last executing test programs: 4m15.262479343s ago: executing program 0 (id=1036): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'bridge_slave_0\x00'}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000180)={0x20, 0xff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x2, 0x0, 0x93}, 0xe) socket(0x18, 0x5, 0x1046) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) sendmmsg$inet(r3, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x20000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) chdir(&(0x7f0000000080)='./file0/file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./proc_mnt\x00', &(0x7f00000004c0)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./proc_mnt/driver/rtc\x00', 0x0, 0x0) read(r5, &(0x7f0000000000)=""/1000, 0x3e8) 4m15.195107272s ago: executing program 0 (id=1037): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001b80)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000020000006a0a00fe00000000850000000a000000b70000000000000095000000000000009cc6b3fcd62c7d376238975d43a4505f80fc88943c4f0cf08e467b592f868ee30a0e8c1bf176db2a6b2feb4b6fd3d5707bfd2d84aaa3b1d4e984c46ea7e2a447a36f5662403e1b2be4cc7c2683908a0d411a9872971c7c56f0979bd10b97163c1d6d0e196bf02f46c7e81eb72c00000000d0d26b5069f8a98f7dc8f76b74635fde9ca3c00cb9bf4e418d07fa22f0610a70f2bdf4000000000000b0c2940dd8e263aa743f7555193161f45346b1004006000000e1ffff8816326d7d25c32aac1c7d5b5be399f6609876b5887437a172fbc02a74067529194e533583412dff048f000000008b260000b2728a0481e9f0da43bb6cfb851cd364ff19ffcafe3e64be033c9d2f002cc93c1c13caec04a347383420336bec88c24a9fb6a6991ddb737d527d6acb15426415b6e8b14fdfa2c6e94bf1339454c13ad3e328a100000000b515a10000"], &(0x7f0000000340)='GPL\x00'}, 0x94) socket(0xa, 0xa, 0x36) syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x18, 0x8, 0x40, 0x42, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000700), &(0x7f00000004c0), 0x1000, r0}, 0x38) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x141102) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) socket$kcm(0x10, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, 0x0, 0xc000) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000850}, 0x0) setrlimit(0xd, &(0x7f0000000280)={0xc800, 0x10000}) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$vga_arbiter(r3, &(0x7f0000000000)=@other={'decodes', ' ', 'io'}, 0xb) 4m14.283932114s ago: executing program 0 (id=1042): epoll_create1(0x0) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet(0x2b, 0x801, 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x3e, &(0x7f00000040c0)=0x7, 0x4) sendmmsg$inet(r2, &(0x7f0000000000), 0x0, 0x8014) 4m13.344112646s ago: executing program 0 (id=1044): sched_setscheduler(0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) chdir(&(0x7f0000000240)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) 4m13.24330764s ago: executing program 0 (id=1048): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ptrace$peekuser(0x3, 0x0, 0x4) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x1, 0x84) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$TCSETAW(r3, 0x5407, 0x0) r4 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_usb_connect(0x3, 0x0, 0x0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x39, &(0x7f0000000140)=ANY=[@ANYBLOB="39033db4b7b56342835eb51eff7504c3574ba531da565daa35b91ac36fe31ad273f5a111fc00005e87841685bffb8a25d5ad57d8fadb72d298"]}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x4001}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x44e}}]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl(r7, 0x4048aecb, &(0x7f0000000200)="01000000") ioctl(r7, 0xc048aeca, &(0x7f0000000300)="0100") sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r4, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x2004000}, 0x4000000) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x7}]}]}, 0x5c}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0xd}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x84}, 0x80) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003ac0)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a44000000090a01010000000000de0000070000050900020073797a31000000000900010073797a3000000000080005400000001c08000a400000000008000f4000000006140000001000010000000000000000000184000a"], 0x6c}, 0x1, 0x0, 0x0, 0x8801}, 0x4000000) sendmsg$IPSET_CMD_GET_BYINDEX(r9, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x84010001}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0xf, 0x6, 0x5, 0x0, 0x0, {0xa, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_INDEX={0x6, 0xb, 0x1}, @IPSET_ATTR_INDEX={0x6, 0xb, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004001) 4m12.904448056s ago: executing program 0 (id=1052): socket$nl_generic(0x10, 0x3, 0x10) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000140), 0x20000, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x800) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) pselect6(0x40, &(0x7f0000000240)={0x0, 0xfffffffffffffffc, 0xd0, 0x80, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000009, 0x400}, 0x0, 0x0) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x103000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0, 0x80000}) ioctl$DMA_BUF_SET_NAME_A(r2, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000540)=0x1) close_range(r0, r1, 0x0) 4m12.794585662s ago: executing program 32 (id=1052): socket$nl_generic(0x10, 0x3, 0x10) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000140), 0x20000, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x800) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) pselect6(0x40, &(0x7f0000000240)={0x0, 0xfffffffffffffffc, 0xd0, 0x80, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000009, 0x400}, 0x0, 0x0) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x103000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0, 0x80000}) ioctl$DMA_BUF_SET_NAME_A(r2, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000540)=0x1) close_range(r0, r1, 0x0) 3m55.639538818s ago: executing program 3 (id=1161): r0 = openat$comedi(0xffffffffffffff9c, 0x0, 0x8ad01, 0x0) setxattr$security_ima(&(0x7f0000000180)='.\x00', &(0x7f00000000c0), &(0x7f00000002c0)=@ng, 0x2, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000080)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) socket$netlink(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg$802154_raw(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)="c8b3766c4b59cab39d6329c0fd35289ec688e7b8c8c9c492b0d4bf3386186001edc75055bd749eb08a5e24d5362d47e8992ddf4e00eff71e999416237b7832be9f4f67d37552604b31607fd107fd80b6ea30bfee9ae35259735b802ca21351aa841512168e944ffae6722bc3eb759d89db734c28da948f9d6616", 0x7a}, 0x1, 0x0, 0x0, 0x2000c840}, 0x80) ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000380)=@mmap={0x401, 0x2, 0x4, 0x4, 0x4, {0x77359400}, {0x3, 0x2, 0xf, 0x6, 0x3, 0x1, "a91b63d9"}, 0x2, 0x1, {}, 0x101}) write(0xffffffffffffffff, &(0x7f0000000100), 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) write(r0, 0x0, 0x0) 3m55.523597954s ago: executing program 3 (id=1163): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x28000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000b, 0xa8011, 0xffffffffffffffff, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x100004) ioctl$PPPIOCSMRRU(0xffffffffffffffff, 0x4004743b, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc01c5868, &(0x7f0000000440)={0xffffffffffffffff, &(0x7f0000000100)='[&\x00', 0x1, &(0x7f0000000300)={@_ha_fsid={[0x8001, 0x90000]}, {0x1, 0x8000, 0x4, 0xffffffff}}, 0x0, &(0x7f0000000340), &(0x7f0000000380)=0xffff}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/net/bond0/bonding/arp_ip_target\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) write(r4, &(0x7f0000000240)='+', 0x1) 3m54.574302805s ago: executing program 3 (id=1176): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x12, 0xc, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bb000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000003100000095"], &(0x7f00000000c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) 3m54.473474299s ago: executing program 3 (id=1177): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) mount$fuse(0x0, 0x0, 0x0, 0x1048001, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x2, &(0x7f0000000400)) chdir(&(0x7f0000000000)='./file1\x00') r1 = syz_clone(0x904000, 0x0, 0x5f, 0x0, 0x0, 0x0) setpgid(r1, r1) r2 = getpgid(r1) setpgid(0x0, r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2800009d}}, {{&(0x7f0000005840)=@file={0x1, './file2\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4004000}}], 0x2, 0x0) 3m54.312906556s ago: executing program 3 (id=1180): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @empty, 0x2}, 0x1c) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) 3m54.03994386s ago: executing program 3 (id=1184): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000140)={{0x80, 0x2}, 'port0\x00', 0x80, 0x100816, 0x4, 0x9, 0x0, 0xc, 0x200000, 0x0, 0x4875c99660ff2b2d}) 3m53.900383406s ago: executing program 33 (id=1184): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000140)={{0x80, 0x2}, 'port0\x00', 0x80, 0x100816, 0x4, 0x9, 0x0, 0xc, 0x200000, 0x0, 0x4875c99660ff2b2d}) 3m52.343609417s ago: executing program 1 (id=1193): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3}]}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}}}, {0x14, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x120}}, 0x0) 3m52.223007246s ago: executing program 1 (id=1194): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newqdisc={0x38, 0x24, 0xd0f, 0x70bd2c, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_INITIAL_QUANTUM={0x8, 0x4, 0x668b}]}}]}, 0x38}}, 0x0) 3m52.063505638s ago: executing program 1 (id=1195): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}}, 0x24}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="58000000020601080000000000000000030000000900020073797a3100000000050001000700000005000500020000000c000780080006400000040111000300686173683a6e65742c6e657400000000050004"], 0x58}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="50000000090601020000000000006ce6016000000900020073797a31000000000500010007000000280007800c00018008000140640101010c00148008000140ac1414bb0c00028008000140"], 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20000050) syz_usb_connect$cdc_ecm(0x0, 0x4d, 0x0, 0x0) 3m51.503892421s ago: executing program 1 (id=1197): recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, 0x0) 3m51.433974401s ago: executing program 1 (id=1199): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x3c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x1}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x1}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x4}]}, 0x3c}}, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x34, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x34}}, 0x0) 3m51.069841771s ago: executing program 1 (id=1201): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) 3m49.534226947s ago: executing program 2 (id=1202): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x102, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r1, &(0x7f0000003d40)=[{{&(0x7f0000000000)={0xa, 0x0, 0x8000, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f00000013c0)=[{&(0x7f0000000340)="18", 0x1}], 0x1}}], 0x1, 0x0) 3m49.487948357s ago: executing program 2 (id=1204): chdir(0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYBLOB], 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x24000044) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r0, &(0x7f0000000000)='8', 0x1) bpf$PROG_LOAD(0x5, 0x0, 0xa0) unshare(0x6a040000) write(r0, &(0x7f0000000000)='9', 0x1) bpf$PROG_LOAD(0x5, 0x0, 0xa0) unshare(0x6a040000) write(r0, &(0x7f0000000000)='10', 0x2) bpf$PROG_LOAD(0x5, 0x0, 0xa0) unshare(0x6a040000) write(r0, &(0x7f0000000000), 0x0) bpf$PROG_LOAD(0x5, 0x0, 0xa0) unshare(0x6a040000) write(r0, &(0x7f0000000000)='12', 0x2) bpf$PROG_LOAD(0x5, 0x0, 0xa0) write(r0, &(0x7f0000000000)='13', 0x2) bpf$PROG_LOAD(0x5, 0x0, 0xa0) write(r0, &(0x7f0000000000)='14', 0x2) bpf$PROG_LOAD(0x5, 0x0, 0xa0) unshare(0x6a040000) write(r0, &(0x7f0000000000)='15', 0x2) 3m48.701215373s ago: executing program 2 (id=1213): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="c400000010000100a9bd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="36420000201a0100140003006e657464657673696d3000000000000088001680840001800c00090006000000070000000c000700ffff0000d300000028000100f6ffffff"], 0xc4}, 0x1, 0x0, 0x0, 0xc1}, 0x800) 3m48.493972797s ago: executing program 2 (id=1214): r0 = socket$inet(0x2, 0x803, 0x6) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') syz_emit_ethernet(0x3e, &(0x7f00000036c0)={@broadcast, @remote, @val={@void, {0x8100, 0x5, 0x1}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x1, 0x16, 0x2c, 0x66, 0x0, 0x2b, 0x11, 0x0, @local, @broadcast}, {0x4e23, 0x4e22, 0x18, 0x0, @wg=@data={0x4, 0x3ff, 0x1000}}}}}}, 0x0) 3m48.413033327s ago: executing program 2 (id=1215): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@ipv4_newroute={0x40, 0x18, 0x601, 0x0, 0x0, {0x2, 0x18, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x1}, [@RTA_DST={0x8, 0x1, @private=0xa000000}, @RTA_OIF={0x8, 0x4, 0x1}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x1}, @RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @MPLS_IPTUNNEL_DST={0x8, 0x1, [{0x100, 0x0, 0x1}]}}]}, 0x40}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x2, 0x1f90, @private=0xa000001}, 0x10) 3m48.323922528s ago: executing program 2 (id=1216): r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_RENAME(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000600)={0x34, 0x5, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xa}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz2\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x11}, 0x20000000) 3m45.553975716s ago: executing program 4 (id=1254): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000001980)={0x9, 0x4, 0x200, 0x3, 0x6, 0x32e35e75, 0x7, 0x80000001}, &(0x7f00000019c0)=0x20) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000740)=ANY=[@ANYBLOB="3c00000010000500"/20, @ANYRES32=0x0, @ANYBLOB="01000000010000001400030073797a6b616c6c65723000000000000008000a00", @ANYRES32=r5], 0x3c}}, 0x0) write(r2, &(0x7f0000000700)="ffffffffffff0011223344554305000f32001800000100112233445500112233445500ff0000", 0xfdef) 3m45.155683957s ago: executing program 4 (id=1258): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000001300)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050204e5"], 0x0) setns(0xc9, 0x0) r1 = socket(0x8, 0x5, 0x7fff) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) ioctl$sock_SIOCOUTQNSD(r1, 0x40106150, &(0x7f0000000040)) 3m43.752383811s ago: executing program 4 (id=1260): r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x80000, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f0000000240)={{0x1, 0x1, 0x1b, 0xffffffffffffffff, {0x6}}, './file0\x00'}) 3m43.752241664s ago: executing program 4 (id=1261): r0 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000680)={0x0, [[0xff800000, 0xffffffff, 0xaee, 0x1, 0xffffffff, 0xfffffffc, 0x1, 0xffffffff], [0xffffffff, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xfffffffe, 0x83, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0x1, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x7, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}], '\x00', 0x401}) 3m43.683896597s ago: executing program 4 (id=1262): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$I2C(0x0, 0x2, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x24, r1, 0x5, 0x4, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000440)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x1, [{0x2, 0x1}]}, @void, @void, @void, @void, @void, @void}, 0x2f) nanosleep(&(0x7f0000000480)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f0000000540)=@device_b, &(0x7f0000000580)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) syz_80211_inject_frame(&(0x7f0000000640)=@device_b, &(0x7f0000000680)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val, @void}, 0x20) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000700)=@mgmt_frame=@beacon={{{0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {}, @broadcast, @device_a, @from_mac=@device_b, {0x0, 0x7}, @value=@ver_80211n={0x0, 0xe, 0x2, 0x2, 0x0, 0x1, 0x1}}, 0x1, @default, 0x1, @void, @val, @val={0x3, 0x1, 0x34}, @val={0x4, 0x6, {0x0, 0x5, 0x1ff, 0x3}}, @val={0x6, 0x2}, @val={0x5, 0x3, {0x7c, 0x20, 0x8}}, @val={0x25, 0x3, {0x1, 0x28}}, @void, @void, @void, @void, @val={0x71, 0x7, {0x0, 0x1, 0x1, 0x0, 0x0, 0x8, 0x21}}, @val={0x76, 0x6, {0xa9, 0x5, 0x36, 0x8000}}}, 0x54) 3m43.034336128s ago: executing program 4 (id=1263): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 3m35.109252397s ago: executing program 34 (id=1201): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) 3m33.27506909s ago: executing program 35 (id=1216): r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_RENAME(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000600)={0x34, 0x5, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xa}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz2\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x11}, 0x20000000) 3m27.602648964s ago: executing program 36 (id=1263): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 1m29.40154349s ago: executing program 6 (id=2795): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0xc0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={0x48, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "1e1c"}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) 1m29.399223768s ago: executing program 6 (id=2796): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x2c, 0x44, 0x1, 0x70bd29, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x12, 0x1, 0x0, 0x1, [@generic="c78c42412853ec1e921ede6c3965"]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x200408d1}, 0x4008094) 1m29.366080825s ago: executing program 6 (id=2798): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r0, &(0x7f0000000540)='readonly', 0x8) 1m29.309874844s ago: executing program 6 (id=2799): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) syz_emit_vhci(&(0x7f0000000340)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_ecred_conn_req={{0x17, 0x42, 0xa}, {0x80, 0x200, 0x200, 0xa, [0x40]}}}}, 0x17) r1 = accept4(r0, 0x0, 0x0, 0x800) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, 0x0, &(0x7f0000000240)) 1m28.719084743s ago: executing program 6 (id=2808): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r0, &(0x7f0000000540)='readonly', 0x8) 1m28.593099029s ago: executing program 6 (id=2810): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='udp 2', 0x5) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x100, {0x0, 0x0, 0x0, r2, {0xe, 0x4}}}, 0x24}}, 0x4) syz_usb_connect(0x2, 0x2d, 0x0, 0x0) 1m13.572027528s ago: executing program 37 (id=2810): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='udp 2', 0x5) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x100, {0x0, 0x0, 0x0, r2, {0xe, 0x4}}}, 0x24}}, 0x4) syz_usb_connect(0x2, 0x2d, 0x0, 0x0) 4.663101605s ago: executing program 8 (id=3594): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) mkdir(&(0x7f0000000040)='./sys_mount\x00', 0x1ff) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r2, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) mount(0x0, &(0x7f00000000c0)='./sys_mount\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r4, &(0x7f0000000200), 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys_mount/block/nullb0/queue/rotational\x00', 0x2202, 0x0) write(r5, &(0x7f0000000280)='1', 0x1) pread64(r3, &(0x7f0000000400), 0x8, 0x1000) 3.671771093s ago: executing program 8 (id=3595): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) mkdir(&(0x7f0000000040)='./sys_mount\x00', 0x1ff) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r2, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) mount(0x0, &(0x7f00000000c0)='./sys_mount\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys_mount/block/nullb0/queue/scheduler\x00', 0x2, 0x0) write(r4, &(0x7f0000000200)='bf', 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys_mount/block/nullb0/queue/rotational\x00', 0x2202, 0x0) write(r5, &(0x7f0000000280)='1', 0x1) pread64(r3, &(0x7f0000000400), 0x8, 0x1000) 3.118206473s ago: executing program 5 (id=3604): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) close_range(r0, 0xffffffffffffffff, 0x0) 3.052740411s ago: executing program 5 (id=3605): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) ptrace$ARCH_MAP_VDSO_X32(0x1e, r1, 0x2, 0x2001) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_int(r4, 0x1, 0x28, &(0x7f00000003c0)=0x8, 0x4) syz_emit_ethernet(0x1e, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan4\x00'}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={0x0, 0x40}, 0x1, 0x0, 0x0, 0x844}, 0x884) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="230000006d0200000300160022bf000001"], 0x50) r6 = socket(0xa, 0x3, 0xff) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r8, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_tracing={0x1a, 0xf, &(0x7f0000000380)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r7}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x18, r8, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r9}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000340)={r10, 0x0, 0x0}, 0x10) sendto$inet6(r6, 0x0, 0x0, 0x40, &(0x7f0000000240)={0xa, 0x4ea2, 0x5, @empty, 0x401}, 0x1c) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000400), 0x2401, r5, 0x0, 0xa002a0}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000300)={0x0, &(0x7f0000000140)=""/184, &(0x7f0000000200), &(0x7f0000001540), 0x1, r5}, 0x38) 2.698352635s ago: executing program 8 (id=3609): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000340)={0x750, 0x0, 0x0, 'queue0\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000000)={0x4, 0x0, 0x1, 'queue0\x00', 0xb}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000840)="68000000000905040000000000000000020000000900010073797a300000000014000a800600010000020000050002000600000008000500000000002c0004800800010000000001200002800c000100706f6c6963793000080002eb000069cc629ae30000000000", 0x68}], 0x1}, 0x0) syz_usbip_server_init(0x5) syz_usb_connect$uac2(0x0, 0x7b, &(0x7f0000000140)=ANY=[@ANYBLOB="1201100300000020ba0d0010400001020301090269000301061002080b0100010c200009040000000101200009240180ff070900040904010000010220000904010101010220000905010910000c02090825018030ad000109040200000102200009040201010102200009058209200002fabc082501028681090000ebb7cc97fb091cec94af08ab28b2a397b1c463034b9822ed69377f3fb0b6f1b8f262f46b01000000ad99faa19185a2294b5fe9147ecc53b0be28a3e0c8cad8b3768c7a9c8b17c1f78caec4d980eb5e62137add95d4c5e48366d750e0ebba4a3b81f1477d39d5681df76e405fef5b0f3c40a3bd72caaf7142"], 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000d00)=@nat={'nat\x00', 0x670, 0x5, 0x418, 0x2cc, 0x228, 0xfeffffff, 0x0, 0x228, 0x384, 0x384, 0xffffffff, 0x384, 0x384, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 'veth0_to_bond\x00', 'veth0_to_bond\x00', {}, {}, 0x6}, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@inet=@tcp={{0x2c}, {[], [], 0x0, 0x8, 0x20, 0x4}}, @common=@inet=@dscp={{0x24}, {0x6, 0x1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0xd1bdfb9e5869a518, 0x0, 0x9, 0x1, 0x0, 0x4], 0x4b, 0x2}, {0x4, [0x3, 0x6, 0x2, 0x6, 0x1, 0x2], 0x0, 0x2}}}}, {{@ip={@multicast1, @rand_addr=0x64010100, 0xffffff00, 0xff, 'tunl0\x00', 'batadv_slave_1\x00', {0xff}, {}, 0x84, 0x1, 0x9}, 0x0, 0xd4, 0x108, 0x0, {}, [@common=@icmp={{0x24}, {0x10, "f4dd", 0x1}}, @common=@set={{0x40}, {{0x0, [], 0x5}}}]}, @REDIRECT={0x34, 'REDIRECT\x00', 0x0, {0x1, {0x0, @broadcast, @remote, @port=0x4e22, @icmp_id=0x64}}}}, {{@ip={@loopback, @dev={0xac, 0x14, 0x14, 0x15}, 0x0, 0x0, 'lo\x00', 'ip6tnl0\x00', {0xff}}, 0x0, 0x70, 0xa4}, @NETMAP={0x34, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id, @icmp_id=0x64}}}}, {{@ip={@remote, @broadcast, 0x0, 0x0, 'pim6reg0\x00', 'wlan0\x00', {}, {0xff}, 0x5c}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@remote, @ipv4=@dev}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x474) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0x16, 0x0, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r5, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r4, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r6}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 2.508591234s ago: executing program 5 (id=3611): mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x2000, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRES64=0x0, @ANYBLOB="2c7766646e6f3da1dbd54010b5be77bb3f90087aa1b4a6e30b10de20f2d0635ca7181a65e6", @ANYRESHEX]) r0 = socket$inet_tcp(0x2, 0x1, 0x6) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000fc0)=ANY=[@ANYBLOB="b7020000f3000000bfa30000000000000702000000feffff7a0af0ff0001000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010402000000000000b7030000010000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb4500639100f51f00000000000000ff7f0000002f17cee19d0001000000000000000000cb04fcbb0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc2695ed094bd09b52680910d7d313f9f57606b83b994fb484510bef2e4872f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16d875fa369258673b5df11cc2afb53611cc320000bc0b80e80efc8f5e64be2c9d2d29db3d36dd015c7bd3f15aa6aadbeab2a01685108e61aaffe400000000000000000000008b798b4f5458d1863cc67c4c6a06e828e5216f601b19db1af1b5d356d08c72137d866d11be4ba3f0151f07bd4e97d62ecc645e143a60f1c6edc76609077909826151e2b42bf0ed0c7e8b0db51662de6d87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e183722537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d0616a48c7957e1226c9129a7c5f8ee5f50579e2f638f7eb12f63be72a39817b324d6e417b1c2cbfdcada0a16e31790e26cf1010000805f6ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b4207e6078625cb2717e21f8f187b1866108b6e8c71e26032176066599783568628f0309c3afa716d3706e1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6d2676bef8310f7032775cfd75652f87b039d543000000000000000008ce31344b554aca78a00000000000000e63a0dba7f6b3f48d5e40a3ae01a5dfde3b4dca205009c0ea7b5bcd49f977c609915c7601080d10b96af1eb55922765313a0eeefae505f4535cd9dc69fbab92150c7e74e5c5b051ddf4180f2d06399b0d00eee5c3afee38cdc55b8d3fbbe210bdec686a23503f4a547327caf381171cc9002be6d89f5734a9e204dbc327ec8f9851d273fa07369c419942509198605ff2781f4d2d4685d762d4764f7ff762e09116946137b7ab812a2d408ae4c53b3dcd3ab82f187bf77779d035818e562bf2737acf0412b217aa0d530438c101979312cbdb013c2f26afc263e0000000000000000000062f3e153dbe06af8a0adf64c0350927e75518774b37bb7f263cc9aad6e77c4cb355c661674ff770488bda1de51bd35429848af22383f4b3bcd4c38a395fd29d7825c15fbfb51f897c7c83954785bab4ce8ae811de674d6fc056943e59fa8e7912b2a16d98b4198b914f4206b6a72fbdf879d4273213d9d32ddd0990c1914488a00a79c12d737"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x14) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x1f2f, 0x241, 0x38f, &(0x7f00000007c0)="9f44948721919580684010a40800", 0x0, 0x241, 0x0, 0xb1, 0x0, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39"}, 0x23) close(0x3) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x2000000]}, 0x8, 0x0) ioctl$KVM_TDX_CAPABILITIES(r2, 0xc004aeba, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/2000, {0x5, 0x0, [{}, {}, {}, {}, {}]}}}) 2.412674874s ago: executing program 5 (id=3612): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xb2, &(0x7f0000000140)=""/178, 0x1f00, 0x6f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb5}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) r3 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCSETA(r3, 0x4b6a, &(0x7f00000006c0)={0x2208, 0x5, 0x1, 0x0, 0x15, "0400"}) memfd_create(&(0x7f0000000040)='\x00', 0x8340b1aabcc04bec) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = openat$rtc(0xffffff9c, &(0x7f0000000280), 0x781100, 0x0) ioctl$RTC_WKALM_RD(r6, 0x80287010, &(0x7f0000000300)) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) move_pages(r2, 0x0, 0x0, 0x0, &(0x7f0000000440), 0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendto$inet6(r7, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r7, 0x40089413, &(0x7f0000000100)=0xa) write$P9_RSTATu(r1, &(0x7f0000000980)={0x23b, 0x7d, 0x0, {{0x500, 0xfa, 0x0, 0xfffffffc, {0x2}, 0x0, 0x0, 0x2, 0x0, 0x1f, '\x04nodev{cvfox%\xff\xff\xff\x81\x02\x00\x00\x00\x00\x001\xff\xce\xbc\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00;Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x06\xb4\x94\xe1', 0x12, '\xcf\xc2\x13\xf6\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00', 0x5e, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x9d,;\x9e\x1dR\xc3\xd6\xda\x9b\xf6\x99\xfa\x88\xda\xcel\xde{\xa4\xa4\x00\xb4\xb0\xb4\xdb\xf6\xc6\x9ai\xd0\x17\xce\xc4Y\x06\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1a'}, 0x12c, 'odev-n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300, 0x0, 0xffffffffffffffff}}, 0x23b) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000e00)={{0x14}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x14, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}}], {0x14}}, 0x68}}, 0x0) 2.308344649s ago: executing program 9 (id=3613): syz_emit_ethernet(0x36, &(0x7f0000000280)={@random="a24858ca13d1", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv4={0x800, @dccp={{0x6, 0x4, 0x1, 0x7, 0x28, 0x68, 0x0, 0xc, 0x21, 0x0, @rand_addr=0x64010100, @local, {[@ra={0x94, 0x4}]}}, {{0x4e21, 0x4e21, 0x4, 0x1, 0xb, 0x0, 0x0, 0x0, 0x2, "740e23", 0xd, '1\x00'}}}}}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000700180a050000000000000000000a0000000900010073797a30000000000900020073797a31000000001400000011"], 0x54}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x3c, 0x0, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8}, @val={0xc, 0x99, {0x7ff, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff0200"], 0xfdef) 2.141641177s ago: executing program 5 (id=3614): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000340)={0x750, 0x0, 0x0, 'queue0\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000000)={0x4, 0x0, 0x1, 'queue0\x00', 0xb}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000840)="68000000000905040000000000000000020000000900010073797a300000000014000a800600010000020000050002000600000008000500000000002c0004800800010000000001200002800c000100706f6c6963793000080002eb000069cc629ae30000000000", 0x68}], 0x1}, 0x0) syz_usbip_server_init(0x5) syz_usb_connect$uac2(0x0, 0x7b, &(0x7f0000000140)=ANY=[@ANYBLOB="1201100300000020ba0d0010400001020301090269000301061002080b0100010c200009040000000101200009240180ff070900040904010000010220000904010101010220000905010910000c02090825018030ad000109040200000102200009040201010102200009058209200002fabc082501028681090000ebb7cc97fb091cec94af08ab28b2a397b1c463034b9822ed69377f3fb0b6f1b8f262f46b01000000ad99faa19185a2294b5fe9147ecc53b0be28a3e0c8cad8b3768c7a9c8b17c1f78caec4d980eb5e62137add95d4c5e48366d750e0ebba4a3b81f1477d39d5681df76e405fef5b0f3c40a3bd72caaf7142"], 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000d00)=@nat={'nat\x00', 0x670, 0x5, 0x418, 0x2cc, 0x228, 0xfeffffff, 0x0, 0x228, 0x384, 0x384, 0xffffffff, 0x384, 0x384, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 'veth0_to_bond\x00', 'veth0_to_bond\x00', {}, {}, 0x6}, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@inet=@tcp={{0x2c}, {[], [], 0x0, 0x8, 0x20, 0x4}}, @common=@inet=@dscp={{0x24}, {0x6, 0x1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0xd1bdfb9e5869a518, 0x0, 0x9, 0x1, 0x0, 0x4], 0x4b, 0x2}, {0x4, [0x3, 0x6, 0x2, 0x6, 0x1, 0x2], 0x0, 0x2}}}}, {{@ip={@multicast1, @rand_addr=0x64010100, 0xffffff00, 0xff, 'tunl0\x00', 'batadv_slave_1\x00', {0xff}, {}, 0x84, 0x1, 0x9}, 0x0, 0xd4, 0x108, 0x0, {}, [@common=@icmp={{0x24}, {0x10, "f4dd", 0x1}}, @common=@set={{0x40}, {{0x0, [], 0x5}}}]}, @REDIRECT={0x34, 'REDIRECT\x00', 0x0, {0x1, {0x0, @broadcast, @remote, @port=0x4e22, @icmp_id=0x64}}}}, {{@ip={@loopback, @dev={0xac, 0x14, 0x14, 0x15}, 0x0, 0x0, 'lo\x00', 'ip6tnl0\x00', {0xff}}, 0x0, 0x70, 0xa4}, @NETMAP={0x34, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id, @icmp_id=0x64}}}}, {{@ip={@remote, @broadcast, 0x0, 0x0, 'pim6reg0\x00', 'wlan0\x00', {}, {0xff}, 0x5c}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@remote, @ipv4=@dev}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x474) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0x16, 0x0, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r5, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r4, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r6}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 2.072660532s ago: executing program 9 (id=3615): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='0x1234\x00', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='0x5678\x00', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/f1\x00') vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'xfrm0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=@newlink={0x48, 0x10, 0x401, 0xfffffffe, 0x200, {0x0, 0x0, 0x0, 0x0, 0x10227}, [@IFLA_MASTER={0x8, 0xa, r4}, @IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r6}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20040000}, 0x840) write(r2, &(0x7f0000000380)='dummy_udc.0\n\x00', 0xc) nanosleep(&(0x7f00000003c0)={0x0, 0x5f5e100}, 0x0) write(r2, &(0x7f0000000400)='\n\x00', 0x1) ioctl$XFS_IOC_FSBULKSTAT(r2, 0xc0105865, &(0x7f00000007c0)={&(0x7f0000000440)=0x7fffffffffffffff, 0x6, &(0x7f0000000480), &(0x7f0000000780)}) 1.800286967s ago: executing program 9 (id=3616): r0 = openat$full(0xffffff9c, &(0x7f00000001c0), 0x40, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000080)=@newlink={0x38, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @hsr={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8}]}}}]}, 0x38}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01080000000000000000030000000900010073797a3100000000080002400000000614000000110001"], 0x50}, 0x1, 0x0, 0x0, 0xc801}, 0x20044884) close(r1) r3 = epoll_create1(0x80000) write(0xffffffffffffffff, &(0x7f0000000000)='transport=fc,traddr=nn-0x3333333333333333:pn-0x4444444444444444,host_traddr=nn-0x1111111111111111:pn-0x2222222222222222,nqn=', 0x7c) r4 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0xc1105511, &(0x7f0000000040)) ioctl$KVM_SMI(0xffffffffffffffff, 0xaeb7) r5 = io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0}) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r5, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x1, 0x2, 0x0, 0x0, {}, 0x40000002}, 0x1) r6 = eventfd2(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r6, &(0x7f0000000b80)) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) faccessat2(r0, &(0x7f0000000380)='./file0\x00', 0x0, 0x2000) r8 = mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x3, 0x9, 0x8010, r5, 0x20000000) syz_ublk_setup_queues(r0, 0x0, &(0x7f0000000800)={0x0, 0xfdd6, 0x42000, 0x1, 0x269, 0x0, r0}, &(0x7f0000000880)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb158, 0x10000, 0x3, 0xd6, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcd2d, 0x200, 0x3, 0x129, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9d10, 0x2000, 0x2, 0x6b, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb09c, 0x80005, 0x0, 0x255, 0x0, r5}, 0xffffffffffffffff, 0x0, 0x0}], 0x4, &(0x7f0000002180)={0x2e, 0x4, 0x0, r0, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x1, 0x8ad, 0x0, &(0x7f0000001180)=@buf_4k="5ac6e5007290fbd3e16fd0b04df6a3d86990c871ef73bf7d44014aa0dc3e205bdd4ea5465504a3454de25b494b320e8e4c3628c6e5dd69b13d51ea38dd6258944b3fd0f2f3ed8908dc455a58b587dc324729f30cf7b9064dd374ddef0449becefb6934fea4bac2770735a5b10c7fc39ba2d91a3fe1e1e7bb4fb9e5345d0b804f04fb4ef0243f4cca5cce4179e4c89940d01d16b179afcbc8245ae0f8e2f74744572de3b1657b08f64217bd0667228c952f9f67d9b7f2497528b77c6fc53a1dee5edef24f436e682e21265fe7438b18bd6c07c05be847e4510062f68473c98468b39616125ff3949aa7d2b67ccb3fa87aef9214624f4fbc5ad1cfee81f792bf8d5b81273356bfac94b55c5e4716d952d37a9ffd17d85266c1922e9f640b89e1f9bf06698bc6e1671ef10b0cbfd2ff719d539c58a130518d5fcbb2c6e969057f66d900c5bc7468808fbbeec09933c4fca5786c2bb27df38eb297796cb0988f11ce1111dbf245485fd8b19fda6c83a00b3c69f9f9e6eeddf873eda3852cb2e945a1828826d436e70d649047f4881d05bd214b9b7f94c59c8aa54334e37e2836138e8ced0d85213d42fdfbb3be41664eb9e808478a695bff4e87a0ebcedc91f52f6c60a928bd6b34cde44caae571d7584e67ced2e66c2fec45ac59d3e97ac247b4b56594fb0e04c0f6786e9dcc9c324b1d799d9a6f7951b76a0ac45d79cff252e2baef6405a74b236c9bfaf8540a7911b67f80d428dc17823ef7179c7753223e04bf462c78b75d9b47aa0ddb4f12eac2e3db7128f1aec0f581843201115b860a4564522c5efa0f24f8e4fe13ae6d9973d0afadec6f2705cd35cdf738d2aea8ddf9576c5d6d9d4378c66f226829b9a63c677a5ed983ca6505c6a3d9fb40b7aba3fbe98b0f3f4eeb9122465548ecd05ec17791d8ab4e0bb19f994bb67b80d1eb759a09611b8d72824fa566eb9d8c980605685ab880f9043e288b1672d8a3c38b251db5523d462f241e7756bd459ddb5b5590d2457be80a9f52ef1c9e31de427d58a853631cc20bab7bb7a17a9a4dcd425c8885d27b4574bdd0881ad24f96ae93798f74a7804cd5f459adad218263e1f27fe81159563ebd9a94989453776719449700145d72246c4b80b0601e7683bbdf3bfc70c6078760fe42ed470c0460c3dc6e2a9772883b50a2558f2957e87edc9b2f8534f6678fae49cb7fc9b4ec94a50058002c30d520c5e6b261eb2a5580e888fbb073f66a7446f0aa3a599dc2cc354288362780c76549accd23b7afe6ba12b61c414e86e3b070a078f0eef81c3256d6de2750929d68c374322f543a7615b396e81a12758cce0b6610023ce0574d252717d3796b93723f4c9e003cb64c452663976186ae4c24340c1c9164f9427250c4a1f6135a6b4f1ff1adb7806492bafb483b79f4eee3b088a83521fad65d19760355ea1572df0067b200cd83ce9191fdfd4d6297bb32eaa8d543e14d99f05ef5d622ec48ba8214a9f16779e53f38e93f7292fecee644de5359902c0a3407f0460393f06205c2158b20f4ba5be5d9a0920ef9e8c831e2018d070c5f5386d0b8712e7ee97499fb0fdad1b6677ac108f70db7b6d7800159b1374724a97987a1a9a3278cbaf79f6e21d2e138544834edd4b7f82663a84f7276263e2e5156b9c042411dfc80937be4dec094985def01a789cbc9a78dd53c02c56d90a9ff268d0c25be918f3f8670e32a12832c8024a40a10f4628f923253ef5ed8451341da38f603f0c95e80ed95ee9a0fc62f62e7ade613d0113b33cebfa97701be8bf86dfce464a571e244db107c5533d84d9c0c9863f6207b6cafa3956ce33f8f3d163f5c71541c221b03b5d502620ec64c9a9f9336cbb94a67f431c3a38cb4fce18317161e7a66971be562eaa94f8acf1032a6a481d433a28b18c2dd4a37d35ba90f8cab7c88340c9e6d8f497eb7f6e7b5ba81d5e9b1aaf1168f43cbd7b9a96f6a4bbaf129223ba5b7ca35f326c5fdb7f885c8f00b5d88de24fd81fe26cf1f14ce7f614c94b1b02523bdd6308ac2187bce57a83e389dde70a23077fa0b93278c146112dc964d8923cad3beaa5dc7ab20f295297c0df5adb9410335f0e5291bbcbe851de67040537c98b713f9b8390aa569caf0c1f209ba0d0aad07d0465e3b88b71d5b04df3ceaaf398cc66c276deb33ede032e41298fa8d8bf5ba68de87bc43da897c63e6881e374fe61b3608ab30dd9079cc8ca197b8b384a1b101f9366e2b58b194e20586905b417b4e9d13c27e61b362e8aad01ac3a1110fd4459b32f8c0f00a0804bef8d8888da08aa2deb1e9d3292ddd1e3c7986826e3529c233268c3ac803537134df88ccdd5f4ac5e081ab11e94f8af2da6895cea386b079d27a1e8de302b9cfe051601bcf86024414b2f014ce2a653bed27bfaa0debefb83217ca24db21dd79f7a9cb5c5916ca7209e664def38e231bd3a40440fb4bd5175c940ed0c96b1dcb25b01c3a7439a3a411b70b531006ba0abb27387ae04007856fdf7838f7bf84b1033426b78e9e29ebaf06f3d3e6a61e028daa06913c0ec9c83195fd9532146d3f09d1298acc12659d92f00be8c4fe2d8674daebadc981390b95e1f0441f6ab1c3909161173471379f9c08fd9e8d3f5e7af6d697cc8e103af8151481095a205ecc0e758ba5e6ec1f519bce0a455cfda36cfade7345383036f6861d4127ea69894e72589ca185240b2b2442edd9d46896893ded29f0c00f23ed51947e8c950165a86d4100b1b406705ac95c492ec08aa73aa414f3ec3492644d7be80e9a235bd5e1c321345e179d346d6f29fe7fdf5df7c72ba19ae2eb9ce2a22cb355ce29ae804d3d0e49bc0a313ffbdd594c0755915b2829ae8e4038f637ca7331ccd9d372524fbc6c4d5b37b6719247875a4690a0fdbc4ee1a4c8e80599357fd6930735f882b45017ced165fbb9268fddb5f02b5c917a34b78a6b8d02034ac6aeadc96ee1e59ec7c8578465dd7bf2449f875a0e102ba4cc4b9e6cc43b427efdd791b4bbe9433db7e085d158547d616501476fea8c0571650803179ba054fed85712e4cfd96189f51816c32b54673fa2b7fbd1a0b6f52ae62b0c204336250462936d458a694a9b10ce496a6b0fad36b0d0f631ef7dab36c230e311c0884b0c8cc11c3a39c98f66327d9d818dbf3442ff65bc38c70079115b49a3a39341606894fc63c78232ce2ca6b46e78423662c224d7c53f1eb3a15bb5d3ddec42bbaa1176fbe730090e613c798aca5dc73b3a4c7c64459b0438ad40777b165b47276ea3aa11ac36686d19f5661a3efedfb278a31be3b58696581355585457c91d3a1215bb9ead7f5b4828b72a51f2ffa431a61502d101bdd028eca0c6ff4237c56c62ebd1bcd87e1993c12fd8f2022c0aee27f185f0ab775adaecd1e7be72c2df221caff662977a8357cb0e428f92cf29003de7efe440d6e3fc60d564e0c6e044645ffc2093fb1a3c527a86bc474240927bd6c10d6031fb85e9e34071a89ad77aa607c34b31d950524e4ab9ab4ed6c9fee0d9e7db96067937dd358a44a6c2d5b1c4b5ba60408ca6a1514fec69f7eb28c79f6d84aa81d5382f19bc0c19cfa42f876624b457a2645a40835c0e9db68491f3b316736ebf2aa7bbb04906506d76fef02b89b6348bfe68f7d9197061abd92ef87b95decda9918b936035459600fd2a9bc154a45670b2de3517a55164a11062fa5c36ef6f07a50311b6705165b9922af5dcfb1a46cfabd5302378a80d135b7aed36ffaa722c03681f175010117dbbea32a323a6c818f8e070dd8e3ce9b58fd7bd9848ac8cac52c2d715d200c6ccfa20d12d4b04969cadafb8c89b279ebb642cbdc056a49ba7ed0a2a68f746d15bb4077bd4f9d3999e14ece4c9269b21f779f32cf7076cc492a0c4dc57bfafc1ae65716a53dfb23eee7ad55398662aa35b69ed2a180358725b122d5d977c351775182e5feca3d01817c660a17ab5ccda633a103f359dd4844dd453d8ebb91f3e81c845193ebfa2358bf964704a167c83edee04bd246d881bf0c3c66971ea75ba054e6d6f58e329da307014be628cdbf905783f60fe83787b1bafd092d6725b24418e531ea56eaceb5638af1172f3eadb2f1759663028787f8b6baf0ddd63ef24236ea2a15cdaa9bc1f626bd6390cb62a4f7c9a9caa463e897d9f8f398332e791407fad12d0ae034b3a2bae0bffccfd51b8cc9f5178424dd5985a7ed8a5696127e0f3299920ab27617426069dec97cf39d388bef5a3c67fc444166fc6d09a0e5993b9581548a6fecf5c0c241ca866013e547e8f72a73bce967fc55dd2b36ecb0a693bae52891424ec6d764f7fd71d397d5ab6aaaa35aeb03049124c4985bb2674743ab5b646f8e8065e9d26a122a4656d154ac625f3259b383c053041a6d45b2345c39fc873dfcec9a8976518b95d546da62d150cdddd8dabb069a02e7a6ea6ab9d3400a684b2db1bdf76f054eee41012a9d282063419dd6c15fdf3605b784357522e0785efe65d037df46289274ec49afe52671d363aa7524dabf6cc0c7ea3b72879175cf14e9daf3c5bd4a6dfd49789a2a37a0949c01d0bf13d3c657c5132b7e3e3c27b4d93881c816d8ba1504e7675825ae15f98ca1e5364dd451deefca84df4bdba6219498e97bd24864c550d83c4e96b76f15df533ab221ee339efa82dce397550bcbdabd16b442e7e266ddb0c866f96f96ea92eb0ccd977a0b7761eef943161317fa409484f4536f7157021dc1ded6766acbeb3bc7aa6227a7e60d26614d287b41a04a66489b31258c9a7d077b68d33edb8cccb5129dcd5f4fc94ef75ca85d58d02b0adf5a572110b1be3464809e5ae733543593628ef324edb0e0e2391daeeecc0c6d64e6965796e3d77d7fc314556eb2cf378024dc7435ed3749c09cae86cc2c0015f15d8c362695858e777a83067d915e06ac9b95f0dedaa193bf9d818f5c12078f6ab7343a04eaf58662d61ce3d49f2a4c5121487317a68043f729ae424fb3d3a41863db6d0b47f2aa527f8c98f5a64a858d30c364c5e097f3d9ec444967d47a061406dd6d12ae305ecfae59ad9c7c9fe0b8169c6c2062390cf02ed7a982f1919d18f25f3e0158d4f4657c21cf057d44523cd8c66b5fdc8af7f7a70d7467daf53bd831887ca3e23e56111bb9261f95c55d33ce34e11e40c3772dbe1f23b8577ccf0b8bf9f2b54cc1ace6cd080307fc2b161de3eb8be5b91d609babd449a64ba2e2b5f94c616d47180747b38dca114e0e6610f8a6e96ba1511d2fb41f4e41e5f0cc141aae42c5c1731c90aaff8fe799f9d8f0bc6416490e4c7fe9315dd300d5ec7bb85a92f4f61dc8f294da2ab9afbf5395662c1713601aa289cbd7f8fd6c239d901c89009eabaa2b7c9d971ed4b423178e194d4e9ad9cc0fdcd5c4f71e1ec4bb246070f670bf23dde16c74167bea0c607bd6d32aa1336a63437a3dec95d54145c872803d751635671074484475bf8c8e33825f40238fe0489f8934c80d652701ed4ba8ab1ec0153d5334363db4e37daa58768a5376b042dcc122f4b31e31eb708273f8012cc3852e744f94a77ebaa2ea57dbd913740e3cbea09629e31b2b023cbf9b12375b0d3ccb2b327a825aa47236eeaa605b741943444e7884ec090bb19864beac39cc76062e589898875e29dea2b5eea1e7fd929f006a7938f848501294d92357dd84d7f732a100879c3506651b8fee374dc7e2b70eab2ba2791985bc1cc87bfc83be074788124cd02d67b02b5b1db4f8fd367be2f3fc193c2deaf0b44918eb957365305f5a875758db74bf7ccb57c"}}, &(0x7f0000002200)) r10 = mmap$IORING_OFF_SQES(0x0, 0x20fb, 0x3, 0x20010, r5, 0x10000000) r11 = fcntl$getown(r7, 0x9) syz_ublk_add_dev(r5, r8, r9, r10, &(0x7f0000002280)={0x2e, 0x8, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x400, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000002240)=@new_dev={0x3, 0x2a2, 0x0, 0x0, 0x1000, 0xffffffff, r11, 0x0, 0x22}}}, &(0x7f0000002300)) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f00000007c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)=ANY=[@ANYBLOB="5c0000000000000000000a00000008000c4000000002080016400400000108001a40000000040800154000000000140005800f0001006e657462696f732d6e730000140005800f00010073616e652d32303030300000"], 0x5c}, 0x1, 0x0, 0x0, 0x48000}, 0x2800) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r6, &(0x7f0000000180)={0xc0002014}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xc, 0xc, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000180000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000006d00000095"], &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xe, &(0x7f0000000540)=ANY=[@ANYBLOB="1865920006000000000000000e00000018120000e0f009989867998bf88665a6da50536a32ada02897831c9437799a8840a6d1d7575b85ec57528925e7309d360f746f00e53f311141199d9c13f4710757ec24d7e00dbbb60cdd158a3acc03c9bbecfa622d397a39782a56182052f6240b38e979080c1cbe270fe63edadb935f12e65a0000c920f68e924bfc7184fbf6828f3bc494e4c816beadf0760ac1b12f31ccd4335e46709139fd0ccdbe1f36ae70e855d3c34421e647fd0cff10f63f2a4a6c948113eb146d8689d441f15a1f0e22804d6c71daad28b59c3e43520623c037e00398720aaacee3c197c121ea11e14073327f5faf4dbf7901e086ad70d34045421226a063fddf9ee9a73d74862c9e2fe6d477ae8dbf1cd00a48c553b40d1031e5aefcaa0db1855741e0982371ab12d3153fa2be6eeb9a9ed35b6fa7b49090ebe1", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095000000000000005566feff01000000"], &(0x7f0000000240)='GPL\x00', 0x9, 0x2d, &(0x7f0000000280)=""/45, 0x41000, 0x38, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x3, 0x6, 0x3, 0x7}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000300)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1], &(0x7f0000000340)=[{0x2, 0x2, 0x6, 0x2}, {0x0, 0x3, 0x0, 0xc}], 0x10, 0x5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r12, 0x0, 0xe, 0x0, &(0x7f0000000140)="0000000000000000000000000005", 0x0, 0x7fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffc}, 0x4c) 1.727266347s ago: executing program 9 (id=3617): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={0xffffffffffffffff, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd, 0x8, 0x0, 0x0}}, 0x10) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x8000) ioctl$XFS_IOC_DIOINFO(r2, 0x800c581e, &(0x7f0000000040)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000ffffffffffffff9900000008000300", @ANYRES32=r5, @ANYBLOB="08002600851600000a00180000000000000000001c005a80"], 0x4c}}, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340), 0x0) 1.653018594s ago: executing program 9 (id=3618): syz_emit_ethernet(0x32, &(0x7f0000000280)={@random="a24858ca13d1", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x1, 0x7, 0x24, 0x68, 0x0, 0xc, 0x21, 0x0, @rand_addr=0x64010100, @local}, {{0x4e21, 0x4e21, 0x4, 0x1, 0xb, 0x0, 0x0, 0x0, 0x2, "740e23", 0xd, '1\x00'}}}}}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x54}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) 1.65265547s ago: executing program 8 (id=3619): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="180200000000000000000000000000008500000028000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000380)="821d0216e5b9e94733950d1d6fc7", 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x4c) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) write(r2, &(0x7f0000000040)='7', 0x1) lsm_set_self_attr(0x66, 0x0, 0x21, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x2, &(0x7f00000002c0)={0x0, @in={{0x2, 0x0, @dev}}}, &(0x7f0000000380)=0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000003c0)={r4, @in={{0x2, 0x0, @empty}}}, &(0x7f0000000100)=0x9c) fcntl$setstatus(r0, 0x4, 0x42000) 1.592371773s ago: executing program 8 (id=3620): syz_usb_connect(0x2, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000062a10b40450c101003000102030109021b00010000000009043200019740a40009058203ff"], 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000380), r0) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd701bb4e2c1d184f1390008000200", @ANYRES32=r1, @ANYBLOB="05002b00000000000600060001000000"], 0x2c}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0x2, 0x1}, 0x6) write$char_usb(r3, 0x0, 0x0) 1.590642762s ago: executing program 9 (id=3621): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000380)={0x2, &(0x7f0000000340)=[{0x8, 0x7f, 0x0, 0x7fff7ffc}, {0x196, 0x1c, 0x0, 0x8}]}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) ioctl$VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f0000000280)={0x3, 0x1fe}) (rerun: 64) sendmsg$NFT_BATCH(r2, &(0x7f0000001100)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000001140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01010000000000000000020000000900010073797a3000000000080002400000000350000000120a01010000000000000000020000000900010073797a3000000000070002006f303000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323900080003400000000720000480060001000002000005000200110000000c000300080001000000001e14000000110001"], 0xcd0}}, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000003d40), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r3, &(0x7f0000003f40)={0x0, 0x0, &(0x7f0000003f00)={&(0x7f00000002c0)={0x60, r4, 0x1, 0x70bd29, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x1}}, {@pci={{0x8}, {0x11}}, {0x6c, 0x8e, 0x2}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004041}, 0x0) (async) sendmsg$NFT_MSG_GETOBJ(r2, &(0x7f0000002200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000002000)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) (async) setns(0xc9, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x101002, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x20}) ioctl$TUNSETLINK(r5, 0x400454cd, 0x10f) r6 = socket$inet(0x2, 0x2, 0x0) (async, rerun: 32) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) write$binfmt_misc(r8, &(0x7f0000000000), 0xfffffecc) (async) r9 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) splice(r7, 0x0, r9, 0x0, 0x1, 0x8864000000000000) (async) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', 0x1}) (async, rerun: 32) write$tun(r5, &(0x7f00000000c0)=ANY=[@ANYBLOB="5c146cfd2076392cbb9b136dc7237943c03cc37a317a66"], 0x97) (rerun: 32) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r10, 0x5b04, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) (async) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r11, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5a09000000ec1dc4a041515ce23a13371482ee1cf8d458129bf1ae1a81c394981ea5502c930b09ba5752bdbcb972222a7c4ce2294d46afac9b2834f80a9c935e05dc6b8db45a2658d214041ab91487a87e2390b222775ebe0974e30c5c0b997d0605321d4e9a6c43bf84d3536fd551ed6c780d093663981e911faa2d72bf5c71132fbae542", @ANYRES16=r12, @ANYBLOB="01002bbd7000fedbdf250c0000001c0005800c00028008000400ff0f00000c0002800800040005000000"], 0x30}, 0x1, 0x0, 0x0, 0x40044}, 0x20000010) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0f00000004"], 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) 1.489722617s ago: executing program 7 (id=3622): set_mempolicy(0x3, &(0x7f0000000000)=0x7ff, 0x5) syz_open_dev$loop(0x0, 0x5, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000400)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000001800)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0xae7, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x127}}}, 0x0) futex(0x0, 0x85, 0x2000000, 0x0, 0x0, 0xa2090199) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0xc00, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xf, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000004000000000000feffffff181100003f7421f087284708a82eccad86c7bb3b48d652fe8b580313712a57f6c2d938eefb58a4896e042f767863de11916306eefe40b9a900cc0f9a562f991191b4e0d1a920c729a3cd6ab08e2ea50b6bea0fff0f90741854d7b67745cbb9adb5ad3b866428373d4877f2d167c4bee0db678b9d6e075ed01740a8bc083dc99c9620ba6de5b673a24cd16ead39a115c8953a42a82ed128344450", @ANYRES32, @ANYBLOB="000000000000000ab702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000030000008500000084000000b7000000000000009500000000000000"], &(0x7f00000000c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) sendmsg$nl_generic(r5, 0x0, 0xc000) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r6 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0x12, &(0x7f0000000100)=0x8, 0x4) r7 = syz_open_dev$hidraw(&(0x7f0000000100), 0x0, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000140)='fdinfo/3\x00') read$FUSE(r8, 0x0, 0x0) ioctl$HIDIOCSUSAGES(0xffffffffffffffff, 0x501c4814, &(0x7f0000000dc0)={{0x1, 0x3, 0x9, 0x800, 0x800005, 0x5}, 0x8d, [0x7, 0x93b, 0x6, 0x1, 0x1, 0xb8a, 0x2f, 0x100, 0x5, 0x7, 0x7, 0x5, 0x41d4, 0x83, 0x4, 0xffffffff, 0x9, 0x1000, 0x77e4, 0xffff0c56, 0x3, 0x1, 0x0, 0x40, 0x9, 0x200, 0x69, 0x2, 0x0, 0x6, 0x3, 0x7, 0x8, 0x8, 0xa522, 0x100, 0xfffffff8, 0x80000001, 0x0, 0x40, 0x1, 0x6, 0x1, 0x7fffffff, 0x5eb9, 0x5, 0x9c05, 0x800000c, 0x401, 0x4, 0x75, 0x817, 0xb, 0x3, 0xda90, 0x27, 0xf, 0xbc4b, 0x106, 0xfd, 0x0, 0x6, 0x101, 0x39, 0xffffff7f, 0x6, 0x5, 0x5, 0x77, 0x7, 0x0, 0x9, 0x73f, 0x5, 0x8, 0x4, 0x3, 0xffffffff, 0x5, 0x3, 0x7, 0x2, 0x9, 0x8, 0xdd2, 0xfffffffb, 0x3, 0x4, 0x2, 0xfff, 0x80000001, 0x9, 0x4, 0x0, 0x3, 0x2, 0x2, 0x5, 0x6, 0x1, 0x80000001, 0x7, 0x0, 0x40, 0x5, 0x101, 0x8, 0x9, 0x334c230c, 0x6, 0x4, 0xfffffff9, 0x8, 0x3, 0xffff0000, 0x7, 0x2, 0xffffffff, 0x4, 0x3, 0x4, 0x4, 0x3f, 0x81, 0x3, 0x400, 0x4, 0x984, 0x1, 0x6, 0x7, 0x6, 0x1ff, 0x2a3, 0x6d, 0x1, 0x10000, 0x2, 0x7, 0x1d01e, 0x1, 0x3, 0xfffffffb, 0xb34, 0x63, 0x400, 0x5, 0x401, 0x7, 0xfff, 0x0, 0x9, 0x3, 0x8, 0xfffffff7, 0x2, 0x80000000, 0x3, 0xfffffffe, 0x1, 0xad, 0x100, 0x144, 0x2, 0xfffffffc, 0x2, 0x5, 0x0, 0x7, 0x9, 0x1, 0x4, 0x1000, 0x974, 0x5, 0x2, 0x8, 0x2, 0x88, 0x1000, 0x0, 0xffffffff, 0x2, 0x5, 0x9, 0x0, 0x57a, 0x0, 0x0, 0x6, 0x9, 0x5c, 0x6, 0x9, 0xd22, 0x2, 0x7, 0x10, 0x8, 0xffffffff, 0x2149, 0xe, 0x26a02622, 0x7fff, 0x8, 0x8, 0x7ff, 0x5, 0x8, 0x81, 0x8, 0xff, 0x5, 0xfffffffa, 0x2, 0x2, 0xffff, 0xf, 0x5, 0x7, 0x5, 0x100, 0x1e06, 0xf, 0xdf2, 0x0, 0xbb, 0xfff, 0x400, 0x2, 0x80000000, 0x7, 0x8, 0xf9b, 0x8, 0x7ff, 0x7, 0x3ff, 0x630a, 0x5, 0xcff, 0x9, 0xb7, 0x1, 0xff, 0x4, 0x5, 0x10, 0x1, 0x92a, 0x3, 0x5, 0xd, 0x5, 0x101, 0x6, 0x7fff, 0x800, 0x3, 0x4, 0x0, 0x7f, 0x200, 0x20, 0x7, 0x64000000, 0x0, 0x7f, 0x53, 0x8, 0x8, 0x5, 0x2, 0xf, 0xd81c, 0x840, 0x1, 0x9, 0x2, 0x81, 0x9, 0x3, 0x5, 0x1000, 0x8, 0x44, 0x94, 0x7, 0x8, 0x8001, 0x56f71053, 0x1, 0x867, 0x3ff, 0x40, 0x6, 0x3, 0xfff, 0x5, 0x197, 0x9, 0x6, 0x5, 0x6, 0x7, 0x0, 0x84, 0x3, 0x1ff, 0x400, 0x3, 0xd42, 0x9, 0x5, 0x1ff, 0x4, 0x9, 0xbec, 0x7, 0x7, 0x3, 0x5, 0x64000000, 0x2, 0x1e, 0x3a, 0x6, 0x5, 0x18000, 0x2, 0xffff, 0x9, 0x6, 0x9, 0x0, 0xe4f, 0x67c, 0x27b7, 0xe, 0x9, 0x9, 0x5, 0xd, 0x5, 0x7f, 0x76, 0x9, 0xc4fe, 0x9, 0x3, 0x4, 0x8, 0x87, 0x1, 0x4, 0x6, 0x40, 0x9, 0x8, 0x1, 0x6, 0x8, 0xc75e, 0x4, 0xa, 0x1b, 0xfd3, 0x2, 0x3, 0x9, 0x10, 0x4, 0x5d2f, 0x5, 0x1b, 0x3ff, 0x5, 0x8, 0x6, 0xc000000, 0x5c, 0x9, 0x541b, 0xce, 0x400, 0x4, 0x69f, 0x3, 0x5, 0x7, 0x4, 0x200, 0x7, 0x8, 0x2323, 0xfffffff7, 0xffff, 0x7ff, 0x4, 0xd, 0xffffff42, 0x89, 0x80000001, 0x3ff, 0x3, 0x554, 0xde, 0x0, 0x400, 0x3, 0x9, 0x800, 0x7cb3aca3, 0x6, 0x6, 0x4, 0xf8000000, 0x1, 0xfffffff9, 0x9, 0xffffffff, 0x0, 0x7, 0x10000, 0x4, 0x3, 0x8001, 0x8, 0xbb, 0x2, 0xf548, 0x3, 0x36c, 0xffffffff, 0x10, 0x676, 0xe67, 0x88, 0x808, 0x560, 0x6db5, 0xa7b, 0x2, 0x4, 0x9, 0x3, 0x4, 0xffffffff, 0x6, 0xed2, 0x24bdaad2, 0x9, 0x4, 0x3, 0x1, 0xd599, 0x2, 0x6c51, 0x2, 0x0, 0x5, 0x2, 0xfce6, 0xf, 0xcd0, 0x4, 0xf, 0x0, 0x9, 0x5, 0x200, 0x6, 0x5, 0x2, 0x7, 0x17, 0xc36, 0x0, 0x8fbb, 0x3, 0x5, 0x0, 0x8, 0x8, 0x1, 0x80000001, 0x1000001, 0x45d8, 0x9, 0x0, 0x60000, 0x7, 0xffffffff, 0xfffffff1, 0x3, 0x2, 0xfffffd67, 0x2, 0x4, 0x5, 0x3, 0x800, 0x10, 0xa, 0xb12c, 0x5ce, 0x1, 0xfffffffd, 0xf9c8, 0x0, 0x80f4, 0x10000, 0x3, 0x8, 0x2, 0x7, 0x5, 0x8, 0x401, 0x7, 0x10, 0x0, 0x67, 0x100, 0x8, 0x2, 0x2, 0x5273, 0xe45f, 0x10, 0x0, 0x4, 0x4, 0x7, 0x7, 0x6, 0x4, 0x8e8b, 0x5, 0x3, 0x7, 0x3, 0xe535, 0x80, 0x5, 0x6, 0x0, 0x3, 0xff, 0x7fffffff, 0x5, 0x1, 0xa, 0x4, 0x1, 0x31, 0x0, 0xee1, 0x10001, 0x3, 0xfffffffc, 0x4, 0x1, 0x6f9, 0x7, 0xb26c, 0xb, 0x0, 0xfffffff3, 0x4000008, 0x8, 0x1ff, 0x6, 0xfd, 0x7, 0x3d, 0x6, 0x80000001, 0x5, 0x7, 0x0, 0xffffffff, 0x6, 0x3d29, 0x4, 0xfffffff9, 0x8, 0xb04, 0x3, 0xea4, 0x9, 0x101, 0x4, 0x1400, 0xfffffeff, 0x7, 0x2, 0x4, 0x8, 0x7, 0xe, 0x2, 0xc, 0x40000002, 0x2, 0x64c1, 0x80000000, 0x200, 0x2, 0xfffffffd, 0x1, 0x91, 0x8001, 0x401, 0x781d, 0x80, 0xfffff5b0, 0x8, 0x3, 0x8, 0xfff, 0xcd800000, 0x9, 0x6, 0x0, 0x5b5, 0x7, 0x3, 0x2, 0x5, 0x10001, 0xc, 0x9e9, 0x53, 0xfffffdd5, 0xc, 0xc00, 0x40, 0x401, 0xf2a6, 0x7, 0x3, 0x2, 0x7, 0x3800000, 0x0, 0x3ff, 0x3, 0x7fffffff, 0x4, 0x0, 0x1, 0xf, 0x7, 0xa84d, 0x3, 0xaf, 0xaf72, 0x5f, 0x1, 0xe, 0x6, 0x9, 0x5, 0x7, 0x3, 0x5, 0x3, 0x40, 0x1000, 0x75f1, 0x4, 0x3, 0x1, 0xfffffffd, 0x4, 0x8, 0x10, 0x80, 0x1, 0x7fffffff, 0x0, 0xe, 0xc, 0x3, 0x2, 0xd, 0x8, 0xfffff3f6, 0x6, 0x8, 0x3, 0x8, 0x5, 0x3, 0x101, 0x8, 0xbd, 0xa, 0x8, 0xffffed34, 0x8000, 0x2, 0xffffffff, 0x7, 0x55f4727b, 0xd, 0x3b, 0x5, 0x8, 0xffffffff, 0x4, 0x81, 0x6, 0xb, 0x2, 0xa53, 0xff, 0x0, 0x2, 0x1, 0x3233, 0xff, 0x6, 0x2, 0x9, 0x1, 0x0, 0x3ff, 0x5, 0x8, 0x40, 0x0, 0x40, 0xbed6, 0x5, 0x80, 0x4, 0xd0000000, 0x8, 0x4, 0x5, 0x5, 0x7, 0x0, 0x0, 0x76b, 0xbb, 0x2, 0x6, 0x7fff, 0x9, 0xa, 0x5, 0x80, 0x4, 0x8, 0x8, 0x1f, 0x1, 0x3, 0x4, 0xd126, 0x7, 0x5, 0x0, 0x0, 0x8, 0x7, 0x1, 0x5, 0xfffffff8, 0x8, 0x270b, 0x5, 0x7fff, 0x4, 0x5, 0x6, 0x3, 0x4, 0x13f, 0x0, 0xc906, 0x6, 0x100, 0x1, 0x3, 0x3, 0x7f, 0x2b, 0x4, 0x3, 0x3, 0x8001, 0x46f, 0x19f1, 0x6, 0x20, 0x2, 0x2, 0x6, 0x5, 0x5, 0x401, 0x5, 0x6, 0x5, 0x7, 0xb, 0x200, 0x6, 0x9, 0x7, 0x3, 0x1, 0x7f, 0x9, 0xc3b, 0xfdf5, 0x0, 0x3, 0x0, 0xf, 0x1, 0x800, 0x4f35, 0x1, 0x18, 0x5, 0x0, 0x6, 0xaa5, 0x800, 0xf, 0x7, 0x800, 0xc, 0xfffffffb, 0xff, 0x5, 0x1000, 0x8, 0x81, 0x6, 0x2, 0x9, 0x8, 0x5, 0x8, 0x8, 0x100, 0x5, 0x10, 0x3, 0x7, 0x82, 0x4, 0x40, 0xabde, 0x1, 0xb, 0x8, 0x5, 0x8, 0x7f, 0x100, 0x8, 0x9, 0x6, 0x80000001, 0x2, 0x8, 0x2, 0x7fff, 0x3, 0x6, 0x4, 0x5, 0x3, 0x0, 0x1, 0x8, 0x59, 0x1, 0x0, 0x49, 0xaa19, 0xc, 0x400, 0x1, 0x7c47, 0x8, 0xc11, 0x4, 0x0, 0x7, 0x2, 0x7f, 0x0, 0x1, 0xc0000, 0x7, 0x4, 0xef47, 0x3, 0x1, 0x0, 0x2, 0x1, 0x0, 0xe14f, 0x5, 0x7, 0x8, 0x7fffffff, 0x7f, 0x3, 0xffffff88, 0x400, 0x7fffffff, 0x10, 0x5, 0x9, 0x5, 0x0, 0xff, 0x0, 0x8, 0x3, 0x5, 0xfffffffc, 0x9, 0x11, 0x9, 0xfffffffe, 0x40, 0x3, 0x7, 0x0, 0x1, 0x95, 0x6, 0x81, 0x4, 0x401, 0x6, 0x5, 0x3, 0x0, 0xd, 0x6, 0xc, 0x2, 0x1, 0xfffffe5c, 0x40, 0x0, 0x9, 0x24, 0x1ff, 0x4, 0xe92, 0x5, 0x6e3, 0x4, 0xff, 0x0, 0xdf, 0x5, 0x7, 0x100, 0x3ac9, 0x10001, 0xae27, 0x80, 0x5, 0x7, 0x7fff, 0x6, 0xb, 0x4, 0x1, 0x1, 0x0, 0x9, 0x331d, 0x6, 0xb6, 0x7, 0x4, 0x4, 0x9, 0x6cf3, 0x8, 0x7, 0xf, 0x80, 0x9, 0xffff, 0x8000, 0x1, 0x2, 0x2, 0xdc0, 0x0, 0x100, 0x9, 0x1, 0xfffffff8, 0x800, 0x6, 0x0, 0x9, 0x644d, 0x93, 0xb0, 0x2, 0x3ff, 0x800, 0xfffffff7, 0x2, 0x0, 0xff]}) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="01000000050000000900000084"], 0x48) r9 = socket$kcm(0x29, 0x2, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r9, 0x119, 0x1, &(0x7f00000000c0)=0x4, 0x4) readv(r7, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/158, 0x9e}, {&(0x7f0000000480)=""/63, 0x3f}], 0x2) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r10 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r10, 0x6, 0x0, 0x0, 0x0) r11 = fsmount(r10, 0x0, 0x0) fchdir(r11) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x40000, 0x0) 1.353127225s ago: executing program 7 (id=3623): syz_emit_ethernet(0x36, &(0x7f0000000280)={@random="a24858ca13d1", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv4={0x800, @dccp={{0x6, 0x4, 0x1, 0x7, 0x28, 0x68, 0x0, 0xc, 0x21, 0x0, @rand_addr=0x64010100, @local, {[@ra={0x94, 0x4}]}}, {{0x4e21, 0x4e21, 0x4, 0x1, 0xb, 0x0, 0x0, 0x0, 0x2, "740e23", 0xd, '1\x00'}}}}}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000700180a050000000000000000000a0000000900010073797a30000000000900020073797a31000000001400000011"], 0x54}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x3c, 0x0, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8}, @val={0xc, 0x99, {0x7ff, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff0200"], 0xfdef) 1.267971961s ago: executing program 7 (id=3624): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5, r0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket(0x400000000010, 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000004000)=@newtfilter={0x2c, 0x2c, 0xf3f, 0x70fd2c, 0x25dddbbd, {0x0, 0x0, 0x0, r6, {0xc, 0x3da48c8682330ab8}, {}, {0x7, 0xc}}, [@TCA_CHAIN={0x8, 0xb, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20045080}, 0x4880) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f0000000240)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000200)="03", 0x1}], 0x1}, 0x20004014) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x20800, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x20}) r9 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x2, 0x0) write(r9, &(0x7f0000000100)='bRequestType=\'', 0xe) ioctl$KVM_SET_SREGS(r9, 0x4138ae84, &(0x7f0000000600)={{0x3000, 0x2ffc, 0x5d82b76071442757, 0xe, 0x26, 0x76, 0x1, 0xc8, 0x9, 0x5, 0xf9, 0x6}, {0x80a0000, 0xb000, 0x0, 0xc4, 0x1, 0x9, 0x1, 0x6, 0x3, 0x2, 0x4, 0x7}, {0xe000, 0xfec00000, 0xe, 0x4, 0x9, 0xfe, 0x9, 0x24, 0xd, 0x4, 0x3, 0x4}, {0x2227d007, 0x4, 0x3, 0x2a, 0x6, 0x8b, 0x0, 0x3, 0x0, 0x9, 0x80, 0x8}, {0x80a0000, 0x1ffc, 0x4, 0x5, 0x6, 0x57, 0x1, 0xd3, 0x1, 0x1, 0x3, 0xb}, {0xe000, 0x40000, 0x4, 0x3, 0x2, 0x3, 0x5, 0xc3, 0x89, 0x27, 0x2, 0xd}, {0xeeee0000, 0x26000, 0x3, 0x7f, 0x6, 0x7f, 0x9, 0xd0, 0x7, 0xdd, 0x5, 0x3}, {0xb000, 0xffff1000, 0xc, 0x8, 0x40, 0x7, 0x81, 0x3, 0x8, 0x7, 0x1e, 0x8}, {0x40000, 0x7}, {0xffff1000, 0x4}, 0x40000001, 0x0, 0x1, 0x200000, 0x2, 0x1, 0x4, [0x3, 0xb9, 0xa4c8, 0x6]}) r10 = mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, &(0x7f0000000440)={0x2000000000002000, 0x1, 0x56, 0x3}) mq_timedsend(r10, 0x0, 0x0, 0x3, 0x0) mq_timedsend(r10, 0x0, 0x0, 0x9, 0x0) mq_timedreceive(r10, &(0x7f0000000500)=""/202, 0xca, 0x200000200009, 0x0) 1.227079756s ago: executing program 5 (id=3625): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x6, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x48885) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) getpid() mkdirat(0xffffffffffffffff, &(0x7f0000000400)='./sys/bus/pci/rescan\x00', 0x1f7) r2 = syz_open_dev$usbfs(0x0, 0x84, 0x111000) read$usbfs(r2, &(0x7f0000000600)=""/234, 0xea) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000401000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100626174616476000014000280100001004241544d414e5f56"], 0xfd12}}, 0x0) write(r3, &(0x7f00000000c0)='1\x00', 0x1) r5 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r5, &(0x7f00000000c0)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @multicast2}}, 0x24) bind$rxrpc(r5, &(0x7f0000000000)=@in6={0x21, 0x4, 0x2, 0x1c, {0xa, 0x4e23, 0x0, @rand_addr=' \x01\x00'}}, 0x24) write(0xffffffffffffffff, &(0x7f0000000700)="3100d90daaa91f198d99db922334963f621e49a6ca0b870113948d1bd6e243e5da22cf2ba7bca0e3865eaa6666cca12e329a784c6e63a08e7d57f2e2a6fa1f85d8a30f16645140e37208d917f43c0e86486bb3e9fd67f758c7f029fcbacd68c67fd996ba190681103b5cb8dbd189543ac4d64867e39469625a900852b3220d4788d9f52245fb79fec8cffbcf9a5d9764a4d5c3af2d28", 0x96) openat$kvm(0xffffffffffffff9c, &(0x7f00000008c0), 0x103000, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 372.257741ms ago: executing program 7 (id=3626): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0xffffffff, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, 0x400, 0x4, r0, 0x0, 0x0, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc1105518, 0x0) 303.037835ms ago: executing program 7 (id=3627): r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) listen(r0, 0x5) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0) process_vm_readv(0x0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) mount$nfs4(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='tcp']) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x21, &(0x7f0000000340)={0x0, 0x6be, 0x80, 0x2, 0x27c, 0x0, r1}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000440)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000980)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x79, 0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80010023, 0x0, {0x1}}) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x809, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x4, 0x180, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x48}}}, 0x0) ioctl$int_out(r2, 0x3d87eb9fb34264a4, 0x0) socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000480)=ANY=[@ANYBLOB="6d616e676c65000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000", @ANYBLOB="9ad871c30ccea866b26bcde5caf5db24b22eddaefe6b1047d9f8a5ba4c03f86ab57909da279ca5e297cb326b4ab059c4e674f0b5f4bc75af2d5ade7af2fe5ff86f6a05c799765b3ade85ac0288fdeec7904c2020f445ab18f5d6e9b7b9189493e30ead8b0d19d2b90ddee042e720fbcce64ea7bf497a828fff12707b8971a128dfce7215498d90d0f806764cd1bea356cbdcd999d6132945"], 0x54) syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) r7 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0) r8 = syz_open_dev$video(&(0x7f0000000000), 0x7ff, 0x0) ioctl$VIDIOC_S_INPUT(r8, 0xc0045627, &(0x7f0000000040)=0x3) ioctl$VIDIOC_S_INPUT(r8, 0xc0045627, &(0x7f0000000080)) ioctl$VHOST_SET_FEATURES(r7, 0x4008af83, &(0x7f00000008c0)=0x8000) close(0x3) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB="00000000000000000000f6ffffffffffffff0000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r9, &(0x7f0000000280), &(0x7f0000000000)=""/3, 0x2}, 0x20) r10 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000280), 0x40900, 0x0) io_setup(0x3, &(0x7f00000003c0)=0x0) io_submit(r11, 0x1, &(0x7f0000000000)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x0, r10, 0x0}]) socket$packet(0x11, 0x2, 0x300) socket$inet6(0xa, 0x2, 0x0) socket$inet6(0xa, 0x5, 0x0) 250.766341ms ago: executing program 7 (id=3628): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) shmat(0x0, &(0x7f0000001000/0x3000)=nil, 0xc000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$key(0xf, 0x3, 0x2) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x3, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000640)=0x7) r3 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_UNISCRNMAP(r3, 0x4b69, &(0x7f0000000280)=""/207) r4 = getpid() ptrace$ARCH_SHSTK_UNLOCK(0x1e, r4, 0x3, 0x5004) sched_setaffinity(0x0, 0x28, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40046607, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc00000019000100010000000000000020010000000000000000000000000000ac3514aa0000000000000000000000004e220000000000000a0000000000"], 0xfc}}, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="a0000000210001000000000004000000ff0100000000000000000000000000010a01010200000000000000000000000000000005000000000a0000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000005000110000000000000000000000000000000001000000000000000000009276bfbd3c92846fdfa7d3ceffffac1e0101ff020000000000000000000000000001fc0200000000000000000000000000003c"], 0xa0}}, 0x0) 0s ago: executing program 8 (id=3629): syz_emit_ethernet(0x32, &(0x7f0000000280)={@random="a24858ca13d1", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x1, 0x7, 0x24, 0x68, 0x0, 0xc, 0x21, 0x0, @rand_addr=0x64010100, @local}, {{0x4e21, 0x4e21, 0x4, 0x1, 0xb, 0x0, 0x0, 0x0, 0x2, "740e23", 0xd, '1\x00'}}}}}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x54}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) kernel console output (not intermixed with test programs): ][ T1040] nfcmrvl 13-1:1.0: NFC: registered with nci successfully [ 390.776799][T10886] usb 14-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 390.776822][T10886] usb 14-1: no configurations [ 390.776828][T10886] usb 14-1: can't read configurations, error -22 [ 390.777120][T10886] usb usb14-port1: attempt power cycle [ 390.797110][ T5817] nfcmrvl 13-1:1.0: NFC: send entry, len 4 [ 390.797884][ T5817] usb 13-1: NFC: urb ffff88804eb3ea00 submission failed (90) [ 390.845979][T15808] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.848831][T15808] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 391.116416][T10886] usb 14-1: new high-speed USB device number 8 using dummy_hcd [ 391.137544][T10886] usb 14-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 391.137580][T10886] usb 14-1: no configurations [ 391.137592][T10886] usb 14-1: can't read configurations, error -22 [ 391.267741][T10886] usb 14-1: new high-speed USB device number 9 using dummy_hcd [ 391.287447][T10886] usb 14-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 391.287485][T10886] usb 14-1: no configurations [ 391.287497][T10886] usb 14-1: can't read configurations, error -22 [ 391.288400][T10886] usb usb14-port1: unable to enumerate USB device [ 391.420317][T15819] netlink: 'syz.5.3291': attribute type 19 has an invalid length. [ 392.211332][T15821] FAULT_INJECTION: forcing a failure. [ 392.211332][T15821] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 392.211400][T15821] CPU: 0 UID: 0 PID: 15821 Comm: syz.7.3292 Tainted: G L syzkaller #0 PREEMPT(full) [ 392.211417][T15821] Tainted: [L]=SOFTLOCKUP [ 392.211421][T15821] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 392.211428][T15821] Call Trace: [ 392.211432][T15821] [ 392.211438][T15821] dump_stack_lvl+0x100/0x190 [ 392.211457][T15821] should_fail_ex.cold+0x5/0xa [ 392.211472][T15821] _copy_from_user+0x2e/0xd0 [ 392.211488][T15821] do_ip_getsockopt+0x42a/0x23f0 [ 392.211504][T15821] ? __pfx_do_ip_getsockopt+0x10/0x10 [ 392.211530][T15821] ? __pfx_check_buffer+0x10/0x10 [ 392.211546][T15821] ? __pfx_begin_current_label_crit_section+0x10/0x10 [ 392.211564][T15821] ? aa_inet_opt_perm+0x30d/0x970 [ 392.211580][T15821] ? __pfx_aa_inet_opt_perm+0x10/0x10 [ 392.211594][T15821] ? __lock_acquire+0x5c0/0x1f40 [ 392.211609][T15821] ? _parse_integer_limit+0x1ac/0x220 [ 392.211622][T15821] ? _kstrtoull+0x144/0x200 [ 392.211633][T15821] ip_getsockopt+0xa1/0x1e0 [ 392.211647][T15821] ? __pfx_ip_getsockopt+0x10/0x10 [ 392.211665][T15821] ipv6_getsockopt+0x243/0x2a0 [ 392.211683][T15821] ? __pfx_ipv6_getsockopt+0x10/0x10 [ 392.211699][T15821] ? lock_acquire+0x1d1/0x380 [ 392.211717][T15821] tcp_getsockopt+0xa1/0x110 [ 392.211732][T15821] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 392.211746][T15821] do_sock_getsockopt+0x50a/0x6e0 [ 392.211761][T15821] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 392.211776][T15821] ? __fget_files+0x34/0x3d0 [ 392.211790][T15821] ? find_held_lock+0x2b/0x80 [ 392.211810][T15821] ? __fget_files+0x21f/0x3d0 [ 392.211826][T15821] __sys_getsockopt+0x133/0x1d0 [ 392.211847][T15821] ? __ia32_sys_getsockopt+0xbc/0x160 [ 392.211863][T15821] __ia32_sys_getsockopt+0xbc/0x160 [ 392.211879][T15821] ? __do_fast_syscall_32+0xb3/0x8b0 [ 392.211892][T15821] ? lockdep_hardirqs_on+0x7d/0x110 [ 392.211903][T15821] __do_fast_syscall_32+0x13a/0x8b0 [ 392.211915][T15821] ? lockdep_hardirqs_on+0x7d/0x110 [ 392.211928][T15821] do_fast_syscall_32+0x32/0x70 [ 392.211941][T15821] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 392.211955][T15821] RIP: 0023:0xf703efec [ 392.211968][T15821] Code: Unable to access opcode bytes at 0xf703efc2. [ 392.211974][T15821] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 000000000000016d [ 392.211985][T15821] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 392.211992][T15821] RDX: 0000000000000030 RSI: 0000000000000000 RDI: 0000000080000100 [ 392.211999][T15821] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 392.212006][T15821] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 392.212012][T15821] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 392.212026][T15821] [ 393.129786][T15784] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 393.160171][T15836] binder: BINDER_SET_CONTEXT_MGR already set [ 393.160182][T15836] binder: 15835:15836 ioctl 4018620d 80000cc0 returned -16 [ 393.160631][T15836] binder_alloc: 15835: binder_alloc_buf size 1024 failed, no address space [ 393.160741][T15836] binder_alloc: allocated: 12288 (num: 2 largest: 12280), free: 0 (num: 0 largest: 0) [ 393.173915][ T9446] usb 13-1: USB disconnect, device number 16 [ 393.175456][ T9446] usb 13-1: NFC: intf ffff888014673000 [ 393.556313][ T9446] usb 13-1: new high-speed USB device number 17 using dummy_hcd [ 393.716376][ T1038] usb 14-1: new high-speed USB device number 10 using dummy_hcd [ 393.716531][T10886] usb 12-1: new high-speed USB device number 10 using dummy_hcd [ 393.717572][ T9446] usb 13-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 393.718442][ T9446] usb 13-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 393.718464][ T9446] usb 13-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 393.720128][ T9446] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.720146][ T9446] usb 13-1: Product: syz [ 393.720157][ T9446] usb 13-1: Manufacturer: syz [ 393.720169][ T9446] usb 13-1: SerialNumber: syz [ 393.727976][ T9446] usb 13-1: NFC: intf ffff88806b745000 id ffffffff8fe951a0 [ 393.744167][ T9446] nfcmrvl 13-1:1.0: NFC: registered with nci successfully [ 393.875534][T15860] jffs2: notice: (15860) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 393.878347][ T1038] usb 14-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 393.878390][ T1038] usb 14-1: no configurations [ 393.878401][ T1038] usb 14-1: can't read configurations, error -22 [ 393.878717][T10886] usb 12-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 393.880599][T10886] usb 12-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 393.880630][T10886] usb 12-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 393.880654][T10886] usb 12-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 393.880671][T10886] usb 12-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 393.881588][T10886] usb 12-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 393.881607][T10886] usb 12-1: Manufacturer: syz [ 393.883935][T10886] usb 12-1: config 0 descriptor?? [ 393.953971][ T12] nfcmrvl 13-1:1.0: NFC: send entry, len 4 [ 393.954032][ T12] usb 13-1: NFC: urb ffff888055cc1600 submission failed (90) [ 393.999941][T15862] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 394.000778][T15862] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 394.016401][ T1038] usb 14-1: new high-speed USB device number 11 using dummy_hcd [ 394.196255][ C1] net_ratelimit: 70 callbacks suppressed [ 394.198581][ T1038] usb 14-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 394.198603][ T1038] usb 14-1: no configurations [ 394.198610][ T1038] usb 14-1: can't read configurations, error -22 [ 394.198834][ T1038] usb usb14-port1: attempt power cycle [ 394.272998][T15864] FAULT_INJECTION: forcing a failure. [ 394.272998][T15864] name failslab, interval 1, probability 0, space 0, times 0 [ 394.273020][T15864] CPU: 3 UID: 0 PID: 15864 Comm: syz.5.3307 Tainted: G L syzkaller #0 PREEMPT(full) [ 394.273036][T15864] Tainted: [L]=SOFTLOCKUP [ 394.273041][T15864] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 394.273048][T15864] Call Trace: [ 394.273052][T15864] [ 394.273058][T15864] dump_stack_lvl+0x100/0x190 [ 394.273078][T15864] should_fail_ex.cold+0x5/0xa [ 394.273095][T15864] should_failslab+0xc2/0x120 [ 394.273126][T15864] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 394.273140][T15864] ? find_held_lock+0x2b/0x80 [ 394.273154][T15864] ? sock_alloc_inode+0x26/0x2c0 [ 394.273168][T15864] ? __pfx_sock_alloc_inode+0x10/0x10 [ 394.273181][T15864] sock_alloc_inode+0x26/0x2c0 [ 394.273193][T15864] ? __pfx_sock_alloc_inode+0x10/0x10 [ 394.273204][T15864] alloc_inode+0x68/0x250 [ 394.273223][T15864] sock_alloc+0x44/0x280 [ 394.273233][T15864] ? security_socket_create+0x7f/0x250 [ 394.273257][T15864] __sock_create+0xc2/0x860 [ 394.273279][T15864] __sys_socket+0x14d/0x260 [ 394.273298][T15864] ? xfd_validate_state+0x129/0x190 [ 394.273321][T15864] ? __pfx___sys_socket+0x10/0x10 [ 394.273339][T15864] __ia32_sys_socket+0x72/0xb0 [ 394.273352][T15864] ? lockdep_hardirqs_on+0x7d/0x110 [ 394.273370][T15864] __do_fast_syscall_32+0x13a/0x8b0 [ 394.273386][T15864] do_fast_syscall_32+0x32/0x70 [ 394.273400][T15864] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 394.273416][T15864] RIP: 0023:0xf7f42fec [ 394.273430][T15864] Code: Unable to access opcode bytes at 0xf7f42fc2. [ 394.273436][T15864] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 394.273447][T15864] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 0000000000000003 [ 394.273455][T15864] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 394.273462][T15864] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 394.273469][T15864] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 394.273475][T15864] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 394.273490][T15864] [ 394.273588][T15864] socket: no more sockets [ 394.302432][T10886] usbhid 12-1:0.0: can't add hid device: -32 [ 394.302568][T10886] usbhid 12-1:0.0: probe with driver usbhid failed with error -32 [ 394.306542][T10886] usb 12-1: USB disconnect, device number 10 [ 394.536327][ T1038] usb 14-1: new high-speed USB device number 12 using dummy_hcd [ 394.557422][ T1038] usb 14-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 394.557446][ T1038] usb 14-1: no configurations [ 394.557452][ T1038] usb 14-1: can't read configurations, error -22 [ 394.686234][ T1038] usb 14-1: new high-speed USB device number 13 using dummy_hcd [ 394.709998][ T1038] usb 14-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 394.710025][ T1038] usb 14-1: no configurations [ 394.710032][ T1038] usb 14-1: can't read configurations, error -22 [ 394.710668][ T1038] usb usb14-port1: unable to enumerate USB device [ 396.214312][T15840] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 396.251488][ T9446] usb 13-1: USB disconnect, device number 17 [ 396.271671][ T9446] usb 13-1: NFC: intf ffff88806b745000 ** 774 printk messages dropped ** ** 90 printk messages dropped ** ** 96 printk messages dropped ** ** 95 printk messages dropped ** ** 69 printk messages dropped ** ** 58 printk messages dropped ** [ 397.247690][T15909] netlink: 72 bytes leftover after parsing attributes in process `syz.8.3323'. [ 397.520751][T15935] syz.5.3333 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 397.521379][T15937] jffs2: notice: (15937) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 397.807091][T15957] netlink: 32 bytes leftover after parsing attributes in process `syz.9.3342'. [ 397.807923][T15957] netlink: 4 bytes leftover after parsing attributes in process `syz.9.3342'. [ 397.807954][T15957] netlink: 24 bytes leftover after parsing attributes in process `syz.9.3342'. [ 399.203797][T15973] jffs2: notice: (15973) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 399.232792][T15976] FAULT_INJECTION: forcing a failure. [ 399.232792][T15976] name failslab, interval 1, probability 0, space 0, times 0 [ 399.232813][T15976] CPU: 2 UID: 0 PID: 15976 Comm: syz.5.3350 Tainted: G L syzkaller #0 PREEMPT(full) [ 399.232830][T15976] Tainted: [L]=SOFTLOCKUP [ 399.232834][T15976] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 399.232842][T15976] Call Trace: [ 399.232846][T15976] [ 399.232852][T15976] dump_stack_lvl+0x100/0x190 [ 399.232872][T15976] should_fail_ex.cold+0x5/0xa [ 399.232889][T15976] should_failslab+0xc2/0x120 [ 399.232906][T15976] __kmalloc_noprof+0xfc/0x840 [ 399.232922][T15976] ? __vb2_queue_alloc+0x23e/0x1160 [ 399.232941][T15976] __vb2_queue_alloc+0x23e/0x1160 [ 399.232964][T15976] vb2_core_reqbufs+0x899/0xf30 [ 399.232984][T15976] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 399.233001][T15976] ? rcu_is_watching+0x13/0xc0 [ 399.233015][T15976] ? __mutex_lock+0x26c/0x1bd0 [ 399.233028][T15976] ? __video_do_ioctl+0x50f/0xdf0 [ 399.233043][T15976] vb2_ioctl_reqbufs+0x291/0x450 [ 399.233057][T15976] ? __pfx_vb2_ioctl_reqbufs+0x10/0x10 [ 399.233076][T15976] vidioc_reqbufs+0x86/0x100 [ 399.233094][T15976] v4l_reqbufs+0x175/0x1d0 [ 399.233112][T15976] __video_do_ioctl+0xb2a/0xdf0 [ 399.233126][T15976] ? __might_fault+0xc5/0x140 [ 399.233138][T15976] ? __pfx___video_do_ioctl+0x10/0x10 [ 399.233157][T15976] video_usercopy+0x3d3/0x14c0 [ 399.233171][T15976] ? __pfx___video_do_ioctl+0x10/0x10 [ 399.233184][T15976] ? __pfx_video_usercopy+0x10/0x10 [ 399.233201][T15976] ? __fget_files+0x215/0x3d0 [ 399.233214][T15976] ? hook_file_ioctl_common+0x140/0x440 [ 399.233230][T15976] v4l2_ioctl+0x1bd/0x250 [ 399.233244][T15976] v4l2_compat_ioctl32+0x20f/0x2d0 [ 399.233262][T15976] ? __pfx_v4l2_compat_ioctl32+0x10/0x10 [ 399.233286][T15976] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 399.233302][T15976] __do_fast_syscall_32+0x13a/0x8b0 [ 399.233319][T15976] do_fast_syscall_32+0x32/0x70 [ 399.233333][T15976] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 399.233349][T15976] RIP: 0023:0xf7f42fec [ 399.233363][T15976] Code: Unable to access opcode bytes at 0xf7f42fc2. [ 399.233369][T15976] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 399.233382][T15976] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000c0145608 [ 399.233390][T15976] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 399.233397][T15976] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 399.233421][T15976] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 399.233429][T15976] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 399.233445][T15976] [ 399.234794][T15976] net_ratelimit: 93 callbacks suppressed [ 399.477890][T15985] netlink: 36 bytes leftover after parsing attributes in process `syz.8.3353'. [ 400.335013][ T43] audit: type=1326 audit(1790214011.423:95): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16001 comm="syz.9.3358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 400.335051][ T43] audit: type=1326 audit(1790214011.423:96): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16001 comm="syz.9.3358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 400.335840][ T43] audit: type=1326 audit(1790214011.423:97): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16001 comm="syz.9.3358" exe="/syz-executor" sig=0 arch=40000003 syscall=297 compat=1 ip=0xf701efec code=0x7ffc0000 [ 400.335866][ T43] audit: type=1326 audit(1790214011.423:98): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16001 comm="syz.9.3358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 400.336079][ T43] audit: type=1326 audit(1790214011.423:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16001 comm="syz.9.3358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 400.337399][ T43] audit: type=1326 audit(1790214011.433:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16001 comm="syz.9.3358" exe="/syz-executor" sig=0 arch=40000003 syscall=358 compat=1 ip=0xf701efec code=0x7ffc0000 [ 400.338203][ T43] audit: type=1326 audit(1790214011.433:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16001 comm="syz.9.3358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 400.338359][ T43] audit: type=1326 audit(1790214011.433:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16001 comm="syz.9.3358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 400.339081][ T43] audit: type=1326 audit(1790214011.433:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16001 comm="syz.9.3358" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf701efec code=0x7ffc0000 [ 400.341706][ T43] audit: type=1326 audit(1790214011.433:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16001 comm="syz.9.3358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 400.551901][T16002] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 400.553052][T16002] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 400.553288][T16002] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 400.553523][T16002] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 400.553931][T16002] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 400.554352][T16002] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 400.580139][T16002] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 400.636698][ T854] usb 14-1: new high-speed USB device number 14 using dummy_hcd [ 400.733575][T16013] FAULT_INJECTION: forcing a failure. [ 400.733575][T16013] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 400.733600][T16013] CPU: 3 UID: 0 PID: 16013 Comm: syz.7.3361 Tainted: G L syzkaller #0 PREEMPT(full) [ 400.733624][T16013] Tainted: [L]=SOFTLOCKUP [ 400.733630][T16013] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 400.733640][T16013] Call Trace: [ 400.733646][T16013] [ 400.733653][T16013] dump_stack_lvl+0x100/0x190 [ 400.733680][T16013] should_fail_ex.cold+0x5/0xa [ 400.733702][T16013] _copy_from_user+0x2e/0xd0 [ 400.733725][T16013] compat_wext_handle_ioctl+0xc4/0x220 [ 400.733744][T16013] ? __pfx_compat_wext_handle_ioctl+0x10/0x10 [ 400.733764][T16013] ? do_vfs_ioctl+0x226/0x13e0 [ 400.733782][T16013] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 400.733801][T16013] compat_sock_ioctl+0x381/0x760 [ 400.733826][T16013] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 400.733845][T16013] ? hook_file_ioctl_common+0x140/0x440 [ 400.733866][T16013] ? __fget_files+0x21f/0x3d0 [ 400.733888][T16013] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 400.733910][T16013] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 400.733929][T16013] __do_fast_syscall_32+0x13a/0x8b0 [ 400.733948][T16013] ? lockdep_hardirqs_on+0x7d/0x110 [ 400.733967][T16013] do_fast_syscall_32+0x32/0x70 [ 400.733986][T16013] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 400.734007][T16013] RIP: 0023:0xf703efec [ 400.734026][T16013] Code: Unable to access opcode bytes at 0xf703efc2. [ 400.734034][T16013] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 400.734052][T16013] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000008b04 [ 400.734063][T16013] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 400.734074][T16013] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 400.734084][T16013] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 400.734095][T16013] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 400.734137][T16013] [ 400.774312][T16015] FAULT_INJECTION: forcing a failure. [ 400.774312][T16015] name failslab, interval 1, probability 0, space 0, times 0 [ 400.774344][T16015] CPU: 3 UID: 0 PID: 16015 Comm: syz.7.3362 Tainted: G L syzkaller #0 PREEMPT(full) [ 400.774372][T16015] Tainted: [L]=SOFTLOCKUP [ 400.774386][T16015] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 400.774399][T16015] Call Trace: [ 400.774407][T16015] [ 400.774417][T16015] dump_stack_lvl+0x100/0x190 [ 400.774448][T16015] should_fail_ex.cold+0x5/0xa [ 400.774475][T16015] should_failslab+0xc2/0x120 [ 400.774503][T16015] __kmalloc_noprof+0xfc/0x840 [ 400.774527][T16015] ? __vb2_queue_alloc+0x23e/0x1160 [ 400.774559][T16015] __vb2_queue_alloc+0x23e/0x1160 [ 400.774599][T16015] vb2_core_reqbufs+0x899/0xf30 [ 400.774630][T16015] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 400.774657][T16015] ? rcu_is_watching+0x13/0xc0 [ 400.774681][T16015] ? __mutex_lock+0x26c/0x1bd0 [ 400.774704][T16015] ? __video_do_ioctl+0x50f/0xdf0 [ 400.774727][T16015] vb2_ioctl_reqbufs+0x291/0x450 [ 400.774753][T16015] ? __pfx_vb2_ioctl_reqbufs+0x10/0x10 [ 400.774785][T16015] vidioc_reqbufs+0x86/0x100 [ 400.774814][T16015] v4l_reqbufs+0x175/0x1d0 [ 400.774841][T16015] __video_do_ioctl+0xb2a/0xdf0 [ 400.774864][T16015] ? __might_fault+0xc5/0x140 [ 400.774881][T16015] ? __pfx___video_do_ioctl+0x10/0x10 [ 400.774908][T16015] video_usercopy+0x3d3/0x14c0 [ 400.774929][T16015] ? __pfx___video_do_ioctl+0x10/0x10 [ 400.774951][T16015] ? __pfx_video_usercopy+0x10/0x10 [ 400.774978][T16015] ? __fget_files+0x215/0x3d0 [ 400.774998][T16015] ? hook_file_ioctl_common+0x140/0x440 [ 400.775017][T16015] v4l2_ioctl+0x1bd/0x250 [ 400.775031][T16015] v4l2_compat_ioctl32+0x20f/0x2d0 [ 400.775048][T16015] ? __pfx_v4l2_compat_ioctl32+0x10/0x10 [ 400.775066][T16015] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 400.775081][T16015] __do_fast_syscall_32+0x13a/0x8b0 [ 400.775096][T16015] do_fast_syscall_32+0x32/0x70 [ 400.775110][T16015] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 400.775125][T16015] RIP: 0023:0xf703efec [ 400.775140][T16015] Code: Unable to access opcode bytes at 0xf703efc2. [ 400.775146][T16015] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 400.775158][T16015] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000c0145608 [ 400.775166][T16015] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 400.775173][T16015] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 400.775180][T16015] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 400.775187][T16015] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 400.775227][T16015] [ 401.095844][T16020] netlink: 36 bytes leftover after parsing attributes in process `syz.7.3363'. [ 401.267652][T16024] FAULT_INJECTION: forcing a failure. [ 401.267652][T16024] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 401.267671][T16024] CPU: 0 UID: 0 PID: 16024 Comm: syz.5.3365 Tainted: G L syzkaller #0 PREEMPT(full) [ 401.267687][T16024] Tainted: [L]=SOFTLOCKUP [ 401.267691][T16024] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 401.267698][T16024] Call Trace: [ 401.267703][T16024] [ 401.267708][T16024] dump_stack_lvl+0x100/0x190 [ 401.267728][T16024] should_fail_ex.cold+0x5/0xa [ 401.267748][T16024] _copy_to_user+0x32/0xd0 [ 401.267765][T16024] simple_read_from_buffer+0xcb/0x170 [ 401.267781][T16024] proc_fail_nth_read+0x1af/0x230 [ 401.267794][T16024] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 401.267808][T16024] ? rw_verify_area+0xce/0x6d0 [ 401.267819][T16024] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 401.267832][T16024] vfs_read+0x1e4/0xb40 [ 401.267844][T16024] ? lock_acquire+0x1d1/0x380 [ 401.267860][T16024] ? __fget_files+0x34/0x3d0 [ 401.267874][T16024] ? __pfx_vfs_read+0x10/0x10 [ 401.267885][T16024] ? find_held_lock+0x2b/0x80 [ 401.267898][T16024] ? __fget_files+0x215/0x3d0 [ 401.267914][T16024] ? __fget_files+0x21f/0x3d0 [ 401.267930][T16024] ksys_read+0x12a/0x250 [ 401.267942][T16024] ? __pfx_ksys_read+0x10/0x10 [ 401.267958][T16024] do_int80_emulation+0x166/0x650 [ 401.267974][T16024] asm_int80_emulation+0x1a/0x20 [ 401.267986][T16024] RIP: 0023:0xf71475ab [ 401.267995][T16024] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 401.268019][T16024] RSP: 002b:00000000f54064bc EFLAGS: 00000246 [ 401.268026][T16024] ORIG_RAX: 0000000000000003 [ 401.268032][T16024] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54065d0 [ 401.268039][T16024] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 401.268046][T16024] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 401.268052][T16024] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 401.268059][T16024] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 401.268073][T16024] [ 401.596370][T16026] bond0: invalid ARP target specified [ 401.688634][T16043] FAULT_INJECTION: forcing a failure. [ 401.688634][T16043] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 401.688653][T16043] CPU: 2 UID: 0 PID: 16043 Comm: syz.9.3371 Tainted: G L syzkaller #0 PREEMPT(full) [ 401.688668][T16043] Tainted: [L]=SOFTLOCKUP [ 401.688673][T16043] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 401.688679][T16043] Call Trace: [ 401.688684][T16043] [ 401.688688][T16043] dump_stack_lvl+0x100/0x190 [ 401.688708][T16043] should_fail_ex.cold+0x5/0xa [ 401.688723][T16043] _copy_to_user+0x32/0xd0 [ 401.688740][T16043] simple_read_from_buffer+0xcb/0x170 [ 401.688755][T16043] proc_fail_nth_read+0x1af/0x230 [ 401.688769][T16043] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 401.688782][T16043] ? rw_verify_area+0xce/0x6d0 [ 401.688793][T16043] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 401.688805][T16043] vfs_read+0x1e4/0xb40 [ 401.688817][T16043] ? lock_acquire+0x1d1/0x380 [ 401.688834][T16043] ? __fget_files+0x34/0x3d0 [ 401.688847][T16043] ? __pfx_vfs_read+0x10/0x10 [ 401.688862][T16043] ? find_held_lock+0x2b/0x80 [ 401.688875][T16043] ? __fget_files+0x215/0x3d0 [ 401.688890][T16043] ? __fget_files+0x21f/0x3d0 [ 401.688907][T16043] ksys_read+0x12a/0x250 [ 401.688919][T16043] ? __pfx_ksys_read+0x10/0x10 [ 401.688935][T16043] do_int80_emulation+0x166/0x650 [ 401.688950][T16043] asm_int80_emulation+0x1a/0x20 [ 401.688962][T16043] RIP: 0023:0xf71575ab [ 401.688972][T16043] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 401.688983][T16043] RSP: 002b:00000000f540d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 401.688995][T16043] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f540d5d0 [ 401.689002][T16043] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 401.689009][T16043] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 401.689015][T16043] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 401.689022][T16043] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 401.689036][T16043] [ 401.751710][T16045] No control pipe specified [ 402.046290][ T854] usb 12-1: new high-speed USB device number 11 using dummy_hcd [ 402.065408][T16048] No control pipe specified [ 402.218002][ T854] usb 12-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 402.219208][ T854] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 402.219229][ T854] usb 12-1: config 0 has no interfaces? [ 402.219270][ T854] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 402.223764][ T854] usb 12-1: config 0 descriptor?? [ 402.438822][ T5887] usb 12-1: USB disconnect, device number 11 [ 402.544158][T16061] netlink: 84 bytes leftover after parsing attributes in process `syz.5.3377'. [ 402.587242][T14397] Bluetooth: hci0: command 0x0c1a tx timeout [ 402.587288][T14397] Bluetooth: hci6: command 0x0406 tx timeout [ 402.587312][T14397] Bluetooth: hci5: command 0x0406 tx timeout [ 402.587332][T14397] Bluetooth: hci4: command 0x0406 tx timeout [ 402.587353][T14397] Bluetooth: hci1: command 0x0406 tx timeout [ 402.702674][T16071] FAULT_INJECTION: forcing a failure. [ 402.702674][T16071] name failslab, interval 1, probability 0, space 0, times 0 [ 402.702708][T16071] CPU: 0 UID: 0 PID: 16071 Comm: syz.8.3379 Tainted: G L syzkaller #0 PREEMPT(full) [ 402.702751][T16071] Tainted: [L]=SOFTLOCKUP [ 402.702760][T16071] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 402.702779][T16071] Call Trace: [ 402.702786][T16071] [ 402.702795][T16071] dump_stack_lvl+0x100/0x190 [ 402.702829][T16071] should_fail_ex.cold+0x5/0xa [ 402.702854][T16071] should_failslab+0xc2/0x120 [ 402.702882][T16071] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 402.702907][T16071] ? find_held_lock+0x2b/0x80 [ 402.702929][T16071] ? sock_alloc_inode+0x26/0x2c0 [ 402.702952][T16071] ? __pfx_sock_alloc_inode+0x10/0x10 [ 402.702974][T16071] sock_alloc_inode+0x26/0x2c0 [ 402.702995][T16071] ? __pfx_sock_alloc_inode+0x10/0x10 [ 402.703016][T16071] alloc_inode+0x68/0x250 [ 402.703047][T16071] sock_alloc+0x44/0x280 [ 402.703064][T16071] ? security_socket_create+0x7f/0x250 [ 402.703094][T16071] __sock_create+0xc2/0x860 [ 402.703248][T16071] __sys_socket+0x14d/0x260 [ 402.703273][T16071] ? fput+0x7c/0x100 [ 402.703298][T16071] ? __pfx___sys_socket+0x10/0x10 [ 402.703321][T16071] ? ksys_write+0x1ac/0x250 [ 402.703342][T16071] ? __pfx_ksys_write+0x10/0x10 [ 402.703369][T16071] __ia32_sys_socket+0x72/0xb0 [ 402.703392][T16071] ? lockdep_hardirqs_on+0x7d/0x110 [ 402.703413][T16071] __do_fast_syscall_32+0x13a/0x8b0 [ 402.703439][T16071] do_fast_syscall_32+0x32/0x70 [ 402.703462][T16071] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 402.703487][T16071] RIP: 0023:0xf7f28fec [ 402.703509][T16071] Code: Unable to access opcode bytes at 0xf7f28fc2. [ 402.703519][T16071] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 402.703538][T16071] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 0000000000000003 [ 402.703551][T16071] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 402.703563][T16071] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 402.703575][T16071] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 402.703587][T16071] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 402.703611][T16071] [ 403.427170][ T10] usb 13-1: new high-speed USB device number 18 using dummy_hcd [ 403.598734][ T10] usb 13-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 403.599707][ T10] usb 13-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 403.599725][ T10] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 403.599738][ T10] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 403.599749][ T10] usb 13-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 403.600999][ T10] usb 13-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 403.601009][ T10] usb 13-1: Manufacturer: syz [ 403.604696][ T10] usb 13-1: config 0 descriptor?? [ 403.936317][ T1040] usb 12-1: new high-speed USB device number 12 using dummy_hcd [ 403.988656][T16114] bond0: invalid ARP target specified [ 404.013277][ T10] appleir 0003:05AC:8243.000F: unknown main item tag 0x0 [ 404.015842][ T10] appleir 0003:05AC:8243.000F: hiddev0,hidraw1: USB HID v0.00 Device [syz] on usb-dummy_hcd.8-1/input0 [ 404.084560][T16118] FAULT_INJECTION: forcing a failure. [ 404.084560][T16118] name failslab, interval 1, probability 0, space 0, times 0 [ 404.084580][T16118] CPU: 0 UID: 0 PID: 16118 Comm: syz.5.3395 Tainted: G L syzkaller #0 PREEMPT(full) [ 404.084596][T16118] Tainted: [L]=SOFTLOCKUP [ 404.084600][T16118] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 404.084607][T16118] Call Trace: [ 404.084611][T16118] [ 404.084616][T16118] dump_stack_lvl+0x100/0x190 [ 404.084636][T16118] should_fail_ex.cold+0x5/0xa [ 404.084651][T16118] should_failslab+0xc2/0x120 [ 404.084668][T16118] __kmalloc_noprof+0xfc/0x840 [ 404.084682][T16118] ? iter_file_splice_write+0x1d8/0x10b0 [ 404.084700][T16118] iter_file_splice_write+0x1d8/0x10b0 [ 404.084722][T16118] ? __pfx_iter_file_splice_write+0x10/0x10 [ 404.084737][T16118] ? __lock_acquire+0x5c0/0x1f40 [ 404.084754][T16118] ? shmem_file_splice_read+0x724/0xd80 [ 404.084781][T16118] ? __pfx_iter_file_splice_write+0x10/0x10 [ 404.084798][T16118] direct_splice_actor+0x192/0x690 [ 404.084815][T16118] splice_direct_to_actor+0x345/0xa30 [ 404.084831][T16118] ? __pfx_direct_splice_actor+0x10/0x10 [ 404.084847][T16118] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 404.084864][T16118] ? lock_acquire+0x1d1/0x380 [ 404.084881][T16118] do_splice_direct+0x174/0x240 [ 404.084896][T16118] ? __pfx_do_splice_direct+0x10/0x10 [ 404.084913][T16118] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 404.084929][T16118] ? rw_verify_area+0xce/0x6d0 [ 404.084941][T16118] do_sendfile+0xadc/0xe20 [ 404.084956][T16118] ? __pfx_do_sendfile+0x10/0x10 [ 404.084968][T16118] ? __might_fault+0xc5/0x140 [ 404.084989][T16118] __ia32_compat_sys_sendfile+0x162/0x220 [ 404.085011][T16118] ? __pfx___ia32_compat_sys_sendfile+0x10/0x10 [ 404.085031][T16118] ? ksys_write+0x1ac/0x250 [ 404.085049][T16118] ? __pfx_ksys_write+0x10/0x10 [ 404.085073][T16118] __do_fast_syscall_32+0x13a/0x8b0 [ 404.085090][T16118] ? lockdep_hardirqs_on+0x7d/0x110 [ 404.085104][T16118] do_fast_syscall_32+0x32/0x70 [ 404.085116][T16118] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 404.085131][T16118] RIP: 0023:0xf7f42fec [ 404.085144][T16118] Code: Unable to access opcode bytes at 0xf7f42fc2. [ 404.085149][T16118] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 00000000000000bb [ 404.085164][T16118] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000003 [ 404.085175][T16118] RDX: 0000000080000100 RSI: 0000000000008112 RDI: 0000000000000000 [ 404.085184][T16118] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 404.085195][T16118] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 404.085205][T16118] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 404.085229][T16118] [ 404.106924][ T1040] usb 12-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 404.107966][ T1040] usb 12-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 404.107978][ T1040] usb 12-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 404.108005][ T1040] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.131744][T16122] FAULT_INJECTION: forcing a failure. [ 404.131744][T16122] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 404.131761][T16122] CPU: 0 UID: 0 PID: 16122 Comm: syz.5.3397 Tainted: G L syzkaller #0 PREEMPT(full) [ 404.131776][T16122] Tainted: [L]=SOFTLOCKUP [ 404.131780][T16122] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 404.131787][T16122] Call Trace: [ 404.131791][T16122] [ 404.131796][T16122] dump_stack_lvl+0x100/0x190 [ 404.131815][T16122] should_fail_ex.cold+0x5/0xa [ 404.131830][T16122] _copy_from_iter+0x1f4/0x1690 [ 404.131849][T16122] ? __asan_memset+0x23/0x50 [ 404.131862][T16122] ? __pfx__copy_from_iter+0x10/0x10 [ 404.131877][T16122] ? __pfx___alloc_skb+0x10/0x10 [ 404.131901][T16122] netlink_sendmsg+0x808/0xda0 [ 404.131926][T16122] ? __pfx_netlink_sendmsg+0x10/0x10 [ 404.131949][T16122] ? apparmor_socket_sendmsg+0x165/0x280 [ 404.131977][T16122] ____sys_sendmsg+0xa4d/0xbe0 [ 404.131997][T16122] ? __pfx_netlink_sendmsg+0x10/0x10 [ 404.132023][T16122] ? __pfx_____sys_sendmsg+0x10/0x10 [ 404.132052][T16122] ___sys_sendmsg+0x190/0x1e0 [ 404.132076][T16122] ? __pfx____sys_sendmsg+0x10/0x10 [ 404.132108][T16122] ? find_held_lock+0x2b/0x80 [ 404.132143][T16122] __sys_sendmsg+0x160/0x210 [ 404.132161][T16122] ? __pfx___sys_sendmsg+0x10/0x10 [ 404.132182][T16122] ? __pfx_ksys_write+0x10/0x10 [ 404.132197][T16122] __do_fast_syscall_32+0x13a/0x8b0 [ 404.132211][T16122] ? lockdep_hardirqs_on+0x7d/0x110 [ 404.132223][T16122] do_fast_syscall_32+0x32/0x70 [ 404.132236][T16122] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 404.132251][T16122] RIP: 0023:0xf7f42fec [ 404.132264][T16122] Code: Unable to access opcode bytes at 0xf7f42fc2. [ 404.132270][T16122] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 404.132281][T16122] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000340 [ 404.132288][T16122] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 404.132295][T16122] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 404.132302][T16122] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 404.132308][T16122] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 404.132322][T16122] [ 404.155812][T16124] syz.9.3398: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 404.155920][T16124] CPU: 2 UID: 0 PID: 16124 Comm: syz.9.3398 Tainted: G L syzkaller #0 PREEMPT(full) [ 404.155947][T16124] Tainted: [L]=SOFTLOCKUP [ 404.155956][T16124] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 404.155968][T16124] Call Trace: [ 404.155976][T16124] [ 404.155985][T16124] dump_stack_lvl+0x100/0x190 [ 404.156016][T16124] warn_alloc.cold+0x9e/0xb2 [ 404.156041][T16124] ? __pfx_warn_alloc+0x10/0x10 [ 404.156061][T16124] ? __kasan_kmalloc+0xaa/0xb0 [ 404.156084][T16124] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 404.156102][T16124] ? xskq_create+0x52/0x290 [ 404.156132][T16124] ? do_sock_setsockopt+0xf3/0x1d0 [ 404.156176][T16124] ? __do_fast_syscall_32+0x13a/0x8b0 [ 404.156201][T16124] ? do_fast_syscall_32+0x32/0x70 [ 404.156236][T16124] ? xsk_setsockopt+0x743/0xab0 [ 404.156265][T16124] __vmalloc_node_range_noprof+0x123b/0x1420 [ 404.156304][T16124] ? xsk_setsockopt+0x743/0xab0 [ 404.156337][T16124] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 404.156372][T16124] ? kasan_save_track+0x14/0x30 [ 404.156400][T16124] ? __kasan_kmalloc+0xaa/0xb0 [ 404.156428][T16124] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 404.156452][T16124] ? xskq_create+0x52/0x290 [ 404.156484][T16124] ? xsk_setsockopt+0x743/0xab0 [ 404.156516][T16124] xskq_create+0x18f/0x290 [ 404.156548][T16124] ? xsk_setsockopt+0x743/0xab0 [ 404.156581][T16124] xsk_setsockopt+0x743/0xab0 [ 404.156611][T16124] ? __pfx_aa_sk_perm+0x10/0x10 [ 404.156633][T16124] ? __pfx_xsk_setsockopt+0x10/0x10 [ 404.156663][T16124] ? find_held_lock+0x2b/0x80 [ 404.156690][T16124] ? aa_sock_opt_perm+0x114/0x1e0 [ 404.156720][T16124] ? __pfx_xsk_setsockopt+0x10/0x10 [ 404.156758][T16124] do_sock_setsockopt+0xf3/0x1d0 [ 404.156784][T16124] __sys_setsockopt+0x119/0x190 [ 404.156818][T16124] __ia32_sys_setsockopt+0xbc/0x160 [ 404.156844][T16124] ? __do_fast_syscall_32+0xb3/0x8b0 [ 404.156864][T16124] ? lockdep_hardirqs_on+0x7d/0x110 [ 404.156883][T16124] __do_fast_syscall_32+0x13a/0x8b0 [ 404.156908][T16124] do_fast_syscall_32+0x32/0x70 [ 404.156930][T16124] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 404.156954][T16124] RIP: 0023:0xf701efec [ 404.156977][T16124] Code: Unable to access opcode bytes at 0xf701efc2. [ 404.156987][T16124] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 404.157007][T16124] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000000011b [ 404.157021][T16124] RDX: 0000000000000006 RSI: 0000000080000000 RDI: 0000000000000004 [ 404.157033][T16124] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 404.157045][T16124] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 404.157057][T16124] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 404.157083][T16124] [ 404.157425][T16124] Mem-Info: [ 404.157437][T16124] active_anon:7724 inactive_anon:309 isolated_anon:0 [ 404.157437][T16124] active_file:8783 inactive_file:19978 isolated_file:0 [ 404.157437][T16124] unevictable:1000 dirty:382 writeback:25 [ 404.157437][T16124] slab_reclaimable:7151 slab_unreclaimable:69280 [ 404.157437][T16124] mapped:29991 shmem:1535 pagetables:1856 [ 404.157437][T16124] sec_pagetables:315 bounce:0 [ 404.157437][T16124] kernel_misc_reclaimable:0 [ 404.157437][T16124] free:27192 free_pcp:14177 free_cma:0 [ 404.157489][T16124] Node 0 active_anon:556kB inactive_anon:48kB active_file:168kB inactive_file:1276kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:2080kB dirty:0kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8384kB pagetables:1504kB sec_pagetables:1120kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 404.157537][T16124] Node 1 active_anon:30340kB inactive_anon:1188kB active_file:34964kB inactive_file:78636kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:117884kB dirty:1528kB writeback:100kB shmem:4140kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:6912kB pagetables:5920kB sec_pagetables:140kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 404.157585][T16124] Node 0 DMA free:3156kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:8kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:104kB local_pcp:52kB free_cma:0kB [ 404.157635][T16124] lowmem_reserve[]: 0 278 278 278 278 [ 404.157669][T16124] Node 0 DMA32 free:20552kB boost:8192kB min:20816kB low:23972kB high:27128kB reserved_highatomic:0kB free_highatomic:0kB active_anon:556kB inactive_anon:48kB active_file:160kB inactive_file:1276kB unevictable:2000kB writepending:0kB zspages:0kB present:1032196kB managed:284860kB mlocked:0kB bounce:0kB free_pcp:9760kB local_pcp:2700kB free_cma:0kB [ 404.157722][T16124] lowmem_reserve[]: 0 0 0 0 0 [ 404.157752][T16124] Node 1 DMA32 free:85060kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0kB free_highatomic:0kB active_anon:30340kB inactive_anon:1188kB active_file:34964kB inactive_file:78636kB unevictable:2000kB writepending:1728kB zspages:3116kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:46780kB local_pcp:12804kB free_cma:0kB [ 404.157803][T16124] lowmem_reserve[]: 0 0 0 0 0 [ 404.157830][T16124] Node 0 DMA: 61*4kB (UM) 30*8kB (UM) 9*16kB (UM) 27*32kB (UM) 8*64kB (UM) 3*128kB (UM) 1*256kB (M) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 3156kB [ 404.157949][T16124] Node 0 DMA32: 248*4kB (UME) 295*8kB (UME) 139*16kB (UME) 212*32kB (UME) 56*64kB (UME) 16*128kB (UE) [ 404.158027][T16124] 6*256kB (UME) 2*512kB (M) 0*1024kB 0*2048kB [ 404.158061][T16124] 0*4096kB = 20552kB [ 404.158076][T16124] Node 1 DMA32: 1992*4kB (UM) 1421*8kB (UME) 599*16kB (UME) 153*32kB (UME) 231*64kB (UME) 119*128kB (UME) 42*256kB (UME) 11*512kB (UM) 5*1024kB (M) 0*2048kB 0*4096kB = 85336kB [ 404.158204][T16124] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 404.158219][T16124] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 404.158233][T16124] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 404.158246][T16124] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 404.158261][T16124] 30653 total pagecache pages [ 404.158319][T16124] 331 pages in swap cache [ 404.158327][T16124] Free swap = 119064kB [ 404.158335][T16124] Total swap = 124996kB [ 404.158344][T16124] 524155 pages RAM [ 404.158358][T16124] 0 pages HighMem/MovableOnly [ 404.158365][T16124] 212048 pages reserved [ 404.158372][T16124] 0 pages cma reserved [ 404.258480][ T9446] net_ratelimit: 228 callbacks suppressed [ 404.323587][ T1038] usb 12-1: USB disconnect, device number 12 [ 404.677109][ T5751] Bluetooth: hci0: command 0x0c1a tx timeout [ 404.896908][T16148] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3408'. [ 405.508232][T16172] netlink: 16402 bytes leftover after parsing attributes in process `syz.9.3415'. [ 405.696299][ T5819] usb 12-1: new high-speed USB device number 13 using dummy_hcd [ 405.857885][ T5819] usb 12-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 405.859778][ T5819] usb 12-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 405.859810][ T5819] usb 12-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 405.859852][ T5819] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 406.043969][ T1038] usb 13-1: USB disconnect, device number 18 [ 406.216667][ T5819] usb 12-1: USB disconnect, device number 13 [ 406.350457][T14397] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 406.356579][T14397] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 406.362734][T14397] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 406.365614][T14397] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 406.374144][T14397] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 406.488771][T16187] bond0: (slave syz_tun): Releasing backup interface [ 406.637862][ T10] usb 14-1: new high-speed USB device number 15 using dummy_hcd [ 406.746517][ T5751] Bluetooth: hci0: command 0x0c1a tx timeout [ 406.780634][T16212] VFS: file-max limit 0 reached [ 406.787195][ T10] usb 14-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 406.788212][ T10] usb 14-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 406.788233][ T10] usb 14-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 406.790271][ T10] usb 14-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.790288][ T10] usb 14-1: Product: syz [ 406.790300][ T10] usb 14-1: Manufacturer: syz [ 406.790312][ T10] usb 14-1: SerialNumber: syz [ 406.800127][ T10] usb 14-1: NFC: intf ffff888072386000 id ffffffff8fe951a0 [ 406.825339][ T10] nfcmrvl 14-1:1.0: NFC: registered with nci successfully [ 406.835404][ T5817] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 406.985514][ T5817] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 407.005694][ T12] nfcmrvl 14-1:1.0: NFC: send entry, len 4 [ 407.005749][ T12] usb 14-1: NFC: urb ffff88802a44e400 submission failed (90) [ 407.059143][T16221] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 407.060504][T16221] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 407.086379][ T5887] usb 12-1: new high-speed USB device number 14 using dummy_hcd [ 407.099812][ T5817] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 407.183700][ T5817] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 407.237975][ T5887] usb 12-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice= 1.00 [ 407.241756][ T5887] usb 12-1: config 1 interface 1 altsetting 1 bulk endpoint 0x1 has invalid maxpacket 64 [ 407.241772][ T5887] usb 12-1: config 1 interface 1 altsetting 1 bulk endpoint 0x81 has invalid maxpacket 64 [ 407.243778][ T5887] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 407.243788][ T5887] usb 12-1: Product: syz [ 407.243796][ T5887] usb 12-1: Manufacturer: syz [ 407.329374][T16195] bridge0: port 1(bridge_slave_0) entered blocking state [ 407.329452][T16195] bridge0: port 1(bridge_slave_0) entered disabled state [ 407.329660][T16195] bridge_slave_0: entered allmulticast mode [ 407.330856][T16195] bridge_slave_0: entered promiscuous mode [ 407.339065][T16195] bridge0: port 2(bridge_slave_1) entered blocking state [ 407.340676][T16195] bridge0: port 2(bridge_slave_1) entered disabled state [ 407.340776][T16195] bridge_slave_1: entered allmulticast mode [ 407.341620][T16195] bridge_slave_1: entered promiscuous mode [ 407.470653][T16218] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 407.470758][T16218] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 407.481070][T16195] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 407.488888][T16195] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 407.511270][ T5887] dvb_ttusb_budget: ttusb_init_controller: error [ 407.514309][ T5887] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 407.591990][ T5887] DVB: Unable to find symbol cx22700_attach() [ 407.610990][T16195] team0: Port device team_slave_0 added [ 407.625498][T16195] team0: Port device team_slave_1 added [ 407.635980][ T5887] DVB: Unable to find symbol tda10046_attach() [ 407.635984][ T5887] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 407.679704][ T5817] bridge_slave_1: left allmulticast mode [ 407.679715][ T5817] bridge_slave_1: left promiscuous mode [ 407.679822][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 407.682779][ T5817] bridge_slave_0: left allmulticast mode [ 407.682791][ T5817] bridge_slave_0: left promiscuous mode [ 407.682888][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 407.730189][T16238] dvb_ttusb_budget: failed urb submission (0: err = -90)! [ 407.739471][T16238] dvb_ttusb_budget: failed urb submission (0: err = -90)! [ 407.744748][ T1038] usb 12-1: USB disconnect, device number 14 [ 407.954047][ T5817] bond1 (unregistering): (slave bridge1): Releasing active interface [ 407.972205][ T5817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 407.974305][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 407.975621][ T5817] bond0 (unregistering): Released all slaves [ 407.981148][ T5817] bond1 (unregistering): Released all slaves [ 407.991048][T16195] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 407.991054][T16195] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 407.991067][T16195] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 407.995643][T16195] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 407.995652][T16195] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 407.995670][T16195] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 408.000001][T16237] netlink: 16402 bytes leftover after parsing attributes in process `syz.8.3429'. [ 408.080945][ T5817] ovs-dp0: left promiscuous mode [ 408.129414][T16195] hsr_slave_0: entered promiscuous mode [ 408.130495][T16195] hsr_slave_1: entered promiscuous mode [ 408.131330][T16195] debugfs: 'hsr0' already exists in 'hsr' [ 408.131345][T16195] Cannot create hsr debugfs directory [ 408.161357][ T5817] tipc: Disabling bearer [ 408.165145][ T5817] tipc: Left network mode [ 408.506332][ T5751] Bluetooth: hci2: command tx timeout [ 408.612618][ T5817] hsr_slave_0: left promiscuous mode [ 408.615353][ T5817] hsr_slave_1: left promiscuous mode [ 408.616311][ T5817] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 408.616329][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 408.619603][ T5817] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 408.619616][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 408.644348][ T5817] veth1_macvtap: left promiscuous mode [ 408.644400][ T5817] veth0_macvtap: left promiscuous mode [ 408.644517][ T5817] veth1_vlan: left promiscuous mode [ 408.644560][ T5817] veth0_vlan: left promiscuous mode [ 408.736392][ T5819] usb 12-1: new high-speed USB device number 15 using dummy_hcd [ 409.129335][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 409.143666][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 409.386282][ C2] net_ratelimit: 281 callbacks suppressed [ 409.390233][T16199] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 409.530860][ T5887] usb 14-1: USB disconnect, device number 15 [ 409.549128][ T5887] usb 14-1: NFC: intf ffff888072386000 [ 409.617632][ T5455] 8021q: adding VLAN 0 to HW filter on device eth22 [ 409.848632][ T5819] usb 12-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 409.872901][ T5819] usb 12-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 409.872924][ T5819] usb 12-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 409.872968][ T5819] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.308474][ T5819] usb 12-1: USB disconnect, device number 15 [ 410.384693][T16266] netlink: 'syz.8.3435': attribute type 1 has an invalid length. [ 410.569482][T16271] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3435'. [ 410.596383][ T5751] Bluetooth: hci2: command tx timeout [ 410.642426][ T5817] IPVS: stop unused estimator thread 0... [ 410.739209][T16278] FAULT_INJECTION: forcing a failure. [ 410.739209][T16278] name failslab, interval 1, probability 0, space 0, times 0 [ 410.739242][T16278] CPU: 1 UID: 0 PID: 16278 Comm: syz.9.3436 Tainted: G L syzkaller #0 PREEMPT(full) [ 410.739268][T16278] Tainted: [L]=SOFTLOCKUP [ 410.739276][T16278] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 410.739288][T16278] Call Trace: [ 410.739294][T16278] [ 410.739302][T16278] dump_stack_lvl+0x100/0x190 [ 410.739333][T16278] should_fail_ex.cold+0x5/0xa [ 410.739359][T16278] should_failslab+0xc2/0x120 [ 410.739388][T16278] __kmalloc_noprof+0xfc/0x840 [ 410.739411][T16278] ? __vb2_queue_alloc+0x23e/0x1160 [ 410.739442][T16278] __vb2_queue_alloc+0x23e/0x1160 [ 410.739483][T16278] vb2_core_reqbufs+0x899/0xf30 [ 410.739517][T16278] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 410.739545][T16278] ? rcu_is_watching+0x13/0xc0 [ 410.739569][T16278] ? __mutex_lock+0x26c/0x1bd0 [ 410.739592][T16278] ? __video_do_ioctl+0x50f/0xdf0 [ 410.739618][T16278] vb2_ioctl_reqbufs+0x291/0x450 [ 410.739644][T16278] ? __pfx_vb2_ioctl_reqbufs+0x10/0x10 [ 410.739675][T16278] vidioc_reqbufs+0x86/0x100 [ 410.739704][T16278] v4l_reqbufs+0x175/0x1d0 [ 410.739732][T16278] __video_do_ioctl+0xb2a/0xdf0 [ 410.739754][T16278] ? __might_fault+0xc5/0x140 [ 410.739772][T16278] ? __pfx___video_do_ioctl+0x10/0x10 [ 410.739801][T16278] video_usercopy+0x3d3/0x14c0 [ 410.739822][T16278] ? __pfx___video_do_ioctl+0x10/0x10 [ 410.739845][T16278] ? __pfx_video_usercopy+0x10/0x10 [ 410.739874][T16278] ? __fget_files+0x215/0x3d0 [ 410.739897][T16278] ? hook_file_ioctl_common+0x140/0x440 [ 410.739925][T16278] v4l2_ioctl+0x1bd/0x250 [ 410.739951][T16278] v4l2_compat_ioctl32+0x20f/0x2d0 [ 410.739979][T16278] ? __pfx_v4l2_compat_ioctl32+0x10/0x10 [ 410.740010][T16278] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 410.740032][T16278] __do_fast_syscall_32+0x13a/0x8b0 [ 410.740059][T16278] do_fast_syscall_32+0x32/0x70 [ 410.740080][T16278] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 410.740103][T16278] RIP: 0023:0xf701efec [ 410.740124][T16278] Code: Unable to access opcode bytes at 0xf701efc2. [ 410.740133][T16278] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 410.740153][T16278] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000c0145608 [ 410.740167][T16278] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 410.740186][T16278] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 410.740198][T16278] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 410.740211][T16278] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 410.740236][T16278] [ 410.816898][ T5819] usb 13-1: new high-speed USB device number 19 using dummy_hcd [ 410.845625][T16195] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 410.853788][T16195] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 410.854404][T16195] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 410.862233][T16281] gadgetfs: bound to dummy_udc driver [ 410.863651][T16195] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 410.864375][T16195] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 410.879831][T16195] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 410.880314][T16195] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 410.894611][T16195] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 410.962989][T16195] 8021q: adding VLAN 0 to HW filter on device bond0 [ 410.966305][ T5819] usb 13-1: Using ep0 maxpacket: 8 [ 410.967129][ T5819] usb 13-1: New USB device found, idVendor=0582, idProduct=e6ca, bcdDevice=d3.0b [ 410.968056][ T5819] usb 13-1: config 3 has an invalid interface number: 45 but max is 0 [ 410.968075][ T5819] usb 13-1: config 3 contains an unexpected descriptor of type 0x1, skipping [ 410.968090][ T5819] usb 13-1: config 3 has no interface number 0 [ 410.968150][ T5819] usb 13-1: config 3 interface 45 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 410.968170][ T5819] usb 13-1: config 3 interface 45 has no altsetting 0 [ 410.970809][ T5819] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 410.970825][ T5819] usb 13-1: Product: syz [ 410.970837][ T5819] usb 13-1: Manufacturer: syz [ 410.970849][ T5819] usb 13-1: SerialNumber: syz [ 410.982642][T16195] 8021q: adding VLAN 0 to HW filter on device team0 [ 410.991720][ T1164] bridge0: port 1(bridge_slave_0) entered blocking state [ 410.991801][ T1164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 411.003983][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state [ 411.004026][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 411.262836][T16195] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 411.263526][ T5819] usb 13-1: Quirk or no altset; falling back to MIDI 1.0 [ 411.324808][ T5819] usb 13-1: USB disconnect, device number 19 [ 411.375421][T12622] udevd[12622]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb13/13-1/13-1:3.45/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 411.426386][T16195] veth0_vlan: entered promiscuous mode [ 411.432418][T16195] veth1_vlan: entered promiscuous mode [ 411.449575][T16195] veth0_macvtap: entered promiscuous mode [ 411.453028][T16195] veth1_macvtap: entered promiscuous mode [ 411.464663][T16195] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 411.469790][T16195] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 411.516433][ T5818] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.516472][ T5818] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.516503][ T5818] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.516532][ T5818] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.552672][ T55] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 411.552687][ T55] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 411.573973][ T1164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 411.573991][ T1164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 411.628596][T16313] netlink: 'syz.5.3420': attribute type 7 has an invalid length. [ 411.848988][T16317] jffs2: notice: (16317) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 412.666419][ T5751] Bluetooth: hci2: command tx timeout [ 412.715494][T16328] syzkaller1: entered promiscuous mode [ 412.715510][T16328] syzkaller1: entered allmulticast mode [ 412.997519][T16340] FAULT_INJECTION: forcing a failure. [ 412.997519][T16340] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 412.997541][T16340] CPU: 0 UID: 0 PID: 16340 Comm: syz.8.3450 Tainted: G L syzkaller #0 PREEMPT(full) [ 412.997557][T16340] Tainted: [L]=SOFTLOCKUP [ 412.997561][T16340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 412.997569][T16340] Call Trace: [ 412.997573][T16340] [ 412.997577][T16340] dump_stack_lvl+0x100/0x190 [ 412.997596][T16340] should_fail_ex.cold+0x5/0xa [ 412.997612][T16340] _copy_from_iter+0x1f4/0x1690 [ 412.997630][T16340] ? __asan_memset+0x23/0x50 [ 412.997643][T16340] ? __pfx__copy_from_iter+0x10/0x10 [ 412.997658][T16340] ? __pfx___alloc_skb+0x10/0x10 [ 412.997680][T16340] netlink_sendmsg+0x808/0xda0 [ 412.997698][T16340] ? __pfx_netlink_sendmsg+0x10/0x10 [ 412.997715][T16340] ? apparmor_socket_sendmsg+0x165/0x280 [ 412.997734][T16340] ____sys_sendmsg+0xa4d/0xbe0 [ 412.997746][T16340] ? __pfx_netlink_sendmsg+0x10/0x10 [ 412.997763][T16340] ? __pfx_____sys_sendmsg+0x10/0x10 [ 412.997781][T16340] ___sys_sendmsg+0x190/0x1e0 [ 412.997796][T16340] ? __pfx____sys_sendmsg+0x10/0x10 [ 412.997823][T16340] ? find_held_lock+0x2b/0x80 [ 412.997855][T16340] __sys_sendmsg+0x160/0x210 [ 412.997891][T16340] ? __pfx___sys_sendmsg+0x10/0x10 [ 412.997926][T16340] ? __pfx_ksys_write+0x10/0x10 [ 412.997947][T16340] __do_fast_syscall_32+0x13a/0x8b0 [ 412.997961][T16340] ? lockdep_hardirqs_on+0x7d/0x110 [ 412.997974][T16340] do_fast_syscall_32+0x32/0x70 [ 412.997986][T16340] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 412.998000][T16340] RIP: 0023:0xf7f28fec [ 412.998015][T16340] Code: Unable to access opcode bytes at 0xf7f28fc2. [ 412.998021][T16340] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 412.998032][T16340] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000040 [ 412.998039][T16340] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 412.998046][T16340] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 412.998053][T16340] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 412.998060][T16340] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 412.998073][T16340] [ 414.111657][T16361] FAULT_INJECTION: forcing a failure. [ 414.111657][T16361] name failslab, interval 1, probability 0, space 0, times 0 [ 414.111690][T16361] CPU: 2 UID: 0 PID: 16361 Comm: syz.5.3458 Tainted: G L syzkaller #0 PREEMPT(full) [ 414.111708][T16361] Tainted: [L]=SOFTLOCKUP [ 414.111713][T16361] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 414.111721][T16361] Call Trace: [ 414.111726][T16361] [ 414.111731][T16361] dump_stack_lvl+0x100/0x190 [ 414.111751][T16361] should_fail_ex.cold+0x5/0xa [ 414.111793][T16361] should_failslab+0xc2/0x120 [ 414.111812][T16361] __kmalloc_noprof+0xfc/0x840 [ 414.111827][T16361] ? __vb2_queue_alloc+0x23e/0x1160 [ 414.111848][T16361] __vb2_queue_alloc+0x23e/0x1160 [ 414.111871][T16361] vb2_core_reqbufs+0x899/0xf30 [ 414.111890][T16361] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 414.111907][T16361] ? rcu_is_watching+0x13/0xc0 [ 414.111921][T16361] ? __mutex_lock+0x26c/0x1bd0 [ 414.111934][T16361] ? __video_do_ioctl+0x50f/0xdf0 [ 414.111948][T16361] vb2_ioctl_reqbufs+0x291/0x450 [ 414.111963][T16361] ? __pfx_vb2_ioctl_reqbufs+0x10/0x10 [ 414.111988][T16361] vidioc_reqbufs+0x86/0x100 [ 414.112007][T16361] v4l_reqbufs+0x175/0x1d0 [ 414.112025][T16361] __video_do_ioctl+0xb2a/0xdf0 [ 414.112038][T16361] ? __might_fault+0xc5/0x140 [ 414.112051][T16361] ? __pfx___video_do_ioctl+0x10/0x10 [ 414.112077][T16361] video_usercopy+0x3d3/0x14c0 [ 414.112094][T16361] ? __pfx___video_do_ioctl+0x10/0x10 [ 414.112112][T16361] ? __pfx_video_usercopy+0x10/0x10 [ 414.112136][T16361] ? __fget_files+0x215/0x3d0 [ 414.112155][T16361] ? hook_file_ioctl_common+0x140/0x440 [ 414.112177][T16361] v4l2_ioctl+0x1bd/0x250 [ 414.112194][T16361] v4l2_compat_ioctl32+0x20f/0x2d0 [ 414.112212][T16361] ? __pfx_v4l2_compat_ioctl32+0x10/0x10 [ 414.112231][T16361] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 414.112250][T16361] __do_fast_syscall_32+0x13a/0x8b0 [ 414.112272][T16361] do_fast_syscall_32+0x32/0x70 [ 414.112290][T16361] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 414.112313][T16361] RIP: 0023:0xf700efec [ 414.112330][T16361] Code: Unable to access opcode bytes at 0xf700efc2. [ 414.112336][T16361] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 414.112348][T16361] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000c0145608 [ 414.112356][T16361] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 414.112363][T16361] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 414.112370][T16361] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 414.112377][T16361] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 414.112392][T16361] [ 414.355855][T16355] bond0: invalid ARP target specified [ 414.586234][ C0] net_ratelimit: 363 callbacks suppressed [ 414.686442][ T9786] usb 14-1: new high-speed USB device number 16 using dummy_hcd [ 414.756289][ T5751] Bluetooth: hci2: command tx timeout [ 414.836748][T16382] FAULT_INJECTION: forcing a failure. [ 414.836748][T16382] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 414.836772][T16382] CPU: 2 UID: 0 PID: 16382 Comm: syz.8.3467 Tainted: G L syzkaller #0 PREEMPT(full) [ 414.836800][T16382] Tainted: [L]=SOFTLOCKUP [ 414.836805][T16382] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 414.836812][T16382] Call Trace: [ 414.836816][T16382] [ 414.836821][T16382] dump_stack_lvl+0x100/0x190 [ 414.836840][T16382] should_fail_ex.cold+0x5/0xa [ 414.836856][T16382] _copy_from_user+0x2e/0xd0 [ 414.836872][T16382] ia32_restore_sigcontext+0xc5/0x620 [ 414.836884][T16382] ? __pfx_ia32_restore_sigcontext+0x10/0x10 [ 414.836899][T16382] ? rcu_is_watching+0x13/0xc0 [ 414.836911][T16382] ? _raw_spin_unlock_irq+0x23/0x50 [ 414.836929][T16382] ? lockdep_hardirqs_on+0x7d/0x110 [ 414.836943][T16382] __do_compat_sys_rt_sigreturn+0x18c/0x270 [ 414.836955][T16382] ? __pfx___ia32_compat_sys_rt_sigreturn+0x10/0x10 [ 414.836971][T16382] do_int80_emulation+0x166/0x650 [ 414.836986][T16382] asm_int80_emulation+0x1a/0x20 [ 414.836997][T16382] RIP: 0023:0xf7f29017 [ 414.837006][T16382] Code: 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 77 00 00 00 cd 80 0f 0b 90 2e 8d 74 26 00 b8 ad 00 00 00 cd 80 <0f> 0b 90 90 90 90 90 90 90 55 31 c9 89 e5 57 8b 45 0c 8b 55 10 8b [ 414.837017][T16382] RSP: 002b:00000000f53e5880 EFLAGS: 00000282 ORIG_RAX: 00000000000000ad [ 414.837029][T16382] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f53e590c [ 414.837036][T16382] RDX: 00000000f53e588c RSI: 0000000000000000 RDI: 0000000000000000 [ 414.837043][T16382] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 414.837053][T16382] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 414.837060][T16382] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 414.837074][T16382] [ 414.838664][ T9786] usb 14-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 414.839508][ T9786] usb 14-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 414.839522][ T9786] usb 14-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 414.841087][ T9786] usb 14-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.841097][ T9786] usb 14-1: Product: syz [ 414.841104][ T9786] usb 14-1: Manufacturer: syz [ 414.841112][ T9786] usb 14-1: SerialNumber: syz [ 414.847989][ T9786] usb 14-1: NFC: intf ffff888014577000 id ffffffff8fe951a0 [ 414.874160][ T9786] nfcmrvl 14-1:1.0: NFC: registered with nci successfully [ 415.068911][ T5818] nfcmrvl 14-1:1.0: NFC: send entry, len 4 [ 415.068976][ T5818] usb 14-1: NFC: urb ffff88802af54e00 submission failed (90) [ 415.119272][T16394] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.121021][T16394] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 417.425169][T16376] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 417.461189][ T9] usb 14-1: USB disconnect, device number 16 [ 417.473819][ T9] usb 14-1: NFC: intf ffff888014577000 [ 417.541339][T16414] netlink: 72 bytes leftover after parsing attributes in process `syz.8.3477'. [ 417.991800][T16427] netlink: 72 bytes leftover after parsing attributes in process `syz.5.3482'. [ 417.996452][ T1159] IPVS: starting estimator thread 0... [ 418.106494][T16431] IPVS: using max 42 ests per chain, 100800 per kthread [ 418.598875][T16442] syzkaller0: entered promiscuous mode [ 418.598890][T16442] syzkaller0: entered allmulticast mode [ 418.607742][T16442] tipc: Started in network mode [ 418.607765][T16442] tipc: Node identity da7537096657, cluster identity 4711 [ 418.607912][T16442] tipc: Enabled bearer , priority 0 [ 418.621235][T16442] tipc: Resetting bearer [ 418.655558][T16440] tipc: Resetting bearer [ 418.673009][T16440] tipc: Disabling bearer [ 419.117249][T16463] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3496'. [ 419.216464][ T1040] usb 14-1: new full-speed USB device number 17 using dummy_hcd [ 419.266834][T16468] netlink: 84 bytes leftover after parsing attributes in process `syz.8.3497'. [ 419.346278][ T1040] usb 14-1: device descriptor read/64, error -71 [ 419.606406][ T1040] usb 14-1: new full-speed USB device number 18 using dummy_hcd [ 419.736314][ T1040] usb 14-1: device descriptor read/64, error -71 [ 419.861237][ T1040] usb usb14-port1: attempt power cycle [ 419.876215][ C1] net_ratelimit: 190 callbacks suppressed [ 419.970720][T16482] FAULT_INJECTION: forcing a failure. [ 419.970720][T16482] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 419.970740][T16482] CPU: 3 UID: 0 PID: 16482 Comm: syz.5.3504 Tainted: G L syzkaller #0 PREEMPT(full) [ 419.970755][T16482] Tainted: [L]=SOFTLOCKUP [ 419.970760][T16482] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 419.970766][T16482] Call Trace: [ 419.970771][T16482] [ 419.970776][T16482] dump_stack_lvl+0x100/0x190 [ 419.970794][T16482] should_fail_ex.cold+0x5/0xa [ 419.970810][T16482] _copy_from_user+0x2e/0xd0 [ 419.970826][T16482] do_tcp_setsockopt+0x223f/0x2b50 [ 419.970856][T16482] ? __pfx_do_tcp_setsockopt+0x10/0x10 [ 419.970873][T16482] ? __lock_acquire+0x5c0/0x1f40 [ 419.970896][T16482] ? lock_acquire+0x1d1/0x380 [ 419.970911][T16482] ? __fget_files+0x34/0x3d0 [ 419.970925][T16482] ? find_held_lock+0x2b/0x80 [ 419.970940][T16482] tcp_setsockopt+0xe2/0x100 [ 419.970955][T16482] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 419.970969][T16482] do_sock_setsockopt+0xf3/0x1d0 [ 419.970983][T16482] __sys_setsockopt+0x119/0x190 [ 419.971001][T16482] __ia32_sys_setsockopt+0xbc/0x160 [ 419.971017][T16482] ? __do_fast_syscall_32+0xb3/0x8b0 [ 419.971030][T16482] ? lockdep_hardirqs_on+0x7d/0x110 [ 419.971042][T16482] __do_fast_syscall_32+0x13a/0x8b0 [ 419.971054][T16482] ? lockdep_hardirqs_on+0x7d/0x110 [ 419.971066][T16482] do_fast_syscall_32+0x32/0x70 [ 419.971079][T16482] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 419.971094][T16482] RIP: 0023:0xf700efec [ 419.971129][T16482] Code: Unable to access opcode bytes at 0xf700efc2. [ 419.971135][T16482] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 419.971146][T16482] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000006 [ 419.971153][T16482] RDX: 0000000000000016 RSI: 0000000080000340 RDI: 0000000000000219 [ 419.971160][T16482] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 419.971166][T16482] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 419.971173][T16482] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 419.971187][T16482] [ 420.217527][ T1040] usb 14-1: new full-speed USB device number 19 using dummy_hcd [ 420.238111][ T1040] usb 14-1: device descriptor read/8, error -71 [ 420.318520][T16495] overlayfs: missing 'workdir' [ 420.496299][ T1040] usb 14-1: new full-speed USB device number 20 using dummy_hcd [ 420.516829][ T1040] usb 14-1: device descriptor read/8, error -71 [ 420.557278][T16500] FAULT_INJECTION: forcing a failure. [ 420.557278][T16500] name failslab, interval 1, probability 0, space 0, times 0 [ 420.557311][T16500] CPU: 3 UID: 0 PID: 16500 Comm: syz.8.3511 Tainted: G L syzkaller #0 PREEMPT(full) [ 420.557337][T16500] Tainted: [L]=SOFTLOCKUP [ 420.557345][T16500] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 420.557355][T16500] Call Trace: [ 420.557361][T16500] [ 420.557370][T16500] dump_stack_lvl+0x100/0x190 [ 420.557403][T16500] should_fail_ex.cold+0x5/0xa [ 420.557429][T16500] should_failslab+0xc2/0x120 [ 420.557456][T16500] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 420.557480][T16500] ? find_held_lock+0x2b/0x80 [ 420.557500][T16500] ? sock_alloc_inode+0x26/0x2c0 [ 420.557522][T16500] ? __pfx_sock_alloc_inode+0x10/0x10 [ 420.557543][T16500] sock_alloc_inode+0x26/0x2c0 [ 420.557562][T16500] ? __pfx_sock_alloc_inode+0x10/0x10 [ 420.557581][T16500] alloc_inode+0x68/0x250 [ 420.557608][T16500] sock_alloc+0x44/0x280 [ 420.557644][T16500] ? security_socket_create+0x7f/0x250 [ 420.557678][T16500] __sock_create+0xc2/0x860 [ 420.557705][T16500] __sys_socket+0x14d/0x260 [ 420.557726][T16500] ? xfd_validate_state+0x129/0x190 [ 420.557756][T16500] ? __pfx___sys_socket+0x10/0x10 [ 420.557787][T16500] __ia32_sys_socket+0x72/0xb0 [ 420.557809][T16500] ? lockdep_hardirqs_on+0x7d/0x110 [ 420.557828][T16500] __do_fast_syscall_32+0x13a/0x8b0 [ 420.557852][T16500] do_fast_syscall_32+0x32/0x70 [ 420.557873][T16500] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 420.557897][T16500] RIP: 0023:0xf7f28fec [ 420.557918][T16500] Code: Unable to access opcode bytes at 0xf7f28fc2. [ 420.557927][T16500] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 420.557945][T16500] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000000080805 [ 420.557959][T16500] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 420.557969][T16500] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 420.557980][T16500] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 420.557993][T16500] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 420.558017][T16500] [ 420.639010][ T1040] usb usb14-port1: unable to enumerate USB device [ 420.841692][ T43] kauditd_printk_skb: 92 callbacks suppressed [ 420.841792][ T43] audit: type=1326 audit(1790214031.933:197): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16505 comm="syz.7.3513" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 420.843384][ T43] audit: type=1326 audit(1790214031.933:198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16505 comm="syz.7.3513" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 420.851932][ T43] audit: type=1326 audit(1790214031.943:199): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16505 comm="syz.7.3513" exe="/syz-executor" sig=0 arch=40000003 syscall=298 compat=1 ip=0xf703efec code=0x7ffc0000 [ 420.852581][ T43] audit: type=1326 audit(1790214031.943:200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16505 comm="syz.7.3513" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 420.854321][ T43] audit: type=1326 audit(1790214031.943:201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16505 comm="syz.7.3513" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 420.860654][ T43] audit: type=1326 audit(1790214031.953:202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16505 comm="syz.7.3513" exe="/syz-executor" sig=0 arch=40000003 syscall=224 compat=1 ip=0xf703efec code=0x7ffc0000 [ 420.861396][ T43] audit: type=1326 audit(1790214031.953:203): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16505 comm="syz.7.3513" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 420.863359][ T43] audit: type=1326 audit(1790214031.953:204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16505 comm="syz.7.3513" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 420.872564][ T43] audit: type=1326 audit(1790214031.963:205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16505 comm="syz.7.3513" exe="/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf703efec code=0x7ffc0000 [ 420.873938][ T43] audit: type=1326 audit(1790214031.963:206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16505 comm="syz.7.3513" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 422.112858][T16524] FAULT_INJECTION: forcing a failure. [ 422.112858][T16524] name failslab, interval 1, probability 0, space 0, times 0 [ 422.112890][T16524] CPU: 3 UID: 0 PID: 16524 Comm: syz.5.3519 Tainted: G L syzkaller #0 PREEMPT(full) [ 422.112915][T16524] Tainted: [L]=SOFTLOCKUP [ 422.112922][T16524] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 422.112934][T16524] Call Trace: [ 422.112941][T16524] [ 422.112948][T16524] dump_stack_lvl+0x100/0x190 [ 422.112979][T16524] should_fail_ex.cold+0x5/0xa [ 422.113006][T16524] should_failslab+0xc2/0x120 [ 422.113032][T16524] kmem_cache_alloc_noprof+0x92/0x6a0 [ 422.113054][T16524] ? llc_sap_find+0x268/0x440 [ 422.113076][T16524] ? llc_sap_find+0x27d/0x440 [ 422.113095][T16524] ? skb_clone+0x190/0x400 [ 422.113128][T16524] skb_clone+0x190/0x400 [ 422.113155][T16524] ? __pfx_llc_sap_handler+0x10/0x10 [ 422.113184][T16524] ? __pfx_stp_pdu_rcv+0x10/0x10 [ 422.113215][T16524] llc_rcv+0x525/0xcb0 [ 422.113241][T16524] ? __pfx_llc_rcv+0x10/0x10 [ 422.113261][T16524] __netif_receive_skb_one_core+0x1b2/0x1e0 [ 422.113288][T16524] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 422.113314][T16524] ? lock_acquire+0x1d1/0x380 [ 422.113365][T16524] __netif_receive_skb+0x1f/0x120 [ 422.113392][T16524] netif_receive_skb+0x139/0x7d0 [ 422.113415][T16524] ? __pfx_netif_receive_skb+0x10/0x10 [ 422.113446][T16524] tun_rx_batched.isra.0+0x3f6/0x750 [ 422.113475][T16524] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 422.113507][T16524] ? tun_get_user+0x1e1e/0x3cc0 [ 422.113540][T16524] tun_get_user+0x1f53/0x3cc0 [ 422.113573][T16524] ? __lock_acquire+0x5c0/0x1f40 [ 422.113599][T16524] ? __pfx_tun_get_user+0x10/0x10 [ 422.113623][T16524] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 422.113649][T16524] ? find_held_lock+0x2b/0x80 [ 422.113669][T16524] ? tun_get+0x191/0x370 [ 422.113692][T16524] ? tun_get+0x191/0x370 [ 422.113717][T16524] tun_chr_write_iter+0xdc/0x200 [ 422.113745][T16524] vfs_write+0x6af/0x1050 [ 422.113767][T16524] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 422.113794][T16524] ? __pfx_vfs_write+0x10/0x10 [ 422.113812][T16524] ? find_held_lock+0x2b/0x80 [ 422.113846][T16524] ksys_write+0x12a/0x250 [ 422.113867][T16524] ? __pfx_ksys_write+0x10/0x10 [ 422.113892][T16524] do_int80_emulation+0x166/0x650 [ 422.113917][T16524] asm_int80_emulation+0x1a/0x20 [ 422.113936][T16524] RIP: 0023:0xf71475ab [ 422.113950][T16524] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 422.113968][T16524] RSP: 002b:00000000f53fd44c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 422.113986][T16524] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000240 [ 422.113999][T16524] RDX: 0000000000000018 RSI: 0000000000000000 RDI: 0000000000000000 [ 422.114009][T16524] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 422.114018][T16524] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 422.114030][T16524] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 422.114052][T16524] [ 422.304159][T16542] FAULT_INJECTION: forcing a failure. [ 422.304159][T16542] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 422.304200][T16542] CPU: 0 UID: 0 PID: 16542 Comm: syz.5.3526 Tainted: G L syzkaller #0 PREEMPT(full) [ 422.304226][T16542] Tainted: [L]=SOFTLOCKUP [ 422.304233][T16542] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 422.304245][T16542] Call Trace: [ 422.304251][T16542] [ 422.304260][T16542] dump_stack_lvl+0x100/0x190 [ 422.304292][T16542] should_fail_ex.cold+0x5/0xa [ 422.304315][T16542] ? __pfx_sync_file_ioctl+0x10/0x10 [ 422.304344][T16542] _copy_to_user+0x32/0xd0 [ 422.304368][T16542] ? __pfx_sync_file_ioctl+0x10/0x10 [ 422.304396][T16542] sync_file_ioctl+0xb10/0xea0 [ 422.304428][T16542] ? __pfx_sync_file_ioctl+0x10/0x10 [ 422.304454][T16542] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 422.304483][T16542] ? do_vfs_ioctl+0x226/0x13e0 [ 422.304503][T16542] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 422.304526][T16542] ? __fget_files+0x34/0x3d0 [ 422.304548][T16542] ? find_held_lock+0x2b/0x80 [ 422.304569][T16542] ? __fget_files+0x215/0x3d0 [ 422.304589][T16542] ? hook_file_ioctl_common+0x140/0x440 [ 422.304613][T16542] ? __fget_files+0x21f/0x3d0 [ 422.304636][T16542] ? __pfx_sync_file_ioctl+0x10/0x10 [ 422.304664][T16542] compat_ptr_ioctl+0x6e/0xa0 [ 422.304682][T16542] ? __pfx_compat_ptr_ioctl+0x10/0x10 [ 422.304698][T16542] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 422.304722][T16542] __do_fast_syscall_32+0x13a/0x8b0 [ 422.304743][T16542] ? lockdep_hardirqs_on+0x7d/0x110 [ 422.304764][T16542] do_fast_syscall_32+0x32/0x70 [ 422.304785][T16542] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 422.304810][T16542] RIP: 0023:0xf700efec [ 422.304831][T16542] Code: Unable to access opcode bytes at 0xf700efc2. [ 422.304839][T16542] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 422.304857][T16542] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000c0383e04 [ 422.304869][T16542] RDX: 00000000800004c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 422.304880][T16542] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 422.304891][T16542] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 422.304902][T16542] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 422.304926][T16542] [ 422.417542][ T74] IPVS: starting estimator thread 0... [ 422.508773][T16549] IPVS: using max 29 ests per chain, 69600 per kthread [ 422.619635][T16551] ieee802154 phy0 wpan0: encryption failed: -126 [ 423.126558][T11180] usb 14-1: new high-speed USB device number 21 using dummy_hcd [ 423.266364][ T9] usb 13-1: new high-speed USB device number 20 using dummy_hcd [ 423.277099][T11180] usb 14-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 423.278082][T11180] usb 14-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 423.278105][T11180] usb 14-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 423.280851][T11180] usb 14-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.280868][T11180] usb 14-1: Product: syz [ 423.280880][T11180] usb 14-1: Manufacturer: syz [ 423.280894][T11180] usb 14-1: SerialNumber: syz [ 423.285980][T11180] usb 14-1: NFC: intf ffff88802a63c000 id ffffffff8fe951a0 [ 423.300363][T11180] nfcmrvl 14-1:1.0: NFC: registered with nci successfully [ 423.437354][ T9] usb 13-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 423.439454][ T9] usb 13-1: config 1 interface 1 altsetting 0 endpoint 0x3 has invalid maxpacket 44431, setting to 1024 [ 423.439477][ T9] usb 13-1: config 1 interface 1 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 423.439525][ T9] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.496141][ T13] nfcmrvl 14-1:1.0: NFC: send entry, len 4 [ 423.496374][ T13] usb 14-1: NFC: urb ffff888014448b00 submission failed (90) [ 423.549979][T16579] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 423.550563][T16579] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 423.660650][ T9] cdc_acm 13-1:1.0: ttyACM0: USB ACM device [ 424.110338][T16559] FAULT_INJECTION: forcing a failure. [ 424.110338][T16559] name failslab, interval 1, probability 0, space 0, times 0 [ 424.110365][T16559] CPU: 2 UID: 0 PID: 16559 Comm: syz.8.3532 Tainted: G L syzkaller #0 PREEMPT(full) [ 424.110390][T16559] Tainted: [L]=SOFTLOCKUP [ 424.110397][T16559] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 424.110408][T16559] Call Trace: [ 424.110415][T16559] [ 424.110423][T16559] dump_stack_lvl+0x100/0x190 [ 424.110470][T16559] should_fail_ex.cold+0x5/0xa [ 424.110491][T16559] ? do_raw_spin_lock+0x128/0x260 [ 424.110512][T16559] should_failslab+0xc2/0x120 [ 424.110538][T16559] __kmalloc_cache_noprof+0x91/0x6d0 [ 424.110556][T16559] ? rcu_is_watching+0x13/0xc0 [ 424.110576][T16559] ? dummy_urb_enqueue+0xa3/0x880 [ 424.110606][T16559] dummy_urb_enqueue+0xa3/0x880 [ 424.110629][T16559] ? usb_hcd_map_urb_for_dma+0x28a/0x1190 [ 424.110653][T16559] ? rpm_resume+0x7eb/0x1320 [ 424.110681][T16559] usb_hcd_submit_urb+0x268/0x2150 [ 424.110708][T16559] ? __pfx_rpm_resume+0x10/0x10 [ 424.110731][T16559] ? do_raw_spin_lock+0x128/0x260 [ 424.110752][T16559] usb_submit_urb+0x827/0x19b0 [ 424.110781][T16559] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 424.110809][T16559] acm_start_wb+0x1a8/0x300 [ 424.110829][T16559] acm_tty_write+0x328/0x4e0 [ 424.110853][T16559] tty_put_char+0x130/0x160 [ 424.110875][T16559] ? __pfx_tty_put_char+0x10/0x10 [ 424.110894][T16559] ? _raw_spin_unlock_irqrestore+0x59/0x80 [ 424.110920][T16559] ? lockdep_hardirqs_on+0x7d/0x110 [ 424.110936][T16559] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 424.110961][T16559] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 424.110986][T16559] do_output_char+0x155/0x850 [ 424.111014][T16559] n_tty_write+0x4d6/0x1160 [ 424.111041][T16559] ? __pfx_n_tty_write+0x10/0x10 [ 424.111056][T16559] ? __kasan_kmalloc+0xaa/0xb0 [ 424.111077][T16559] ? __pfx_woken_wake_function+0x10/0x10 [ 424.111137][T16559] ? rcu_is_watching+0x13/0xc0 [ 424.111156][T16559] ? file_tty_write.isra.0+0x694/0x890 [ 424.111180][T16559] ? kfree+0x1e5/0x6d0 [ 424.111198][T16559] ? __pfx_n_tty_write+0x10/0x10 [ 424.111217][T16559] file_tty_write.isra.0+0x4d2/0x890 [ 424.111248][T16559] vfs_write+0x6af/0x1050 [ 424.111269][T16559] ? __pfx_tty_write+0x10/0x10 [ 424.111296][T16559] ? __pfx_vfs_write+0x10/0x10 [ 424.111313][T16559] ? find_held_lock+0x2b/0x80 [ 424.111347][T16559] ksys_write+0x12a/0x250 [ 424.111365][T16559] ? __pfx_ksys_write+0x10/0x10 [ 424.111383][T16559] ? ksys_write+0x1ac/0x250 [ 424.111402][T16559] ? __pfx_ksys_write+0x10/0x10 [ 424.111426][T16559] __do_fast_syscall_32+0x13a/0x8b0 [ 424.111447][T16559] ? lockdep_hardirqs_on+0x7d/0x110 [ 424.111468][T16559] do_fast_syscall_32+0x32/0x70 [ 424.111487][T16559] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 424.111509][T16559] RIP: 0023:0xf7f28fec [ 424.111531][T16559] Code: Unable to access opcode bytes at 0xf7f28fc2. [ 424.111539][T16559] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 424.111556][T16559] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000440 [ 424.111567][T16559] RDX: 0000000000001006 RSI: 0000000000000000 RDI: 0000000000000000 [ 424.111580][T16559] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 424.111590][T16559] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 424.111601][T16559] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 424.111629][T16559] [ 424.111643][T16559] cdc_acm 13-1:1.1: acm_start_wb - usb_submit_urb(write bulk) failed: -12 [ 424.269794][T16590] FAULT_INJECTION: forcing a failure. [ 424.269794][T16590] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 424.269817][T16590] CPU: 2 UID: 0 PID: 16590 Comm: syz.7.3542 Tainted: G L syzkaller #0 PREEMPT(full) [ 424.269833][T16590] Tainted: [L]=SOFTLOCKUP [ 424.269837][T16590] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 424.269844][T16590] Call Trace: [ 424.269848][T16590] [ 424.269866][T16590] dump_stack_lvl+0x100/0x190 [ 424.269886][T16590] should_fail_ex.cold+0x5/0xa [ 424.269901][T16590] _copy_to_user+0x32/0xd0 [ 424.269918][T16590] simple_read_from_buffer+0xcb/0x170 [ 424.269934][T16590] proc_fail_nth_read+0x1af/0x230 [ 424.269947][T16590] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 424.269961][T16590] ? rw_verify_area+0xce/0x6d0 [ 424.269972][T16590] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 424.269984][T16590] vfs_read+0x1e4/0xb40 [ 424.269997][T16590] ? lock_acquire+0x1d1/0x380 [ 424.270013][T16590] ? __fget_files+0x34/0x3d0 [ 424.270027][T16590] ? __pfx_vfs_read+0x10/0x10 [ 424.270038][T16590] ? find_held_lock+0x2b/0x80 [ 424.270050][T16590] ? __fget_files+0x215/0x3d0 [ 424.270066][T16590] ? __fget_files+0x21f/0x3d0 [ 424.270083][T16590] ksys_read+0x12a/0x250 [ 424.270095][T16590] ? __pfx_ksys_read+0x10/0x10 [ 424.270111][T16590] do_int80_emulation+0x166/0x650 [ 424.270126][T16590] asm_int80_emulation+0x1a/0x20 [ 424.270138][T16590] RIP: 0023:0xf71775ab [ 424.270148][T16590] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 424.270159][T16590] RSP: 002b:00000000f542d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 424.270170][T16590] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f542d5d0 [ 424.270178][T16590] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 424.270185][T16590] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 424.270192][T16590] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 424.270198][T16590] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 424.270212][T16590] [ 424.671556][T16591] bond0: invalid ARP target specified [ 425.066221][ C2] net_ratelimit: 72 callbacks suppressed [ 425.888425][T16557] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 425.909044][T16072] usb 14-1: USB disconnect, device number 21 [ 425.910578][T16072] usb 14-1: NFC: intf ffff88802a63c000 [ 426.033251][T16607] netlink: 'syz.9.3547': attribute type 5 has an invalid length. [ 426.033268][T16607] netlink: 'syz.9.3547': attribute type 9 has an invalid length. [ 426.033277][T16607] netlink: 4 bytes leftover after parsing attributes in process `syz.9.3547'. [ 426.228902][T16614] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3550'. [ 426.243412][T16614] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 427.428735][T14397] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 427.446977][T14397] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 427.452741][T14397] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 427.455525][T14397] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 427.457655][T14397] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 427.723925][ T5817] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 427.813429][ T5817] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 427.926783][ T5817] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.027474][ T5817] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.053435][T16651] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3562'. [ 428.099153][T16653] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3563'. [ 428.132543][T16653] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3563'. [ 428.297575][ T5817] bridge_slave_1: left allmulticast mode [ 428.297589][ T5817] bridge_slave_1: left promiscuous mode [ 428.297690][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 428.301836][ T5817] bridge_slave_0: left allmulticast mode [ 428.301846][ T5817] bridge_slave_0: left promiscuous mode [ 428.301942][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 428.444408][ T5751] Bluetooth: hci0: unexpected event for opcode 0x204e [ 428.520578][ T5817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 428.523582][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 428.525227][ T5817] bond0 (unregistering): Released all slaves [ 428.614920][ T5817] ovs-dp0: left promiscuous mode [ 428.671211][ T5817] tipc: Disabling bearer [ 428.674699][ T5817] tipc: Left network mode [ 428.847158][T16633] bridge0: port 1(bridge_slave_0) entered blocking state [ 428.847232][T16633] bridge0: port 1(bridge_slave_0) entered disabled state [ 428.847324][T16633] bridge_slave_0: entered allmulticast mode [ 428.848312][T16633] bridge_slave_0: entered promiscuous mode [ 428.851949][ T5455] 8021q: adding VLAN 0 to HW filter on device eth22 [ 428.852248][T16633] bridge0: port 2(bridge_slave_1) entered blocking state [ 428.852315][T16633] bridge0: port 2(bridge_slave_1) entered disabled state [ 428.852391][T16633] bridge_slave_1: entered allmulticast mode [ 428.853133][T16633] bridge_slave_1: entered promiscuous mode [ 428.892056][T16633] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 428.894147][T16633] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 428.939471][T16633] team0: Port device team_slave_0 added [ 428.943009][T16633] team0: Port device team_slave_1 added [ 429.010493][T16633] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 429.010499][T16633] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 429.010512][T16633] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 429.012406][T16633] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 429.012412][T16633] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 429.012425][T16633] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 429.099764][ T5817] hsr_slave_0: left promiscuous mode [ 429.100576][ T5817] hsr_slave_1: left promiscuous mode [ 429.101761][ T5817] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 429.101771][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 429.119102][ T5817] veth1_macvtap: left promiscuous mode [ 429.119161][ T5817] veth0_macvtap: left promiscuous mode [ 429.119254][ T5817] veth1_vlan: left promiscuous mode [ 429.119396][ T5817] veth0_vlan: left promiscuous mode [ 429.300789][T16687] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 429.304716][T16689] mmap: syz.9.3570 (16689) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 429.320795][T16687] /dev/sg0: Can't lookup blockdev [ 429.350483][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 429.361335][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 429.388355][ T1040] usb 13-1: USB disconnect, device number 20 [ 429.440675][T16687] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3569'. [ 429.547206][ T5751] Bluetooth: hci1: command tx timeout [ 429.600115][T16633] hsr_slave_0: entered promiscuous mode [ 429.604292][T16633] hsr_slave_1: entered promiscuous mode [ 429.604715][T16633] debugfs: 'hsr0' already exists in 'hsr' [ 429.604725][T16633] Cannot create hsr debugfs directory [ 429.606145][ T5455] 8021q: adding VLAN 0 to HW filter on device eth23 [ 429.650311][T16687] ipvlan2: entered allmulticast mode [ 429.650325][T16687] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 429.651222][T16687] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 429.787317][T16701] ublk_ctrl_add_dev: dev id not match 4294967295 48 [ 430.121409][T16713] net_ratelimit: 123 callbacks suppressed [ 430.194901][T16715] netlink: 84 bytes leftover after parsing attributes in process `syz.9.3575'. [ 430.611582][ T5455] 8021q: adding VLAN 0 to HW filter on device eth24 [ 430.846318][ T1479] usb 13-1: new high-speed USB device number 21 using dummy_hcd [ 430.986975][ T1479] usb 13-1: device descriptor read/64, error -71 [ 431.236377][ T1479] usb 13-1: new high-speed USB device number 22 using dummy_hcd [ 431.377767][ T1479] usb 13-1: device descriptor read/64, error -71 [ 431.426558][ T5846] usb 14-1: new high-speed USB device number 22 using dummy_hcd [ 431.457963][T16633] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 431.463264][T16633] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 431.465602][T16633] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 431.477474][T16633] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 431.478292][T16633] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 431.484623][T16633] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 431.485631][T16633] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 431.486686][ T1479] usb usb13-port1: attempt power cycle [ 431.491416][T16633] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 431.553219][T16633] 8021q: adding VLAN 0 to HW filter on device bond0 [ 431.562642][T16633] 8021q: adding VLAN 0 to HW filter on device team0 [ 431.568604][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state [ 431.568670][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 431.574076][ T1167] bridge0: port 2(bridge_slave_1) entered blocking state [ 431.574120][ T1167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 431.587436][ T5846] usb 14-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 431.592332][ T5846] usb 14-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 431.592386][ T5846] usb 14-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.603100][ T5846] keyspan 14-1:1.0: Keyspan 2 port adapter converter detected [ 431.603281][ T5846] keyspan 14-1:1.0: found no endpoint descriptor for endpoint 81 [ 431.603341][ T5846] keyspan 14-1:1.0: found no endpoint descriptor for endpoint 1 [ 431.610317][ T5846] keyspan 14-1:1.0: found no endpoint descriptor for endpoint 84 [ 431.610388][ T5846] keyspan 14-1:1.0: found no endpoint descriptor for endpoint 2 [ 431.616201][ T5846] usb 14-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 431.618747][ T5846] keyspan 14-1:1.0: found no endpoint descriptor for endpoint 88 [ 431.618788][ T5846] keyspan 14-1:1.0: found no endpoint descriptor for endpoint 6 [ 431.622914][ T5846] usb 14-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 431.637423][ T5751] Bluetooth: hci1: command tx timeout [ 431.798524][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.798660][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.798760][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.798857][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.798955][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.799080][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.799181][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.799886][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.799989][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.800086][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.800183][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.800280][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.800387][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.800482][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.800582][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.800685][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.800782][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.800883][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.800983][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.801081][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.801182][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.801292][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.801396][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.801495][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.801594][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.801695][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.801793][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.801889][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.804635][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.804742][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.804855][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.804951][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.805058][T16763] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 431.837693][ T1479] usb 13-1: new high-speed USB device number 23 using dummy_hcd [ 431.858250][ T1479] usb 13-1: device descriptor read/8, error -71 [ 431.897097][T16633] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 431.971545][ T9446] usb 14-1: USB disconnect, device number 22 [ 431.973682][ T9446] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 431.978893][ T9446] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 431.980929][ T9446] keyspan 14-1:1.0: device disconnected [ 432.062262][T16633] veth0_vlan: entered promiscuous mode [ 432.066952][T16633] veth1_vlan: entered promiscuous mode [ 432.085958][T16633] veth0_macvtap: entered promiscuous mode [ 432.089431][T16633] veth1_macvtap: entered promiscuous mode [ 432.099466][T16633] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 432.105556][T16633] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 432.116303][ T1479] usb 13-1: new high-speed USB device number 24 using dummy_hcd [ 432.144587][ T1479] usb 13-1: device descriptor read/8, error -71 [ 432.154234][ T13] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.154700][ T13] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.154723][ T13] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.154741][ T13] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.209011][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 432.209023][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 432.244683][ T106] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 432.244698][ T106] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 432.258391][ T1479] usb usb13-port1: unable to enumerate USB device [ 432.282597][T16777] netlink: 72 bytes leftover after parsing attributes in process `syz.7.3557'. [ 432.513879][T16783] FAULT_INJECTION: forcing a failure. [ 432.513879][T16783] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 432.513909][T16783] CPU: 3 UID: 0 PID: 16783 Comm: syz.9.3584 Tainted: G L syzkaller #0 PREEMPT(full) [ 432.513933][T16783] Tainted: [L]=SOFTLOCKUP [ 432.513941][T16783] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 432.513951][T16783] Call Trace: [ 432.513958][T16783] [ 432.513965][T16783] dump_stack_lvl+0x100/0x190 [ 432.513994][T16783] should_fail_ex.cold+0x5/0xa [ 432.514020][T16783] _copy_to_user+0x32/0xd0 [ 432.514046][T16783] simple_read_from_buffer+0xcb/0x170 [ 432.514071][T16783] proc_fail_nth_read+0x1af/0x230 [ 432.514093][T16783] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 432.514114][T16783] ? rw_verify_area+0xce/0x6d0 [ 432.514133][T16783] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 432.514151][T16783] vfs_read+0x1e4/0xb40 [ 432.514172][T16783] ? lock_acquire+0x1d1/0x380 [ 432.514196][T16783] ? __fget_files+0x34/0x3d0 [ 432.514216][T16783] ? __pfx_vfs_read+0x10/0x10 [ 432.514234][T16783] ? find_held_lock+0x2b/0x80 [ 432.514252][T16783] ? __fget_files+0x215/0x3d0 [ 432.514277][T16783] ? __fget_files+0x21f/0x3d0 [ 432.514305][T16783] ksys_read+0x12a/0x250 [ 432.514323][T16783] ? __pfx_ksys_read+0x10/0x10 [ 432.514350][T16783] do_int80_emulation+0x166/0x650 [ 432.514374][T16783] asm_int80_emulation+0x1a/0x20 [ 432.514393][T16783] RIP: 0023:0xf71575ab [ 432.514408][T16783] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 432.514425][T16783] RSP: 002b:00000000f540d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 432.514442][T16783] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f540d5d0 [ 432.514455][T16783] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 432.514465][T16783] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 432.514474][T16783] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 432.514487][T16783] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 432.514510][T16783] [ 432.862039][T16793] netlink: 84 bytes leftover after parsing attributes in process `syz.9.3587'. [ 433.596747][ T9446] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 433.758629][T16806] FAULT_INJECTION: forcing a failure. [ 433.758629][T16806] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 433.758656][T16806] CPU: 0 UID: 0 PID: 16806 Comm: syz.7.3592 Tainted: G L syzkaller #0 PREEMPT(full) [ 433.758676][T16806] Tainted: [L]=SOFTLOCKUP [ 433.758681][T16806] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 433.758704][T16806] Call Trace: [ 433.758711][T16806] [ 433.758717][T16806] dump_stack_lvl+0x100/0x190 [ 433.758741][T16806] should_fail_ex.cold+0x5/0xa [ 433.758762][T16806] _copy_from_user+0x2e/0xd0 [ 433.758783][T16806] do_tcp_setsockopt+0x223f/0x2b50 [ 433.758806][T16806] ? __pfx_do_tcp_setsockopt+0x10/0x10 [ 433.758827][T16806] ? __lock_acquire+0x5c0/0x1f40 [ 433.758856][T16806] ? lock_acquire+0x1d1/0x380 [ 433.758876][T16806] ? __fget_files+0x34/0x3d0 [ 433.758893][T16806] ? find_held_lock+0x2b/0x80 [ 433.758913][T16806] tcp_setsockopt+0xe2/0x100 [ 433.758931][T16806] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 433.758949][T16806] do_sock_setsockopt+0xf3/0x1d0 [ 433.758967][T16806] __sys_setsockopt+0x119/0x190 [ 433.758991][T16806] __ia32_sys_setsockopt+0xbc/0x160 [ 433.759011][T16806] ? __do_fast_syscall_32+0xb3/0x8b0 [ 433.759027][T16806] ? lockdep_hardirqs_on+0x7d/0x110 [ 433.759068][T16806] __do_fast_syscall_32+0x13a/0x8b0 [ 433.759081][T16806] ? lockdep_hardirqs_on+0x7d/0x110 [ 433.759094][T16806] do_fast_syscall_32+0x32/0x70 [ 433.759107][T16806] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 433.759122][T16806] RIP: 0023:0xf700efec [ 433.759136][T16806] Code: Unable to access opcode bytes at 0xf700efc2. [ 433.759141][T16806] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 433.759153][T16806] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000006 [ 433.759160][T16806] RDX: 0000000000000016 RSI: 0000000080000340 RDI: 0000000000000219 [ 433.759167][T16806] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 433.759174][T16806] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 433.759180][T16806] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 433.759195][T16806] [ 433.762897][T16801] Console: switching to colour dummy device 80x25 [ 433.780848][ T9446] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 433.788099][ T9446] usb 10-1: config 1 interface 1 altsetting 0 endpoint 0x3 has invalid maxpacket 44431, setting to 1024 [ 433.788646][ T9446] usb 10-1: config 1 interface 1 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 433.788737][ T9446] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 434.046484][ T5819] usb 12-1: new high-speed USB device number 16 using dummy_hcd [ 434.095126][T16798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 434.095700][T16798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 434.119296][T16798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 434.123405][T16798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 434.197411][ T5819] usb 12-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 434.198920][ T5819] usb 12-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 434.198956][ T5819] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 434.226571][ T5819] keyspan 12-1:1.0: Keyspan 2 port adapter converter detected [ 434.226748][ T5819] keyspan 12-1:1.0: found no endpoint descriptor for endpoint 81 [ 434.226784][ T5819] keyspan 12-1:1.0: found no endpoint descriptor for endpoint 1 [ 434.230331][ T5819] keyspan 12-1:1.0: found no endpoint descriptor for endpoint 84 [ 434.230372][ T5819] keyspan 12-1:1.0: found no endpoint descriptor for endpoint 2 [ 434.254825][ T5819] usb 12-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 434.255758][ T5819] keyspan 12-1:1.0: found no endpoint descriptor for endpoint 88 [ 434.255799][ T5819] keyspan 12-1:1.0: found no endpoint descriptor for endpoint 6 [ 434.267682][ T9446] cdc_acm 10-1:1.0: ttyACM0: USB ACM device [ 434.279078][ T5819] usb 12-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 434.357051][ T5751] Bluetooth: hci1: command tx timeout [ 434.420080][ T9446] usb 10-1: USB disconnect, device number 21 [ 434.556900][T16804] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 434.599513][ T5819] usb 12-1: USB disconnect, device number 16 [ 434.651086][ T5819] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 434.707741][ T5819] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 434.710689][ T5819] keyspan 12-1:1.0: device disconnected [ 434.732005][T16804] pci 0000:00:01.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 434.732107][T16804] pci 0000:00:01.0: BAR 2 [mem 0xfeaf4000-0xfeaf4fff] [ 434.732285][T16804] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 434.735624][T16804] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 434.763373][T16804] pci 0000:00:01.0: Adding to iommu group 1 [ 434.780682][T16804] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 434.780693][T16804] pci 0000:00:01.0: vgaarb: bridge control possible [ 434.780701][T16804] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 434.796661][T16804] pci 0000:00:01.0: BAR 0 [mem 0x81000000-0x81ffffff pref]: assigned [ 434.800142][T16804] pci 0000:00:01.0: BAR 2 [mem 0x80084000-0x80084fff]: assigned [ 434.804524][T16804] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 434.830593][T16804] [drm] Found bochs VGA, ID 0xb0c5. [ 434.830611][T16804] [drm] Framebuffer size 16384 kB @ 0x81000000, mmio @ 0x80084000. [ 434.867968][T16804] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 435.019801][T16804] Console: switching to colour frame buffer device 160x50 [ 435.019834][T16804] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 435.226348][ C1] net_ratelimit: 457 callbacks suppressed [ 435.292749][T16825] syzkaller0: entered promiscuous mode [ 435.292766][T16825] syzkaller0: entered allmulticast mode [ 435.300112][T16825] tipc: Started in network mode [ 435.300137][T16825] tipc: Node identity 5adb04d83b1c, cluster identity 4711 [ 435.300222][T16825] tipc: Enabled bearer , priority 0 [ 435.302656][T16825] tipc: Resetting bearer [ 435.315998][T16824] tipc: Resetting bearer [ 435.327858][T16824] tipc: Disabling bearer [ 435.619466][T16837] syzkaller0: entered promiscuous mode [ 435.619475][T16837] syzkaller0: entered allmulticast mode [ 435.622075][T16837] tipc: Started in network mode [ 435.622090][T16837] tipc: Node identity de1ddfc9413, cluster identity 4711 [ 435.622326][T16837] tipc: Enabled bearer , priority 0 [ 435.624597][T16837] tipc: Resetting bearer [ 435.635153][T16836] tipc: Resetting bearer [ 435.665209][T16836] tipc: Disabling bearer [ 435.815510][T16843] FAULT_INJECTION: forcing a failure. [ 435.815510][T16843] name failslab, interval 1, probability 0, space 0, times 0 [ 435.815538][T16843] CPU: 1 UID: 0 PID: 16843 Comm: syz.7.3606 Tainted: G L syzkaller #0 PREEMPT(full) [ 435.815561][T16843] Tainted: [L]=SOFTLOCKUP [ 435.815568][T16843] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 435.815577][T16843] Call Trace: [ 435.815583][T16843] [ 435.815589][T16843] dump_stack_lvl+0x100/0x190 [ 435.815616][T16843] should_fail_ex.cold+0x5/0xa [ 435.815637][T16843] should_failslab+0xc2/0x120 [ 435.815692][T16843] __kmalloc_noprof+0xfc/0x840 [ 435.815713][T16843] ? __vb2_queue_alloc+0x23e/0x1160 [ 435.815740][T16843] __vb2_queue_alloc+0x23e/0x1160 [ 435.815772][T16843] vb2_core_reqbufs+0x899/0xf30 [ 435.815797][T16843] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 435.815818][T16843] ? rcu_is_watching+0x13/0xc0 [ 435.815837][T16843] ? __mutex_lock+0x26c/0x1bd0 [ 435.815855][T16843] ? __video_do_ioctl+0x50f/0xdf0 [ 435.815876][T16843] vb2_ioctl_reqbufs+0x291/0x450 [ 435.815897][T16843] ? __pfx_vb2_ioctl_reqbufs+0x10/0x10 [ 435.815927][T16843] vidioc_reqbufs+0x86/0x100 [ 435.815955][T16843] v4l_reqbufs+0x175/0x1d0 [ 435.815987][T16843] __video_do_ioctl+0xb2a/0xdf0 [ 435.816010][T16843] ? __might_fault+0xc5/0x140 [ 435.816029][T16843] ? __pfx___video_do_ioctl+0x10/0x10 [ 435.816059][T16843] video_usercopy+0x3d3/0x14c0 [ 435.816081][T16843] ? __pfx___video_do_ioctl+0x10/0x10 [ 435.816104][T16843] ? __pfx_video_usercopy+0x10/0x10 [ 435.816134][T16843] ? __fget_files+0x215/0x3d0 [ 435.816174][T16843] ? hook_file_ioctl_common+0x140/0x440 [ 435.816199][T16843] v4l2_ioctl+0x1bd/0x250 [ 435.816218][T16843] v4l2_compat_ioctl32+0x20f/0x2d0 [ 435.816240][T16843] ? __pfx_v4l2_compat_ioctl32+0x10/0x10 [ 435.816262][T16843] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 435.816280][T16843] __do_fast_syscall_32+0x13a/0x8b0 [ 435.816299][T16843] do_fast_syscall_32+0x32/0x70 [ 435.816316][T16843] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 435.816335][T16843] RIP: 0023:0xf700efec [ 435.816353][T16843] Code: Unable to access opcode bytes at 0xf700efc2. [ 435.816360][T16843] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 435.816375][T16843] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000c0145608 [ 435.816385][T16843] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 435.816394][T16843] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 435.816403][T16843] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 435.816412][T16843] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 435.816432][T16843] [ 436.230996][ T43] kauditd_printk_skb: 230 callbacks suppressed [ 436.231007][ T43] audit: type=1326 audit(1790214047.323:437): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16853 comm="syz.7.3610" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 436.231718][ T43] audit: type=1326 audit(1790214047.323:438): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16853 comm="syz.7.3610" exe="/syz-executor" sig=0 arch=40000003 syscall=297 compat=1 ip=0xf700efec code=0x7ffc0000 [ 436.231973][ T43] audit: type=1326 audit(1790214047.323:439): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16853 comm="syz.7.3610" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 436.232065][ T43] audit: type=1326 audit(1790214047.323:440): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16853 comm="syz.7.3610" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 436.232674][ T43] audit: type=1326 audit(1790214047.323:441): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16853 comm="syz.7.3610" exe="/syz-executor" sig=0 arch=40000003 syscall=358 compat=1 ip=0xf700efec code=0x7ffc0000 [ 436.233401][ T43] audit: type=1326 audit(1790214047.323:442): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16853 comm="syz.7.3610" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 436.233525][ T43] audit: type=1326 audit(1790214047.323:443): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16853 comm="syz.7.3610" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 436.235140][ T43] audit: type=1326 audit(1790214047.323:444): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16853 comm="syz.7.3610" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf700efec code=0x7ffc0000 [ 436.235334][ T43] audit: type=1326 audit(1790214047.323:445): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16853 comm="syz.7.3610" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 436.235361][ T43] audit: type=1326 audit(1790214047.323:446): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16853 comm="syz.7.3610" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 436.356539][ T1040] usb 13-1: new high-speed USB device number 25 using dummy_hcd [ 436.453498][T16854] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 436.453835][T16854] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 436.456668][T16854] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 436.459685][T16854] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 436.459817][T16854] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 436.492387][T16854] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 436.500730][T16854] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 436.500881][T16854] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 436.506814][ T1040] usb 13-1: Using ep0 maxpacket: 32 [ 436.515545][T16852] Cannot find add_set index 1 as target [ 436.537692][ T1040] usb 13-1: unable to get BOS descriptor or descriptor too short [ 436.537723][ T1040] usb 13-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 436.541340][ T1040] usb 13-1: unable to read config index 0 descriptor/start: -71 [ 436.541369][ T1040] usb 13-1: can't read configurations, error -71 [ 436.571525][T16854] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 436.626914][ T1479] usb 12-1: new high-speed USB device number 17 using dummy_hcd [ 436.702845][T16871] ip6gretap1: entered allmulticast mode [ 436.704736][T16871] batman_adv: batadv0: Adding interface: ip6gretap1 [ 436.704747][T16871] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 436.704774][T16871] batman_adv: batadv0: Interface activated: ip6gretap1 [ 436.846343][ T9786] usb 10-1: new high-speed USB device number 22 using dummy_hcd [ 436.996768][ T9786] usb 10-1: Using ep0 maxpacket: 32 [ 437.004631][T16868] Cannot find add_set index 1 as target [ 437.013752][ T9786] usb 10-1: unable to get BOS descriptor or descriptor too short [ 437.013793][ T9786] usb 10-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 437.014875][ T9786] usb 10-1: unable to read config index 0 descriptor/start: -71 [ 437.014907][ T9786] usb 10-1: can't read configurations, error -71 [ 437.133512][T16881] FAULT_INJECTION: forcing a failure. [ 437.133512][T16881] name failslab, interval 1, probability 0, space 0, times 0 [ 437.133545][T16881] CPU: 3 UID: 0 PID: 16881 Comm: syz.8.3619 Tainted: G L syzkaller #0 PREEMPT(full) [ 437.133572][T16881] Tainted: [L]=SOFTLOCKUP [ 437.133580][T16881] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 437.133593][T16881] Call Trace: [ 437.133600][T16881] [ 437.133609][T16881] dump_stack_lvl+0x100/0x190 [ 437.133641][T16881] should_fail_ex.cold+0x5/0xa [ 437.133668][T16881] should_failslab+0xc2/0x120 [ 437.133697][T16881] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 437.133723][T16881] ? sock_alloc_inode+0x26/0x2c0 [ 437.133746][T16881] ? __pfx_sock_alloc_inode+0x10/0x10 [ 437.133768][T16881] sock_alloc_inode+0x26/0x2c0 [ 437.133789][T16881] ? __pfx_sock_alloc_inode+0x10/0x10 [ 437.133807][T16881] alloc_inode+0x68/0x250 [ 437.133837][T16881] sock_alloc+0x44/0x280 [ 437.133854][T16881] ? security_socket_create+0x7f/0x250 [ 437.133883][T16881] __sock_create+0xc2/0x860 [ 437.133910][T16881] __sys_socket+0x14d/0x260 [ 437.133933][T16881] ? xfd_validate_state+0x129/0x190 [ 437.133963][T16881] ? __pfx___sys_socket+0x10/0x10 [ 437.133996][T16881] __ia32_sys_socket+0x72/0xb0 [ 437.134018][T16881] ? lockdep_hardirqs_on+0x7d/0x110 [ 437.134040][T16881] __do_fast_syscall_32+0x13a/0x8b0 [ 437.134067][T16881] do_fast_syscall_32+0x32/0x70 [ 437.134090][T16881] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 437.134124][T16881] RIP: 0023:0xf7f28fec [ 437.134145][T16881] Code: Unable to access opcode bytes at 0xf7f28fc2. [ 437.134156][T16881] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 437.134176][T16881] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000000000005 [ 437.134190][T16881] RDX: 0000000000000084 RSI: 0000000000000000 RDI: 0000000000000000 [ 437.134203][T16881] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 437.134216][T16881] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 437.134229][T16881] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 437.134256][T16881] [ 437.275820][T16887] futex_wake_op: syz.7.3622 tries to shift op by 144; fix this program [ 437.436400][ T5819] usb 14-1: new high-speed USB device number 23 using dummy_hcd [ 437.566475][ T5819] usb 14-1: device descriptor read/64, error -71 [ 437.576410][ T1040] usb 13-1: new full-speed USB device number 26 using dummy_hcd [ 437.600912][T16893] syzkaller0: entered promiscuous mode [ 437.600979][T16893] syzkaller0: entered allmulticast mode [ 437.736681][ T1040] usb 13-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice= 0.03 [ 437.737460][ T1040] usb 13-1: config 0 has an invalid interface number: 50 but max is 0 [ 437.737474][ T1040] usb 13-1: config 0 has no interface number 0 [ 437.737492][ T1040] usb 13-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 437.737506][ T1040] usb 13-1: config 0 interface 50 altsetting 0 endpoint 0x82 has invalid maxpacket 255, setting to 64 [ 437.739926][ T1040] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.739937][ T1040] usb 13-1: Product: syz [ 437.739945][ T1040] usb 13-1: Manufacturer: syz [ 437.739952][ T1040] usb 13-1: SerialNumber: syz [ 437.746806][ T1040] usb 13-1: config 0 descriptor?? [ 437.748795][T16883] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 437.762098][ T1040] yurex 13-1:0.50: USB YUREX device now attached to Yurex #0 [ 437.798763][T16896] Console: switching to colour dummy device 80x25 [ 437.846358][ T5819] usb 14-1: new high-speed USB device number 24 using dummy_hcd [ 437.976747][ T5819] usb 14-1: device descriptor read/64, error -71 [ 437.983441][ T1040] usb 13-1: USB disconnect, device number 26 [ 437.997703][ T1040] yurex 13-1:0.50: USB YUREX #0 now disconnected [ 438.090717][ T5819] usb usb14-port1: attempt power cycle [ 438.425675][T16905] nfs4: Unknown parameter 'tcp"»' [ 438.446393][ T5819] usb 14-1: new high-speed USB device number 25 using dummy_hcd [ 438.469356][ T5819] usb 14-1: device descriptor read/8, error -71 [ 438.516744][ T5751] Bluetooth: hci1: command 0x0c1a tx timeout [ 438.516786][ T5751] Bluetooth: hci2: command 0x0c1a tx timeout [ 438.516809][ T5751] Bluetooth: hci0: command 0x0c1a tx timeout [ 438.516828][ T5751] Bluetooth: hci6: command 0x0406 tx timeout [ 438.516848][ T5751] Bluetooth: hci4: command 0x0406 tx timeout [ 438.716243][ T5819] usb 14-1: new high-speed USB device number 26 using dummy_hcd [ 438.789141][T16907] netlink: 72 bytes leftover after parsing attributes in process `syz.7.3628'. [ 438.806820][ T5819] usb 14-1: device descriptor read/8, error -71 [ 438.840970][T16894] vgaarb: vga_arb_release [ 438.840984][T16894] ================================================================== [ 438.840989][T16894] BUG: KASAN: slab-use-after-free in __dynamic_dev_dbg+0x2fc/0x310 [ 438.841019][T16894] Read of size 8 at addr ffff888022e38120 by task syz.5.3625/16894 [ 438.841029][T16894] [ 438.841036][T16894] CPU: 2 UID: 0 PID: 16894 Comm: syz.5.3625 Tainted: G L syzkaller #0 PREEMPT(full) [ 438.841051][T16894] Tainted: [L]=SOFTLOCKUP [ 438.841056][T16894] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 438.841063][T16894] Call Trace: [ 438.841068][T16894] [ 438.841072][T16894] dump_stack_lvl+0x100/0x190 [ 438.841088][T16894] print_report+0x13d/0x4b0 [ 438.841105][T16894] ? __virt_addr_valid+0x239/0x430 [ 438.841123][T16894] ? __dynamic_dev_dbg+0x2fc/0x310 [ 438.841133][T16894] kasan_report+0xdf/0x1c0 [ 438.841149][T16894] ? __dynamic_dev_dbg+0x2fc/0x310 [ 438.841160][T16894] __dynamic_dev_dbg+0x2fc/0x310 [ 438.841171][T16894] ? __pfx___dynamic_dev_dbg+0x10/0x10 [ 438.841185][T16894] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 438.841197][T16894] ? _raw_spin_lock_irqsave+0x52/0x60 [ 438.841215][T16894] vga_arb_release+0x3e7/0x540 [ 438.841234][T16894] ? __pfx_vga_arb_release+0x10/0x10 [ 438.841246][T16894] __fput+0x3ff/0xb50 [ 438.841262][T16894] task_work_run+0x150/0x240 [ 438.841276][T16894] ? __pfx_task_work_run+0x10/0x10 [ 438.841291][T16894] exit_to_user_mode_loop+0x1d8/0x700 [ 438.841308][T16894] ? rcu_is_watching+0x13/0xc0 [ 438.841320][T16894] __do_fast_syscall_32+0x59f/0x8b0 [ 438.841333][T16894] do_fast_syscall_32+0x32/0x70 [ 438.841345][T16894] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 438.841359][T16894] RIP: 0023:0xf700efec [ 438.841374][T16894] Code: Unable to access opcode bytes at 0xf700efc2. [ 438.841379][T16894] RSP: 002b:00000000ffe70fbc EFLAGS: 00000202 ORIG_RAX: 00000000000001b4 [ 438.841391][T16894] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 000000000000001e [ 438.841398][T16894] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 438.841405][T16894] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 438.841411][T16894] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 438.841418][T16894] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 438.841427][T16894] [ 438.841432][T16894] [ 438.841434][T16894] Allocated by task 16804: [ 438.841440][T16894] kasan_save_stack+0x30/0x50 [ 438.841453][T16894] kasan_save_track+0x14/0x30 [ 438.841465][T16894] __kasan_kmalloc+0xaa/0xb0 [ 438.841477][T16894] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 438.841486][T16894] pci_alloc_dev+0x47/0x270 [ 438.841496][T16894] pci_scan_single_device+0x10c/0x240 [ 438.841508][T16894] pci_scan_slot+0x1c9/0x7c0 [ 438.841518][T16894] pci_scan_child_bus_extend+0x6b/0x7b0 [ 438.841530][T16894] pci_rescan_bus+0x18/0x40 [ 438.841541][T16894] rescan_store+0xfb/0x130 [ 438.841553][T16894] bus_attr_store+0x74/0xb0 [ 438.841563][T16894] sysfs_kf_write+0xf2/0x150 [ 438.841575][T16894] kernfs_fop_write_iter+0x3e0/0x5f0 [ 438.841604][T16894] vfs_write+0x6af/0x1050 [ 438.841616][T16894] ksys_write+0x12a/0x250 [ 438.841627][T16894] __do_fast_syscall_32+0x13a/0x8b0 [ 438.841638][T16894] do_fast_syscall_32+0x32/0x70 [ 438.841649][T16894] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 438.841662][T16894] [ 438.841664][T16894] Freed by task 16896: [ 438.841670][T16894] kasan_save_stack+0x30/0x50 [ 438.841682][T16894] kasan_save_track+0x14/0x30 [ 438.841694][T16894] kasan_save_free_info+0x3b/0x70 [ 438.841703][T16894] __kasan_slab_free+0x5f/0x80 [ 438.841716][T16894] kfree+0x22b/0x6d0 [ 438.841724][T16894] device_release+0xd2/0x270 [ 438.841735][T16894] kobject_put+0x1f7/0x640 [ 438.841747][T16894] put_device+0x1f/0x30 [ 438.841758][T16894] pci_remove_bus_device+0x305/0x3b0 [ 438.841771][T16894] pci_stop_and_remove_bus_device_locked+0x1a/0x20 [ 438.841785][T16894] remove_store+0x123/0x140 [ 438.841799][T16894] dev_attr_store+0x58/0x80 [ 438.841795][T16908] syzkaller1 (unregistering): bond_netdev_event received NETDEV_UNREGISTER [ 438.841808][T16894] sysfs_kf_write+0xf2/0x150 [ 438.841818][T16894] kernfs_fop_write_iter+0x3e0/0x5f0 [ 438.841824][T16908] net syzkaller1: siw: event 6 [ 438.841834][T16894] vfs_write+0x6af/0x1050 [ 438.841844][T16894] ksys_write+0x12a/0x250 [ 438.841854][T16894] __do_fast_syscall_32+0x13a/0x8b0 [ 438.841865][T16894] do_fast_syscall_32+0x32/0x70 [ 438.841876][T16894] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 438.841889][T16894] [ 438.841891][T16894] The buggy address belongs to the object at ffff888022e38000 [ 438.841891][T16894] which belongs to the cache kmalloc-4k of size 4096 [ 438.841900][T16894] The buggy address is located 288 bytes inside of [ 438.841900][T16894] freed 4096-byte region [ffff888022e38000, ffff888022e39000) [ 438.841910][T16894] [ 438.841913][T16894] The buggy address belongs to the physical page: [ 438.841918][T16894] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22e38 [ 438.841928][T16894] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 438.841937][T16894] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 438.841947][T16894] page_type: f5(slab) [ 438.841957][T16894] raw: 00fff00000000040 ffff88801c043040 dead000000000100 dead000000000122 [ 438.841967][T16894] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 438.841977][T16894] head: 00fff00000000040 ffff88801c043040 dead000000000100 dead000000000122 [ 438.841986][T16894] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 438.841995][T16894] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 438.842004][T16894] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 438.842010][T16894] page dumped because: kasan: bad access detected [ 438.842015][T16894] page_owner tracks the page as allocated [ 438.842019][T16894] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3546562827 [ 438.842036][T16894] post_alloc_hook+0xfd/0x120 [ 438.842053][T16894] get_page_from_freelist+0x110d/0x35d0 [ 438.842064][T16894] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 438.842075][T16894] new_slab+0xa9/0x6e0 [ 438.842083][T16894] refill_objects+0xe3/0x410 [ 438.842093][T16894] __pcs_replace_empty_main+0x35e/0x650 [ 438.842102][T16894] __kmalloc_node_noprof+0x6ad/0x880 [ 438.842114][T16894] __vmalloc_node_range_noprof+0x3d4/0x1420 [ 438.842130][T16894] __vmalloc_node_noprof+0xad/0xf0 [ 438.842144][T16894] kcov_init+0x1e/0xc0 [ 438.842157][T16894] do_one_initcall+0x11c/0x6f0 [ 438.842166][T16894] kernel_init_freeable+0x6ea/0x7b0 [ 438.842177][T16894] kernel_init+0x21/0x1e0 [ 438.842189][T16894] ret_from_fork+0x730/0xd60 [ 438.842198][T16894] ret_from_fork_asm+0x1a/0x30 [ 438.842208][T16894] page_owner free stack trace missing [ 438.842211][T16894] [ 438.842214][T16894] Memory state around the buggy address: [ 438.842223][T16894] ffff888022e38000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 438.842231][T16894] ffff888022e38080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 438.842238][T16894] >ffff888022e38100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 438.842245][T16894] ^ [ 438.842250][T16894] ffff888022e38180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 438.842257][T16894] ffff888022e38200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 438.842263][T16894] ================================================================== [ 438.842269][T16894] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 439.075469][T16894] CPU: 2 UID: 0 PID: 16894 Comm: syz.5.3625 Tainted: G L syzkaller #0 PREEMPT(full) [ 439.078852][T16894] Tainted: [L]=SOFTLOCKUP [ 439.080222][T16894] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 439.083358][T16894] Call Trace: [ 439.084430][T16894] [ 439.085408][T16894] dump_stack_lvl+0x100/0x190 [ 439.086905][T16894] vpanic+0x553/0x970 [ 439.088186][T16894] ? __pfx_vpanic+0x10/0x10 [ 439.089575][T16894] ? __pfx_vprintk_emit+0x10/0x10 [ 439.091073][T16894] ? __dynamic_dev_dbg+0x2fc/0x310 [ 439.092787][T16894] panic+0xd1/0xe0 [ 439.093959][T16894] ? __pfx_panic+0x10/0x10 [ 439.095346][T16894] ? end_report.part.0+0x23/0x90 [ 439.096773][T16894] ? rcu_is_watching+0x13/0xc0 [ 439.098262][T16894] ? end_report.part.0+0x23/0x90 [ 439.099767][T16894] check_panic_on_warn.cold+0x19/0x34 [ 439.101501][T16894] end_report.part.0+0x3a/0x90 [ 439.103046][T16894] kasan_report.cold+0xe/0x18 [ 439.104530][T16894] ? __dynamic_dev_dbg+0x2fc/0x310 [ 439.106170][T16894] __dynamic_dev_dbg+0x2fc/0x310 [ 439.107756][T16894] ? __pfx___dynamic_dev_dbg+0x10/0x10 [ 439.109476][T16894] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 439.111184][T16894] ? _raw_spin_lock_irqsave+0x52/0x60 [ 439.112908][T16894] vga_arb_release+0x3e7/0x540 [ 439.114396][T16894] ? __pfx_vga_arb_release+0x10/0x10 [ 439.116097][T16894] __fput+0x3ff/0xb50 [ 439.117368][T16894] task_work_run+0x150/0x240 [ 439.118860][T16894] ? __pfx_task_work_run+0x10/0x10 [ 439.120490][T16894] exit_to_user_mode_loop+0x1d8/0x700 [ 439.122218][T16894] ? rcu_is_watching+0x13/0xc0 [ 439.123883][T16894] __do_fast_syscall_32+0x59f/0x8b0 [ 439.125575][T16894] do_fast_syscall_32+0x32/0x70 [ 439.127061][T16894] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 439.128982][T16894] RIP: 0023:0xf700efec [ 439.130256][T16894] Code: Unable to access opcode bytes at 0xf700efc2. [ 439.132318][T16894] RSP: 002b:00000000ffe70fbc EFLAGS: 00000202 ORIG_RAX: 00000000000001b4 [ 439.134785][T16894] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 000000000000001e [ 439.137151][T16894] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 439.139507][T16894] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 439.142020][T16894] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 439.144490][T16894] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 439.146912][T16894] [ 439.148714][T16894] Kernel Offset: disabled [ 439.150018][T16894] Rebooting in 86400 seconds.. VM DIAGNOSIS: 01:40:50 Registers: info registers vcpu 0 CPU#0 RAX=000000000055973f RBX=ffffffff8ea91580 RCX=ffffffff8bcf91c5 RDX=0000000000000001 RSI=ffffffff8e390af9 RDI=ffffffff8c623a80 RBP=fffffbfff1d522b0 RSP=ffffffff8ea07cf0 R8 =0000000000000001 R9 =ffffed10056467bd R10=ffff88802b233deb R11=0000000000000001 R12=0000000000000000 R13=0000000000000000 R14=1ffffffff1d40fa2 R15=dffffc0000000000 RIP=ffffffff8bcf76ff RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096959000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000034804ff8 CR3=0000000024ce6000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000005000001 Opmask01=0000000000000001 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=00000000ffffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 545b5d3836303134 382e38333420205b ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 3e4b5341543c2020 5d3439383631545b ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe0edc8c90 0000003000000018 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 65746e6f63007325 203a726f72726520 64656e7275746572 2072657672657300 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 40514b4a46005600 051f574a57574005 41404b5750514057 0557405357405600 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3120534f4942202c 2939303032202c39 484349202b203533 5128204350206472 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3035366336663337 3038383866666666 3d61746164206e77 6f646b6e696c5f68 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 7469775f73657475 6f725f65726f6e67 695f6c7463737973 5f666e6f63726464 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 613d72656c646e61 685f636f72702034 34363d65646f6d20 6e776f646b6e696c ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 5f687469775f7365 74756f725f65726f 6e67693d656d616e 636f72702020205d ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 65746e656d676172 66206562206c6c69 7720656361667265 746e692073696874 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=ffff888048d92580 RBX=0000000000000000 RCX=0000000000000001 RDX=0000000000000001 RSI=0000000000000000 RDI=ffffffff9bbd8990 RBP=ffffffff9bbd8990 RSP=ffffc900069cf240 R8 =0000000000000001 R9 =0000000000000000 R10=ffffffff9145735f R11=0000000000000000 R12=0000000000000000 R13=0000000000000001 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff81e6cc37 RFL=00000092 [--S-A--] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096a59000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000347f5ff8 CR3=000000000eb96000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000034 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85af7645 RDI=ffffffff9bc5e3e0 RBP=ffffffff9bc5e3a0 RSP=ffffc90004817328 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3230383838666666 R12=0000000000000000 R13=0000000000000034 R14=0000000000000006 R15=ffffc90004817640 RIP=ffffffff85af766f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096b59000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00000000f700f000 CR3=000000006ab91000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001c000000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=00000000004459c3 RBX=ffff88801cbf8000 RCX=ffffffff8bcf91c5 RDX=0000000000000001 RSI=ffffffff8e390af9 RDI=ffffffff8c623a80 RBP=ffffed100397f000 RSP=ffffc9000049fe00 R8 =0000000000000001 R9 =ffffed10056a67bd R10=ffff88802b533deb R11=0000000000000001 R12=0000000000000000 R13=0000000000000000 R14=1ffff92000093fc4 R15=dffffc0000000000 RIP=ffffffff8bcf76ff RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096c59000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000002f820ff8 CR3=00000000571f2000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001f000000000 0000000400000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000