [ 501.101422][ T28] kasan_save_stack+0x30/0x50 [ 501.101440][ T28] kasan_save_track+0x14/0x30 [ 501.101459][ T28] kasan_save_free_info+0x3b/0x70 [ 501.101484][ T28] __kasan_slab_free+0x5f/0x80 [ 501.101505][ T28] kfree+0x22b/0x6d0 [ 501.101528][ T28] skb_free_head+0xb9/0x160 [ 501.101553][ T28] skb_release_data+0x6c5/0x8e0 [ 501.101570][ T28] sk_skb_reason_drop+0x102/0x1b0 [ 501.101589][ T28] __netif_receive_skb_core.constprop.0+0x571/0x3530 [ 501.101618][ T28] __netif_receive_skb_one_core+0xb0/0x1e0 [ 501.101644][ T28] __netif_receive_skb+0x1f/0x120 [ 501.101669][ T28] process_backlog+0x487/0x1600 [ 501.101693][ T28] __napi_poll.constprop.0+0xaf/0x450 [ 501.101719][ T28] net_rx_action+0xa40/0xf20 [ 501.101744][ T28] handle_softirqs+0x1e6/0x9d0 [ 501.101802][ T28] do_softirq+0xaf/0xf0 [ 501.101825][ T28] __local_bh_enable_ip+0xff/0x120 [ 501.101851][ T28] __dev_queue_xmit+0xa27/0x4970 [ 501.101882][ T28] batadv_send_skb_packet+0x53a/0x6e0 [ 501.101904][ T28] batadv_iv_send_outstanding_bat_ogm_packet+0x6a2/0x7d0 [ 501.101926][ T28] process_one_work+0xac7/0x1b10 [ 501.101944][ T28] worker_thread+0x5ef/0xe50 [ 501.101963][ T28] kthread+0x373/0x450 [ 501.101980][ T28] ret_from_fork+0x730/0xd60 [ 501.102006][ T28] ret_from_fork_asm+0x1a/0x30 [ 501.102031][ T28] [ 501.102036][ T28] The buggy address belongs to the object at ffff88806cfa9800 [ 501.102036][ T28] which belongs to the cache kmalloc-1k of size 1024 [ 501.102051][ T28] The buggy address is located 424 bytes inside of [ 501.102051][ T28] freed 1024-byte region [ffff88806cfa9800, ffff88806cfa9c00) [ 501.102070][ T28] [ 501.102075][ T28] The buggy address belongs to the physical page: [ 501.102084][ T28] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806cfab800 pfn:0x6cfa8 [ 501.102101][ T28] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 501.102116][ T28] flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff) [ 501.102135][ T28] page_type: f5(slab) [ 501.102150][ T28] raw: 04fff00000000240 ffff88801c042dc0 ffffea00013bf810 ffffea000131a610 [ 501.102169][ T28] raw: ffff88806cfab800 0000000000100009 00000000f5000000 0000000000000000 [ 501.102188][ T28] head: 04fff00000000240 ffff88801c042dc0 ffffea00013bf810 ffffea000131a610 [ 501.102208][ T28] head: ffff88806cfab800 0000000000100009 00000000f5000000 0000000000000000 [ 501.102225][ T28] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 501.102245][ T28] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 501.102257][ T28] page dumped because: kasan: bad access detected [ 501.102268][ T28] page_owner tracks the page as allocated [ 501.102276][ T28] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1076, tgid 1076 (kworker/u33:8), ts 41486551917 [ 501.102312][ T28] post_alloc_hook+0xfd/0x120 [ 501.102341][ T28] get_page_from_freelist+0x110d/0x35b0 [ 501.102372][ T28] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 501.102404][ T28] new_slab+0xa9/0x6e0 [ 501.102433][ T28] refill_objects+0xe3/0x410 [ 501.102464][ T28] __pcs_replace_empty_main+0x35e/0x650 [ 501.102494][ T28] __kmalloc_noprof+0x67c/0x840 [ 501.102516][ T28] ieee802_11_parse_elems_full+0x17c/0x3c90 [ 501.102549][ T28] ieee80211_ibss_rx_queued_mgmt+0xc96/0x1c70 [ 501.102580][ T28] ieee80211_iface_work+0xa9a/0x1070 [ 501.102610][ T28] cfg80211_wiphy_work+0x2b7/0x550 [ 501.102637][ T28] process_one_work+0xac7/0x1b10 [ 501.102659][ T28] worker_thread+0x5ef/0xe50 [ 501.102681][ T28] kthread+0x373/0x450 [ 501.102700][ T28] ret_from_fork+0x730/0xd60 [ 501.102729][ T28] ret_from_fork_asm+0x1a/0x30 [ 501.102760][ T28] page last free pid 5746 tgid 5746 ts 41477966168 stack trace: [ 501.102776][ T28] __free_frozen_pages+0x79f/0x10f0 [ 501.102803][ T28] qlist_free_all+0x47/0xf0 [ 501.102823][ T28] kasan_quarantine_reduce+0x1a0/0x1f0 [ 501.102844][ T28] __kasan_slab_alloc+0x69/0x90 [ 501.102868][ T28] __kmalloc_noprof+0x2cc/0x840 [ 501.102895][ T28] tomoyo_realpath_from_path+0xb6/0x690 [ 501.102927][ T28] tomoyo_check_open_permission+0x2af/0x3c0 [ 501.102953][ T28] tomoyo_file_open+0x6b/0x90 [ 501.102983][ T28] security_file_open+0xb5/0x1e0 [ 501.103011][ T28] do_dentry_open+0x588/0x14d0 [ 501.103032][ T28] vfs_open+0x82/0x3f0 [ 501.103056][ T28] path_openat+0x19fa/0x2440 [ 501.103078][ T28] do_file_open+0x20e/0x430 [ 501.103098][ T28] do_sys_openat2+0x10f/0x1e0 [ 501.103122][ T28] __x64_sys_openat+0x12d/0x210 [ 501.103147][ T28] do_syscall_64+0x121/0x770 [ 501.103170][ T28] [ 501.103175][ T28] Memory state around the buggy address: [ 501.103187][ T28] ffff88806cfa9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 501.103202][ T28] ffff88806cfa9900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 501.103217][ T28] >ffff88806cfa9980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 501.103228][ T28] ^ [ 501.103240][ T28] ffff88806cfa9a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 501.103255][ T28] ffff88806cfa9a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 501.103267][ T28] ================================================================== [ 501.103280][ T28] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 501.879282][ T28] CPU: 1 UID: 0 PID: 28 Comm: migration/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 501.887652][ T28] Tainted: [L]=SOFTLOCKUP [ 501.892772][ T28] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 501.901234][ T28] Stopper: multi_cpu_stop+0x0/0x4b0 <- __stop_cpus.constprop.0+0xb1/0x140 [ 501.905482][ T28] Call Trace: [ 501.908467][ T28] [ 501.910955][ T28] dump_stack_lvl+0x100/0x190 [ 501.914192][ T28] vpanic+0x553/0x970 [ 501.916665][ T28] ? __pfx_vpanic+0x10/0x10 [ 501.919341][ T28] ? __pfx_vprintk_emit+0x10/0x10 [ 501.921946][ T28] ? irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 501.925885][ T28] panic+0xd1/0xe0 [ 501.928669][ T28] ? __pfx_panic+0x10/0x10 [ 501.931569][ T28] check_panic_on_warn.cold+0x19/0x34 [ 501.935225][ T28] end_report.part.0+0x3a/0x90 [ 501.938364][ T28] kasan_report.cold+0xe/0x18 [ 501.941023][ T28] ? irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 501.944740][ T28] irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 501.949451][ T28] ? native_cpu_disable+0x54/0x80 [ 501.952798][ T28] ? __pfx_take_cpu_down+0x10/0x10 [ 501.956019][ T28] fixup_irqs+0x2b/0x280 [ 501.959072][ T28] ? __pfx_take_cpu_down+0x10/0x10 [ 501.962087][ T28] native_cpu_disable+0x59/0x80 [ 501.966215][ T28] take_cpu_down+0xb6/0x190 [ 501.969458][ T28] multi_cpu_stop+0x16a/0x4b0 [ 501.972829][ T28] ? __stop_cpus.constprop.0+0xb1/0x140 [ 501.976204][ T28] ? __pfx_multi_cpu_stop+0x10/0x10 [ 501.979128][ T28] cpu_stopper_thread+0x21e/0x450 [ 501.981831][ T28] ? __pfx_cpu_stopper_thread+0x10/0x10 [ 501.984418][ T28] smpboot_thread_fn+0x3d3/0xab0 [ 501.986700][ T28] ? kthread+0x13a/0x450 [ 501.989458][ T28] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 501.993021][ T28] kthread+0x373/0x450 [ 501.995701][ T28] ? __pfx_kthread+0x10/0x10 [ 501.998861][ T28] ret_from_fork+0x730/0xd60 [ 502.001858][ T28] ? __pfx_ret_from_fork+0x10/0x10 [ 502.005349][ T28] ? __switch_to+0x800/0x10f0 [ 502.008704][ T28] ? __pfx_kthread+0x10/0x10 [ 502.012938][ T28] ret_from_fork_asm+0x1a/0x30 [ 502.016464][ T28] [ 503.377198][ T28] Shutting down cpus with NMI [ 503.391727][ T28] Kernel Offset: disabled [ 503.395051][ T28] Rebooting in 86400 seconds.. VM DIAGNOSIS: 11:01:59 Registers: info registers vcpu 0 CPU#0 RAX=dffffc0000000000 RBX=0000000000000000 RCX=0000000000000001 RDX=1ffffffff1cd6d24 RSI=ffffffff81d1503f RDI=ffffffff8e6b6920 RBP=00000000000036b0 RSP=ffffc9000046fcf8 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000 R12=0000000100004e04 R13=ffffffff8ea0f280 R14=0000000100004e06 R15=ffffffff948b7238 RIP=ffffffff81d1506d RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88809696d000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000ffcc2d6c CR3=0000000051e4a000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000020 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85ad2db5 RDI=ffffffff9bc4a0a0 RBP=ffffffff9bc4a060 RSP=ffffc900005673e8 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=20666f2064616552 R12=0000000000000000 R13=0000000000000020 R14=0000000000000000 R15=ffffc90000567700 RIP=ffffffff85ad2ddf RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096a6d000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000080000200 CR3=000000000eb96000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000008 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000007400000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000000 RBX=0000000000000003 RCX=0000000000000001 RDX=ffff88801cf50000 RSI=0000000000000003 RDI=0000000000000003 RBP=ffffc9000750f92c RSP=ffffc9000050fd28 R8 =0000000000000005 R9 =0000000000000004 R10=0000000000000003 R11=0000000000000000 R12=ffffc9000750f908 R13=fffff52000ea1f25 R14=0000000000000003 R15=0000000000000003 RIP=ffffffff820b1ce0 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096b6d000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000000c2df21b CR3=000000004dde8000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=8000000000000001 RBX=0000000000000003 RCX=ffffffff82076a9b RDX=ffff88801d30cb00 RSI=ffffffff82076a2d RDI=ffff88801d30cb00 RBP=ffffc9000750f92c RSP=ffffc900005bfd28 R8 =0000000000000005 R9 =0000000000000004 R10=0000000000000003 R11=0000000000000000 R12=ffffc9000750f908 R13=fffff52000ea1f25 R14=0000000000000003 R15=0000000000000003 RIP=ffffffff820b2348 RFL=00000093 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096c6d000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f507e0af CR3=000000004dde8000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 6d10f89e36847919 ba6545c02ca46b6e ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a321a06e9e931fdf d36f41910b262066 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 680b973a92d5095b fb2394bf23aafd0d ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a072c1e00021b592 468bfd61f2a69cad ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000ffffffff 00000000000000b4 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000034 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 7b2e7f879f5ecb30 5143615ff088db3c ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 b9ab068d1b83ec3b 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 4bb915393d4cca48 c35ad1cdd34e92c9 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 453815dc00000000 8be47980f0822e36 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 50c2af4aeec394d1 e0ada32c6814380b ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 4167f0127d443798 e664de603c80164d ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a54ff53a3c6ef372 bb67ae856a09e667 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 5be0cd191f83d9ab 9b05688c510e527f ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000