last executing test programs: 1.726519249s ago: executing program 3 (id=321): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xfff1, 0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0xd4, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300, 0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xa8, 0x2, [@TCA_U32_SEL={0xa4, 0x5, {0x8, 0x6, 0x9, 0xc000, 0x4c16, 0x8, 0x7ff, 0x5, [{0x1000, 0x9, 0x4}, {0x3ff, 0x0, 0xfffffff7, 0x81}, {0xffff, 0x9, 0xe6f, 0x5}, {0x8001, 0xfb86, 0xffffffff, 0x1ff}, {0x6, 0x9, 0x2, 0x9}, {0x400, 0x5, 0xe, 0x1}, {0x80000000, 0xfffffffc, 0x1, 0x7f}, {0x81, 0x5, 0x9, 0x4}, {0x6, 0x2, 0x8, 0x3}]}}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x24004800}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0xc4, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xffff}, {0x300, 0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0x98, 0x2, [@TCA_U32_SEL={0x94, 0x5, {0x8, 0x6, 0x9, 0xc000, 0x4c16, 0x8, 0x7ff, 0x5, [{0x1000, 0x9, 0x4}, {0x3ff, 0x0, 0xfffffff7, 0x81}, {0x8001, 0xfb86, 0xffffffff, 0x1ff}, {0x6, 0x9, 0x2, 0x9}, {0x400, 0x5, 0xe, 0x1}, {0x80000000, 0xfffffffc, 0x1, 0x7f}, {0x81, 0x5, 0x9, 0x4}, {0x6, 0x2, 0x8, 0x3}]}}]}}]}, 0xc4}, 0x1, 0x0, 0x0, 0x24004800}, 0x0) 1.726311064s ago: executing program 1 (id=322): sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x44050) socket(0x400000000010, 0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0x1ff) socketpair$unix(0x1, 0x1, 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f00000000c0)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000200)=0x1, 0x12) 1.631062661s ago: executing program 1 (id=323): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, 0x0, 0x0, 0x7ddfdbdfaba51c5d, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @remote, 0x44}, 0x1c) 1.630866034s ago: executing program 0 (id=324): mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file0\x00', &(0x7f0000002100), 0x1800000, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) connect$can_bcm(r0, 0x0, 0x0) sendmsg$can_bcm(r0, 0x0, 0x0) sendmsg$can_bcm(r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r2 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r2, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x40505330, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x40505330, 0x0) read(r2, 0x0, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x15) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000000)=""/188) 1.630446584s ago: executing program 3 (id=325): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/tracing/trace_pipe\x00', 0xa2180, 0x26) 1.580058232s ago: executing program 1 (id=326): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0x30000, 0x8, 0xd, 0x3, 0xe4, 0x40, 0xfa, 0x0, 0x38, 0x1b}, {0xdddd1000, 0x70000, 0xe, 0x0, 0x40, 0x5, 0x7d, 0x9, 0xd, 0x3, 0x3, 0x1}, {0x2000, 0xa000, 0xe, 0x5, 0x3, 0x7, 0x6, 0x8b, 0x22, 0xab, 0x5, 0x46}, {0x30000, 0x7000, 0x3, 0x1, 0x4, 0x43, 0x9, 0xfb, 0xc0, 0x7, 0xd}, {0xa000, 0x9000, 0x10, 0x2, 0x3, 0x7, 0xab, 0x7f, 0x4a, 0x83, 0xfe, 0xe}, {0xf000, 0x80a0000, 0x8, 0xfa, 0xb1, 0x8, 0x1, 0xd, 0x88, 0xfb, 0x1, 0x6}, {0x7000, 0x2, 0xf, 0xd, 0x7, 0xff, 0xb, 0x0, 0x4, 0x81, 0x1}, {0x5000, 0xa000, 0xe, 0x5, 0xf, 0x7, 0x1, 0x1a, 0x5, 0x3, 0x7, 0x19}, {0xb000, 0x2d}, {0xf000, 0x7fff}, 0xc0040075, 0x0, 0x231d7000, 0x42224, 0xb, 0x1, 0x3000, [0x483ffffffffffffe, 0x3, 0x80000004, 0x5b3]}) r1 = io_uring_setup(0x178e, &(0x7f0000000140)={0x0, 0x5284, 0x10, 0xffffffee, 0x8d}) syz_usb_connect(0x2, 0x2d, &(0x7f0000000240)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400fb01600600000905"], 0x0) r2 = syz_open_dev$audion(&(0x7f0000000000), 0x3, 0x101001) syz_usb_connect$uac3(0x2, 0x0, 0x0, &(0x7f0000000440)={0xa, &(0x7f0000000300)={0xa, 0x6, 0x250, 0x3, 0x40, 0x9, 0x8, 0x7}, 0xc, &(0x7f0000000340)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0x8, 0x6, 0x9bb2}]}, 0x1, [{0x76, &(0x7f00000003c0)=ANY=[@ANYBLOB="76032f95742c77f55b5d05095a493419b91d9db084610932d1a56a6c2042bf591e425748a4720ce34f8ab21344adc8beecf9fc083331e523fe4c4f985204231ba068c3821f3326683235f4b92f479756ca729e28279bc6ca12c35bc573ce04905427f4ef5d6502"]}]}) write$P9_RRENAME(r2, &(0x7f0000000640)={0x7, 0x15, 0x2}, 0x7) socket$inet6_sctp(0xa, 0x1, 0x84) close_range(r1, 0xffffffffffffffff, 0x0) 1.579810829s ago: executing program 0 (id=327): symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x1c0) r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000440)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00', 0x0) mkdir(&(0x7f00000001c0)='./file1\x00', 0xb) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x0) renameat2(0xffffffffffffffff, &(0x7f0000000100)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00', 0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', 0x2) 1.578468646s ago: executing program 3 (id=328): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0xc000) 1.501838322s ago: executing program 0 (id=329): clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_nanosleep(0x2, 0x0, &(0x7f0000000140)={r0, r1+10000000}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x0) write$binfmt_aout(r2, &(0x7f00000002c0)=ANY=[], 0xfffffee2) r3 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000000480)=0x0) timer_settime(r4, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r5, 0x400448c9, &(0x7f0000000240)) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r7 = userfaultfd(0x1) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x140}) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r7, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) 1.50155519s ago: executing program 3 (id=330): bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x7}, 0x1c) r0 = syz_open_dev$video4linux(&(0x7f0000000540), 0x110000fc5, 0x12f1e502c5c14a57) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f00000000c0)={0x2000000, 0x0, 0x100f, 0x2220, 0x5, 0x4000c251, 0x7f, 0x1}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000040)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="040e0c92df1e6f845d5d356ff701030300cda0e305cbc3f9e8106720929f5e1e6dba4fdea9c660f3541818a7bd4a9343ba3be2c1cdd15632a65f543b092a7d26cbebf5edf2b3b66cbcb5344fb056df794425ce27f149d68ee82814a32ffa455b22943e651a2035f0e6311e54d9fcc7605bb1b8e07670b75297e2c38db144f207f49fa4d8b32d9a14f5c8b5ae57"], 0xf) nanosleep(&(0x7f00000000c0)={0x0, 0x5f5e100}, 0x0) setns(0xc9, 0x0) r2 = socket(0x1f, 0x5, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10) bind(r2, &(0x7f0000000140)=@generic={0x1, "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000008000"}, 0x80) connect(r2, &(0x7f0000000180)=@generic={0x1f, "01020304050600"}, 0x80) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) close(0xffffffffffffffff) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 991.839807ms ago: executing program 2 (id=335): sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x1000002d, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xe11, 0xffffffff}, 0x0) r0 = socket$inet6(0xa, 0x3, 0x3c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) connect$inet6(r0, &(0x7f0000000000)={0xa, 0xd000, 0x80000001, @remote, 0x7}, 0x1c) writev(r0, &(0x7f00000000c0)=[{&(0x7f00000002c0)=',9', 0x2}], 0x1) 951.295735ms ago: executing program 2 (id=336): mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file0\x00', &(0x7f0000002100), 0x1800000, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) connect$can_bcm(r0, 0x0, 0x0) sendmsg$can_bcm(r0, 0x0, 0x0) sendmsg$can_bcm(r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r2 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r2, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x40505330, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x40505330, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x15) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000000)=""/188) 861.724159ms ago: executing program 2 (id=337): symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x1c0) r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000440)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00', 0x0) mkdir(&(0x7f00000001c0)='./file1\x00', 0xb) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x0) renameat2(0xffffffffffffffff, &(0x7f0000000100)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00', 0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', 0x2) 861.401065ms ago: executing program 3 (id=338): mount(0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1fa) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./ffs/ep0\x00', 0x2, 0x0) 801.506476ms ago: executing program 2 (id=339): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000180)={0x1c, r1, 0x1, 0x70bd29, 0x1, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) 800.966921ms ago: executing program 2 (id=340): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0) writev(r0, &(0x7f0000001640)=[{&(0x7f0000000140)="11d55559c0e28e7c9e5d8dfec530f31191de75f3d1090a6bca510852d6c0a6ebca99b80e785c43612894118f3d12a264f0dd1b3c98f792365dd7ab6b51f427", 0x3f}], 0x1) 800.771438ms ago: executing program 3 (id=341): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000000)={@my=0x0}) r1 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x2) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000000)={0x9, 0x8, 0x94b, 0x3, "46ffff0000e97324b7ed1a500d1fafdb00"}) 701.768794ms ago: executing program 2 (id=342): r0 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_io_uring_complete(0x0, r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000008c0)={0x38, r2, 0x121, 0x70bd28, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}]]}, 0x38}, 0x1, 0x0, 0x0, 0xf040}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x3, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x1, 0x3c9}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r6, 0xc0385868, 0x0) r7 = dup(r5) r8 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f00000000c0), 0x42000, 0x0) ioctl$BTRFS_IOC_RM_DEV(0xffffffffffffffff, 0x5000940b, &(0x7f0000000100)={{}, "c0676d43b96c0f70db6f16a66a6ca2ae995e972107dcc84a201888e04afe449716b0608c06937d5ec97489e1844d7f9dc1fa7ed7e42b309816c627e29936e138283e04b0578ac6d12ad53c25ed05e075d94c72e4a3bf4cf0c6d2725e4a1d70cdc0e638b67db196d2feac16d9bee5f3ac1de9a8f96fabf1b85a4a493c8f4c35dca997ace98b11eb12c741f02552285718acf4069a4eadff1908a358f62389e659fb46f48db4a24e59fec969848ecf64fe98db90bdaa9acf443bac140820007c8e192f1e2e5ecc7c1bd6e1096c24b7131096de003a907cc1a8e584c10847f82f8fccc0b378e72e3e20093b48196e59fb7572a286035f962f5e174d4cd7ec99956eb51b94f75c9981b988c4ef3ac186eebbc629678187340029ccc940773fb4d45e651df1f58d45e13a4c25e21576300862b940b24506d589c8df20cdb79c0f4a8afaed2b3419b1c6b7b36f7a1af8a6b35af18e9e71bae04100e76839fad1c0e024bf0d1910c143cb7d8f0aff3a11dfb04e1846e8a48498938d00bf7a6b553286c2e0f3981656f8c5d48f60f321190f71c646904aa6e02ad4ac751c9a778a8e029c0e1e83b750742b9782a7b9774ba9deb5142ce44a836ab01251ea52c346ad7ea08e4c780e36eb2cd7cd522bd18f8c56955ff35d50a996ca54ff6cfd5cd9af18fc50ffbf2fd0bfa9997fbae0cd42016f2b6b863f4ba7d86bed74a52263f17cad14232c6a25b5a6acb636c249da76f98074e7074f3a044d3d50604a626bff042471a0bb29b6f168897f51c9bd307789f00683aacc05795c171bc0cc5d7f1a73926170ee03fff17ec8b933ea5035bef9210eb81f4e404f6e0164d7dadf91d740d974c15fd257deca501c6ffd0ea466746e7982562f20ed8a8dec9517ea4a395677c7ff78d3ee3801f75d028aa1feb9d5d047bc5ecb7c428690dc9ab7438d57fb489a054a41a130a6fcff81b241877c6a04dbe8810227769d65f16af5060494bc779e9b4de362fc193cafbf67c310a83a5a9c8a3746e7ba28a48721178ebb1ec569ff2d0cdce96294a89195f092508431c7c4f0569a0edcd0d9b23dd7b00457285b6a725f14f4eef5316ab7dd29b132557b46f0b4e914c085ebe8624acb6adbf3889aa30535ae07806913326ab686221315ba50a0f6ba32b2106e0412d10428a619bcc73722b433b77d205609e6ccd816e90403f7f1629621dde00680c23dce5368d62a4c17abd9d1278928c615a118c6fc9f9e29e1598cdef31de5af754e583bd2d496734bbd66cec4da11772c617a41b83008b2bdd9c4c1cad67dcf423d0d0360cb35e793e42e083e434b15d13b330a553928a3bcfb8272a7e367baac12475c8ec3e90291c46a411af4fb6a3018e3450a8fe583f267fb8fa73d6e39d319432ffc3a90224d9ce080fc33e71538a7ca8f8caf9077b2bc1437411ead30681cde87cdd6e3740dea8208685c59f64efcad35dd709656a9975e9f08825409a1705eb1f6099268c21f00ed5cb83a8e1c5af63189e88d0156df44d1d4698030c690363a0f65ba10d0c779dc4b9029e4e0130698d284430683c98c9fa4f1c5796cd749862b0c316e1da70942d713a2505a39364fc84fde7a871bf9162288d48b3115a63c389c5bc7dfd2c1165e45e6a3e0ecd84842567e6378c5197de985a66ff747d50da2291e0cb2af588d7afdc1ce0500372f1218eb8327e3522f6c151e2ba7a97c0d7e1799fafb9ac5d28e16e1765e1286b6d6111918237f4ef82db00be6b46a6e5b0c0a08b8722a69f2ecaac810378cef1377b9985b9f8f23705c96ea2ba390a2122991fad118e3631036c2d0efb7e486e263b657e59b8388e7f9d25260fbe3b824d379bd79b9a5b19b4ec7ea181a4aaab84d8040d84f7d47a4747ed0c8493a1f5f31b6f46aeab974ed636a5a12804bc1fdff00bb541eac97538e8868d9e9373c620344e358fb72bfbd095ccfee2b9f2dc4cc1bc01a83dd2cf42a3a5d6dba362cbfe96c5514288f9b622a54f28b115428bbf7883d51811285d2846258b8a80992f105098ea017ac7c979e408f8c3ccf5ebe12a620106e48d0356d817d830bd3549f063d65022e00b47ab995dc34ccbf6f79ac1d407a548879b9ef74c656c5b74e598a6d8465d6894d13d23f2838482eab278b14bcc69236eb33c96a7a0a4d45904fdeaca02b40cd9862b4a7acbb67d79af84c5235b6cc9a550af39e7d7d02ff4115a64db8e9aa06c5a3dcf53c8278df28c3b4b9fdafe1b43459d9bd00bd325e79a7f2dea38e7530fd43d75c94097014c9ac0fc12da726fef0b50b119ac22f5fd38ed4e274c93fa0b5ffafe87fb6d6966c1ad29a9b8cef5a11c8405e65705e8a5124ce5f83833983cb88ad64c979c8b068b5a7766dacf36d606fcbaa84b91c478e3820b2980d18fbeed062ad4738cbaea265754810116aa34c218863bafc64855689ca43153db7788aa8490fd1d8bc42221defe4b8ed1d2717d7038e200d4973fca71608e4204d159ed7ffd618a7429dff90af09d0fd2aef07379978ae1f801e3b4e50aa206e75ebc466308a397f0b8574a268c92fc80e92fd0577d3d25365e3e4190fe64c3151926de421d514dc9089b51726bf65db68f9fef253e8dcf1ece73a35cdbc726fd94aa72104a1ce384a2171f1608b39421e99a05adac18737991326f33e0992468b8a0f2678dc0051a7b54136442cc8104dc888afd202487b9a8fba40938f145432a1f560902a7680bb09429fa40e37d30181273f077e2d13b4e8109a6b9ce05865685ac4da25bd0505de458d38dc07b6bab04e7c59ca87306f0811a5a959a00b832a61567d5852e69c924a23a58b5d981be36db5e3a67d8c0fe9010c8944f8e07cb889412bf5193261722ef43053596632d2e8233a578ec0b1d58e05993daae8aaa787a5782905eaefdedc4df470ba8fb6462031e8ae0e445360247ae0cecc5dc9c30cb69b53079f13d55d91365060a0b9ca4c5d59e82bd994dee24085aa253c65b60cd1317b20251f980ec649898204a6c57e708c7eab1b7dda70509d00b77910b6fb5401877def0e340b734573c05fe1e19503c5f6590351e8cae783fd167216126b65a40f84c15ac2526ff9903ef50966fbce1d91e8a9de35b0357d489cad03fec5ff9c9b879e277d941f5c99430757551d66d574e8ec64d86c1970ada546576fb0fe65d9815ec6dc22e33f45e6906595f3a1b4e3c9b170edb61882280e971be66c1b1aac20463c779ea983f7f0ec4ddd2855ebb0af3679f0aa4fa6c961726120a24bd181905a6f533a044eaa4f148bf6c91008332569704568a79109ae710841ee6a41ba86cb87767d145e98bbe985e09b0f44bb615112107c73991b70aeb657a24b3371906e77946e924955a84f2b6ceea649e09aa0435be65e706af7f8ef6a2baffbc5feb7a1f17dd91accc9c60c0dbb7327d4dbe3d2f24e1b5a91a512f24fc6b6d8d9d3ea8c0700f0a7e9d97e6c1504be4d810071a995f8202b6c001840b0880070ebc932ca502610c1b78bba46a4599fc024d221b14e71d229efdfce92667c9643d6c68fa1a60fb14538bdf20ee01e8200ad541ced811cb572539918325bf583cb2b6484bab28c5b26bafc0f194226739948bfd52e4d110a45634f5554a8a1027ba8b5b414be7ee32bae801c22b09dfc1659b1006280f8e45eefb5d33fec4d46685b19c1fbba680d32eea1ca5576f7d111be4695b489820759577938a10f21c6055eeec3c34105adc6f381a2809f7bdca2c2324144069908d0f33d53f7b31267cf4ecb897f1fa9dbcf2afaae3e109c145d090a5117c56c5da7e62a928919c457c72f74efb82f84856cba325edc3eac1f9f03b367c86f47859bcc253e3579e6363a6da6200ab75b41aaae70a7ddbf20147e1b07470c3ba1c31178309b7141f95b273e13e155bdc1b646e94ec0b02769418c9dd917786c8e93af5babd3047a45c392856fafdf40f01646b148a27f2e2a1314b4d443ba6be80aa3c367000ede41c30f21e6e653c26c6da3896ba6ab720f777663941a8d80d8ee90d1f4d78cd2ae03d698b778dc8463372944801b68328e012a310c89aeb1d3eb364186bdb0c191117d3104830d533205fe4943c715ca650d77b59467b46e91ac762865e3c323ea4c5d321ca1947f0be7b21f08c949c0c31a9af4b83bcfe7c73ae57e9c02ef2d7addcfe4d591c795dacbf662d0b07324290912288087ff35a21da1dc68e9b67f8ae0912f712bfb370190db441c51ab241f2f17d50ee97cf116cbaca1a76012096e1cda7cd3a8398a14bc90db3e3ca92db5212f0221e6d4a4d91b48ebfc411076dd411b5f87651e795d357c88da17e80938924593f71844d7601c8347c98953072e9afedee69e94e07ca9c12e7eada4677e02e8e1429834c494965d8258fd0d2708524d3df336c09c321e274dc403b8ab55afb02bb4a5faf93ad68ac35cb2765eb55a2d8eb5c73c3b0dfaa533519f00d7352b5a3d0733d01f5d78694e9f976fb7cce0b62d6aa8263251bc5af6448893611f01a50f327e228c6369d768f348b696072b76b4b6b3f638f5fa298748f178e6fe8b9b157a891a499d33226f9b72bf95eb2e6701ec44c805e26911227fe988315b2da2c370b6319440d18419971405bd8bef7ee25f8e0925cce6f5a650e571ae1dcc26e4cdeb6ea5e8bba3bb6dc8566d847c50a4f1da16582945d67b49d880bc957d45cfc750d466fff902a2c71090ce407300ebb301d0a0190acbf3eea748741cadb50625f3d935a48d21f2caf0ef9ec3a541fcc39855f67bdb80ab430824766995f027556ca34f2fe17ad221c97dfd6fe83520da94e5eb108188d365dbe1a071ca0e02d26f332546b0bd0c33607e429a444c40245af53d8d0001d5f54b097f2e43444b47f729ff21e28e4fced05b4264f6995c870f0385c48dad57835c7a4498315c833d6565c9232b3cb045f8b30af87cbda09887dc4d4f9c7d6536b03c24a262e4fb69a0b359b159927705420c737db95fbf6504353c7cf3f18ce3e1d4c8d826e4371e2e75d160b26491a84012ec8becb0fb7595814870de1e736be0ed7f7697a5d12bf10fb975cb213f6400580a9d27acb7fac287d6f7da3d1ff47335affe57480fd52ff2e76bc5ac725401b0b790f62a89af5e7deef23468602f731da5bff3a863e2973d2e12c3c67ced537e02b884f5778d73e50085ac6a54e909d2b690b47b2c391f6b460893c8525cb8e30f3a70a8f4a16650afce07df3cbad8c8fc4582268fd8581e8ad4ea825ad2027212d17c81378208945c1d48305352877cb1f215214e0282083e5c4f500a0afaba309fc6c0124a7aa172c4c95e8d5045d0e83553bac4d369a639c5b8ea1cfda667090559904ea490d305160c50d6ff99a42b7422c9923e879198a5535be4d49a78dbf34fda9aea15676bcb8a3aac832127117827022b8590de1e7c924eb9e62b75d8aede989116f4f6f12387eda128ed31b33740eb1d6d2c57c8a87bf4d533f930c19e7d3aa79ddf55bfcd606bfd58c6afce83b6daf8741e0366a995f0d62885e1a1211097993df9ef6773e83f10556d101480fd53bcc761dae4f9884f326579d8132a91a02e2e09bf8451d387b7f9a52dffbdf077cde87b9cf43df0f9a92caa768ba2867fe9282e4f99655496c662f778dba7c2a3d6a32557c43e971a511cd084eb992736fbe2e86d19bfe422b6e5eb9a2bfbadc892827e9fe72382d592edce876a2d8294de1ec9a7333ac78ddf680726964d49a4d746cd8ff5e7a55b1ea75bdc09210e7f51a2410d552553abdf404fdf100d50d218"}) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000440)=ANY=[@ANYBLOB="8fcacb7907051175f37538e486dd6300800701082c00db5b686158bbcfe8875a060300000023000000000000000000000000ac1414aa"], 0xfdef) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x40241, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r12 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r12, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @broadcast}) write$tun(r11, &(0x7f0000001440)={@val={0x8, 0x800}, @val={0x5, 0x0, 0x6, 0x0, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x2, 0x2, 0xfde1, 0x66, 0x0, 0xb, 0x89, 0x0, @rand_addr=0x64010102, @broadcast}, "3297e3ba"}}, 0xfdef) close(r10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r9, &(0x7f0000000440)=ANY=[], 0xfdef) read$FUSE(r8, &(0x7f0000000600)={0x2020}, 0x2020) syz_ublk_setup_queues(r7, r4, 0x0, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x200, 0x1000000, 0x33f, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x20, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3acc, 0x6449, 0x0, 0xfffffffd, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x40, 0x2, 0xffffffff}}], 0x1, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x30000, 0x0) 561.844114ms ago: executing program 0 (id=343): ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)={0x23, 0x0, [{0x40000235, 0xed, 0x1}, {0x2cb, 0x0, 0x7f}, {0x8f7, 0x0, 0x5}, {0xa00, 0x0, 0x80000001}]}) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0xfffffdfffffffffe) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_GET_MSRS_cpu(r4, 0xc008ae88, &(0x7f0000000200)={0x1, 0x0, [{0x40000080, 0x0, 0xffffffff00000001}]}) r5 = socket(0x40000000015, 0x5, 0x0) connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r5, 0x114, 0x8, &(0x7f00000008c0)=0xffffffffffffffff, 0x4) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r5, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000004c0)="0000000000303e97380e90231bdbdaf6a4bd77eabcd3866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9d00000c0a498396b28c7d1784d04aa38922721cb781608144284d90a72d7d2e3152d201ed78ffb6e711b889cda0346ce9bca2e6e9e46b15980456c43a659f427e3e6e9e16e0de93100734d409ca57c27d3bde66b2791c1b2f7032f3cc02c85c43e8652f13258bd412174ea931f1d39a9830e593761d91c56f637f0e1568ea66a15d9f0eba504ab3eb205fda13d1068e7692f8d00a2d92d2fb48887b6f71c6de43a923bbcaa9e3ac5bd82ac0ec00000000000000000000000000000000e48251271d0ed111d9ed7f4d18ee4aa30240843ed560aeebee209d8c557e60e69e634b37c43235e062634e8f0932582eb91d27c5c81911c5a4d57ea2813573aec3a6909f30f29c535a", 0x142}, {&(0x7f0000000d00)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fbc84589ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe953054720185010000f1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe0", 0x33f}], 0x2}, 0x0) setsockopt$RDS_CONG_MONITOR(r5, 0x114, 0x6, &(0x7f0000000040), 0x4) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000200)={[0xe47, 0x9, 0xfffffffffffffffd, 0x10000000, 0x10000, 0x3, 0x4002004c2, 0x7ff, 0x800000000001, 0x0, 0x400, 0x82, 0x88, 0x0, 0x8, 0x8d], 0xeeee8000, 0x240406}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000002c0)={0xa}) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002780)=ANY=[@ANYBLOB="640000000206010800000000000000000100000a16000300686173683a6e65742c706f72742c6e6574000000050001000700000005000500020000000900020073797a310000000005000400000000001400078008000840000000f1080006"], 0x64}, 0x1, 0x0, 0x0, 0x2006c0c4}, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x14, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000100000000000000100a0030603b000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="0000000000000000000000000000000000000000000000000400000000000000fffffffffffffffffdffffffffffffff0100000000000000fcfffffffffffffffdffffffffffffff00000000000000000000000000000100ffffffffffffffff00"/112], 0xb8}}, 0x0) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b800000015"], 0xb8}}, 0x0) r9 = dup3(r0, r4, 0x0) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r9, 0x4018aee2, &(0x7f00000001c0)=@attr_irq_timer={0x0, 0x1, 0x0, &(0x7f0000000040)=0x11}) ioctl$KVM_RUN(r6, 0xae80, 0x0) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmmsg$inet(r10, &(0x7f0000002180)=[{{&(0x7f0000000400)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10, &(0x7f0000002040)=[{&(0x7f0000000440)="7f023b975c36df0c255f5b16b4c77092f45f0078c4bd55b18ac5970ca6e6e0bbf0ce8b2653a5cd33a1f0a1d0dc6fa0cea6dc03c629a74bbed55a427ed5612235bc608557d38d7f5e18c9264cd0", 0x4d}, {&(0x7f0000000640)="4a05101e98b14a5081", 0x9}, {&(0x7f0000000680)="6625b9b1a791f3712b65813f39dabb267bdd2e4472293385d986ed2dc4cd370c51c88afc5dac143bacce127636b2e98d5984c35d117e5fd1004bf11872de5bd404b0c7c5e2a588818093be8834472d61fc86a462fcddb93d17b16e545f59e69fe598721ef1e1643be07f07d59b9aba37bc159c8aef2a8ea2e826c7b78415890585ee26b463f1bb644e9035cf68e60b5e31c082b3dc263e25930b23737299b9217b94a2ea67084f0acb237c98edb5edbdf59e6205c33f19551600a1fc9844415e80f1ee2fbf891057dab0", 0xca}, {&(0x7f0000000780)="f2ace213dba4c8289c30fb019cd0e7181cea7642e9613098c4089d57cf1ab0dfb93b7889e95509acee0225c0bec109fd32b2e975b58d3c4c75efcaf1179dde263ec9097a65d93a46bf49b86861189dc3dfb753abf5cd64cb57ef99b017d4152a35f292258d43d1de80048046132558235ee3", 0x72}, {&(0x7f0000000900)="51a4c8643f7a2c68d38cd2c73c0da19fc6222217b9dfa56373d08d078bab5fa76b425b418febaa1dffe1b0cb5740b52da7bb54ed781543a5aea17803161861a78af56963c503b6c8f2771fc3cfd9d5ebed9e0f4ae055b9b0e63d7c01d2b4e3ca679f310be8f7dc1eb8b08bc3da89ee6289c92aae84c1f1909fa10edbe52b5978b5799d1781214aa9eb51d8c5e1ac76746b1e11f7084a3136ae47b79ce5ae4b0cc8912dbb9fc95b2150cd0f0c5de89a34f2302c0809d32879f1f16815a422256636d40be8855e5ca0cae768584867b1e547", 0xd1}, {&(0x7f0000000a00)="edb48746c827a3be4b70f05a21ca09d2e69d5e3594ba8d64af94c24bc47440cf1e1940fbd5aa6f6db3c7f447c2003263d8d80ec6713e224aaab3d143db9ca9d883d72c76b954d4e392a3325b", 0x4c}, {&(0x7f0000000a80)="1689e54427a3adab482d06888eebde6b8fc66872984ac4aee7d8a808402a0567682925e4551be4546190709d25049b74c834c54ea8e065567a97d38a9cb0d04498cb60e877391b85aa62ce3a872d637ceb49ffa94a7217097162bf2161807aaa8fea6541f9653b3cc812a141f502a4a42cb96a481160706761cb669a9d29cf10cd5b56db6606172ec3fb176ecec0a5b86be032d57f95c267c92ed87c3c1e5a387b12d5f7a512dea755d299c1886bfa13253d9b5f", 0xb4}, {&(0x7f0000000b40)="2baab6c859a015060baba4c7650b7b3b1950a15f4b942349673acde73a2e1dacd678daf27e247c5c39496d75e85bacb463abe53db049506fee34899896d0cf6e70d4331f695e7f281299a374efca54e0939eed0c090c95972dfdcef1465cc4668c629b", 0x63}, {&(0x7f0000001040)="f2b7355b28777f46ad75f9a079fd354c1208866ce96f3809ae3f423724b042eec9cdffb343612e2134b22d9287397351bfd3e8fe7771c45c47c6221055c275a6ca88a40bd6f41ca82c22e360b118edc91cd46823a52d0aef9bdd3e52e17449cbeb6b08692f6f323a898033363aa051873b3819f0231407c2a383180077dee2d56ef1b1a162bd508e2f208641521d3b06054909bd3d0466964621ba8c802c1276010912954788454a4e74290c562d3dc4be27fd14f6d5fd145333d8fffeec6c14265004060329098afc2cb8346075277055a865431d95efda4c14ca08cd0aa3e71d5c577493e53861b738c6b93be505b0e01b75ff4d2bbbb8f1f89edf0edd672ad79f69139b2d27da1752cb3cf65e24c0cb33865474697355f11de2ad686d44f84c456c5f45f836a948d089edebf5f31d8b73a6838b6fd7e8760996bf36ba94c4bf73e971e3bc99670af20f4f17de50618435186b74488c676dda09bb09ba5817cf843d9248898326d4ef3fcfc27e9a4d675f343d2f7e18139fdffbcb0ac53d02577fd1e5510c8b40dd292d7aceb2660f39eadcfaa00b07c2a53992e800737ebc81b0d9f3227efdcbd183eacd2dc222141ba536cb008f9aa6bbb5d5f473f0ca6693cef4586bd23c042b81f6d3166dbb2cbadfbbe438d9a89e4d63f6e70dddb146ca8d247718143a01b9f3699da18f930fe231829510f2e2d5c5e3e27d8294851ab7ecc619c7b33637f30b483f3e5a728a733ed937fbd55c4487edcba62e7483a11d047cf4c95dc41f0a54c8c7ea19b795673b7af6f8dcc90618b9a5bd0c545473469d0c49f87b392cc80aa783cc3fc72a5ced71b8622a185ece9755ab2813354218ba9041e3f48f39dc667b83b93e066b2055f12702809332651727637f046d631b6613779e5da04cc6cc7183057e16fcd63f7e48561569d2060039833d44583098ddf6b3eebdb433e5899a4400ed3c9b91ead37e212c6e99a910d5cb41768d0d80230f653b33c92326eeec1094c578059facbf186d7294e08744826db1f843291e6b801ea18967d7bfd3a5480449e4b790d44a627c7eaa8122737feac9b3059418f4c7c91d553d3149eef038aabf594341b401bdeec5c78a6acb0b462caa6e99da7744dd60055f597140222c1b55e5d84a82479989b9371034d45d96d28d01d4f2bfb00ddc313d813edf72e1a31205348ebb9d5a74b3332b2466e9b66033699fcac5010ce6890530b19ad34c094cd300759f0f05aa564a8057be13e3f1fe3653b08db53620382adb03ef0412597322f9d6c1ea9fe7754517565c8ca73d9a43d670bfb06104f07d73c5165051628da5dd65b0496bfb7b25210eef45a3fe59050c1fcf7c1b08a4524388e9df984adcc4f46cb4613ee45346690221baf7d6d1c8d08570921024f8b37209b5bf511f17087c14fa66212aa94c0d1151bba6bc8205656769c76ce1794a7c040d40adacebc8213a4ec0c759b7fbf8e71fe264297426ec12360d6c8f2ac9f30b609e22b4e7d72878965c7db609a4acbd67272f09cd9cb0656ef960aec4baf0049e72ff25659ce4057454c000bf060365205cf576282cbc2155d5640daaeb26376da62811d3bedddda3fdfce142cd8c1d7c4001c18deef005f293d9626f7654d51f86fefda8939e8e2a83ad12ea3e4295a8ad1167ade66996e30ae21a21a20e21fedf58e705c49fc3e278138c1d4e4b0a1bc1786497d0be98f6f22c5f8ab501888972ffe105c4256111f67e9c9bd7b85aaf4c5f9cb840e05b7f2cff9c84a00c3674a4bf76ecce9e1003b9e8258dcbba734339fc957847a05a0aad55dfdedd3196ab96bc94f91d964f3be8e8985012f48ddad982243af9484549b4fcfa23db22e7d4307729a17ac599d24f7ade240a51388dce501af710f594f9b4fe061de0637f62b02b79ee842c84b0d175df5945dd6384893bb32bfab5d8cd3e72163ef050f1555907b5cf6c6e702212c429d53455f243b4d2d2806c995522805e02419b3ecc40a85c57a76638724c8c1d929a80ab2932b6588bff7d865d3f385fde506b7d21088a50236ce27525333d7e964d4dc6740bb4408c50a58f65c4ee5e9c914dffe5dd68cbc53798465ea7fc9d83aa0a0cc09c6d64fd185874b3174717b7c677daa75fc2a5d2bfb116a1451e1475e29bf668c21ce259b9c23f5ec165bed9a20191d0c3949b8a3b55ad51a476a9d00400eb20dc4e941599053d65cc56f08deb939bdd6d72235ee92e65fda6889950418cdd43a2cb0649f17200352be2747392971406f7dfed68227324f0fa1adfa7522af1b53b086dae7e53ec954c1cb3ef2ad549eaa43135277b4d34049994972a1237d86fd4b9827cdbbc7fa57e8ea2eff2c840b6916568baaaa9e42fb19f3667a6ee58a6f470b229f357cca76cad3ae14d8a84499b31dbbe28e383fab2ff391fe453d09e7efd0078502803cafa984b29817485341b33c5134b2e823263c1d0a16a1d6b7c26df2958b3289d38f2805f0cf9fee02b479a6b0c90b7e79f36c45a01f6090c8354702953b92848faab27393617f0bdf5481b03e81e588621d6d4f1dc28ee0cac913bf8335afaeea444d0d5338505897593db309ad9bf674e5c4bf38c65a3ed4b2acc0fdc9ec989e52aa5251df04ec251e76141f318908203ef1408023f4c0a573ff47466b0c3ce2f9e4ff9be8484c19d4bf79c66cc15a3277e35b503021e6323c426567021c4927eb9958fba05341faca04be324f6a05651f5f96dc7fa4400ce85e2805fcb9f3ddde4afa553480a6dbb5620e9a0ae1fdb7c78e28d93262aee08d3d7e507b8debb50392416770f354526f785b2d0e5bf9926ddbfc1205ed767c9e8ee064680e483a4b3c1c3123da9eaac248237d0bfec9beac50f13f98da42812e1a0266a8a161426d796a3aa6c732b140da49496352e4d7b372abd8783de65c8a989a8548dadbe4a103571822a27d3e9145c0130cba05895a1e1537f3e91c625e3f7d849f24e727e967302ba033f4a4c0dd09fce8db56acf043e1b08b9e7b7846dcabbfbb657ee4368adeeab03d01cceebda7eb0bc5d1572a54720fdbe70a49debe00c366c097b6f7e6fc3a0969efcd096e7853f9e87c2380752e5d147e378c177a794d596f6d58133696dff5f0e4af8ad734aa3d3f08f37f8c457f87e3abfa9c4c3ce68f49bb528982bd2b7697015923a09ff6054ede355e4d04f29aee7a419df7a028d8c646518b47faeb4e99e8ef82e50a8b0ef64143544e9296a00964fde1cd7ac2b288b93079700f1608411eec444bd5e4f4d0d11c72610b588fe3d11a9120d1de5bf38f8481383533ffb091281fb6f9df3820fe0210ce1d6dba095a3f9c93eb5b45869d94a1600ee4d7e1ebd0dc04e046900d9eea943f175f8c30fc29fbd372358f6d6af16f73e7432f877dd00a071b2da543c79c5185a8916990f7dae09e40ed8aaaa0259437b7ba50348e637791c7ae6f5d358d7ba71fb284483e9279ca5c42409286decde2c70d61f09346022b99aad6519fac4963c6bac4c69668aec22d9fa66a21f2d87f182dc7c3fd70ba0602a9b7d97c3335d4d2fd5d6cc94dab990792025e66b9cea748b545dce934565c39ff82de2b55a122247a8f8e96d13dbaeb0744f2c42f9e4e93d71746e51a6fe06775b4b03080cea2594188b721ac19c29c5172d095d4aec3c88c5bd4363092fc4de02a5595ed607d5a3b21663d2fa6f01b61dd705b493e3cff313858a42c87c000f74a0f3539f5a29fa7bf2a7319fade6b88e801500c540e69ce26cee24cf4352ce58874451e740b4c5f8105e3f868948c53f88128789fa89ddb33d6df9920a0a14d9790340a43a96fbb937c96dc92f52656c356852ef4bbd2cfe678fd0f6f73b7351d974f7712af93429bed68ea22adeb55004535d637284e76f7c693851656bd295587b14c575a7ef404c20ddc3ebac9696a5f80641a220eec573d39c2ac13ed017a8e71f72eed045d237d68f0becfa9836ef0364e9c47f22a6b743e21b8625518464df643bbd3be2bbac3417156acd6e6bf6002ca038bcdcfe88a10455ca9c8a1904115e421b3b6537ad625d438431526a660a721355b5898c50a45c014a18b2a581ec3af87d0c3af3a9d5695e9f292b370034fbeb9f4b897e8de06b755d0c36069c92dc26d6f66e9a1f7e9836dd60378d91808c656a94f4c10222df3bf6263b474f6834936bd1657d49e167c2d0c0bf6c43534e56a429e47ad8f5d72e1734bc6646231295e0c1b6ef0d2a2e8d2e1b946a27898aefb09f2c2da09bd62e13dcb8098d7e1975bdfc9a807efa17413573447d405ad45741f04df289335856df66938c6afdd0c1b39e4833485cfa39d08662d94015d3fe9f5fa765db6c36b2c586a7fd4feac8fb252f2c6f101dcdcf3d601fb826840deb2c3f175efb833fb7769468eb03b93489ee6791b2ca1d7bbde643bdaf0070ad49b7a790c30541a7c206232a804d1b6584369d5e8276beb837affa8c01d1c4e51fe2bb7eaf62fb7b68641784763b0840e510346315f1a8a1079f22236410fadcc8635ebc2cde8288c7fbbb62dce7f056933b0e460a24d41d4f3dac43134d04fc17635ee5eb088baae3c3df34606096f2a8809fa4d62109958415d0c23c7b46e8527c7ca322de32f971dffc731bae7970cba375973c8ce0226077d81b411c140814ff9aafd8ed788c224c4a4dbd8080ff0fee3daa84bbf6fc88a945d3c8f4bced1c7edf9cb0c21953f27543d73c4e3887fef8d388653c6a0e60907ad7ab51ac4d3b7f0c9fa8d8486f323a10f577343a4a83931b80647fd8462b640d2b0de409fbd7aadd2c058667483dfcb75b659720e39c1afd79c799944d93bc9e591984b2052904584315c558d93e5c017ef0e136ffa25bc5772ae37910e635d3837b7767a879a2ed32ecb6f6fd6ca4293b28756f3df804c995698e3cc60cf84e26c9e75903ac48c59a97af81d66767ef52c50088fc79249d528ec071ea4a0def1635945b8291f40a1e31b68d7ff2904bd75fce586dbf49eb17c2a17668d7d21789059b3bdfdb5f9837995f6c1c1986b3206ba950a773e56418f9ba543a5ce20cb69010ced7a438d3b7837a932414bc65ac19eb0652cedd34cfaadaf0a7810d09aeffc5d827379d240129011299223c4984642a6b220b371a8c1ea3f08aa5a57f8d36d208928b73e00d0997d82e2591f79a950bb4cbaf75f210756280a118c35f919b7a6b1e82fbc1625534cf46121a639ca8034dad2a5930c753339228179f7bbaa575ef222ce2732372ad2331877b9ebe8635acf197e034a0fc0a31b4e3b061d93c9822b9f49f948d9aab35fecc2f22cf74e54cde3a49a747115668b88562f4f1248ae5a8df35a24db48a3cda4f619166513dd54092c6581f0fda58951e14b4afe759ab21d01d0517f645293d649335f371f5f2ce1be9a6a25b6e7cbb59c6cac76e6fa6680ad1ca5020856438fe3c176c162703775743dda9d98c0f173ae47fa12760d459ce4b8057addcd462867d81245d7936a3cbac35608d09247310fa588aa078327f21a6e7f37a962f12d6eff33d0eb6d11881c91e65c9009461d86b64c08f52f9d04a8f11a3d28eb572165b9b9bdfd3016a175584279ebf4330d78cf20fee5551882d36f8d9a09ca2c5632794f3eee0bf72b54862d7a34af44e9694a7aca29031839b750d392664526eb09b0bc6705c7bbfd3f1195c262ff8c9bb6b883c5326ea76e3938dbc0d6a2fa71587e1e5d35a8a8803a4accd312e9a220f22e50dddb9e64fe380f845d505d7c5394750dc245796a4259ab36fa5320b3535b2b9ffdacaf99e", 0x1000}], 0x9, &(0x7f0000002100)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x1}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x4}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x53ab1ee1}}], 0x60}}], 0x1, 0x5) r11 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="06000000123401002abd70000000000008004b0013000000080001000000000027fd71255b193b7b47e122586c0b665746ad2731d99177cde06b52c11b5b68879aba545eb1cd9b155b5c34145624e2e01204d2437dfeaae59df945b1316c054d735c6cfd5916480f4935fc96b007c52f99a2677b5e2aeb"], 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x8084) 393.882043ms ago: executing program 1 (id=344): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000180)=@file={0x1}, 0x6e) listen(r0, 0xfffffffd) landlock_restrict_self(0xffffffffffffffff, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) connect$unix(r1, &(0x7f0000000080)=@file={0x1}, 0x6e) 378.539989ms ago: executing program 0 (id=345): r0 = socket(0x1e, 0x1, 0x0) sendmmsg$inet(r0, &(0x7f0000000880)=[{{&(0x7f0000000080)={0x2, 0x0, @rand_addr=0xac1414bb}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)='Q', 0x34000}], 0x1}, 0x20000000}, {{&(0x7f0000000180)={0x2, 0x0, @remote}, 0x10, 0x0}}], 0x2, 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000180)=ANY=[@ANYBLOB="8aaaaaaaaaaaaaaaaaaaaa0008004500005c0000000008019078ac1e0001ac1414aaf7ff8f78032c0000400000000000000000c900000a010104ac1414aa862900000002060d5e000000ff000000f5870000050404a60011960605390006fff5800000b61af93a"], 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYRES16, @ANYBLOB="010000000000000000001400000008000200fc0000001800018014"], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8890}, 0x20004450) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x8040}, 0x0) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x268}) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='comm\x00') ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ptrace(0x10, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x14, 0x0, 0x1}, 0x14}}, 0x0) munmap(&(0x7f0000138000/0x4000)=nil, 0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) read(r2, &(0x7f0000000300)=""/172, 0xdc) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) getdents(r4, &(0x7f00000000c0)=""/207, 0xcf) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c0000007800010402000000000000000700000064000000140001"], 0x2c}}, 0x0) socket$netlink(0x10, 0x3, 0x0) 272.333209ms ago: executing program 1 (id=346): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0xc000) 272.074484ms ago: executing program 1 (id=347): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x80000000) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x9d) syz_emit_ethernet(0x32, &(0x7f00000007c0)={@random="e90c610faca2", @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x3, 0x11, 0x0, @empty, @empty}, {0x0, 0xfffe, 0x27, 0x0, @gue={{0x2, 0x0, 0x2, 0x1}}}}}}}, 0x0) syz_emit_ethernet(0xbe, &(0x7f0000000300)={@link_local, @local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x2, 0x8, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "2a995ffbee74ab1b3690842deee3df48f8806827d5c763698c4c288abc85bfcc", "9f6cf565ebbd4ddfc4f9c023b431968db6dbc868705956f8baf975b8cb6e17048850e8e89f732bced1e3baee50e5acb8", "112c482ee3d37cb1a7a31c450e403a6ee32477eaeb41d283c8618b26", {"6652725f56c59b04563b19a79d293550", "25b048c89cb27902d8d629c56b49c550"}}}}}}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x4840) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x2101, 0x0, 0x0) 0s ago: executing program 0 (id=348): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000480)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='1\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='dummy_udc.0\n', 0xc) close(r4) nanosleep(&(0x7f00000006c0)={0x0, 0x5f5e100}, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000700), 0x1, 0x2) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) r6 = syz_open_dev$sg(&(0x7f0000000700), 0x0, 0x2) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:50540' (ED25519) to the list of known hosts. [ 42.785433][ T5726] cgroup: Unknown subsys name 'net' [ 42.916347][ T5726] cgroup: Unknown subsys name 'cpuset' [ 42.919913][ T5726] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 43.857643][ T5726] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 48.354716][ T5739] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 48.357316][ T5739] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 48.358974][ T5739] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 48.371314][ T5743] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 48.373438][ T5097] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 48.374334][ T5743] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 48.377701][ T5097] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 48.381129][ T5747] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 48.383582][ T5747] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 48.384073][ T5745] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 48.384141][ T5747] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 48.384734][ T5745] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 48.388046][ T5750] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 48.388578][ T5750] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 48.394877][ T5748] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 48.396390][ T5748] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 48.396893][ T5745] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 48.397772][ T5745] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 48.402285][ T5743] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 48.404671][ T5748] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 49.109577][ T5744] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.109691][ T5744] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.109879][ T5744] bridge_slave_0: entered allmulticast mode [ 49.111196][ T5744] bridge_slave_0: entered promiscuous mode [ 49.115100][ T5744] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.115197][ T5744] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.115288][ T5744] bridge_slave_1: entered allmulticast mode [ 49.116627][ T5744] bridge_slave_1: entered promiscuous mode [ 49.139361][ T5737] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.139488][ T5737] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.139579][ T5737] bridge_slave_0: entered allmulticast mode [ 49.140844][ T5737] bridge_slave_0: entered promiscuous mode [ 49.181152][ T5737] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.181222][ T5737] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.181316][ T5737] bridge_slave_1: entered allmulticast mode [ 49.182732][ T5737] bridge_slave_1: entered promiscuous mode [ 49.223639][ T5744] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.226918][ T5744] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.288972][ T5737] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.303655][ T5746] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.303731][ T5746] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.303789][ T5746] bridge_slave_0: entered allmulticast mode [ 49.304619][ T5746] bridge_slave_0: entered promiscuous mode [ 49.315895][ T5737] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.315969][ T5746] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.316010][ T5746] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.316076][ T5746] bridge_slave_1: entered allmulticast mode [ 49.316891][ T5746] bridge_slave_1: entered promiscuous mode [ 49.334459][ T5744] team0: Port device team_slave_0 added [ 49.334651][ T5741] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.334727][ T5741] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.334821][ T5741] bridge_slave_0: entered allmulticast mode [ 49.336130][ T5741] bridge_slave_0: entered promiscuous mode [ 49.354298][ T5744] team0: Port device team_slave_1 added [ 49.361560][ T5741] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.361644][ T5741] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.361731][ T5741] bridge_slave_1: entered allmulticast mode [ 49.363049][ T5741] bridge_slave_1: entered promiscuous mode [ 49.389253][ T5746] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.396947][ T5737] team0: Port device team_slave_0 added [ 49.404526][ T5746] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.405321][ T5744] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.405334][ T5744] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.405355][ T5744] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.417577][ T5737] team0: Port device team_slave_1 added [ 49.419635][ T5741] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.420190][ T5744] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.420201][ T5744] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.420223][ T5744] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.448561][ T5741] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.449127][ T5737] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.449141][ T5737] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.449163][ T5737] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.458015][ T5746] team0: Port device team_slave_0 added [ 49.461225][ T5746] team0: Port device team_slave_1 added [ 49.461892][ T5737] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.461904][ T5737] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.461925][ T5737] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.508176][ T5741] team0: Port device team_slave_0 added [ 49.510016][ T5741] team0: Port device team_slave_1 added [ 49.527863][ T5746] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.527881][ T5746] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.527905][ T5746] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.544616][ T5744] hsr_slave_0: entered promiscuous mode [ 49.545527][ T5744] hsr_slave_1: entered promiscuous mode [ 49.547870][ T5746] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.547883][ T5746] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.547906][ T5746] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.589861][ T5741] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.589878][ T5741] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.589898][ T5741] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.612552][ T5737] hsr_slave_0: entered promiscuous mode [ 49.613295][ T5737] hsr_slave_1: entered promiscuous mode [ 49.614033][ T5737] debugfs: 'hsr0' already exists in 'hsr' [ 49.614098][ T5737] Cannot create hsr debugfs directory [ 49.614788][ T5741] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.614801][ T5741] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.614821][ T5741] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.684566][ T5746] hsr_slave_0: entered promiscuous mode [ 49.685320][ T5746] hsr_slave_1: entered promiscuous mode [ 49.685863][ T5746] debugfs: 'hsr0' already exists in 'hsr' [ 49.685880][ T5746] Cannot create hsr debugfs directory [ 49.744730][ T5741] hsr_slave_0: entered promiscuous mode [ 49.745165][ T5741] hsr_slave_1: entered promiscuous mode [ 49.745480][ T5741] debugfs: 'hsr0' already exists in 'hsr' [ 49.745496][ T5741] Cannot create hsr debugfs directory [ 49.950786][ T5744] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 49.958232][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.968728][ T5744] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 49.974231][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.974728][ T5744] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 49.977343][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.977785][ T5744] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 49.979501][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.041688][ T5737] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 50.046616][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 50.047382][ T5737] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 50.052242][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 50.062550][ T5737] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 50.065673][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 50.066214][ T5737] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 50.071316][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.132850][ T5746] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 50.138345][ T5746] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 50.139212][ T5746] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 50.144227][ T5746] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 50.154792][ T5746] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 50.159447][ T5746] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 50.160154][ T5746] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 50.165979][ T5746] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.265959][ T5741] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 50.270185][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 50.274038][ T5744] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.276690][ T5741] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 50.281297][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 50.282631][ T5741] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 50.285332][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 50.292401][ T5741] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 50.296379][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.320751][ T5744] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.347509][ T5737] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.352484][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.352561][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.373129][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.373187][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.402097][ T5747] Bluetooth: hci0: command tx timeout [ 50.402265][ T5750] Bluetooth: hci2: command tx timeout [ 50.405661][ T5737] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.418808][ T5746] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.430737][ T102] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.430824][ T102] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.449409][ T102] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.449456][ T102] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.475820][ T5746] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.482788][ T5747] Bluetooth: hci3: command tx timeout [ 50.483212][ T5750] Bluetooth: hci1: command tx timeout [ 50.494650][ T5741] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.497011][ T102] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.497055][ T102] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.505631][ T102] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.506051][ T102] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.532661][ T5741] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.544204][ T114] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.544348][ T114] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.553647][ T114] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.553728][ T114] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.583648][ T5741] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 50.827076][ T5737] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.839577][ T5744] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.879393][ T5741] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.880934][ T5737] veth0_vlan: entered promiscuous mode [ 50.893830][ T5746] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.904787][ T5737] veth1_vlan: entered promiscuous mode [ 50.911251][ T5744] veth0_vlan: entered promiscuous mode [ 50.928299][ T5744] veth1_vlan: entered promiscuous mode [ 50.954551][ T5746] veth0_vlan: entered promiscuous mode [ 50.968793][ T5741] veth0_vlan: entered promiscuous mode [ 50.973809][ T5744] veth0_macvtap: entered promiscuous mode [ 50.975990][ T5744] veth1_macvtap: entered promiscuous mode [ 50.977210][ T5737] veth0_macvtap: entered promiscuous mode [ 50.980026][ T5746] veth1_vlan: entered promiscuous mode [ 50.983146][ T5741] veth1_vlan: entered promiscuous mode [ 50.984073][ T5737] veth1_macvtap: entered promiscuous mode [ 50.995497][ T5744] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.997970][ T5744] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.017628][ T5737] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 51.025587][ T5746] veth0_macvtap: entered promiscuous mode [ 51.026818][ T5741] veth0_macvtap: entered promiscuous mode [ 51.029131][ T5737] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.041323][ T5741] veth1_macvtap: entered promiscuous mode [ 51.043208][ T5746] veth1_macvtap: entered promiscuous mode [ 51.068596][ T5741] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 51.071139][ T5746] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 51.096610][ T5741] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.099651][ T5746] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.102801][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.103058][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.103078][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.103095][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.103113][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.103131][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.103148][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.103165][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.105307][ T75] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.105317][ T75] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.140214][ T1669] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.140227][ T1669] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.143725][ T5610] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.164096][ T5610] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.170905][ T114] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.170919][ T114] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.208787][ T114] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.208800][ T114] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.229434][ T5744] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 51.242648][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.242661][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.245104][ T5744] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 51.248111][ T5744] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 51.250953][ T5744] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 51.270644][ T63] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.270657][ T63] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.278885][ T5744] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 51.321403][ T5815] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.341140][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.341153][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.342790][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.342813][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.342830][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.342847][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.342863][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.363347][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.363359][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.409788][ T5891] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4'. [ 51.412822][ T5891] ptrace attach of "/syz-executor exec"[5737] was attempted by "/syz-executor exec"[5891] [ 51.912514][ T5914] FAULT_INJECTION: forcing a failure. [ 51.912514][ T5914] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 51.912535][ T5914] CPU: 0 UID: 0 PID: 5914 Comm: syz.3.11 Not tainted syzkaller #0 PREEMPT(full) [ 51.912547][ T5914] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 51.912554][ T5914] Call Trace: [ 51.912558][ T5914] [ 51.912562][ T5914] dump_stack_lvl+0x100/0x190 [ 51.912581][ T5914] should_fail_ex.cold+0x5/0xa [ 51.912595][ T5914] _copy_from_user+0x2e/0xd0 [ 51.912610][ T5914] memdup_user+0x6b/0xe0 [ 51.912620][ T5914] strndup_user+0x78/0xe0 [ 51.912631][ T5914] __do_sys_fsconfig+0x7ec/0xcb0 [ 51.912648][ T5914] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 51.912665][ T5914] ? xfd_validate_state+0x129/0x190 [ 51.912688][ T5914] __do_fast_syscall_32+0x13a/0x8b0 [ 51.912707][ T5914] do_fast_syscall_32+0x32/0x70 [ 51.912723][ T5914] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 51.912737][ T5914] RIP: 0023:0xf7f57fec [ 51.912748][ T5914] Code: Unable to access opcode bytes at 0xf7f57fc2. [ 51.912753][ T5914] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 00000000000001af [ 51.912763][ T5914] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000000000001 [ 51.912770][ T5914] RDX: 0000000080000080 RSI: 0000000080000400 RDI: 0000000000000000 [ 51.912776][ T5914] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 51.912782][ T5914] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 51.912788][ T5914] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 51.912800][ T5914] [ 52.481917][ T5750] Bluetooth: hci2: command tx timeout [ 52.481949][ T5750] Bluetooth: hci0: command tx timeout [ 52.571965][ T5747] Bluetooth: hci3: command tx timeout [ 52.572010][ T5750] Bluetooth: hci1: command tx timeout [ 52.630366][ T5942] mmap: syz.1.23 (5942) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 52.834066][ T5951] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 52.834087][ T5951] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 52.834577][ T5953] vhci_hcd: xmit failed -107 [ 52.836762][ T5951] vhci_hcd vhci_hcd.0: Device attached [ 52.839156][ T5815] vhci_hcd vhci_hcd.0: stop threads [ 52.840697][ T5815] vhci_hcd vhci_hcd.0: release socket [ 52.840713][ T5815] vhci_hcd vhci_hcd.0: disconnect device [ 52.891434][ T5960] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 52.891445][ T5960] IPv6: NLM_F_CREATE should be set when creating new route [ 52.891936][ T5960] Zero length message leads to an empty skb [ 53.125178][ T5971] syz_tun: entered allmulticast mode [ 53.141524][ T5830] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 53.251557][ T5971] syz_tun: left allmulticast mode [ 53.292797][ T5830] usb 7-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 53.294152][ T5830] usb 7-1: config 0 has an invalid interface number: 251 but max is 0 [ 53.294172][ T5830] usb 7-1: config 0 has no interface number 0 [ 53.300480][ T5830] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.300501][ T5830] usb 7-1: Product: syz [ 53.300512][ T5830] usb 7-1: Manufacturer: syz [ 53.300524][ T5830] usb 7-1: SerialNumber: syz [ 53.304688][ T5975] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 53.308262][ T5830] usb 7-1: config 0 descriptor?? [ 53.549739][ T5830] asix 7-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 53.549760][ T5830] asix 7-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -71 [ 53.550620][ T5830] asix 7-1:0.251: probe with driver asix failed with error -5 [ 53.552511][ T5830] usb 7-1: USB disconnect, device number 2 [ 53.631447][ T989] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 53.671947][ T50] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 53.782948][ T989] usb 6-1: New USB device found, idVendor=06cd, idProduct=0107, bcdDevice= 1.00 [ 53.783763][ T989] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 53.787534][ T989] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.787547][ T989] usb 6-1: Product: syz [ 53.787554][ T989] usb 6-1: Manufacturer: syz [ 53.787561][ T989] usb 6-1: SerialNumber: syz [ 53.791830][ T989] keyspan 6-1:1.0: Keyspan 1 port adapter converter detected [ 53.791915][ T989] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 84 [ 53.792840][ T989] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 81 [ 53.792875][ T989] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 82 [ 53.792905][ T989] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 1 [ 53.792935][ T989] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 2 [ 53.792964][ T989] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 83 [ 53.792995][ T989] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 3 [ 53.798363][ T989] usb 6-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 53.841475][ T50] usb 5-1: Using ep0 maxpacket: 16 [ 53.964894][ T50] usb 5-1: unable to get BOS descriptor or descriptor too short [ 53.964920][ T50] usb 5-1: New USB device found, idVendor=1397, idProduct=00bd, bcdDevice= 0.40 [ 53.965559][ T50] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 53.965575][ T50] usb 5-1: can't read configurations, error -71 [ 54.319871][ T6000] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input5 [ 54.470641][ T5112] usb 6-1: USB disconnect, device number 2 [ 54.475809][ T5112] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 54.476180][ T5112] keyspan 6-1:1.0: device disconnected [ 54.572633][ T5747] Bluetooth: hci2: command tx timeout [ 54.572685][ T5750] Bluetooth: hci0: command tx timeout [ 54.641776][ T5747] Bluetooth: hci3: command tx timeout [ 54.642106][ T5750] Bluetooth: hci1: command tx timeout [ 54.671443][ T5822] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 54.831931][ T5822] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 54.832738][ T5822] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 54.832754][ T5822] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 54.832765][ T5822] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 54.832784][ T5822] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.834080][ T5822] usb 8-1: config 0 descriptor?? [ 54.975243][ T6039] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 55.266124][ T5822] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw1: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 55.419309][ T6070] netlink: 4 bytes leftover after parsing attributes in process `syz.0.54'. [ 55.682615][ T6080] bridge0: port 3(syz_tun) entered blocking state [ 55.682700][ T6080] bridge0: port 3(syz_tun) entered disabled state [ 55.682789][ T6080] syz_tun: entered allmulticast mode [ 55.683531][ T6080] syz_tun: entered promiscuous mode [ 55.684008][ T6080] bridge0: port 3(syz_tun) entered blocking state [ 55.684053][ T6080] bridge0: port 3(syz_tun) entered forwarding state [ 55.696390][ T6080] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 55.769058][ T6082] input: syz0 as /devices/virtual/input/input7 [ 56.218427][ T6090] syz.2.62 uses obsolete (PF_INET,SOCK_PACKET) [ 56.651469][ T5750] Bluetooth: hci0: command tx timeout [ 56.651493][ T5750] Bluetooth: hci2: command tx timeout [ 56.723730][ T5747] Bluetooth: hci1: command tx timeout [ 56.723765][ T5747] Bluetooth: hci3: command tx timeout [ 56.776245][ T6113] digital: digital_start_poll: Unknown protocol [ 57.066444][ T6130] capability: warning: `syz.3.78' uses 32-bit capabilities (legacy support in use) [ 57.176569][ T6141] bond1: entered allmulticast mode [ 57.176850][ T6141] 8021q: adding VLAN 0 to HW filter on device bond1 [ 57.187608][ T6141] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 57.188338][ T6141] macvlan2: entered allmulticast mode [ 57.188348][ T6141] bond0: entered allmulticast mode [ 57.188355][ T6141] bond_slave_0: entered allmulticast mode [ 57.188364][ T6141] bond_slave_1: entered allmulticast mode [ 57.188424][ T6141] bond_slave_0: entered promiscuous mode [ 57.188441][ T6141] bond_slave_1: entered promiscuous mode [ 57.189467][ T6141] bond1: (slave macvlan2): Enslaving as a backup interface with an up link [ 57.280411][ T5112] usb 8-1: USB disconnect, device number 2 [ 57.345676][ T6155] netlink: 'syz.0.91': attribute type 10 has an invalid length. [ 57.358109][ T6155] team0 (unregistering): Port device team_slave_0 removed [ 57.360631][ T6155] team0 (unregistering): Port device team_slave_1 removed [ 58.231393][ T989] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 58.403339][ T989] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 58.404682][ T989] usb 5-1: config 0 has an invalid descriptor of length 129, skipping remainder of the config [ 58.404703][ T989] usb 5-1: config 0 interface 0 altsetting 251 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 58.404716][ T989] usb 5-1: config 0 interface 0 has no altsetting 0 [ 58.409346][ T989] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 58.409364][ T989] usb 5-1: Product: syz [ 58.409375][ T989] usb 5-1: Manufacturer: syz [ 58.409386][ T989] usb 5-1: SerialNumber: syz [ 58.430502][ T6190] bond1: entered allmulticast mode [ 58.430783][ T6190] 8021q: adding VLAN 0 to HW filter on device bond1 [ 58.433179][ T989] usb 5-1: config 0 descriptor?? [ 58.438267][ T6190] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 58.440096][ T6190] macvlan2: entered allmulticast mode [ 58.440106][ T6190] bond0: entered allmulticast mode [ 58.440112][ T6190] bond_slave_0: entered allmulticast mode [ 58.440120][ T6190] bond_slave_1: entered allmulticast mode [ 58.440146][ T6190] bond_slave_0: entered promiscuous mode [ 58.440163][ T6190] bond_slave_1: entered promiscuous mode [ 58.440418][ T6190] bond1: (slave macvlan2): Enslaving as a backup interface with an up link [ 58.499648][ T6195] netlink: 'syz.3.104': attribute type 10 has an invalid length. [ 58.514332][ T6195] team0 (unregistering): Port device team_slave_0 removed [ 58.520614][ T6195] team0 (unregistering): Port device team_slave_1 removed [ 58.719110][ T989] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 58.721606][ T989] usb 5-1: USB disconnect, device number 4 [ 58.734137][ T5754] udevd[5754]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 58.741680][ T10] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 58.811480][ T5750] Bluetooth: hci3: command tx timeout [ 58.891537][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 58.892265][ T10] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 58.893158][ T10] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 58.893185][ T10] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 58.893220][ T10] usb 6-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 58.893240][ T10] usb 6-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 58.893259][ T10] usb 6-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 58.893278][ T10] usb 6-1: config 0 interface 0 has no altsetting 0 [ 58.895099][ T10] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 58.895117][ T10] usb 6-1: Product: syz [ 58.895127][ T10] usb 6-1: Manufacturer: syz [ 58.895138][ T10] usb 6-1: SerialNumber: syz [ 58.897132][ T10] usb 6-1: config 0 descriptor?? [ 58.899656][ T6193] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 58.902322][ T10] ldusb 6-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 58.906168][ T10] ldusb 6-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 58.988136][ T6197] netlink: 4 bytes leftover after parsing attributes in process `syz.2.105'. [ 59.396213][ T6220] bond1: option mode: unable to set because the bond device has slaves [ 59.417485][ T6220] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 59.452568][ T5822] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 59.603745][ T5822] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 59.604591][ T5822] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 59.604603][ T5822] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 59.605758][ T5822] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 59.605770][ T5822] usb 5-1: Product: syz [ 59.605777][ T5822] usb 5-1: Manufacturer: syz [ 59.811790][ T58] usb 5-1: USB disconnect, device number 5 [ 60.137915][ T58] usb 6-1: USB disconnect, device number 3 [ 60.137985][ C0] ldusb 6-1:0.0: usb_submit_urb failed (-19) [ 60.150300][ T58] ldusb 6-1:0.0: LD USB Device #0 now disconnected [ 60.356853][ T6237] syzkaller1: entered promiscuous mode [ 60.356954][ T6237] syzkaller1: entered allmulticast mode [ 60.457663][ T6242] syzkaller1: entered allmulticast mode [ 60.460999][ T6242] netlink: 8 bytes leftover after parsing attributes in process `syz.2.122'. [ 60.581478][ T5822] usb 8-1: new full-speed USB device number 3 using dummy_hcd [ 60.603703][ T6246] dummy0: entered allmulticast mode [ 60.606080][ T6246] dummy0: left allmulticast mode [ 60.691133][ T6251] FAULT_INJECTION: forcing a failure. [ 60.691133][ T6251] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 60.691155][ T6251] CPU: 0 UID: 0 PID: 6251 Comm: syz.1.126 Not tainted syzkaller #0 PREEMPT(full) [ 60.691169][ T6251] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 60.691176][ T6251] Call Trace: [ 60.691180][ T6251] [ 60.691186][ T6251] dump_stack_lvl+0x100/0x190 [ 60.691205][ T6251] should_fail_ex.cold+0x5/0xa [ 60.691219][ T6251] ? prepare_alloc_pages+0x16d/0x5b0 [ 60.691238][ T6251] should_fail_alloc_page+0xeb/0x140 [ 60.691256][ T6251] prepare_alloc_pages+0x1f0/0x5b0 [ 60.691274][ T6251] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 60.691287][ T6251] ? __pfx_get_page_from_freelist+0x10/0x10 [ 60.691298][ T6251] ? prepare_alloc_pages+0x1f0/0x5b0 [ 60.691312][ T6251] ? is_bpf_text_address+0x94/0x1a0 [ 60.691351][ T6251] ? rcu_is_watching+0x13/0xc0 [ 60.691364][ T6251] ? __alloc_frozen_pages_noprof+0x56b/0x3300 [ 60.691378][ T6251] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 60.691394][ T6251] ? stack_trace_save+0x8e/0xc0 [ 60.691409][ T6251] ? __pfx_stack_trace_save+0x10/0x10 [ 60.691431][ T6251] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 60.691446][ T6251] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 60.691458][ T6251] ? is_bpf_text_address+0x94/0x1a0 [ 60.691478][ T6251] ? kasan_save_track+0x14/0x30 [ 60.691491][ T6251] ? __kasan_slab_alloc+0x89/0x90 [ 60.691505][ T6251] ? kmem_cache_alloc_node_noprof+0x282/0x6e0 [ 60.691519][ T6251] ? alloc_vmap_area+0x1814/0x2bb0 [ 60.691532][ T6251] ? __get_vm_area_node+0x1ed/0x350 [ 60.691546][ T6251] ? __vmalloc_node_range_noprof+0x268/0x1420 [ 60.691561][ T6251] ? __vmalloc_node_noprof+0xad/0xf0 [ 60.691576][ T6251] ? n_tty_open+0x1a/0x170 [ 60.691592][ T6251] ? tty_ldisc_open+0xa2/0x120 [ 60.691602][ T6251] ? tty_ldisc_setup+0x40/0xf0 [ 60.691614][ T6251] ? tty_init_dev.part.0+0x1b5/0x470 [ 60.691628][ T6251] ? tty_init_dev+0x60/0x80 [ 60.691642][ T6251] ? ptmx_open+0x128/0x360 [ 60.691652][ T6251] ? chrdev_open+0x234/0x6a0 [ 60.691665][ T6251] ? do_dentry_open+0x6ab/0x14d0 [ 60.691680][ T6251] alloc_pages_bulk_noprof+0x5e1/0x13c0 [ 60.691694][ T6251] ? policy_nodemask+0xed/0x4f0 [ 60.691712][ T6251] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 60.691733][ T6251] __kasan_populate_vmalloc+0xf0/0x210 [ 60.691749][ T6251] alloc_vmap_area+0x95d/0x2bb0 [ 60.691767][ T6251] ? kasan_save_track+0x14/0x30 [ 60.691779][ T6251] ? __kasan_kmalloc+0xaa/0xb0 [ 60.691791][ T6251] ? __pfx_alloc_vmap_area+0x10/0x10 [ 60.691806][ T6251] ? __get_vm_area_node+0x124/0x350 [ 60.691821][ T6251] __get_vm_area_node+0x1ed/0x350 [ 60.691838][ T6251] __vmalloc_node_range_noprof+0x268/0x1420 [ 60.691854][ T6251] ? n_tty_open+0x1a/0x170 [ 60.691871][ T6251] ? lock_acquire+0x1d1/0x380 [ 60.691888][ T6251] ? n_tty_open+0x1a/0x170 [ 60.691906][ T6251] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 60.691925][ T6251] ? __pfx___ldsem_down_write_nested+0x10/0x10 [ 60.691943][ T6251] ? n_tty_open+0x1a/0x170 [ 60.691959][ T6251] __vmalloc_node_noprof+0xad/0xf0 [ 60.691974][ T6251] ? n_tty_open+0x1a/0x170 [ 60.691990][ T6251] ? __pfx_n_tty_open+0x10/0x10 [ 60.692006][ T6251] n_tty_open+0x1a/0x170 [ 60.692022][ T6251] tty_ldisc_open+0xa2/0x120 [ 60.692035][ T6251] tty_ldisc_setup+0x40/0xf0 [ 60.692049][ T6251] tty_init_dev.part.0+0x1b5/0x470 [ 60.692066][ T6251] tty_init_dev+0x60/0x80 [ 60.692081][ T6251] ? __pfx_ptmx_open+0x10/0x10 [ 60.692091][ T6251] ptmx_open+0x128/0x360 [ 60.692103][ T6251] ? __pfx_ptmx_open+0x10/0x10 [ 60.692114][ T6251] chrdev_open+0x234/0x6a0 [ 60.692127][ T6251] ? __pfx_apparmor_file_open+0x10/0x10 [ 60.692144][ T6251] ? __pfx_chrdev_open+0x10/0x10 [ 60.692158][ T6251] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 60.692176][ T6251] do_dentry_open+0x6ab/0x14d0 [ 60.692187][ T6251] ? __pfx_chrdev_open+0x10/0x10 [ 60.692203][ T6251] vfs_open+0x82/0x3f0 [ 60.692220][ T6251] path_openat+0x19fa/0x2440 [ 60.692235][ T6251] ? __pfx_path_openat+0x10/0x10 [ 60.692252][ T6251] do_file_open+0x20e/0x430 [ 60.692266][ T6251] ? __pfx_do_file_open+0x10/0x10 [ 60.692289][ T6251] ? _raw_spin_unlock+0x28/0x50 [ 60.692303][ T6251] ? alloc_fd+0x471/0x7a0 [ 60.692320][ T6251] do_sys_openat2+0x10f/0x1e0 [ 60.692336][ T6251] ? __pfx_do_sys_openat2+0x10/0x10 [ 60.692351][ T6251] ? do_sock_setsockopt+0x101/0x1d0 [ 60.692367][ T6251] ? kfree+0x1e5/0x6d0 [ 60.692383][ T6251] ? udp_setsockopt+0x6b/0xb0 [ 60.692402][ T6251] __ia32_compat_sys_openat+0x12d/0x210 [ 60.692427][ T6251] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 60.692471][ T6251] __do_fast_syscall_32+0x13a/0x8b0 [ 60.692494][ T6251] do_fast_syscall_32+0x32/0x70 [ 60.692513][ T6251] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 60.692528][ T6251] RIP: 0023:0xf7fb2fec [ 60.692543][ T6251] Code: Unable to access opcode bytes at 0xf7fb2fc2. [ 60.692548][ T6251] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 60.692559][ T6251] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800000c0 [ 60.692566][ T6251] RDX: 0000000000080782 RSI: 0000000000000000 RDI: 0000000000000000 [ 60.692572][ T6251] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 60.692578][ T6251] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 60.692584][ T6251] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 60.692597][ T6251] [ 60.698008][ T6251] syz.1.126: vmalloc error: size 9112, align 0x1, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 60.698087][ T6251] CPU: 0 UID: 0 PID: 6251 Comm: syz.1.126 Not tainted syzkaller #0 PREEMPT(full) [ 60.698102][ T6251] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 60.698108][ T6251] Call Trace: [ 60.698121][ T6251] [ 60.698126][ T6251] dump_stack_lvl+0x100/0x190 [ 60.698144][ T6251] warn_alloc.cold+0x9e/0xb2 [ 60.698157][ T6251] ? __pfx_warn_alloc+0x10/0x10 [ 60.698169][ T6251] ? lockdep_hardirqs_on+0x7d/0x110 [ 60.698189][ T6251] ? __get_vm_area_node+0x2f0/0x350 [ 60.698206][ T6251] ? __get_vm_area_node+0x22b/0x350 [ 60.698222][ T6251] __vmalloc_node_range_noprof+0xfa2/0x1420 [ 60.698239][ T6251] ? lock_acquire+0x1d1/0x380 [ 60.698258][ T6251] ? n_tty_open+0x1a/0x170 [ 60.698278][ T6251] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 60.698301][ T6251] ? __pfx___ldsem_down_write_nested+0x10/0x10 [ 60.698321][ T6251] ? n_tty_open+0x1a/0x170 [ 60.698337][ T6251] __vmalloc_node_noprof+0xad/0xf0 [ 60.698355][ T6251] ? n_tty_open+0x1a/0x170 [ 60.698372][ T6251] ? __pfx_n_tty_open+0x10/0x10 [ 60.698388][ T6251] n_tty_open+0x1a/0x170 [ 60.698407][ T6251] tty_ldisc_open+0xa2/0x120 [ 60.698426][ T6251] tty_ldisc_setup+0x40/0xf0 [ 60.698445][ T6251] tty_init_dev.part.0+0x1b5/0x470 [ 60.698466][ T6251] tty_init_dev+0x60/0x80 [ 60.698487][ T6251] ? __pfx_ptmx_open+0x10/0x10 [ 60.698503][ T6251] ptmx_open+0x128/0x360 [ 60.698521][ T6251] ? __pfx_ptmx_open+0x10/0x10 [ 60.698539][ T6251] chrdev_open+0x234/0x6a0 [ 60.698553][ T6251] ? __pfx_apparmor_file_open+0x10/0x10 [ 60.698570][ T6251] ? __pfx_chrdev_open+0x10/0x10 [ 60.698584][ T6251] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 60.698601][ T6251] do_dentry_open+0x6ab/0x14d0 [ 60.698612][ T6251] ? __pfx_chrdev_open+0x10/0x10 [ 60.698627][ T6251] vfs_open+0x82/0x3f0 [ 60.698643][ T6251] path_openat+0x19fa/0x2440 [ 60.698659][ T6251] ? __pfx_path_openat+0x10/0x10 [ 60.698675][ T6251] do_file_open+0x20e/0x430 [ 60.698689][ T6251] ? __pfx_do_file_open+0x10/0x10 [ 60.698711][ T6251] ? _raw_spin_unlock+0x28/0x50 [ 60.698725][ T6251] ? alloc_fd+0x471/0x7a0 [ 60.698740][ T6251] do_sys_openat2+0x10f/0x1e0 [ 60.698755][ T6251] ? __pfx_do_sys_openat2+0x10/0x10 [ 60.698770][ T6251] ? do_sock_setsockopt+0x101/0x1d0 [ 60.698786][ T6251] ? kfree+0x1e5/0x6d0 [ 60.698802][ T6251] ? udp_setsockopt+0x6b/0xb0 [ 60.698822][ T6251] __ia32_compat_sys_openat+0x12d/0x210 [ 60.698839][ T6251] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 60.698860][ T6251] __do_fast_syscall_32+0x13a/0x8b0 [ 60.698879][ T6251] do_fast_syscall_32+0x32/0x70 [ 60.698895][ T6251] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 60.698909][ T6251] RIP: 0023:0xf7fb2fec [ 60.698923][ T6251] Code: Unable to access opcode bytes at 0xf7fb2fc2. [ 60.698928][ T6251] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 60.698938][ T6251] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800000c0 [ 60.698945][ T6251] RDX: 0000000000080782 RSI: 0000000000000000 RDI: 0000000000000000 [ 60.698951][ T6251] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 60.698957][ T6251] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 60.698963][ T6251] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 60.698975][ T6251] [ 60.698980][ T6251] Mem-Info: [ 60.698985][ T6251] active_anon:5201 inactive_anon:415 isolated_anon:0 [ 60.698985][ T6251] active_file:7652 inactive_file:52323 isolated_file:0 [ 60.698985][ T6251] unevictable:1000 dirty:280 writeback:0 [ 60.698985][ T6251] slab_reclaimable:9368 slab_unreclaimable:50546 [ 60.698985][ T6251] mapped:24529 shmem:1489 pagetables:1152 [ 60.698985][ T6251] sec_pagetables:297 bounce:0 [ 60.698985][ T6251] kernel_misc_reclaimable:0 [ 60.698985][ T6251] free:35888 free_pcp:15258 free_cma:0 [ 60.699010][ T6251] Node 0 active_anon:100kB inactive_anon:24kB active_file:140kB inactive_file:0kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:8kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8576kB pagetables:1548kB sec_pagetables:1120kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 60.699036][ T6251] Node 1 active_anon:20704kB inactive_anon:1636kB active_file:30468kB inactive_file:209292kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:98088kB dirty:1112kB writeback:0kB shmem:3956kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:4636kB pagetables:3060kB sec_pagetables:68kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 60.699109][ T6251] Node 0 DMA free:2212kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:132kB inactive_file:0kB unevictable:0kB writepending:4kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:228kB local_pcp:104kB free_cma:0kB [ 60.699140][ T6251] lowmem_reserve[]: 0 277 277 277 277 [ 60.699160][ T6251] Node 0 DMA32 free:14600kB boost:2048kB min:14676kB low:17832kB high:20988kB reserved_highatomic:0kB free_highatomic:0kB active_anon:100kB inactive_anon:24kB active_file:8kB inactive_file:0kB unevictable:2000kB writepending:4kB zspages:0kB present:1032196kB managed:284568kB mlocked:0kB bounce:0kB free_pcp:11676kB local_pcp:3836kB free_cma:0kB [ 60.699192][ T6251] lowmem_reserve[]: 0 0 0 0 0 [ 60.699211][ T6251] Node 1 DMA32 free:126740kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0kB free_highatomic:0kB active_anon:20704kB inactive_anon:1636kB active_file:30468kB inactive_file:209292kB unevictable:2000kB writepending:1112kB zspages:2460kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:49128kB local_pcp:16224kB free_cma:0kB [ 60.699242][ T6251] lowmem_reserve[]: 0 0 0 0 0 [ 60.699261][ T6251] Node 0 DMA: 31*4kB (U) 13*8kB (U) 2*16kB (U) 21*32kB (U) 18*64kB (U) 1*128kB (U) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 2212kB [ 60.699354][ T6251] Node 0 DMA32: 16*4kB (UME) 47*8kB (UME) 37*16kB (UME) 32*32kB (UME) 26*64kB (UME) 11*128kB (UME) 13*256kB (UME) 6*512kB (M) 3*1024kB (UM) 0*2048kB 0*4096kB = 14600kB [ 60.699438][ T6251] Node 1 DMA32: 369*4kB (UM) 212*8kB (UME) 62*16kB (UME) 111*32kB (UME) 30*64kB (UME) 14*128kB (UME) 13*256kB (UME) 15*512kB (M) 12*1024kB (ME) 7*2048kB (UM) 19*4096kB (UM) = 126884kB [ 60.699529][ T6251] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 60.699538][ T6251] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 60.699545][ T6251] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 60.699553][ T6251] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 60.699561][ T6251] 62004 total pagecache pages [ 60.699564][ T6251] 544 pages in swap cache [ 60.699568][ T6251] Free swap = 118844kB [ 60.699571][ T6251] Total swap = 124996kB [ 60.699575][ T6251] 524155 pages RAM [ 60.699579][ T6251] 0 pages HighMem/MovableOnly [ 60.699582][ T6251] 212121 pages reserved [ 60.699585][ T6251] 0 pages cma reserved [ 60.699660][ T6251] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 61.031800][ T5822] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 61.243253][ T6262] evm: overlay not supported [ 61.305439][ T5822] usb 8-1: config 0 has an invalid descriptor of length 129, skipping remainder of the config [ 61.305484][ T5822] usb 8-1: config 0 interface 0 altsetting 251 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 61.305506][ T5822] usb 8-1: config 0 interface 0 has no altsetting 0 [ 61.534253][ T5822] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 61.534270][ T5822] usb 8-1: Product: syz [ 61.534277][ T5822] usb 8-1: Manufacturer: syz [ 61.534285][ T5822] usb 8-1: SerialNumber: syz [ 61.549595][ T5822] usb 8-1: config 0 descriptor?? [ 61.681620][ T10] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 61.705617][ T6283] syzkaller1: entered promiscuous mode [ 61.705639][ T6283] syzkaller1: entered allmulticast mode [ 61.778458][ T5822] snd-usb-audio 8-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 61.782249][ T5822] usb 8-1: USB disconnect, device number 3 [ 61.792071][ T5754] udevd[5754]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 61.831489][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 61.832013][ T10] usb 7-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 61.832835][ T10] usb 7-1: config index 0 descriptor too short (expected 156, got 27) [ 61.832853][ T10] usb 7-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 61.832870][ T10] usb 7-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 61.832883][ T10] usb 7-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 61.832895][ T10] usb 7-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 61.832908][ T10] usb 7-1: config 0 interface 0 has no altsetting 0 [ 61.837116][ T10] usb 7-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 61.837128][ T10] usb 7-1: Product: syz [ 61.837135][ T10] usb 7-1: Manufacturer: syz [ 61.837143][ T10] usb 7-1: SerialNumber: syz [ 61.839175][ T10] usb 7-1: config 0 descriptor?? [ 61.839679][ T6271] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 61.840730][ T10] ldusb 7-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 61.843084][ T10] ldusb 7-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 62.337659][ T6289] syz.0.140 (6289): drop_caches: 2 [ 62.787125][ T6300] netlink: 'syz.1.143': attribute type 11 has an invalid length. [ 62.787147][ T6300] netlink: 112 bytes leftover after parsing attributes in process `syz.1.143'. [ 62.981758][ T6314] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 63.074438][ T5112] usb 7-1: USB disconnect, device number 3 [ 63.074546][ C3] ldusb 7-1:0.0: usb_submit_urb failed (-19) [ 63.081099][ T5112] ldusb 7-1:0.0: LD USB Device #0 now disconnected [ 63.203568][ T6334] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 63.227750][ T6335] FAULT_INJECTION: forcing a failure. [ 63.227750][ T6335] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 63.227774][ T6335] CPU: 2 UID: 0 PID: 6335 Comm: syz.3.156 Tainted: G L syzkaller #0 PREEMPT(full) [ 63.227790][ T6335] Tainted: [L]=SOFTLOCKUP [ 63.227795][ T6335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 63.227802][ T6335] Call Trace: [ 63.227810][ T6335] [ 63.227815][ T6335] dump_stack_lvl+0x100/0x190 [ 63.227835][ T6335] should_fail_ex.cold+0x5/0xa [ 63.227848][ T6335] ? prepare_alloc_pages+0x16d/0x5b0 [ 63.227867][ T6335] should_fail_alloc_page+0xeb/0x140 [ 63.227887][ T6335] prepare_alloc_pages+0x1f0/0x5b0 [ 63.227904][ T6335] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 63.227917][ T6335] ? is_bpf_text_address+0x8a/0x1a0 [ 63.227933][ T6335] ? lock_release+0x24d/0x310 [ 63.227949][ T6335] ? bpf_ksym_find+0x124/0x1c0 [ 63.227961][ T6335] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 63.227977][ T6335] ? is_bpf_text_address+0x94/0x1a0 [ 63.227993][ T6335] ? kernel_text_address+0x8d/0x100 [ 63.228007][ T6335] ? mark_held_locks+0x40/0x70 [ 63.228022][ T6335] ? __kernel_text_address+0xd/0x30 [ 63.228036][ T6335] ? unwind_get_return_address+0x59/0xa0 [ 63.228050][ T6335] ? arch_stack_walk+0xa6/0xf0 [ 63.228063][ T6335] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 63.228080][ T6335] ? stack_trace_save+0x8e/0xc0 [ 63.228094][ T6335] ? __pfx_stack_trace_save+0x10/0x10 [ 63.228114][ T6335] ? add_lock_to_list+0x9d/0x1d0 [ 63.228130][ T6335] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 63.228148][ T6335] ? policy_nodemask+0xed/0x4f0 [ 63.228165][ T6335] alloc_pages_mpol+0x201/0x550 [ 63.228181][ T6335] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 63.228201][ T6335] alloc_pages_noprof+0x1a/0x160 [ 63.228219][ T6335] get_free_pages_noprof+0x10/0xb0 [ 63.228233][ T6335] __kasan_populate_vmalloc+0xa0/0x210 [ 63.228257][ T6335] alloc_vmap_area+0x95d/0x2bb0 [ 63.228278][ T6335] ? kasan_save_track+0x14/0x30 [ 63.228292][ T6335] ? __kasan_kmalloc+0xaa/0xb0 [ 63.228306][ T6335] ? __pfx_alloc_vmap_area+0x10/0x10 [ 63.228323][ T6335] ? __get_vm_area_node+0x124/0x350 [ 63.228341][ T6335] __get_vm_area_node+0x1ed/0x350 [ 63.228360][ T6335] __vmalloc_node_range_noprof+0x268/0x1420 [ 63.228377][ T6335] ? vc_uniscr_check+0x1a0/0x5a0 [ 63.228393][ T6335] ? check_noncircular+0x97/0x160 [ 63.228409][ T6335] ? add_lock_to_list+0x9d/0x1d0 [ 63.228424][ T6335] ? vc_uniscr_check+0x1a0/0x5a0 [ 63.228438][ T6335] ? check_prev_add+0x354/0xe60 [ 63.228455][ T6335] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 63.228477][ T6335] ? vc_uniscr_check+0x1a0/0x5a0 [ 63.228491][ T6335] __vmalloc_node_noprof+0xad/0xf0 [ 63.228507][ T6335] ? vc_uniscr_check+0x1a0/0x5a0 [ 63.228523][ T6335] vc_uniscr_check+0x1a0/0x5a0 [ 63.228541][ T6335] do_con_write+0x66b/0x4980 [ 63.228566][ T6335] ? __pfx_do_con_write+0x10/0x10 [ 63.228591][ T6335] con_write+0x23/0xb0 [ 63.228607][ T6335] n_tty_write+0x431/0x1160 [ 63.228631][ T6335] ? __pfx_n_tty_write+0x10/0x10 [ 63.228648][ T6335] ? __kasan_kmalloc+0xaa/0xb0 [ 63.228661][ T6335] ? __pfx_woken_wake_function+0x10/0x10 [ 63.228680][ T6335] ? rcu_is_watching+0x13/0xc0 [ 63.228691][ T6335] ? file_tty_write.isra.0+0x694/0x890 [ 63.228706][ T6335] ? kfree+0x1e5/0x6d0 [ 63.228746][ T6335] ? __pfx_n_tty_write+0x10/0x10 [ 63.228767][ T6335] file_tty_write.isra.0+0x4d2/0x890 [ 63.228788][ T6335] do_iter_readv_writev+0x6f7/0x930 [ 63.228809][ T6335] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 63.228826][ T6335] ? common_file_perm+0x266/0x500 [ 63.228846][ T6335] ? bpf_lsm_file_permission+0x9/0x10 [ 63.228861][ T6335] ? security_file_permission+0x76/0x210 [ 63.228880][ T6335] ? rw_verify_area+0xce/0x6d0 [ 63.228899][ T6335] vfs_writev+0x360/0xdd0 [ 63.228911][ T6335] ? __lock_acquire+0x5c0/0x1f40 [ 63.228929][ T6335] ? __pfx_vfs_writev+0x10/0x10 [ 63.228946][ T6335] ? lock_acquire+0x1d1/0x380 [ 63.228960][ T6335] ? __fget_files+0x34/0x3d0 [ 63.228977][ T6335] ? __fget_files+0x21f/0x3d0 [ 63.228992][ T6335] ? do_writev+0x13e/0x340 [ 63.229001][ T6335] do_writev+0x13e/0x340 [ 63.229011][ T6335] ? __pfx_do_writev+0x10/0x10 [ 63.229025][ T6335] __do_fast_syscall_32+0x13a/0x8b0 [ 63.229045][ T6335] ? lockdep_hardirqs_on+0x7d/0x110 [ 63.229061][ T6335] do_fast_syscall_32+0x32/0x70 [ 63.229078][ T6335] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 63.229092][ T6335] RIP: 0023:0xf7f57fec [ 63.229107][ T6335] Code: Unable to access opcode bytes at 0xf7f57fc2. [ 63.229111][ T6335] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000092 [ 63.229123][ T6335] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000008000cac0 [ 63.229131][ T6335] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 63.229137][ T6335] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 63.229145][ T6335] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 63.229152][ T6335] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 63.229166][ T6335] [ 64.941458][ T989] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 65.092170][ T989] usb 8-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 65.092662][ T989] usb 8-1: config 0 has no interfaces? [ 65.092687][ T989] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 65.099734][ T989] usb 8-1: config 0 descriptor?? [ 65.311280][ T42] usb 8-1: USB disconnect, device number 4 [ 65.337841][ T6384] netlink: 4 bytes leftover after parsing attributes in process `syz.1.178'. [ 65.557406][ T6398] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 65.563090][ T6398] loop0: detected capacity change from 0 to 65536 [ 65.656439][ T6398] md/raid1:md0: active with 1 out of 1 mirrors [ 65.657001][ T6398] md0: detected capacity change from 0 to 2048 [ 65.703536][ T6398] syz.2.184: attempt to access beyond end of device [ 65.703536][ T6398] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 65.703666][ T6398] syz.2.184: attempt to access beyond end of device [ 65.703666][ T6398] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 65.703688][ T6398] md: md0: failed to read bitmap from any device [ 65.783530][ T6405] netlink: 'syz.2.186': attribute type 10 has an invalid length. [ 65.788061][ T6405] team0 (unregistering): Port device team_slave_0 removed [ 65.789927][ T6405] team0 (unregistering): Port device team_slave_1 removed [ 66.125850][ T68] block nbd0: Receive control failed (result -32) [ 66.439799][ T38] nvmet: connect request for invalid subsystem testsubsys! [ 66.440362][ T6429] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 66.450366][ T5750] Bluetooth: hci0: SCO packet for unknown connection handle 0 [ 66.764358][ T42] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 66.770328][ T6445] bridge0: port 3(veth0_vlan) entered blocking state [ 66.770390][ T6445] bridge0: port 3(veth0_vlan) entered disabled state [ 66.770588][ T6445] veth0_vlan: entered allmulticast mode [ 66.772897][ T6445] veth0_vlan: left allmulticast mode [ 66.810103][ T6449] netlink: 'syz.0.205': attribute type 10 has an invalid length. [ 66.921448][ T42] usb 7-1: Using ep0 maxpacket: 32 [ 66.922162][ T42] usb 7-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 66.923005][ T42] usb 7-1: config index 0 descriptor too short (expected 156, got 27) [ 66.923031][ T42] usb 7-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 66.923058][ T42] usb 7-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 66.923078][ T42] usb 7-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 66.923098][ T42] usb 7-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 66.923117][ T42] usb 7-1: config 0 interface 0 has no altsetting 0 [ 66.924945][ T42] usb 7-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 66.924962][ T42] usb 7-1: Product: syz [ 66.924973][ T42] usb 7-1: Manufacturer: syz [ 66.924983][ T42] usb 7-1: SerialNumber: syz [ 66.928265][ T42] usb 7-1: config 0 descriptor?? [ 66.928954][ T6436] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 66.932707][ T42] ldusb 7-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 66.935634][ T42] ldusb 7-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 67.213312][ T6464] FAULT_INJECTION: forcing a failure. [ 67.213312][ T6464] name failslab, interval 1, probability 0, space 0, times 0 [ 67.213348][ T6464] CPU: 0 UID: 0 PID: 6464 Comm: syz.1.211 Tainted: G L syzkaller #0 PREEMPT(full) [ 67.213376][ T6464] Tainted: [L]=SOFTLOCKUP [ 67.213383][ T6464] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 67.213395][ T6464] Call Trace: [ 67.213402][ T6464] [ 67.213411][ T6464] dump_stack_lvl+0x100/0x190 [ 67.213443][ T6464] should_fail_ex.cold+0x5/0xa [ 67.213468][ T6464] should_failslab+0xc2/0x120 [ 67.213496][ T6464] __kmalloc_cache_noprof+0x91/0x6d0 [ 67.213526][ T6464] ? proc_self_get_link+0x189/0x1f0 [ 67.213554][ T6464] proc_self_get_link+0x189/0x1f0 [ 67.213577][ T6464] pick_link+0xac2/0x13c0 [ 67.213595][ T6464] ? __pfx_proc_self_get_link+0x10/0x10 [ 67.213622][ T6464] step_into_slowpath+0x9ba/0xf90 [ 67.213647][ T6464] ? __pfx_step_into_slowpath+0x10/0x10 [ 67.213694][ T6464] ? lookup_fast+0x2da/0x600 [ 67.213716][ T6464] ? inode_permission+0x374/0x620 [ 67.213748][ T6464] link_path_walk+0xf28/0x1cc0 [ 67.213778][ T6464] path_openat+0x1ac/0x2440 [ 67.213806][ T6464] ? __pfx_path_openat+0x10/0x10 [ 67.213837][ T6464] do_file_open+0x20e/0x430 [ 67.213877][ T6464] ? __pfx_do_file_open+0x10/0x10 [ 67.213920][ T6464] ? _raw_spin_unlock+0x28/0x50 [ 67.213944][ T6464] ? alloc_fd+0x471/0x7a0 [ 67.213973][ T6464] do_sys_openat2+0x10f/0x1e0 [ 67.214000][ T6464] ? __pfx_do_sys_openat2+0x10/0x10 [ 67.214025][ T6464] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 67.214058][ T6464] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 67.214085][ T6464] __ia32_compat_sys_openat+0x12d/0x210 [ 67.214114][ T6464] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 67.214152][ T6464] do_int80_emulation+0x166/0x650 [ 67.214186][ T6464] asm_int80_emulation+0x1a/0x20 [ 67.214205][ T6464] RIP: 0023:0xf71b75ab [ 67.214220][ T6464] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 67.214238][ T6464] RSP: 002b:00000000f54763cc EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 67.214258][ T6464] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f5476490 [ 67.214270][ T6464] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 67.214281][ T6464] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 67.214292][ T6464] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 67.214303][ T6464] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 67.214328][ T6464] [ 67.738185][ T6486] netlink: 'syz.0.221': attribute type 10 has an invalid length. [ 67.807407][ T6490] bond1: entered allmulticast mode [ 67.807799][ T6490] 8021q: adding VLAN 0 to HW filter on device bond1 [ 67.824132][ T6490] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 67.825351][ T6490] macvlan2: entered allmulticast mode [ 67.825366][ T6490] bond0: entered allmulticast mode [ 67.825377][ T6490] bond_slave_0: entered allmulticast mode [ 67.825491][ T6490] bond_slave_1: entered allmulticast mode [ 67.825541][ T6490] bond_slave_0: entered promiscuous mode [ 67.825571][ T6490] bond_slave_1: entered promiscuous mode [ 67.826051][ T6490] bond1: (slave macvlan2): Enslaving as a backup interface with an up link [ 68.167685][ T42] usb 7-1: USB disconnect, device number 4 [ 68.167788][ C1] ldusb 7-1:0.0: usb_submit_urb failed (-19) [ 68.177145][ T42] ldusb 7-1:0.0: LD USB Device #0 now disconnected [ 68.474726][ T6518] netlink: 'syz.3.235': attribute type 10 has an invalid length. [ 68.508926][ T6522] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 68.548682][ T6524] netlink: 244 bytes leftover after parsing attributes in process `syz.1.238'. [ 68.577785][ T6526] bond1: option mode: unable to set because the bond device has slaves [ 68.583188][ T6526] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 68.983320][ T6547] netlink: 164 bytes leftover after parsing attributes in process `syz.0.248'. [ 69.067856][ T6555] netlink: NAT attribute type 8 has unexpected length (3 != 0) [ 69.067876][ T6555] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 69.215019][ T6577] netlink: 4 bytes leftover after parsing attributes in process `syz.3.261'. [ 69.315114][ T6592] bond1: option mode: unable to set because the bond device has slaves [ 69.323808][ T6592] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 69.621514][ T58] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 69.761455][ T10] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 69.781985][ T58] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 69.783191][ T58] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 69.783208][ T58] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 69.783236][ T58] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 69.784851][ T58] usb 5-1: config 0 descriptor?? [ 69.787777][ T58] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 69.787932][ T58] dvb-usb: bulk message failed: -22 (3/0) [ 69.792016][ T58] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 69.792724][ T58] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 69.792748][ T58] usb 5-1: media controller created [ 69.793800][ T58] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 69.800793][ T58] dvb-usb: bulk message failed: -22 (6/0) [ 69.800845][ T58] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 69.803734][ T58] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb5/5-1/input/input8 [ 69.811974][ T58] dvb-usb: schedule remote query interval to 150 msecs. [ 69.811986][ T58] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 69.912263][ T10] usb 6-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 69.912795][ T10] usb 6-1: config 0 has no interfaces? [ 69.912819][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 69.914299][ T10] usb 6-1: config 0 descriptor?? [ 69.972898][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 69.972934][ T25] dvb-usb: error while querying for an remote control event. [ 69.990253][ T10] usb 5-1: USB disconnect, device number 6 [ 70.011491][ T10] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 70.122123][ T989] usb 6-1: USB disconnect, device number 4 [ 70.173895][ T6620] FAULT_INJECTION: forcing a failure. [ 70.173895][ T6620] name failslab, interval 1, probability 0, space 0, times 0 [ 70.174051][ T6620] CPU: 3 UID: 0 PID: 6620 Comm: syz.3.281 Tainted: G L syzkaller #0 PREEMPT(full) [ 70.174079][ T6620] Tainted: [L]=SOFTLOCKUP [ 70.174086][ T6620] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.174097][ T6620] Call Trace: [ 70.174103][ T6620] [ 70.174111][ T6620] dump_stack_lvl+0x100/0x190 [ 70.174140][ T6620] should_fail_ex.cold+0x5/0xa [ 70.174164][ T6620] should_failslab+0xc2/0x120 [ 70.174189][ T6620] __kmalloc_cache_node_noprof+0x94/0x720 [ 70.174213][ T6620] ? __kmalloc_cache_node_noprof+0x30c/0x720 [ 70.174234][ T6620] ? bdi_alloc+0x44/0x140 [ 70.174255][ T6620] bdi_alloc+0x44/0x140 [ 70.174274][ T6620] __alloc_disk_node+0xac/0x6b0 [ 70.174295][ T6620] __blk_alloc_disk+0xd2/0x170 [ 70.174313][ T6620] ? __pfx___blk_alloc_disk+0x10/0x10 [ 70.174344][ T6620] ? lockdep_init_map_type+0x5c/0x250 [ 70.174371][ T6620] ? lockdep_init_map_type+0x5c/0x250 [ 70.174400][ T6620] dm_create+0x5e8/0x1530 [ 70.174432][ T6620] dev_create+0x121/0x2a0 [ 70.174452][ T6620] ? __pfx_dev_create+0x10/0x10 [ 70.174479][ T6620] ctl_ioctl+0x4d2/0xcc0 [ 70.174498][ T6620] ? __pfx_dev_create+0x10/0x10 [ 70.174518][ T6620] ? __pfx_ctl_ioctl+0x10/0x10 [ 70.174561][ T6620] ? __fget_files+0x21f/0x3d0 [ 70.174587][ T6620] dm_compat_ctl_ioctl+0x23/0x30 [ 70.174607][ T6620] ? __pfx_dm_compat_ctl_ioctl+0x10/0x10 [ 70.174626][ T6620] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 70.174660][ T6620] __do_fast_syscall_32+0x13a/0x8b0 [ 70.174688][ T6620] ? lockdep_hardirqs_on+0x7d/0x110 [ 70.174716][ T6620] do_fast_syscall_32+0x32/0x70 [ 70.174744][ T6620] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 70.174768][ T6620] RIP: 0023:0xf7f57fec [ 70.174797][ T6620] Code: Unable to access opcode bytes at 0xf7f57fc2. [ 70.174806][ T6620] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 70.174829][ T6620] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c138fd03 [ 70.174841][ T6620] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 70.174853][ T6620] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 70.174865][ T6620] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 70.174876][ T6620] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 70.174900][ T6620] [ 70.277772][ T6630] netlink: 4 bytes leftover after parsing attributes in process `syz.2.286'. [ 70.965164][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.965222][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.032906][ T6670] ci_hdrc ci_hdrc.0: error -EINVAL: invalid resource (null) [ 71.032925][ T6670] ci_hdrc ci_hdrc.0: probe with driver ci_hdrc failed with error -22 [ 71.125568][ T6675] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 71.271610][ T989] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 71.358933][ T6696] faux_driver vgem: [drm] Unknown color mode 135165; guessing buffer size. [ 71.412897][ T6700] netlink: 4 bytes leftover after parsing attributes in process `syz.0.316'. [ 71.422480][ T989] usb 8-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 71.422979][ T989] usb 8-1: config 0 has no interfaces? [ 71.422995][ T989] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 71.424134][ T989] usb 8-1: config 0 descriptor?? [ 71.628108][ T25] usb 8-1: USB disconnect, device number 5 [ 72.035545][ T6704] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 72.390611][ T6728] Bluetooth: ISO socket layer initialized [ 72.545029][ T6737] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 72.571486][ T10] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 72.665652][ T6737] md: md0: raid5 would not accept array [ 72.732139][ T10] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 72.733058][ T10] usb 6-1: config 0 interface 0 altsetting 251 has an invalid descriptor for endpoint zero, skipping [ 72.733078][ T10] usb 6-1: config 0 interface 0 has no altsetting 0 [ 72.735352][ T10] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 72.735372][ T10] usb 6-1: Product: syz [ 72.735384][ T10] usb 6-1: Manufacturer: syz [ 72.735397][ T10] usb 6-1: SerialNumber: syz [ 72.739121][ T10] usb 6-1: config 0 descriptor?? [ 72.784175][ T6742] md: recover of RAID array md0 [ 72.800535][ T6742] md: md0: recover done. [ 72.806838][ T10] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 72.830308][ T5754] udevd[5754]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 72.849360][ T6744] netlink: 4 bytes leftover after parsing attributes in process `syz.2.333'. [ 72.947880][ T10] usb 6-1: USB disconnect, device number 5 [ 73.220088][ T6765] syzkaller1: entered promiscuous mode [ 73.220108][ T6765] syzkaller1: entered allmulticast mode [ 73.381513][ T42] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 73.468623][ T6767] netlink: 4 bytes leftover after parsing attributes in process `syz.0.343'. [ 73.473790][ T6767] netlink: 104 bytes leftover after parsing attributes in process `syz.0.343'. [ 73.473803][ T6767] netlink: 104 bytes leftover after parsing attributes in process `syz.0.343'. [ 73.551498][ T42] usb 8-1: Using ep0 maxpacket: 16 [ 73.553315][ T42] usb 8-1: New USB device found, idVendor=0b05, idProduct=18c6, bcdDevice= 0.00 [ 73.554629][ T42] usb 8-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 73.554655][ T42] usb 8-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 73.554677][ T42] usb 8-1: config 0 interface 0 has no altsetting 0 [ 73.554703][ T42] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 73.558471][ T42] usb 8-1: config 0 descriptor?? [ 73.679475][ T6777] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 73.980633][ T6780] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 73.998580][ T42] input: HID 0b05:18c6 as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/0003:0B05:18C6.0003/input/input9 [ 74.060252][ T6780] [ 74.061330][ T6780] ====================================================== [ 74.064280][ T6780] WARNING: possible circular locking dependency detected [ 74.067229][ T6780] syzkaller #0 Tainted: G L [ 74.069866][ T6780] ------------------------------------------------------ [ 74.072727][ T6780] syz.0.348/6780 is trying to acquire lock: [ 74.075220][ T6780] ffffffff90480980 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x20/0x440 [ 74.079012][ T6780] [ 74.079012][ T6780] but task is already holding lock: [ 74.082196][ T6780] ffff888060672390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 74.086010][ T6780] [ 74.086010][ T6780] which lock already depends on the new lock. [ 74.086010][ T6780] [ 74.090385][ T6780] [ 74.090385][ T6780] the existing dependency chain (in reverse order) is: [ 74.094246][ T6780] [ 74.094246][ T6780] -> #2 (&gi->lock){+.+.}-{4:4}: [ 74.097209][ T6780] lock_acquire+0x1d1/0x380 [ 74.099359][ T6780] __mutex_lock+0x1a4/0x1bd0 [ 74.101500][ T6780] config_usb_cfg_link+0x57/0x3a0 [ 74.103817][ T6780] configfs_symlink+0x695/0x1340 [ 74.106110][ T6780] vfs_symlink+0x178/0x4d0 [ 74.108181][ T6780] filename_symlinkat+0x2a6/0x560 [ 74.110488][ T6780] __ia32_sys_symlinkat+0x9b/0xe0 [ 74.112776][ T6780] __do_fast_syscall_32+0x13a/0x8b0 [ 74.115163][ T6780] do_fast_syscall_32+0x32/0x70 [ 74.117405][ T6780] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 74.120233][ T6780] [ 74.120233][ T6780] -> #1 (&sb->s_type->i_mutex_key#26){++++}-{4:4}: [ 74.123867][ T6780] lock_acquire+0x1d1/0x380 [ 74.126200][ T6780] down_write+0x8b/0x1f0 [ 74.128600][ T6780] configfs_depend_item_unlocked+0xf3/0x6a0 [ 74.131451][ T6780] usbg_make_tpg+0x251/0x610 [ 74.133604][ T6780] target_fabric_make_tpg+0xab/0x8c0 [ 74.136009][ T6780] configfs_mkdir+0x525/0xd40 [ 74.138168][ T6780] vfs_mkdir+0x364/0x850 [ 74.140189][ T6780] filename_mkdirat+0x48b/0x5e0 [ 74.142416][ T6780] __ia32_sys_mkdirat+0x88/0xc0 [ 74.144662][ T6780] __do_fast_syscall_32+0x13a/0x8b0 [ 74.147119][ T6780] do_fast_syscall_32+0x32/0x70 [ 74.149364][ T6780] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 74.152206][ T6780] [ 74.152206][ T6780] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 74.155483][ T6780] check_prev_add+0xeb/0xe60 [ 74.157647][ T6780] __lock_acquire+0x1528/0x1f40 [ 74.159878][ T6780] lock_acquire+0x1d1/0x380 [ 74.161980][ T6780] __mutex_lock+0x1a4/0x1bd0 [ 74.164109][ T6780] tcm_alloc+0x20/0x440 [ 74.166066][ T6780] usb_get_function+0x5e/0xd0 [ 74.168279][ T6780] config_usb_cfg_link+0x1ed/0x3a0 [ 74.170634][ T6780] configfs_symlink+0x695/0x1340 [ 74.172910][ T6780] vfs_symlink+0x178/0x4d0 [ 74.174996][ T6780] filename_symlinkat+0x2a6/0x560 [ 74.177320][ T6780] __ia32_sys_symlinkat+0x9b/0xe0 [ 74.179625][ T6780] __do_fast_syscall_32+0x13a/0x8b0 [ 74.181991][ T6780] do_fast_syscall_32+0x32/0x70 [ 74.184220][ T6780] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 74.187040][ T6780] [ 74.187040][ T6780] other info that might help us debug this: [ 74.187040][ T6780] [ 74.191191][ T6780] Chain exists of: [ 74.191191][ T6780] tpg_instances_lock --> &sb->s_type->i_mutex_key#26 --> &gi->lock [ 74.191191][ T6780] [ 74.196825][ T6780] Possible unsafe locking scenario: [ 74.196825][ T6780] [ 74.199891][ T6780] CPU0 CPU1 [ 74.202115][ T6780] ---- ---- [ 74.204327][ T6780] lock(&gi->lock); [ 74.205979][ T6780] lock(&sb->s_type->i_mutex_key#26); [ 74.209255][ T6780] lock(&gi->lock); [ 74.211873][ T6780] lock(tpg_instances_lock); [ 74.213832][ T6780] [ 74.213832][ T6780] *** DEADLOCK *** [ 74.213832][ T6780] [ 74.217033][ T6780] locks held by syz.0.348/6780: 3, last CPU#1: [ 74.219442][ T6780] #0: ffff888022428460 (sb_writers#14){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 74.223250][ T6780] #1: ffff888013330600 (&sb->s_type->i_mutex_key#26){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 74.227570][ T6780] #2: ffff888060672390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 74.231327][ T6780] [ 74.231327][ T6780] stack backtrace: [ 74.233786][ T6780] CPU: 1 UID: 0 PID: 6780 Comm: syz.0.348 Tainted: G L syzkaller #0 PREEMPT(full) [ 74.238177][ T6780] Tainted: [L]=SOFTLOCKUP [ 74.239976][ T6780] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 74.244112][ T6780] Call Trace: [ 74.245523][ T6780] [ 74.246821][ T6780] dump_stack_lvl+0x100/0x190 [ 74.248799][ T6780] print_circular_bug.cold+0x178/0x1be [ 74.251094][ T6780] check_noncircular+0x146/0x160 [ 74.253165][ T6780] check_prev_add+0xeb/0xe60 [ 74.255097][ T6780] ? __schedule+0x126b/0x6920 [ 74.257067][ T6780] __lock_acquire+0x1528/0x1f40 [ 74.259137][ T6780] ? mark_held_locks+0x40/0x70 [ 74.261144][ T6780] lock_acquire+0x1d1/0x380 [ 74.263056][ T6780] ? tcm_alloc+0x20/0x440 [ 74.264857][ T6780] ? __pfx___might_resched+0x10/0x10 [ 74.267112][ T6780] __mutex_lock+0x1a4/0x1bd0 [ 74.269072][ T6780] ? tcm_alloc+0x20/0x440 [ 74.270916][ T6780] ? tcm_alloc+0x20/0x440 [ 74.272738][ T6780] ? __mutex_lock+0x8f4/0x1bd0 [ 74.274778][ T6780] ? config_usb_cfg_link+0x57/0x3a0 [ 74.276912][ T6780] ? __pfx___mutex_lock+0x10/0x10 [ 74.278996][ T6780] ? __lock_acquire+0x5c0/0x1f40 [ 74.281085][ T6780] ? tcm_alloc+0x20/0x440 [ 74.282922][ T6780] tcm_alloc+0x20/0x440 [ 74.284674][ T6780] usb_get_function+0x5e/0xd0 [ 74.286665][ T6780] config_usb_cfg_link+0x1ed/0x3a0 [ 74.288851][ T6780] ? mntput_no_expire+0xe7/0x220 [ 74.290924][ T6780] configfs_symlink+0x695/0x1340 [ 74.292951][ T6780] ? bpf_lsm_inode_permission+0x9/0x10 [ 74.295171][ T6780] ? security_inode_permission+0xbf/0x250 [ 74.297550][ T6780] ? __pfx_configfs_symlink+0x10/0x10 [ 74.299815][ T6780] vfs_symlink+0x178/0x4d0 [ 74.301745][ T6780] filename_symlinkat+0x2a6/0x560 [ 74.303906][ T6780] ? __pfx_filename_symlinkat+0x10/0x10 [ 74.306213][ T6780] ? strncpy_from_user+0x19d/0x2d0 [ 74.308388][ T6780] ? do_getname+0x191/0x390 [ 74.310310][ T6780] __ia32_sys_symlinkat+0x9b/0xe0 [ 74.312417][ T6780] __do_fast_syscall_32+0x13a/0x8b0 [ 74.314611][ T6780] do_fast_syscall_32+0x32/0x70 [ 74.316654][ T6780] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 74.319297][ T6780] RIP: 0023:0xf709efec [ 74.320969][ T6780] Code: Unable to access opcode bytes at 0xf709efc2. [ 74.323696][ T6780] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000130 [ 74.327120][ T6780] RAX: ffffffffffffffda RBX: 00000000800005c0 RCX: 00000000ffffff9c [ 74.330387][ T6780] RDX: 0000000080000600 RSI: 0000000000000000 RDI: 0000000000000000 [ 74.333671][ T6780] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 74.336951][ T6780] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 74.340237][ T6780] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 74.343507][ T6780] [ 74.349702][ T42] asus 0003:0B05:18C6.0003: input,hiddev0,hidraw1: USB HID v0.00 Device [HID 0b05:18c6] on usb-dummy_hcd.3-1/input0 [ 74.373316][ T50] usb 8-1: USB disconnect, device number 6 [ 74.390214][ T6783] fido_id[6783]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb8/report_descriptor': No such file or directory [ 74.435048][ C0] sr 2:0:0:0: [sr0] tag#13 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 74.435074][ C0] sr 2:0:0:0: [sr0] tag#13 CDB: Verify(16) 8f 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 [ 74.621403][ T10] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 74.781737][ T10] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03 [ 74.784627][ T10] usb 5-1: Dual-Role OTG device on HNP port [ 74.784840][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 74.787117][ T989] Using the BOT protocol [ 74.792457][ T989] Using the UAS protocol [ 74.812176][ T10] scsi host6: uas [ 74.825097][ T63] scsi 6:0:0:0: Direct-Access LIO-ORG RAMDISK-MCP 4.0 PQ: 0 ANSI: 6 [ 74.830014][ T63] sd 6:0:0:0: Attached scsi generic sg2 type 0 [ 74.832373][ T38] sd 6:0:0:0: [sdb] 512 512-byte logical blocks: (262 kB/256 KiB) [ 74.833244][ T38] sd 6:0:0:0: [sdb] Write Protect is off [ 74.833304][ T38] sd 6:0:0:0: [sdb] Mode Sense: 43 00 00 08 [ 74.834950][ T38] sd 6:0:0:0: [sdb] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA [ 74.925188][ T38] sd 6:0:0:0: [sdb] Attached SCSI disk [ 76.081827][ T30] cfg80211: failed to load regulatory.db