last executing test programs: 29.027259807s ago: executing program 3 (id=446): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed, 0x9}]}) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x11, &(0x7f0000000000)=0x8, 0x4) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x9, 0xfffffffffffffffd, 0x10000000, 0x10000, 0x3, 0x4002004c2, 0x803, 0x9, 0x0, 0x400, 0x80, 0x89, 0xfffffffffffffffd, 0x8, 0x8d], 0x100000, 0x240046}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 28.840617637s ago: executing program 3 (id=448): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe2002, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r2, 0x4068aea3, &(0x7f0000000000)={0xc0, 0x0, 0x10000}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = mmap$KVM_VCPU(0x0, 0x50000, 0x3, 0x11, r3, 0x0) syz_memcpy_off$KVM_EXIT_MMIO(r4, 0x40000, &(0x7f0000000100)="020000000000000000000000000000000200", 0x0, 0x30) ioctl$KVM_RESET_DIRTY_RINGS(r2, 0xaec7) ioctl$KVM_RUN(r3, 0xae80, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000001300090468fe0700000000000000ff3f08000000480100100000000019002b000a0001000500000000000072080003000500000000", 0x39}], 0x1) ioctl$KVM_MEMORY_ENCRYPT_UNREG_REGION(r2, 0x8010aebc, &(0x7f0000000140)={0x3000, 0x8000}) 28.737100762s ago: executing program 3 (id=450): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x3, {0x42}}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x2, {{0x42}, 0x4}}, 0x10) bind$tipc(r1, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r1, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0x3, 0x1}, 0x10) bind$tipc(r0, 0x0, 0x0) close(r0) 28.681917325s ago: executing program 3 (id=451): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x10a}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000e00)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f00000004c0)={@flat=@weak_binder={0x77622a85, 0x1001}, @fd={0x66642a85, 0x0, r3}, @flat=@binder={0x73622a85, 0x10a, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x1, 0xfdfd, &(0x7f0000001540)=""/1}) 28.676501579s ago: executing program 3 (id=452): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x4000) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x1a32e5400, 0x0, 0x0, 0x0, {0x1a}, 0x0, 0x0, 0x0, 0x0, 0x0, {r0}}, 0x58) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000010880)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRESOCT, @ANYBLOB="000000000000000000000000000010"], 0x50) sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x10, 0x701, 0x0, 0x25dfdbfb, {0xd}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x0) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x20000}, 0xc) 26.67322288s ago: executing program 3 (id=454): write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfe33) socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/card0/oss_mixer\x00', 0x2, 0x0) write$proc_mixer(r0, &(0x7f0000000280)=ANY=[@ANYBLOB='VOLUME \'Line\' '], 0x2a) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r1 = openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) write$dsp(r1, 0x0, 0x0) write$snddsp(0xffffffffffffffff, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) close(r0) 24.634563677s ago: executing program 2 (id=470): bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x800, @mcast2, 0x6}, 0x1c) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x3b) ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(r1, 0x4068aea3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1200000007"], 0x50) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) socket$inet_icmp_raw(0x2, 0x3, 0x1) 24.564777858s ago: executing program 2 (id=471): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x0, 0x7}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r3, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x1}}}, 0x10) bind$tipc(r2, &(0x7f00000001c0)=@name={0x1e, 0x2, 0x2, {{0x42, 0x80000004}}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 24.502831311s ago: executing program 2 (id=472): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x3, 0x5, 0x8, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x101, 0xaec4, 0x6, 0x4004, 0x2, 0x4, 0xffffffffffffffff, 0x0, 0x0, 0x7, 0x20000, 0x1c, 0x0, 0x5, 0x1, 0xffffffffffffffff], 0x0, 0x41981}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 24.301453706s ago: executing program 2 (id=477): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4d}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, 0x0, 0x0, 0x1, 0x5}, 0x94) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc01c586a, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0x100, 0x0, 0x7, 0x0, &(0x7f0000000400)=0x7}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f00000fe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r1 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1c, 0x1f, &(0x7f0000000000)=ANY=[@ANYBLOB="24f000feea"], 0x0, 0x9, 0x0, 0x0, 0x41100, 0x6e}, 0x94) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 24.145562703s ago: executing program 2 (id=478): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x9e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffff7, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfdfffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x0, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0xfffffffc, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000300), r2) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4840}, 0x800) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@getlink={0x28, 0x12, 0x1, 0x0, 0x0, {}, [@IFLA_EXT_MASK={0x8, 0x1d, 0x3ff}]}, 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 23.741123928s ago: executing program 2 (id=480): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x240448a4}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r4, &(0x7f0000000280)='0', 0x1, 0x40000, &(0x7f0000000340)={0x11, 0x6, r3, 0x1, 0x2, 0x6, @local}, 0x14) 23.682530319s ago: executing program 32 (id=480): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x240448a4}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r4, &(0x7f0000000280)='0', 0x1, 0x40000, &(0x7f0000000340)={0x11, 0x6, r3, 0x1, 0x2, 0x6, @local}, 0x14) 11.199835065s ago: executing program 33 (id=454): write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfe33) socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/card0/oss_mixer\x00', 0x2, 0x0) write$proc_mixer(r0, &(0x7f0000000280)=ANY=[@ANYBLOB='VOLUME \'Line\' '], 0x2a) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r1 = openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) write$dsp(r1, 0x0, 0x0) write$snddsp(0xffffffffffffffff, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) close(r0) 5.159242005s ago: executing program 0 (id=536): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0x7}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002740)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x1}, {}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0x3, 0x10000000, 0x43af, 0x8}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xfff2, 0x9}}]}, {0x4, 0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syzkaller0\x00', 0xb) sendto$inet(r4, 0x0, 0x0, 0x0, &(0x7f0000000900)={0x2, 0x4e20, @loopback}, 0x10) 4.804973625s ago: executing program 0 (id=542): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x3}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = syz_create_resource$binfmt(&(0x7f0000000000)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r1, 0x41, 0x1ff) creat(&(0x7f0000000140)='./file0\x00', 0x148) bind$unix(0xffffffffffffffff, 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x2) 4.197747117s ago: executing program 4 (id=548): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x74, 0x0, 0x0, 0x11203}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_DEFAULT_PVID={0x6, 0x27, 0x18}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 3.784356848s ago: executing program 0 (id=549): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000140)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0x7, 0x7fffffff}]}) exit(0xffff) epoll_create1(0x80000) socket$nl_sock_diag(0x10, 0x3, 0x4) syz_open_procfs(0x0, &(0x7f00000000c0)='environ\x00') r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000094}, 0x20040040) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x30, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newtfilter={0x34, 0x2c, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)=@deltfilter={0x24, 0x2d, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}, {0x3, 0x1}}}, 0x24}}, 0x0) 3.447332562s ago: executing program 1 (id=552): timer_create(0x0, &(0x7f0000000300)={0x0, 0x21, 0x2}, &(0x7f00000005c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10) sendto$inet(r1, &(0x7f0000000100)='$e', 0x2, 0x20008005, &(0x7f00000000c0)={0x2, 0x4e20}, 0x10) sendto$inet(r1, &(0x7f0000000140)="8d", 0x1, 0x4008004, 0x0, 0x0) readv(r1, &(0x7f00000002c0)=[{&(0x7f00000001c0)=""/210, 0xd2}], 0x1) recvfrom(r1, &(0x7f0000000300)=""/102, 0xfffffffffffffe30, 0x736, 0x0, 0x0) 3.179601783s ago: executing program 4 (id=554): openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x8042, 0x20) fcntl$setlease(r1, 0x400, 0x0) fcntl$getflags(r1, 0x401) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}}, 0x24}}, 0x0) write$char_usb(r0, &(0x7f0000000040)="e2", 0x918) setns(0xc9, 0x0) r2 = socket(0x2a, 0x2, 0x9) getsockopt$sock_buf(r2, 0x1, 0x1c, 0x0, &(0x7f0000000040)) ioctl$CDROM_GET_CAPABILITY(0xffffffffffffffff, 0x5331) 3.010925119s ago: executing program 4 (id=557): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0x2000000, 0xe, 0x0, &(0x7f0000000580)="63eced8e46aa7ce5a833c9f7b942", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.880057183s ago: executing program 0 (id=559): syz_open_dev$sndpcmc(0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x600}, 0x2000114) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000001340)) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@ll={0x11, 0x2, 0x0, 0x1, 0x40, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x80, 0x0}, 0x20000010) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r2, 0xc018620c, &(0x7f0000000200)) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000180)=0x6f) write$dsp(r1, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) 2.681597715s ago: executing program 4 (id=560): ioctl(0xffffffffffffffff, 0x4038ae7a, 0x0) fsopen(0x0, 0x1) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="440f20c0350b000000440f22c0360f09c4217d700c9d0000000028b8010000000f01c166b82e000f00d80f20d835080000000f22d82e0f019885000000b9b1060000b86f8d0000ba0000000066b8b5008ec036363ef3420f51a600000000b9e30b0000b8f233278fba000000000f30", 0x6f}], 0x1, 0x13, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x8, 0x61, 0x200002000001, 0x1, 0x36, 0x0, 0x0, 0x36ae, 0x5, 0x6, 0x3, 0x400000000, 0x6, 0xf73c], 0x80a0000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) write$char_usb(0xffffffffffffffff, &(0x7f0000000080)="d6f5fbcf8c5f6b1eab996ddbb1a3fa9e7faef2c7e9b975084ebb6f5557284549957db0e43ddd", 0x26) 2.535703207s ago: executing program 5 (id=562): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4050) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_clone(0xb2a62000, 0x0, 0xffffffffffffff13, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000040)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) 2.466375543s ago: executing program 4 (id=563): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0xa9525000) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) lchown(&(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0x0, 0x0) close(0x3) 2.365745247s ago: executing program 5 (id=564): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = landlock_create_ruleset(&(0x7f0000000040)={0xc0d8, 0x9, 0x3}, 0x30, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x42, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, 0x0) landlock_restrict_self(r0, 0xf) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) 638.246488ms ago: executing program 5 (id=565): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x48, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'veth0\x00'}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}]}, 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@setlink={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@IFLA_IFNAME={0x14, 0x3, 'veth0\x00'}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x48, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x3, "01020202010200000101010101010101"}}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newqdisc={0x3c, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2, {0x0, 0x2}, {0x1, 0x1}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x1, 0x100}}}]}, 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newqdisc={0x38, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2, {0x0, 0x3}, {0x2, 0x1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_BACKLOG_LIMIT={0x8, 0x1, 0x3e8}]}}]}, 0x38}}, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) bind$packet(r1, &(0x7f0000000500)={0x11, 0x3, 0x2}, 0x14) sendto$packet(r1, &(0x7f0000000200)="00112233445566778899aabb08004500001c000000004011000001010101010101020001000100080000", 0x2a, 0x0, &(0x7f0000000540)={0x11, 0x0, 0x2}, 0x14) sendto$packet(r1, &(0x7f0000000200)="00112233445566778899aabb08004500001c000000004011000001010101010101020001000100080000", 0x2a, 0x0, &(0x7f0000000580)={0x11, 0x0, 0x2}, 0x14) sendmsg$nl_route_sched(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newqdisc={0x38, 0x24, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2, {0x0, 0x3}, {0x2, 0x1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_BACKLOG_LIMIT={0x8}]}}]}, 0x38}}, 0x0) 593.965861ms ago: executing program 5 (id=566): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000180)={0x1, 0xaa4, 0x0, &(0x7f0000000340)}) ioctl$KVM_SET_CLOCK(r1, 0x4188aec6, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x20000000000003, 0x1004}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000029000/0x18000)=nil, &(0x7f0000000680)=[@text16={0x10, &(0x7f0000000080)="66b9800000c00f326635010000000f3064660f38828e4258660f08676ac744240012e93bf96766c744240201000000f20f78ecf5543e660f3829544e66b9800000c00f326635002000000f300f01df66b805000000f3a5baf80c66b80e5ca48f66efbafc0cec0f01310f019c09000f01c2", 0x71}], 0x1, 0x7d, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f0000000100)={0xbc, 0x0, 0x4}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 511.553798ms ago: executing program 1 (id=567): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x24000044) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) clock_gettime(0x1, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000000)=0x3) bpf$MAP_CREATE(0x0, 0x0, 0xffffffffffffff9d) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000008c0)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000007c0)}, 0x68) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669632e74696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657930820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, 0xffffffffffffffff) 475.523795ms ago: executing program 1 (id=568): statx(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x10000000000002, 0x9, 0xfffffffffffffff9, 0x2, 0x0, 0x0, 0x4002004c4, 0x1004, 0x76, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x90], 0xeeee8000, 0x2018d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 437.410666ms ago: executing program 5 (id=569): r0 = userfaultfd(0x801) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r1, r1, 0x200000000000000) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000200)={0x0, 0x0}, 0x8) r4 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r3, 0x4) bpf$LINK_DETACH(0x22, &(0x7f0000000340)=r4, 0x4) close_range(r0, 0xffffffffffffffff, 0x0) 382.163105ms ago: executing program 0 (id=570): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0xc) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x80002, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, 0x0, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) mount$9p_tcp(&(0x7f0000000180), 0x0, 0x0, 0x114000, &(0x7f00000002c0)=ANY=[]) mount(0x0, 0x0, &(0x7f0000000040)='jfs\x00', 0x20c86, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0140) 318.40647ms ago: executing program 5 (id=571): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r1 = socket$unix(0x1, 0x3, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x7) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x4a243) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_LISTALL(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x44}, 0x24000001) close(r2) 298.187387ms ago: executing program 4 (id=572): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xffeffffffffffffa]}, 0x8, 0x800) r1 = syz_io_uring_setup(0xf08, &(0x7f0000000400)={0x0, 0x8000595d, 0x1000, 0x20002, 0x3c7, 0x0, r0}, &(0x7f0000000100)=0x0, &(0x7f0000001080)=0x0, &(0x7f0000000340)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x10, 0x0, @fd=r0, 0x0, 0x0, 0x0, {0x110a}, 0x1}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) readv(r6, &(0x7f00000001c0)=[{&(0x7f0000000400)=""/157, 0x9d}], 0x1) 261.592268ms ago: executing program 0 (id=573): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000780)={'pim6reg0\x00', 0x400}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) write$cgroup_int(r0, &(0x7f00000000c0)=0x7, 0x12) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000100)={'syz_tun\x00', 0x200}) close(0x3) 256.746197ms ago: executing program 1 (id=574): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='wwnn=0x1000000010000001,wwpn=0x1000000010000002\n', 0x30) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='wwnn=0x2000000010000001,wwpn=0x2000000010000002,lpwwnn=0x1000000010000001,lpwwpn=0x1000000010000002,roles=3', 0x6b) 218.419423ms ago: executing program 1 (id=575): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x1a) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x404c2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') setxattr$security_ima(&(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000280), &(0x7f00000002c0), 0x1, 0x2) unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 0s ago: executing program 1 (id=576): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000300), 0x3, r2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000580)={0x600, 0x1, &(0x7f0000000180)=[r2], &(0x7f00000000c0)=[0x3], &(0x7f0000000640)=[r4, r3, r4], &(0x7f00000003c0), 0x0, 0x2}) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r5, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r5, 0xc02064b6, &(0x7f00000001c0)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r5, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0], &(0x7f0000000300), 0x1, r7}) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:41342' (ED25519) to the list of known hosts. [ 33.005723][ T5666] cgroup: Unknown subsys name 'net' [ 33.132776][ T5666] cgroup: Unknown subsys name 'cpuset' [ 33.134905][ T5666] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 34.005579][ T5666] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 38.279953][ T5739] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 38.283878][ T5746] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 38.284923][ T5746] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 38.285246][ T5746] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 38.285331][ T5746] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 38.287514][ T5749] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 38.288613][ T5746] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 38.289949][ T5750] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 38.290157][ T5750] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 38.290599][ T5750] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 38.290743][ T5750] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 38.293322][ T5747] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 38.295171][ T5747] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 38.295989][ T5747] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 38.299602][ T5748] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 38.304023][ T5096] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 38.304528][ T5096] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 38.306680][ T5748] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 38.312988][ T5096] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 38.313606][ T5096] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 38.869042][ T5735] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.869127][ T5735] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.869260][ T5735] bridge_slave_0: entered allmulticast mode [ 38.873356][ T5735] bridge_slave_0: entered promiscuous mode [ 38.886332][ T5735] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.886467][ T5735] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.886564][ T5735] bridge_slave_1: entered allmulticast mode [ 38.887785][ T5735] bridge_slave_1: entered promiscuous mode [ 38.915866][ T5742] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.915911][ T5742] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.915966][ T5742] bridge_slave_0: entered allmulticast mode [ 38.916727][ T5742] bridge_slave_0: entered promiscuous mode [ 38.934563][ T5735] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.937175][ T5735] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.937265][ T5742] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.937326][ T5742] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.937433][ T5742] bridge_slave_1: entered allmulticast mode [ 38.938952][ T5742] bridge_slave_1: entered promiscuous mode [ 39.025179][ T5742] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.056178][ T5735] team0: Port device team_slave_0 added [ 39.058740][ T5742] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.094772][ T5735] team0: Port device team_slave_1 added [ 39.113549][ T5742] team0: Port device team_slave_0 added [ 39.113642][ T5743] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.113684][ T5743] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.113745][ T5743] bridge_slave_0: entered allmulticast mode [ 39.114973][ T5743] bridge_slave_0: entered promiscuous mode [ 39.117409][ T5743] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.117482][ T5743] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.117579][ T5743] bridge_slave_1: entered allmulticast mode [ 39.118826][ T5743] bridge_slave_1: entered promiscuous mode [ 39.129393][ T5734] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.129468][ T5734] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.129556][ T5734] bridge_slave_0: entered allmulticast mode [ 39.130946][ T5734] bridge_slave_0: entered promiscuous mode [ 39.134008][ T5742] team0: Port device team_slave_1 added [ 39.134094][ T5734] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.134133][ T5734] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.134194][ T5734] bridge_slave_1: entered allmulticast mode [ 39.134907][ T5734] bridge_slave_1: entered promiscuous mode [ 39.186224][ T5735] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.186242][ T5735] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.186263][ T5735] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.209218][ T5735] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.209232][ T5735] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.209253][ T5735] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.230268][ T5742] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.230284][ T5742] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.230304][ T5742] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.241268][ T5743] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.243209][ T5734] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.244558][ T5743] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.245001][ T5742] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.245012][ T5742] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.245031][ T5742] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.247389][ T5734] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.303026][ T5734] team0: Port device team_slave_0 added [ 39.324794][ T5743] team0: Port device team_slave_0 added [ 39.337812][ T5734] team0: Port device team_slave_1 added [ 39.344625][ T5742] hsr_slave_0: entered promiscuous mode [ 39.345168][ T5742] hsr_slave_1: entered promiscuous mode [ 39.350582][ T5735] hsr_slave_0: entered promiscuous mode [ 39.351376][ T5735] hsr_slave_1: entered promiscuous mode [ 39.351965][ T5735] debugfs: 'hsr0' already exists in 'hsr' [ 39.352032][ T5735] Cannot create hsr debugfs directory [ 39.353868][ T5743] team0: Port device team_slave_1 added [ 39.395061][ T5734] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.395073][ T5734] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.395086][ T5734] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.401143][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.401154][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.401166][ T5743] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.422861][ T5734] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.422877][ T5734] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.422898][ T5734] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.423671][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.423683][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.423702][ T5743] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.483640][ T5734] hsr_slave_0: entered promiscuous mode [ 39.484093][ T5734] hsr_slave_1: entered promiscuous mode [ 39.484420][ T5734] debugfs: 'hsr0' already exists in 'hsr' [ 39.484433][ T5734] Cannot create hsr debugfs directory [ 39.520236][ T5743] hsr_slave_0: entered promiscuous mode [ 39.520680][ T5743] hsr_slave_1: entered promiscuous mode [ 39.520991][ T5743] debugfs: 'hsr0' already exists in 'hsr' [ 39.521003][ T5743] Cannot create hsr debugfs directory [ 39.700282][ T5742] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.704780][ T5742] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.705190][ T5742] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.707170][ T5742] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.711236][ T5742] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.714543][ T5742] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.715014][ T5742] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.719872][ T5742] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.780311][ T5735] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 39.784230][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.785154][ T5735] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 39.787450][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.788517][ T5735] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 39.793228][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.794096][ T5735] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 39.799937][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.864235][ T5743] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 39.868225][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.868976][ T5743] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 39.874471][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.877302][ T5743] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 39.882931][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.892328][ T5743] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 39.896068][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.963898][ T5742] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.976798][ T5734] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 39.983266][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.984017][ T5734] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 39.989782][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.997584][ T5734] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 40.001565][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 40.002241][ T5734] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 40.005196][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 40.016837][ T5742] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.048735][ T5735] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.050829][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.050949][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.064745][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.064789][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.087550][ T5735] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.095136][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.095180][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.096073][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.096113][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.139732][ T5743] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.188684][ T5743] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.197542][ T5734] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.201238][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.201332][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.215870][ T5734] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.223520][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.223586][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.232752][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.232795][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.253585][ T74] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.253702][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.302675][ T5739] Bluetooth: hci1: command tx timeout [ 40.302682][ T5096] Bluetooth: hci0: command tx timeout [ 40.381726][ T5096] Bluetooth: hci3: command tx timeout [ 40.381738][ T5739] Bluetooth: hci2: command tx timeout [ 40.438806][ T5742] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.476146][ T5742] veth0_vlan: entered promiscuous mode [ 40.487130][ T5742] veth1_vlan: entered promiscuous mode [ 40.506297][ T5742] veth0_macvtap: entered promiscuous mode [ 40.511536][ T5742] veth1_macvtap: entered promiscuous mode [ 40.532303][ T5742] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.539800][ T5742] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.580499][ T5735] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.606724][ T5743] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.617249][ T5734] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.659178][ T5735] veth0_vlan: entered promiscuous mode [ 40.661008][ T55] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.661020][ T55] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.679520][ T5735] veth1_vlan: entered promiscuous mode [ 40.706091][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.706106][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.720889][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.721133][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.721153][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.721171][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.722612][ T5743] veth0_vlan: entered promiscuous mode [ 40.732345][ T5734] veth0_vlan: entered promiscuous mode [ 40.747226][ T5734] veth1_vlan: entered promiscuous mode [ 40.748572][ T5743] veth1_vlan: entered promiscuous mode [ 40.762039][ T5735] veth0_macvtap: entered promiscuous mode [ 40.766357][ T5742] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 40.769815][ T5735] veth1_macvtap: entered promiscuous mode [ 40.777786][ T5742] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 40.785396][ T5742] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 40.787029][ T5742] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 40.789179][ T5735] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.795921][ T5742] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 40.802199][ T5743] veth0_macvtap: entered promiscuous mode [ 40.804461][ T5735] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.812258][ T5743] veth1_macvtap: entered promiscuous mode [ 40.814371][ T5734] veth0_macvtap: entered promiscuous mode [ 40.816511][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.816583][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.816649][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.824527][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.825895][ T5734] veth1_macvtap: entered promiscuous mode [ 40.839868][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.850542][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.859434][ T5592] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.859471][ T5592] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.859498][ T5592] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.859523][ T5592] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.862895][ T5734] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.869641][ T5734] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.890205][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.890232][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.890249][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.890267][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.907085][ T160] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.907098][ T160] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.938784][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.938797][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.976794][ T160] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.976822][ T160] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.988320][ T160] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.988337][ T160] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.001421][ T160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.001434][ T160] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.014430][ T160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.014443][ T160] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.165524][ T5897] tipc: Started in network mode [ 41.165541][ T5897] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 41.165631][ T5897] tipc: Enabled bearer , priority 0 [ 41.204764][ T5900] FAULT_INJECTION: forcing a failure. [ 41.204764][ T5900] name failslab, interval 1, probability 0, space 0, times 1 [ 41.204786][ T5900] CPU: 2 UID: 0 PID: 5900 Comm: syz.3.4 Not tainted syzkaller #0 PREEMPT(full) [ 41.204800][ T5900] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 41.204807][ T5900] Call Trace: [ 41.204811][ T5900] [ 41.204821][ T5900] dump_stack_lvl+0x100/0x190 [ 41.204841][ T5900] should_fail_ex.cold+0x5/0xa [ 41.204857][ T5900] should_failslab+0xc2/0x120 [ 41.204875][ T5900] kmem_cache_alloc_noprof+0x92/0x6a0 [ 41.204891][ T5900] ? anon_vma_clone+0x2b3/0xca0 [ 41.204909][ T5900] anon_vma_clone+0x2b3/0xca0 [ 41.204947][ T5900] copy_vma+0x934/0x1100 [ 41.204964][ T5900] ? __pfx_copy_vma+0x10/0x10 [ 41.204976][ T5900] ? __pfx_vms_complete_munmap_vmas+0x10/0x10 [ 41.204995][ T5900] ? rcu_is_watching+0x13/0xc0 [ 41.205014][ T5900] ? __pfx_do_vmi_align_munmap+0x10/0x10 [ 41.205026][ T5900] ? find_held_lock+0x2b/0x80 [ 41.205040][ T5900] ? finish_task_switch.isra.0+0x2bd/0x10d0 [ 41.205063][ T5900] copy_vma_and_data+0x23f/0x780 [ 41.205079][ T5900] ? __pfx_copy_vma_and_data+0x10/0x10 [ 41.205091][ T5900] ? arch_get_unmapped_area_topdown+0x45b/0xa10 [ 41.205108][ T5900] ? rcu_is_watching+0x13/0xc0 [ 41.205120][ T5900] ? percpu_counter_add_batch+0xb9/0x230 [ 41.205139][ T5900] ? __vm_enough_memory+0x184/0x390 [ 41.205156][ T5900] move_vma+0x57c/0x12e0 [ 41.205170][ T5900] ? __pfx_move_vma+0x10/0x10 [ 41.205182][ T5900] ? cap_mmap_addr+0x4b/0x120 [ 41.205198][ T5900] ? security_mmap_addr+0x71/0x1e0 [ 41.205210][ T5900] ? __get_unmapped_area+0x255/0x3e0 [ 41.205227][ T5900] ? vrm_set_new_addr+0x1f5/0x2a0 [ 41.205240][ T5900] mremap_to+0x234/0x4c0 [ 41.205252][ T5900] ? __pfx_mremap_to+0x10/0x10 [ 41.205264][ T5900] ? mas_walk+0x260/0x310 [ 41.205280][ T5900] __do_sys_mremap+0x99f/0x1780 [ 41.205293][ T5900] ? futex_wait+0xb0/0x370 [ 41.205309][ T5900] ? __pfx___do_sys_mremap+0x10/0x10 [ 41.205322][ T5900] ? percpu_counter_add_batch+0xb9/0x230 [ 41.205344][ T5900] ? __pfx_do_futex+0x10/0x10 [ 41.205356][ T5900] ? fd_install+0x223/0x580 [ 41.205374][ T5900] ? xfd_validate_state+0x129/0x190 [ 41.205397][ T5900] __do_fast_syscall_32+0x13a/0x8b0 [ 41.205415][ T5900] do_fast_syscall_32+0x32/0x70 [ 41.205430][ T5900] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 41.205444][ T5900] RIP: 0023:0xf748efec [ 41.205458][ T5900] Code: Unable to access opcode bytes at 0xf748efc2. [ 41.205462][ T5900] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 00000000000000a3 [ 41.205474][ T5900] RAX: ffffffffffffffda RBX: 0000000080001000 RCX: 0000000000004000 [ 41.205480][ T5900] RDX: 0000000000003021 RSI: 0000000000000003 RDI: 0000000080ffd000 [ 41.205486][ T5900] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 41.205493][ T5900] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 41.205499][ T5900] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 41.205512][ T5900] [ 41.323366][ T5905] netlink: 'syz.1.9': attribute type 12 has an invalid length. [ 41.414646][ T5907] syz.3.10 uses obsolete (PF_INET,SOCK_PACKET) [ 41.691642][ T5914] uhci_hcd 0000:00:1d.0: remove, state 4 [ 41.691694][ T5914] usb usb2: USB disconnect, device number 1 [ 41.729285][ T5914] uhci_hcd 0000:00:1d.0: USB bus 2 deregistered [ 41.836300][ T5916] pci 0000:00:1d.0: [8086:2934] type 00 class 0x0c0300 conventional PCI endpoint [ 41.846339][ T5916] pci 0000:00:1d.0: BAR 4 [io 0xc0e0-0xc0ff] [ 41.861566][ T5916] pci 0000:00:1d.0: Adding to iommu group 7 [ 41.866649][ T5916] pci 0000:00:1d.0: BAR 4 [io 0x2000-0x201f]: assigned [ 42.038172][ T5916] pci 0000:00:1d.0: quirk_usb_early_handoff+0x0/0x1360 took 166484 usecs [ 42.093758][ T5916] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 42.096431][ T5916] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 2 [ 42.096593][ T5916] uhci_hcd 0000:00:1d.0: detected 2 ports [ 42.097403][ T5916] uhci_hcd 0000:00:1d.0: irq 16, io port 0x00002000 [ 42.099030][ T5916] usb usb2: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.03 [ 42.100006][ T5916] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 42.100023][ T5916] usb usb2: Product: UHCI Host Controller [ 42.100801][ T5916] usb usb2: Manufacturer: Linux syzkaller uhci_hcd [ 42.100811][ T5916] usb usb2: SerialNumber: 0000:00:1d.0 [ 42.110791][ T5916] hub 2-0:1.0: USB hub found [ 42.111552][ T5916] hub 2-0:1.0: 2 ports detected [ 42.171063][ T988] tipc: Node number set to 43690 [ 42.382364][ T5096] Bluetooth: hci0: command tx timeout [ 42.384803][ T5739] Bluetooth: hci1: command tx timeout [ 42.460459][ T5739] Bluetooth: hci2: command tx timeout [ 42.460480][ T5739] Bluetooth: hci3: command tx timeout [ 42.597558][ T5096] Bluetooth: hci0: Invalid handle: 0xed88 > 0x0eff [ 42.631964][ T5933] batman_adv: batadv0: Adding interface: syzkaller0 [ 42.631978][ T5933] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 42.631998][ T5933] batman_adv: batadv0: Interface activated: syzkaller0 [ 42.698462][ T5932] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 42.704377][ T5932] batman_adv: batadv0: Removing interface: syzkaller0 [ 43.349631][ T42] audit: type=1800 audit(1791246194.866:2): pid=5939 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.23" name="bus" dev="overlay" ino=53 res=0 errno=0 [ 43.418551][ T5941] netlink: 4 bytes leftover after parsing attributes in process `syz.2.31'. [ 43.558548][ T42] audit: type=1804 audit(1791246195.076:3): pid=5949 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.27" name="/newroot/6/file0" dev="tmpfs" ino=50 res=1 errno=0 [ 43.559386][ T5949] ref_ctr going negative. vaddr: 0x80ffd002, curr val: -780, delta: 1 [ 43.559398][ T5949] ref_ctr increment failed for inode: 0x32 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88802b17c980 [ 43.566070][ T5948] ref_ctr going negative. vaddr: 0x80ffd002, curr val: -780, delta: -1 [ 43.566082][ T5948] ref_ctr decrement failed for inode: 0x32 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88802b17c980 [ 43.572842][ T5948] uprobe: syz.2.27:5948 failed to unregister, leaking uprobe [ 43.658103][ T5952] uhci_hcd 0000:00:1d.0: remove, state 4 [ 43.658126][ T5952] usb usb2: USB disconnect, device number 1 [ 43.688251][ T5952] uhci_hcd 0000:00:1d.0: USB bus 2 deregistered [ 43.759601][ T5956] pci 0000:00:1d.0: [8086:2934] type 00 class 0x0c0300 conventional PCI endpoint [ 43.770287][ T5956] pci 0000:00:1d.0: BAR 4 [io 0x2000-0x201f] [ 43.788463][ T5956] pci 0000:00:1d.0: Adding to iommu group 7 [ 43.806911][ T5956] pci 0000:00:1d.0: BAR 4 [io 0x2000-0x201f]: assigned [ 43.879618][ T5956] pci 0000:00:1d.0: quirk_usb_early_handoff+0x0/0x1360 took 70612 usecs [ 43.909711][ T5956] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 43.911753][ T5956] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 2 [ 43.912107][ T5956] uhci_hcd 0000:00:1d.0: detected 2 ports [ 43.912975][ T5956] uhci_hcd 0000:00:1d.0: irq 16, io port 0x00002000 [ 43.922226][ T5956] usb usb2: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.03 [ 43.923563][ T5956] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 43.923577][ T5956] usb usb2: Product: UHCI Host Controller [ 43.923584][ T5956] usb usb2: Manufacturer: Linux syzkaller uhci_hcd [ 43.923618][ T5956] usb usb2: SerialNumber: 0000:00:1d.0 [ 43.931668][ T5956] hub 2-0:1.0: USB hub found [ 43.931883][ T5956] hub 2-0:1.0: 2 ports detected [ 44.028737][ T5960] netlink: 'syz.2.29': attribute type 10 has an invalid length. [ 44.029330][ T5960] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.030000][ T5960] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.033794][ T5960] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.033843][ T5960] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.033977][ T5960] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.034033][ T5960] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.038950][ T5960] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 44.106376][ T5965] uhci_hcd 0000:00:1d.0: remove, state 4 [ 44.106408][ T5965] usb usb2: USB disconnect, device number 1 [ 44.122203][ T5965] uhci_hcd 0000:00:1d.0: USB bus 2 deregistered [ 44.198134][ T5968] pci 0000:00:1d.0: [8086:2934] type 00 class 0x0c0300 conventional PCI endpoint [ 44.202110][ T5968] pci 0000:00:1d.0: BAR 4 [io 0x2000-0x201f] [ 44.212468][ T5968] pci 0000:00:1d.0: Adding to iommu group 7 [ 44.219027][ T5968] pci 0000:00:1d.0: BAR 4 [io 0x2000-0x201f]: assigned [ 44.269311][ T5968] pci 0000:00:1d.0: quirk_usb_early_handoff+0x0/0x1360 took 48937 usecs [ 44.329566][ T5968] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 44.334277][ T5968] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 2 [ 44.334825][ T5968] uhci_hcd 0000:00:1d.0: detected 2 ports [ 44.336070][ T5968] uhci_hcd 0000:00:1d.0: irq 16, io port 0x00002000 [ 44.336737][ T5968] usb usb2: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.03 [ 44.337459][ T5968] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 44.337470][ T5968] usb usb2: Product: UHCI Host Controller [ 44.337478][ T5968] usb usb2: Manufacturer: Linux syzkaller uhci_hcd [ 44.337486][ T5968] usb usb2: SerialNumber: 0000:00:1d.0 [ 44.354748][ T5968] hub 2-0:1.0: USB hub found [ 44.357495][ T5968] hub 2-0:1.0: 2 ports detected [ 44.460198][ T5096] Bluetooth: hci1: command tx timeout [ 44.470244][ T5096] Bluetooth: hci0: command tx timeout [ 44.540355][ T5739] Bluetooth: hci2: command tx timeout [ 44.540436][ T5096] Bluetooth: hci3: command tx timeout [ 45.024122][ T42] audit: type=1800 audit(1791246196.546:4): pid=5975 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.35" name="bus" dev="overlay" ino=79 res=0 errno=0 [ 45.334005][ T42] audit: type=1800 audit(1791246196.856:5): pid=5987 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.48" name="bus" dev="overlay" ino=93 res=0 errno=0 [ 46.128578][ T5999] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 46.128675][ T5999] block device autoloading is deprecated and will be removed. [ 46.290110][ T57] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 46.504865][ T57] usb 7-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 46.523955][ T57] usb 7-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 46.529858][ T57] usb 7-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 46.533957][ T57] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 46.533997][ T57] usb 7-1: Product: syz [ 46.534029][ T57] usb 7-1: Manufacturer: syz [ 46.534071][ T57] usb 7-1: SerialNumber: syz [ 46.555601][ T5096] Bluetooth: hci0: command tx timeout [ 46.555625][ T5096] Bluetooth: hci1: command tx timeout [ 46.621095][ T57] ti_usb_3410_5052 7-1:2.0: TI USB 5052 2 port adapter converter detected [ 46.630664][ T5739] Bluetooth: hci3: command tx timeout [ 46.630688][ T5739] Bluetooth: hci2: command tx timeout [ 46.709573][ T57] usb 7-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 46.731560][ T57] usb 7-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 48.009390][ T42] audit: type=1800 audit(1791246199.526:6): pid=6019 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.59" name="bus" dev="overlay" ino=102 res=0 errno=0 [ 48.198192][ T42] audit: type=1800 audit(1791246199.716:7): pid=6029 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.62" name="bus" dev="overlay" ino=116 res=0 errno=0 [ 48.951420][ T5993] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set config on port 0, -110 [ 48.951756][ T5993] ti_usb_3410_5052_2 ttyUSB0: ti_write_byte - failed, -32 [ 48.951787][ T5993] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set modem control on port 0, -32 [ 48.952115][ T5993] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot send open command (2), -32 [ 48.968568][ T10] usb 7-1: USB disconnect, device number 2 [ 48.986295][ T10] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 48.989362][ T10] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 48.990811][ T10] ti_usb_3410_5052 7-1:2.0: device disconnected [ 49.823999][ T6059] EXT4-fs warning (device sda1): ext4_group_extend:1869: need to use ext2online to resize further [ 51.004275][ T6079] vlan2: entered promiscuous mode [ 51.004291][ T6079] hsr0: entered promiscuous mode [ 51.013764][ T6079] netlink: 4 bytes leftover after parsing attributes in process `syz.2.68'. [ 51.017977][ T6079] hsr_slave_0: left promiscuous mode [ 51.024166][ T6079] hsr_slave_1: left promiscuous mode [ 51.047515][ T854] hid-generic 0005:16C0:05DF.0002: unknown main item tag 0x0 [ 51.068011][ T854] hid-generic 0005:16C0:05DF.0002: hidraw1: BLUETOOTH HID v0.09 Device [syz1] on aa:aa:aa:aa:aa:aa [ 51.188800][ T6085] netlink: 24 bytes leftover after parsing attributes in process `syz.2.69'. [ 51.547024][ T6095] EXT4-fs warning (device sda1): ext4_group_extend:1869: need to use ext2online to resize further [ 53.273433][ T988] hid-generic 0005:16C0:05DF.0003: unknown main item tag 0x0 [ 53.276938][ T988] hid-generic 0005:16C0:05DF.0003: hidraw1: BLUETOOTH HID v0.09 Device [syz1] on aa:aa:aa:aa:aa:aa [ 53.331478][ T6126] netlink: 'syz.0.81': attribute type 12 has an invalid length. [ 53.343228][ T5096] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 53.343265][ T5096] Bluetooth: hci0: Injecting HCI hardware error event [ 53.343913][ T5096] Bluetooth: hci0: hardware error 0x00 [ 53.419929][ T6125] Zero length message leads to an empty skb [ 53.424439][ T6125] netlink: 4 bytes leftover after parsing attributes in process `syz.1.82'. [ 53.444762][ T6125] team0: Port device team_slave_0 removed [ 54.220213][ T5739] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 54.221750][ T5739] Bluetooth: hci1: Injecting HCI hardware error event [ 54.224723][ T5739] Bluetooth: hci1: hardware error 0x00 [ 55.421160][ T5096] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 56.310535][ T5739] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 56.327109][ T25] hid-generic 0005:16C0:05DF.0004: unknown main item tag 0x0 [ 56.331233][ T25] hid-generic 0005:16C0:05DF.0004: hidraw1: BLUETOOTH HID v0.09 Device [syz1] on aa:aa:aa:aa:aa:aa [ 56.741315][ T6186] netlink: 'syz.3.94': attribute type 12 has an invalid length. [ 57.131835][ T6206] netlink: 24 bytes leftover after parsing attributes in process `syz.0.100'. [ 57.298644][ T6210] netlink: 'syz.0.110': attribute type 12 has an invalid length. [ 57.499257][ T6219] dummy0 speed is unknown, defaulting to 1000 [ 57.506162][ T6219] dummy0 speed is unknown, defaulting to 1000 [ 57.513702][ T6219] dummy0 speed is unknown, defaulting to 1000 [ 57.536212][ T42] audit: type=1800 audit(1791246209.056:8): pid=6222 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.106" name=08 dev="sda1" ino=2039 res=0 errno=0 [ 57.691957][ T854] dummy0 speed is unknown, defaulting to 1000 [ 57.692039][ T6219] infiniband syz0: set active [ 57.692054][ T6219] infiniband syz0: added dummy0 [ 57.704543][ T6219] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 57.704564][ T6219] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 57.704585][ T6219] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 57.787768][ T6219] RDS/IB: syz0: added [ 57.794554][ T6219] smc: adding ib device syz0 with port count 1 [ 57.794639][ T6219] smc: ib device syz0 port 1 has no pnetid [ 57.796080][ T988] dummy0 speed is unknown, defaulting to 1000 [ 57.798245][ T6219] dummy0 speed is unknown, defaulting to 1000 [ 58.038824][ T6219] dummy0 speed is unknown, defaulting to 1000 [ 58.229561][ T6219] dummy0 speed is unknown, defaulting to 1000 [ 58.391361][ T6219] dummy0 speed is unknown, defaulting to 1000 [ 59.251910][ T1345] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 59.316490][ T6264] netlink: 'syz.3.115': attribute type 12 has an invalid length. [ 59.423330][ T1345] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 59.424828][ T1345] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 59.424850][ T1345] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 59.424863][ T1345] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 59.426965][ T1345] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 59.426978][ T1345] usb 5-1: Product: syz [ 59.426985][ T1345] usb 5-1: Manufacturer: syz [ 59.426991][ T1345] usb 5-1: SerialNumber: syz [ 59.547805][ T6267] ======================================================= [ 59.547805][ T6267] WARNING: The mand mount option has been deprecated and [ 59.547805][ T6267] and is ignored by this kernel. Remove the mand [ 59.547805][ T6267] option from the mount to silence this warning. [ 59.547805][ T6267] ======================================================= [ 59.549731][ T6267] jffs2: notice: (6267) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 59.574338][ T6267] overlayfs: upper fs does not support tmpfile. [ 59.576585][ T6267] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 59.643940][ T6262] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 59.644030][ T6262] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 59.788630][ T6276] netlink: 4 bytes leftover after parsing attributes in process `syz.3.121'. [ 59.810992][ T6276] team0: Port device team_slave_0 removed [ 60.036380][ T6284] process 'syz.3.124' launched './file0' with NULL argv: empty string added [ 60.053166][ T1345] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 60.053290][ T1345] cdc_ncm 5-1:1.0: bind() failure [ 60.059112][ T1345] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 60.059148][ T1345] cdc_ncm 5-1:1.1: bind() failure [ 60.113042][ T5832] usb 5-1: USB disconnect, device number 2 [ 60.321502][ T6292] syzkaller0: entered promiscuous mode [ 60.321530][ T6292] syzkaller0: entered allmulticast mode [ 61.429728][ T6304] jffs2: notice: (6304) jffs2_build_xattr_subsystem: complete building xattr subsystem, 6 of xdatum (0 unchecked, 6 orphan) and 6 of xref (1 dead, 5 orphan) found. [ 61.433059][ T6303] netlink: 8 bytes leftover after parsing attributes in process `syz.2.138'. [ 61.433072][ T6303] netlink: 8 bytes leftover after parsing attributes in process `syz.2.138'. [ 61.441604][ T6304] overlayfs: upper fs does not support tmpfile. [ 61.442005][ T6304] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 62.580580][ T10] dummy0 speed is unknown, defaulting to 1000 [ 63.771756][ T6341] netlink: 44 bytes leftover after parsing attributes in process `syz.2.140'. [ 64.129811][ T6343] random: crng reseeded on system resumption [ 64.357899][ T854] libceph: connect (1)[c::]:6789 error -101 [ 64.358289][ T854] libceph: mon0 (1)[c::]:6789 connect error [ 64.366672][ T6346] ceph: No mds server is up or the cluster is laggy [ 64.682337][ T6360] jffs2: notice: (6360) jffs2_build_xattr_subsystem: complete building xattr subsystem, 12 of xdatum (0 unchecked, 12 orphan) and 12 of xref (2 dead, 10 orphan) found. [ 64.691301][ T6360] overlayfs: upper fs does not support tmpfile. [ 64.691694][ T6360] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 64.757393][ T6363] syz0: rxe_newlink: already configured on dummy0 [ 65.460621][ T6391] 9pnet: p9_errstr2errno: server reported unknown error 0x000000000 [ 66.260930][ T6408] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 66.282316][ T6407] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 67.234403][ T10] libceph: connect (1)[c::]:6789 error -101 [ 67.234485][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 67.293050][ T6434] ceph: No mds server is up or the cluster is laggy [ 69.000318][ T6490] FAULT_INJECTION: forcing a failure. [ 69.000318][ T6490] name failslab, interval 1, probability 0, space 0, times 0 [ 69.000344][ T6490] CPU: 1 UID: 0 PID: 6490 Comm: syz.1.183 Not tainted syzkaller #0 PREEMPT(full) [ 69.000362][ T6490] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 69.000370][ T6490] Call Trace: [ 69.000375][ T6490] [ 69.000381][ T6490] dump_stack_lvl+0x100/0x190 [ 69.000418][ T6490] should_fail_ex.cold+0x5/0xa [ 69.000439][ T6490] should_failslab+0xc2/0x120 [ 69.000470][ T6490] __kmalloc_cache_noprof+0x91/0x6d0 [ 69.000487][ T6490] ? snd_hrtimer_open+0x43/0xf0 [ 69.000514][ T6490] ? __pfx_snd_hrtimer_open+0x10/0x10 [ 69.000535][ T6490] snd_hrtimer_open+0x43/0xf0 [ 69.000553][ T6490] snd_timer_open+0xbc3/0x1190 [ 69.000575][ T6490] ? __pfx_snd_timer_open+0x10/0x10 [ 69.000594][ T6490] ? kstrdup+0xb3/0xe0 [ 69.000612][ T6490] snd_seq_timer_open+0x289/0x5c0 [ 69.000638][ T6490] ? __pfx_snd_seq_timer_open+0x10/0x10 [ 69.000662][ T6490] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 69.000683][ T6490] ? mark_held_locks+0x40/0x70 [ 69.000704][ T6490] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 69.000729][ T6490] queue_use+0xdc/0x1f0 [ 69.000752][ T6490] snd_seq_queue_alloc+0x2e5/0x540 [ 69.000780][ T6490] snd_seq_ioctl_create_queue+0xa9/0x370 [ 69.000807][ T6490] call_seq_client_ctl+0xa3/0x130 [ 69.000833][ T6490] snd_seq_kernel_client_ctl+0x35/0x50 [ 69.000849][ T6490] alloc_seq_queue+0xdb/0x180 [ 69.000864][ T6490] ? __pfx_alloc_seq_queue+0x10/0x10 [ 69.000888][ T6490] ? find_held_lock+0x2b/0x80 [ 69.000907][ T6490] ? mark_held_locks+0x40/0x70 [ 69.000931][ T6490] snd_seq_oss_open+0x2b2/0xa10 [ 69.000950][ T6490] odev_open+0x6f/0x90 [ 69.000963][ T6490] ? __pfx_odev_open+0x10/0x10 [ 69.000976][ T6490] soundcore_open+0x2e3/0x5a0 [ 69.000993][ T6490] ? __pfx_soundcore_open+0x10/0x10 [ 69.001029][ T6490] chrdev_open+0x234/0x6a0 [ 69.001051][ T6490] ? __pfx_apparmor_file_open+0x10/0x10 [ 69.001078][ T6490] ? __pfx_chrdev_open+0x10/0x10 [ 69.001099][ T6490] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 69.001128][ T6490] do_dentry_open+0x6ab/0x14d0 [ 69.001148][ T6490] ? __pfx_chrdev_open+0x10/0x10 [ 69.001171][ T6490] vfs_open+0x82/0x3f0 [ 69.001195][ T6490] path_openat+0x19fa/0x2440 [ 69.001225][ T6490] ? __pfx_path_openat+0x10/0x10 [ 69.001250][ T6490] do_file_open+0x20e/0x430 [ 69.001271][ T6490] ? __pfx_do_file_open+0x10/0x10 [ 69.001304][ T6490] ? _raw_spin_unlock+0x28/0x50 [ 69.001319][ T6490] ? alloc_fd+0x471/0x7a0 [ 69.001345][ T6490] do_sys_openat2+0x10f/0x1e0 [ 69.001369][ T6490] ? __pfx_do_sys_openat2+0x10/0x10 [ 69.001401][ T6490] __ia32_compat_sys_openat+0x12d/0x210 [ 69.001419][ T6490] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 69.001443][ T6490] __do_fast_syscall_32+0x13a/0x8b0 [ 69.001467][ T6490] do_fast_syscall_32+0x32/0x70 [ 69.001488][ T6490] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 69.001508][ T6490] RIP: 0023:0xf743efec [ 69.001527][ T6490] Code: Unable to access opcode bytes at 0xf743efc2. [ 69.001534][ T6490] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 69.001549][ T6490] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800001c0 [ 69.001559][ T6490] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 69.001568][ T6490] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 69.001577][ T6490] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 69.001586][ T6490] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 69.001607][ T6490] [ 69.059230][ T6492] FAULT_INJECTION: forcing a failure. [ 69.059230][ T6492] name failslab, interval 1, probability 0, space 0, times 0 [ 69.059263][ T6492] CPU: 0 UID: 0 PID: 6492 Comm: syz.0.184 Not tainted syzkaller #0 PREEMPT(full) [ 69.059277][ T6492] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 69.059286][ T6492] Call Trace: [ 69.059291][ T6492] [ 69.059296][ T6492] dump_stack_lvl+0x100/0x190 [ 69.059314][ T6492] should_fail_ex.cold+0x5/0xa [ 69.059329][ T6492] should_failslab+0xc2/0x120 [ 69.059347][ T6492] __kmalloc_cache_noprof+0x91/0x6d0 [ 69.059361][ T6492] ? garp_init_applicant+0x38d/0x4e0 [ 69.059383][ T6492] garp_init_applicant+0x38d/0x4e0 [ 69.059402][ T6492] register_vlan_dev+0x197/0x910 [ 69.059422][ T6492] vlan_ioctl_handler+0x8e9/0xa70 [ 69.059438][ T6492] ? __pfx_vlan_ioctl_handler+0x10/0x10 [ 69.059460][ T6492] ? tomoyo_path_number_perm+0x188/0x580 [ 69.059474][ T6492] ? __pfx_vlan_ioctl_handler+0x10/0x10 [ 69.059489][ T6492] sock_ioctl+0x5e9/0x6b0 [ 69.059505][ T6492] ? __pfx_sock_ioctl+0x10/0x10 [ 69.059521][ T6492] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 69.059538][ T6492] ? do_vfs_ioctl+0x226/0x13e0 [ 69.059550][ T6492] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 69.059564][ T6492] compat_sock_ioctl+0x595/0x760 [ 69.059581][ T6492] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 69.059597][ T6492] ? hook_file_ioctl_common+0x140/0x440 [ 69.059612][ T6492] ? __fget_files+0x21f/0x3d0 [ 69.059636][ T6492] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 69.059653][ T6492] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 69.059668][ T6492] __do_fast_syscall_32+0x13a/0x8b0 [ 69.059685][ T6492] ? lockdep_hardirqs_on+0x7d/0x110 [ 69.059701][ T6492] do_fast_syscall_32+0x32/0x70 [ 69.059716][ T6492] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 69.059732][ T6492] RIP: 0023:0xf745efec [ 69.059745][ T6492] Code: Unable to access opcode bytes at 0xf745efc2. [ 69.059749][ T6492] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 69.059760][ T6492] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000008982 [ 69.059767][ T6492] RDX: 0000000080000280 RSI: 0000000000000000 RDI: 0000000000000000 [ 69.059773][ T6492] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 69.059789][ T6492] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 69.059799][ T6492] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 69.059823][ T6492] [ 69.189280][ T6498] faux_driver vgem: [drm] Unknown color mode 11176; guessing buffer size. [ 69.504100][ T5108] libceph: connect (1)[c::]:6789 error -101 [ 69.504183][ T5108] libceph: mon0 (1)[c::]:6789 connect error [ 69.504479][ T5108] libceph: connect (1)[c::]:6789 error -101 [ 69.504542][ T5108] libceph: mon0 (1)[c::]:6789 connect error [ 69.548518][ T6511] ceph: No mds server is up or the cluster is laggy [ 70.315320][ T42] audit: type=1804 audit(1791246221.836:9): pid=6543 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.201" name="/newroot/48/file0" dev="fuse" ino=1 res=1 errno=0 [ 70.650191][ T6559] netlink: 64 bytes leftover after parsing attributes in process `syz.3.206'. [ 70.658512][ T6563] binder: 6562:6563 ioctl c0306201 80000080 returned -14 [ 70.660668][ T6559] syzkaller1: entered promiscuous mode [ 70.660684][ T6559] syzkaller1: entered allmulticast mode [ 70.665283][ T6563] binder: 6562:6563 ioctl c0306201 800003c0 returned -14 [ 70.945753][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.965079][ T73] cfg80211: failed to load regulatory.db [ 72.320777][ T6603] syz_tun: entered allmulticast mode [ 72.671966][ T6636] Bluetooth: MGMT ver 1.23 [ 72.673234][ T6636] Bluetooth: hci0: unsupported parameter 255 [ 72.673252][ T6636] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 73.191821][ T6665] netlink: 8 bytes leftover after parsing attributes in process `syz.1.247'. [ 73.304765][ T6669] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 73.509882][ T6681] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 73.566423][ T6684] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 73.643482][ T6681] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 74.628616][ T6695] netlink: 'syz.1.261': attribute type 1 has an invalid length. [ 74.672902][ T6695] 8021q: adding VLAN 0 to HW filter on device bond1 [ 74.679553][ T6695] tipc: Resetting bearer [ 74.694919][ T6695] tipc: Resetting bearer [ 74.696363][ T6695] bond1: (slave syz_tun): Enslaving as a backup interface with an up link [ 75.380009][ T6728] FAULT_INJECTION: forcing a failure. [ 75.380009][ T6728] name failslab, interval 1, probability 0, space 0, times 0 [ 75.380116][ T6728] CPU: 3 UID: 0 PID: 6728 Comm: syz.3.270 Not tainted syzkaller #0 PREEMPT(full) [ 75.380138][ T6728] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.380148][ T6728] Call Trace: [ 75.380156][ T6728] [ 75.380163][ T6728] dump_stack_lvl+0x100/0x190 [ 75.380194][ T6728] should_fail_ex.cold+0x5/0xa [ 75.380217][ T6728] should_failslab+0xc2/0x120 [ 75.380245][ T6728] kmem_cache_alloc_noprof+0x92/0x6a0 [ 75.380271][ T6728] ? d_instantiate+0x8a/0xb0 [ 75.380297][ T6728] ? alloc_empty_file+0x5b/0x1c0 [ 75.380326][ T6728] alloc_empty_file+0x5b/0x1c0 [ 75.380353][ T6728] alloc_file_pseudo+0x183/0x290 [ 75.380381][ T6728] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 75.380406][ T6728] ? alloc_fd+0x471/0x7a0 [ 75.380432][ T6728] sock_alloc_file+0x50/0x210 [ 75.380454][ T6728] __sys_socket+0x1c0/0x260 [ 75.380475][ T6728] ? xfd_validate_state+0x129/0x190 [ 75.380502][ T6728] ? __pfx___sys_socket+0x10/0x10 [ 75.380532][ T6728] __ia32_sys_socket+0x72/0xb0 [ 75.380555][ T6728] ? lockdep_hardirqs_on+0x7d/0x110 [ 75.380576][ T6728] __do_fast_syscall_32+0x13a/0x8b0 [ 75.380603][ T6728] do_fast_syscall_32+0x32/0x70 [ 75.380626][ T6728] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 75.380649][ T6728] RIP: 0023:0xf748efec [ 75.380667][ T6728] Code: Unable to access opcode bytes at 0xf748efc2. [ 75.380675][ T6728] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 75.380693][ T6728] RAX: ffffffffffffffda RBX: 000000000000002b RCX: 0000000000000001 [ 75.380703][ T6728] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 75.380714][ T6728] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 75.380724][ T6728] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 75.380733][ T6728] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 75.380756][ T6728] [ 75.850151][ T1345] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 75.886928][ T6747] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 76.000919][ T1345] usb 5-1: New USB device found, idVendor=104f, idProduct=0004, bcdDevice= 1.00 [ 76.001812][ T1345] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 76.001833][ T1345] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 76.003481][ T1345] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 76.003494][ T1345] usb 5-1: Product: syz [ 76.003502][ T1345] usb 5-1: Manufacturer: syz [ 76.006773][ T1345] iuu_phoenix 5-1:1.0: iuu_phoenix converter detected [ 76.016923][ T1345] usb 5-1: iuu_phoenix converter now attached to ttyUSB0 [ 76.157662][ T6751] kvm: faulting far call emulation tainted memory [ 76.158112][ T6751] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 76.269670][ T6755] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 76.269691][ T6755] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 76.545154][ T6761] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 76.545177][ T6761] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 76.760690][ T6766] netlink: 4 bytes leftover after parsing attributes in process `syz.1.285'. [ 76.821055][ T6768] FAULT_INJECTION: forcing a failure. [ 76.821055][ T6768] name failslab, interval 1, probability 0, space 0, times 0 [ 76.821077][ T6768] CPU: 2 UID: 0 PID: 6768 Comm: syz.1.286 Not tainted syzkaller #0 PREEMPT(full) [ 76.821091][ T6768] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.821098][ T6768] Call Trace: [ 76.821102][ T6768] [ 76.821107][ T6768] dump_stack_lvl+0x100/0x190 [ 76.821127][ T6768] should_fail_ex.cold+0x5/0xa [ 76.821142][ T6768] should_failslab+0xc2/0x120 [ 76.821159][ T6768] __kmalloc_cache_node_noprof+0x94/0x720 [ 76.821202][ T6768] ? sbitmap_queue_init_node+0x291/0x4a0 [ 76.821233][ T6768] sbitmap_queue_init_node+0x291/0x4a0 [ 76.821260][ T6768] kyber_alloc_sched_data+0x30f/0x7b0 [ 76.821279][ T6768] ? __pfx_kyber_alloc_sched_data+0x10/0x10 [ 76.821293][ T6768] blk_mq_alloc_sched_res+0x105/0x250 [ 76.821320][ T6768] elevator_change+0x136/0x530 [ 76.821353][ T6768] elv_iosched_store+0x3be/0x460 [ 76.821376][ T6768] ? __pfx_elv_iosched_store+0x10/0x10 [ 76.821399][ T6768] ? kernfs_fop_write_iter+0x2c2/0x5f0 [ 76.821418][ T6768] ? __pfx_elv_iosched_store+0x10/0x10 [ 76.821443][ T6768] queue_attr_store+0x25f/0x2f0 [ 76.821468][ T6768] ? __pfx_queue_attr_store+0x10/0x10 [ 76.821490][ T6768] ? __lock_acquire+0x5c0/0x1f40 [ 76.821517][ T6768] ? lock_acquire+0x1d1/0x380 [ 76.821533][ T6768] ? sysfs_file_kobj+0x21/0x290 [ 76.821548][ T6768] ? find_held_lock+0x2b/0x80 [ 76.821561][ T6768] ? sysfs_file_kobj+0xe4/0x290 [ 76.821573][ T6768] ? sysfs_file_kobj+0xe4/0x290 [ 76.821587][ T6768] ? __pfx_queue_attr_store+0x10/0x10 [ 76.821600][ T6768] sysfs_kf_write+0xf2/0x150 [ 76.821614][ T6768] kernfs_fop_write_iter+0x3e0/0x5f0 [ 76.821625][ T6768] ? __pfx_sysfs_kf_write+0x10/0x10 [ 76.821639][ T6768] vfs_write+0x6af/0x1050 [ 76.821653][ T6768] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 76.821666][ T6768] ? __pfx_vfs_write+0x10/0x10 [ 76.821678][ T6768] ? find_held_lock+0x2b/0x80 [ 76.821699][ T6768] ksys_write+0x12a/0x250 [ 76.821712][ T6768] ? __pfx_ksys_write+0x10/0x10 [ 76.821729][ T6768] __do_fast_syscall_32+0x13a/0x8b0 [ 76.821752][ T6768] do_fast_syscall_32+0x32/0x70 [ 76.821768][ T6768] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 76.821783][ T6768] RIP: 0023:0xf743efec [ 76.821799][ T6768] Code: Unable to access opcode bytes at 0xf743efc2. [ 76.821804][ T6768] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 76.821816][ T6768] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800001c0 [ 76.821824][ T6768] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000000 [ 76.821830][ T6768] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 76.821836][ T6768] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 76.821842][ T6768] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 76.821856][ T6768] [ 76.953750][ T6774] capability: warning: `syz.3.288' uses 32-bit capabilities (legacy support in use) [ 76.971832][ T6772] syzkaller0: entered promiscuous mode [ 76.971849][ T6772] syzkaller0: entered allmulticast mode [ 77.269839][ T6741] iuu_phoenix ttyUSB0: iuu_open - failed submitting read urb, error -90 [ 77.275975][ T988] usb 5-1: USB disconnect, device number 3 [ 77.296069][ T988] iuu_phoenix ttyUSB0: iuu_phoenix converter now disconnected from ttyUSB0 [ 77.296786][ T988] iuu_phoenix 5-1:1.0: device disconnected [ 77.443893][ T6798] capability: warning: `syz.3.297' uses deprecated v2 capabilities in a way that may be insecure [ 77.888700][ T6815] netlink: 28 bytes leftover after parsing attributes in process `syz.3.301'. [ 77.888716][ T6815] netlink: 28 bytes leftover after parsing attributes in process `syz.3.301'. [ 77.888724][ T6815] netlink: 8 bytes leftover after parsing attributes in process `syz.3.301'. [ 77.901099][ T6817] binder: 6816:6817 ioctl c0306201 80000180 returned -14 [ 78.036978][ T6823] netlink: 24 bytes leftover after parsing attributes in process `syz.0.304'. [ 78.061494][ T6823] netlink: 4 bytes leftover after parsing attributes in process `syz.0.304'. [ 78.103794][ T6827] xt_ecn: cannot match TCP bits for non-tcp packets [ 78.484046][ T6842] netlink: 4 bytes leftover after parsing attributes in process `syz.0.311'. [ 78.493873][ T6842] netlink: 4 bytes leftover after parsing attributes in process `syz.0.311'. [ 78.494901][ T6842] netlink: 4 bytes leftover after parsing attributes in process `syz.0.311'. [ 78.574061][ T6848] netlink: 4 bytes leftover after parsing attributes in process `syz.0.313'. [ 78.651270][ T6853] input: syz0 as /devices/virtual/input/input7 [ 80.116719][ T6909] bridge1: port 1(dummy0) entered blocking state [ 80.116769][ T6909] bridge1: port 1(dummy0) entered disabled state [ 80.116835][ T6909] dummy0: entered allmulticast mode [ 80.118365][ T6909] dummy0: entered promiscuous mode [ 80.122301][ T6909] netlink: 'syz.1.325': attribute type 10 has an invalid length. [ 80.125204][ T6909] bridge1: port 1(dummy0) entered blocking state [ 80.125307][ T6909] bridge1: port 1(dummy0) entered forwarding state [ 80.126182][ T6909] dummy0: left allmulticast mode [ 80.126289][ T6909] bridge1: port 1(dummy0) entered disabled state [ 80.174189][ T6911] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 80.176656][ T6911] CIFS: Attempting to mount //127.0.0.1/share [ 80.310394][ T10] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 80.460141][ T10] usb 8-1: Using ep0 maxpacket: 32 [ 80.460610][ T10] usb 8-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 80.462886][ T10] usb 8-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 80.462908][ T10] usb 8-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 80.462920][ T10] usb 8-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 80.462932][ T10] usb 8-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 80.465164][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.465176][ T10] usb 8-1: Product: syz [ 80.465183][ T10] usb 8-1: Manufacturer: syz [ 80.465190][ T10] usb 8-1: SerialNumber: syz [ 80.471571][ C0] imon 8-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 80.482448][ T10] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:155.0/input/input8 [ 80.690105][ T10] imon 8-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 80.690117][ T10] (id 0x00) [ 80.740158][ T10] rc_core: IR keymap rc-imon-pad not found [ 80.740175][ T10] Registered IR keymap rc-empty [ 80.740240][ T10] imon 8-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 80.740254][ T10] imon 8-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 80.891662][ T10] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:155.0/rc/rc0 [ 80.894599][ T10] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:155.0/rc/rc0/input9 [ 80.901303][ T10] imon 8-1:155.0: iMON device (15c2:ffdc, intf0) on usb<8:2> initialized [ 81.006913][ T6911] CIFS: VFS: Error connecting to socket. Aborting operation. [ 81.006972][ T6911] CIFS: VFS: cifs_mount failed w/return code = -4 [ 81.337788][ T6907] imon:send_packet: task interrupted [ 81.337837][ T6907] imon:send_packet: packet tx failed (-512) [ 81.338612][ T6907] imon:vfd_write: send packet #1 failed [ 81.344268][ T30] usb 8-1: USB disconnect, device number 2 [ 81.681766][ T6935] sch_tbf: burst 128 is lower than device syzkaller0 mtu (1514) ! [ 81.684145][ T6935] syzkaller0: entered promiscuous mode [ 81.684164][ T6935] syzkaller0: entered allmulticast mode [ 82.595286][ T1133] ata2: SATA link down (SStatus 0 SControl 300) [ 82.596074][ T1128] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300) [ 82.602706][ T1128] ata1.00: configured for UDMA/100 [ 83.198932][ T6986] tipc: Failed to remove unknown binding: 66,0,0/0:847755170/847755172 [ 83.198961][ T6986] tipc: Failed to remove unknown binding: 66,0,0/0:847755170/847755171 [ 83.199481][ T6986] tipc: Failed to remove unknown binding: 66,0,0/0:847755170/847755172 [ 83.199501][ T6986] tipc: Failed to remove unknown binding: 66,0,0/0:847755170/847755171 [ 83.307205][ T6988] Set syz1 is full, maxelem 6117 reached [ 83.571734][ T7003] FAULT_INJECTION: forcing a failure. [ 83.571734][ T7003] name failslab, interval 1, probability 0, space 0, times 0 [ 83.571760][ T7003] CPU: 0 UID: 0 PID: 7003 Comm: syz.2.356 Not tainted syzkaller #0 PREEMPT(full) [ 83.571772][ T7003] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 83.571779][ T7003] Call Trace: [ 83.571782][ T7003] [ 83.571787][ T7003] dump_stack_lvl+0x100/0x190 [ 83.571812][ T7003] should_fail_ex.cold+0x5/0xa [ 83.571829][ T7003] should_failslab+0xc2/0x120 [ 83.571847][ T7003] __kmalloc_noprof+0xfc/0x840 [ 83.571861][ T7003] ? tomoyo_encode2+0xfb/0x3c0 [ 83.571878][ T7003] tomoyo_encode2+0xfb/0x3c0 [ 83.571894][ T7003] tomoyo_encode+0x29/0x50 [ 83.571907][ T7003] tomoyo_realpath_from_path+0x18c/0x690 [ 83.571924][ T7003] tomoyo_path2_perm+0x29f/0x700 [ 83.571935][ T7003] ? tomoyo_path2_perm+0x291/0x700 [ 83.571947][ T7003] ? __pfx_tomoyo_path2_perm+0x10/0x10 [ 83.571973][ T7003] ? do_raw_spin_lock+0x128/0x260 [ 83.571989][ T7003] tomoyo_path_rename+0xfc/0x1a0 [ 83.572005][ T7003] ? __pfx_tomoyo_path_rename+0x10/0x10 [ 83.572022][ T7003] ? do_raw_spin_unlock+0x145/0x1e0 [ 83.572036][ T7003] security_path_rename+0x18e/0x3c0 [ 83.572051][ T7003] filename_renameat2+0x731/0xa60 [ 83.572072][ T7003] ? __pfx_filename_renameat2+0x10/0x10 [ 83.572089][ T7003] ? lock_acquire+0x1d1/0x380 [ 83.572105][ T7003] ? __might_fault+0xc5/0x140 [ 83.572117][ T7003] ? __might_fault+0xc5/0x140 [ 83.572135][ T7003] ? do_getname+0x191/0x390 [ 83.572149][ T7003] __ia32_sys_renameat2+0xee/0x140 [ 83.572167][ T7003] __do_fast_syscall_32+0x13a/0x8b0 [ 83.572184][ T7003] do_fast_syscall_32+0x32/0x70 [ 83.572199][ T7003] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 83.572213][ T7003] RIP: 0023:0xf739efec [ 83.572226][ T7003] Code: Unable to access opcode bytes at 0xf739efc2. [ 83.572231][ T7003] RSP: 002b:00000000f53b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000161 [ 83.572243][ T7003] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000540 [ 83.572251][ T7003] RDX: 0000000000000004 RSI: 0000000080000740 RDI: 0000000000000001 [ 83.572257][ T7003] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 83.572264][ T7003] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 83.572271][ T7003] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 83.572284][ T7003] [ 83.572297][ T7003] ERROR: Out of memory at tomoyo_realpath_from_path. [ 83.640222][ T5782] usb 8-1: new full-speed USB device number 3 using dummy_hcd [ 83.792976][ T5782] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 0.00 [ 83.793409][ T5782] usb 8-1: config 0 has no interfaces? [ 83.794253][ T5782] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 83.794265][ T5782] usb 8-1: SerialNumber: syz [ 83.796218][ T5782] usb 8-1: config 0 descriptor?? [ 84.106184][ T10] usb 8-1: USB disconnect, device number 3 [ 84.276832][ T7035] syz_tun: entered allmulticast mode [ 84.280266][ T7035] pimreg: entered allmulticast mode [ 84.288910][ T7035] __nla_validate_parse: 2 callbacks suppressed [ 84.288922][ T7035] netlink: 4 bytes leftover after parsing attributes in process `syz.2.364'. [ 84.308600][ T7034] syz_tun: left allmulticast mode [ 84.308716][ T7034] pimreg: left allmulticast mode [ 84.330739][ T12] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 84.350215][ T12] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 84.350255][ T12] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 84.350285][ T12] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 84.440435][ T5819] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 84.584204][ T7045] netlink: 8 bytes leftover after parsing attributes in process `syz.2.368'. [ 84.600569][ T5819] usb 6-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 84.600592][ T5819] usb 6-1: too many configurations: 248, using maximum allowed: 8 [ 84.601514][ T5819] usb 6-1: config index 0 descriptor too short (expected 28277, got 36) [ 84.601528][ T5819] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.601537][ T5819] usb 6-1: config 0 has no interfaces? [ 84.602299][ T5819] usb 6-1: config index 1 descriptor too short (expected 28277, got 36) [ 84.602311][ T5819] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.602322][ T5819] usb 6-1: config 0 has no interfaces? [ 84.603039][ T5819] usb 6-1: config index 2 descriptor too short (expected 28277, got 36) [ 84.603051][ T5819] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.603059][ T5819] usb 6-1: config 0 has no interfaces? [ 84.603828][ T5819] usb 6-1: config index 3 descriptor too short (expected 28277, got 36) [ 84.603840][ T5819] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.603848][ T5819] usb 6-1: config 0 has no interfaces? [ 84.604577][ T5819] usb 6-1: config index 4 descriptor too short (expected 28277, got 36) [ 84.604592][ T5819] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.604604][ T5819] usb 6-1: config 0 has no interfaces? [ 84.605754][ T5819] usb 6-1: config index 5 descriptor too short (expected 28277, got 36) [ 84.605766][ T5819] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.605774][ T5819] usb 6-1: config 0 has no interfaces? [ 84.608650][ T5819] usb 6-1: config index 6 descriptor too short (expected 28277, got 36) [ 84.608662][ T5819] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.608671][ T5819] usb 6-1: config 0 has no interfaces? [ 84.609702][ T5819] usb 6-1: config index 7 descriptor too short (expected 28277, got 36) [ 84.609714][ T5819] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.609723][ T5819] usb 6-1: config 0 has no interfaces? [ 84.609735][ T5819] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.610988][ T5819] usb 6-1: config 0 descriptor?? [ 84.662706][ T42] audit: type=1326 audit(1791246236.186:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7047 comm="syz.3.369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 84.662757][ T42] audit: type=1326 audit(1791246236.186:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7047 comm="syz.3.369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 84.677028][ T42] audit: type=1326 audit(1791246236.196:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7047 comm="syz.3.369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 84.678087][ T42] audit: type=1326 audit(1791246236.196:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7047 comm="syz.3.369" exe="/syz-executor" sig=0 arch=40000003 syscall=41 compat=1 ip=0xf748efec code=0x7ffc0000 [ 84.678133][ T42] audit: type=1326 audit(1791246236.196:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7047 comm="syz.3.369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 84.678324][ T42] audit: type=1326 audit(1791246236.196:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7047 comm="syz.3.369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 84.678484][ T42] audit: type=1326 audit(1791246236.196:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7047 comm="syz.3.369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 84.678858][ T42] audit: type=1326 audit(1791246236.196:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7047 comm="syz.3.369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 84.679225][ T42] audit: type=1326 audit(1791246236.196:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7047 comm="syz.3.369" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf748efec code=0x7ffc0000 [ 84.679323][ T42] audit: type=1326 audit(1791246236.196:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7047 comm="syz.3.369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 84.837525][ T5819] usb 6-1: string descriptor 0 read error: -71 [ 84.846410][ T5819] usb 6-1: USB disconnect, device number 2 [ 86.793276][ T7099] Bluetooth: (null): Invalid header checksum [ 87.044600][ T7101] »»»»»»: renamed from vlan0 (while UP) [ 87.530147][ T30] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 87.693003][ T30] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 87.694118][ T30] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 87.694154][ T30] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.714579][ T30] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 87.714684][ T30] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 81 [ 87.714712][ T30] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 1 [ 87.715598][ T30] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 84 [ 87.715658][ T30] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 2 [ 87.719637][ T30] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 87.720710][ T30] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 88 [ 87.720743][ T30] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 87.725622][ T30] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 87.762215][ T12] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.838359][ T7118] netlink: 4 bytes leftover after parsing attributes in process `syz.1.394'. [ 87.905723][ T988] usb 5-1: USB disconnect, device number 4 [ 87.908379][ T988] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 87.921537][ T988] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 87.921817][ T988] keyspan 5-1:1.0: device disconnected [ 88.247997][ T7135] netlink: 24 bytes leftover after parsing attributes in process `syz.3.397'. [ 88.390326][ T7135] netlink: 4 bytes leftover after parsing attributes in process `syz.3.397'. [ 88.563556][ T7138] Set syz1 is full, maxelem 6117 reached [ 88.628391][ T7142] random: crng reseeded on system resumption [ 88.978802][ T7164] netlink: 'syz.3.408': attribute type 1 has an invalid length. [ 88.992030][ T7164] 8021q: adding VLAN 0 to HW filter on device bond1 [ 89.020624][ T7164] bond1: (slave syz_tun): Enslaving as a backup interface with an up link [ 89.060137][ T1345] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 89.230167][ T1345] usb 7-1: Using ep0 maxpacket: 16 [ 89.231453][ T1345] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 89.233264][ T1345] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 89.234806][ T1345] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.234820][ T1345] usb 7-1: Product: syz [ 89.234830][ T1345] usb 7-1: Manufacturer: syz [ 89.234839][ T1345] usb 7-1: SerialNumber: syz [ 89.242744][ T1345] usb 7-1: config 0 descriptor?? [ 89.245465][ T1345] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 89.245490][ T1345] em28xx 7-1:0.0: DVB interface 0 found: bulk [ 89.858829][ T1345] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 89.937594][ T7171] FAULT_INJECTION: forcing a failure. [ 89.937594][ T7171] name failslab, interval 1, probability 0, space 0, times 0 [ 89.937615][ T7171] CPU: 1 UID: 0 PID: 7171 Comm: syz.0.418 Not tainted syzkaller #0 PREEMPT(full) [ 89.937628][ T7171] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 89.937634][ T7171] Call Trace: [ 89.937638][ T7171] [ 89.937643][ T7171] dump_stack_lvl+0x100/0x190 [ 89.937661][ T7171] should_fail_ex.cold+0x5/0xa [ 89.937675][ T7171] should_failslab+0xc2/0x120 [ 89.937694][ T7171] __kvmalloc_node_noprof+0x113/0x9b0 [ 89.937711][ T7171] ? sbitmap_init_node+0x1cc/0x720 [ 89.937729][ T7171] sbitmap_init_node+0x1cc/0x720 [ 89.937748][ T7171] sbitmap_queue_init_node+0x40/0x4a0 [ 89.937766][ T7171] kyber_alloc_sched_data+0x30f/0x7b0 [ 89.937780][ T7171] ? __pfx_kyber_alloc_sched_data+0x10/0x10 [ 89.937792][ T7171] blk_mq_alloc_sched_res+0x105/0x250 [ 89.937810][ T7171] elevator_change+0x136/0x530 [ 89.937827][ T7171] elv_iosched_store+0x3be/0x460 [ 89.937843][ T7171] ? __pfx_elv_iosched_store+0x10/0x10 [ 89.937862][ T7171] ? kernfs_fop_write_iter+0x2c2/0x5f0 [ 89.937875][ T7171] ? __pfx_elv_iosched_store+0x10/0x10 [ 89.937891][ T7171] queue_attr_store+0x25f/0x2f0 [ 89.937905][ T7171] ? __pfx_queue_attr_store+0x10/0x10 [ 89.937917][ T7171] ? __lock_acquire+0x5c0/0x1f40 [ 89.937938][ T7171] ? lock_acquire+0x1d1/0x380 [ 89.937953][ T7171] ? sysfs_file_kobj+0x21/0x290 [ 89.937966][ T7171] ? find_held_lock+0x2b/0x80 [ 89.937978][ T7171] ? sysfs_file_kobj+0xe4/0x290 [ 89.937990][ T7171] ? sysfs_file_kobj+0xe4/0x290 [ 89.938005][ T7171] ? __pfx_queue_attr_store+0x10/0x10 [ 89.938017][ T7171] sysfs_kf_write+0xf2/0x150 [ 89.938032][ T7171] kernfs_fop_write_iter+0x3e0/0x5f0 [ 89.938042][ T7171] ? __pfx_sysfs_kf_write+0x10/0x10 [ 89.938057][ T7171] vfs_write+0x6af/0x1050 [ 89.938076][ T7171] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 89.938094][ T7171] ? __pfx_vfs_write+0x10/0x10 [ 89.938109][ T7171] ? find_held_lock+0x2b/0x80 [ 89.938142][ T7171] ksys_write+0x12a/0x250 [ 89.938169][ T7171] ? __pfx_ksys_write+0x10/0x10 [ 89.938187][ T7171] __do_fast_syscall_32+0x13a/0x8b0 [ 89.938206][ T7171] do_fast_syscall_32+0x32/0x70 [ 89.938222][ T7171] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 89.938237][ T7171] RIP: 0023:0xf745efec [ 89.938250][ T7171] Code: Unable to access opcode bytes at 0xf745efc2. [ 89.938255][ T7171] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 89.938266][ T7171] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800001c0 [ 89.938272][ T7171] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000000 [ 89.938279][ T7171] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 89.938285][ T7171] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 89.938292][ T7171] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 89.938307][ T7171] [ 90.271972][ T1345] em28xx 7-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 90.272003][ T1345] em28xx 7-1:0.0: board has no eeprom [ 90.350197][ T7157] em28xx 7-1:0.0: write to i2c device at 0xe failed with unknown error (status=1) [ 90.580243][ T1345] em28xx 7-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 90.580271][ T1345] em28xx 7-1:0.0: dvb set to bulk mode. [ 90.583239][ T57] em28xx 7-1:0.0: Binding DVB extension [ 90.592442][ T1345] usb 7-1: USB disconnect, device number 3 [ 90.593572][ T1345] em28xx 7-1:0.0: Disconnecting em28xx [ 90.610909][ T57] em28xx 7-1:0.0: Registering input extension [ 90.611731][ T1345] em28xx 7-1:0.0: Closing input extension [ 90.638502][ T1345] em28xx: Freeing device [ 91.292461][ T7208] syzkaller0: Caught tx_queue_len zero misconfig [ 92.796139][ T7242] syzkaller0: entered promiscuous mode [ 92.796155][ T7242] syzkaller0: entered allmulticast mode [ 93.026653][ T7255] evm: overlay not supported [ 93.192546][ T7261] syzkaller0: entered promiscuous mode [ 93.192560][ T7261] syzkaller0: entered allmulticast mode [ 93.305257][ T7265] FAULT_INJECTION: forcing a failure. [ 93.305257][ T7265] name failslab, interval 1, probability 0, space 0, times 0 [ 93.305278][ T7265] CPU: 0 UID: 0 PID: 7265 Comm: syz.2.439 Not tainted syzkaller #0 PREEMPT(full) [ 93.305291][ T7265] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.305297][ T7265] Call Trace: [ 93.305301][ T7265] [ 93.305305][ T7265] dump_stack_lvl+0x100/0x190 [ 93.305324][ T7265] should_fail_ex.cold+0x5/0xa [ 93.305339][ T7265] should_failslab+0xc2/0x120 [ 93.305356][ T7265] __kmalloc_cache_noprof+0x91/0x6d0 [ 93.305369][ T7265] ? snd_midi_event_new+0x6f/0x210 [ 93.305383][ T7265] snd_midi_event_new+0x6f/0x210 [ 93.305395][ T7265] snd_virmidi_input_open+0x107/0x470 [ 93.305410][ T7265] open_substream+0x480/0x970 [ 93.305425][ T7265] rawmidi_open_priv+0x55d/0x6f0 [ 93.305441][ T7265] snd_rawmidi_open+0x4b4/0xb90 [ 93.305459][ T7265] ? __pfx_snd_rawmidi_open+0x10/0x10 [ 93.305474][ T7265] ? __pfx_default_wake_function+0x10/0x10 [ 93.305492][ T7265] ? lock_acquire+0x1d1/0x380 [ 93.305508][ T7265] ? kobject_get_unless_zero+0x156/0x200 [ 93.305527][ T7265] ? __pfx_snd_rawmidi_open+0x10/0x10 [ 93.305541][ T7265] snd_open+0x201/0x450 [ 93.305553][ T7265] ? __pfx_snd_open+0x10/0x10 [ 93.305564][ T7265] chrdev_open+0x234/0x6a0 [ 93.305579][ T7265] ? __pfx_apparmor_file_open+0x10/0x10 [ 93.305592][ T7265] ? __pfx_chrdev_open+0x10/0x10 [ 93.305623][ T7265] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 93.305647][ T7265] do_dentry_open+0x6ab/0x14d0 [ 93.305662][ T7265] ? __pfx_chrdev_open+0x10/0x10 [ 93.305681][ T7265] vfs_open+0x82/0x3f0 [ 93.305699][ T7265] path_openat+0x19fa/0x2440 [ 93.305717][ T7265] ? __pfx_path_openat+0x10/0x10 [ 93.305738][ T7265] do_file_open+0x20e/0x430 [ 93.305755][ T7265] ? __pfx_do_file_open+0x10/0x10 [ 93.305780][ T7265] ? _raw_spin_unlock+0x28/0x50 [ 93.305792][ T7265] ? alloc_fd+0x471/0x7a0 [ 93.305811][ T7265] do_sys_openat2+0x10f/0x1e0 [ 93.305828][ T7265] ? __pfx_do_sys_openat2+0x10/0x10 [ 93.305844][ T7265] ? find_held_lock+0x2b/0x80 [ 93.305859][ T7265] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 93.305872][ T7265] ? __ia32_sys_futex_time32+0x2fd/0x470 [ 93.305887][ T7265] __ia32_compat_sys_openat+0x12d/0x210 [ 93.305898][ T7265] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 93.305915][ T7265] do_int80_emulation+0x166/0x650 [ 93.305931][ T7265] asm_int80_emulation+0x1a/0x20 [ 93.305942][ T7265] RIP: 0023:0xf70f75eb [ 93.305951][ T7265] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 93.305962][ T7265] RSP: 002b:00000000f53b603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 93.305973][ T7265] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f53b6100 [ 93.305980][ T7265] RDX: 0000000000141102 RSI: 0000000000000000 RDI: 0000000000000000 [ 93.305986][ T7265] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 93.305992][ T7265] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 93.305998][ T7265] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 93.306011][ T7265] [ 93.428149][ T7271] jffs2: notice: (7271) jffs2_build_xattr_subsystem: complete building xattr subsystem, 18 of xdatum (0 unchecked, 18 orphan) and 18 of xref (3 dead, 15 orphan) found. [ 93.449388][ T7271] FAULT_INJECTION: forcing a failure. [ 93.449388][ T7271] name failslab, interval 1, probability 0, space 0, times 0 [ 93.449408][ T7271] CPU: 2 UID: 0 PID: 7271 Comm: syz.1.441 Not tainted syzkaller #0 PREEMPT(full) [ 93.449420][ T7271] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.449427][ T7271] Call Trace: [ 93.449430][ T7271] [ 93.449435][ T7271] dump_stack_lvl+0x100/0x190 [ 93.449453][ T7271] should_fail_ex.cold+0x5/0xa [ 93.449468][ T7271] should_failslab+0xc2/0x120 [ 93.449486][ T7271] kmem_cache_alloc_noprof+0x92/0x6a0 [ 93.449501][ T7271] ? lock_acquire+0x1d1/0x380 [ 93.449516][ T7271] ? jffs2_prealloc_raw_node_refs+0x1db/0x370 [ 93.449537][ T7271] jffs2_prealloc_raw_node_refs+0x1db/0x370 [ 93.449557][ T7271] jffs2_reserve_space+0x676/0xbb0 [ 93.449579][ T7271] ? __pfx_jffs2_reserve_space+0x10/0x10 [ 93.449595][ T7271] ? trace_kmem_cache_alloc+0xdd/0x100 [ 93.449611][ T7271] ? __kasan_slab_alloc+0x89/0x90 [ 93.449626][ T7271] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 93.449643][ T7271] ? jffs2_mkdir+0x91/0xdb0 [ 93.449658][ T7271] jffs2_mkdir+0x146/0xdb0 [ 93.449671][ T7271] ? bpf_lsm_inode_permission+0x9/0x10 [ 93.449687][ T7271] ? __pfx_jffs2_mkdir+0x10/0x10 [ 93.449704][ T7271] vfs_mkdir+0x364/0x850 [ 93.449717][ T7271] filename_mkdirat+0x48b/0x5e0 [ 93.449734][ T7271] ? __pfx_filename_mkdirat+0x10/0x10 [ 93.449749][ T7271] ? strncpy_from_user+0x19d/0x2d0 [ 93.449768][ T7271] ? do_getname+0x191/0x390 [ 93.449779][ T7271] __ia32_sys_mkdirat+0x88/0xc0 [ 93.449796][ T7271] __do_fast_syscall_32+0x13a/0x8b0 [ 93.449812][ T7271] do_fast_syscall_32+0x32/0x70 [ 93.449826][ T7271] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 93.449858][ T7271] RIP: 0023:0xf743efec [ 93.449873][ T7271] Code: Unable to access opcode bytes at 0xf743efc2. [ 93.449878][ T7271] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000128 [ 93.449890][ T7271] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000000 [ 93.449898][ T7271] RDX: 00000000000001ff RSI: 0000000000000000 RDI: 0000000000000000 [ 93.449905][ T7271] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 93.449912][ T7271] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 93.449919][ T7271] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 93.449933][ T7271] [ 93.696957][ T7288] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 93.757486][ T7289] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 93.796197][ T7291] sit0: entered promiscuous mode [ 93.801413][ T7291] netlink: 'syz.3.448': attribute type 1 has an invalid length. [ 93.801426][ T7291] netlink: 1 bytes leftover after parsing attributes in process `syz.3.448'. [ 93.814696][ T7289] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 93.821366][ T1345] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 93.893925][ T7294] tipc: Failed to remove unknown binding: 66,0,0/0:4030707460/4030707462 [ 93.893942][ T7294] tipc: Failed to remove unknown binding: 66,0,0/0:4030707460/4030707461 [ 93.895498][ T7294] tipc: Failed to remove unknown binding: 66,0,0/0:4030707460/4030707462 [ 93.895512][ T7294] tipc: Failed to remove unknown binding: 66,0,0/0:4030707460/4030707461 [ 93.972848][ T1345] usb 7-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 93.973652][ T1345] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 93.973666][ T1345] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 93.976076][ T1345] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.976088][ T1345] usb 7-1: Product: syz [ 93.976096][ T1345] usb 7-1: Manufacturer: syz [ 93.976103][ T1345] usb 7-1: SerialNumber: syz [ 94.195597][ T1345] usb 7-1: Limiting number of CPorts to U8_MAX [ 95.001231][ T12] usb 7-1: failed to submit out-urb: -90 [ 95.001251][ T12] greybus greybus1: 0/0:0: failed to send response 0 for type 0x01: -90 [ 95.209447][ T13] usb 7-1: failed to submit out-urb: -90 [ 95.209464][ T13] greybus greybus1: 0/0:0: synchronous operation id 0x0002 of type 0x10 failed: -90 [ 95.209551][ T13] greybus 1-svc: power mode change failed on AP to switch link: -90 [ 95.210615][ T12] usb 7-1: failed to submit out-urb: -90 [ 95.210628][ T12] greybus greybus1: 0/0:0: synchronous operation id 0x0003 of type 0x14 failed: -90 [ 95.210661][ T12] greybus 1-svc: failed to get rail count: -90 [ 95.211143][ T12] usb 7-1: failed to submit out-urb: -90 [ 95.211154][ T12] greybus greybus1: 0/0:0: failed to send response 0 for type 0x02: -90 [ 95.406693][ T5819] usb 7-1: USB disconnect, device number 4 [ 95.406736][ C3] usb 7-1: failed to resubmit arpc in-urb: -19 [ 95.406755][ C3] usb 7-1: failed to resubmit arpc in-urb: -19 [ 95.406768][ C3] usb 7-1: failed to resubmit in-urb: -19 [ 95.406781][ C3] usb 7-1: failed to resubmit in-urb: -19 [ 95.406794][ C3] usb 7-1: failed to resubmit in-urb: -19 [ 95.406806][ C3] usb 7-1: failed to resubmit in-urb: -19 [ 95.423304][ T5819] usb 7-1: failed to send ARPC request 4: -19 [ 95.423339][ T5819] usb 7-1: failed to execute ARPC: -19 [ 95.423346][ T5819] usb 7-1: failed to flush cport 0: -19 [ 95.423354][ T5819] greybus greybus1: 0/0:0: failed to flush host cport: -19 [ 95.423411][ T5819] usb 7-1: failed to send ARPC request 2: -19 [ 95.423440][ T5819] usb 7-1: failed to execute ARPC: -19 [ 95.423446][ T5819] usb 7-1: failed to quiesce cport 0: -19 (0) [ 95.423455][ T5819] greybus greybus1: 0/0:0: failed to quiesce host cport: -19 [ 95.423510][ T5819] usb 7-1: failed to send ARPC request 3: -19 [ 95.423538][ T5819] usb 7-1: failed to execute ARPC: -19 [ 95.423545][ T5819] usb 7-1: failed to clear cport 0: -19 [ 95.423552][ T5819] greybus greybus1: 0/0:0: failed to clear host cport: -19 [ 95.972648][ T7301] FAULT_INJECTION: forcing a failure. [ 95.972648][ T7301] name failslab, interval 1, probability 0, space 0, times 0 [ 95.972682][ T7301] CPU: 1 UID: 0 PID: 7301 Comm: syz.2.453 Not tainted syzkaller #0 PREEMPT(full) [ 95.972707][ T7301] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.972719][ T7301] Call Trace: [ 95.972726][ T7301] [ 95.972734][ T7301] dump_stack_lvl+0x100/0x190 [ 95.972767][ T7301] should_fail_ex.cold+0x5/0xa [ 95.972794][ T7301] should_failslab+0xc2/0x120 [ 95.972824][ T7301] __kvmalloc_node_noprof+0x113/0x9b0 [ 95.972855][ T7301] ? sbitmap_init_node+0x1cc/0x720 [ 95.972887][ T7301] sbitmap_init_node+0x1cc/0x720 [ 95.972918][ T7301] sbitmap_queue_init_node+0x40/0x4a0 [ 95.972950][ T7301] kyber_alloc_sched_data+0x30f/0x7b0 [ 95.972976][ T7301] ? __pfx_kyber_alloc_sched_data+0x10/0x10 [ 95.972997][ T7301] blk_mq_alloc_sched_res+0x105/0x250 [ 95.973030][ T7301] elevator_change+0x136/0x530 [ 95.973061][ T7301] elv_iosched_store+0x3be/0x460 [ 95.973088][ T7301] ? __pfx_elv_iosched_store+0x10/0x10 [ 95.973130][ T7301] ? kernfs_fop_write_iter+0x2c2/0x5f0 [ 95.973154][ T7301] ? __pfx_elv_iosched_store+0x10/0x10 [ 95.973183][ T7301] queue_attr_store+0x25f/0x2f0 [ 95.973209][ T7301] ? __pfx_queue_attr_store+0x10/0x10 [ 95.973233][ T7301] ? __lock_acquire+0x5c0/0x1f40 [ 95.973272][ T7301] ? lock_acquire+0x1d1/0x380 [ 95.973298][ T7301] ? sysfs_file_kobj+0x21/0x290 [ 95.973322][ T7301] ? find_held_lock+0x2b/0x80 [ 95.973344][ T7301] ? sysfs_file_kobj+0xe4/0x290 [ 95.973365][ T7301] ? sysfs_file_kobj+0xe4/0x290 [ 95.973391][ T7301] ? __pfx_queue_attr_store+0x10/0x10 [ 95.973414][ T7301] sysfs_kf_write+0xf2/0x150 [ 95.973439][ T7301] kernfs_fop_write_iter+0x3e0/0x5f0 [ 95.973457][ T7301] ? __pfx_sysfs_kf_write+0x10/0x10 [ 95.973483][ T7301] vfs_write+0x6af/0x1050 [ 95.973508][ T7301] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 95.973530][ T7301] ? __pfx_vfs_write+0x10/0x10 [ 95.973551][ T7301] ? find_held_lock+0x2b/0x80 [ 95.973592][ T7301] ksys_write+0x12a/0x250 [ 95.973615][ T7301] ? __pfx_ksys_write+0x10/0x10 [ 95.973647][ T7301] __do_fast_syscall_32+0x13a/0x8b0 [ 95.973676][ T7301] do_fast_syscall_32+0x32/0x70 [ 95.973701][ T7301] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 95.973726][ T7301] RIP: 0023:0xf739efec [ 95.973748][ T7301] Code: Unable to access opcode bytes at 0xf739efc2. [ 95.973756][ T7301] RSP: 002b:00000000f53b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 95.973774][ T7301] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800001c0 [ 95.973786][ T7301] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000000 [ 95.973797][ T7301] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 95.973808][ T7301] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 95.973819][ T7301] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 95.973845][ T7301] [ 97.004457][ T7321] netlink: 24 bytes leftover after parsing attributes in process `syz.0.459'. [ 97.522342][ T7333] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 97.895083][ T7339] FAULT_INJECTION: forcing a failure. [ 97.895083][ T7339] name failslab, interval 1, probability 0, space 0, times 0 [ 97.895111][ T7339] CPU: 3 UID: 0 PID: 7339 Comm: syz.2.469 Not tainted syzkaller #0 PREEMPT(full) [ 97.895129][ T7339] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.895250][ T7339] Call Trace: [ 97.895256][ T7339] [ 97.895263][ T7339] dump_stack_lvl+0x100/0x190 [ 97.895292][ T7339] should_fail_ex.cold+0x5/0xa [ 97.895314][ T7339] should_failslab+0xc2/0x120 [ 97.895338][ T7339] __kmalloc_cache_noprof+0x91/0x6d0 [ 97.895356][ T7339] ? get_device_parent+0x260/0x4c0 [ 97.895372][ T7339] ? get_device_parent+0x29a/0x4c0 [ 97.895391][ T7339] get_device_parent+0x29a/0x4c0 [ 97.895410][ T7339] device_add+0xc3b/0x1970 [ 97.895434][ T7339] ? __pfx_dev_set_name+0x10/0x10 [ 97.895454][ T7339] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 97.895477][ T7339] ? __pfx_device_add+0x10/0x10 [ 97.895495][ T7339] ? lockdep_init_map_type+0x5c/0x250 [ 97.895520][ T7339] ? __init_waitqueue_head+0xca/0x150 [ 97.895541][ T7339] wakeup_source_device_create+0x243/0x2e0 [ 97.895563][ T7339] wakeup_source_sysfs_add+0x1c/0x90 [ 97.895589][ T7339] wakeup_source_register+0x154/0x3e0 [ 97.895618][ T7339] ep_create_wakeup_source+0x1df/0x2e0 [ 97.895642][ T7339] ? __pfx_ep_create_wakeup_source+0x10/0x10 [ 97.895668][ T7339] ? do_epoll_ctl_file+0x10d0/0x36e0 [ 97.895691][ T7339] ? do_epoll_ctl_file+0x10d0/0x36e0 [ 97.895721][ T7339] do_epoll_ctl_file+0x1e26/0x36e0 [ 97.895753][ T7339] ? __pfx_do_epoll_ctl_file+0x10/0x10 [ 97.895777][ T7339] ? lock_acquire+0x1d1/0x380 [ 97.895800][ T7339] ? __fget_files+0x34/0x3d0 [ 97.895822][ T7339] ? find_held_lock+0x2b/0x80 [ 97.895842][ T7339] ? __fget_files+0x215/0x3d0 [ 97.895866][ T7339] ? __fget_files+0x21f/0x3d0 [ 97.895891][ T7339] ? do_epoll_ctl+0xfd/0x1a0 [ 97.895913][ T7339] do_epoll_ctl+0xfd/0x1a0 [ 97.895938][ T7339] ? __pfx_do_epoll_ctl+0x10/0x10 [ 97.895968][ T7339] __ia32_sys_epoll_ctl+0x15b/0x1e0 [ 97.895992][ T7339] ? __pfx___ia32_sys_epoll_ctl+0x10/0x10 [ 97.896024][ T7339] __do_fast_syscall_32+0x13a/0x8b0 [ 97.896074][ T7339] do_fast_syscall_32+0x32/0x70 [ 97.896096][ T7339] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 97.896117][ T7339] RIP: 0023:0xf739efec [ 97.896137][ T7339] Code: Unable to access opcode bytes at 0xf739efc2. [ 97.896144][ T7339] RSP: 002b:00000000f53b650c EFLAGS: 00000292 ORIG_RAX: 00000000000000ff [ 97.896163][ T7339] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000000001 [ 97.896174][ T7339] RDX: 0000000000000006 RSI: 0000000080000140 RDI: 0000000000000000 [ 97.896184][ T7339] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 97.896194][ T7339] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 97.896203][ T7339] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 97.896224][ T7339] [ 97.993669][ T7342] Bluetooth: hci0: load_link_keys: too big key_count value 65280 [ 98.262714][ T7358] syzkaller0: entered promiscuous mode [ 98.262727][ T7358] syzkaller0: entered allmulticast mode [ 99.066129][ T5096] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 99.069221][ T5096] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 99.077005][ T5096] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 99.083129][ T5096] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 99.085695][ T5096] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 99.436673][ T7373] dummy0 speed is unknown, defaulting to 1000 [ 99.749706][ T7373] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.749834][ T7373] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.749928][ T7373] bridge_slave_0: entered allmulticast mode [ 99.751704][ T7373] bridge_slave_0: entered promiscuous mode [ 99.754649][ T7373] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.754810][ T7373] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.754904][ T7373] bridge_slave_1: entered allmulticast mode [ 99.756368][ T7373] bridge_slave_1: entered promiscuous mode [ 99.783259][ T7373] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.786229][ T7373] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.808130][ T7373] team0: Port device team_slave_0 added [ 99.809603][ T7373] team0: Port device team_slave_1 added [ 99.832471][ T7373] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.832488][ T7373] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.832507][ T7373] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.833996][ T7373] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.834007][ T7373] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.834027][ T7373] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.870000][ T7373] hsr_slave_0: entered promiscuous mode [ 99.870871][ T7373] hsr_slave_1: entered promiscuous mode [ 99.871496][ T7373] debugfs: 'hsr0' already exists in 'hsr' [ 99.871514][ T7373] Cannot create hsr debugfs directory [ 99.985998][ T7373] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 99.990189][ T7373] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 99.990701][ T7373] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 99.994221][ T7373] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 99.994648][ T7373] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 99.998249][ T7373] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 99.998658][ T7373] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 100.002214][ T7373] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 100.012791][ T7373] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.012839][ T7373] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.012945][ T7373] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.012986][ T7373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.031194][ T1170] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.038621][ T1170] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.054440][ T7373] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.061690][ T7373] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.066754][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.066802][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.073782][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.073828][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.369652][ T7373] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.538243][ T7373] veth0_vlan: entered promiscuous mode [ 100.542227][ T7373] veth1_vlan: entered promiscuous mode [ 100.562006][ T7373] veth0_macvtap: entered promiscuous mode [ 100.564154][ T7373] veth1_macvtap: entered promiscuous mode [ 100.573529][ T7373] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.577998][ T7373] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.645756][ T1158] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.645778][ T1158] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.662420][ T1158] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.662438][ T1158] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.681269][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.690184][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.690209][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.690225][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.181078][ T5096] Bluetooth: hci3: command tx timeout [ 101.791433][ T7432] syzkaller0: entered promiscuous mode [ 101.791447][ T7432] syzkaller0: entered allmulticast mode [ 102.561310][ T7462] netlink: 'syz.0.493': attribute type 1 has an invalid length. [ 102.573675][ T7462] bond1: entered promiscuous mode [ 102.573888][ T7462] 8021q: adding VLAN 0 to HW filter on device bond1 [ 102.603183][ T7462] macvtap1: entered allmulticast mode [ 102.619642][ T7462] bond1: (slave bridge2): making interface the new active one [ 102.619658][ T7462] bridge2: entered promiscuous mode [ 102.625933][ T7462] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 102.698217][ T7465] jffs2: notice: (7465) jffs2_build_xattr_subsystem: complete building xattr subsystem, 18 of xdatum (0 unchecked, 18 orphan) and 18 of xref (3 dead, 15 orphan) found. [ 102.704811][ T7465] jffs2: warning: (7465) jffs2_sum_write_data: Not enough space for summary, padsize = -2 [ 103.260166][ T5096] Bluetooth: hci3: command tx timeout [ 105.341003][ T5096] Bluetooth: hci3: command tx timeout [ 107.431651][ T5096] Bluetooth: hci3: command tx timeout [ 111.506857][ T5739] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 111.512281][ T5739] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 111.515235][ T5739] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 111.521195][ T5739] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 111.522842][ T5739] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 111.569953][ T5734] syz_tun (unregistering): left allmulticast mode [ 111.574850][ T5734] bond1: (slave syz_tun): Removing an active aggregator [ 111.575382][ T5734] bond1: (slave syz_tun): Releasing backup interface [ 111.687889][ T5592] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.738820][ T7495] dummy0 speed is unknown, defaulting to 1000 [ 111.775903][ T5592] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.877409][ T5592] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.926687][ T7511] FAULT_INJECTION: forcing a failure. [ 111.926687][ T7511] name failslab, interval 1, probability 0, space 0, times 0 [ 111.926716][ T7511] CPU: 2 UID: 0 PID: 7511 Comm: syz.4.503 Not tainted syzkaller #0 PREEMPT(full) [ 111.926736][ T7511] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 111.926746][ T7511] Call Trace: [ 111.926753][ T7511] [ 111.926761][ T7511] dump_stack_lvl+0x100/0x190 [ 111.926790][ T7511] should_fail_ex.cold+0x5/0xa [ 111.926816][ T7511] should_failslab+0xc2/0x120 [ 111.926846][ T7511] __kmalloc_noprof+0xfc/0x840 [ 111.926871][ T7511] ? __register_sysctl_table+0xac/0x1650 [ 111.926906][ T7511] __register_sysctl_table+0xac/0x1650 [ 111.926963][ T7511] ? trace_kmalloc+0xeb/0x110 [ 111.926992][ T7511] ? __kasan_kmalloc+0xaa/0xb0 [ 111.927019][ T7511] ? __kmalloc_node_track_caller_noprof+0x35b/0x870 [ 111.927051][ T7511] ? __pfx___register_sysctl_table+0x10/0x10 [ 111.927080][ T7511] ? register_pidns_sysctls+0x48/0x1c0 [ 111.927106][ T7511] ? __asan_memcpy+0x3c/0x60 [ 111.927131][ T7511] register_pidns_sysctls+0x11d/0x1c0 [ 111.927154][ T7511] ? __ns_common_init+0x299/0x4b0 [ 111.927174][ T7511] copy_pid_ns+0x680/0x10a0 [ 111.927196][ T7511] ? __pfx_copy_pid_ns+0x10/0x10 [ 111.927217][ T7511] ? __pfx_copy_mnt_ns+0x10/0x10 [ 111.927249][ T7511] ? create_new_namespaces+0x30/0xac0 [ 111.927281][ T7511] create_new_namespaces+0x2aa/0xac0 [ 111.927314][ T7511] unshare_nsproxy_namespaces+0xf2/0x220 [ 111.927345][ T7511] ksys_unshare+0x4a2/0xa70 [ 111.927366][ T7511] ? __pfx_ksys_unshare+0x10/0x10 [ 111.927395][ T7511] __ia32_sys_unshare+0x30/0x40 [ 111.927414][ T7511] __do_fast_syscall_32+0x13a/0x8b0 [ 111.927444][ T7511] do_fast_syscall_32+0x32/0x70 [ 111.927469][ T7511] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 111.927494][ T7511] RIP: 0023:0xf742efec [ 111.927514][ T7511] Code: Unable to access opcode bytes at 0xf742efc2. [ 111.927522][ T7511] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000136 [ 111.927541][ T7511] RAX: ffffffffffffffda RBX: 0000000060040000 RCX: 0000000000000000 [ 111.927553][ T7511] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 111.927563][ T7511] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 111.927574][ T7511] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 111.927584][ T7511] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 111.927608][ T7511] [ 112.048187][ T5592] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.259731][ T7527] netlink: 4 bytes leftover after parsing attributes in process `syz.0.505'. [ 112.274287][ T7495] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.274404][ T7495] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.274527][ T7495] bridge_slave_0: entered allmulticast mode [ 112.276337][ T7495] bridge_slave_0: entered promiscuous mode [ 112.300636][ T7495] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.300719][ T7495] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.300840][ T7495] bridge_slave_1: entered allmulticast mode [ 112.302714][ T7495] bridge_slave_1: entered promiscuous mode [ 112.339709][ T5592] bridge_slave_1: left allmulticast mode [ 112.339744][ T5592] bridge_slave_1: left promiscuous mode [ 112.342231][ T5592] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.354682][ T5592] bridge_slave_0: left allmulticast mode [ 112.354699][ T5592] bridge_slave_0: left promiscuous mode [ 112.354798][ T5592] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.609638][ T5592] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 112.624404][ T5592] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 112.626498][ T5592] bond0 (unregistering): Released all slaves [ 112.641571][ T5592] bond1 (unregistering): Released all slaves [ 112.916170][ T7495] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 112.921559][ T7495] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 112.972885][ T7495] team0: Port device team_slave_0 added [ 112.974229][ T7495] team0: Port device team_slave_1 added [ 112.991059][ T7495] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 112.991070][ T7495] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 112.991082][ T7495] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 112.991957][ T7495] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 112.991965][ T7495] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 112.991977][ T7495] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 113.039765][ T7495] hsr_slave_0: entered promiscuous mode [ 113.042252][ T7495] hsr_slave_1: entered promiscuous mode [ 113.042585][ T7495] debugfs: 'hsr0' already exists in 'hsr' [ 113.042597][ T7495] Cannot create hsr debugfs directory [ 113.580272][ T5096] Bluetooth: hci4: command tx timeout [ 114.376151][ T10] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 114.385636][ T7550] uprobe: syz.1.512:7550 failed to unregister, leaking uprobe [ 114.520246][ T10] usb 9-1: Using ep0 maxpacket: 16 [ 114.522783][ T10] usb 9-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 114.526145][ T10] usb 9-1: config 0 has an invalid interface number: 8 but max is 0 [ 114.526166][ T10] usb 9-1: config 0 has no interface number 0 [ 114.526205][ T10] usb 9-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 114.526224][ T10] usb 9-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 114.528222][ T10] usb 9-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 114.528243][ T10] usb 9-1: Product: syz [ 114.528254][ T10] usb 9-1: SerialNumber: syz [ 114.539892][ T7552] FAULT_INJECTION: forcing a failure. [ 114.539892][ T7552] name failslab, interval 1, probability 0, space 0, times 0 [ 114.539922][ T7552] CPU: 1 UID: 0 PID: 7552 Comm: syz.1.513 Not tainted syzkaller #0 PREEMPT(full) [ 114.539943][ T7552] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 114.539954][ T7552] Call Trace: [ 114.539961][ T7552] [ 114.539969][ T7552] dump_stack_lvl+0x100/0x190 [ 114.540001][ T7552] should_fail_ex.cold+0x5/0xa [ 114.540045][ T7552] should_failslab+0xc2/0x120 [ 114.540079][ T7552] __kmalloc_cache_noprof+0x91/0x6d0 [ 114.540105][ T7552] ? sctp_stream_init_ext+0x4e/0x1b0 [ 114.540137][ T7552] sctp_stream_init_ext+0x4e/0x1b0 [ 114.540162][ T7552] sctp_sendmsg_to_asoc+0x17a2/0x1cb0 [ 114.540190][ T7552] ? aa_inet_msg_perm+0x337/0x8f0 [ 114.540222][ T7552] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 114.540248][ T7552] ? do_raw_spin_lock+0x128/0x260 [ 114.540269][ T7552] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 114.540293][ T7552] ? sctp_sendmsg_check_sflags+0x176/0x360 [ 114.540322][ T7552] sctp_sendmsg+0x1144/0x22e0 [ 114.540347][ T7552] ? __pfx_sctp_sendmsg+0x10/0x10 [ 114.540366][ T7552] ? aa_file_perm+0x7e4/0x14d0 [ 114.540395][ T7552] ? tomoyo_socket_sendmsg_permission+0x14e/0x3c0 [ 114.540427][ T7552] ? aa_sock_msg_perm+0x11e/0x200 [ 114.540457][ T7552] ? __pfx_sctp_sendmsg+0x10/0x10 [ 114.540477][ T7552] inet_sendmsg+0x11c/0x140 [ 114.540503][ T7552] sock_write_iter+0x4ea/0x5b0 [ 114.540527][ T7552] ? __pfx_inet_sendmsg+0x10/0x10 [ 114.540559][ T7552] ? __pfx_sock_write_iter+0x10/0x10 [ 114.540593][ T7552] ? bpf_lsm_file_permission+0x9/0x10 [ 114.540622][ T7552] ? security_file_permission+0x76/0x210 [ 114.540648][ T7552] ? rw_verify_area+0xce/0x6d0 [ 114.540671][ T7552] vfs_write+0x6af/0x1050 [ 114.540695][ T7552] ? __pfx_sock_write_iter+0x10/0x10 [ 114.540721][ T7552] ? __pfx_vfs_write+0x10/0x10 [ 114.540742][ T7552] ? find_held_lock+0x2b/0x80 [ 114.540781][ T7552] ksys_write+0x1f8/0x250 [ 114.540804][ T7552] ? __pfx_ksys_write+0x10/0x10 [ 114.540834][ T7552] __do_fast_syscall_32+0x13a/0x8b0 [ 114.540864][ T7552] do_fast_syscall_32+0x32/0x70 [ 114.540911][ T7552] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 114.540937][ T7552] RIP: 0023:0xf743efec [ 114.540960][ T7552] Code: Unable to access opcode bytes at 0xf743efc2. [ 114.540969][ T7552] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 114.540989][ T7552] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800007c0 [ 114.541000][ T7552] RDX: 0000000000000163 RSI: 0000000000000000 RDI: 0000000000000000 [ 114.541011][ T7552] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 114.541021][ T7552] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 114.541033][ T7552] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 114.541057][ T7552] [ 114.598262][ T10] usb 9-1: config 0 descriptor?? [ 114.598868][ T7557] jffs2: notice: (7557) jffs2_build_xattr_subsystem: complete building xattr subsystem, 19 of xdatum (0 unchecked, 18 orphan) and 19 of xref (3 dead, 15 orphan) found. [ 114.619906][ T7495] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 114.628667][ T7495] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 114.629485][ T7495] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 114.638576][ T7495] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 114.639485][ T7495] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 114.644031][ T7495] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 114.644683][ T7495] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 114.648884][ T7495] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 114.726416][ T10] cm109 9-1:0.8: invalid payload size 0, expected 4 [ 114.736806][ T10] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.8/input/input11 [ 114.876004][ T7495] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.946285][ T7495] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.948676][ T5451] 8021q: adding VLAN 0 to HW filter on device eth2 [ 114.963505][ T1159] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.964032][ T1159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 115.002149][ T1159] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.002227][ T1159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 115.035576][ T5592] hsr_slave_0: left promiscuous mode [ 115.036442][ T5592] hsr_slave_1: left promiscuous mode [ 115.037954][ T5592] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 115.038442][ T5592] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 115.042773][ T5592] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 115.042785][ T5592] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 115.060923][ T5592] veth1_macvtap: left promiscuous mode [ 115.061912][ T5592] veth0_macvtap: left promiscuous mode [ 115.062158][ T5592] veth1_vlan: left promiscuous mode [ 115.062241][ T5592] veth0_vlan: left promiscuous mode [ 115.069144][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 115.232287][ T5592] team0 (unregistering): Port device team_slave_1 removed [ 115.410238][ T42] kauditd_printk_skb: 89 callbacks suppressed [ 115.410259][ T42] audit: type=1800 audit(1791246266.936:109): pid=7579 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.519" name="(" dev="sda1" ino=2044 res=0 errno=0 [ 115.410870][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 115.411095][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 115.411277][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 115.411455][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 115.411644][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 115.411830][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 115.412029][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 115.412204][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 115.412376][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 115.412766][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 115.417776][ T5833] usb 9-1: USB disconnect, device number 2 [ 115.417866][ C0] cm109 9-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 115.471425][ T5833] cm109 9-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 115.589712][ T7594] syzkaller0: entered promiscuous mode [ 115.589726][ T7594] syzkaller0: entered allmulticast mode [ 115.643065][ T5451] 8021q: adding VLAN 0 to HW filter on device eth3 [ 115.646518][ T7598] netlink: 8 bytes leftover after parsing attributes in process `syz.0.522'. [ 115.660139][ T5096] Bluetooth: hci4: command tx timeout [ 115.753200][ T7607] Illegal XDP return value 4294967294 on prog (id 31) dev N/A, expect packet loss! [ 115.881457][ T7495] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 115.915877][ T5451] 8021q: adding VLAN 0 to HW filter on device eth4 [ 116.004950][ T7625] netlink: 'syz.4.526': attribute type 1 has an invalid length. [ 116.144754][ T5451] 8021q: adding VLAN 0 to HW filter on device eth5 [ 116.233833][ T7495] veth0_vlan: entered promiscuous mode [ 116.242129][ T7495] veth1_vlan: entered promiscuous mode [ 116.278655][ T7495] veth0_macvtap: entered promiscuous mode [ 116.284536][ T7495] veth1_macvtap: entered promiscuous mode [ 116.298033][ T7495] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 116.303832][ T7646] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 116.319561][ T7495] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 116.324218][ T7646] kvm: pic: level sensitive irq not supported [ 116.325063][ T7646] kvm: pic: non byte read [ 116.352054][ T5592] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.352099][ T5592] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.352132][ T5592] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.352162][ T5592] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.418107][ T1280] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.418125][ T1280] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.435620][ T1280] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.435641][ T1280] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.333818][ T7661] netlink: 16 bytes leftover after parsing attributes in process `syz.4.534'. [ 117.691958][ T7671] IPVS: rr: UDP 127.0.0.1:5060 - no destination available [ 117.693900][ T37] IPVS: starting estimator thread 0... [ 117.705716][ T7666] overlayfs: failed to clone lowerpath [ 117.740408][ T5096] Bluetooth: hci4: command tx timeout [ 117.785832][ T42] audit: type=1326 audit(1791246269.306:110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7680 comm="syz.1.541" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf743efec code=0x0 [ 117.797756][ T7675] IPVS: using max 27 ests per chain, 64800 per kthread [ 118.086938][ T42] audit: type=1326 audit(1791246269.606:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7691 comm="syz.5.544" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 118.087896][ T42] audit: type=1326 audit(1791246269.606:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7691 comm="syz.5.544" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 118.098748][ T42] audit: type=1326 audit(1791246269.606:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7691 comm="syz.5.544" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 118.098797][ T42] audit: type=1326 audit(1791246269.616:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7691 comm="syz.5.544" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 118.098838][ T42] audit: type=1326 audit(1791246269.616:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7691 comm="syz.5.544" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf742efec code=0x7ffc0000 [ 118.098873][ T42] audit: type=1326 audit(1791246269.616:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7691 comm="syz.5.544" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 118.098929][ T42] audit: type=1326 audit(1791246269.616:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7691 comm="syz.5.544" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf742efec code=0x7ffc0000 [ 118.126028][ T42] audit: type=1326 audit(1791246269.636:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7691 comm="syz.5.544" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 119.781916][ T7740] binder: 7739:7740 ioctl c018620c 80000200 returned -1 [ 119.820172][ T5096] Bluetooth: hci4: command tx timeout [ 120.200750][ T7752] overlayfs: failed to clone lowerpath [ 122.123640][ T7770] FAULT_INJECTION: forcing a failure. [ 122.123640][ T7770] name failslab, interval 1, probability 0, space 0, times 0 [ 122.123660][ T7770] CPU: 1 UID: 0 PID: 7770 Comm: syz.1.567 Not tainted syzkaller #0 PREEMPT(full) [ 122.123673][ T7770] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.123679][ T7770] Call Trace: [ 122.123683][ T7770] [ 122.123688][ T7770] dump_stack_lvl+0x100/0x190 [ 122.123706][ T7770] should_fail_ex.cold+0x5/0xa [ 122.123720][ T7770] should_failslab+0xc2/0x120 [ 122.123738][ T7770] __kmalloc_noprof+0xfc/0x840 [ 122.123752][ T7770] ? asymmetric_key_generate_id+0x7e/0x180 [ 122.123769][ T7770] asymmetric_key_generate_id+0x7e/0x180 [ 122.123784][ T7770] x509_note_issuer+0x128/0x210 [ 122.123800][ T7770] asn1_ber_decoder+0xd0c/0x2170 [ 122.123819][ T7770] ? __pfx_asn1_ber_decoder+0x10/0x10 [ 122.123834][ T7770] ? kasan_save_track+0x14/0x30 [ 122.123848][ T7770] ? __kasan_kmalloc+0xaa/0xb0 [ 122.123863][ T7770] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 122.123875][ T7770] ? x509_cert_parse+0x162/0x910 [ 122.123891][ T7770] x509_cert_parse+0x1c9/0x910 [ 122.123922][ T7770] x509_key_preparse+0x65/0x9c0 [ 122.123941][ T7770] asymmetric_key_preparse+0xce/0x1d0 [ 122.123953][ T7770] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 122.123967][ T7770] __key_create_or_update+0x463/0xe30 [ 122.123982][ T7770] ? __pfx___key_create_or_update+0x10/0x10 [ 122.123996][ T7770] ? lookup_user_key+0x3f3/0x1300 [ 122.124016][ T7770] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 122.124031][ T7770] key_create_or_update+0x42/0x60 [ 122.124048][ T7770] __do_sys_add_key+0x2e8/0x460 [ 122.124065][ T7770] ? __pfx___do_sys_add_key+0x10/0x10 [ 122.124087][ T7770] __do_fast_syscall_32+0x13a/0x8b0 [ 122.124105][ T7770] do_fast_syscall_32+0x32/0x70 [ 122.124119][ T7770] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 122.124133][ T7770] RIP: 0023:0xf743efec [ 122.124145][ T7770] Code: Unable to access opcode bytes at 0xf743efc2. [ 122.124151][ T7770] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 000000000000011e [ 122.124162][ T7770] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000000000 [ 122.124170][ T7770] RDX: 0000000080000200 RSI: 0000000000000559 RDI: 00000000ffffffff [ 122.124177][ T7770] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 122.124185][ T7770] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 122.124192][ T7770] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 122.124206][ T7770] [ 122.343366][ T7756] syz.5.562 (7756) used greatest stack depth: 19544 bytes left [ 122.552257][ T5834] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 122.675024][ T1158] ================================================================== [ 122.675035][ T1158] BUG: KASAN: slab-use-after-free in drm_atomic_helper_wait_for_vblanks.part.0+0x7d5/0x8a0 [ 122.675055][ T1158] Read of size 1 at addr ffff88802622e009 by task kworker/u33:8/1158 [ 122.675064][ T1158] [ 122.675070][ T1158] CPU: 0 UID: 0 PID: 1158 Comm: kworker/u33:8 Not tainted syzkaller #0 PREEMPT(full) [ 122.675082][ T1158] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.675090][ T1158] Workqueue: events_unbound commit_work [ 122.675103][ T1158] Call Trace: [ 122.675107][ T1158] [ 122.675112][ T1158] dump_stack_lvl+0x100/0x190 [ 122.675127][ T1158] print_report+0x13d/0x4b0 [ 122.675143][ T1158] ? __virt_addr_valid+0x239/0x430 [ 122.675165][ T1158] ? drm_atomic_helper_wait_for_vblanks.part.0+0x7d5/0x8a0 [ 122.675178][ T1158] kasan_report+0xdf/0x1c0 [ 122.675194][ T1158] ? drm_atomic_helper_wait_for_vblanks.part.0+0x7d5/0x8a0 [ 122.675221][ T1158] drm_atomic_helper_wait_for_vblanks.part.0+0x7d5/0x8a0 [ 122.675234][ T1158] ? preempt_schedule_common+0x3c/0xb0 [ 122.675246][ T1158] ? preempt_schedule_thunk+0x16/0x40 [ 122.675259][ T1158] ? __pfx_drm_atomic_helper_wait_for_vblanks.part.0+0x10/0x10 [ 122.675272][ T1158] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 122.675284][ T1158] ? drm_atomic_helper_commit_hw_done+0x36d/0x490 [ 122.675298][ T1158] drm_atomic_helper_commit_tail+0xff/0x130 [ 122.675310][ T1158] commit_tail+0x338/0x430 [ 122.675322][ T1158] process_one_work+0xac7/0x1b10 [ 122.675338][ T1158] ? __pfx_process_one_work+0x10/0x10 [ 122.675352][ T1158] ? lock_acquire+0x1d1/0x380 [ 122.675369][ T1158] ? __pfx_commit_work+0x10/0x10 [ 122.675381][ T1158] worker_thread+0x5ef/0xe50 [ 122.675396][ T1158] ? kthread+0x13a/0x450 [ 122.675407][ T1158] ? __pfx_worker_thread+0x10/0x10 [ 122.675420][ T1158] kthread+0x373/0x450 [ 122.675431][ T1158] ? __pfx_kthread+0x10/0x10 [ 122.675443][ T1158] ret_from_fork+0x730/0xd60 [ 122.675453][ T1158] ? __pfx_ret_from_fork+0x10/0x10 [ 122.675463][ T1158] ? __switch_to+0x800/0x10f0 [ 122.675477][ T1158] ? __pfx_kthread+0x10/0x10 [ 122.675489][ T1158] ret_from_fork_asm+0x1a/0x30 [ 122.675502][ T1158] [ 122.675506][ T1158] [ 122.675508][ T1158] Allocated by task 7790: [ 122.675513][ T1158] kasan_save_stack+0x30/0x50 [ 122.675526][ T1158] kasan_save_track+0x14/0x30 [ 122.675539][ T1158] __kasan_kmalloc+0xaa/0xb0 [ 122.675552][ T1158] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 122.675562][ T1158] drm_atomic_helper_crtc_duplicate_state+0x72/0xd0 [ 122.675576][ T1158] drm_atomic_get_crtc_state+0x1de/0x690 [ 122.675591][ T1158] drm_atomic_set_property+0x165/0x3f90 [ 122.675602][ T1158] drm_mode_atomic_ioctl+0x6ed/0x2940 [ 122.675612][ T1158] drm_ioctl_kernel+0x1f3/0x3e0 [ 122.675622][ T1158] drm_ioctl+0x5e6/0xc60 [ 122.675631][ T1158] drm_compat_ioctl+0x386/0x4c0 [ 122.675644][ T1158] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 122.675659][ T1158] __do_fast_syscall_32+0x13a/0x8b0 [ 122.675678][ T1158] do_fast_syscall_32+0x32/0x70 [ 122.675696][ T1158] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 122.675717][ T1158] [ 122.675720][ T1158] Freed by task 5833: [ 122.675729][ T1158] kasan_save_stack+0x30/0x50 [ 122.675750][ T1158] kasan_save_track+0x14/0x30 [ 122.675771][ T1158] kasan_save_free_info+0x3b/0x70 [ 122.675786][ T1158] __kasan_slab_free+0x5f/0x80 [ 122.675800][ T1158] kfree+0x22b/0x6d0 [ 122.675809][ T1158] drm_atomic_commit_default_clear+0x465/0x10c0 [ 122.675819][ T1158] __drm_atomic_commit_free+0x185/0x2f0 [ 122.675829][ T1158] drm_atomic_helper_dirtyfb+0x578/0x790 [ 122.675843][ T1158] drm_fbdev_shmem_helper_fb_dirty+0x1cc/0x350 [ 122.675857][ T1158] drm_fb_helper_damage_work+0x4c8/0xab0 [ 122.675869][ T1158] process_one_work+0xac7/0x1b10 [ 122.675881][ T1158] worker_thread+0x5ef/0xe50 [ 122.675892][ T1158] kthread+0x373/0x450 [ 122.675903][ T1158] ret_from_fork+0x730/0xd60 [ 122.675911][ T1158] ret_from_fork_asm+0x1a/0x30 [ 122.675920][ T1158] [ 122.675923][ T1158] The buggy address belongs to the object at ffff88802622e000 [ 122.675923][ T1158] which belongs to the cache kmalloc-512 of size 512 [ 122.675931][ T1158] The buggy address is located 9 bytes inside of [ 122.675931][ T1158] freed 512-byte region [ffff88802622e000, ffff88802622e200) [ 122.675941][ T1158] [ 122.675943][ T1158] The buggy address belongs to the physical page: [ 122.675948][ T1158] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2622c [ 122.675957][ T1158] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 122.675966][ T1158] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 122.675975][ T1158] page_type: f5(slab) [ 122.675995][ T1158] raw: 00fff00000000040 ffff88801c042c80 dead000000000100 dead000000000122 [ 122.676004][ T1158] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 122.676016][ T1158] head: 00fff00000000040 ffff88801c042c80 dead000000000100 dead000000000122 [ 122.676025][ T1158] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 122.676034][ T1158] head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 122.676045][ T1158] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 122.676051][ T1158] page dumped because: kasan: bad access detected [ 122.676056][ T1158] page_owner tracks the page as allocated [ 122.676060][ T1158] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4709430018 [ 122.676076][ T1158] post_alloc_hook+0xfd/0x120 [ 122.676086][ T1158] get_page_from_freelist+0x110d/0x35d0 [ 122.676097][ T1158] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 122.676109][ T1158] new_slab+0xa9/0x6e0 [ 122.676119][ T1158] refill_objects+0xe3/0x410 [ 122.676129][ T1158] __pcs_replace_empty_main+0x35e/0x650 [ 122.676139][ T1158] __kmalloc_flags_noprof+0x6a9/0x8e0 [ 122.676149][ T1158] do_kmem_cache_create+0x6fc/0x7a0 [ 122.676167][ T1158] __kmem_cache_create_args+0x1e3/0x430 [ 122.676184][ T1158] i915_scheduler_module_init+0x8a/0xe0 [ 122.676195][ T1158] i915_init+0x5b/0x1c0 [ 122.676203][ T1158] do_one_initcall+0x11c/0x6f0 [ 122.676211][ T1158] kernel_init_freeable+0x6ea/0x7b0 [ 122.676224][ T1158] kernel_init+0x21/0x1e0 [ 122.676238][ T1158] ret_from_fork+0x730/0xd60 [ 122.676246][ T1158] ret_from_fork_asm+0x1a/0x30 [ 122.676255][ T1158] page_owner free stack trace missing [ 122.676259][ T1158] [ 122.676261][ T1158] Memory state around the buggy address: [ 122.676266][ T1158] ffff88802622df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 122.676273][ T1158] ffff88802622df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 122.676280][ T1158] >ffff88802622e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 122.676285][ T1158] ^ [ 122.676290][ T1158] ffff88802622e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 122.676297][ T1158] ffff88802622e100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 122.676302][ T1158] ================================================================== [ 122.676333][ T1158] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 122.913871][ T1158] CPU: 0 UID: 0 PID: 1158 Comm: kworker/u33:8 Not tainted syzkaller #0 PREEMPT(full) [ 122.916977][ T1158] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.920706][ T1158] Workqueue: events_unbound commit_work [ 122.922742][ T1158] Call Trace: [ 122.924006][ T1158] [ 122.925153][ T1158] dump_stack_lvl+0x100/0x190 [ 122.926880][ T1158] vpanic+0x553/0x970 [ 122.928204][ T1158] ? __pfx_vpanic+0x10/0x10 [ 122.929734][ T1158] ? mark_held_locks+0x40/0x70 [ 122.931379][ T1158] ? irqentry_exit+0x24d/0xa10 [ 122.932905][ T1158] ? drm_atomic_helper_wait_for_vblanks.part.0+0x7d5/0x8a0 [ 122.935122][ T1158] panic+0xd1/0xe0 [ 122.936325][ T1158] ? __pfx_panic+0x10/0x10 [ 122.937789][ T1158] check_panic_on_warn.cold+0x19/0x34 [ 122.939583][ T1158] end_report.part.0+0x3a/0x90 [ 122.941115][ T1158] kasan_report.cold+0xe/0x18 [ 122.942611][ T1158] ? drm_atomic_helper_wait_for_vblanks.part.0+0x7d5/0x8a0 [ 122.944846][ T1158] drm_atomic_helper_wait_for_vblanks.part.0+0x7d5/0x8a0 [ 122.947132][ T1158] ? preempt_schedule_common+0x3c/0xb0 [ 122.948922][ T1158] ? preempt_schedule_thunk+0x16/0x40 [ 122.950962][ T1158] ? __pfx_drm_atomic_helper_wait_for_vblanks.part.0+0x10/0x10 [ 122.953380][ T1158] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 122.955337][ T1158] ? drm_atomic_helper_commit_hw_done+0x36d/0x490 [ 122.957427][ T1158] drm_atomic_helper_commit_tail+0xff/0x130 [ 122.959428][ T1158] commit_tail+0x338/0x430 [ 122.960903][ T1158] process_one_work+0xac7/0x1b10 [ 122.962528][ T1158] ? __pfx_process_one_work+0x10/0x10 [ 122.964296][ T1158] ? lock_acquire+0x1d1/0x380 [ 122.965847][ T1158] ? __pfx_commit_work+0x10/0x10 [ 122.967610][ T1158] worker_thread+0x5ef/0xe50 [ 122.969187][ T1158] ? kthread+0x13a/0x450 [ 122.970674][ T1158] ? __pfx_worker_thread+0x10/0x10 [ 122.972347][ T1158] kthread+0x373/0x450 [ 122.973695][ T1158] ? __pfx_kthread+0x10/0x10 [ 122.975232][ T1158] ret_from_fork+0x730/0xd60 [ 122.976768][ T1158] ? __pfx_ret_from_fork+0x10/0x10 [ 122.978521][ T1158] ? __switch_to+0x800/0x10f0 [ 122.980101][ T1158] ? __pfx_kthread+0x10/0x10 [ 122.981600][ T1158] ret_from_fork_asm+0x1a/0x30 [ 122.983137][ T1158] [ 122.985217][ T1158] Kernel Offset: disabled [ 122.986724][ T1158] Rebooting in 86400 seconds.. VM DIAGNOSIS: 00:24:34 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000065 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85b01805 RDI=ffffffff9bc654e0 RBP=ffffffff9bc654a0 RSP=ffffc90003b57220 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3236323038386552 R12=0000000000000000 R13=0000000000000065 R14=000000000000000a R15=ffffc90003b57538 RIP=ffffffff85b0182f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096952000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f7f8a190 CR3=000000007999f000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=000000000000000e DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000008 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000003800000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000000 RBX=ffff88806bd80000 RCX=0000000000000001 RDX=0000000000000000 RSI=0000000000000001 RDI=ffff888040b30000 RBP=0000000000000006 RSP=ffffc90002146d18 R8 =0000000000000005 R9 =0000000000000010 R10=000000000000000a R11=ffff88806bd80042 R12=00000000000040b0 R13=ffff888021ae60e5 R14=00000000000000b0 R15=0000000000000040 RIP=ffffffff820ba3d0 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096a52000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000033511ff8 CR3=000000006b0db000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=000000000000000e DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000000 RBX=ffffc9000045ff48 RCX=ffffc90000547f64 RDX=0000000000000102 RSI=ffffffff8e36c6ac RDI=ffffffff8c624080 RBP=0000000000000001 RSP=ffffc90000547f80 R8 =0000000000000001 R9 =0000000000000007 R10=0000000000000200 R11=000000000000aedd R12=ffffc90000548060 R13=ffffc90000548010 R14=ffffc9000045ff48 R15=ffffc90000548044 RIP=ffffffff81f0709a RFL=00000292 [--S-A--] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096b52000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f3248f08708 CR3=000000004c9bb000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=000000000000000e DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000cc160081 Opmask01=0000000000000001 Opmask02=00000000efffbfff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000001e ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055c0485f66f0 000055c04867b780 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055c048519660 000055c048519710 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000a6425006469 702e73257325002f 6e75722f7261762f 0036353261687300 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000a410000414c 550b56005600000a 4b50570a5744530a 00131017444d5600 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 fd80400ab7292680 6ac43fbc00020014 0000004800000080 0008000800000747 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000008000080008 0000075000000750 ffffffffffffffff 000600147cb85a5a ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 c2bc8b9700000000 000080fe00010014 00000008fd80400a b72926806ac43fbc ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0002001400000048 0000008000080008 0000074700000747 ffffffffffffffff ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000600149689264b 6af6143700000000 000080fe00010014 00000007fd80400a ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0a65640a65640a20 3236207020205f62 0a65203620202020 2036203330002036 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 bfbfbfbfbfbfbfbf bfbfbfbfbfbfbfbf bfbfbfbfbfbfbfbf bfbff52532232d20 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 262821df2e2e33df 3228df3232202b22 df312e232d2435bf 2324353124322431 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000004b8fc490cb RBX=ffff88802b523d80 RCX=00000000000006e0 RDX=000000000000004b RSI=ffffffff81fb41f5 RDI=ffff888029260000 RBP=0000001c8a1a270f RSP=ffffc900068c7738 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=1ffff92000d18ef1 R13=0000000000000001 R14=0000000000000001 R15=ffff88802b523dc0 RIP=ffffffff81fb4208 RFL=00000007 [-----PC] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096c52000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000031a12ff8 CR3=00000000602a5000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000f000000000 0000000300000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000