last executing test programs: 8.398385763s ago: executing program 0 (id=2640): socket$kcm(0x21, 0x7, 0x2) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000640)={0xfffffffb}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="280000001200970200000000000000000700", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x28}}, 0x0) socket$packet(0x11, 0x2, 0x300) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000400)='ns/cgroup\x00') r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000500)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@float={0x6}]}, {0x0, [0x5f, 0x2e, 0x61, 0x61, 0x30]}}, 0x0, 0x2b, 0x0, 0x1, 0x4}, 0x28) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./tracing/events/sched/filter\x00', 0x1, 0x0) write$binfmt_format(r7, &(0x7f0000000580)='0\x00', 0x2) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000005c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r9, 0x40345410, &(0x7f0000000600)={{0x3, 0x0, 0x0, 0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r9, 0x54a2) r10 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GCALLUSERDATA(r10, 0x89e4, &(0x7f0000000740)={0x5c, "8aabe904a2326e0ddfe99fe233644dceab9eda5cd474cb98466e93f8b5536ab2587d629119119253e3b1adc8bcde96fb90c7b65e906be0c4e082f7b328270492ea3aa52ce149657a21c68cd9d0ccd091703d814d09587683467cd5bdc116b54b0d493aee37cebe6d8a00277bc8e71ba1f7231d6c04f8b9d77ca7acfec21a8471"}) r11 = dup(r8) syz_ublk_setup_queues(r11, r6, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 7.525586114s ago: executing program 1 (id=2644): socket(0x10, 0x803, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c09425, &(0x7f0000000380)={"b8e50a31a002b94fcd8fc4db3056309d", 0x0, 0x0, {0x7, 0x100}, {0x0, 0x5}, 0x7, [0x7, 0x3, 0xe, 0x4, 0x9, 0x1, 0xd8e, 0x7fc0004, 0x5, 0x0, 0x6, 0x3, 0x5, 0x49, 0xfffffffffffffffe, 0xc]}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="14010000300001000000000000000000040100800c0002000000000000000000140001000100000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0e99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767fc734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8c"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) write(r0, &(0x7f0000000440)="4155952e57093ff78f678d9cb0de3531a79a434e41fa8b5cb5367cb7fe6a2ba934ccb435f22b23a1178766f8ed54e1a927f26f1b7e1c5163d2", 0x39) openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0xffffffffffffff7c, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) r3 = openat$ttynull(0xffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000380)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0xfffffffffffffeef, &(0x7f0000000240)=0x2) r6 = openat$hpet(0xffffffffffffff9c, 0x0, 0x80080, 0x0) ioctl$BLKTRACESETUP(r6, 0x80186803, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000800)=ANY=[@ANYBLOB="611234000000000061134c0000000000bf2000000000000015000200000001103d030100000000009500000000000000bc26000000000000bf67000000000000070300000fff070067020000030000001606000000000078bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f909ad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305865050df26469fac5202d6293c3d5e11f4f83e7455baeeba4f"], &(0x7f0000000100)='GPL\x00'}, 0x48) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="08010000100033060000000000200000fc000000000000000000000000000000fc01000000000000000000000000000000000000000000000000000016000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000040000002b000000ffffffff00000000000000000000000000000080000000000000000000000000140b0000000000000000000000000000000000000000000002000000000000000000000000000000040000000000000003000000000000000100000000000000800000000000000000000000000000000000000062000000feffffff28bd70000000000002000004000000001c000400020000034e2300"/186], 0x108}, 0x1, 0x0, 0x0, 0x4040080}, 0x8000) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) chroot(&(0x7f0000000200)='./file0\x00') 6.921113625s ago: executing program 0 (id=2645): r0 = memfd_create(&(0x7f0000002640)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf13\xf3\x82O\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff,\x190x0}) sched_setscheduler(r6, 0x1, &(0x7f0000000000)=0x40) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x4040040}, 0x56592a445bc89e6d) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r10, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) 5.730954173s ago: executing program 1 (id=2650): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000080)={0x9, 0x3831354f, 0x1, @stepwise={0xda, 0x100, 0x8000, 0x80000000, 0x0, 0x9}}) syz_open_dev$tty1(0xc, 0x4, 0x4) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$FBIOPUT_CON2FBMAP(0xffffffffffffffff, 0x4610, &(0x7f0000000500)={0x29}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f00000000c0)={'dac02\x00', [0x300, 0x1, 0x5, 0x2000, 0x2, 0xffffffff, 0x8, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x200000, 0x0, 0x0, 0x4, 0x0, 0xfffffffe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x8, 0x3, 0xffffe]}) r2 = landlock_create_ruleset(&(0x7f00000001c0)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r2, 0x9) r3 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x14b102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000040)={@desc={0x1, 0x0, @desc3}}) ioctl$SIOCSIFHWADDR(r4, 0x8923, &(0x7f0000000240)={'bridge_slave_1\x00', @random="01320136b1ff"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'vxcan1\x00'}) r6 = socket$netlink(0x10, 0x3, 0x4) ioctl$sock_SIOCBRDELBR(r6, 0x89a2, 0x0) socket(0x15, 0x800, 0x5d51) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000140)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(0xffffffffffffffff, 0xc0585605, &(0x7f00000000c0)={0x1, 0x0, {0x1, 0x0, 0x3009, 0x4, 0xc, 0x0, 0x5, 0x4}}) 5.654502894s ago: executing program 0 (id=2651): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000004c0)='./file0/file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRES16=0x0, @ANYBLOB=',rootmode=00000000000r_id=\x00'/42, @ANYRESDEC=0x0, @ANYRES8=0x0, @ANYRESDEC=0x0]) syz_emit_ethernet(0x2a, &(0x7f0000000500)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x64, 0x0, 0x48, 0x1, 0x0, @rand_addr=0x64010102, @local}, @echo_reply={0x0, 0x0, 0x0, 0x1234, 0x1}}}}}, 0x0) write$FUSE_INIT(r0, &(0x7f0000000400)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x10, 0x1c20040, 0x0, 0x0, 0xc0000000, 0x1, 0x0, 0x0, 0x100}}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x180) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='7', 0x1) syz_open_dev$radio(&(0x7f0000000300), 0x3, 0x2) 5.53756127s ago: executing program 0 (id=2652): syz_usb_connect(0x0, 0x0, 0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x403}}]}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x4000) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000002c40)=ANY=[], 0x40c}, 0x1, 0x0, 0x0, 0x90}, 0x8000) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000240)=@gcm_128={{0x304, 0x38}, "b575c2c1c3a227b7", "799298c9493f4cbdfb5868d41337f3a2", "8df6bd29", 'H\x00'}, 0x28) syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), r1) 5.460010625s ago: executing program 1 (id=2653): socket$kcm(0x21, 0x7, 0x2) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000640)={0xfffffffb}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="280000001200970200000000000000000700", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x28}}, 0x0) socket$packet(0x11, 0x2, 0x300) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000400)='ns/cgroup\x00') r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000500)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@float={0x6}]}, {0x0, [0x5f, 0x2e, 0x61, 0x61, 0x30]}}, 0x0, 0x2b, 0x0, 0x1, 0x4}, 0x28) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./tracing/events/sched/filter\x00', 0x1, 0x0) write$binfmt_format(r7, &(0x7f0000000580)='0\x00', 0x2) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000005c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r9, 0x40345410, &(0x7f0000000600)={{0x3, 0x0, 0x0, 0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r9, 0x54a2) r10 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GCALLUSERDATA(r10, 0x89e4, &(0x7f0000000740)={0x5c, "8aabe904a2326e0ddfe99fe233644dceab9eda5cd474cb98466e93f8b5536ab2587d629119119253e3b1adc8bcde96fb90c7b65e906be0c4e082f7b328270492ea3aa52ce149657a21c68cd9d0ccd091703d814d09587683467cd5bdc116b54b0d493aee37cebe6d8a00277bc8e71ba1f7231d6c04f8b9d77ca7acfec21a8471"}) r11 = dup(r8) syz_ublk_setup_queues(r11, r6, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 5.260424034s ago: executing program 3 (id=2655): r0 = openat$comedi(0xffffff9c, &(0x7f0000000000)='/dev/comedi2\x00', 0x2001, 0x0) ioctl$COMEDI_BUFINFO(r0, 0xc02c640e, &(0x7f0000000040)={0x1ff, 0x5, 0x7, 0x401, 0x9, 0x5, 0x3e}) r1 = openat$sndseq(0xffffff9c, &(0x7f0000000080), 0x14202) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a45320, &(0x7f00000000c0)={{0x3, 0x5}, 'port1\x00', 0x8, 0x110008, 0x8, 0xe90, 0x0, 0xeb09, 0x3, 0x0, 0x6}) r2 = socket(0x9, 0x6, 0x1) r3 = syz_open_dev$sndpcmc(&(0x7f0000000180), 0x0, 0x230400) ioctl$SNDRV_PCM_IOCTL_WRITEN_FRAMES(r3, 0x400c4152, &(0x7f0000000440)={0x0, &(0x7f0000000400)=[&(0x7f00000001c0)="efab4edc712b7be1ca60ed49dc782122b94ab656d578f7d4307b18023ee12ced61d4b580ec0dff8fd50fd30780ae08cf30ddbcd92d2958bea611b65e5978cc1579ba30eea7ead7d115e09ee982241fe3d66f029a04f3461a2d18863b5d46be7bc7bfb2de92bd30f472ebc3d7fa91aef62219fb41617ea396ac54093d1f5ad172e3a0f6fe50177f7546a27b22923c0553a44c12", &(0x7f0000000280)="c2c4e171178d184bcc8fa43b53315d3d6152a51a34415854d7a613dc2aa2bb6e542c682068ed52dec3304ce8e40933ea5d4310a2a5c608ebc50b5f1001f30962795ef5ab48b927fa578517d62ff4aa8df56ee8b376940f", &(0x7f0000000300)="756db56aab415c450f63f049d0d842eeb5cb4f2522951d0c3895b60dd81137c460e36295fbcb3a9e3863f2119af9d01bb7abe0331f838a425d5ea9bc22940ed6b4e4385ad196a1501154f9ac62036e8828522ed26133c81d9fcff6a6f40c1ab80ba6c8c139c5d6d44aef4f4e643906e7178fb7ae76ce1b6944f2fdf96344603b2d03d15cde6a66e6d46041cb08ad39dfb217ea5d6f5c9f7a9e3cf0956e03603f56187aa9eaa9da2581d8e7550f9fafe428d6ba1e39b28f1430ad224e25948cc8a5d2e86d7206a99d52"], 0x3}) ioctl$F2FS_IOC_GARBAGE_COLLECT(r3, 0x4004f506, &(0x7f0000000480)=0x1) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0xc86) write$char_usb(r4, &(0x7f00000004c0)="c0f3aa6e00e2993ec0277f73c4321f4711a478b335dc7b36bd0a3a0ceda45c171102c2399327e81da85aac86514599089d213c074d4b1122becf1ee76837594d337db05cfcb01fbe4d6f6ddc537db84e9d7f68c7bf58975b327fbbf9ece7e43637b59f0280f6235b80fc6bcc59d402d74dbe4ca2d7f1fad410cbaed8a0096359823aecb4a6a03538382bc7865bbf32cde68d276ea24ce4", 0x97) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000600)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_UPDATE_FT_IES(r2, &(0x7f0000000ac0)={&(0x7f0000000580), 0xc, &(0x7f0000000a80)={&(0x7f0000000640)={0x3e4, r5, 0x8, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MDID={0x6}, @NL80211_ATTR_IE={0x22, 0x2a, [@ext_channel_switch={0x3c, 0x4, {0x0, 0x1c, 0x2e, 0xd}}, @ext_channel_switch={0x3c, 0x4, {0x7, 0x80, 0x74, 0x9b}}, @mic={0x8c, 0x10, {0x3df, "2e7d11d00b99", @short="e8c7bae3f3c7475b"}}]}, @NL80211_ATTR_MDID={0x6, 0xb1, 0xa0}, @NL80211_ATTR_IE={0x23c, 0x2a, [@ext_channel_switch={0x3c, 0x4, {0x0, 0x98, 0xad, 0xf3}}, @fast_bss_trans={0x37, 0x69, {0x8, 0x1, "b1e2e8dde69d00ecc5ee7e052752df03", "2597a1126b12000611b1b000aa8d1918cfe966e6a6473d55550b2e0b90ee54ca", "a5bceb40524c4fe5b91481fa8e5627f32481c24740e86a96c6de546f27a38016", [{0x2, 0x15, "4cc4f4203e5759b48fe59188ce7ccae231dc8fe034"}]}}, @ssid={0x0, 0x6, @default_ap_ssid}, @challenge={0x10, 0x1, 0x2b}, @tim={0x5, 0xf7, {0x0, 0x2f, 0xfd, "6865da81649076fff16d0014a83b56e0eb758b77582b2b74c9a211fc90a2287c3d05ae422647b4eb3b80d49ab3de85d6aed1ebff902bdcc94ded875c3660084eebabe00d542f1c8ff6e82ff682b1658cbbfb433ab0dec8192b4f676a2079679c631c8a222fad026f50d826f354173d723977a1b4bf32458100d0451df64e1f429fdb02d7729d5197b6ae78145961099169cdd109475cdd0dd412bcd04b1cddfcdc57d501516611ebbf9720bd9c7c09aa8cf42340e08e254da967f731567d04fc34f48e0accfe168036adff3f4868fd9900552f7acd6ea6658bddf6b63021db181d6ddfcd7e77e48d5c4259f99da3dd06bc1a7f58"}}, @prep={0x83, 0x1f, {{}, 0x4, 0x16, @broadcast, 0x0, @void, 0x200, 0xa, @device_b, 0x2}}, @tim={0x5, 0xa0, {0x9, 0x1f, 0x6, "8630f163d397c3f1cf41e23e785365a61c2d47cb471208521b5d18b867f8228c90bb9a58dfc36006fcf50342eb9764f62ad46e95001e326057de783d0368eba834340e798186697fb8fda7c18fc421d2290d7ed2c1ffa1761b0c3be4c30c65528f5d22ca96f333da15c6027a11e36841a4519fc7037915564d1f869ad61e25e5bdc0f3d89e655b660b63c06d522f5ced7a79fef5a333c792710d2a9004"}}]}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x5}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x5}, @NL80211_ATTR_IE={0x146, 0x2a, [@random={0x7f, 0x84, "43dc5c775f306d299beb5e6ccbae5345dcfeb589e330520c00396dadbc4d129524cdb3fd1cdf509b8093179c87e9fe11453e9caea89fcab5d14348d9cbc7ba88f6bcabf6b47cb79c163e24ca5085375aaa5ad3ee9fd995040340bc3551c5d2397fc6eaab43457f910d3e12f9691b7e18070a40a201f82074d94354d705ed63035693d3ba"}, @link_id={0x65, 0x12, {@random="59495ed42081"}}, @random={0x6, 0x68, "a8cd1e6bf47d7c5b42a3a7a8d8de6ad2522b7e3f69fac240fa6d6da17a0803d7eb2350690cae31719495cdce5f4ce202b358de6f786fed05f7988c8221dc7efacd135dd55c3be761a6479a60b3f0a0aa62660c1372de6faefb463d5e0c5e0433b90b608cff971fe2"}, @prep={0x83, 0x25, {{0x0, 0x1}, 0x4, 0x4, @device_a, 0x0, @value, 0x3, 0x5, @device_a, 0x6}}, @sec_chan_ofs={0x3e, 0x1, 0x2}, @link_id={0x65, 0x12, {@random="de860ed2ea96", @device_b, @broadcast}}]}]}, 0x3e4}, 0x1, 0x0, 0x0, 0x84}, 0x0) r7 = openat$bsg(0xffffff9c, &(0x7f0000000b00)='/dev/bsg/2:0:0:0\x00', 0x200480, 0x0) ioctl$SG_GET_PACK_ID(r7, 0x227c, &(0x7f0000000b40)) r8 = openat$rnullb(0xffffff9c, &(0x7f0000000b80)={'/dev/syzrnull', 0x0}, 0x10200, 0x0) ioctl$IOC_PR_REGISTER(r8, 0x401870c8, &(0x7f0000000bc0)={0x7, 0xe}) ioctl$SIOCX25SCALLUSERDATA(r2, 0x89e5, &(0x7f0000000c00)={0x31, "bce8b67255f09fccc1909a5e04644dcc5a7d1dcaac837871a7de86b2a04cd882194f56a27c134dd69a80d6f5f8679320268e79a9024bea17068c9ad3f6d1a3da22eef7a7106a74b7fa681426a985545cd218f897a35f65f5383266c8aa147239a025f6b802e496b73bfcad1a4db440db16c48be50ffcea0f9cf35afa2a55f939"}) r9 = openat$sndtimer(0xffffff9c, &(0x7f0000000cc0), 0x8000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r9, 0x40345410, &(0x7f0000000d00)={{0x2, 0x1, 0x4, 0x0, 0x6}}) r10 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r10, 0x0, 0x48c, &(0x7f0000000d40)={0x2, 'batadv_slave_1\x00', 0x2}, 0x18) r11 = syz_open_dev$audion(&(0x7f0000000d80), 0x10000, 0x80000) write$P9_RREMOVE(r11, &(0x7f0000000dc0)={0x7, 0x7b, 0x1}, 0x7) timer_create(0x0, &(0x7f0000000f40)={0x0, 0x3e, 0x0, @thr={&(0x7f0000000e00)="fb4d5606d283b9c1d8f9790d4f2a214986485804cbca18eb1312979dea81ee51a383aee01cb7fd2cd5bfeb3d9719b976526e9c874eaf135391dcfd9ea9f6", &(0x7f0000000e40)="d6e60ef3bce329b90eff5a3eebf9c5a929d2102b112086ab7f94a5b44922f4c39a01e1d45815ccdaaee46d8e82b1d8e26d6f1647b75862967e670f7787d4137a3dc02573d338590dfd1ff51c0bc8045106beb5d5155dd8247d0e1b9794d7b10a3c43b6fc7311109b55505c1f07d4a0298da56f514744a280393860e27d88f81b27dae950aece2ec6ea814dddfef51cfa5eed7808508ba6aa5aadf26c574481a234a24c06bc642808ad7b0fd244f4e512d89cbc3589eadd90d28bc799c15e1c437ba6d90c6ee74b88bce4e32903f247da1309a1d69f6fe306"}}, &(0x7f0000000f80)=0x0) clock_gettime(0x0, &(0x7f0000000fc0)={0x0, 0x0}) timer_settime(r12, 0x0, &(0x7f0000001000)={{0x0, 0x3938700}, {r13, r14+60000000}}, &(0x7f0000001040)) ioctl$UFFDIO_API(r11, 0xc018aa3f, &(0x7f0000001080)={0xaa, 0x40}) 5.198338861s ago: executing program 3 (id=2656): r0 = semget(0x1, 0x4, 0x39c) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x11, r1, 0x0) msync(&(0x7f0000ac9000/0x3000)=nil, 0x3000, 0x4) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x309042, 0x0) semctl$GETNCNT(r0, 0x4, 0xe, &(0x7f0000000340)=""/4096) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r2, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioperm(0x3, 0x9, 0x80) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) timer_getoverrun(r3) r4 = open(&(0x7f0000000280)='.\x00', 0x0, 0x70) fremovexattr(r4, &(0x7f0000000000)=@known='system.posix_acl_default\x00') unlink(&(0x7f0000000180)='./file1\x00') socketpair(0x1, 0x100000005, 0x0, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000140)) getpid() semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000200)) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@newlink={0xac, 0x10, 0x437, 0x0, 0x25dfdbec, {0x0, 0x0, 0x0, 0x0, 0x50403, 0x1}, [@IFLA_AF_SPEC={0x8c, 0x1a, 0x0, 0x1, [@AF_INET={0x30, 0x2, 0x0, 0x1, {0x2c, 0x1, 0x0, 0x1, [{0x8, 0xd, 0x0, 0x0, 0x101}, {0x8, 0x5, 0x0, 0x0, 0x5}, {0x8, 0x11}, {0x8, 0x1a, 0x0, 0x0, 0x8}, {0x8, 0x14, 0x0, 0x0, 0xe1}]}}, @AF_INET={0x58, 0x2, 0x0, 0x1, {0x54, 0x1, 0x0, 0x1, [{0x8, 0xf, 0x0, 0x0, 0xda}, {0x8, 0x16, 0x0, 0x0, 0x40}, {0x8, 0x3, 0x0, 0x0, 0x1}, {0x8, 0xd, 0x0, 0x0, 0xf}, {0x8, 0xb, 0x0, 0x0, 0x2}, {0x8, 0x5, 0x0, 0x0, 0xe}, {0x8, 0xb}, {0x8, 0xc, 0x0, 0x0, 0xa}, {0x8, 0x4, 0x0, 0x0, 0x9}, {0x8, 0xf}]}}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x40}, 0x4000) 4.877833695s ago: executing program 3 (id=2657): socket$kcm(0x10, 0x2, 0x0) syz_usb_connect(0x3, 0x3d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r0, &(0x7f0000000080)=""/131, 0x83) r1 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000140)=ANY=[@ANYRES32=r1], 0x0) syz_usb_connect$uac3(0x0, 0xb5, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) prctl$PR_SET_IO_FLUSHER(0x39, 0x1) bpf$MAP_CREATE(0x4400000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="0a00000008000000324900007f00000000000000", @ANYRES32=0x1, @ANYBLOB="00000000000080000017040001e9842eb00000000193444dab7556abbbc6447372cf314f8ab70a9069f9384dea9cd801e7163b4b490a1a2610962d5c793a38c0fdd5697378846438e76036ca7a067dbc37042c61ef7f429701161cbb7657f1e0afd084972fdeedad73e43e336405", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000feffffff00"/28], 0x50) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) socket$alg(0x26, 0x5, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r3, 0x0, 0x61, &(0x7f0000000300)={'filter\x00', 0x4}, 0x64) 4.699588096s ago: executing program 0 (id=2658): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x2, 0x0) unshare(0x100) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./debug\x00', 0x1ff) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/dynamic_debug/control\x00', 0x20a02, 0x14) write(r1, &(0x7f0000000180)='+p', 0x2) syz_usb_connect(0x0, 0x24, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000240)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1\x00', 0x1f7) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/devices/system/memory/memory2/state\x00', 0x1ff) mmap$dsp(&(0x7f0000ff3000/0xb000)=nil, 0xb000, 0x0, 0x4000010, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000340)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='usbip-vudc.0', 0xc) write(r2, &(0x7f0000000440)='\n', 0x1) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f0000000040)=""/19) 4.482852525s ago: executing program 1 (id=2659): capset(&(0x7f0000000940)={0x20071026}, &(0x7f0000000980)={0x200000, 0x200000}) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x20) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCMGET(r1, 0x5415, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0xd, 0x3, &(0x7f0000000b00)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000009000000dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359caa1af3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef682cc4375f594425d408ccc58187feb0e3d43347f989007a7c63f6dae2acb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259621818c3c75da31290bce645451b851111dd98ac4d8da9317c2c082020e0b2d634086785f3fe41a3053645cc413790faf7e229c782845b5bb774f7f154263178151ea93ff2cac4b181332c9c9a1c7d85616c8100000000000000d8300d19d585000000fc005774b56a7142047326f940e95b8489e1c5650f5c61299a295f39c88456391cffdef93e29f10f4a11f0cfbfc0ff976b20fef6033495b9b94777db9bb9b678ffc1130000009faa798226a080c01e47151268a02dc1a557cfdcf76305fbf6643df66b1b4d2d5e7bf698fc5a18d984ecb91e6683a5f522d536e2f3c43b89823659d1945258fc668950e5aacfffffffffffffff7f7a266c90e64efc8d8f730867202a9ee94e6a00"], &(0x7f0000000cc0)='GPL\x00', 0x5, 0x1f6, &(0x7f0000000d00)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000dc0), 0x1, 0x0, 0xffffffffffffffff, 0xf5010000}, 0x6d) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000e00)={r2, 0xe0, &(0x7f0000000e40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000f40), 0x0, 0x13, 0x10, 0x8, 0x0, 0x0}}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000580)='./nfsd\x00', &(0x7f00000005c0)='nfsd\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f0000000640)='0', 0xff7) r5 = io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x1b6e, 0x3800}) mkdirat(r4, &(0x7f00000004c0)='./nfsd\x00', 0x1) syz_usb_connect$cdc_ncm(0x5, 0x8d, &(0x7f00000002c0)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7b, 0x2, 0x1, 0x9, 0x50, 0x84, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x9, 0x24, 0x6, 0x0, 0x1, "4c51f2e8"}, {0x5, 0x24, 0x0, 0xe0}, {0xd, 0x24, 0xf, 0x1, 0x80, 0xfff7, 0x3, 0xfb}, {0x6, 0x24, 0x1a, 0x9, 0xa}, [@mbim_extended={0x8, 0x24, 0x1c, 0x1ff, 0x9, 0x9}, @dmm={0x7, 0x24, 0x14, 0xfff, 0x5}, @acm={0x4, 0x24, 0x2, 0x13}, @country_functional={0x8, 0x24, 0x7, 0x9b, 0x1059, [0x7]}]}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x5, 0x0, 0xf}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0x1, 0x2, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x2, 0x8, 0xe}}}}}}}]}}, &(0x7f0000000540)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x110, 0x4, 0xbb, 0x8, 0x8, 0x48}, 0x19, &(0x7f00000003c0)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x4, "0e9583a253dfd2eeda70dca5d2c9216e"}]}, 0x1, [{0xb1, &(0x7f0000000400)=@string={0xb1, 0x3, "3c418c2f325de27c52ba13f85453b3d892bd9ffadd9c268e6c2b52368d28e8228ee635d75dda49f68422c05bd6d57263e4c6bb91afcdfb88020b11423514c1ac0414d995cfaeb983fffde8aeef671794cc177e3872aa1bbf32fc1b4b257071f1daf8b16f64950e149374b30602d3f306d7a561e852c2608358f9a68166b61a2d0f8e07eb2a5e2b935cfadf9186f91b0ea838f0e6653064ddc026a373e83fe70f714259e838c34cd4500eb11ade9296"}}]}) openat$uhid(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r5, 0x20, &(0x7f0000000180)={0x0, 0x0, 0x1, 0x2, &(0x7f0000000200)={&(0x7f0000000240), 0x50}, &(0x7f0000000280)={&(0x7f00000002c0), 0x1000, 0x1}}, 0x1) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x301, 0x0, 0x0, {0x5}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000810}, 0x20004000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x800, 0x30f3, &(0x7f0000000500)=0x1) r6 = getpgid(0xffffffffffffffff) capset(&(0x7f0000000f80)={0x19980330, r6}, &(0x7f0000000fc0)={0x6, 0x80000000, 0xaf, 0x0, 0x90, 0x7ff}) 2.151005239s ago: executing program 2 (id=2661): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, r1, 0x1, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x3, 0x10, 0x0, &(0x7f00000006c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) shutdown(r0, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000700)={@random="0f38d8f21094", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "1200b0", 0x48, 0x3a, 0x1, @empty, @mcast2, {[], @dest_unreach={0x4, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, "277382", 0x0, 0x2c, 0x0, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', [@hopopts={0x2f, 0x1, '\x00', [@calipso={0x7, 0x8, {0x22ebffff, 0x0, 0x7}}]}]}}}}}}}, 0x0) 2.10814282s ago: executing program 2 (id=2662): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = syz_clone3(&(0x7f0000001440)={0x40020100, 0x0, 0x0, 0x0, {0x2d}, 0x0, 0x0, 0x0, 0x0}, 0x58) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000014c0)={'bridge0\x00', 0x0}) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001500), 0x42, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000001580), 0x0, &(0x7f00000015c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r3, 0xe503, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000001640), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000001680)={0x80001003, 0x0, 0x0, 'queue1\x00', 0xfffffffd}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=@base={0x5, 0x4, 0x2, 0x7, 0x0, 0x1, 0xe92}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x11, 0xd, &(0x7f0000001880)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xc3}}, @call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f0000001900)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000001940)={r6, r5}, 0xc) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r7 = userfaultfd(0x801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000001980)) ioctl$UFFDIO_CONTINUE(r7, 0xc020aa08, &(0x7f0000001a00)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r8, &(0x7f0000001a40)=[{&(0x7f0000001a80)=""/156, 0x9c}], 0x53, &(0x7f0000001b40)=[{&(0x7f0000001b80)=""/109, 0x20001c34}], 0x1, 0x0) write$sndseq(r4, &(0x7f0000001c00)=[{0x84, 0x77, 0x0, 0x0, @tick=0x1f4, {}, {}, @raw32={[0x2600]}}], 0xffc8) sendmsg$nl_route(r1, &(0x7f0000001c40)={0x0, 0x0, &(0x7f0000001c80)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="480000001c00110c0000001400000f0007000000", @ANYRES32=r2, @ANYBLOB="800202000a000200577f0000aabb000020000e80050001008f000000050001000100000004000200050001"], 0x48}}, 0x0) close(0xffffffffffffffff) getpgid(r0) munmap(&(0x7f0000bde000/0x1000)=nil, 0x1000) syz_emit_vhci(&(0x7f0000001d40)=ANY=[@ANYBLOB="043e1a37"], 0x1d) 1.699123745s ago: executing program 3 (id=2663): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x20c202) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r0, 0x0, 0x4000) bind$unix(0xffffffffffffffff, &(0x7f0000000180)=@file={0x1}, 0x6e) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x3) syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="040302"], 0x4) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0xa8002, 0x0) ioctl$EVIOCGPROP(r2, 0x40047438, &(0x7f0000000180)=""/246) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000280)}], 0x1) mmap(&(0x7f00005a7000/0x2000)=nil, 0x2000, 0x1000000, 0xa54820b2aab199de, r1, 0xfd337000) mount(0x0, &(0x7f0000000300)='./sys\x00', 0x0, 0x0, 0x0) writev(r2, &(0x7f00000007c0)=[{&(0x7f0000000800)="dd950d1df66887159a5b8c78e7284b8e367eafd5f234955292c25651bbc945f3651852f46cad7b0fc91efcb99dc012c03392261dd9fe28672d49ec45e2ca161afb54965271c91b046a17f170fd60bc14490507443bf9ec8abe3980e61b47272de2adea602059a31a2ce80ca13e78c74f5b7690833a05959dea0d9600b0c08472bf6a811c3dc60d9c488fc5b27a4246bd5af0c7d8d569c2d8ce8077ba555183254955bd8f5e932a23fd93bd867228e331edb31f45", 0xb4}, {&(0x7f00000004c0)="2e3c540b0546b15ebf28cd6a29c124709db201b10c5ad650cc411716580a4ba92f4af566a4416b51af27c69a2a9e7f4aba1cd07218bec33d1f8fe12d770aa97ec5944e6f49073be0b29aba2f29f8cd8a01234afcd366ca59a3a51b443e17533130910091d7fd7be492a4dbbcb80afa6b9b11ca56aa6b0970b824fab7de885540f8b4f9cb177fb7437fa4c3d48bd517dbeebe49bf9e58f6759aa7e90c93d9ebc972387dc795d422424a24df1e8af17908c8b82488ee9ca94a52c2256221f3e79bd2c262e73b64fb7fc7115211053e5dc26a48d50056a33d2d3564fba4d893cd959f0a72d96eae68", 0xe7}, {&(0x7f00000005c0)="43d7ac75d86b691ac6bd5861dba276f3529911022a284db2eae480f73341cf8312b5cd050d5b73f2a881ad421d72780c0ab1d3513b664618b22f02d96e8ea596b87f5b0f95e6447241bab45c68fd69cb5ccc8aedd812c6d7a115b50e54b4264932f7f5b5eb131af454a87ece0d4447fc6e3564f2820b899318d44c0a15396b38ac5558d75e2410692b08324d343b17d8dd1d581e2504d77599ff480ab3528196c53fd8b9d9d85f63a2b4c54e3b9bc305b39f961013e66ee06169133b6a", 0xbd}, {&(0x7f0000000680)="49fe46295ce7e6967391bb9a1c3018a86048fa40b6e8ccb39a5df069964fd6f69c8673", 0x23}, {&(0x7f0000000700)="a266df1bf6f4a13e5e74bd25fcc4770e51570785ebae57dcf5feb28e541f3e06cd8b98fc91eec571b8a3e67268c745ee076111f870fbf81cda38d3e3eb415f3cb9ac7e01210b5f4fec37bc67f0f4e1ece89fd88aec90935e2576f84d6dbceb04d259967177aba3619d19506e005aef302ccc6d156697f788631fbd8a44252e225be27a824e045fa3808d6f05d0cf4a9e9fe463dd7307bcd768e021a8e7b1bd0c48d2e263c43d4981389e6daed3ecbb002fed367d35dc98", 0xb7}], 0x5) openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/devices/system/cpu/smt/control\x00', 0x1, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./gadget\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000b80)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r3, &(0x7f0000000bc0)="0000000008020900010100803212010002000000402505a0a4000100000002", 0x1f) openat$ppp(0xffffff9c, &(0x7f0000000340), 0x449581, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000a80)={&(0x7f0000000940), 0xc, &(0x7f0000000a40)={&(0x7f0000000980)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_DELRULE={0x24, 0x8, 0xa, 0x101, 0x0, 0x0, {0xe, 0x0, 0x1}, [@NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}]}, @NFT_MSG_DELSET={0x54, 0xb, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1e}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_EXPR={0xc, 0x11, 0x0, 0x1, @dup={{0x8}, @void}}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x100000000}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0x5}, @NFTA_SET_POLICY={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xa0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040090) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 1.440454233s ago: executing program 2 (id=2664): r0 = memfd_create(&(0x7f0000002640)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf13\xf3\x82O\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff,\x190x0}) sched_setscheduler(r4, 0x1, &(0x7f0000000000)=0x40) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r8, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) 1.422301294s ago: executing program 0 (id=2665): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BTRFS_IOC_SNAP_DESTROY(r1, 0x5000940f, &(0x7f0000000240)={{r0}, "6615aa80ab4f1018d03939dc1f4913d0b36393a7be890b8c8099d2d6295faaa576da3ac725bbe24e2506810811945b36a8a17c0e7dfebe3be6ddeb3ad05f7c4840260edb7cca0b7a830bc2b416a8c190a79261cb10f5bb9ecac876ca938296132b5b983dbdacd8a7820690867dabb04f8478961b1f0a6b0674a49afe5b4cf32e5db4d5dd5ae1f7bba29cd1842c565bcabe22ee32e6d04e5b75ff1c993090ab50c99fc1378ef4b40c089ef1afb858135ede6ec48a2176c4f439cff10b011be3b4fba9d22929033987633eb65063b09882717439bff29ca760cecc0f00a2f1ef3a601dbde81814b176520158a6d1c7be176595fd5b8a8fe98743d5322ccb4d08d7d78145d0123f02c534476546068177aaf8ca4d843fc15e357f030f005f5a9e1a3a80116522babc1531479e706ab2e07281f14530cfa96bc74198b83c2c3e0d38cf431afc7da39d5b26135c4a6436001009abe66caa01db2f69ac06fe6cb2ff32b026c6575a5031c00fb6a4b6494143642d7b74a241b553ec53694f5f48f5f15b286fdb64c65e3923d309200082788f8c3082808625c1c097cb16ec1743bb5ee8c2402e1bda1414539696fea6557887ebc60e54549283364fe9aa238e86531f8186323b6b89ceffc219139133e93cfe933e7dfb337591815908880ccce1b8dccfcf18cbb657b6d0467cc26d3079ebb8a9ce1b88ecec2240d2eba7aaf1dd9b5089225d850adeab8d53da7b938bbd71e381441ab433e105f87c3a27d65c4cc0c6635923923a9d8bf716bc3e0a393bab0005380d184f4e4bcd2ee8288ba0d852b8d5ed1d4fcf7962c630a18b92e06cb777246362e3b58bae372bb8b51c64250f5f6725b42b91bcba1aab68a28826478083b29544cd85e165dcb159e28ccd16f3e7ba3e6843995e230478f3d47160f4a32b99fca47d586285991f00bf43f15ffec1d0b23f5efd51313c43a38ecb03bf054c057b240b3f1095b3de1b0c609229eb8bb2465e4c11016b2ab8557a30a03a36a2a3f91d4d5a76f5d47466b411ec7fdd6b5c48145b55146d4c24f6da0c38233c829bf2bd4bb286a5114546995c9dc0243c8249905317e0a12f4970dd576349f1fa2ef8e7e8a780a39fc723cb8794a6a126de2a1644de371b8d5bbaf0783a0de54338d892e284d645ebc6e3cc3fad2a2be56023f6f53164ffc11f3041cf5d6897691e6beb79d95f63ea0905d4b85d2d758f4fa5a933f6f58d746c731efc22e59cb9583273386b531af099af77a3e880e69abe32a7a9ef3f9d7b0ef9f852f77ff66668ab84981242c9eb4511ac119e9f01dbfbdd17a1fbfcffe1c0335d09a727600fca7b99ac08ff2c61a5efaa8c38b5bf37fc2c427b668f4156c294bfc2aad46c4fb92eba008dc754587e21a4d978962c92cb13d58214b8af19a87d87b493650f699cdec89a8117d505173be2f250f4812545db21d925c69bf9a8dc453fb116481002909ee4e69a17f018f3946bddb669728160335272757f65b9dab4ff71d1a534645c2549b96fb97496e4c6bc5af2eab51250a448393ba68c688851fcb899e2d5b37cabe2e253a5d2adc7da32adf8b8208c7cf0f55785edb7c585996076ce10f6d3695add14fbed09ae93497b48e3ac00137bc4add6f64b31add8b9b1df9381ebd3cb4bf6f83b0ccb643784992b4938cc5485fb53127508f98dd0a38c7e5616263f5ec0cc2caa332b9a754fc22fb787c8347fa72a69c31ad8c94878d1d4b83871cc41f9c75ccb6cf3b0a5218cd99ebb268e2272545fb1cbcd4b539305ce1cc2c68f6f902de49952cf1a67c078149226df1cdc3cc6ecb25318a8a606e6b2554087a169e760eabb797914b43dd7699ca2fb5660dcafe551c5cf46922435a614590c6b9fae8ec9684af4cc6eeca17e4e3c017d78b77b5e27bbdd6a70f0ffe0977585a7cf9b56cfdf4decd301e5efbdddd5651e43d0c2c38383ef428a1f3d7c9ef2e61973649875fa25b4da910c2d0617f4ef21eaae38142f8849c49f0c84882e27e4d9a55e49841ce11115791767db0a79e20fc9c17c5bf7fd2cfba506e101c2b357373fffd5b3756012ff628800b9f4e665cbe991b6c2b91e9f9eb87172a7cc71e0faa8b7127e83b3b38741eb6052ba53f6a373eae906f9477beca9f7180ccf0423d212bb8596289d11dff76432a4d0f8bea4a6108c2ae47b12027771689f74a1f15bb68944c51813f90853333e9b718c3db3e3e54df02c113c0ed477e7abd5ec5b2910616a773aaa43f1ea6c9ccbd3a7241f4021c2467881f37154237f068db8d9df46123893332cd3184d6341f362bcbb61c8a9c01d6ad8f5c91841960505edd8f5bc28b75dda749be2d7f5fcf4e51174474cc6d60ef560de8f8e907dffac4c584c473468a7cda41f2d8b5c667673e339347eee98842ba9499a6675cf00bedf2d5ebaaca3d000caaaf4d6d7b4dabae340d32834575aa02c269798c2fecfcaeab9cf26c6a6b2afc3cd33e833ba5654cd845cbf558e08c9b5608c41f2caf4d3a626c2ee6ae22512c5abb270422262459c58a9cd66cdfb9f222be28284e389bbf6381c64733d365d0f15885139a01f273dd67002e1f208dff1dd41802407f7d4e2597eadaa41195c1fc2e12f60508567fc7a7e9c64c01c4308f59684ef3bb98e993694b06e055c99479b5a32cc37112d6dd5b51c0cfeebe64cd4791f33169634e95e254929937c97e4eca906f0aa33a7014339d16c0e0822aaba2e060c9c114df27c13f5da8f3e58e92d4d7b2f0ecc3cadc9d103c2928f63ab0f8f1e8a3cfdecf88b09d0d5be77d2177c4b7f5533add623fe702f7d6f2753ef0c3413135452cda0fcb437c0a951805406b7a3c6c916c3ba0ca47e5edbd53bf9876c406cbce97d38a629ba08d9aaeadacad9a3a8cdd56db5b5ef846ac5da223fc151b95244e5169cd397a8a319425bb1218d6b823ed76f20c221ad1b35f654fdaecdfac4e16c9107387e27155f76bb93781e2de176c24acb86cd6997b13b61d80b6bd9476d20898ace8d3a21fbe9b954e7edfbb7940bb14c3ddca53c99e9d7ac4912cb9a6cacb31ec88b3e60d217fedf5428ad5ecf8823719d420a9619bf8dd4f2c021ed9c7f1f032a549b3ce448b2669ba59ba3d86fb87112bd34b72108c04c5a8170fb369c85158d0fe33b56c6bb36c45cf35f7e9ebaa85a54b291f22850c8e0958c155b399aae18bb99e6da4a9beed2e32a10083a6341e8487b0ece9eb25ee3944721c575621c0653d8e606a97a5a2712c9a6e32fccb76d2518538d04543474314f73a98cb49a14709b283ac6a4cc3397286d2dfec8566ffbcbfffeb96e8148ba506a5109c229f0e8e854cde5b922319601b51b353a1563f7d4b61e282b1c20ba11f8d64969718d75384cbdc4010c8a7caefcaab3bce2349cf3071c9a0be5376a71de404f02e968a24fe273f6f8ec359b4c6cba93e98a8ecb6c3168b208dc21d54cb455a36b7df04bed4cb076df50b521217172037b9a82c6b95c582751a8fc2094d65c6609ee05c32c3914bb4f5ba68d4da80d640a5acaa91be2263c1390afe39009f6b28819cda37d460d8a0d3d72e6853648033adee8ea28a7effdf5551dd9f0c621552de054dd230b4d2788dfac5fc456ee01222bed0a166b75695589ea469d05a4d02857c03dfad6ca601cd17ff38683207fafb30b43ed0b4f8eb6b10146ab7dc0fa9fc40ba7bb75517e0e7538ec81198015c3cecd6e47c42a09de418f7103bd9e986ee03f1d00ae610903f6f6c362dfcd43ff1e6012e0fe27df03c25d44cff2e1c04f907add3f0d4a774b2d72a2ecafb5b06fc50a16bd84d8c7f4a7ba2f602ed94b9a2108b6e1cca7244681fa4fb7c377a06ef14b5ae39e87114eebbb8f698f91fc8e4927bce8b445127c3995f8d728e10db347caaa00c522eb67996e7227ba55c082d3e5090aeefa251c67b85c425f921a24265bd83a97069b5efffd93d421b66806643283270cf0a26390fab87dc836d9c73f9e889544130d73e3611d5afbf37317b03ad1456c31319f19e6dea61ba45f7982ab73ceedff1a28fd660b09e2bcbb2ec86ea529c856eb7d88952b56b3b7233c870d87b68a1404ddf20a800e478fe232ca21a6544d6ea46406535818e7ec6a50db0658708db3b53d772745360b6b82de138efc3a1bc4cbac375986b1fcf1a916bf8b45dd3dc7b9f994e8c30c3eb877d960aef36a8b6992e9253dbbe57b631361fd19dd6dfff4d340663b0c478d0de112fc6783a7a062881ed9676a8b13424edec2e51bc3044f51f7b3a307d61777e4f71ce9198d73bc1bd89d34bbdee24e3e4a119e523a72a002013d3d05119803fd9815714824ea0ee5eb14211f0446253102892becdf7f34414a5fb08f8ed92e40c7cd03cac2a9ff63691970afc5675ffdcde15956b46ca944c14ffd76e89dcd2c78462629b9db770c579ae4ec4252e5f69916b3964c18c54b419a6285f27809e4049165309204b19ce48951ced7fc48b20d20d43811cab6c32d4e4cf05ebcb715c21019002e3bedcf86bc6baec9578a1b36ea567c088aa97a7dad7e050472f7906d226747bb2fbbd52e328069dc8c547c45a7cff5b7949548d4799641798314d2f4a11b198bce08f7c936299eeb15d10cff730e4781ce80664b7c1e375c6cd392de58a025280e7c9b7f6a5590b68bc8e7a90232a79e663bb0c393cd94e9b72ee86053c87f1ee197e684fc8cf5c8893971eee36f55e6acfc5dd0a7a38baf9642b37b294513a12591b07be05787b870e7e28892780390e59567fcd78c97691b28e2d0b3eb6344ae92c5ac7aac40d67ab8f152d41f60c0c077d60c552db80ef8baec5bcc9adaa33cba28dc3b52df4d2951d024a219fa75a612248045a7abcaca6f606248f21aa543fb56dd132cf30b021c30976e84e8ed2e5615cdecc874908512b9e3a48f80445e75260312d9d5b8bc9534187aa91ed1d03398c738b38fb06c6e8746674d24422539f94e27d1af2865ee64adfaf98ca63e83456ff17c60a95698b01f8e6f4962469a2d9ea503cf344d15ea52699e7d62efc77530672d62cf6f03a14857f59d3307f925d6004eb2104ccb90e67930357f13b4d74dc009d482d56a4b6e566716f549351b3738112f9ff1e4217661450918f07689641ee72e9f3055defe72ac05774c016e0431926a7ab75973f46f0625d6e5b19403ea7fbed8d9775007c41c444bcfa562eb2e7532fe332abc7587b87a5ad77e05888dcbe1b87c69199e276ddca4750a7b3ef0f46d132ac73d42bb9ea6864e88bda5db891490d92f9577be973ec4653baeb0b1d90bc7757cacd0973bdb9909aab7c16598cb4dc2a19ac57dab3c22836c172218078a8bf91e7ca81ba05eeef9e966489b182f6be07bb174c7fb28c8940d0902db9f45b73471ce9a760b78d40cc117da1caa07412cde830db9b15aac1ec5f5a8b1d109ee24eb4949174dad32c850cd9e6d42c736241ebf310293bc03880b7e0e775ef4e954e16abe7d9de9e576b0809755706d9b7384c27916866e17948cf5f3baaf9eba6718fee030194a6bb2fdc401d1c67c22a8a0bac6bcef24076dcc359190df4748114a6634761903f0482c76098eba24c841e6a6e6ba9b599fec88f9e5e0158352a05ef1ab162bfec139dc0653cb875d883b0c98f02d1fe35419133537521b5f8f48cb8269971e58fe3b3b4804dd69e7038161d7786a71de18533287f21445e6f49e93c53ddf7820e234a8ec5cc9c4d154fb5980c59a3545a1ea4fc67a758e24328811131ff9afe8561eaadaf6cb502fcbcaee557229f64fd74a33c52ab3f163"}) syz_usb_connect(0x0, 0x36, &(0x7f00000014c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000001500)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write(r2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./sys\x00', 0x152) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000920)='./sys/bus/usb/devices/usb1/bConfigurationValue\x00', 0x2, 0x15d) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000001300)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000001480)=ANY=[@ANYRES16, @ANYRES32, @ANYBLOB="dddf9385f20008b54fe6ffffff000000000039a218b6d3d2cdfd3e5e560000", @ANYRES32=0x0, @ANYRES32=r4, @ANYRESHEX=r4], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000a80), 0x407f, r5, 0x4}, 0x38) chdir(&(0x7f00000000c0)='./file1\x00') r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r6, 0xffffffff80000800, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./trace\x00', 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000001380)='./trace/error_log\x00', 0x20000, 0x42) pread64(r7, &(0x7f00000013c0)=""/144, 0x90, 0x7d) 1.403275591s ago: executing program 1 (id=2666): r0 = semget(0x1, 0x4, 0x39c) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x11, r1, 0x0) msync(&(0x7f0000ac9000/0x3000)=nil, 0x3000, 0x4) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x309042, 0x0) semctl$GETNCNT(r0, 0x4, 0xe, &(0x7f0000000340)=""/4096) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r2, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioperm(0x3, 0x9, 0x80) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) timer_getoverrun(r3) r4 = open(&(0x7f0000000280)='.\x00', 0x0, 0x70) fremovexattr(r4, &(0x7f0000000000)=@known='system.posix_acl_default\x00') unlink(&(0x7f0000000180)='./file1\x00') socketpair(0x1, 0x100000005, 0x0, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000140)) getpid() semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000200)) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@newlink={0xac, 0x10, 0x437, 0x0, 0x25dfdbec, {0x0, 0x0, 0x0, 0x0, 0x50403, 0x1}, [@IFLA_AF_SPEC={0x8c, 0x1a, 0x0, 0x1, [@AF_INET={0x30, 0x2, 0x0, 0x1, {0x2c, 0x1, 0x0, 0x1, [{0x8, 0xd, 0x0, 0x0, 0x101}, {0x8, 0x5, 0x0, 0x0, 0x5}, {0x8, 0x11}, {0x8, 0x1a, 0x0, 0x0, 0x8}, {0x8, 0x14, 0x0, 0x0, 0xe1}]}}, @AF_INET={0x58, 0x2, 0x0, 0x1, {0x54, 0x1, 0x0, 0x1, [{0x8, 0xf, 0x0, 0x0, 0xda}, {0x8, 0x16, 0x0, 0x0, 0x40}, {0x8, 0x3, 0x0, 0x0, 0x1}, {0x8, 0xd, 0x0, 0x0, 0xf}, {0x8, 0xb, 0x0, 0x0, 0x2}, {0x8, 0x5, 0x0, 0x0, 0xe}, {0x8, 0xb}, {0x8, 0xc, 0x0, 0x0, 0xa}, {0x8, 0x4, 0x0, 0x0, 0x9}, {0x8, 0xf}]}}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x40}, 0x4000) 1.131916953s ago: executing program 2 (id=2667): socket$kcm(0x21, 0x7, 0x2) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000640)={0xfffffffb}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="280000001200970200000000000000000700", @ANYBLOB="00000000000017"], 0x28}}, 0x0) socket$packet(0x11, 0x2, 0x300) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000400)='ns/cgroup\x00') r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000500)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@float={0x6}]}, {0x0, [0x5f, 0x2e, 0x61, 0x61, 0x30]}}, 0x0, 0x2b, 0x0, 0x1, 0x4}, 0x28) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./tracing/events/sched/filter\x00', 0x1, 0x0) write$binfmt_format(r7, &(0x7f0000000580)='0\x00', 0x2) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000005c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r9, 0x40345410, &(0x7f0000000600)={{0x3, 0x0, 0x0, 0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r9, 0x54a2) r10 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GCALLUSERDATA(r10, 0x89e4, &(0x7f0000000740)={0x5c, "8aabe904a2326e0ddfe99fe233644dceab9eda5cd474cb98466e93f8b5536ab2587d629119119253e3b1adc8bcde96fb90c7b65e906be0c4e082f7b328270492ea3aa52ce149657a21c68cd9d0ccd091703d814d09587683467cd5bdc116b54b0d493aee37cebe6d8a00277bc8e71ba1f7231d6c04f8b9d77ca7acfec21a8471"}) r11 = dup(r8) syz_ublk_setup_queues(r11, r6, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 1.129546514s ago: executing program 3 (id=2668): r0 = memfd_create(&(0x7f0000002640)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf13\xf3\x82O\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff,\x190x0) io_submit(r2, 0x1, &(0x7f0000000100)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x7, 0x80, 0xffffffffffffffff, &(0x7f0000000180)="31ce", 0x2fe, 0xfbe, 0x0, 0x1}]) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010027bd7000fedbdf250b0000000c000580070001"], 0x20}, 0x1, 0x0, 0x0, 0x20004010}, 0x8000000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./pipe/gssd/clntXX/gssd\x00', 0x2, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r6, 0x84, 0x73, &(0x7f0000000540)={0x0, 0x1, 0x7d312eb190dc5e7e, 0x1, 0x3}, &(0x7f0000000580)=0x18) mount(&(0x7f00000005c0)=@filename='127.0.0.1:/\x00', &(0x7f0000000600)='./mnt\x00', &(0x7f0000000640)='nfs\x00', 0x0, &(0x7f0000000680)='vers=4.0,sec=krb5p,addr=127.0.0.1\x00') r7 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./pipe/nfs/clnt0/gssd\x00', 0x2, 0x0) write(r7, &(0x7f0000000700)='\x00\x00\x00\x00', 0x4) syz_usb_connect(0x0, 0x36, &(0x7f00000007c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r8 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write(r8, 0x0, 0x0) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r9, &(0x7f0000000740)={0x1f, 0xfbfc, 0x6}, 0x6) ioctl$TUNSETNOCSUM(0xffffffffffffffff, 0x400454c8, 0x1) preadv(r0, &(0x7f0000000340)=[{&(0x7f0000000380)=""/3, 0x3}], 0x1, 0x6, 0x6) write$tun(r7, &(0x7f0000000880)={@void, @void, @x25={0x1, 0x8, 0xff, "f6a69e18af9a6c395174eaa000cf69e49c9768183901f5ea819822509377e98316a9589d59de5476f6c71d6bc8c0a1224790dacd09ad145719ec88fc30562dcac0d53b430a4245d1e8cd7e96a30d89db074258f9523ab6dc3b5ff69e0134be39f7286a56f0d11d6046d12d59f6ff785f17ad6c8853f7861295368987dc3f95d26eeda75b1d4fa8e8a2fb674f578b231b508746a52338a6c8105d9d5b6380850a2097d8de38ac1e61ba3a1c5fedcef65163ae593e6c9f9adfdb56b756c3"}}, 0xc0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000004c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) 0s ago: executing program 3 (id=2672): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = syz_clone3(&(0x7f0000001440)={0x40020100, 0x0, 0x0, 0x0, {0x2d}, 0x0, 0x0, 0x0, 0x0}, 0x58) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000014c0)={'bridge0\x00', 0x0}) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001500), 0x42, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000001580), 0x0, &(0x7f00000015c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r3, 0xe503, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000001640), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000001680)={0x80001003, 0x0, 0x0, 'queue1\x00', 0xfffffffd}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=@base={0x5, 0x4, 0x2, 0x7, 0x0, 0x1, 0xe92}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x11, 0xd, &(0x7f0000001880)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xc3}}, @call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f0000001900)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000001940)={r6, r5}, 0xc) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r7 = userfaultfd(0x801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000001980)) ioctl$UFFDIO_CONTINUE(r7, 0xc020aa08, &(0x7f0000001a00)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r8, &(0x7f0000001a40)=[{&(0x7f0000001a80)=""/156, 0x9c}], 0x53, &(0x7f0000001b40)=[{&(0x7f0000001b80)=""/109, 0x20001c34}], 0x1, 0x0) write$sndseq(r4, &(0x7f0000001c00)=[{0x84, 0x77, 0x0, 0x0, @tick=0x1f4, {}, {}, @raw32={[0x2600]}}], 0xffc8) sendmsg$nl_route(r1, &(0x7f0000001c40)={0x0, 0x0, &(0x7f0000001c80)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="480000001c00110c0000001400000f0007000000", @ANYRES32=r2, @ANYBLOB="800202000a000200577f0000aabb000020000e80050001008f000000050001000100000004000200050001"], 0x48}}, 0x0) close(0xffffffffffffffff) getpgid(r0) munmap(&(0x7f0000bde000/0x1000)=nil, 0x1000) syz_emit_vhci(&(0x7f0000001d40)=ANY=[@ANYBLOB="043e1a37"], 0x1d) kernel console output (not intermixed with test programs): get_register_driver returned -16 [ 378.899941][T13455] dummy0 speed is unknown, defaulting to 1000 [ 379.430638][ T9470] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 379.470720][ T9463] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 379.590711][ T9470] usb 6-1: Using ep0 maxpacket: 8 [ 379.591280][ T9470] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 379.592236][ T9470] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 379.592256][ T9470] usb 6-1: config 0 has no interface number 0 [ 379.592287][ T9470] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 379.592307][ T9470] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 379.592328][ T9470] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 379.592349][ T9470] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 379.592382][ T9470] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 379.594597][ T9470] usb 6-1: config 0 descriptor?? [ 379.599428][ T9470] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 379.610667][ T9463] usb 7-1: device descriptor read/64, error -71 [ 379.812630][ T5741] Bluetooth: hci0: command 0x2016 tx timeout [ 379.854664][ T9463] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 379.990656][ T9463] usb 7-1: device descriptor read/64, error -71 [ 380.100861][ T9463] usb usb7-port1: attempt power cycle [ 380.463532][ T9463] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 380.481117][ T9463] usb 7-1: device descriptor read/8, error -71 [ 380.486445][T13482] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2272'. [ 380.740647][ T9463] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 380.771317][ T9463] usb 7-1: device descriptor read/8, error -71 [ 380.890808][ T9463] usb usb7-port1: unable to enumerate USB device [ 381.815248][ T5835] usb 6-1: USB disconnect, device number 92 [ 381.824170][ T5835] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 381.890971][ T5741] Bluetooth: hci0: command 0x2016 tx timeout [ 382.141517][T13497] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2277'. [ 382.141547][T13497] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2277'. [ 382.201380][T13499] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2277'. [ 382.292510][ T5100] Bluetooth: hci1: Opcode 0x206a failed: -110 [ 382.300753][ T5100] Bluetooth: hci1: command 0x2016 tx timeout [ 383.174886][T13521] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 383.175304][T13521] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 383.550720][ T5835] usb 8-1: new high-speed USB device number 101 using dummy_hcd [ 383.681475][ T5835] usb 8-1: device descriptor read/64, error -71 [ 383.759605][T13534] dummy0 speed is unknown, defaulting to 1000 [ 383.940921][ T5835] usb 8-1: new high-speed USB device number 102 using dummy_hcd [ 383.970711][ T5100] Bluetooth: hci0: command 0x2016 tx timeout [ 384.082112][ T5835] usb 8-1: device descriptor read/64, error -71 [ 384.190930][ T5835] usb usb8-port1: attempt power cycle [ 384.385311][ T5100] Bluetooth: hci1: unexpected subevent 0x37 length: 25 > 13 [ 384.541063][ T5835] usb 8-1: new high-speed USB device number 103 using dummy_hcd [ 384.561673][ T5835] usb 8-1: device descriptor read/8, error -71 [ 384.810839][ T5835] usb 8-1: new high-speed USB device number 104 using dummy_hcd [ 384.831155][ T5835] usb 8-1: device descriptor read/8, error -71 [ 384.950814][ T5835] usb usb8-port1: unable to enumerate USB device [ 385.250699][ T5100] Bluetooth: hci2: command 0x2016 tx timeout [ 385.650813][ T5835] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 385.820853][ T5835] usb 7-1: Using ep0 maxpacket: 8 [ 385.821457][ T5835] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 385.822961][ T5835] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 385.822981][ T5835] usb 7-1: config 0 has no interface number 0 [ 385.823011][ T5835] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 385.823030][ T5835] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 385.823050][ T5835] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 385.823071][ T5835] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 385.823103][ T5835] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 385.825222][ T5835] usb 7-1: config 0 descriptor?? [ 385.840379][ T5835] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 386.050793][ T5100] Bluetooth: hci0: command 0x2016 tx timeout [ 386.864319][T13574] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2304'. [ 387.340654][ T5100] Bluetooth: hci2: command 0x2016 tx timeout [ 387.394004][T13584] FAULT_INJECTION: forcing a failure. [ 387.394004][T13584] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 387.394038][T13584] CPU: 1 UID: 0 PID: 13584 Comm: syz.3.2305 Tainted: G L syzkaller #0 PREEMPT(full) [ 387.394061][T13584] Tainted: [L]=SOFTLOCKUP [ 387.394068][T13584] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 387.394078][T13584] Call Trace: [ 387.394099][T13584] [ 387.394107][T13584] dump_stack_lvl+0x100/0x190 [ 387.394136][T13584] should_fail_ex.cold+0x5/0xa [ 387.394159][T13584] _copy_from_iter+0x1f4/0x1690 [ 387.394180][T13584] ? __asan_memset+0x23/0x50 [ 387.394203][T13584] ? __pfx__copy_from_iter+0x10/0x10 [ 387.394221][T13584] ? __pfx___alloc_skb+0x10/0x10 [ 387.394243][T13584] ? aa_sk_perm+0x389/0xab0 [ 387.394270][T13584] netlink_sendmsg+0x808/0xda0 [ 387.394286][T13584] ? __pfx_netlink_sendmsg+0x10/0x10 [ 387.394299][T13584] ? apparmor_socket_sendmsg+0x165/0x280 [ 387.394318][T13584] ____sys_sendmsg+0xa4d/0xbe0 [ 387.394341][T13584] ? __pfx_netlink_sendmsg+0x10/0x10 [ 387.394362][T13584] ? __pfx_____sys_sendmsg+0x10/0x10 [ 387.394397][T13584] ___sys_sendmsg+0x190/0x1e0 [ 387.394425][T13584] ? __pfx____sys_sendmsg+0x10/0x10 [ 387.394462][T13584] ? find_held_lock+0x2b/0x80 [ 387.394498][T13584] __sys_sendmsg+0x160/0x210 [ 387.394519][T13584] ? __pfx___sys_sendmsg+0x10/0x10 [ 387.394547][T13584] ? __pfx_ksys_write+0x10/0x10 [ 387.394578][T13584] __do_fast_syscall_32+0x13a/0x8b0 [ 387.394597][T13584] ? lockdep_hardirqs_on+0x7d/0x110 [ 387.394624][T13584] do_fast_syscall_32+0x32/0x70 [ 387.394642][T13584] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 387.394664][T13584] RIP: 0023:0xf7fb3fec [ 387.394683][T13584] Code: Unable to access opcode bytes at 0xf7fb3fc2. [ 387.394692][T13584] RSP: 002b:00000000f544550c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 387.394710][T13584] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000580 [ 387.394721][T13584] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 387.394732][T13584] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 387.394743][T13584] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 387.394753][T13584] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 387.394777][T13584] [ 388.140656][ T5100] Bluetooth: hci0: command 0x2016 tx timeout [ 388.400486][ T42] usb 7-1: USB disconnect, device number 17 [ 388.404396][ T42] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 389.180679][ T42] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 389.281477][T13617] FAULT_INJECTION: forcing a failure. [ 389.281477][T13617] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 389.281534][T13617] CPU: 0 UID: 0 PID: 13617 Comm: syz.2.2316 Tainted: G L syzkaller #0 PREEMPT(full) [ 389.281552][T13617] Tainted: [L]=SOFTLOCKUP [ 389.281557][T13617] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 389.281563][T13617] Call Trace: [ 389.281568][T13617] [ 389.281573][T13617] dump_stack_lvl+0x100/0x190 [ 389.281592][T13617] should_fail_ex.cold+0x5/0xa [ 389.281607][T13617] _copy_from_user+0x2e/0xd0 [ 389.281620][T13617] kstrtouint_from_user+0xd6/0x1d0 [ 389.281634][T13617] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 389.281653][T13617] ? lock_acquire+0x1d1/0x380 [ 389.281673][T13617] proc_fail_nth_write+0x83/0x220 [ 389.281690][T13617] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 389.281709][T13617] vfs_write+0x2aa/0x1050 [ 389.281724][T13617] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 389.281739][T13617] ? lock_acquire+0x1d1/0x380 [ 389.281755][T13617] ? __fget_files+0x34/0x3d0 [ 389.281770][T13617] ? __pfx_vfs_write+0x10/0x10 [ 389.281783][T13617] ? find_held_lock+0x2b/0x80 [ 389.281797][T13617] ? __fget_files+0x215/0x3d0 [ 389.281815][T13617] ? __fget_files+0x21f/0x3d0 [ 389.281834][T13617] ksys_write+0x12a/0x250 [ 389.281848][T13617] ? __pfx_ksys_write+0x10/0x10 [ 389.281866][T13617] do_int80_emulation+0x166/0x650 [ 389.281881][T13617] asm_int80_emulation+0x1a/0x20 [ 389.281893][T13617] RIP: 0023:0xf710762b [ 389.281902][T13617] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 389.281925][T13617] RSP: 002b:00000000f53c64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 389.281938][T13617] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f53c65d0 [ 389.281945][T13617] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 389.281951][T13617] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 389.281958][T13617] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 389.281965][T13617] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 389.281980][T13617] [ 389.307397][T13618] x_tables: duplicate underflow at hook 3 [ 389.382345][ T42] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 389.383315][ T42] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 389.383353][ T42] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 389.385207][ T42] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.385228][ T42] usb 6-1: Product: syz [ 389.385241][ T42] usb 6-1: Manufacturer: syz [ 389.385255][ T42] usb 6-1: SerialNumber: syz [ 389.410759][ T67] Bluetooth: hci2: command 0x2016 tx timeout [ 389.410830][ T5741] Bluetooth: hci2: Opcode 0x206a failed: -110 [ 389.749304][T13623] CIFS: Attempting to mount //127.0.0.1/test [ 389.756418][T13623] CIFS: VFS: Error connecting to socket. Aborting operation. [ 389.756474][T13623] CIFS: VFS: cifs_mount failed w/return code = -111 [ 390.210787][ T67] Bluetooth: hci0: command 0x2016 tx timeout [ 390.668531][T13640] netlink: 'syz.3.2324': attribute type 1 has an invalid length. [ 390.668546][T13640] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2324'. [ 390.937724][T13645] netlink: 'syz.2.2325': attribute type 1 has an invalid length. [ 390.937745][T13645] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2325'. [ 391.089904][ T7467] usb 6-1: USB disconnect, device number 93 [ 391.963159][T13654] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 392.292136][ T5100] Bluetooth: hci0: command 0x2016 tx timeout [ 392.882955][T13674] FAULT_INJECTION: forcing a failure. [ 392.882955][T13674] name failslab, interval 1, probability 0, space 0, times 0 [ 392.882978][T13674] CPU: 0 UID: 0 PID: 13674 Comm: syz.2.2333 Tainted: G L syzkaller #0 PREEMPT(full) [ 392.882995][T13674] Tainted: [L]=SOFTLOCKUP [ 392.883000][T13674] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 392.883008][T13674] Call Trace: [ 392.883013][T13674] [ 392.883019][T13674] dump_stack_lvl+0x100/0x190 [ 392.883040][T13674] should_fail_ex.cold+0x5/0xa [ 392.883056][T13674] should_failslab+0xc2/0x120 [ 392.883075][T13674] __kmalloc_cache_noprof+0x91/0x6d0 [ 392.883089][T13674] ? down_write_killable+0x152/0x240 [ 392.883102][T13674] ? alloc_ldt_struct+0x5d/0x1b0 [ 392.883119][T13674] alloc_ldt_struct+0x5d/0x1b0 [ 392.883133][T13674] write_ldt+0x62b/0xd40 [ 392.883148][T13674] ? __pfx_write_ldt+0x10/0x10 [ 392.883163][T13674] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 392.883180][T13674] ? __pfx_ksys_write+0x10/0x10 [ 392.883198][T13674] __ia32_sys_modify_ldt+0xb0/0x170 [ 392.883213][T13674] __do_fast_syscall_32+0x13a/0x8b0 [ 392.883228][T13674] do_fast_syscall_32+0x32/0x70 [ 392.883240][T13674] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 392.883255][T13674] RIP: 0023:0xf73aefec [ 392.883268][T13674] Code: Unable to access opcode bytes at 0xf73aefc2. [ 392.883273][T13674] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 000000000000007b [ 392.883285][T13674] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000080000a80 [ 392.883292][T13674] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 392.883299][T13674] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 392.883306][T13674] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 392.883313][T13674] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 392.883328][T13674] [ 392.997067][T13685] netlink: 'syz.0.2338': attribute type 1 has an invalid length. [ 392.997082][T13685] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2338'. [ 393.163477][T13691] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 393.508043][T13697] netlink: 'syz.3.2341': attribute type 1 has an invalid length. [ 393.508057][T13697] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2341'. [ 393.806340][T13699] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2341'. [ 394.860647][ T7467] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 395.000608][ T7467] usb 6-1: device descriptor read/64, error -71 [ 395.158011][T13733] FAULT_INJECTION: forcing a failure. [ 395.158011][T13733] name failslab, interval 1, probability 0, space 0, times 0 [ 395.158034][T13733] CPU: 1 UID: 0 PID: 13733 Comm: syz.2.2352 Tainted: G L syzkaller #0 PREEMPT(full) [ 395.158050][T13733] Tainted: [L]=SOFTLOCKUP [ 395.158054][T13733] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 395.158061][T13733] Call Trace: [ 395.158065][T13733] [ 395.158070][T13733] dump_stack_lvl+0x100/0x190 [ 395.158102][T13733] should_fail_ex.cold+0x5/0xa [ 395.158118][T13733] should_failslab+0xc2/0x120 [ 395.158136][T13733] __kmalloc_cache_node_noprof+0x94/0x720 [ 395.158155][T13733] ? sched_setaffinity+0x265/0x400 [ 395.158171][T13733] sched_setaffinity+0x265/0x400 [ 395.158185][T13733] ? __pfx_sched_setaffinity+0x10/0x10 [ 395.158200][T13733] ? __fget_files+0x21f/0x3d0 [ 395.158215][T13733] ? compat_get_bitmap+0x149/0x190 [ 395.158228][T13733] __ia32_compat_sys_sched_setaffinity+0x147/0x1c0 [ 395.158241][T13733] ? fput+0x7c/0x100 [ 395.158257][T13733] ? __pfx___ia32_compat_sys_sched_setaffinity+0x10/0x10 [ 395.158270][T13733] ? ksys_write+0x1ac/0x250 [ 395.158284][T13733] ? __pfx_ksys_write+0x10/0x10 [ 395.158301][T13733] __do_fast_syscall_32+0x13a/0x8b0 [ 395.158313][T13733] ? lockdep_hardirqs_on+0x7d/0x110 [ 395.158331][T13733] do_fast_syscall_32+0x32/0x70 [ 395.158343][T13733] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 395.158358][T13733] RIP: 0023:0xf73aefec [ 395.158370][T13733] Code: Unable to access opcode bytes at 0xf73aefc2. [ 395.158376][T13733] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 00000000000000f1 [ 395.158387][T13733] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000ffffff7c [ 395.158394][T13733] RDX: 00000000800002c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 395.158401][T13733] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 395.158412][T13733] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 395.158419][T13733] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 395.158433][T13733] [ 395.262009][ T7467] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 395.400626][ T7467] usb 6-1: device descriptor read/64, error -71 [ 395.472894][T13742] binder: BINDER_SET_CONTEXT_MGR already set [ 395.472910][T13742] binder: 13741:13742 ioctl 4018620d 800003c0 returned -16 [ 395.500014][T13748] netlink: 'syz.3.2357': attribute type 1 has an invalid length. [ 395.500034][T13748] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2357'. [ 395.649268][ T7467] usb usb6-port1: attempt power cycle [ 395.938546][T13754] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 395.938767][T13754] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 395.956087][T13754] dummy0 speed is unknown, defaulting to 1000 [ 395.956580][T13749] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2357'. [ 396.230608][ T7467] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 396.261551][ T7467] usb 6-1: device descriptor read/8, error -71 [ 396.540778][ T7467] usb 6-1: new high-speed USB device number 97 using dummy_hcd [ 396.561054][ T7467] usb 6-1: device descriptor read/8, error -71 [ 396.660683][ T9463] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 396.681059][ T7467] usb usb6-port1: unable to enumerate USB device [ 396.820667][ T9463] usb 7-1: Using ep0 maxpacket: 8 [ 396.821500][ T9463] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 396.822347][ T9463] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 396.822408][ T9463] usb 7-1: config 0 has no interface number 0 [ 396.823562][ T9463] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 396.823576][ T9463] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 396.823589][ T9463] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 396.823678][ T9463] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 396.823703][ T9463] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 396.828615][ T9463] usb 7-1: config 0 descriptor?? [ 396.867879][ T9463] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 397.169355][T13767] dummy0 speed is unknown, defaulting to 1000 [ 397.577523][ T7467] usb 7-1: USB disconnect, device number 19 [ 397.577636][ C1] ldusb 7-1:0.55: usb_submit_urb failed (-19) [ 398.084180][T13780] FAULT_INJECTION: forcing a failure. [ 398.084180][T13780] name failslab, interval 1, probability 0, space 0, times 0 [ 398.084204][T13780] CPU: 1 UID: 0 PID: 13780 Comm: syz.0.2366 Tainted: G L syzkaller #0 PREEMPT(full) [ 398.084233][T13780] Tainted: [L]=SOFTLOCKUP [ 398.084239][T13780] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 398.084246][T13780] Call Trace: [ 398.084252][T13780] [ 398.084257][T13780] dump_stack_lvl+0x100/0x190 [ 398.084278][T13780] should_fail_ex.cold+0x5/0xa [ 398.084293][T13780] should_failslab+0xc2/0x120 [ 398.084313][T13780] __kmalloc_cache_noprof+0x91/0x6d0 [ 398.084328][T13780] ? v4l2_fh_open+0x4c/0xa0 [ 398.084348][T13780] v4l2_fh_open+0x4c/0xa0 [ 398.084365][T13780] v4l2_open+0x1d2/0x490 [ 398.084382][T13780] ? __pfx_v4l2_open+0x10/0x10 [ 398.084398][T13780] chrdev_open+0x234/0x6a0 [ 398.084419][T13780] ? __pfx_apparmor_file_open+0x10/0x10 [ 398.084436][T13780] ? __pfx_chrdev_open+0x10/0x10 [ 398.084455][T13780] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 398.084471][T13780] do_dentry_open+0x6ab/0x14d0 [ 398.084488][T13780] ? __pfx_chrdev_open+0x10/0x10 [ 398.084509][T13780] vfs_open+0x82/0x3f0 [ 398.084523][T13780] path_openat+0x19fa/0x2440 [ 398.084543][T13780] ? __pfx_path_openat+0x10/0x10 [ 398.084564][T13780] do_file_open+0x20e/0x430 [ 398.084581][T13780] ? __pfx_do_file_open+0x10/0x10 [ 398.084608][T13780] ? _raw_spin_unlock+0x28/0x50 [ 398.084624][T13780] ? alloc_fd+0x471/0x7a0 [ 398.084645][T13780] do_sys_openat2+0x10f/0x1e0 [ 398.084657][T13780] ? __pfx_do_sys_openat2+0x10/0x10 [ 398.084667][T13780] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 398.084682][T13780] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 398.084696][T13780] ? __ia32_sys_futex_time32+0x2fd/0x470 [ 398.084712][T13780] __ia32_compat_sys_openat+0x12d/0x210 [ 398.084726][T13780] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 398.084746][T13780] do_int80_emulation+0x166/0x650 [ 398.084760][T13780] asm_int80_emulation+0x1a/0x20 [ 398.084771][T13780] RIP: 0023:0xf711762b [ 398.084782][T13780] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 398.084793][T13780] RSP: 002b:00000000f53d603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 398.084805][T13780] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f53d6100 [ 398.084813][T13780] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 398.084820][T13780] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 398.084827][T13780] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 398.084852][T13780] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 398.084869][T13780] [ 398.211001][ T43] usb 6-1: new high-speed USB device number 98 using dummy_hcd [ 398.361345][ T43] usb 6-1: Using ep0 maxpacket: 8 [ 398.362226][ T43] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 398.366358][ T43] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 398.366434][ T43] usb 6-1: config 0 has no interface number 0 [ 398.366469][ T43] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 398.366635][ T43] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 398.366690][ T43] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 398.367352][ T43] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 398.367446][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 398.407239][ T43] usb 6-1: config 0 descriptor?? [ 398.444404][ T43] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 398.755527][T13791] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 398.755735][T13791] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 398.860671][ T9468] usb 8-1: new high-speed USB device number 105 using dummy_hcd [ 399.020642][ T9468] usb 8-1: Using ep0 maxpacket: 8 [ 399.021989][ T9468] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 399.022896][ T9468] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 399.022988][ T9468] usb 8-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 399.023002][ T9468] usb 8-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024 [ 399.024970][ T9468] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.024982][ T9468] usb 8-1: Product: syz [ 399.024990][ T9468] usb 8-1: Manufacturer: ã  [ 399.024998][ T9468] usb 8-1: SerialNumber: syz [ 399.246301][ T9468] cdc_ncm 8-1:1.0: bind() failure [ 399.257432][ T9468] cdc_ncm 8-1:1.1: CDC Union missing and no IAD found [ 399.257454][ T9468] cdc_ncm 8-1:1.1: bind() failure [ 399.268122][ T9468] usb 8-1: USB disconnect, device number 105 [ 399.327509][ T7467] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 399.436305][T13793] device-mapper: ioctl: name not supplied when creating device [ 399.570931][ T5741] Bluetooth: hci1: command 0x2016 tx timeout [ 399.571998][ T5100] Bluetooth: hci1: Opcode 0x206a failed: -110 [ 399.830596][ T7467] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 399.970820][ T7467] usb 7-1: device descriptor read/64, error -71 [ 400.240696][ T7467] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 400.390644][ T7467] usb 7-1: device descriptor read/64, error -71 [ 400.474297][T13802] CIFS: Attempting to mount //127.0.0.1/test [ 400.510956][ T7467] usb usb7-port1: attempt power cycle [ 400.870689][ T7467] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 400.891213][ T7467] usb 7-1: device descriptor read/8, error -71 [ 400.916331][ T5888] usb 6-1: USB disconnect, device number 98 [ 400.924437][ T5888] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 401.140774][ T7467] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 401.161305][ T7467] usb 7-1: device descriptor read/8, error -71 [ 401.268226][T13823] netdevsim netdevsim1 : renamed from netdevsim0 (while UP) [ 401.280865][ T7467] usb usb7-port1: unable to enumerate USB device [ 401.344724][T13802] CIFS: VFS: Error connecting to socket. Aborting operation. [ 401.344805][T13802] CIFS: VFS: cifs_mount failed w/return code = -4 [ 401.970810][ T67] Bluetooth: hci0: command 0x2016 tx timeout [ 401.970970][ T5100] Bluetooth: hci0: Opcode 0x206a failed: -110 [ 402.310501][T13861] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 402.311234][T13861] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 402.608650][T13878] bridge0: port 3(syz_tun) entered blocking state [ 402.608730][T13878] bridge0: port 3(syz_tun) entered disabled state [ 402.609100][T13878] syz_tun: entered allmulticast mode [ 402.623296][T13878] syz_tun: entered promiscuous mode [ 402.625905][T13878] bridge0: port 3(syz_tun) entered blocking state [ 402.626027][T13878] bridge0: port 3(syz_tun) entered forwarding state [ 402.636801][T13878] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 402.639899][T13878] netlink: 1272 bytes leftover after parsing attributes in process `syz.2.2388'. [ 402.654542][T13877] bridge0: port 3(syz_tun) entered disabled state [ 402.654666][T13877] bridge0: port 2(bridge_slave_1) entered disabled state [ 402.655132][T13877] bridge0: port 1(bridge_slave_0) entered disabled state [ 402.855165][T13891] FAULT_INJECTION: forcing a failure. [ 402.855165][T13891] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 402.855187][T13891] CPU: 3 UID: 0 PID: 13891 Comm: syz.3.2389 Tainted: G L syzkaller #0 PREEMPT(full) [ 402.855203][T13891] Tainted: [L]=SOFTLOCKUP [ 402.855207][T13891] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 402.855214][T13891] Call Trace: [ 402.855218][T13891] [ 402.855223][T13891] dump_stack_lvl+0x100/0x190 [ 402.855242][T13891] should_fail_ex.cold+0x5/0xa [ 402.855257][T13891] _copy_from_user+0x2e/0xd0 [ 402.855270][T13891] kstrtouint_from_user+0xd6/0x1d0 [ 402.855285][T13891] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 402.855303][T13891] ? lock_acquire+0x1d1/0x380 [ 402.855323][T13891] proc_fail_nth_write+0x83/0x220 [ 402.855339][T13891] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 402.855358][T13891] vfs_write+0x2aa/0x1050 [ 402.855373][T13891] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 402.855388][T13891] ? lock_acquire+0x1d1/0x380 [ 402.855404][T13891] ? __fget_files+0x34/0x3d0 [ 402.855419][T13891] ? __pfx_vfs_write+0x10/0x10 [ 402.855432][T13891] ? find_held_lock+0x2b/0x80 [ 402.855446][T13891] ? __fget_files+0x215/0x3d0 [ 402.855463][T13891] ? __fget_files+0x21f/0x3d0 [ 402.855482][T13891] ksys_write+0x12a/0x250 [ 402.855496][T13891] ? __pfx_ksys_write+0x10/0x10 [ 402.855514][T13891] do_int80_emulation+0x166/0x650 [ 402.855528][T13891] asm_int80_emulation+0x1a/0x20 [ 402.855540][T13891] RIP: 0023:0xf71a762b [ 402.855550][T13891] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 402.855560][T13891] RSP: 002b:00000000f54454bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 402.855572][T13891] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000f54455d0 [ 402.855579][T13891] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 402.855586][T13891] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 402.855592][T13891] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 402.855599][T13891] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 402.855613][T13891] [ 402.946523][T13896] dummy0 speed is unknown, defaulting to 1000 [ 402.982538][T13899] netlink: 'syz.1.2393': attribute type 1 has an invalid length. [ 402.982559][T13899] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2393'. [ 403.008658][ T5100] Bluetooth: hci1: unexpected subevent 0x37 length: 25 > 13 [ 403.347793][T13909] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2393'. [ 403.729870][T13921] lo speed is unknown, defaulting to 1000 [ 403.729910][T13921] lo speed is unknown, defaulting to 1000 [ 403.730437][T13921] lo speed is unknown, defaulting to 1000 [ 403.731815][ T5741] Bluetooth: hci1: Opcode 0x206a failed: -110 [ 403.733642][T13921] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 403.733678][T13921] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 403.733718][T13921] smbdirect: ib_dev[syz_device_name_32_chars_1234567]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 403.737473][T13921] infiniband syz_device_name_32_chars_1234567: RDMA CMA: cma_listen_on_dev, error -22 [ 403.740770][ T5741] Bluetooth: hci1: command 0x2016 tx timeout [ 403.752893][T13921] lo speed is unknown, defaulting to 1000 [ 403.753636][T13921] lo speed is unknown, defaulting to 1000 [ 403.754445][T13921] lo speed is unknown, defaulting to 1000 [ 403.755989][T13921] lo speed is unknown, defaulting to 1000 [ 403.756692][T13921] lo speed is unknown, defaulting to 1000 [ 403.758623][T13921] lo speed is unknown, defaulting to 1000 [ 403.811164][ T5835] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 403.920800][ T9] usb 8-1: new high-speed USB device number 106 using dummy_hcd [ 403.950714][ T5835] usb 7-1: device descriptor read/64, error -71 [ 404.061507][ T5741] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 404.200781][ T5835] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 404.330683][ T5835] usb 7-1: device descriptor read/64, error -71 [ 404.451842][ T5835] usb usb7-port1: attempt power cycle [ 404.498190][ T9] usb 8-1: Using ep0 maxpacket: 8 [ 404.526896][ T9] usb 8-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 404.576920][ T9] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 404.576938][ T9] usb 8-1: config 0 has no interface number 0 [ 404.576958][ T9] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 404.576970][ T9] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 404.576983][ T9] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 404.576996][ T9] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 404.577016][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.810664][ T5835] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 404.831095][ T5835] usb 7-1: device descriptor read/8, error -71 [ 404.846670][ T9] usb 8-1: config 0 descriptor?? [ 405.023033][T13938] dummy0 speed is unknown, defaulting to 1000 [ 405.025702][T13938] lo speed is unknown, defaulting to 1000 [ 405.071162][ T5741] Bluetooth: hci2: unexpected subevent 0x37 length: 25 > 13 [ 405.083112][ T5835] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 405.104106][ T5835] usb 7-1: device descriptor read/8, error -71 [ 405.220837][ T5835] usb usb7-port1: unable to enumerate USB device [ 405.421557][ T9] ldusb 8-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 405.424508][ T9] usb 8-1: USB disconnect, device number 106 [ 405.429244][ T9] ldusb 8-1:0.55: LD USB Device #0 now disconnected [ 407.661499][T13967] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 407.680613][T13967] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 407.871787][T13968] ALSA: mixer_oss: invalid OSS volume 'ÿÿÿÿ' [ 408.164399][T13973] dummy0 speed is unknown, defaulting to 1000 [ 408.166731][T13973] lo speed is unknown, defaulting to 1000 [ 408.226040][ T5741] Bluetooth: hci0: unexpected subevent 0x37 length: 25 > 13 [ 409.635615][T13994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.635970][T13994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.902384][ T12] pim6reg: left allmulticast mode [ 410.025994][T14001] netlink: 'syz.2.2419': attribute type 1 has an invalid length. [ 410.026018][T14001] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2419'. [ 410.059923][ T12] batman_adv: batadv0: Removing interface: ip6gretap1 [ 410.411264][ T5846] usb 8-1: new high-speed USB device number 107 using dummy_hcd [ 410.458563][ T12] bond1 (unregistering): (slave dummy0): Releasing active interface [ 410.472973][ T12] bond1 (unregistering): Released all slaves [ 410.485671][ T12] bond2 (unregistering): Released all slaves [ 410.505966][ T5452] 8021q: adding VLAN 0 to HW filter on device eth2 [ 410.506514][ T5835] dummy0 speed is unknown, defaulting to 1000 [ 410.506547][ T5835] syz0: Port: 1 Link DOWN [ 410.506600][ T9470] dummy0 speed is unknown, defaulting to 1000 [ 410.591006][ T5846] usb 8-1: Using ep0 maxpacket: 8 [ 410.594848][ T5846] usb 8-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 410.595905][ T5846] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 410.595928][ T5846] usb 8-1: config 0 has no interface number 0 [ 410.595955][ T5846] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 410.595974][ T5846] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 410.595996][ T5846] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 410.596018][ T5846] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 410.596053][ T5846] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.598174][ T5846] usb 8-1: config 0 descriptor?? [ 410.606156][ T5846] ldusb 8-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 410.718979][ T12] Uý: left promiscuous mode [ 411.078936][T14018] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2423'. [ 411.169359][T14023] netlink: 'syz.2.2426': attribute type 1 has an invalid length. [ 411.169373][T14023] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2426'. [ 411.203439][T14021] dummy0 speed is unknown, defaulting to 1000 [ 411.206090][T14021] lo speed is unknown, defaulting to 1000 [ 411.287055][ T12] hsr_slave_0: left promiscuous mode [ 411.290063][ T12] hsr_slave_1: left promiscuous mode [ 411.296842][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 411.301776][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 411.309256][ T5741] Bluetooth: hci2: unexpected subevent 0x37 length: 25 > 13 [ 411.552357][T14029] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2426'. [ 411.807813][ T12] team0 (unregistering): Port device team_slave_1 removed [ 411.827646][ T12] team0 (unregistering): Port device team_slave_0 removed [ 412.286409][ T8634] smbdirect: ib_dev[syz0] removed [ 413.018652][T14043] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2430'. [ 413.148536][ T5835] usb 8-1: USB disconnect, device number 107 [ 413.153264][ T5835] ldusb 8-1:0.55: LD USB Device #0 now disconnected [ 413.950652][ T5835] usb 8-1: new high-speed USB device number 108 using dummy_hcd [ 414.185886][ T5835] usb 8-1: device descriptor read/64, error -71 [ 414.702595][ T5835] usb 8-1: new high-speed USB device number 109 using dummy_hcd [ 414.831177][ T5835] usb 8-1: device descriptor read/64, error -71 [ 414.941638][ T5835] usb usb8-port1: attempt power cycle [ 415.281004][ T5835] usb 8-1: new high-speed USB device number 110 using dummy_hcd [ 415.301637][ T5835] usb 8-1: device descriptor read/8, error -71 [ 415.608821][ T5835] usb 8-1: new high-speed USB device number 111 using dummy_hcd [ 415.639522][ T5835] usb 8-1: device descriptor read/8, error -71 [ 415.742026][ T5835] usb usb8-port1: unable to enumerate USB device [ 416.369392][T14099] netlink: 'syz.0.2444': attribute type 1 has an invalid length. [ 416.369406][T14099] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2444'. [ 416.403818][T14100] xt_bpf: check failed: parse error [ 416.738579][T14111] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2444'. [ 417.039017][T14118] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 417.039035][T14118] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 417.039166][T14118] vhci_hcd vhci_hcd.0: Device attached [ 417.039949][T14118] binder: 14117:14118 ioctl 84009422 80000600 returned -22 [ 417.040032][T14118] binder: 14117:14118 ioctl 50009403 80000a00 returned -22 [ 417.047292][T14119] vhci_hcd: connection closed [ 417.049500][ T12] vhci_hcd vhci_hcd.2: stop threads [ 417.049520][ T12] vhci_hcd vhci_hcd.2: release socket [ 417.049534][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 417.086064][ T5741] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 417.295762][T14127] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 417.296061][T14127] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 417.307013][T14127] lo speed is unknown, defaulting to 1000 [ 417.336954][T14130] gadgetfs: bound to dummy_udc driver [ 417.570823][ T5835] usb 6-1: new full-speed USB device number 99 using dummy_hcd [ 417.571051][ C3] gadgetfs: connected [ 417.573522][ T5835] gadgetfs: disconnected [ 417.628514][T14137] binder: 14136:14137 ioctl c04064a0 80003300 returned -22 [ 417.628770][T14137] binder: 14136:14137 ioctl c04064a0 80003440 returned -22 [ 417.667154][ T5741] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 418.406331][T14152] FAULT_INJECTION: forcing a failure. [ 418.406331][T14152] name failslab, interval 1, probability 0, space 0, times 0 [ 418.406400][T14152] CPU: 2 UID: 0 PID: 14152 Comm: syz.2.2461 Tainted: G L syzkaller #0 PREEMPT(full) [ 418.406443][T14152] Tainted: [L]=SOFTLOCKUP [ 418.406451][T14152] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 418.406462][T14152] Call Trace: [ 418.406470][T14152] [ 418.406479][T14152] dump_stack_lvl+0x100/0x190 [ 418.406511][T14152] should_fail_ex.cold+0x5/0xa [ 418.406538][T14152] should_failslab+0xc2/0x120 [ 418.406571][T14152] __kmalloc_cache_noprof+0x91/0x6d0 [ 418.406610][T14152] ? v4l2_fh_open+0x4c/0xa0 [ 418.406645][T14152] v4l2_fh_open+0x4c/0xa0 [ 418.406675][T14152] v4l2_open+0x1d2/0x490 [ 418.406704][T14152] ? __pfx_v4l2_open+0x10/0x10 [ 418.406731][T14152] chrdev_open+0x234/0x6a0 [ 418.406759][T14152] ? __pfx_apparmor_file_open+0x10/0x10 [ 418.406786][T14152] ? __pfx_chrdev_open+0x10/0x10 [ 418.406815][T14152] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 418.406841][T14152] do_dentry_open+0x6ab/0x14d0 [ 418.406867][T14152] ? __pfx_chrdev_open+0x10/0x10 [ 418.406900][T14152] vfs_open+0x82/0x3f0 [ 418.406922][T14152] path_openat+0x19fa/0x2440 [ 418.406956][T14152] ? __pfx_path_openat+0x10/0x10 [ 418.406995][T14152] do_file_open+0x20e/0x430 [ 418.407030][T14152] ? __pfx_do_file_open+0x10/0x10 [ 418.407077][T14152] ? _raw_spin_unlock+0x28/0x50 [ 418.407104][T14152] ? alloc_fd+0x471/0x7a0 [ 418.407140][T14152] do_sys_openat2+0x10f/0x1e0 [ 418.407160][T14152] ? __pfx_do_sys_openat2+0x10/0x10 [ 418.407184][T14152] ? irqentry_exit+0x24d/0xa10 [ 418.407203][T14152] ? lockdep_hardirqs_on+0x7d/0x110 [ 418.407237][T14152] __ia32_compat_sys_openat+0x12d/0x210 [ 418.407260][T14152] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 418.407294][T14152] do_int80_emulation+0x166/0x650 [ 418.407318][T14152] asm_int80_emulation+0x1a/0x20 [ 418.407338][T14152] RIP: 0023:0xf710762b [ 418.407355][T14152] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 418.407374][T14152] RSP: 002b:00000000f53c603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 418.407395][T14152] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f53c6100 [ 418.407409][T14152] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 418.407420][T14152] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 418.407431][T14152] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 418.407443][T14152] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 418.407469][T14152] [ 418.769636][T14162] FAULT_INJECTION: forcing a failure. [ 418.769636][T14162] name failslab, interval 1, probability 0, space 0, times 0 [ 418.769671][T14162] CPU: 2 UID: 0 PID: 14162 Comm: syz.3.2466 Tainted: G L syzkaller #0 PREEMPT(full) [ 418.769698][T14162] Tainted: [L]=SOFTLOCKUP [ 418.769705][T14162] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 418.769717][T14162] Call Trace: [ 418.769724][T14162] [ 418.769732][T14162] dump_stack_lvl+0x100/0x190 [ 418.769762][T14162] should_fail_ex.cold+0x5/0xa [ 418.769787][T14162] should_failslab+0xc2/0x120 [ 418.769819][T14162] __kmalloc_cache_noprof+0x91/0x6d0 [ 418.769843][T14162] ? tcf_action_init_1+0x27e/0x6c0 [ 418.769879][T14162] tcf_action_init_1+0x27e/0x6c0 [ 418.769904][T14162] ? __pfx_tcf_action_init_1+0x10/0x10 [ 418.769926][T14162] ? tc_action_load_ops+0x1f5/0x3e0 [ 418.769949][T14162] ? __pfx_tc_action_load_ops+0x10/0x10 [ 418.769983][T14162] ? __nla_parse+0x40/0x60 [ 418.770014][T14162] tcf_action_init+0x43f/0xa60 [ 418.770048][T14162] ? __pfx_tcf_action_init+0x10/0x10 [ 418.770070][T14162] ? __lock_acquire+0x5c0/0x1f40 [ 418.770098][T14162] ? __kernel_text_address+0xd/0x30 [ 418.770170][T14162] ? __lock_acquire+0x5c0/0x1f40 [ 418.770200][T14162] ? __css_rstat_updated+0x1ce/0x590 [ 418.770220][T14162] ? __lock_acquire+0x5c0/0x1f40 [ 418.770247][T14162] ? __pfx___css_rstat_updated+0x10/0x10 [ 418.770270][T14162] tcf_exts_validate_ex+0x42f/0x550 [ 418.770302][T14162] ? __pfx_tcf_exts_validate_ex+0x10/0x10 [ 418.770326][T14162] ? pcpu_alloc_noprof+0xef1/0x1e50 [ 418.770366][T14162] mall_change+0x3cd/0x1030 [ 418.770403][T14162] ? __pfx_mall_change+0x10/0x10 [ 418.770443][T14162] ? __pfx_mall_change+0x10/0x10 [ 418.770470][T14162] tc_new_tfilter+0x9e2/0x24e0 [ 418.770507][T14162] ? __pfx_tc_new_tfilter+0x10/0x10 [ 418.770544][T14162] ? kmem_cache_free+0x127/0x6c0 [ 418.770576][T14162] ? __lock_acquire+0x5c0/0x1f40 [ 418.770615][T14162] ? lock_acquire+0x1d1/0x380 [ 418.770642][T14162] ? rtnetlink_rcv_msg+0x1f6/0xe90 [ 418.770668][T14162] ? find_held_lock+0x2b/0x80 [ 418.770694][T14162] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 418.770723][T14162] ? __pfx_tc_new_tfilter+0x10/0x10 [ 418.770745][T14162] rtnetlink_rcv_msg+0x95e/0xe90 [ 418.770773][T14162] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 418.770807][T14162] ? ref_tracker_free+0x37e/0x6c0 [ 418.770835][T14162] netlink_rcv_skb+0x159/0x420 [ 418.770858][T14162] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 418.770893][T14162] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 418.770923][T14162] ? netlink_deliver_tap+0x1ae/0xcc0 [ 418.770958][T14162] netlink_unicast+0x585/0x850 [ 418.770983][T14162] ? __pfx_netlink_unicast+0x10/0x10 [ 418.771003][T14162] ? aa_sk_perm+0x389/0xab0 [ 418.771035][T14162] netlink_sendmsg+0x8b0/0xda0 [ 418.771063][T14162] ? __pfx_netlink_sendmsg+0x10/0x10 [ 418.771087][T14162] ? apparmor_socket_sendmsg+0x165/0x280 [ 418.771112][T14162] ____sys_sendmsg+0xa4d/0xbe0 [ 418.771139][T14162] ? __pfx_netlink_sendmsg+0x10/0x10 [ 418.771163][T14162] ? __pfx_____sys_sendmsg+0x10/0x10 [ 418.771206][T14162] ___sys_sendmsg+0x190/0x1e0 [ 418.771238][T14162] ? __pfx____sys_sendmsg+0x10/0x10 [ 418.771281][T14162] ? find_held_lock+0x2b/0x80 [ 418.771323][T14162] __sys_sendmsg+0x160/0x210 [ 418.771349][T14162] ? __pfx___sys_sendmsg+0x10/0x10 [ 418.771381][T14162] ? __pfx_ksys_write+0x10/0x10 [ 418.771413][T14162] __do_fast_syscall_32+0x13a/0x8b0 [ 418.771433][T14162] ? lockdep_hardirqs_on+0x7d/0x110 [ 418.771466][T14162] do_fast_syscall_32+0x32/0x70 [ 418.771489][T14162] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 418.771513][T14162] RIP: 0023:0xf7fb3fec [ 418.771535][T14162] Code: Unable to access opcode bytes at 0xf7fb3fc2. [ 418.771544][T14162] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 418.771564][T14162] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000540 [ 418.771576][T14162] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 418.771587][T14162] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 418.771598][T14162] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 418.771609][T14162] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 418.771635][T14162] [ 419.344409][T14177] jffs2: notice: (14177) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 419.349305][T14177] FAULT_INJECTION: forcing a failure. [ 419.349305][T14177] name failslab, interval 1, probability 0, space 0, times 0 [ 419.349328][T14177] CPU: 1 UID: 0 PID: 14177 Comm: syz.3.2470 Tainted: G L syzkaller #0 PREEMPT(full) [ 419.349344][T14177] Tainted: [L]=SOFTLOCKUP [ 419.349349][T14177] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 419.349356][T14177] Call Trace: [ 419.349360][T14177] [ 419.349366][T14177] dump_stack_lvl+0x100/0x190 [ 419.349386][T14177] should_fail_ex.cold+0x5/0xa [ 419.349401][T14177] should_failslab+0xc2/0x120 [ 419.349433][T14177] kmem_cache_alloc_noprof+0x92/0x6a0 [ 419.349448][T14177] ? lockdep_hardirqs_on+0x7d/0x110 [ 419.349466][T14177] ? jffs2_do_read_inode_internal+0x1436/0x4ac0 [ 419.349483][T14177] jffs2_do_read_inode_internal+0x1436/0x4ac0 [ 419.349498][T14177] ? check_prev_add+0xfe/0xe60 [ 419.349517][T14177] ? __lock_acquire+0xe8b/0x1f40 [ 419.349536][T14177] ? __pfx_jffs2_do_read_inode_internal+0x10/0x10 [ 419.349552][T14177] ? lock_acquire+0x1d1/0x380 [ 419.349571][T14177] ? jffs2_do_read_inode+0x173/0x520 [ 419.349587][T14177] jffs2_do_read_inode+0x1b3/0x520 [ 419.349601][T14177] ? __pfx_jffs2_do_read_inode+0x10/0x10 [ 419.349615][T14177] ? __pfx_iget_locked+0x10/0x10 [ 419.349629][T14177] ? __mutex_lock+0x26c/0x1bd0 [ 419.349643][T14177] jffs2_iget+0x32b/0xe30 [ 419.349658][T14177] ? __pfx_jffs2_iget+0x10/0x10 [ 419.349675][T14177] ? generic_permission+0xae/0x800 [ 419.349690][T14177] jffs2_lookup+0x353/0x410 [ 419.349708][T14177] ? __pfx_jffs2_lookup+0x10/0x10 [ 419.349724][T14177] lookup_open+0xa79/0x1990 [ 419.349743][T14177] path_openat+0xa2c/0x2440 [ 419.349761][T14177] ? __pfx_path_openat+0x10/0x10 [ 419.349782][T14177] do_file_open+0x20e/0x430 [ 419.349799][T14177] ? __pfx_do_file_open+0x10/0x10 [ 419.349826][T14177] ? _raw_spin_unlock+0x28/0x50 [ 419.349841][T14177] ? alloc_fd+0x471/0x7a0 [ 419.349861][T14177] do_sys_openat2+0x10f/0x1e0 [ 419.349873][T14177] ? __pfx_do_sys_openat2+0x10/0x10 [ 419.349885][T14177] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 419.349897][T14177] ? __fget_files+0x21f/0x3d0 [ 419.349915][T14177] __ia32_sys_creat+0xcb/0x120 [ 419.349927][T14177] ? __pfx___ia32_sys_creat+0x10/0x10 [ 419.349940][T14177] ? __pfx_ksys_write+0x10/0x10 [ 419.349955][T14177] ? __do_fast_syscall_32+0xb3/0x8b0 [ 419.349968][T14177] __do_fast_syscall_32+0x13a/0x8b0 [ 419.349979][T14177] ? lockdep_hardirqs_on+0x7d/0x110 [ 419.349997][T14177] do_fast_syscall_32+0x32/0x70 [ 419.350009][T14177] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 419.350024][T14177] RIP: 0023:0xf7fb3fec [ 419.350036][T14177] Code: Unable to access opcode bytes at 0xf7fb3fc2. [ 419.350042][T14177] RSP: 002b:00000000f544550c EFLAGS: 00000292 ORIG_RAX: 0000000000000008 [ 419.350053][T14177] RAX: ffffffffffffffda RBX: 0000000080019840 RCX: 0000000000000040 [ 419.350060][T14177] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 419.350067][T14177] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 419.350073][T14177] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 419.350080][T14177] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 419.350095][T14177] [ 419.350997][T14177] jffs2: error: (14177) read_dnode: failed to allocate tn (56 bytes). [ 419.351082][T14177] jffs2: error: (14177) jffs2_do_read_inode_internal: cannot read nodes for ino 2, returned error is -12 [ 419.351213][T14177] jffs2: iget() failed for ino #2 [ 419.422244][T14178] jffs2: Checked all inodes but still 0x44 bytes of unchecked space? [ 419.422268][T14178] jffs2: No space for garbage collection. Aborting GC thread [ 420.221369][ T43] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 420.371530][ T43] usb 7-1: Using ep0 maxpacket: 8 [ 420.372096][ T43] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 420.374953][ T43] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 420.374983][ T43] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 420.375018][ T43] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 420.375041][ T43] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 420.375063][ T43] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 420.375086][ T43] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 420.375109][ T43] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 420.375132][ T43] usb 7-1: config 168 interface 0 has no altsetting 0 [ 420.376613][ T43] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 420.376642][ T43] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 420.376674][ T43] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 420.376698][ T43] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 420.376721][ T43] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 420.376773][ T43] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 420.376803][ T43] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 420.376827][ T43] usb 7-1: config 168 interface 0 has no altsetting 0 [ 420.377844][ T43] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 420.377872][ T43] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 420.377901][ T43] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 420.377921][ T43] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 420.377943][ T43] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 420.377967][ T43] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 420.377990][ T43] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 420.378014][ T43] usb 7-1: config 168 interface 0 has no altsetting 0 [ 420.405994][ T43] usb 7-1: string descriptor 0 read error: -22 [ 420.406107][ T43] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.472902][T14199] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 420.473251][T14199] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 420.475198][T14200] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2480'. [ 420.475887][T14198] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2480'. [ 420.510347][ T43] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 420.715080][T14190] tmpfs: Unknown parameter 'usrquotaû©Ò))9‡c>¶Pc°˜‚qt9¿òœ§`ÎÌ' [ 420.878359][T14216] sctp: [Deprecated]: syz.3.2485 (pid 14216) Use of int in max_burst socket option. [ 420.878359][T14216] Use struct sctp_assoc_value instead [ 420.878852][T14216] sctp: [Deprecated]: syz.3.2485 (pid 14216) Use of struct sctp_assoc_value in delayed_ack socket option. [ 420.878852][T14216] Use struct sctp_sack_info instead [ 421.010089][ T43] usb 7-1: USB disconnect, device number 28 [ 421.454031][ T5888] usb 8-1: new high-speed USB device number 112 using dummy_hcd [ 421.510712][ T9] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 421.693774][ T5888] usb 8-1: Using ep0 maxpacket: 8 [ 421.749643][ T9] usb 6-1: device descriptor read/64, error -71 [ 421.973703][ T5888] usb 8-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 421.990877][ T5888] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 421.990894][ T5888] usb 8-1: config 0 has no interface number 0 [ 421.990913][ T5888] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 421.990925][ T5888] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 421.990937][ T5888] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 421.990951][ T5888] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 421.990970][ T5888] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.101241][ T5888] usb 8-1: config 0 descriptor?? [ 422.200608][ T9] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 422.291585][ T5741] Bluetooth: hci2: command 0x2016 tx timeout [ 422.350797][ T5888] ldusb 8-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 422.410723][ T9] usb 6-1: device descriptor read/64, error -71 [ 422.520784][ T9] usb usb6-port1: attempt power cycle [ 422.910641][ T9] usb 6-1: new high-speed USB device number 102 using dummy_hcd [ 422.949017][ T9] usb 6-1: device descriptor read/8, error -71 [ 423.004631][T14232] lo speed is unknown, defaulting to 1000 [ 423.182393][ T9] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 423.185844][ T9468] usb 8-1: USB disconnect, device number 112 [ 423.191892][ T9468] ldusb 8-1:0.55: LD USB Device #0 now disconnected [ 423.213048][ T9] usb 6-1: device descriptor read/8, error -71 [ 423.244269][T14255] ovs-dp0: entered promiscuous mode [ 423.320833][ T9] usb usb6-port1: unable to enumerate USB device [ 423.877020][T14276] FAULT_INJECTION: forcing a failure. [ 423.877020][T14276] name failslab, interval 1, probability 0, space 0, times 0 [ 423.877042][T14276] CPU: 2 UID: 0 PID: 14276 Comm: syz.0.2505 Tainted: G L syzkaller #0 PREEMPT(full) [ 423.877058][T14276] Tainted: [L]=SOFTLOCKUP [ 423.877062][T14276] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 423.877069][T14276] Call Trace: [ 423.877074][T14276] [ 423.877079][T14276] dump_stack_lvl+0x100/0x190 [ 423.877098][T14276] should_fail_ex.cold+0x5/0xa [ 423.877113][T14276] should_failslab+0xc2/0x120 [ 423.877132][T14276] kmem_cache_alloc_noprof+0x92/0x6a0 [ 423.877147][T14276] ? skb_clone+0x190/0x400 [ 423.877164][T14276] skb_clone+0x190/0x400 [ 423.877178][T14276] netlink_deliver_tap+0xaed/0xcc0 [ 423.877200][T14276] netlink_unicast+0x6a5/0x850 [ 423.877214][T14276] ? __pfx_netlink_unicast+0x10/0x10 [ 423.877231][T14276] netlink_ack+0x655/0xb80 [ 423.877247][T14276] netlink_rcv_skb+0x333/0x420 [ 423.877259][T14276] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 423.877275][T14276] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 423.877293][T14276] ? netlink_deliver_tap+0x1ae/0xcc0 [ 423.877314][T14276] netlink_unicast+0x585/0x850 [ 423.877328][T14276] ? __pfx_netlink_unicast+0x10/0x10 [ 423.877344][T14276] netlink_sendmsg+0x8b0/0xda0 [ 423.877359][T14276] ? __pfx_netlink_sendmsg+0x10/0x10 [ 423.877372][T14276] ? apparmor_socket_sendmsg+0x165/0x280 [ 423.877387][T14276] ____sys_sendmsg+0xa4d/0xbe0 [ 423.877403][T14276] ? __pfx_netlink_sendmsg+0x10/0x10 [ 423.877417][T14276] ? __pfx_____sys_sendmsg+0x10/0x10 [ 423.877440][T14276] ___sys_sendmsg+0x190/0x1e0 [ 423.877457][T14276] ? __pfx____sys_sendmsg+0x10/0x10 [ 423.877482][T14276] ? find_held_lock+0x2b/0x80 [ 423.877504][T14276] __sys_sendmsg+0x160/0x210 [ 423.877518][T14276] ? __pfx___sys_sendmsg+0x10/0x10 [ 423.877536][T14276] ? __pfx_ksys_write+0x10/0x10 [ 423.877553][T14276] __do_fast_syscall_32+0x13a/0x8b0 [ 423.877565][T14276] ? lockdep_hardirqs_on+0x7d/0x110 [ 423.877584][T14276] do_fast_syscall_32+0x32/0x70 [ 423.877596][T14276] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 423.877610][T14276] RIP: 0023:0xf73befec [ 423.877623][T14276] Code: Unable to access opcode bytes at 0xf73befc2. [ 423.877628][T14276] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 423.877639][T14276] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000140 [ 423.877647][T14276] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 423.877653][T14276] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 423.877660][T14276] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 423.877666][T14276] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 423.877681][T14276] [ 424.371888][ T5741] Bluetooth: hci2: command 0x2016 tx timeout [ 426.555747][T14327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 426.555956][T14327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 427.086238][T14352] FAULT_INJECTION: forcing a failure. [ 427.086238][T14352] name failslab, interval 1, probability 0, space 0, times 0 [ 427.086261][T14352] CPU: 2 UID: 0 PID: 14352 Comm: syz.2.2534 Tainted: G L syzkaller #0 PREEMPT(full) [ 427.086277][T14352] Tainted: [L]=SOFTLOCKUP [ 427.086282][T14352] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 427.086288][T14352] Call Trace: [ 427.086292][T14352] [ 427.086298][T14352] dump_stack_lvl+0x100/0x190 [ 427.086316][T14352] should_fail_ex.cold+0x5/0xa [ 427.086332][T14352] should_failslab+0xc2/0x120 [ 427.086349][T14352] __kmalloc_noprof+0xfc/0x840 [ 427.086364][T14352] ? __asan_memcpy+0x3c/0x60 [ 427.086378][T14352] ? tls_decrypt_sg+0x76e/0x2c10 [ 427.086394][T14352] tls_decrypt_sg+0x76e/0x2c10 [ 427.086413][T14352] ? tls_strp_load_anchor_with_queue+0x29a/0x370 [ 427.086438][T14352] ? __pfx_tls_decrypt_sg+0x10/0x10 [ 427.086454][T14352] ? tls_strp_msg_load+0x229/0x710 [ 427.086467][T14352] ? tls_rx_rec_wait+0x6b3/0xa00 [ 427.086483][T14352] tls_rx_one_record+0x133/0x13e0 [ 427.086497][T14352] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 427.086510][T14352] ? __pfx_tls_rx_one_record+0x10/0x10 [ 427.086528][T14352] tls_sw_recvmsg+0x7a7/0x1600 [ 427.086548][T14352] ? __pfx_tls_sw_recvmsg+0x10/0x10 [ 427.086562][T14352] ? find_held_lock+0x2b/0x80 [ 427.086575][T14352] ? __fget_files+0x215/0x3d0 [ 427.086594][T14352] ? __pfx_tls_sw_recvmsg+0x10/0x10 [ 427.086607][T14352] inet6_recvmsg+0x455/0x4c0 [ 427.086619][T14352] ? bpf_lsm_socket_recvmsg+0x9/0x10 [ 427.086634][T14352] ? __pfx_inet6_recvmsg+0x10/0x10 [ 427.086647][T14352] sock_recvmsg+0x102/0x220 [ 427.086664][T14352] __sys_recvfrom+0x1f2/0x2f0 [ 427.086677][T14352] ? __pfx___sys_recvfrom+0x10/0x10 [ 427.086694][T14352] ? lock_acquire+0x1d1/0x380 [ 427.086719][T14352] __ia32_compat_sys_socketcall+0x5eb/0x770 [ 427.086738][T14352] ? __fget_files+0x21f/0x3d0 [ 427.086753][T14352] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 427.086772][T14352] ? xfd_validate_state+0x129/0x190 [ 427.086796][T14352] do_int80_emulation+0x166/0x650 [ 427.086810][T14352] asm_int80_emulation+0x1a/0x20 [ 427.086822][T14352] RIP: 0023:0xf710762b [ 427.086832][T14352] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 427.086843][T14352] RSP: 002b:00000000f53a435c EFLAGS: 00000246 ORIG_RAX: 0000000000000066 [ 427.086855][T14352] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 00000000f53a440c [ 427.086862][T14352] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 427.086868][T14352] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 427.086875][T14352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 427.086882][T14352] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 427.086896][T14352] [ 427.150796][ T43] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 427.300672][ T43] usb 6-1: Using ep0 maxpacket: 8 [ 427.301215][ T43] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 427.302009][ T43] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 427.302022][ T43] usb 6-1: config 0 has no interface number 0 [ 427.302040][ T43] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 427.302052][ T43] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 427.302065][ T43] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 427.302077][ T43] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 427.302097][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.303360][ T43] usb 6-1: config 0 descriptor?? [ 427.306282][ T43] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 427.488590][ T5100] Bluetooth: hci1: unexpected event 0x10 length: 4 > 1 [ 427.490648][ T5750] Bluetooth: hci1: hardware error 0x18 [ 427.504610][T14361] WARNING! power/level is deprecated; use power/control instead [ 427.583210][T14362] lo speed is unknown, defaulting to 1000 [ 427.838170][ T7467] usb 6-1: USB disconnect, device number 104 [ 427.838223][ C3] ldusb 6-1:0.55: usb_submit_urb failed (-19) [ 428.130660][ T5100] Bluetooth: hci2: command 0x2016 tx timeout [ 428.130749][ T5741] Bluetooth: hci2: Opcode 0x206a failed: -110 [ 428.200642][ T9468] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 428.350579][ T9468] usb 7-1: Using ep0 maxpacket: 8 [ 428.350636][ T43] usb 8-1: new high-speed USB device number 113 using dummy_hcd [ 428.351074][ T9468] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 428.351879][ T9468] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 428.351892][ T9468] usb 7-1: config 0 has no interface number 0 [ 428.351910][ T9468] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 428.351969][ T9468] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 428.351983][ T9468] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 428.351996][ T9468] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 428.352019][ T9468] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 428.353710][ T9468] usb 7-1: config 0 descriptor?? [ 428.359806][ T9468] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 428.480730][ T43] usb 8-1: device descriptor read/64, error -71 [ 428.610646][ T5741] Bluetooth: hci0: command 0x2016 tx timeout [ 428.630768][T14381] lo speed is unknown, defaulting to 1000 [ 428.720769][ T43] usb 8-1: new high-speed USB device number 114 using dummy_hcd [ 428.858050][ T43] usb 8-1: device descriptor read/64, error -71 [ 428.961522][ T43] usb usb8-port1: attempt power cycle [ 429.300664][ T43] usb 8-1: new high-speed USB device number 115 using dummy_hcd [ 429.321025][ T43] usb 8-1: device descriptor read/8, error -71 [ 429.560745][ T43] usb 8-1: new high-speed USB device number 116 using dummy_hcd [ 429.581184][ T43] usb 8-1: device descriptor read/8, error -71 [ 429.581970][ T5750] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 429.690782][ T43] usb usb8-port1: unable to enumerate USB device [ 429.912590][ T7467] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 430.020664][ T44] kauditd_printk_skb: 67 callbacks suppressed [ 430.020682][ T44] audit: type=1326 audit(1791972645.232:2215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14402 comm="syz.1.2552" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf748efec code=0x0 [ 430.345737][T14408] FAULT_INJECTION: forcing a failure. [ 430.345737][T14408] name failslab, interval 1, probability 0, space 0, times 0 [ 430.345877][T14408] CPU: 1 UID: 0 PID: 14408 Comm: syz.0.2554 Tainted: G L syzkaller #0 PREEMPT(full) [ 430.345895][T14408] Tainted: [L]=SOFTLOCKUP [ 430.345900][T14408] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 430.345908][T14408] Call Trace: [ 430.345928][T14408] [ 430.345949][T14408] dump_stack_lvl+0x100/0x190 [ 430.345980][T14408] should_fail_ex.cold+0x5/0xa [ 430.346007][T14408] should_failslab+0xc2/0x120 [ 430.346035][T14408] __kmalloc_cache_noprof+0x91/0x6d0 [ 430.346060][T14408] ? v4l2_fh_open+0x4c/0xa0 [ 430.346092][T14408] v4l2_fh_open+0x4c/0xa0 [ 430.346121][T14408] v4l2_open+0x1d2/0x490 [ 430.346145][T14408] ? __pfx_v4l2_open+0x10/0x10 [ 430.346161][T14408] chrdev_open+0x234/0x6a0 [ 430.346178][T14408] ? __pfx_apparmor_file_open+0x10/0x10 [ 430.346194][T14408] ? __pfx_chrdev_open+0x10/0x10 [ 430.346211][T14408] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 430.346226][T14408] do_dentry_open+0x6ab/0x14d0 [ 430.346242][T14408] ? __pfx_chrdev_open+0x10/0x10 [ 430.346264][T14408] vfs_open+0x82/0x3f0 [ 430.346277][T14408] path_openat+0x19fa/0x2440 [ 430.346296][T14408] ? __pfx_path_openat+0x10/0x10 [ 430.346317][T14408] do_file_open+0x20e/0x430 [ 430.346334][T14408] ? __pfx_do_file_open+0x10/0x10 [ 430.346361][T14408] ? _raw_spin_unlock+0x28/0x50 [ 430.346377][T14408] ? alloc_fd+0x471/0x7a0 [ 430.346397][T14408] do_sys_openat2+0x10f/0x1e0 [ 430.346409][T14408] ? __pfx_do_sys_openat2+0x10/0x10 [ 430.346419][T14408] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 430.346434][T14408] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 430.346449][T14408] ? __ia32_sys_futex_time32+0x2fd/0x470 [ 430.346465][T14408] __ia32_compat_sys_openat+0x12d/0x210 [ 430.346478][T14408] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 430.346498][T14408] do_int80_emulation+0x166/0x650 [ 430.346512][T14408] asm_int80_emulation+0x1a/0x20 [ 430.346524][T14408] RIP: 0023:0xf711762b [ 430.346534][T14408] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 430.346546][T14408] RSP: 002b:00000000f53d603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 430.346558][T14408] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f53d6100 [ 430.346566][T14408] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 430.346573][T14408] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 430.346580][T14408] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 430.346587][T14408] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 430.346601][T14408] [ 430.643737][T14421] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2560'. [ 430.690715][ T5741] Bluetooth: hci0: command 0x2016 tx timeout [ 430.927716][ T67] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 430.979221][ T9468] usb 7-1: USB disconnect, device number 29 [ 430.988155][ T9468] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 431.201894][T14430] FAULT_INJECTION: forcing a failure. [ 431.201894][T14430] name failslab, interval 1, probability 0, space 0, times 0 [ 431.201918][T14430] CPU: 1 UID: 0 PID: 14430 Comm: syz.3.2563 Tainted: G L syzkaller #0 PREEMPT(full) [ 431.201935][T14430] Tainted: [L]=SOFTLOCKUP [ 431.201940][T14430] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 431.201947][T14430] Call Trace: [ 431.201953][T14430] [ 431.201958][T14430] dump_stack_lvl+0x100/0x190 [ 431.201991][T14430] should_fail_ex.cold+0x5/0xa [ 431.202008][T14430] should_failslab+0xc2/0x120 [ 431.202026][T14430] __kmalloc_cache_noprof+0x91/0x6d0 [ 431.202040][T14430] ? v4l2_fh_open+0x4c/0xa0 [ 431.202059][T14430] v4l2_fh_open+0x4c/0xa0 [ 431.202075][T14430] v4l2_open+0x1d2/0x490 [ 431.202092][T14430] ? __pfx_v4l2_open+0x10/0x10 [ 431.202108][T14430] chrdev_open+0x234/0x6a0 [ 431.202124][T14430] ? __pfx_apparmor_file_open+0x10/0x10 [ 431.202140][T14430] ? __pfx_chrdev_open+0x10/0x10 [ 431.202158][T14430] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 431.202172][T14430] do_dentry_open+0x6ab/0x14d0 [ 431.202188][T14430] ? __pfx_chrdev_open+0x10/0x10 [ 431.202207][T14430] vfs_open+0x82/0x3f0 [ 431.202220][T14430] path_openat+0x19fa/0x2440 [ 431.202239][T14430] ? __pfx_path_openat+0x10/0x10 [ 431.202262][T14430] do_file_open+0x20e/0x430 [ 431.202280][T14430] ? __pfx_do_file_open+0x10/0x10 [ 431.202306][T14430] ? _raw_spin_unlock+0x28/0x50 [ 431.202322][T14430] ? alloc_fd+0x471/0x7a0 [ 431.202342][T14430] do_sys_openat2+0x10f/0x1e0 [ 431.202354][T14430] ? __pfx_do_sys_openat2+0x10/0x10 [ 431.202366][T14430] ? handle_softirqs+0x1e6/0x9d0 [ 431.202387][T14430] __ia32_compat_sys_openat+0x12d/0x210 [ 431.202400][T14430] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 431.202419][T14430] do_int80_emulation+0x166/0x650 [ 431.202433][T14430] asm_int80_emulation+0x1a/0x20 [ 431.202445][T14430] RIP: 0023:0xf71a762b [ 431.202455][T14430] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 431.202466][T14430] RSP: 002b:00000000f546603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 431.202478][T14430] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f5466100 [ 431.202486][T14430] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 431.202492][T14430] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 431.202499][T14430] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 431.202506][T14430] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 431.202520][T14430] [ 431.770741][ T9468] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 431.808533][T14449] jffs2: notice: (14449) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 431.921042][ T9468] usb 6-1: Using ep0 maxpacket: 8 [ 431.921770][ T9468] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 431.923009][ T9468] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 431.923038][ T9468] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 431.923072][ T9468] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 431.923160][ T9468] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 431.923183][ T9468] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 431.923204][ T9468] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 431.923227][ T9468] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 431.923250][ T9468] usb 6-1: config 168 interface 0 has no altsetting 0 [ 431.924415][ T9468] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 431.924445][ T9468] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 431.924476][ T9468] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 431.924563][ T9468] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 431.924586][ T9468] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 431.924608][ T9468] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 431.924630][ T9468] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 431.924653][ T9468] usb 6-1: config 168 interface 0 has no altsetting 0 [ 431.925865][ T9468] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 431.925892][ T9468] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 431.925922][ T9468] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 431.926008][ T9468] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 431.926030][ T9468] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 431.926053][ T9468] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 431.926076][ T9468] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 431.926100][ T9468] usb 6-1: config 168 interface 0 has no altsetting 0 [ 431.929209][ T9468] usb 6-1: string descriptor 0 read error: -22 [ 431.929305][ T9468] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 431.945012][ T9468] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 432.100632][ T7467] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 432.141830][T14443] tmpfs: Unknown parameter 'usrquotaû©Ò))9‡c>¶Pc°˜‚qt9¿òœ§`ÎÌ' [ 432.340600][ T7467] usb 7-1: Using ep0 maxpacket: 8 [ 432.360877][ T7467] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 432.383129][ T7467] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 432.383192][ T7467] usb 7-1: config 0 has no interface number 0 [ 432.383213][ T7467] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 432.383225][ T7467] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 432.383238][ T7467] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 432.383251][ T7467] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 432.383272][ T7467] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.411503][ T7467] usb 7-1: config 0 descriptor?? [ 432.425094][ T7467] ldusb 7-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 432.427678][ T5846] usb 6-1: USB disconnect, device number 105 [ 432.492302][ T43] usb 8-1: new high-speed USB device number 117 using dummy_hcd [ 432.640269][T14454] lo speed is unknown, defaulting to 1000 [ 432.641100][ T43] usb 8-1: Using ep0 maxpacket: 8 [ 432.641556][ T43] usb 8-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 432.642576][ T43] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 432.642589][ T43] usb 8-1: config 0 has no interface number 0 [ 432.642607][ T43] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 432.642619][ T43] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 432.642632][ T43] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 432.642644][ T43] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 432.642664][ T43] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.647802][ T43] usb 8-1: config 0 descriptor?? [ 432.653333][ T43] ldusb 8-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 432.743516][T14466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 432.743814][T14466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 432.780611][ T7467] usb 7-1: USB disconnect, device number 30 [ 432.785962][ T7467] ldusb 7-1:0.55: LD USB Device #1 now disconnected [ 432.920325][T14467] lo speed is unknown, defaulting to 1000 [ 433.181843][ T7467] usb 8-1: USB disconnect, device number 117 [ 433.181942][ C1] ldusb 8-1:0.55: usb_submit_urb failed (-19) [ 433.210726][ T5835] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 433.360733][ T5835] usb 6-1: Using ep0 maxpacket: 8 [ 433.361341][ T5835] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 433.362353][ T5835] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 433.362375][ T5835] usb 6-1: config 0 has no interface number 0 [ 433.362407][ T5835] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 433.362428][ T5835] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 433.362449][ T5835] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 433.362471][ T5835] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 433.362504][ T5835] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.364472][ T5835] usb 6-1: config 0 descriptor?? [ 433.369365][ T5835] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 433.616859][T14480] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 433.617034][T14480] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512 [ 433.617047][T14480] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 433.617054][T14480] UDF-fs: Scanning with blocksize 512 failed [ 433.618265][T14480] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 433.618335][T14480] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512 [ 433.618413][T14480] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 433.618421][T14480] UDF-fs: Scanning with blocksize 1024 failed [ 433.618830][T14480] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 433.618948][T14480] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512 [ 433.618960][T14480] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 433.618967][T14480] UDF-fs: Scanning with blocksize 2048 failed [ 433.619473][T14480] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 433.619577][T14480] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512 [ 433.619592][T14480] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 433.619602][T14480] UDF-fs: Scanning with blocksize 4096 failed [ 433.619609][T14480] UDF-fs: warning (device loop2): udf_fill_super: No partition found (1) [ 434.082630][T14498] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2589'. [ 434.352217][T14504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 434.352744][T14504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 434.416553][T14505] lo speed is unknown, defaulting to 1000 [ 434.719004][T14511] netlink: 'syz.2.2592': attribute type 5 has an invalid length. [ 434.719019][T14511] netlink: 3657 bytes leftover after parsing attributes in process `syz.2.2592'. [ 434.883872][T14511] kAFS: No cell specified [ 435.232220][ T7467] ldusb 8-1:0.55: LD USB Device #0 now disconnected [ 435.615958][ T44] audit: type=1326 audit(1791972650.832:2216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14542 comm="syz.3.2601" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 435.616023][ T44] audit: type=1326 audit(1791972650.832:2217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14542 comm="syz.3.2601" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 435.616266][ T44] audit: type=1326 audit(1791972650.832:2218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14542 comm="syz.3.2601" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 435.616426][ T44] audit: type=1326 audit(1791972650.832:2219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14542 comm="syz.3.2601" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 435.616453][ T44] audit: type=1326 audit(1791972650.832:2220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14542 comm="syz.3.2601" exe="/syz-executor" sig=0 arch=40000003 syscall=356 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 435.616591][ T44] audit: type=1326 audit(1791972650.832:2221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14542 comm="syz.3.2601" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 435.616615][ T44] audit: type=1326 audit(1791972650.832:2222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14542 comm="syz.3.2601" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 435.616757][ T44] audit: type=1326 audit(1791972650.832:2223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14542 comm="syz.3.2601" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 435.616926][ T44] audit: type=1326 audit(1791972650.832:2224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14542 comm="syz.3.2601" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 435.616950][ T44] audit: type=1326 audit(1791972650.832:2225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14542 comm="syz.3.2601" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71a762b code=0x7ffc0000 [ 435.617271][T14543] FAULT_INJECTION: forcing a failure. [ 435.617271][T14543] name failslab, interval 1, probability 0, space 0, times 0 [ 435.617297][T14543] CPU: 3 UID: 0 PID: 14543 Comm: syz.3.2601 Tainted: G L syzkaller #0 PREEMPT(full) [ 435.617313][T14543] Tainted: [L]=SOFTLOCKUP [ 435.617317][T14543] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 435.617324][T14543] Call Trace: [ 435.617328][T14543] [ 435.617333][T14543] dump_stack_lvl+0x100/0x190 [ 435.617353][T14543] should_fail_ex.cold+0x5/0xa [ 435.617368][T14543] should_failslab+0xc2/0x120 [ 435.617386][T14543] __kvmalloc_node_noprof+0x113/0x9b0 [ 435.617403][T14543] ? lockdep_init_map_type+0x5c/0x250 [ 435.617420][T14543] ? simple_xattr_alloc+0x6c/0xd0 [ 435.617435][T14543] simple_xattr_alloc+0x6c/0xd0 [ 435.617448][T14543] simple_xattr_set+0xa8/0x3cb0 [ 435.617462][T14543] ? __lock_acquire+0x5c0/0x1f40 [ 435.617480][T14543] ? __kernel_text_address+0xd/0x30 [ 435.617496][T14543] ? __pfx_shmem_xattr_handler_set+0x10/0x10 [ 435.617512][T14543] ? shmem_xattr_handler_set+0xe2/0x3c0 [ 435.617527][T14543] shmem_xattr_handler_set+0xe2/0x3c0 [ 435.617544][T14543] ? __pfx_shmem_xattr_handler_set+0x10/0x10 [ 435.617558][T14543] __vfs_setxattr+0x175/0x1e0 [ 435.617576][T14543] ? __pfx___vfs_setxattr+0x10/0x10 [ 435.617591][T14543] ? generic_permission+0xae/0x800 [ 435.617607][T14543] __vfs_setxattr_noperm+0x127/0x660 [ 435.617627][T14543] __vfs_setxattr_locked+0x127/0x2b0 [ 435.617646][T14543] vfs_setxattr+0x14a/0x390 [ 435.617663][T14543] ? mnt_get_write_access+0x52/0x2f0 [ 435.617676][T14543] ? __pfx_vfs_setxattr+0x10/0x10 [ 435.617692][T14543] ? mnt_get_write_access+0x52/0x2f0 [ 435.617705][T14543] ? mnt_get_write_access+0x52/0x2f0 [ 435.617719][T14543] do_setxattr+0x145/0x180 [ 435.617750][T14543] file_setxattr+0x139/0x1b0 [ 435.617767][T14543] ? fdget+0x17a/0x210 [ 435.617781][T14543] path_setxattrat+0x335/0x3b0 [ 435.617799][T14543] ? __pfx_path_setxattrat+0x10/0x10 [ 435.617833][T14543] ? fput+0x7c/0x100 [ 435.617849][T14543] ? ksys_write+0x1ac/0x250 [ 435.617865][T14543] __ia32_sys_fsetxattr+0xc4/0x140 [ 435.617884][T14543] __do_fast_syscall_32+0x13a/0x8b0 [ 435.617897][T14543] ? lockdep_hardirqs_on+0x7d/0x110 [ 435.617915][T14543] do_fast_syscall_32+0x32/0x70 [ 435.617927][T14543] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 435.617942][T14543] RIP: 0023:0xf7fb3fec [ 435.617955][T14543] Code: Unable to access opcode bytes at 0xf7fb3fc2. [ 435.617960][T14543] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 00000000000000e4 [ 435.617972][T14543] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000dc0 [ 435.617980][T14543] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 435.617987][T14543] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 435.617993][T14543] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 435.618000][T14543] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 435.618015][T14543] [ 435.986095][ T9463] usb 6-1: USB disconnect, device number 106 [ 435.986254][ C3] ldusb 6-1:0.55: usb_submit_urb failed (-19) [ 435.993517][ T9463] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 436.035854][ T67] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 436.043517][ T5888] usb 8-1: new high-speed USB device number 118 using dummy_hcd [ 436.170682][ T5888] usb 8-1: device descriptor read/64, error -71 [ 436.350691][ T42] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 436.410733][ T5888] usb 8-1: new high-speed USB device number 119 using dummy_hcd [ 436.510609][ T42] usb 7-1: Using ep0 maxpacket: 8 [ 436.511081][ T42] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 436.512604][ T42] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 436.512618][ T42] usb 7-1: config 0 has no interface number 0 [ 436.512637][ T42] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 436.512649][ T42] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 436.512679][ T42] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 436.512692][ T42] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 436.512712][ T42] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.513864][ T42] usb 7-1: config 0 descriptor?? [ 436.518217][ T42] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 436.542797][ T5888] usb 8-1: device descriptor read/64, error -71 [ 436.625314][T14563] No such timeout policy "syz1" [ 436.625376][T14564] No such timeout policy "syz1" [ 436.653027][ T5888] usb usb8-port1: attempt power cycle [ 436.670978][T14567] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2611'. [ 436.670997][T14567] openvswitch: netlink: Missing key (keys=c0, expected=20080) [ 436.671881][T14567] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 436.759479][T14574] FAULT_INJECTION: forcing a failure. [ 436.759479][T14574] name failslab, interval 1, probability 0, space 0, times 0 [ 436.759516][T14574] CPU: 3 UID: 0 PID: 14574 Comm: syz.1.2614 Tainted: G L syzkaller #0 PREEMPT(full) [ 436.759548][T14574] Tainted: [L]=SOFTLOCKUP [ 436.759556][T14574] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 436.759567][T14574] Call Trace: [ 436.759574][T14574] [ 436.759582][T14574] dump_stack_lvl+0x100/0x190 [ 436.759611][T14574] should_fail_ex.cold+0x5/0xa [ 436.759634][T14574] should_failslab+0xc2/0x120 [ 436.759666][T14574] __kmalloc_cache_noprof+0x91/0x6d0 [ 436.759691][T14574] ? v4l2_fh_open+0x4c/0xa0 [ 436.759726][T14574] v4l2_fh_open+0x4c/0xa0 [ 436.759752][T14574] v4l2_open+0x1d2/0x490 [ 436.759778][T14574] ? __pfx_v4l2_open+0x10/0x10 [ 436.759802][T14574] chrdev_open+0x234/0x6a0 [ 436.759826][T14574] ? __pfx_apparmor_file_open+0x10/0x10 [ 436.759853][T14574] ? __pfx_chrdev_open+0x10/0x10 [ 436.759883][T14574] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 436.759912][T14574] do_dentry_open+0x6ab/0x14d0 [ 436.759937][T14574] ? __pfx_chrdev_open+0x10/0x10 [ 436.759968][T14574] vfs_open+0x82/0x3f0 [ 436.759989][T14574] path_openat+0x19fa/0x2440 [ 436.760018][T14574] ? __pfx_path_openat+0x10/0x10 [ 436.760055][T14574] do_file_open+0x20e/0x430 [ 436.760087][T14574] ? __pfx_do_file_open+0x10/0x10 [ 436.760130][T14574] ? _raw_spin_unlock+0x28/0x50 [ 436.760154][T14574] ? alloc_fd+0x471/0x7a0 [ 436.760191][T14574] do_sys_openat2+0x10f/0x1e0 [ 436.760213][T14574] ? __pfx_do_sys_openat2+0x10/0x10 [ 436.760231][T14574] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 436.760259][T14574] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 436.760283][T14574] ? __ia32_sys_futex_time32+0x2fd/0x470 [ 436.760309][T14574] __ia32_compat_sys_openat+0x12d/0x210 [ 436.760330][T14574] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 436.760362][T14574] do_int80_emulation+0x166/0x650 [ 436.760387][T14574] asm_int80_emulation+0x1a/0x20 [ 436.760408][T14574] RIP: 0023:0xf71e762b [ 436.760425][T14574] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 436.760443][T14574] RSP: 002b:00000000f54a603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 436.760460][T14574] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f54a6100 [ 436.760471][T14574] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 436.760482][T14574] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 436.760492][T14574] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 436.760503][T14574] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 436.760541][T14574] [ 436.909032][T14578] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 436.990659][ T5888] usb 8-1: new high-speed USB device number 120 using dummy_hcd [ 437.011291][ T5888] usb 8-1: device descriptor read/8, error -71 [ 437.069419][T14583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 437.069749][T14583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 437.139321][T14584] lo speed is unknown, defaulting to 1000 [ 437.250698][ T5888] usb 8-1: new high-speed USB device number 121 using dummy_hcd [ 437.271172][ T5888] usb 8-1: device descriptor read/8, error -71 [ 437.381300][ T5888] usb usb8-port1: unable to enumerate USB device [ 437.450614][ T9463] usb 6-1: new high-speed USB device number 107 using dummy_hcd [ 437.600678][ T9463] usb 6-1: Using ep0 maxpacket: 8 [ 437.601180][ T9463] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 437.602008][ T9463] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 437.602087][ T9463] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 437.602107][ T9463] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 437.602120][ T9463] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 437.602133][ T9463] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 437.602146][ T9463] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 437.602159][ T9463] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 437.602172][ T9463] usb 6-1: config 168 interface 0 has no altsetting 0 [ 437.603052][ T9463] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 437.603068][ T9463] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 437.603152][ T9463] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 437.603166][ T9463] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 437.603179][ T9463] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 437.603191][ T9463] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 437.603208][ T9463] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 437.603221][ T9463] usb 6-1: config 168 interface 0 has no altsetting 0 [ 437.604119][ T9463] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 437.604181][ T9463] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 437.604203][ T9463] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 437.604216][ T9463] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 437.604229][ T9463] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 437.604241][ T9463] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 437.604254][ T9463] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 437.604267][ T9463] usb 6-1: config 168 interface 0 has no altsetting 0 [ 437.606756][ T9463] usb 6-1: string descriptor 0 read error: -22 [ 437.606816][ T9463] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.863483][T14590] tmpfs: Unknown parameter 'usrquotaû©Ò))9‡c>¶Pc°˜‚qt9¿òœ§`ÎÌ' [ 438.776884][ T43] usb 7-1: USB disconnect, device number 31 [ 438.776994][ C2] ldusb 7-1:0.55: usb_submit_urb failed (-19) [ 438.777358][ T9463] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux1 [ 438.794936][ T9463] usb 6-1: USB disconnect, device number 107 [ 438.795193][ T43] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 439.225501][T14600] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 439.225535][T14600] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.225559][T14600] netdevsim netdevsim3 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 439.263184][T14604] ipvlan3: entered promiscuous mode [ 439.263896][T14604] bridge0: port 1(ipvlan3) entered blocking state [ 439.264060][T14604] bridge0: port 1(ipvlan3) entered disabled state [ 439.264156][T14604] ipvlan3: entered allmulticast mode [ 439.264169][T14604] bridge0: entered allmulticast mode [ 439.266524][T14604] ipvlan3: left allmulticast mode [ 439.266538][T14604] bridge0: left allmulticast mode [ 439.399515][T14600] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 439.399538][T14600] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.399552][T14600] netdevsim netdevsim3 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 439.467983][T14600] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 439.468016][T14600] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.468039][T14600] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 439.506120][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.563472][T14600] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 439.563494][T14600] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.563508][T14600] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 439.706885][ T9756] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 439.706916][ T9756] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 439.706935][ T9756] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 439.711364][ T12] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 439.711394][ T12] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 439.711415][ T12] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 439.721045][ T12] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 439.721064][ T12] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 439.721078][ T12] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 439.721097][ T12] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 439.721111][ T12] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 439.721125][ T12] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 439.769357][T14617] netlink: 'syz.2.2628': attribute type 1 has an invalid length. [ 439.769380][T14617] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2628'. [ 440.210948][ T43] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 440.351726][ T43] usb 7-1: device descriptor read/64, error -71 [ 440.403900][T14627] ±ÿ: renamed from bridge_slave_1 (while UP) [ 440.432789][ T5750] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 440.457647][T14636] lo speed is unknown, defaulting to 1000 [ 440.590677][ T43] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 440.720839][ T43] usb 7-1: device descriptor read/64, error -71 [ 440.741067][ T5846] usb 8-1: new high-speed USB device number 122 using dummy_hcd [ 440.841235][ T43] usb usb7-port1: attempt power cycle [ 440.890646][ T5846] usb 8-1: Using ep0 maxpacket: 8 [ 440.891263][ T5846] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 440.892568][ T5846] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 440.892595][ T5846] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 440.892626][ T5846] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 440.892761][ T5846] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 440.892793][ T5846] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 440.892807][ T5846] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 440.892820][ T5846] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 440.892833][ T5846] usb 8-1: config 168 interface 0 has no altsetting 0 [ 440.893612][ T5846] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 440.893629][ T5846] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 440.893646][ T5846] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 440.893660][ T5846] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 440.893672][ T5846] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 440.893684][ T5846] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 440.893697][ T5846] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 440.893710][ T5846] usb 8-1: config 168 interface 0 has no altsetting 0 [ 440.894444][ T5846] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 440.894459][ T5846] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 440.894480][ T5846] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 440.894493][ T5846] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 440.894505][ T5846] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 440.894517][ T5846] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 440.894530][ T5846] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 440.894543][ T5846] usb 8-1: config 168 interface 0 has no altsetting 0 [ 440.896736][ T5846] usb 8-1: string descriptor 0 read error: -22 [ 440.896788][ T5846] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.901180][ T5846] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 440.972297][ T5750] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 441.170719][ T43] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 441.188591][T14648] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2640'. [ 441.191038][ T43] usb 7-1: device descriptor read/8, error -71 [ 441.663484][T14656] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2642'. [ 441.700801][ T43] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 441.717679][T14658] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2643'. [ 441.739813][ T43] usb 7-1: device descriptor read/8, error -71 [ 441.834651][T14661] netlink: 'syz.1.2644': attribute type 1 has an invalid length. [ 441.834665][T14661] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2644'. [ 441.864691][ T43] usb usb7-port1: unable to enumerate USB device [ 443.364697][T14675] lo speed is unknown, defaulting to 1000 [ 443.565638][ T9470] usb 8-1: USB disconnect, device number 122 [ 443.633417][ T5750] Bluetooth: hci0: unexpected event 0x03 length: 1 < 11 [ 443.802275][T14685] FAULT_INJECTION: forcing a failure. [ 443.802275][T14685] name fail_futex, interval 1, probability 0, space 0, times 0 [ 443.802299][T14685] CPU: 2 UID: 0 PID: 14685 Comm: syz.0.2651 Tainted: G L syzkaller #0 PREEMPT(full) [ 443.802316][T14685] Tainted: [L]=SOFTLOCKUP [ 443.802320][T14685] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 443.802328][T14685] Call Trace: [ 443.802333][T14685] [ 443.802338][T14685] dump_stack_lvl+0x100/0x190 [ 443.802357][T14685] should_fail_ex.cold+0x5/0xa [ 443.802374][T14685] get_futex_key+0x1d0/0x14f0 [ 443.802390][T14685] ? __pfx_get_futex_key+0x10/0x10 [ 443.802408][T14685] futex_wake+0xf4/0x5e0 [ 443.802427][T14685] ? __pfx_futex_wake+0x10/0x10 [ 443.802442][T14685] ? kasan_quarantine_put+0x104/0x240 [ 443.802461][T14685] ? putname+0xb1/0x110 [ 443.802476][T14685] ? kmem_cache_free+0x127/0x6c0 [ 443.802492][T14685] do_futex+0x2b2/0x440 [ 443.802506][T14685] ? __pfx_do_futex+0x10/0x10 [ 443.802517][T14685] ? do_sys_openat2+0x159/0x1e0 [ 443.802529][T14685] ? __pfx_do_sys_openat2+0x10/0x10 [ 443.802540][T14685] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 443.802554][T14685] __ia32_sys_futex_time32+0x2f4/0x470 [ 443.802571][T14685] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 443.802587][T14685] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 443.802604][T14685] __do_fast_syscall_32+0x13a/0x8b0 [ 443.802615][T14685] ? lockdep_hardirqs_on+0x7d/0x110 [ 443.802634][T14685] do_fast_syscall_32+0x32/0x70 [ 443.802646][T14685] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 443.802660][T14685] RIP: 0023:0xf73befec [ 443.802673][T14685] Code: Unable to access opcode bytes at 0xf73befc2. [ 443.802679][T14685] RSP: 002b:00000000f53d65cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 443.802691][T14685] RAX: ffffffffffffffda RBX: 00000000f73e4f8c RCX: 0000000000000081 [ 443.802698][T14685] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 443.802705][T14685] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 443.802712][T14685] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 443.802719][T14685] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 443.802733][T14685] [ 443.992121][T14692] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2653'. [ 444.470649][ T5835] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 444.600789][ T5835] usb 7-1: device descriptor read/64, error -71 [ 444.800793][ T5846] usb 8-1: new high-speed USB device number 123 using dummy_hcd [ 444.840749][ T5835] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 444.961331][ T5846] usb 8-1: Using ep0 maxpacket: 8 [ 444.961857][ T5846] usb 8-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 444.964496][ T5846] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 444.964597][ T5846] usb 8-1: config 0 has no interface number 0 [ 444.964651][ T5846] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 444.964672][ T5846] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 444.964692][ T5846] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 444.964713][ T5846] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 444.964746][ T5846] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.966781][ T5846] usb 8-1: config 0 descriptor?? [ 444.976496][ T9468] usb 5-1: USB disconnect, device number 44 [ 444.976533][ T5835] usb 7-1: device descriptor read/64, error -71 [ 445.007087][ T5846] ldusb 8-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 445.084206][ T5835] usb usb7-port1: attempt power cycle [ 445.259490][T14712] lo speed is unknown, defaulting to 1000 [ 445.290691][ T5888] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 445.420958][ T5835] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 445.440713][ T5888] usb 6-1: device descriptor read/64, error -71 [ 445.441694][ T5835] usb 7-1: device descriptor read/8, error -71 [ 445.690825][ T5835] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 445.691589][ T5888] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 445.711355][ T5835] usb 7-1: device descriptor read/8, error -71 [ 445.830832][ T5888] usb 6-1: device descriptor read/64, error -71 [ 445.830910][ T5835] usb usb7-port1: unable to enumerate USB device [ 445.951361][ T5888] usb usb6-port1: attempt power cycle [ 446.304605][ T5888] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 446.322956][ T5888] usb 6-1: device descriptor read/8, error -71 [ 446.570955][ T5888] usb 6-1: new high-speed USB device number 111 using dummy_hcd [ 446.592771][ T5888] usb 6-1: device descriptor read/8, error -71 [ 446.711454][ T5888] usb usb6-port1: unable to enumerate USB device [ 447.387101][T14726] lo speed is unknown, defaulting to 1000 [ 447.608634][ T5846] usb 8-1: USB disconnect, device number 123 [ 447.626174][ T5846] ldusb 8-1:0.55: LD USB Device #0 now disconnected [ 447.768696][ T5750] Bluetooth: hci0: unexpected event 0x03 length: 1 < 11 [ 448.260748][ T5888] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 448.547881][ T5888] usb 5-1: Using ep0 maxpacket: 8 [ 448.570769][ T5846] usb 6-1: new high-speed USB device number 112 using dummy_hcd [ 448.614227][ T5888] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 448.711065][ T5846] usb 6-1: device descriptor read/64, error -71 [ 448.737608][ T5888] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 448.737630][ T5888] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 448.737649][ T5888] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 448.737662][ T5888] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 448.737675][ T5888] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 448.737688][ T5888] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 448.737701][ T5888] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 448.737715][ T5888] usb 5-1: config 168 interface 0 has no altsetting 0 [ 448.789500][ T5888] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 448.789522][ T5888] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 448.789541][ T5888] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 448.789555][ T5888] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 448.789601][ T5888] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 448.789615][ T5888] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 448.789628][ T5888] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 448.789641][ T5888] usb 5-1: config 168 interface 0 has no altsetting 0 [ 448.847093][ T5888] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 448.847116][ T5888] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 448.847135][ T5888] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 448.847148][ T5888] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 448.847161][ T5888] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 448.847174][ T5888] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 448.847187][ T5888] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 448.847200][ T5888] usb 5-1: config 168 interface 0 has no altsetting 0 [ 448.951607][ T5888] usb 5-1: string descriptor 0 read error: -22 [ 448.951679][ T5888] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.970714][ T5846] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 449.101837][ T5846] usb 6-1: device descriptor read/64, error -71 [ 449.214150][ T5846] usb usb6-port1: attempt power cycle [ 449.217222][ T5888] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 449.423256][T14753] 842_decompress: index4 to 8b off 22c adjoff a2c tot a30 data 0 [ 449.423266][T14753] 842_decompress: op is 22 [ 449.423272][T14753] 842_decompress: op is 12 [ 449.423277][T14753] 842_decompress: index2 to d9 off 1b2 adjoff 9b2 tot a30 data 1cf7 [ 449.423287][T14753] 842_decompress: op is 40 [ 449.423293][T14753] 842_decompress: template is 19 [ 449.423298][T14753] 842_decompress: op is 18 [ 449.423303][T14753] 842_decompress: index8 to 26 off 130 adjoff 930 tot a38 data 7201000000000000 [ 449.423314][T14753] 842_decompress: op is 40 [ 449.423319][T14753] 842_decompress: op is 40 [ 449.423324][T14753] 842_decompress: op is 40 [ 449.423329][T14753] 842_decompress: template is 1c [ 449.423335][T14753] 842_decompress: template is 1b [ 449.423341][T14753] 842_decompress: template is 19 [ 449.423346][T14753] 842_decompress: op is 18 [ 449.423351][T14753] 842_decompress: index8 to 2f off 178 adjoff 978 tot a80 data 1000000 [ 449.423361][T14753] 842_decompress: op is 40 [ 449.423367][T14753] 842_decompress: op is 40 [ 449.423372][T14753] 842_decompress: op is 40 [ 449.423377][T14753] 842_decompress: template is 1c [ 449.423383][T14753] 842_decompress: template is 1b [ 449.423388][T14753] 842_decompress: template is 9 [ 449.423394][T14753] 842_decompress: op is 22 [ 449.423399][T14753] 842_decompress: op is 12 [ 449.423404][T14753] 842_decompress: index2 to 1b off 36 adjoff a36 tot ab8 data 1cf7 [ 449.423414][T14753] 842_decompress: op is 14 [ 449.423420][T14753] 842_decompress: index4 to 8e off 238 adjoff a38 tot ab8 data 72010000 [ 449.423430][T14753] 842_decompress: op is 40 [ 449.423435][T14753] 842_decompress: template is 1c [ 449.423441][T14753] 842_decompress: template is 1b [ 449.423447][T14753] 842_decompress: template is 19 [ 449.423452][T14753] 842_decompress: op is 18 [ 449.423458][T14753] 842_decompress: index8 to 40 off 200 adjoff a00 tot b08 data 100000000000000 [ 449.423468][T14753] 842_decompress: op is 40 [ 449.423473][T14753] 842_decompress: op is 40 [ 449.423478][T14753] 842_decompress: op is 40 [ 449.423484][T14753] 842_decompress: template is 1c [ 449.423489][T14753] 842_decompress: template is 1b [ 449.423495][T14753] 842_decompress: template is 15 [ 449.423500][T14753] 842_decompress: op is 14 [ 449.423506][T14753] 842_decompress: index4 to cd off 334 adjoff b34 tot b38 data 0 [ 449.423516][T14753] 842_decompress: op is 22 [ 449.423521][T14753] 842_decompress: op is 12 [ 449.423526][T14753] 842_decompress: index2 to 5d off ba adjoff aba tot b38 data 1cf7 [ 449.423536][T14753] 842_decompress: op is 40 [ 449.423542][T14753] 842_decompress: template is 19 [ 449.423547][T14753] 842_decompress: op is 18 [ 449.423552][T14753] 842_decompress: index8 to 47 off 238 adjoff a38 tot b40 data 7201000000000000 [ 449.423563][T14753] 842_decompress: op is 40 [ 449.423568][T14753] 842_decompress: op is 40 [ 449.423573][T14753] 842_decompress: op is 40 [ 449.423578][T14753] 842_decompress: template is 1c [ 449.423584][T14753] 842_decompress: template is 1b [ 449.423590][T14753] 842_decompress: template is 19 [ 449.423595][T14753] 842_decompress: op is 18 [ 449.423600][T14753] 842_decompress: index8 to 50 off 280 adjoff a80 tot b88 data 1000000 [ 449.423610][T14753] 842_decompress: op is 40 [ 449.423616][T14753] 842_decompress: op is 40 [ 449.423621][T14753] 842_decompress: op is 40 [ 449.423626][T14753] 842_decompress: template is 1c [ 449.423632][T14753] 842_decompress: template is 1b [ 449.423638][T14753] 842_decompress: template is 9 [ 449.423643][T14753] 842_decompress: op is 22 [ 449.423648][T14753] 842_decompress: op is 12 [ 449.423654][T14753] 842_decompress: index2 to 9f off 13e adjoff b3e tot bc0 data 1cf7 [ 449.423663][T14753] 842_decompress: op is 14 [ 449.423669][T14753] 842_decompress: index4 to d0 off 340 adjoff b40 tot bc0 data 72010000 [ 449.423679][T14753] 842_decompress: op is 40 [ 449.423684][T14753] 842_decompress: template is 1c [ 449.423690][T14753] 842_decompress: template is 1b [ 449.423696][T14753] 842_decompress: template is 19 [ 449.423701][T14753] 842_decompress: op is 18 [ 449.423706][T14753] 842_decompress: index8 to 61 off 308 adjoff b08 tot c10 data 100000000000000 [ 449.423717][T14753] 842_decompress: op is 40 [ 449.423722][T14753] 842_decompress: op is 40 [ 449.423727][T14753] 842_decompress: op is 40 [ 449.423732][T14753] 842_decompress: template is 1c [ 449.423741][T14753] 842_decompress: template is 1b [ 449.423747][T14753] 842_decompress: template is 15 [ 449.423753][T14753] 842_decompress: op is 14 [ 449.423758][T14753] 842_decompress: index4 to 10f off 43c adjoff c3c tot c40 data 0 [ 449.423768][T14753] 842_decompress: op is 22 [ 449.423773][T14753] 842_decompress: op is 12 [ 449.423779][T14753] 842_decompress: index2 to e1 off 1c2 adjoff bc2 tot c40 data 1cf7 [ 449.423789][T14753] 842_decompress: op is 40 [ 449.423794][T14753] 842_decompress: template is 19 [ 449.423799][T14753] 842_decompress: op is 18 [ 449.423805][T14753] 842_decompress: index8 to 68 off 340 adjoff b40 tot c48 data 7201000000000000 [ 449.423815][T14753] 842_decompress: op is 40 [ 449.423820][T14753] 842_decompress: op is 40 [ 449.423825][T14753] 842_decompress: op is 40 [ 449.423831][T14753] 842_decompress: template is 1c [ 449.423836][T14753] 842_decompress: template is 1b [ 449.423842][T14753] 842_decompress: template is 19 [ 449.423847][T14753] 842_decompress: op is 18 [ 449.423853][T14753] 842_decompress: index8 to 71 off 388 adjoff b88 tot c90 data 1000000 [ 449.423863][T14753] 842_decompress: op is 40 [ 449.423868][T14753] 842_decompress: op is 40 [ 449.423873][T14753] 842_decompress: op is 40 [ 449.423878][T14753] 842_decompress: template is 1c [ 449.423884][T14753] 842_decompress: template is 1b [ 449.423890][T14753] 842_decompress: template is 9 [ 449.423895][T14753] 842_decompress: op is 22 [ 449.423901][T14753] 842_decompress: op is 12 [ 449.423906][T14753] 842_decompress: index2 to 23 off 46 adjoff c46 tot cc8 data 1cf7 [ 449.423916][T14753] 842_decompress: op is 14 [ 449.423921][T14753] 842_decompress: index4 to 112 off 448 adjoff c48 tot cc8 data 72010000 [ 449.423931][T14753] 842_decompress: op is 40 [ 449.423937][T14753] 842_decompress: template is 1c [ 449.423942][T14753] 842_decompress: template is 1b [ 449.423948][T14753] 842_decompress: template is 19 [ 449.423954][T14753] 842_decompress: op is 18 [ 449.423959][T14753] 842_decompress: index8 to 82 off 410 adjoff c10 tot d18 data 100000000000000 [ 449.423969][T14753] 842_decompress: op is 40 [ 449.423975][T14753] 842_decompress: op is 40 [ 449.423980][T14753] 842_decompress: op is 40 [ 449.423985][T14753] 842_decompress: template is 1c [ 449.423990][T14753] 842_decompress: template is 1b [ 449.423996][T14753] 842_decompress: template is 15 [ 449.424002][T14753] 842_decompress: op is 14 [ 449.424007][T14753] 842_decompress: index4 to 151 off 544 adjoff d44 tot d48 data 0 [ 449.424017][T14753] 842_decompress: op is 22 [ 449.424022][T14753] 842_decompress: op is 12 [ 449.424028][T14753] 842_decompress: index2 to 65 off ca adjoff cca tot d48 data 1cf7 [ 449.424038][T14753] 842_decompress: op is 40 [ 449.424043][T14753] 842_decompress: template is 19 [ 449.424049][T14753] 842_decompress: op is 18 [ 449.424054][T14753] 842_decompress: index8 to 89 off 448 adjoff c48 tot d50 data 7201000000000000 [ 449.424064][T14753] 842_decompress: op is 40 [ 449.424069][T14753] 842_decompress: op is 40 [ 449.424075][T14753] 842_decompress: op is 40 [ 449.424080][T14753] 842_decompress: template is 1c [ 449.424085][T14753] 842_decompress: template is 1b [ 449.424093][T14753] 842_decompress: template is 19 [ 449.424099][T14753] 842_decompress: op is 18 [ 449.424104][T14753] 842_decompress: index8 to 92 off 490 adjoff c90 tot d98 data 1000000 [ 449.424114][T14753] 842_decompress: op is 40 [ 449.424120][T14753] 842_decompress: op is 40 [ 449.424125][T14753] 842_decompress: op is 40 [ 449.424131][T14753] 842_decompress: template is 1c [ 449.424137][T14753] 842_decompress: template is 1b [ 449.424143][T14753] 842_decompress: template is 9 [ 449.424148][T14753] 842_decompress: op is 22 [ 449.424153][T14753] 842_decompress: op is 12 [ 449.424159][T14753] 842_decompress: index2 to a7 off 14e adjoff d4e tot dd0 data 1cf7 [ 449.424169][T14753] 842_decompress: op is 14 [ 449.424174][T14753] 842_decompress: index4 to 154 off 550 adjoff d50 tot dd0 data 72010000 [ 449.424184][T14753] 842_decompress: op is 40 [ 449.424189][T14753] 842_decompress: template is 1c [ 449.424195][T14753] 842_decompress: template is 1b [ 449.424201][T14753] 842_decompress: template is 19 [ 449.424206][T14753] 842_decompress: op is 18 [ 449.424213][T14753] 842_decompress: index8 to a3 off 518 adjoff d18 tot e20 data 100000000000000 [ 449.424223][T14753] 842_decompress: op is 40 [ 449.424228][T14753] 842_decompress: op is 40 [ 449.424233][T14753] 842_decompress: op is 40 [ 449.424239][T14753] 842_decompress: template is 1c [ 449.424244][T14753] 842_decompress: template is 1b [ 449.424250][T14753] 842_decompress: template is 15 [ 449.424256][T14753] 842_decompress: op is 14 [ 449.424261][T14753] 842_decompress: index4 to 193 off 64c adjoff e4c tot e50 data 0 [ 449.424271][T14753] 842_decompress: op is 22 [ 449.424276][T14753] 842_decompress: op is 12 [ 449.424281][T14753] 842_decompress: index2 to e9 off 1d2 adjoff dd2 tot e50 data 1cf7 [ 449.424291][T14753] 842_decompress: op is 40 [ 449.424297][T14753] 842_decompress: template is 19 [ 449.424302][T14753] 842_decompress: op is 18 [ 449.424308][T14753] 842_decompress: index8 to aa off 550 adjoff d50 tot e58 data 7201000000000000 [ 449.424318][T14753] 842_decompress: op is 40 [ 449.424323][T14753] 842_decompress: op is 40 [ 449.424328][T14753] 842_decompress: op is 40 [ 449.424334][T14753] 842_decompress: template is 1c [ 449.424339][T14753] 842_decompress: template is 1b [ 449.424345][T14753] 842_decompress: template is 19 [ 449.424350][T14753] 842_decompress: op is 18 [ 449.424356][T14753] 842_decompress: index8 to b3 off 598 adjoff d98 tot ea0 data 1000000 [ 449.424366][T14753] 842_decompress: op is 40 [ 449.424371][T14753] 842_decompress: op is 40 [ 449.424376][T14753] 842_decompress: op is 40 [ 449.424381][T14753] 842_decompress: template is 1c [ 449.424387][T14753] 842_decompress: template is 1b [ 449.424393][T14753] 842_decompress: template is 9 [ 449.424398][T14753] 842_decompress: op is 22 [ 449.424403][T14753] 842_decompress: op is 12 [ 449.424409][T14753] 842_decompress: index2 to 2b off 56 adjoff e56 tot ed8 data 1cf7 [ 449.424419][T14753] 842_decompress: op is 14 [ 449.424424][T14753] 842_decompress: index4 to 196 off 658 adjoff e58 tot ed8 data 72010000 [ 449.424434][T14753] 842_decompress: op is 40 [ 449.424439][T14753] 842_decompress: template is 1c [ 449.424445][T14753] 842_decompress: template is 1b [ 449.424451][T14753] 842_decompress: template is 19 [ 449.424456][T14753] 842_decompress: op is 18 [ 449.424462][T14753] 842_decompress: index8 to c4 off 620 adjoff e20 tot f28 data 100000000000000 [ 449.424472][T14753] 842_decompress: op is 40 [ 449.424477][T14753] 842_decompress: op is 40 [ 449.424482][T14753] 842_decompress: op is 40 [ 449.424488][T14753] 842_decompress: template is 1c [ 449.424493][T14753] 842_decompress: template is 1b [ 449.424499][T14753] 842_decompress: template is 15 [ 449.424504][T14753] 842_decompress: op is 14 [ 449.424510][T14753] 842_decompress: index4 to 1d5 off 754 adjoff f54 tot f58 data 0 [ 449.424519][T14753] 842_decompress: op is 22 [ 449.424525][T14753] 842_decompress: op is 12 [ 449.424530][T14753] 842_decompress: index2 to 6d off da adjoff eda tot f58 data 1cf7 [ 449.424540][T14753] 842_decompress: op is 40 [ 449.424545][T14753] 842_decompress: template is 19 [ 449.424551][T14753] 842_decompress: op is 18 [ 449.424556][T14753] 842_decompress: index8 to cb off 658 adjoff e58 tot f60 data 7201000000000000 [ 449.424566][T14753] 842_decompress: op is 40 [ 449.424572][T14753] 842_decompress: op is 40 [ 449.424577][T14753] 842_decompress: op is 40 [ 449.424582][T14753] 842_decompress: template is 1c [ 449.424588][T14753] 842_decompress: template is 1b [ 449.424610][T14753] 842_decompress: template is 19 [ 449.424618][T14753] 842_decompress: op is 18 [ 449.424623][T14753] 842_decompress: index8 to d4 off 6a0 adjoff ea0 tot fa8 data 1000000 [ 449.424633][T14753] 842_decompress: op is 40 [ 449.424639][T14753] 842_decompress: op is 40 [ 449.424644][T14753] 842_decompress: op is 40 [ 449.424649][T14753] 842_decompress: template is 1c [ 449.424655][T14753] 842_decompress: template is 1b [ 449.424661][T14753] 842_decompress: template is 9 [ 449.424666][T14753] 842_decompress: op is 22 [ 449.424671][T14753] 842_decompress: op is 12 [ 449.424677][T14753] 842_decompress: index2 to af off 15e adjoff f5e tot fe0 data 1cf7 [ 449.424687][T14753] 842_decompress: op is 14 [ 449.424692][T14753] 842_decompress: index4 to 1d8 off 760 adjoff f60 tot fe0 data 72010000 [ 449.424702][T14753] 842_decompress: op is 40 [ 449.424708][T14753] 842_decompress: template is 1c [ 449.424713][T14753] 842_decompress: template is 1b [ 449.424719][T14753] 842_decompress: template is 1e [ 449.426746][T14734] usb 5-1: adu_open: open count 1 [ 449.426919][ C0] ================================================================== [ 449.426927][ C0] BUG: KASAN: slab-use-after-free in find_endpoint+0x2a3/0x2c0 [ 449.426948][ C0] Read of size 1 at addr ffff8880526504e8 by task syz.0.2665/14733 [ 449.426957][ C0] [ 449.426964][ C0] CPU: 0 UID: 0 PID: 14733 Comm: syz.0.2665 Tainted: G L syzkaller #0 PREEMPT(full) [ 449.426980][ C0] Tainted: [L]=SOFTLOCKUP [ 449.426984][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 449.426991][ C0] Call Trace: [ 449.426995][ C0] [ 449.427000][ C0] dump_stack_lvl+0x100/0x190 [ 449.427016][ C0] print_report+0x13d/0x4b0 [ 449.427032][ C0] ? __virt_addr_valid+0x239/0x430 [ 449.427049][ C0] ? find_endpoint+0x2a3/0x2c0 [ 449.427063][ C0] kasan_report+0xdf/0x1c0 [ 449.427080][ C0] ? find_endpoint+0x2a3/0x2c0 [ 449.427096][ C0] find_endpoint+0x2a3/0x2c0 [ 449.427112][ C0] dummy_timer+0x500/0x3820 [ 449.427123][ C0] ? do_raw_spin_lock+0x128/0x260 [ 449.427136][ C0] ? find_held_lock+0x2b/0x80 [ 449.427148][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 449.427162][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 449.427174][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 449.427190][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 449.427203][ C0] ? __pfx_debug_object_deactivate+0x10/0x10 [ 449.427216][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 449.427226][ C0] ? rcu_is_watching+0x13/0xc0 [ 449.427238][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 449.427256][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 449.427266][ C0] __hrtimer_run_queues+0x462/0x9c0 [ 449.427281][ C0] hrtimer_run_softirq+0x1ca/0x360 [ 449.427296][ C0] handle_softirqs+0x1e6/0x9d0 [ 449.427313][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 449.427329][ C0] ? _raw_spin_unlock+0x28/0x50 [ 449.427343][ C0] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 449.427358][ C0] __irq_exit_rcu+0x16a/0x210 [ 449.427381][ C0] irq_exit_rcu+0x9/0x30 [ 449.427399][ C0] sysvec_apic_timer_interrupt+0x56/0xc0 [ 449.427416][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 449.427429][ C0] RIP: 0023:0xf7000505 [ 449.427438][ C0] Code: 89 54 24 10 8d ab 0c 70 02 00 89 4c 24 1c 89 44 24 18 89 7c 24 04 89 ca 8b 5c 24 08 8b 7c 24 0c 81 e2 ff 1f 00 00 8b 44 d5 00 <8b> 74 d5 04 31 c3 31 f7 09 fb 74 4f 09 f0 74 7c 8b 74 24 04 0f b6 [ 449.427449][ C0] RSP: 002b:00000000ffc3ce88 EFLAGS: 00000202 [ 449.427459][ C0] RAX: 000000008bce99e3 RBX: 000000008bce99e3 RCX: 000000008bce99e3 [ 449.427466][ C0] RDX: 00000000000019e3 RSI: 0000000000000d82 RDI: 00000000ffffffff [ 449.427473][ C0] RBP: 00000000f73d2000 R08: 0000000000000000 R09: 0000000000000000 [ 449.427480][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 449.427487][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 449.427497][ C0] [ 449.427502][ C0] [ 449.427504][ C0] Allocated by task 12124: [ 449.427510][ C0] kasan_save_stack+0x30/0x50 [ 449.427525][ C0] kasan_save_track+0x14/0x30 [ 449.427538][ C0] __kasan_kmalloc+0xaa/0xb0 [ 449.427551][ C0] __kmalloc_noprof+0x32f/0x840 [ 449.427565][ C0] usb_copy_descriptors+0xcd/0x320 [ 449.427578][ C0] f_midi2_bind+0x1dad/0x2770 [ 449.427590][ C0] usb_add_function+0x219/0x890 [ 449.427604][ C0] configfs_composite_bind+0xd83/0x1960 [ 449.427618][ C0] gadget_bind_driver+0x28c/0xbf0 [ 449.427627][ C0] really_probe+0x241/0xa60 [ 449.427638][ C0] __driver_probe_device+0x210/0x460 [ 449.427649][ C0] driver_probe_device+0x4a/0x140 [ 449.427660][ C0] __driver_attach+0x21f/0x5b0 [ 449.427670][ C0] bus_for_each_dev+0x13e/0x1d0 [ 449.427684][ C0] bus_add_driver+0x305/0x5b0 [ 449.427693][ C0] driver_register+0x1e2/0x360 [ 449.427704][ C0] usb_gadget_register_driver_owner+0x132/0x210 [ 449.427715][ C0] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 449.427728][ C0] configfs_write_iter+0x302/0x4e0 [ 449.427732][ T13] bond1: (slave geneve2): Send learning packet: mac fe:c0:e6:49:db:0d vlan 0 [ 449.427742][ C0] vfs_write+0x6af/0x1050 [ 449.427754][ C0] ksys_write+0x12a/0x250 [ 449.427765][ C0] __do_fast_syscall_32+0x13a/0x8b0 [ 449.427775][ C0] do_fast_syscall_32+0x32/0x70 [ 449.427784][ C0] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 449.427797][ C0] [ 449.427799][ C0] Freed by task 14708: [ 449.427804][ C0] kasan_save_stack+0x30/0x50 [ 449.427818][ C0] kasan_save_track+0x14/0x30 [ 449.427831][ C0] kasan_save_free_info+0x3b/0x70 [ 449.427842][ C0] __kasan_slab_free+0x5f/0x80 [ 449.427856][ C0] kfree+0x22b/0x6d0 [ 449.427866][ C0] usb_free_all_descriptors+0x81/0x1a0 [ 449.427879][ C0] purge_configs_funcs+0x285/0x510 [ 449.427891][ C0] configfs_composite_unbind+0xae/0x210 [ 449.427904][ C0] gadget_unbind_driver+0x20c/0x4f0 [ 449.427914][ C0] device_remove+0xcb/0x180 [ 449.427924][ C0] device_release_driver_internal+0x44e/0x620 [ 449.427936][ C0] driver_detach+0xd8/0x1b0 [ 449.427946][ C0] bus_remove_driver+0x13b/0x2e0 [ 449.427955][ C0] driver_unregister+0x76/0xb0 [ 449.427967][ C0] usb_gadget_unregister_driver+0x49/0x70 [ 449.427976][ C0] gadget_dev_desc_UDC_store+0x170/0x2e0 [ 449.427989][ C0] configfs_write_iter+0x302/0x4e0 [ 449.427998][ C0] vfs_write+0x6af/0x1050 [ 449.428009][ C0] ksys_write+0x12a/0x250 [ 449.428020][ C0] __do_fast_syscall_32+0x13a/0x8b0 [ 449.428030][ C0] do_fast_syscall_32+0x32/0x70 [ 449.428040][ C0] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 449.428052][ C0] [ 449.428054][ C0] The buggy address belongs to the object at ffff888052650400 [ 449.428054][ C0] which belongs to the cache kmalloc-512 of size 512 [ 449.428063][ C0] The buggy address is located 232 bytes inside of [ 449.428063][ C0] freed 512-byte region [ffff888052650400, ffff888052650600) [ 449.428073][ C0] [ 449.428076][ C0] The buggy address belongs to the physical page: [ 449.428081][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888052650000 pfn:0x52650 [ 449.428092][ C0] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 449.428100][ C0] flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff) [ 449.428111][ C0] page_type: f5(slab) [ 449.428133][ C0] raw: 04fff00000000240 ffff88801d042c80 ffffea00013cce10 ffffea000165c810 [ 449.428143][ C0] raw: ffff888052650000 000000000010000d 00000000f5000000 0000000000000000 [ 449.428153][ C0] head: 04fff00000000240 ffff88801d042c80 ffffea00013cce10 ffffea000165c810 [ 449.428162][ C0] head: ffff888052650000 000000000010000d 00000000f5000000 0000000000000000 [ 449.428172][ C0] head: 04fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 449.428181][ C0] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 449.428187][ C0] page dumped because: kasan: bad access detected [ 449.428192][ C0] page_owner tracks the page as allocated [ 449.428196][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 12124, tgid 12123 (syz.2.1848), ts 313691700317 [ 449.428213][ C0] post_alloc_hook+0xfd/0x120 [ 449.428224][ C0] get_page_from_freelist+0x110d/0x35d0 [ 449.428236][ C0] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 449.428249][ C0] new_slab+0xa9/0x6e0 [ 449.428259][ C0] refill_objects+0xe3/0x410 [ 449.428270][ C0] __pcs_replace_empty_main+0x35e/0x650 [ 449.428281][ C0] __kmalloc_cache_noprof+0x4f4/0x6d0 [ 449.428292][ C0] snd_mixer_oss_build_test+0x7a/0x380 [ 449.428304][ C0] snd_mixer_oss_build_test_all+0x1ac/0x6e0 [ 449.428316][ C0] snd_mixer_oss_build_input+0x139/0xd50 [ 449.428327][ C0] snd_mixer_oss_notify_handler+0x48d/0x990 [ 449.428340][ C0] snd_card_register+0x2af/0x760 [ 449.428353][ C0] f_midi2_bind+0x1198/0x2770 [ 449.428364][ C0] usb_add_function+0x219/0x890 [ 449.428378][ C0] configfs_composite_bind+0xd83/0x1960 [ 449.428391][ C0] gadget_bind_driver+0x28c/0xbf0 [ 449.428401][ C0] page last free pid 5747 tgid 5747 ts 311036368776 stack trace: [ 449.428408][ C0] __free_frozen_pages+0x79f/0x10f0 [ 449.428418][ C0] qlist_free_all+0x47/0xf0 [ 449.428430][ C0] kasan_quarantine_reduce+0x1a0/0x1f0 [ 449.428443][ C0] __kasan_slab_alloc+0x69/0x90 [ 449.428457][ C0] __kmalloc_cache_node_noprof+0x28e/0x720 [ 449.428471][ C0] __get_vm_area_node+0x124/0x350 [ 449.428486][ C0] __vmalloc_node_range_noprof+0x268/0x1420 [ 449.428502][ C0] __vmalloc_node_noprof+0xad/0xf0 [ 449.428517][ C0] xt_compat_init_offsets+0xe2/0x1f0 [ 449.428530][ C0] compat_table_info+0x11b/0x870 [ 449.428541][ C0] compat_do_ebt_get_ctl+0x270/0xbb0 [ 449.428552][ C0] do_ebt_get_ctl+0x243/0x7a0 [ 449.428563][ C0] nf_getsockopt+0x7c/0xe0 [ 449.428574][ C0] ip_getsockopt+0x192/0x1e0 [ 449.428583][ C0] tcp_getsockopt+0xa1/0x110 [ 449.428613][ C0] do_sock_getsockopt+0x50a/0x6e0 [ 449.428629][ C0] [ 449.428632][ C0] Memory state around the buggy address: [ 449.428637][ C0] ffff888052650380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 449.428645][ C0] ffff888052650400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 449.428652][ C0] >ffff888052650480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 449.428658][ C0] ^ [ 449.428664][ C0] ffff888052650500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 449.428671][ C0] ffff888052650580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 449.428677][ C0] ================================================================== [ 449.428683][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 450.141979][ C0] CPU: 0 UID: 0 PID: 14733 Comm: syz.0.2665 Tainted: G L syzkaller #0 PREEMPT(full) [ 450.146047][ C0] Tainted: [L]=SOFTLOCKUP [ 450.147664][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 450.151481][ C0] Call Trace: [ 450.152763][ C0] [ 450.153918][ C0] dump_stack_lvl+0x100/0x190 [ 450.155725][ C0] vpanic+0x553/0x970 [ 450.157263][ C0] ? __pfx_vpanic+0x10/0x10 [ 450.158993][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 450.160926][ C0] ? find_endpoint+0x2a3/0x2c0 [ 450.162760][ C0] panic+0xd1/0xe0 [ 450.164222][ C0] ? __pfx_panic+0x10/0x10 [ 450.165933][ C0] ? end_report.part.0+0x23/0x90 [ 450.167826][ C0] ? rcu_is_watching+0x13/0xc0 [ 450.169683][ C0] ? end_report.part.0+0x23/0x90 [ 450.171580][ C0] check_panic_on_warn.cold+0x19/0x34 [ 450.173616][ C0] end_report.part.0+0x3a/0x90 [ 450.175328][ C0] kasan_report.cold+0xe/0x18 [ 450.176816][ C0] ? find_endpoint+0x2a3/0x2c0 [ 450.178254][ C0] find_endpoint+0x2a3/0x2c0 [ 450.179637][ C0] dummy_timer+0x500/0x3820 [ 450.181065][ C0] ? do_raw_spin_lock+0x128/0x260 [ 450.182603][ C0] ? find_held_lock+0x2b/0x80 [ 450.184043][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 450.185747][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 450.187373][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 450.189125][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 450.190814][ C0] ? __pfx_debug_object_deactivate+0x10/0x10 [ 450.192566][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 450.194123][ C0] ? rcu_is_watching+0x13/0xc0 [ 450.196048][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 450.197956][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 450.199436][ C0] __hrtimer_run_queues+0x462/0x9c0 [ 450.201035][ C0] hrtimer_run_softirq+0x1ca/0x360 [ 450.202533][ C0] handle_softirqs+0x1e6/0x9d0 [ 450.204043][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 450.206221][ C0] ? _raw_spin_unlock+0x28/0x50 [ 450.208210][ C0] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 450.210177][ C0] __irq_exit_rcu+0x16a/0x210 [ 450.211664][ C0] irq_exit_rcu+0x9/0x30 [ 450.212982][ C0] sysvec_apic_timer_interrupt+0x56/0xc0 [ 450.214769][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 450.216530][ C0] RIP: 0023:0xf7000505 [ 450.217749][ C0] Code: 89 54 24 10 8d ab 0c 70 02 00 89 4c 24 1c 89 44 24 18 89 7c 24 04 89 ca 8b 5c 24 08 8b 7c 24 0c 81 e2 ff 1f 00 00 8b 44 d5 00 <8b> 74 d5 04 31 c3 31 f7 09 fb 74 4f 09 f0 74 7c 8b 74 24 04 0f b6 [ 450.223187][ C0] RSP: 002b:00000000ffc3ce88 EFLAGS: 00000202 [ 450.225206][ C0] RAX: 000000008bce99e3 RBX: 000000008bce99e3 RCX: 000000008bce99e3 [ 450.227468][ C0] RDX: 00000000000019e3 RSI: 0000000000000d82 RDI: 00000000ffffffff [ 450.229819][ C0] RBP: 00000000f73d2000 R08: 0000000000000000 R09: 0000000000000000 [ 450.232142][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 450.234447][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 450.236696][ C0] [ 450.238224][ C0] Kernel Offset: disabled [ 450.239520][ C0] Rebooting in 86400 seconds.. VM DIAGNOSIS: 10:11:05 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000020 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85b109a5 RDI=ffffffff9cc6cba0 RBP=ffffffff9cc6cb60 RSP=ffffc9000eee7300 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3530383838666666 R12=0000000000000000 R13=0000000000000020 R14=0000000000000006 R15=ffffc9000eee7618 RIP=ffffffff85b109cf RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff88809574a000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000000c388509 CR3=000000005b3dd000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=00000000000feb06 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000008 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000070a00000000 0000001100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=ffff888029c84b00 RBX=0000000000000000 RCX=0000000000000001 RDX=0000000000000000 RSI=ffffffff825064c9 RDI=ffffed10056267d8 RBP=ffff88802b133ec0 RSP=ffffc9002120eaf8 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000 R12=0000000000000000 R13=0000000000000001 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff81e6eb59 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff88809584a000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f7228c90 CR3=00000000623e3000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 681150b6bfb781e1 76ff3f6216e3736e ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 9b75a3bf6726e46b 7858cc2eea914f20 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 3a3d532677463f2d c78481206bcf6246 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 27dbe6689104c8f1 d2d5e8fa8098e722 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000008340 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000040 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0001115b00011165 66dea5002c080a8c ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0001115b5ca8a95b 3d3a380a5eeda38b ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00011164c6149e00 a5864600295dc000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 8ac2af4c3acb0fcf dba1930f0fc65800 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 b6f10d39018128e6 a53cde00009a1feb ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 f66527ee8c363487 e0bb00b11bcaa373 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a54ff53a3c6ef372 bb67ae856a09e667 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 5be0cd191f83d9ab 9b05688c510e527f ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000682c33 RBX=ffff88801db1a580 RCX=ffffffff8bd27235 RDX=0000000000000001 RSI=ffffffff8e3e0f26 RDI=ffffffff8c625a80 RBP=ffffed1003b634b0 RSP=ffffc9000048fe00 R8 =0000000000000001 R9 =ffffed10056467bd R10=ffff88802b233deb R11=0000000000000001 R12=0000000000000000 R13=0000000000000000 R14=1ffff92000091fc4 R15=dffffc0000000000 RIP=ffffffff8bd2576f RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88809594a000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000080001000 CR3=000000006361b000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=00000000000f000e DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000005000000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000000 RBX=0000000000000000 RCX=ffffffff81fee773 RDX=0000000000000000 RSI=0000000000000000 RDI=ffff888025528000 RBP=ffff88802b043b20 RSP=ffffc90002dcf898 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000000 R12=ffffed1004aa52b3 R13=0000000000000003 R14=ffffed1005608765 R15=0000000000000001 RIP=ffffffff820b9ba0 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888095a4a000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000559b57772f40 CR3=000000004ded2000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=00000000000f000e DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000fcffc200 Opmask01=000000000000ffff Opmask02=00000000ffffffff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000001 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 494eb169bd1ae960 3305afeb255319e8 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 68d820af9a8c4d66 cfcb57c0b1fbbd89 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 681c7acc9dc6b26f e2b3b1477b6791ac ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 5f7eb358329d7593 0e1f8eda50546110 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000008380 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000040 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 165dc8ca6bbe8546 0c807a98d028ce7b ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 afe2f41e02f53843 dc77f8000001118e ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 8996471391d05e70 eda1db495ded19a7 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 b87986e280010000 1520dd4e0ae78e72 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 681150b6bfb781e1 76ff3f6216e3736e ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 9b75a3bf6726e46b 7858cc2eea914f20 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a54ff53a3c6ef372 bb67ae856a09e667 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 5be0cd191f83d9ab 9b05688c510e527f ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=550ef55b79259931 c17ea09571090344 550ef55b79259931 c17ea09571090344 550ef55b79259931 c17ea09571090344 550ef55b79259931 c17ea09571090344 ZMM18=465a4145031cbe52 c8bd27687d84529c 465a4145031cbe52 c8bd27687d84529c 465a4145031cbe52 c8bd27687d84529c 465a4145031cbe52 c8bd27687d84529c ZMM19=8d13000000000000 0000000000000004 8d13000000000000 0000000000000003 8d13000000000000 0000000000000002 8d13000000000000 0000000000000001 ZMM20=0000000000000000 0000000000000004 0000000000000000 0000000000000004 0000000000000000 0000000000000004 0000000000000000 0000000000000004 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 8002010000000806 060104a200080001 d40300080001cc03 00080001c4030808 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0001bc030ff08080 8204880001a40300 04840001a0030404 00019c0301080001 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 9403000800018c03 0208000184033004 0001800302080002 0800300800060075 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000001010800 0a80020401788a00 7074326c01ffffff fffffffffff5080a ZMM25=d0080746d0080746 d0080746d0080746 d0080746d0080746 d0080746d0080746 d0080746d0080746 d0080746d0080746 d0080746d0080746 d0080746d0080746 ZMM26=e4706cfbe4706cfb e4706cfbe4706cfb e4706cfbe4706cfb e4706cfbe4706cfb e4706cfbe4706cfb e4706cfbe4706cfb e4706cfbe4706cfb e4706cfbe4706cfb ZMM27=08b8f01108b8f011 08b8f01108b8f011 08b8f01108b8f011 08b8f01108b8f011 08b8f01108b8f011 08b8f01108b8f011 08b8f01108b8f011 08b8f01108b8f011 ZMM28=000001800000017f 0000017e0000017d 0000017c0000017b 0000017a00000179 0000017800000177 0000017600000175 0000017400000173 0000017200000171 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=6b2100006b210000 6b2100006b210000 6b2100006b210000 6b2100006b210000 6b2100006b210000 6b2100006b210000 6b2100006b210000 6b2100006b210000