last executing test programs: 3.022011571s ago: executing program 2 (id=1558): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000d"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x20}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0xfeff, 0x0}, 0x0) 3.021830872s ago: executing program 2 (id=1559): socket$igmp6(0xa, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000380)={0x18, 0x0, @ioapic={0x8000000, 0xc, 0x10001, 0xfffffffe, 0x0, [{0x2, 0x4, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x40, '\x00', 0xb}, {0xff, 0x7f, 0x9, '\x00', 0x67}, {0x0, 0x5, 0xd4, '\x00', 0xf}, {0x7, 0x9, 0xc, '\x00', 0xfb}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7b}, {0x3, 0x4, 0x8}, {0x7f, 0xd, 0xb, '\x00', 0xb}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x6, '\x00', 0xdc}, {0xff, 0x1, 0xfe, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xc7, 0x4, 0x1, '\x00', 0x6}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x6, '\x00', 0xb}, {0x0, 0x6, 0x2, '\x00', 0x8}, {0x5, 0x9, 0x5, '\x00', 0x1c}, {0x7, 0xe1, 0x7, '\x00', 0xc2}, {0x0, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7b}, {0x10, 0x6, 0x3, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4}]}}) mkdir(&(0x7f0000000140)='./debugfs\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./debugfs\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debugfs/ubifs/chk_index\x00', 0x2, 0x0) pread64(r4, 0x0, 0x0, 0x0) r5 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) 2.064130827s ago: executing program 2 (id=1566): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000480), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f00000004c0)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000500)=0x6f) syz_usb_connect$cdc_ncm(0x4, 0x6e, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000005c0)=0x7) write$dsp(r0, &(0x7f0000002180)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c0928", 0x18) 1.947866565s ago: executing program 3 (id=1567): socket$nl_generic(0x10, 0x3, 0x10) timer_create(0x0, &(0x7f0000000400)={0x0, 0x21, 0x2}, &(0x7f0000000600)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000640)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) msgctl$IPC_RMID(0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000680)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000700)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000780)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000800), 0x651, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xff, 0x0, 0x12, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$usbmon(&(0x7f0000000840), 0x5, 0x0) pread64(r3, 0x0, 0x0, 0x1) recvmmsg(r1, &(0x7f0000000880), 0x10106, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg(0xffffffffffffffff, 0x0, 0x0) r4 = syz_open_dev$usbfs(&(0x7f00000008c0), 0xf, 0x101301) ioctl$USBDEVFS_IOCTL(r4, 0x80045505, &(0x7f0000000900)=@usbdevfs_connect) timerfd_create(0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000940)={'syz0\x00', {0x8, 0x4, 0x8b, 0xfffa}, 0x1d, [0xeb, 0xc95a, 0x6, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x1, 0x3, 0x0, 0x6, 0x4, 0x4008, 0x4, 0x3c5b, 0x1, 0x3, 0x9, 0x1, 0x1f461e2c, 0x0, 0xe660, 0x4, 0x7, 0x101, 0x7fff, 0x1, 0x7, 0x4, 0x3, 0xe, 0xfffffffb, 0x71, 0xfffffff8, 0x7, 0x0, 0x0, 0x2, 0x80003e, 0xffffffff, 0x6, 0x10000006, 0x0, 0x5, 0x4, 0x8, 0x0, 0x2, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x1, 0xffff, 0x134, 0x7ffe, 0x6, 0xfffffff3, 0x129432e6, 0xcb, 0x6, 0xd, 0x2bf, 0x2, 0x9, 0x5, 0x3, 0x8, 0x7, 0x5, 0x0, 0xffffffff, 0x312, 0x6, 0xea4, 0x0, 0x4, 0x4, 0x8000, 0x3, 0x400, 0x5, 0x6, 0x7, 0xff, 0x5, 0x5, 0x5f31, 0x4, 0x0, 0x2, 0x100002, 0xa, 0x4, 0x9, 0x8, 0x800, 0x6, 0x7, 0x8002, 0x1, 0xfe000000, 0xb4c5, 0x2, 0x7f, 0x9, 0x2, 0xffffffff, 0x9, 0x1, 0xa, 0x80000003, 0x9, 0x48c93690, 0x8, 0x7], [0x1, 0x4, 0x0, 0x5, 0xffffeffe, 0xfffff76b, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x5, 0x5, 0x5, 0x0, 0x1ef, 0x1, 0x8, 0x83, 0x80000003, 0x200009, 0x100003e7, 0x2, 0x5, 0x3, 0x2, 0xf38, 0x8, 0x4, 0x6d01, 0x5, 0x2, 0x800003, 0x72, 0x7b, 0xf, 0xd, 0x2950bfaf, 0x1000, 0x9e, 0x4, 0x53cf697b, 0x4, 0x6, 0xac8, 0x7, 0x2, 0x3, 0x7ff, 0xfffffffc, 0x2, 0x4, 0xffff, 0x0, 0x1a, 0x1c, 0x120000, 0x356, 0x8, 0xaaed, 0x4, 0x65], [0x9, 0xbb31, 0x3, 0xb, 0x1, 0x938, 0x6, 0x6, 0x0, 0x5, 0x20000ce7, 0x201, 0x2, 0xf58, 0x5, 0x3, 0x0, 0x10000, 0x8024, 0x7ffe, 0x80000000, 0x200a620, 0x2, 0xc, 0x1, 0x4, 0x14c, 0x60a7, 0xe, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0x5, 0xee1, 0xfffff000, 0xfffe, 0x3, 0x7f, 0x104, 0x9606, 0x7, 0x2, 0x4, 0x8006, 0x1, 0x0, 0x4, 0x8, 0x30b1d693, 0xa1f, 0x8, 0x7, 0x1, 0x6c1b, 0x2, 0x4, 0xb0b2748, 0x6, 0x1, 0x200, 0xffbf2445, 0xfff]}, 0x45c) ppoll(&(0x7f0000000dc0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) syz_io_uring_setup(0x34b8, &(0x7f0000000e00)={0x0, 0xc3b5, 0x800, 0x3, 0x1a2}, &(0x7f0000000e80), &(0x7f0000000ec0), &(0x7f0000000f00)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000f40)=ANY=[@ANYBLOB="0200000004000000040000000100000080000000", @ANYRES32, @ANYBLOB="02"], 0x50) bind$can_raw(0xffffffffffffffff, &(0x7f0000000f80), 0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) 1.677549591s ago: executing program 1 (id=1571): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000002c0)=[@in6={0xa, 0x4e24, 0x10006, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000300)={&(0x7f0000000340)={0xa, 0x4e24, 0x9, @loopback, 0x4}, 0x1c, &(0x7f0000000380)}, 0x4048043) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x2, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000440)={0xa, 0x4}, 0xc) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000480)='bond_slave_1\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000004c0)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x80000000, 0xbffc, 0xe652, 0x2, 0x4, 0x8, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000580)={0x0, @in6={{0xa, 0x4e24, 0x5, @loopback, 0x5}}, 0x4, 0x1, 0xf06, 0x0, 0xac, 0x7d, 0x5}, 0x9c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000a40)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty, 0x3}}, 0x1000000, 0x31, 0xffff1896, 0x3, 0x6, 0x8, 0x1b}, 0x9c) 1.557587287s ago: executing program 1 (id=1572): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000040)=0xffffffffffffff40, 0x4) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$inet(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @multicast1}, 0x10) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='27', 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x80) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r2, 0xc0189379, 0x0) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(0xffffffffffffffff, 0xf505, 0x0) syz_open_procfs(0x0, 0x0) r3 = getpgrp(0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f0000000200)={{0x7, 0x2, 0x7, 0x7e, '\x00', 0x1}, 0x2, 0x20000040, 0x2, r3, 0x9, 0xb, 'syz1\x00', &(0x7f0000000000)=['.[]a!\x00', 'proc\x00', '/\x00', '\x00', '\'*-.+\x00', 'proc\x00', 'proc\x00', 'proc\x00', '^(\x00'], 0x26}) 1.503670788s ago: executing program 0 (id=1573): r0 = syz_open_dev$dri(&(0x7f0000000100), 0xfffffffc, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r1, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x0, 0x0}) fanotify_init(0x200, 0x0) r2 = socket(0x15, 0x5, 0x0) getsockopt(r2, 0x200000000114, 0x271b, &(0x7f0000000180)=""/1, &(0x7f00000001c0)=0xf002) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000000140)) 1.396997203s ago: executing program 1 (id=1574): openat$rtc(0xffffffffffffff9c, 0x0, 0x40000, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000840) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socket$key(0xf, 0x3, 0x2) r4 = socket(0x15, 0x5, 0x0) getsockopt(r4, 0x200000000114, 0x5, 0x0, &(0x7f0000000080)=0x300) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x40000, 0x0) ioctl$TCSETSF2(r5, 0x5453, 0x0) ioctl$TIOCMBIS(r5, 0x5416, 0x0) r6 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) write$cgroup_pid(r6, &(0x7f0000000240), 0x12) 1.396775025s ago: executing program 0 (id=1575): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000000100), 0x400000000000041, 0x0) r1 = add_key$user(&(0x7f0000000140), 0x0, 0x0, 0x0, 0xfffffffffffffffd) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) r3 = syz_open_dev$dvb_demux(&(0x7f00000001c0), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r3, 0x40146f2c, &(0x7f0000000200)={0x1, 0x0, 0x3, 0x13, 0x4}) connect$inet6(r2, &(0x7f0000000280)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r4 = fcntl$dupfd(r2, 0x406, r2) setsockopt$inet6_buf(r2, 0x29, 0x39, &(0x7f00000002c0)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) syz_open_dev$sndpcmc(0x0, 0x1, 0x2) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r6 = shmget(0x2, 0x2000, 0x20, &(0x7f0000ffc000/0x2000)=nil) shmat(r6, &(0x7f0000ffd000/0x3000)=nil, 0x4000) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8b1a, &(0x7f0000000040)={'wlan1\x00'}) write$binfmt_elf64(r4, &(0x7f0000000300)=ANY=[@ANYRESOCT=r0, @ANYRES64=r2, @ANYRES16=r4, @ANYRES32=r2, @ANYRES8=r3, @ANYRES64=r1], 0xfffffdcf) connect$unix(r4, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) write(0xffffffffffffffff, &(0x7f0000000000)='27', 0x2) unshare(0xa000400) 1.396215917s ago: executing program 2 (id=1576): setsockopt$inet_sctp_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000c00)=@raw={'raw\x00', 0x3c1, 0x3, 0x4ac, 0x2d8, 0x111, 0x4b4, 0x2d8, 0xd4feffff, 0x3e4, 0x20a, 0x278, 0x3e4, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @private2={0xfc, 0x2, '\x00', 0x1}, [0x0, 0xffffff00], [0x0, 0x0, 0x0, 0xffffffff], 'ipvlan0\x00', 'team_slave_0\x00', {0xff}, {0xff}, 0x21, 0xe}, 0x0, 0x2b4, 0x2d8, 0x0, {}, [@common=@inet=@hashlimit2={{0x150}, {'pimreg\x00', {0xfffffffffffffffe, 0x81, 0x26, 0x1, 0x7, 0x1, 0x9, 0x20, 0x18}, {0x7c012f2}}}, @common=@unspec=@string={{0xc0}, {0x1, 0x0, 'kmp\x00', "6d93eb04697dfa39de04767f46614613a407abbf4ed2e83a63b484dbb3bf6b2a850e79009e2905d2f98ba19f91f3c9faee6d3686e9bee067f4e77d9ad66238750c4100d7ee97ec7646259d90edece6e9787a97bc956c01754c34c5c9518c46178ed5f9194454980e579c80eca35a58dc47d1d5e4ff6e216c724e88c702448587", 0xe}}]}, @common=@inet=@TCPMSS={0x24, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@ipv6={@loopback, @mcast2, [], [0x0, 0x0, 0xffffffff], 'hsr0\x00', 'pim6reg1\x00', {0xff}}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x20, 0x1, 0xfffffffe, 0x0, 'snmp_trap\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x508) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/bsg/1:0:0:0\x00', 0xa2402, 0x0) ioctl$SG_BLKTRACETEARDOWN(r2, 0x1276, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r4 = fsopen(&(0x7f0000000b40)='ceph\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000b80)='ceph\x00', &(0x7f0000000bc0)='c:::\x00', 0x0) write(r3, &(0x7f0000000100)='270', 0x3) socket$nl_route(0x10, 0x3, 0x0) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f00000007c0), 0x210000, 0x0) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000800)={&(0x7f0000000840)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x9, [@type_tag={0x3, 0x0, 0x0, 0x12, 0x4}, @decl_tag={0x7, 0x0, 0x0, 0x11, 0x4}]}, {0x0, [0x61, 0x2e, 0x5f, 0x5f, 0x61, 0x5f, 0x5f]}}, &(0x7f00000008c0)=""/120, 0x3d, 0x78, 0x1, 0x5}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000940)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0x3, '\x00', 0x0, r6, 0x5, 0x3, 0x4}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f00000009c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000a00)='./sys\x00', &(0x7f0000000a40)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./sys/bus/pci/devices/0000:00:05.0/remove\x00', 0x1, 0x0) write(r7, &(0x7f0000000ac0)='1', 0x1) 1.187629671s ago: executing program 1 (id=1577): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f00000007c0), r0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000800)={0x0, 0x31, &(0x7f0000000bc0)={&(0x7f0000000900)=ANY=[@ANYRESOCT=r0, @ANYRES16=r0, @ANYBLOB="f5ab27bd7000000000000e000000feeb6da46d4432548486b4b4a59f9c6a30e2d333e426180fd1be42e0e6fb8c52c63c4cccbd2cb9289180f9a4f67d3b3dfd5968180ecc5aa02d5efcf5fd0fe859ff02207b687116c818c4d2df881c75bddb2ef9c6212624c8d929eb1dda3bd6b08a071233199aea500ae98b1016cadcb2b1ce459484b57409c2f81a9f6e13326e1727c682a232aa46bfa697a27275af400a3b6200fa651b344ef9e85bb67fd3631e0b4b66715827caa5c5e2a19a42954f614c0ceccfa43a0f92801b2be9c722ae6e434f68a6c88a622579580aefe0c52148f81703119cb1cc12af8909c34bdebf676ed74268192a2cad4c58f73c7c5cadcdb7bab92e99d8c46225ebb165"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x700) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0/file0/file0\x00', 0x0, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000540)=""/186, 0x41000, 0x6d, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$kcm(0x2, 0x1000000000000005, 0x0) sendmsg$inet(r1, &(0x7f00000003c0)={&(0x7f0000000400)={0x2, 0x0, @rand_addr=0xc0a80000}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000480)='D', 0x1}], 0x1}, 0x0) prlimit64(0x0, 0xa, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x800) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000040)={{0x0, 0x1, 0x9, 0x2, 0x8}}) ioctl$SNDRV_TIMER_IOCTL_TREAD64(r2, 0x400454a4, 0x0) getpid() r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1f, 0x19, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000080000035e3d2ff1328cda20000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000850000005000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000070000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000020000008500000082000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000840)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r4}, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) pipe2$watch_queue(0x0, 0x80) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x8800}, 0x0) setrlimit(0xa, &(0x7f0000000340)={0x7fffffff, 0x81}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) mkdir(&(0x7f0000000000)='my_debugfs\x00', 0x144) mount(0x0, &(0x7f0000000200)='my_debugfs\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='my_debugfs/asoc/dais\x00', 0x0, 0x0) read$FUSE(r8, &(0x7f0000000c00)={0x2020}, 0x202e) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) 1.18732759s ago: executing program 2 (id=1578): openat$rtc(0xffffffffffffff9c, 0x0, 0x40000, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000840) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socket$key(0xf, 0x3, 0x2) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x40000, 0x0) (fail_nth: 7) ioctl$TCSETSF2(r4, 0x5453, 0x0) ioctl$TIOCMBIS(r4, 0x5416, 0x0) r5 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000200)=0x1, 0x12) write$cgroup_pid(r5, &(0x7f0000000240), 0x12) 1.162675487s ago: executing program 0 (id=1579): bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000240)=ANY=[@ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x50) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000280)={0x0, 0x7fffffff}, &(0x7f00000002c0)=0x8) open(0x0, 0x18d03e, 0x0) open(&(0x7f0000000300)='./bus\x00', 0xc2802, 0x181) prlimit64(0x0, 0xc, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x80) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x5) r0 = syz_open_dev$sndmidi(&(0x7f0000000440), 0x2, 0x141102) writev(r0, &(0x7f0000000480)=[{&(0x7f00000004c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000540)='./nfsd\x00', &(0x7f0000000580)='nfsd\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f00000005c0)={0x4, 0xffffffff, 0xfffffff8, 0xd}, 0x54) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={0x0}}, 0x4040000) inotify_init1(0x800) mount(&(0x7f0000000680)=@filename='127.0.0.1:/test\x00', &(0x7f00000006c0)='./mnt\x00', 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[], 0x50) mount(0x0, &(0x7f0000000780)='./mnt\x00', &(0x7f00000007c0)='nfs\x00', 0x0, &(0x7f0000000800)='addr=127.0.0.1,vers=2,proto=udp\x00') mount(&(0x7f0000000840)=@filename='127.0.0.1:/test\x00', &(0x7f0000000880)='./mnt\x00', &(0x7f00000008c0)='nfs4\x00', 0x0, &(0x7f0000000900)='addr=127.0.0.1,port=2049,proto=tcp,clientaddr=127.0.0.1\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) pipe2(&(0x7f0000000000), 0x0) socket$key(0xf, 0x3, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/module/usb_storage/parameters/delay_use\x00', 0x1, 0x0) 846.547626ms ago: executing program 2 (id=1580): io_setup(0x9, &(0x7f00000000c0)=0x0) openat$dlm_plock(0xffffff9c, &(0x7f0000000180), 0x101400, 0x0) io_submit(r0, 0x1, &(0x7f00000001c0)=[0x0]) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e24, 0x14, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, &(0x7f0000000040)={0x801, 0x10, 0x8, 0x2}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000240)={0x0, 0x4}, 0x8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_RENAME(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB], 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x4048800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000280)=@newtaction={0xbc, 0x30, 0x1, 0x0, 0x0, {}, [{0xa8, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x60, 0x1, 0x0, 0x0, {{0x8}, {0x38, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @local}, @TCA_IFE_METALST={0x28, 0x6, [@IFE_META_SKBMARK={0x4, 0x1, @void}, @IFE_META_PRIO={0x8, 0x3, @val=0x28}, @IFE_META_TCINDEX={0x4, 0x5, @void}, @IFE_META_PRIO={0x8}, @IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_SKBMARK={0x8, 0x1, @val=0xfff}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x804}, 0x8000) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x34) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000700)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000780), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f00000007c0)=0x2) recvmmsg(r3, &(0x7f0000000800), 0x10106, 0x2, 0x0) setgroups(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000009c0)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000a00)='./debug\x00', &(0x7f0000000a40)='debugfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./debug/check_wx_pages\x00', 0x0, 0x0) read(r5, &(0x7f0000000ac0)=""/100, 0x64) 829.125239ms ago: executing program 3 (id=1581): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000140), r0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="c8000000000201060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500003400028014000180080001000506070808000200010203041c00028005000100060000000600020000140000060003009c400000340003801400018008000100ffffffff08000200ffffffff1c00028005000100ff000000060002000000000006000300ffff000016000b006e61742d666f6c6c6f772d6d6173746572"], 0xc8}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) poll(&(0x7f0000000180)=[{r2, 0x88}], 0x1, 0x7) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x20008008}, 0x2404c0c0) mknod$loop(0x0, 0xfff, 0x0) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r4 = syz_io_uring_setup(0x34b9, &(0x7f0000000400)={0x0, 0x2730, 0x800, 0x1, 0x82}, &(0x7f0000000480)=0x0, &(0x7f00000004c0)=0x0, &(0x7f0000000500)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000540)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r4}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat(0xffffffffffffffff, &(0x7f00000005c0)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000640)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000680)=0x7) sendmsg$RDMA_NLDEV_CMD_GET(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=ANY=[@ANYBLOB="180000000514110025bd7000fcdbdf2508001d"], 0x18}, 0x1, 0x0, 0x0, 0x40040800}, 0x48000) r8 = syz_open_dev$sndmidi(&(0x7f0000000780), 0x2, 0x4a102) writev(r8, &(0x7f00000007c0)=[{&(0x7f0000000800)="94", 0xf000}, {0x0}], 0x2) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) r9 = socket$packet(0x11, 0x8291c3c00632863d, 0x300) setsockopt$packet_int(r9, 0x107, 0x12, &(0x7f0000000000)=0x80, 0x4) 664.300571ms ago: executing program 3 (id=1582): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000009c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1], 0x3c}, 0x1, 0x0, 0x0, 0x20009805}, 0x40010) 596.641819ms ago: executing program 3 (id=1583): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x4000010}, 0x4040) r1 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r1, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000140)={@broadcast, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x66, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x1, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x36, 0x0, 0x0, 0x20000000}, 0xa}], 0x400000000000172, 0x0) 387.723582ms ago: executing program 3 (id=1584): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) syz_emit_ethernet(0x2a, &(0x7f0000000100)={@remote, @random="72b400000059", @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x4, @empty, @remote, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}, @remote}}}}, 0x0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTACK(r2, 0x0, 0x0, &(0x7f0000000000)=0x1, 0x4) sendto$packet(r0, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local}, 0x14) 387.534125ms ago: executing program 3 (id=1585): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000480), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f00000004c0)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000500)=0x6f) syz_usb_connect$cdc_ncm(0x4, 0x6e, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000005c0)=0x7) write$dsp(r0, &(0x7f0000002180)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb62", 0x1c) 267.589231ms ago: executing program 1 (id=1586): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)) r1 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x11) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl(r2, 0x8914, &(0x7f00000000c0)="63616e3000000000000000000000000001") ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000180)=0x62) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) io_setup(0x202, &(0x7f0000004e00)=0x0) io_submit(r3, 0x0, &(0x7f00000001c0)) 267.334454ms ago: executing program 0 (id=1587): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x75) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x7, @empty, 0x5de}, 0x1c) listen(r0, 0x80000003) syz_emit_ethernet(0x9a, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa246fd483a58186dd608a35f200640600fe5000000000000000000000000000bbfe8000000000000000000000000000aa00004e2224d9e3b9a956c80c59"], 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_inet_SIOCSIFPFLAGS(r2, 0x8934, &(0x7f00000004c0)={'virt_wifi0\x00', 0x7}) 164.336984ms ago: executing program 0 (id=1588): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000340), 0x0) close(r3) ioctl$KVM_NMI(r3, 0xae9a) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000380)='ns/net\x00') r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000006c0)={r5, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000740)={r4, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r6 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000840)="5c00000015006b0300224ed86e6c1d000a117ea6e070d6064e22000300000000250002000f00000017d34460bc24eab556a705251e6182949a00003d3b48dfd8cdbf9767b4fa51f62a64c9f4060046d88037e786a6d0a5d700000017", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newtfilter={0x94, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x6}, @empty, @private=0xa010101, 0xff000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x18, 0x3}}]}, 0x94}}, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c0000002400090243bd7000fedbdf250800000006000400"], 0x1c}}, 0x8800) 7.323273ms ago: executing program 1 (id=1589): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r2, &(0x7f0000000480)='p:_est/_vent1 ./file0:0x0 _', 0x1b) r3 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x800000000000, 0x4, 0x3}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in6=@mcast1, 0x0, 0x3, 0x1, 0x7}}, 0xe4) sendmmsg(r3, &(0x7f0000000480), 0x2e9, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)=ANY=[@ANYBLOB="020602000200000002"], 0x10}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=ANY=[@ANYBLOB="300000001000010029bd7000fbdbdf2500000000", @ANYRES32=0x0], 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) socket(0x46, 0xa, 0x2feb) syz_extract_tcp_res$synack(0x0, 0x1, 0x0) io_submit(0x0, 0xfffffffffffffead, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="042f014b"], 0x4) prlimit64(0x0, 0xe, 0x0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', &(0x7f00000001c0)='./file0\x00') rename(&(0x7f0000000580)='./file0\x00', 0x0) symlinkat(0x0, 0xffffffffffffff9c, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) getsockopt$SO_COOKIE(r5, 0x1, 0x48, 0x0, &(0x7f0000000400)) socket$alg(0x26, 0x5, 0x0) syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="02c930160012000500189a0e000001011d010103000100060008006d2efbdf026d8da35b9e9d2f6b27d8fad48475bcb8908eccd48c3915617d134e2faadca34fa3dd9b5fbb9b"], 0x1b) getsockopt$IP_SET_OP_GET_BYINDEX(r5, 0x1, 0x53, &(0x7f0000000080)={0x7, 0x7, 0x4}, &(0x7f0000000140)=0x28) 0s ago: executing program 0 (id=1590): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040), 0xfffffffffffffffe, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) r1 = syz_io_uring_setup(0x34b8, &(0x7f00000011c0)={0x0, 0xcf0b, 0x0, 0x2, 0x11}, &(0x7f0000001240)=0x0, &(0x7f0000001280)=0x0, &(0x7f00000012c0)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000001300)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0x8, 0x0, 0x0, 0x4, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x101, 0x11, 0x5, 0x0, 0x0) 0s ago: executing program 0 (id=1591): ioperm(0x2, 0xfffffe79, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) symlinkat(&(0x7f0000000280)='./sys/bus/pci/drivers/i801_smbus\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./drv\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./drv/unbind\x00', 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_DEL(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x14, 0x3, 0x7, 0x201, 0x0, 0x0, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x840}, 0x80) write(r0, &(0x7f00000003c0)='0000:00:1f.3', 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x4000, 0x0) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000040}, 0x20044002) set_mempolicy(0x3, 0x0, 0x40) timer_create(0x0, &(0x7f0000000180)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000380)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000600)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r5, 0xc040564b, &(0x7f0000000680)={0x8000, 0x0, 0x1001, 0x3, 0x9, {0xe1, 0x3000000}, 0x1}) close(r4) socket$inet6_mptcp(0xa, 0x1, 0x106) r6 = syz_open_dev$swradio(&(0x7f00000006c0), 0x0, 0x2) r7 = dup(r6) read(r7, 0x0, 0x0) read$FUSE(r7, 0x0, 0x0) bind$inet6(r4, &(0x7f0000000700)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) kernel console output (not intermixed with test programs): /0x70 [ 166.142570][ T8287] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 166.142595][ T8287] RIP: 0023:0xf73fefec [ 166.142617][ T8287] Code: Unable to access opcode bytes at 0xf73fefc2. [ 166.142625][ T8287] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000136 [ 166.142645][ T8287] RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 0000000000000000 [ 166.142657][ T8287] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 166.142669][ T8287] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 166.142680][ T8287] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 166.142692][ T8287] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 166.142718][ T8287] [ 167.135170][ T8317] syzkaller0: left promiscuous mode [ 167.135184][ T8317] syzkaller0: left allmulticast mode [ 167.161347][ T13] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 167.161374][ T13] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 167.161391][ T13] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 167.161407][ T13] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 168.508207][ T8337] nvme nvme0: failed to connect socket: -512 [ 168.576467][ T8366] FAULT_INJECTION: forcing a failure. [ 168.576467][ T8366] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 168.576487][ T8366] CPU: 1 UID: 0 PID: 8366 Comm: syz.2.841 Not tainted syzkaller #0 PREEMPT(full) [ 168.576511][ T8366] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 168.576518][ T8366] Call Trace: [ 168.576522][ T8366] [ 168.576527][ T8366] dump_stack_lvl+0x100/0x190 [ 168.576545][ T8366] should_fail_ex.cold+0x5/0xa [ 168.576560][ T8366] _copy_from_user+0x2e/0xd0 [ 168.576574][ T8366] __copy_siginfo_from_user32+0x95/0x910 [ 168.576592][ T8366] ? __pfx___copy_siginfo_from_user32+0x10/0x10 [ 168.576615][ T8366] ? find_held_lock+0x2b/0x80 [ 168.576628][ T8366] ? __fget_files+0x215/0x3d0 [ 168.576645][ T8366] __ia32_compat_sys_rt_tgsigqueueinfo+0x115/0x200 [ 168.576660][ T8366] ? __pfx___ia32_compat_sys_rt_tgsigqueueinfo+0x10/0x10 [ 168.576686][ T8366] __do_fast_syscall_32+0x13a/0x8b0 [ 168.576700][ T8366] do_fast_syscall_32+0x32/0x70 [ 168.576711][ T8366] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 168.576725][ T8366] RIP: 0023:0xf73eefec [ 168.576737][ T8366] Code: Unable to access opcode bytes at 0xf73eefc2. [ 168.576743][ T8366] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 000000000000014f [ 168.576754][ T8366] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 168.576762][ T8366] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 168.576769][ T8366] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 168.576775][ T8366] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 168.576782][ T8366] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 168.576796][ T8366] [ 168.595990][ T8368] netlink: 4 bytes leftover after parsing attributes in process `syz.1.840'. [ 168.596022][ T8368] netlink: 'syz.1.840': attribute type 11 has an invalid length. [ 168.596034][ T8368] netlink: 24 bytes leftover after parsing attributes in process `syz.1.840'. [ 168.597471][ T5100] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 170.163184][ T5529] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 170.331223][ T5529] usb 6-1: Using ep0 maxpacket: 8 [ 170.331739][ T5529] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 170.332680][ T5529] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 170.332692][ T5529] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 170.332711][ T5529] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 170.332730][ T5529] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 170.368842][ T5529] hub 6-1:1.0: bad descriptor, ignoring hub [ 170.368857][ T5529] hub 6-1:1.0: probe with driver hub failed with error -5 [ 170.369099][ T5529] cdc_wdm 6-1:1.0: skipping garbage [ 170.369106][ T5529] cdc_wdm 6-1:1.0: skipping garbage [ 170.369112][ T5529] cdc_wdm 6-1:1.0: skipping garbage [ 170.369121][ T5529] cdc_wdm 6-1:1.0: probe with driver cdc_wdm failed with error -22 [ 170.881320][ T5529] usb 6-1: USB disconnect, device number 11 [ 171.221613][ T5529] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 171.372026][ T5529] usb 6-1: New USB device found, idVendor=046d, idProduct=c094, bcdDevice= 0.00 [ 171.373272][ T5529] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 171.373301][ T5529] usb 6-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 171.373323][ T5529] usb 6-1: config 0 interface 0 has no altsetting 0 [ 171.373346][ T5529] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.374035][ T8408] FAULT_INJECTION: forcing a failure. [ 171.374035][ T8408] name failslab, interval 1, probability 0, space 0, times 0 [ 171.374054][ T8408] CPU: 1 UID: 0 PID: 8408 Comm: syz.2.853 Not tainted syzkaller #0 PREEMPT(full) [ 171.374068][ T8408] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 171.374087][ T8408] Call Trace: [ 171.374092][ T8408] [ 171.374097][ T8408] dump_stack_lvl+0x100/0x190 [ 171.374118][ T8408] should_fail_ex.cold+0x5/0xa [ 171.374134][ T8408] should_failslab+0xc2/0x120 [ 171.374151][ T8408] kmem_cache_alloc_noprof+0x92/0x6a0 [ 171.374168][ T8408] ? do_getname+0x35/0x390 [ 171.374182][ T8408] do_getname+0x35/0x390 [ 171.374195][ T8408] __ia32_sys_mkdirat+0x77/0xc0 [ 171.374211][ T8408] __do_fast_syscall_32+0x13a/0x8b0 [ 171.374226][ T8408] do_fast_syscall_32+0x32/0x70 [ 171.374238][ T8408] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 171.374252][ T8408] RIP: 0023:0xf73eefec [ 171.374264][ T8408] Code: Unable to access opcode bytes at 0xf73eefc2. [ 171.374269][ T8408] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000128 [ 171.374280][ T8408] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000080 [ 171.374287][ T8408] RDX: 00000000000001ff RSI: 0000000000000000 RDI: 0000000000000000 [ 171.374294][ T8408] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 171.374300][ T8408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 171.374307][ T8408] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 171.374322][ T8408] [ 171.376737][ T5529] usb 6-1: config 0 descriptor?? [ 171.608498][ T5529] usbhid 6-1:0.0: can't add hid device: -71 [ 171.608582][ T5529] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 171.613831][ T5529] usb 6-1: USB disconnect, device number 12 [ 171.746556][ T8416] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 171.760625][ T8416] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 171.780104][ T8416] fuse: fd is not a fuse device [ 172.642847][ T8427] ±ÿ: renamed from veth0_vlan (while UP) [ 172.773251][ T8428] netlink: 8 bytes leftover after parsing attributes in process `syz.2.862'. [ 173.520191][ T8438] 9pnet: p9_errstr2errno: server reported unknown error 0x000000 [ 174.923763][ T8459] syzkaller0: entered promiscuous mode [ 174.923777][ T8459] syzkaller0: entered allmulticast mode [ 175.167706][ T5743] svc: failed to register nfsdv3 RPC service (errno 111). [ 175.168639][ T5743] svc: failed to register nfsaclv3 RPC service (errno 111). [ 175.168654][ T5743] failed to unregister udp with rpcbind [ 175.169106][ T5743] svc: failed to register nfsdv3 RPC service (errno 97). [ 175.169122][ T5743] svc: failed to register nfsaclv3 RPC service (errno 97). [ 175.169133][ T5743] failed to unregister udp with rpcbind [ 175.510608][ T8485] netlink: 8 bytes leftover after parsing attributes in process `syz.0.884'. [ 175.861126][ T5900] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 176.041082][ T5900] usb 7-1: Using ep0 maxpacket: 8 [ 176.041964][ T5900] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 176.044094][ T5900] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 176.044112][ T5900] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 176.044144][ T5900] usb 7-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 176.044227][ T5900] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 176.044247][ T5900] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 176.044275][ T5900] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.052893][ T5900] hub 7-1:1.0: bad descriptor, ignoring hub [ 176.052909][ T5900] hub 7-1:1.0: probe with driver hub failed with error -5 [ 176.053371][ T5900] cdc_wdm 7-1:1.0: skipping garbage [ 176.053379][ T5900] cdc_wdm 7-1:1.0: skipping garbage [ 176.059160][ T5900] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 176.059175][ T5900] cdc_wdm 7-1:1.0: Unknown control protocol [ 176.337869][ T8488] cdc_wdm 7-1:1.0: Error submitting int urb - -90 [ 176.460886][ T8509] syzkaller0: left promiscuous mode [ 176.460911][ T8509] syzkaller0: left allmulticast mode [ 176.493274][ T8506] 9pnet: p9_errstr2errno: server reported unknown error 0x0000 [ 176.621255][ T1352] usb 7-1: USB disconnect, device number 8 [ 176.669061][ T8528] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 176.961138][ T5900] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 177.111638][ T5900] usb 7-1: New USB device found, idVendor=046d, idProduct=c094, bcdDevice= 0.00 [ 177.112642][ T5900] usb 7-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 177.112659][ T5900] usb 7-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 177.112721][ T5900] usb 7-1: config 0 interface 0 has no altsetting 0 [ 177.112738][ T5900] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.114461][ T5900] usb 7-1: config 0 descriptor?? [ 177.321169][ T5900] usbhid 7-1:0.0: can't add hid device: -71 [ 177.321257][ T5900] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 177.323329][ T5900] usb 7-1: USB disconnect, device number 9 [ 178.056881][ T8558] FAULT_INJECTION: forcing a failure. [ 178.056881][ T8558] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 178.057039][ T8558] CPU: 1 UID: 0 PID: 8558 Comm: syz.2.911 Not tainted syzkaller #0 PREEMPT(full) [ 178.057065][ T8558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 178.057072][ T8558] Call Trace: [ 178.057076][ T8558] [ 178.057081][ T8558] dump_stack_lvl+0x100/0x190 [ 178.057100][ T8558] should_fail_ex.cold+0x5/0xa [ 178.057116][ T8558] _copy_from_user+0x2e/0xd0 [ 178.057150][ T8558] __copy_siginfo_from_user32+0x95/0x910 [ 178.057180][ T8558] ? __pfx___copy_siginfo_from_user32+0x10/0x10 [ 178.057214][ T8558] ? find_held_lock+0x2b/0x80 [ 178.057230][ T8558] ? __fget_files+0x215/0x3d0 [ 178.057256][ T8558] __ia32_compat_sys_rt_tgsigqueueinfo+0x115/0x200 [ 178.057281][ T8558] ? __pfx___ia32_compat_sys_rt_tgsigqueueinfo+0x10/0x10 [ 178.057302][ T8558] ? xfd_validate_state+0x129/0x190 [ 178.057340][ T8558] __do_fast_syscall_32+0x13a/0x8b0 [ 178.057369][ T8558] do_fast_syscall_32+0x32/0x70 [ 178.057389][ T8558] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 178.057413][ T8558] RIP: 0023:0xf73eefec [ 178.057433][ T8558] Code: Unable to access opcode bytes at 0xf73eefc2. [ 178.057441][ T8558] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 000000000000014f [ 178.057459][ T8558] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 178.057471][ T8558] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 178.057482][ T8558] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 178.057493][ T8558] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 178.057504][ T8558] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 178.057528][ T8558] [ 178.780672][ T8583] 9pnet: p9_errstr2errno: server reported unknown error 0x00000 [ 178.781447][ T5641] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 178.940942][ T8594] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 178.953169][ T8594] fuse: fd is not a fuse device [ 178.961186][ T5641] usb 7-1: Using ep0 maxpacket: 8 [ 178.961795][ T5641] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 178.962848][ T5641] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 178.962866][ T5641] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 178.962896][ T5641] usb 7-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 178.962916][ T5641] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 178.962935][ T5641] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 178.962961][ T5641] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.966928][ T5641] hub 7-1:1.0: bad descriptor, ignoring hub [ 178.966941][ T5641] hub 7-1:1.0: probe with driver hub failed with error -5 [ 178.967167][ T5641] cdc_wdm 7-1:1.0: skipping garbage [ 178.967175][ T5641] cdc_wdm 7-1:1.0: skipping garbage [ 178.968159][ T5641] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 178.968168][ T5641] cdc_wdm 7-1:1.0: Unknown control protocol [ 179.162903][ T8606] 9pnet: p9_errstr2errno: server reported unknown error 0x00000 [ 179.242692][ T8577] cdc_wdm 7-1:1.0: Error submitting int urb - -90 [ 179.493308][ T8634] 9pnet: p9_errstr2errno: server reported unknown error 0x00000 [ 179.541366][ T3378] usb 7-1: USB disconnect, device number 10 [ 179.760861][ T8639] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 179.881197][ T3378] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 180.041736][ T3378] usb 7-1: New USB device found, idVendor=046d, idProduct=c094, bcdDevice= 0.00 [ 180.042820][ T3378] usb 7-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 180.042846][ T3378] usb 7-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 180.042874][ T3378] usb 7-1: config 0 interface 0 has no altsetting 0 [ 180.042901][ T3378] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.046460][ T3378] usb 7-1: config 0 descriptor?? [ 180.260179][ T3378] usbhid 7-1:0.0: can't add hid device: -71 [ 180.260266][ T3378] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 180.265674][ T3378] usb 7-1: USB disconnect, device number 11 [ 180.283420][ T8648] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 180.944240][ T8677] FAULT_INJECTION: forcing a failure. [ 180.944240][ T8677] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 180.944269][ T8677] CPU: 2 UID: 0 PID: 8677 Comm: syz.2.957 Not tainted syzkaller #0 PREEMPT(full) [ 180.944290][ T8677] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 180.944300][ T8677] Call Trace: [ 180.944306][ T8677] [ 180.944313][ T8677] dump_stack_lvl+0x100/0x190 [ 180.944340][ T8677] should_fail_ex.cold+0x5/0xa [ 180.944365][ T8677] _copy_from_user+0x2e/0xd0 [ 180.944384][ T8677] __copy_siginfo_from_user32+0x95/0x910 [ 180.944411][ T8677] ? __pfx___copy_siginfo_from_user32+0x10/0x10 [ 180.944447][ T8677] ? find_held_lock+0x2b/0x80 [ 180.944467][ T8677] ? __fget_files+0x215/0x3d0 [ 180.944494][ T8677] __ia32_compat_sys_rt_tgsigqueueinfo+0x115/0x200 [ 180.944518][ T8677] ? __pfx___ia32_compat_sys_rt_tgsigqueueinfo+0x10/0x10 [ 180.944552][ T8677] __do_fast_syscall_32+0x13a/0x8b0 [ 180.944574][ T8677] do_fast_syscall_32+0x32/0x70 [ 180.944593][ T8677] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 180.944614][ T8677] RIP: 0023:0xf73eefec [ 180.944634][ T8677] Code: Unable to access opcode bytes at 0xf73eefc2. [ 180.944642][ T8677] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 000000000000014f [ 180.944661][ T8677] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 180.944673][ T8677] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 180.944684][ T8677] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 180.944695][ T8677] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 180.944705][ T8677] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 180.944729][ T8677] [ 181.057771][ T8680] fuse: Bad value for 'fd' [ 181.731187][ T5641] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 181.881182][ T5641] usb 7-1: Using ep0 maxpacket: 8 [ 181.884003][ T5641] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 181.885070][ T5641] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 181.885086][ T5641] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 181.885118][ T5641] usb 7-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 181.885137][ T5641] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 181.885157][ T5641] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 181.885184][ T5641] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.894804][ T5641] hub 7-1:1.0: bad descriptor, ignoring hub [ 181.894824][ T5641] hub 7-1:1.0: probe with driver hub failed with error -5 [ 181.895213][ T5641] cdc_wdm 7-1:1.0: skipping garbage [ 181.895224][ T5641] cdc_wdm 7-1:1.0: skipping garbage [ 181.902874][ T5641] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 181.902889][ T5641] cdc_wdm 7-1:1.0: Unknown control protocol [ 182.164385][ T8692] cdc_wdm 7-1:1.0: Error submitting int urb - -90 [ 182.244559][ T8704] FAULT_INJECTION: forcing a failure. [ 182.244559][ T8704] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 182.244580][ T8704] CPU: 3 UID: 0 PID: 8704 Comm: syz.1.966 Not tainted syzkaller #0 PREEMPT(full) [ 182.244592][ T8704] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 182.244599][ T8704] Call Trace: [ 182.244603][ T8704] [ 182.244608][ T8704] dump_stack_lvl+0x100/0x190 [ 182.244626][ T8704] should_fail_ex.cold+0x5/0xa [ 182.244642][ T8704] _copy_from_user+0x2e/0xd0 [ 182.244655][ T8704] __copy_siginfo_from_user32+0x95/0x910 [ 182.244672][ T8704] ? __pfx___copy_siginfo_from_user32+0x10/0x10 [ 182.244695][ T8704] ? find_held_lock+0x2b/0x80 [ 182.244708][ T8704] ? __fget_files+0x215/0x3d0 [ 182.244725][ T8704] __ia32_compat_sys_rt_tgsigqueueinfo+0x115/0x200 [ 182.244740][ T8704] ? __pfx___ia32_compat_sys_rt_tgsigqueueinfo+0x10/0x10 [ 182.244754][ T8704] ? xfd_validate_state+0x129/0x190 [ 182.244777][ T8704] __do_fast_syscall_32+0x13a/0x8b0 [ 182.244791][ T8704] do_fast_syscall_32+0x32/0x70 [ 182.244803][ T8704] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 182.244816][ T8704] RIP: 0023:0xf73aefec [ 182.244828][ T8704] Code: Unable to access opcode bytes at 0xf73aefc2. [ 182.244834][ T8704] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 000000000000014f [ 182.244845][ T8704] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 182.244851][ T8704] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 182.244858][ T8704] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 182.244864][ T8704] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 182.244870][ T8704] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 182.244883][ T8704] [ 182.461340][ T5641] usb 7-1: USB disconnect, device number 12 [ 182.637795][ T8710] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 182.679622][ T8708] netlink: 48 bytes leftover after parsing attributes in process `syz.0.967'. [ 182.679738][ T8708] netlink: 48 bytes leftover after parsing attributes in process `syz.0.967'. [ 182.802387][ T5900] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 182.951802][ T5900] usb 7-1: New USB device found, idVendor=046d, idProduct=c094, bcdDevice= 0.00 [ 182.954027][ T5900] usb 7-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 182.954120][ T5900] usb 7-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 182.954145][ T5900] usb 7-1: config 0 interface 0 has no altsetting 0 [ 182.954171][ T5900] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.957756][ T5900] usb 7-1: config 0 descriptor?? [ 183.173757][ T5900] usbhid 7-1:0.0: can't add hid device: -71 [ 183.173837][ T5900] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 183.198708][ T5900] usb 7-1: USB disconnect, device number 13 [ 183.610883][ T8725] fuse: Bad value for 'fd' [ 183.739025][ T8723] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 183.760656][ T8730] netlink: 4 bytes leftover after parsing attributes in process `syz.1.976'. [ 183.760679][ T8730] netlink: 'syz.1.976': attribute type 11 has an invalid length. [ 183.760686][ T8730] netlink: 24 bytes leftover after parsing attributes in process `syz.1.976'. [ 183.761898][ T5100] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 184.108566][ T8742] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 184.859525][ T8763] 9pnet: p9_errstr2errno: server reported unknown error 0x00000 [ 185.097314][ T8773] netlink: 4 bytes leftover after parsing attributes in process `syz.1.992'. [ 185.097347][ T8773] netlink: 'syz.1.992': attribute type 11 has an invalid length. [ 185.097359][ T8773] netlink: 24 bytes leftover after parsing attributes in process `syz.1.992'. [ 185.098250][ T5100] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 185.098922][ T8775] FAULT_INJECTION: forcing a failure. [ 185.098922][ T8775] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 185.098941][ T8775] CPU: 2 UID: 0 PID: 8775 Comm: syz.0.991 Not tainted syzkaller #0 PREEMPT(full) [ 185.098953][ T8775] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 185.098959][ T8775] Call Trace: [ 185.098963][ T8775] [ 185.098968][ T8775] dump_stack_lvl+0x100/0x190 [ 185.098986][ T8775] should_fail_ex.cold+0x5/0xa [ 185.099001][ T8775] _copy_from_user+0x2e/0xd0 [ 185.099014][ T8775] __copy_siginfo_from_user32+0x95/0x910 [ 185.099032][ T8775] ? __pfx___copy_siginfo_from_user32+0x10/0x10 [ 185.099054][ T8775] ? find_held_lock+0x2b/0x80 [ 185.099068][ T8775] ? __fget_files+0x215/0x3d0 [ 185.099084][ T8775] __ia32_compat_sys_rt_tgsigqueueinfo+0x115/0x200 [ 185.099099][ T8775] ? __pfx___ia32_compat_sys_rt_tgsigqueueinfo+0x10/0x10 [ 185.099114][ T8775] ? xfd_validate_state+0x129/0x190 [ 185.099137][ T8775] __do_fast_syscall_32+0x13a/0x8b0 [ 185.099151][ T8775] do_fast_syscall_32+0x32/0x70 [ 185.099163][ T8775] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 185.099177][ T8775] RIP: 0023:0xf73fefec [ 185.099188][ T8775] Code: Unable to access opcode bytes at 0xf73fefc2. [ 185.099193][ T8775] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 000000000000014f [ 185.099204][ T8775] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 185.099211][ T8775] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 185.099217][ T8775] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 185.099223][ T8775] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 185.099229][ T8775] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 185.099243][ T8775] [ 185.642987][ T8785] 9pnet: p9_errstr2errno: server reported unknown error 0x00000 [ 185.659873][ T8792] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 185.663472][ T8792] fuse: fd is not a fuse device [ 185.804254][ T8799] FAULT_INJECTION: forcing a failure. [ 185.804254][ T8799] name failslab, interval 1, probability 0, space 0, times 0 [ 185.804286][ T8799] CPU: 2 UID: 0 PID: 8799 Comm: syz.1.1002 Not tainted syzkaller #0 PREEMPT(full) [ 185.804306][ T8799] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 185.804315][ T8799] Call Trace: [ 185.804321][ T8799] [ 185.804328][ T8799] dump_stack_lvl+0x100/0x190 [ 185.804357][ T8799] should_fail_ex.cold+0x5/0xa [ 185.804383][ T8799] should_failslab+0xc2/0x120 [ 185.804414][ T8799] kmem_cache_alloc_noprof+0x92/0x6a0 [ 185.804437][ T8799] ? do_getname+0x35/0x390 [ 185.804461][ T8799] do_getname+0x35/0x390 [ 185.804482][ T8799] __ia32_sys_mkdirat+0x77/0xc0 [ 185.804510][ T8799] __do_fast_syscall_32+0x13a/0x8b0 [ 185.804534][ T8799] do_fast_syscall_32+0x32/0x70 [ 185.804552][ T8799] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 185.804575][ T8799] RIP: 0023:0xf73aefec [ 185.804594][ T8799] Code: Unable to access opcode bytes at 0xf73aefc2. [ 185.804602][ T8799] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000128 [ 185.804621][ T8799] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000080 [ 185.804633][ T8799] RDX: 00000000000001ff RSI: 0000000000000000 RDI: 0000000000000000 [ 185.804644][ T8799] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 185.804653][ T8799] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 185.804665][ T8799] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 185.804689][ T8799] [ 186.727362][ T63] IPVS: starting estimator thread 0... [ 186.736989][ T8810] fuse: Invalid rootmode [ 186.811297][ T8812] IPVS: using max 43 ests per chain, 103200 per kthread [ 186.879935][ T8818] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1009'. [ 186.879998][ T8818] netlink: 'syz.2.1009': attribute type 11 has an invalid length. [ 186.880007][ T8818] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1009'. [ 186.909994][ T5100] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 186.911263][ T13] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 186.911335][ T13] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 186.911369][ T13] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 186.911421][ T13] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 186.948158][ T8805] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 188.287809][ T8855] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1022'. [ 188.287832][ T8855] netlink: 'syz.0.1022': attribute type 11 has an invalid length. [ 188.287839][ T8855] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1022'. [ 188.288544][ T5100] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 189.817948][ T8871] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 190.122385][ T8891] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 190.301923][ T8897] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1035'. [ 190.301948][ T8897] netlink: 'syz.3.1035': attribute type 11 has an invalid length. [ 190.301955][ T8897] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1035'. [ 190.314696][ T5100] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 190.321380][ T5831] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 190.321419][ T5831] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 190.321440][ T5831] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 190.321509][ T5831] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 191.201699][ T8918] FAULT_INJECTION: forcing a failure. [ 191.201699][ T8918] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 191.201721][ T8918] CPU: 2 UID: 0 PID: 8918 Comm: syz.0.1043 Not tainted syzkaller #0 PREEMPT(full) [ 191.201734][ T8918] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 191.201741][ T8918] Call Trace: [ 191.201745][ T8918] [ 191.201750][ T8918] dump_stack_lvl+0x100/0x190 [ 191.201769][ T8918] should_fail_ex.cold+0x5/0xa [ 191.201784][ T8918] strncpy_from_user+0x3b/0x2d0 [ 191.201800][ T8918] do_getname+0x78/0x390 [ 191.201813][ T8918] __ia32_sys_mkdirat+0x77/0xc0 [ 191.201829][ T8918] __do_fast_syscall_32+0x13a/0x8b0 [ 191.201844][ T8918] do_fast_syscall_32+0x32/0x70 [ 191.201857][ T8918] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 191.201871][ T8918] RIP: 0023:0xf73fefec [ 191.201883][ T8918] Code: Unable to access opcode bytes at 0xf73fefc2. [ 191.201888][ T8918] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000128 [ 191.201901][ T8918] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000080 [ 191.201912][ T8918] RDX: 00000000000001ff RSI: 0000000000000000 RDI: 0000000000000000 [ 191.201921][ T8918] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 191.201932][ T8918] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 191.201943][ T8918] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 191.201966][ T8918] [ 191.815137][ T8935] syzkaller0: entered promiscuous mode [ 191.815151][ T8935] syzkaller0: entered allmulticast mode [ 191.950346][ T5752] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 192.046325][ T8940] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 192.048555][ T8940] fuse: fd is not a fuse device [ 192.353516][ T8945] FAULT_INJECTION: forcing a failure. [ 192.353516][ T8945] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 192.353547][ T8945] CPU: 3 UID: 0 PID: 8945 Comm: syz.1.1053 Not tainted syzkaller #0 PREEMPT(full) [ 192.353568][ T8945] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 192.353578][ T8945] Call Trace: [ 192.353584][ T8945] [ 192.353591][ T8945] dump_stack_lvl+0x100/0x190 [ 192.353620][ T8945] should_fail_ex.cold+0x5/0xa [ 192.353643][ T8945] strncpy_from_user+0x3b/0x2d0 [ 192.353666][ T8945] do_getname+0x78/0x390 [ 192.353688][ T8945] __ia32_sys_mkdirat+0x77/0xc0 [ 192.353713][ T8945] __do_fast_syscall_32+0x13a/0x8b0 [ 192.353735][ T8945] do_fast_syscall_32+0x32/0x70 [ 192.353754][ T8945] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 192.353775][ T8945] RIP: 0023:0xf73aefec [ 192.353792][ T8945] Code: Unable to access opcode bytes at 0xf73aefc2. [ 192.353800][ T8945] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000128 [ 192.353817][ T8945] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000080 [ 192.353828][ T8945] RDX: 00000000000001ff RSI: 0000000000000000 RDI: 0000000000000000 [ 192.353838][ T8945] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 192.353848][ T8945] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 192.353857][ T8945] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 192.353879][ T8945] [ 192.540098][ T8953] input: syz0 as /devices/virtual/input/input9 [ 193.711677][ T8967] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 193.821528][ T5752] Bluetooth: hci3: command 0x040f tx timeout [ 193.823683][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.823733][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.826194][ T5100] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 195.399798][ T9011] can0: slcan on ttynull. [ 195.410059][ T5100] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 195.416529][ T9003] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 195.482180][ T9010] can0 (unregistered): slcan off ttynull. [ 195.522245][ T9016] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 195.541882][ T9016] can0: slcan on pts0. [ 195.950989][ T9031] 9p: Bad value for 'wfdno' [ 196.283276][ T9047] can1: slcan on ttynull. [ 196.341747][ T9046] can1 (unregistered): slcan off ttynull. [ 196.411632][ T9015] can0 (unregistered): slcan off pts0. [ 196.603772][ T5100] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 197.097360][ T9065] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 197.272999][ T9084] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 197.277099][ T9084] fuse: fd is not a fuse device [ 197.285557][ T9079] can0: slcan on ttynull. [ 197.333851][ T9077] can0 (unregistered): slcan off ttynull. [ 197.874940][ T5100] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 197.983005][ T9103] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 198.000151][ T9103] can0: slcan on pts0. [ 198.071936][ T9102] can0 (unregistered): slcan off pts0. [ 198.641162][ T5851] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 198.791117][ T5851] usb 7-1: Using ep0 maxpacket: 8 [ 198.792032][ T5851] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 198.793046][ T5851] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 198.793058][ T5851] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 198.793078][ T5851] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 198.793098][ T5851] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.800279][ T5851] hub 7-1:1.0: bad descriptor, ignoring hub [ 198.800294][ T5851] hub 7-1:1.0: probe with driver hub failed with error -5 [ 198.800863][ T5851] cdc_wdm 7-1:1.0: skipping garbage [ 198.800872][ T5851] cdc_wdm 7-1:1.0: skipping garbage [ 198.806109][ T5851] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 198.806121][ T5851] cdc_wdm 7-1:1.0: Unknown control protocol [ 199.285708][ T9125] 9p: Bad value for 'rfdno' [ 199.394383][ T9131] fuse: fd is not a fuse device [ 199.686358][ T9120] usb 7-1: reset high-speed USB device number 14 using dummy_hcd [ 199.692210][ T9120] usb 7-1: device reset changed ep0 maxpacket size! [ 199.700461][ T5824] usb 7-1: USB disconnect, device number 14 [ 199.814819][ T9141] can0: slcan on ttynull. [ 199.841140][ T5824] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 199.881924][ T9140] can0 (unregistered): slcan off ttynull. [ 199.992247][ T5824] usb 7-1: New USB device found, idVendor=046d, idProduct=c094, bcdDevice= 0.00 [ 199.993189][ T5824] usb 7-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 199.993208][ T5824] usb 7-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 199.993221][ T5824] usb 7-1: config 0 interface 0 has no altsetting 0 [ 199.993236][ T5824] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.995974][ T5824] usb 7-1: config 0 descriptor?? [ 200.204275][ T5824] usbhid 7-1:0.0: can't add hid device: -71 [ 200.204326][ T5824] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 200.205428][ T5824] usb 7-1: USB disconnect, device number 15 [ 200.756155][ T9163] fuse: Bad value for 'group_id' [ 200.756167][ T9163] fuse: Bad value for 'group_id' [ 201.630080][ T9177] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 201.754314][ T9180] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1139'. [ 201.777300][ T9177] fuse: fd is not a fuse device [ 201.980067][ T9186] fuse: fd is not a fuse device [ 202.051260][ T5900] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 202.211524][ T5900] usb 7-1: Using ep0 maxpacket: 8 [ 202.212331][ T5900] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 202.215440][ T5900] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 202.215500][ T5900] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 202.215522][ T5900] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 202.215542][ T5900] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.226681][ T5900] hub 7-1:1.0: bad descriptor, ignoring hub [ 202.226695][ T5900] hub 7-1:1.0: probe with driver hub failed with error -5 [ 202.227009][ T5900] cdc_wdm 7-1:1.0: skipping garbage [ 202.227017][ T5900] cdc_wdm 7-1:1.0: skipping garbage [ 202.235051][ T5900] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 202.235063][ T5900] cdc_wdm 7-1:1.0: Unknown control protocol [ 202.310079][ T5100] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 202.419781][ T9198] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 202.593042][ T9203] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1149'. [ 202.874654][ T9212] fuse: fd is not a fuse device [ 203.387874][ T9182] usb 7-1: reset high-speed USB device number 16 using dummy_hcd [ 203.390644][ T9182] usb 7-1: device reset changed ep0 maxpacket size! [ 203.554026][ T5824] usb 7-1: USB disconnect, device number 16 [ 203.691550][ T5824] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 203.841634][ T5824] usb 7-1: New USB device found, idVendor=046d, idProduct=c094, bcdDevice= 0.00 [ 203.842566][ T5824] usb 7-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 203.842584][ T5824] usb 7-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 203.842597][ T5824] usb 7-1: config 0 interface 0 has no altsetting 0 [ 203.842612][ T5824] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.843914][ T5824] usb 7-1: config 0 descriptor?? [ 204.056153][ T5824] usbhid 7-1:0.0: can't add hid device: -71 [ 204.056234][ T5824] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 204.058179][ T5824] usb 7-1: USB disconnect, device number 17 [ 204.127807][ T9229] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1159'. [ 204.178363][ T5100] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 204.313647][ T9234] can0: slcan on ttynull. [ 204.391190][ T9233] can0 (unregistered): slcan off ttynull. [ 204.462272][ T9238] input: syz0 as /devices/virtual/input/input10 [ 205.303432][ T9247] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 206.071086][ T5824] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 206.098713][ T5100] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 206.231092][ T5824] usb 7-1: Using ep0 maxpacket: 8 [ 206.231749][ T5824] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 206.232572][ T5824] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 206.232584][ T5824] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 206.232611][ T5824] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 206.232631][ T5824] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.238201][ T5824] hub 7-1:1.0: bad descriptor, ignoring hub [ 206.238214][ T5824] hub 7-1:1.0: probe with driver hub failed with error -5 [ 206.238432][ T5824] cdc_wdm 7-1:1.0: skipping garbage [ 206.238439][ T5824] cdc_wdm 7-1:1.0: skipping garbage [ 206.240750][ T5824] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 206.240760][ T5824] cdc_wdm 7-1:1.0: Unknown control protocol [ 206.433966][ T9272] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 207.368181][ T9287] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 207.451563][ T9264] usb 7-1: reset high-speed USB device number 18 using dummy_hcd [ 207.453067][ T9264] usb 7-1: device reset changed ep0 maxpacket size! [ 207.454047][ T5851] usb 7-1: USB disconnect, device number 18 [ 207.495964][ T5100] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 207.611169][ T5851] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 207.761688][ T5851] usb 7-1: New USB device found, idVendor=046d, idProduct=c094, bcdDevice= 0.00 [ 207.762599][ T5851] usb 7-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 207.762615][ T5851] usb 7-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 207.762628][ T5851] usb 7-1: config 0 interface 0 has no altsetting 0 [ 207.762643][ T5851] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.764483][ T5851] usb 7-1: config 0 descriptor?? [ 207.987263][ T5851] usbhid 7-1:0.0: can't add hid device: -71 [ 207.987316][ T5851] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 207.989173][ T5851] usb 7-1: USB disconnect, device number 19 [ 208.193559][ T9319] can0: slcan on pts0. [ 208.405367][ T9314] can0 (unregistered): slcan off pts0. [ 208.632002][ T9322] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 208.757088][ T5100] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 209.294855][ T9365] fuse: Unknown parameter 'grou00000000000000000000' [ 209.760794][ T9378] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1214'. [ 210.042091][ T9379] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 210.472147][ T5100] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 211.027334][ T9404] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 211.028357][ T9404] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 211.438256][ T9404] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 211.438464][ T9404] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 211.592944][ T9408] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1226'. [ 212.697893][ T9428] fuse: Unknown parameter 'grou00000000000000000000' [ 212.891634][ T9426] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 213.659273][ T9443] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1237'. [ 213.811483][ T5851] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 213.982935][ T5851] usb 7-1: Using ep0 maxpacket: 8 [ 213.990760][ T5851] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 214.009359][ T5851] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.009672][ T5851] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 214.010147][ T5851] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 214.010227][ T5851] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.042565][ T42] kauditd_printk_skb: 4 callbacks suppressed [ 214.042579][ T42] audit: type=1326 audit(1792335778.120:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9447 comm="syz.0.1241" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf73fefec code=0x0 [ 214.058260][ T5851] hub 7-1:1.0: bad descriptor, ignoring hub [ 214.058276][ T5851] hub 7-1:1.0: probe with driver hub failed with error -5 [ 214.058599][ T5851] cdc_wdm 7-1:1.0: skipping garbage [ 214.058607][ T5851] cdc_wdm 7-1:1.0: skipping garbage [ 214.062395][ T5851] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 214.062453][ T5851] cdc_wdm 7-1:1.0: Unknown control protocol [ 214.179510][ T9458] fuse: fd is not a fuse device [ 215.215636][ T9436] usb 7-1: reset high-speed USB device number 20 using dummy_hcd [ 215.217609][ T9436] usb 7-1: device reset changed ep0 maxpacket size! [ 215.218273][ T5824] usb 7-1: USB disconnect, device number 20 [ 215.338569][ T9485] fuse: fd is not a fuse device [ 215.351094][ T5824] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 215.377506][ T9487] sock: sock_set_timeout: `syz.3.1255' (pid 9487) tries to set negative timeout [ 215.521694][ T5824] usb 7-1: New USB device found, idVendor=046d, idProduct=c094, bcdDevice= 0.00 [ 215.522502][ T5824] usb 7-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 215.522518][ T5824] usb 7-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 215.522531][ T5824] usb 7-1: config 0 interface 0 has no altsetting 0 [ 215.522546][ T5824] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.523815][ T5824] usb 7-1: config 0 descriptor?? [ 215.728874][ T5824] usbhid 7-1:0.0: can't add hid device: -71 [ 215.728927][ T5824] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 215.732158][ T5824] usb 7-1: USB disconnect, device number 21 [ 216.209179][ T5100] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 216.975379][ T9513] fuse: fd is not a fuse device [ 217.118847][ T9520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 217.119060][ T9520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 217.159004][ T5100] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 217.535678][ T9520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 217.535974][ T9520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.209284][ T9547] input: syz0 as /devices/virtual/input/input11 [ 218.684639][ T9559] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1279'. [ 218.685023][ T5100] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 219.459569][ T9573] input: syz0 as /devices/virtual/input/input12 [ 219.461300][ T1352] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 219.611112][ T1352] usb 7-1: Using ep0 maxpacket: 8 [ 219.611969][ T1352] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 219.613166][ T1352] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 219.613312][ T1352] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 219.613350][ T1352] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 219.613381][ T1352] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.625050][ T1352] hub 7-1:1.0: bad descriptor, ignoring hub [ 219.625070][ T1352] hub 7-1:1.0: probe with driver hub failed with error -5 [ 219.625422][ T1352] cdc_wdm 7-1:1.0: skipping garbage [ 219.625432][ T1352] cdc_wdm 7-1:1.0: skipping garbage [ 219.627954][ T1352] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 219.627965][ T1352] cdc_wdm 7-1:1.0: Unknown control protocol [ 220.783739][ T9564] usb 7-1: reset high-speed USB device number 22 using dummy_hcd [ 220.784876][ T9564] usb 7-1: device reset changed ep0 maxpacket size! [ 220.785547][ T3378] usb 7-1: USB disconnect, device number 22 [ 220.844212][ T9593] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1291'. [ 220.845181][ T5100] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 220.931132][ T3378] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 221.081836][ T3378] usb 7-1: New USB device found, idVendor=046d, idProduct=c094, bcdDevice= 0.00 [ 221.083088][ T3378] usb 7-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 221.083124][ T3378] usb 7-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 221.083151][ T3378] usb 7-1: config 0 interface 0 has no altsetting 0 [ 221.083178][ T3378] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.085291][ T3378] usb 7-1: config 0 descriptor?? [ 221.292172][ T3378] usbhid 7-1:0.0: can't add hid device: -71 [ 221.292224][ T3378] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 221.297183][ T3378] usb 7-1: USB disconnect, device number 23 [ 221.477440][ T9601] fuse: Unknown parameter 'group_id00000000000000000000' [ 221.687889][ T9615] netlink: 'syz.0.1299': attribute type 2 has an invalid length. [ 221.740208][ T5100] Bluetooth: hci1: unexpected event for opcode 0x0c7c [ 221.835899][ T9623] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1302'. [ 221.837631][ T5100] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 222.340860][ T9627] fuse: Unknown parameter 'group_id00000000000000000000' [ 223.403407][ T9654] FAULT_INJECTION: forcing a failure. [ 223.403407][ T9654] name failslab, interval 1, probability 0, space 0, times 0 [ 223.403438][ T9654] CPU: 3 UID: 0 PID: 9654 Comm: syz.0.1313 Not tainted syzkaller #0 PREEMPT(full) [ 223.403460][ T9654] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 223.403472][ T9654] Call Trace: [ 223.403478][ T9654] [ 223.403486][ T9654] dump_stack_lvl+0x100/0x190 [ 223.403515][ T9654] should_fail_ex.cold+0x5/0xa [ 223.403540][ T9654] should_failslab+0xc2/0x120 [ 223.403594][ T9654] kmem_cache_alloc_noprof+0x92/0x6a0 [ 223.403620][ T9654] ? __rds_conn_create+0x19b4/0x2650 [ 223.403640][ T9654] ? __rds_conn_create+0x730/0x2650 [ 223.403662][ T9654] __rds_conn_create+0x730/0x2650 [ 223.403691][ T9654] ? __pfx___rds_conn_create+0x10/0x10 [ 223.403708][ T9654] ? trace_kmalloc+0xeb/0x110 [ 223.403735][ T9654] ? __kasan_kmalloc+0xaa/0xb0 [ 223.403762][ T9654] ? lockdep_init_map_type+0x5c/0x250 [ 223.403796][ T9654] rds_conn_create_outgoing+0x44/0x60 [ 223.403820][ T9654] rds_sendmsg+0x10da/0x34d0 [ 223.403855][ T9654] ? __pfx_rds_sendmsg+0x10/0x10 [ 223.403877][ T9654] ? __pfx_aa_sk_perm+0x10/0x10 [ 223.403901][ T9654] ? __pfx_tomoyo_socket_sendmsg_permission+0x10/0x10 [ 223.403935][ T9654] ? aa_sock_msg_perm+0x11e/0x200 [ 223.403957][ T9654] ? apparmor_socket_sendmsg+0x165/0x280 [ 223.403979][ T9654] ? ____sys_sendmsg+0xa4d/0xbe0 [ 223.404006][ T9654] ____sys_sendmsg+0xa4d/0xbe0 [ 223.404031][ T9654] ? __pfx_rds_sendmsg+0x10/0x10 [ 223.404055][ T9654] ? __pfx_____sys_sendmsg+0x10/0x10 [ 223.404096][ T9654] ___sys_sendmsg+0x190/0x1e0 [ 223.404127][ T9654] ? __pfx____sys_sendmsg+0x10/0x10 [ 223.404172][ T9654] ? find_held_lock+0x2b/0x80 [ 223.404210][ T9654] __sys_sendmsg+0x160/0x210 [ 223.404235][ T9654] ? __pfx___sys_sendmsg+0x10/0x10 [ 223.404266][ T9654] ? __pfx_ksys_write+0x10/0x10 [ 223.404295][ T9654] __do_fast_syscall_32+0x13a/0x8b0 [ 223.404316][ T9654] ? lockdep_hardirqs_on+0x7d/0x110 [ 223.404336][ T9654] do_fast_syscall_32+0x32/0x70 [ 223.404356][ T9654] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 223.404379][ T9654] RIP: 0023:0xf73fefec [ 223.404401][ T9654] Code: Unable to access opcode bytes at 0xf73fefc2. [ 223.404410][ T9654] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 223.404431][ T9654] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000f00 [ 223.404443][ T9654] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 223.404454][ T9654] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 223.404465][ T9654] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 223.404475][ T9654] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 223.404500][ T9654] [ 223.492946][ T9664] fuse: fd is not a fuse device [ 223.650858][ T9680] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1324'. [ 223.660236][ T9680] netlink: 'syz.0.1324': attribute type 17 has an invalid length. [ 223.660248][ T9680] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1324'. [ 223.660491][ T9680] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 224.002742][ T9690] fuse: Bad value for 'user_id' [ 224.002757][ T9690] fuse: Bad value for 'user_id' [ 224.299294][ T9694] input: syz0 as /devices/virtual/input/input13 [ 224.545695][ T9702] sctp: [Deprecated]: syz.1.1331 (pid 9702) Use of int in maxseg socket option. [ 224.545695][ T9702] Use struct sctp_assoc_value instead [ 224.821167][ T5851] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 224.971764][ T5851] usb 7-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 224.972701][ T5851] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 224.972765][ T5851] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 224.972785][ T5851] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.979158][ T5851] spcp8x5 7-1:1.0: SPCP8x5 converter detected [ 224.982840][ T5851] usb 7-1: SPCP8x5 converter now attached to ttyUSB0 [ 225.341352][ T9699] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 225.341832][ T9699] SPCP8x5 ttyUSB0: Set UART format 0x30b failed (error = -32) [ 225.342114][ T9699] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 225.351963][ T9714] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1337'. [ 225.351981][ T9714] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1337'. [ 225.353663][ T5100] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 225.442598][ T9699] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 225.551294][ T9698] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 225.552369][ T1352] usb 7-1: USB disconnect, device number 24 [ 225.561317][ T1352] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 225.561640][ T1352] spcp8x5 7-1:1.0: device disconnected [ 226.270761][ T9747] fuse: Bad value for 'user_id' [ 226.270774][ T9747] fuse: Bad value for 'user_id' [ 226.369973][ T9749] FAULT_INJECTION: forcing a failure. [ 226.369973][ T9749] name failslab, interval 1, probability 0, space 0, times 0 [ 226.369995][ T9749] CPU: 1 UID: 0 PID: 9749 Comm: syz.1.1349 Not tainted syzkaller #0 PREEMPT(full) [ 226.370007][ T9749] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 226.370014][ T9749] Call Trace: [ 226.370018][ T9749] [ 226.370023][ T9749] dump_stack_lvl+0x100/0x190 [ 226.370054][ T9749] should_fail_ex.cold+0x5/0xa [ 226.370070][ T9749] should_failslab+0xc2/0x120 [ 226.370088][ T9749] kmem_cache_alloc_noprof+0x92/0x6a0 [ 226.370105][ T9749] ? do_getname+0x35/0x390 [ 226.370120][ T9749] do_getname+0x35/0x390 [ 226.370133][ T9749] do_sys_openat2+0xc7/0x1e0 [ 226.370145][ T9749] ? __pfx_do_sys_openat2+0x10/0x10 [ 226.370162][ T9749] __ia32_compat_sys_openat+0x12d/0x210 [ 226.370175][ T9749] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 226.370197][ T9749] __do_fast_syscall_32+0x13a/0x8b0 [ 226.370210][ T9749] ? lockdep_hardirqs_on+0x7d/0x110 [ 226.370222][ T9749] do_fast_syscall_32+0x32/0x70 [ 226.370235][ T9749] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 226.370251][ T9749] RIP: 0023:0xf73aefec [ 226.370264][ T9749] Code: Unable to access opcode bytes at 0xf73aefc2. [ 226.370269][ T9749] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 226.370280][ T9749] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000940 [ 226.370287][ T9749] RDX: 0000000000020042 RSI: 00000000000000c7 RDI: 0000000000000000 [ 226.370294][ T9749] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 226.370300][ T9749] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 226.370307][ T9749] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 226.370321][ T9749] [ 226.411800][ T9755] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1351'. [ 226.411813][ T9755] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1351'. [ 226.412411][ T5100] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 226.571190][ T1352] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 226.721608][ T1352] usb 7-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 226.722135][ T1352] usb 7-1: config 0 has no interfaces? [ 226.724604][ T1352] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.724617][ T1352] usb 7-1: Product: syz [ 226.724624][ T1352] usb 7-1: Manufacturer: syz [ 226.724632][ T1352] usb 7-1: SerialNumber: syz [ 226.726116][ T1352] usb 7-1: config 0 descriptor?? [ 227.015001][ T9765] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1354'. [ 228.559138][ T9804] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 228.724466][ T9807] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 228.846891][ T9812] can0: slcan on ttynull. [ 228.849875][ T9814] FAULT_INJECTION: forcing a failure. [ 228.849875][ T9814] name failslab, interval 1, probability 0, space 0, times 0 [ 228.849893][ T9814] CPU: 3 UID: 0 PID: 9814 Comm: syz.1.1362 Not tainted syzkaller #0 PREEMPT(full) [ 228.849906][ T9814] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 228.849913][ T9814] Call Trace: [ 228.849917][ T9814] [ 228.849921][ T9814] dump_stack_lvl+0x100/0x190 [ 228.849940][ T9814] should_fail_ex.cold+0x5/0xa [ 228.849954][ T9814] should_failslab+0xc2/0x120 [ 228.849972][ T9814] kmem_cache_alloc_noprof+0x92/0x6a0 [ 228.849988][ T9814] ? ovs_flow_alloc+0x1e/0x210 [ 228.850005][ T9814] ovs_flow_alloc+0x1e/0x210 [ 228.850020][ T9814] ovs_flow_cmd_new+0x231/0xe10 [ 228.850039][ T9814] ? kasan_save_stack+0x30/0x50 [ 228.850054][ T9814] ? kasan_save_track+0x14/0x30 [ 228.850069][ T9814] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 228.850085][ T9814] ? genl_family_rcv_msg_doit+0xc7/0x300 [ 228.850099][ T9814] ? netlink_rcv_skb+0x159/0x420 [ 228.850111][ T9814] ? genl_rcv+0x28/0x40 [ 228.850122][ T9814] ? netlink_unicast+0x65f/0x950 [ 228.850134][ T9814] ? __sys_sendmsg+0x160/0x210 [ 228.850146][ T9814] ? __do_fast_syscall_32+0x13a/0x8b0 [ 228.850158][ T9814] ? do_fast_syscall_32+0x32/0x70 [ 228.850169][ T9814] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 228.850204][ T9814] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 228.850219][ T9814] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 228.850236][ T9814] genl_family_rcv_msg_doit+0x214/0x300 [ 228.850251][ T9814] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 228.850265][ T9814] ? genl_get_cmd+0x3e7/0x760 [ 228.850281][ T9814] ? bpf_lsm_capable+0x9/0x10 [ 228.850293][ T9814] ? security_capable+0x80/0x260 [ 228.850305][ T9814] ? ns_capable+0xd2/0xf0 [ 228.850323][ T9814] genl_rcv_msg+0x560/0x800 [ 228.850339][ T9814] ? __pfx_genl_rcv_msg+0x10/0x10 [ 228.850352][ T9814] ? __lock_acquire+0x5c0/0x1f40 [ 228.850369][ T9814] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 228.850386][ T9814] ? __lock_acquire+0x5c0/0x1f40 [ 228.850405][ T9814] netlink_rcv_skb+0x159/0x420 [ 228.850417][ T9814] ? __pfx_genl_rcv_msg+0x10/0x10 [ 228.850432][ T9814] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 228.850449][ T9814] ? netlink_deliver_tap+0x1ae/0xcc0 [ 228.850463][ T9814] genl_rcv+0x28/0x40 [ 228.850475][ T9814] netlink_unicast+0x65f/0x950 [ 228.850489][ T9814] ? __pfx_netlink_unicast+0x10/0x10 [ 228.850505][ T9814] netlink_sendmsg+0x8b0/0xda0 [ 228.850519][ T9814] ? __pfx_netlink_sendmsg+0x10/0x10 [ 228.850533][ T9814] ? apparmor_socket_sendmsg+0x165/0x280 [ 228.850547][ T9814] ____sys_sendmsg+0xa4d/0xbe0 [ 228.850562][ T9814] ? __pfx_netlink_sendmsg+0x10/0x10 [ 228.850575][ T9814] ? __pfx_____sys_sendmsg+0x10/0x10 [ 228.850598][ T9814] ___sys_sendmsg+0x190/0x1e0 [ 228.850616][ T9814] ? __pfx____sys_sendmsg+0x10/0x10 [ 228.850640][ T9814] ? find_held_lock+0x2b/0x80 [ 228.850661][ T9814] __sys_sendmsg+0x160/0x210 [ 228.850681][ T9814] ? __pfx___sys_sendmsg+0x10/0x10 [ 228.850698][ T9814] ? __pfx_ksys_write+0x10/0x10 [ 228.850715][ T9814] __do_fast_syscall_32+0x13a/0x8b0 [ 228.850726][ T9814] ? lockdep_hardirqs_on+0x7d/0x110 [ 228.850738][ T9814] do_fast_syscall_32+0x32/0x70 [ 228.850750][ T9814] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 228.850764][ T9814] RIP: 0023:0xf73aefec [ 228.850776][ T9814] Code: Unable to access opcode bytes at 0xf73aefc2. [ 228.850781][ T9814] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 228.850792][ T9814] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 228.850799][ T9814] RDX: 000000000000c040 RSI: 0000000000000000 RDI: 0000000000000000 [ 228.850805][ T9814] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 228.850811][ T9814] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 228.850818][ T9814] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 228.850832][ T9814] [ 228.925997][ T9817] ublk_ctrl_add_dev: dev id not match 4294967295 6 [ 228.931256][ T9816] syzkaller0: entered promiscuous mode [ 228.931268][ T9816] syzkaller0: entered allmulticast mode [ 228.944413][ T9811] can0 (unregistered): slcan off ttynull. [ 229.017383][ T9819] FAULT_INJECTION: forcing a failure. [ 229.017383][ T9819] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 229.017404][ T9819] CPU: 1 UID: 0 PID: 9819 Comm: syz.0.1364 Not tainted syzkaller #0 PREEMPT(full) [ 229.017430][ T9819] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 229.017437][ T9819] Call Trace: [ 229.017441][ T9819] [ 229.017446][ T9819] dump_stack_lvl+0x100/0x190 [ 229.017466][ T9819] should_fail_ex.cold+0x5/0xa [ 229.017479][ T9819] ? prepare_alloc_pages+0x16d/0x5b0 [ 229.017498][ T9819] should_fail_alloc_page+0xeb/0x140 [ 229.017517][ T9819] prepare_alloc_pages+0x1f0/0x5b0 [ 229.017534][ T9819] ? is_bpf_text_address+0x94/0x1a0 [ 229.017554][ T9819] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 229.017575][ T9819] ? stack_trace_save+0x8e/0xc0 [ 229.017590][ T9819] ? __pfx_stack_trace_save+0x10/0x10 [ 229.017605][ T9819] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 229.017621][ T9819] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 229.017634][ T9819] ? is_bpf_text_address+0x94/0x1a0 [ 229.017653][ T9819] ? kasan_save_stack+0x3f/0x50 [ 229.017669][ T9819] ? kasan_save_stack+0x30/0x50 [ 229.017683][ T9819] ? kasan_save_track+0x14/0x30 [ 229.017698][ T9819] ? __kasan_slab_alloc+0x89/0x90 [ 229.017714][ T9819] ? kmem_cache_alloc_node_noprof+0x282/0x6e0 [ 229.017728][ T9819] ? alloc_vmap_area+0x640/0x2bb0 [ 229.017743][ T9819] ? __get_vm_area_node+0x1ed/0x350 [ 229.017758][ T9819] ? __vmalloc_node_range_noprof+0x268/0x1420 [ 229.017768][ T9819] ? __vmalloc_node_noprof+0xad/0xf0 [ 229.017785][ T9819] ? copy_process+0x80b/0x8430 [ 229.017795][ T9819] ? vhost_task_create+0x1db/0x370 [ 229.017809][ T9819] ? kvm_mmu_post_init_vm+0x1b3/0x360 [ 229.017821][ T9819] ? kvm_arch_vcpu_ioctl_run+0xb5/0x1dd0 [ 229.017833][ T9819] ? kvm_vcpu_ioctl+0x730/0x1700 [ 229.017847][ T9819] ? kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 229.017860][ T9819] ? __ia32_compat_sys_ioctl+0x2cf/0x360 [ 229.017873][ T9819] ? __do_fast_syscall_32+0x13a/0x8b0 [ 229.017891][ T9819] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 229.017909][ T9819] ? policy_nodemask+0xed/0x4f0 [ 229.017921][ T9819] alloc_pages_mpol+0x201/0x550 [ 229.017933][ T9819] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 229.017947][ T9819] alloc_pages_noprof+0x1a/0x160 [ 229.017960][ T9819] get_free_pages_noprof+0x10/0xb0 [ 229.017976][ T9819] __kasan_populate_vmalloc+0xa0/0x210 [ 229.017994][ T9819] alloc_vmap_area+0x95d/0x2bb0 [ 229.018014][ T9819] ? kasan_save_track+0x14/0x30 [ 229.018029][ T9819] ? __kasan_kmalloc+0xaa/0xb0 [ 229.018044][ T9819] ? __pfx_alloc_vmap_area+0x10/0x10 [ 229.018061][ T9819] ? __get_vm_area_node+0x124/0x350 [ 229.018080][ T9819] __get_vm_area_node+0x1ed/0x350 [ 229.018099][ T9819] __vmalloc_node_range_noprof+0x268/0x1420 [ 229.018111][ T9819] ? vhost_task_create+0x1db/0x370 [ 229.018129][ T9819] ? lock_acquire+0x1d1/0x380 [ 229.018149][ T9819] ? vhost_task_create+0x1db/0x370 [ 229.018164][ T9819] ? __memcg_slab_post_alloc_hook+0x71e/0x10c0 [ 229.018179][ T9819] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 229.018199][ T9819] ? rcu_is_watching+0x13/0xc0 [ 229.018212][ T9819] ? trace_kmem_cache_alloc+0xdd/0x100 [ 229.018230][ T9819] ? vhost_task_create+0x1db/0x370 [ 229.018244][ T9819] __vmalloc_node_noprof+0xad/0xf0 [ 229.018261][ T9819] ? vhost_task_create+0x1db/0x370 [ 229.018277][ T9819] copy_process+0x80b/0x8430 [ 229.018296][ T9819] ? __pfx_copy_process+0x10/0x10 [ 229.018306][ T9819] ? kasan_save_track+0x14/0x30 [ 229.018322][ T9819] ? __kasan_kmalloc+0xaa/0xb0 [ 229.018337][ T9819] ? lockdep_init_map_type+0x5c/0x250 [ 229.018355][ T9819] ? lockdep_init_map_type+0x5c/0x250 [ 229.018373][ T9819] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 229.018390][ T9819] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 229.018404][ T9819] vhost_task_create+0x1db/0x370 [ 229.018419][ T9819] ? __pfx_vhost_task_create+0x10/0x10 [ 229.018437][ T9819] ? __pfx_vhost_task_fn+0x10/0x10 [ 229.018453][ T9819] ? register_lock_class+0x3f/0x7b0 [ 229.018469][ T9819] ? rcu_is_watching+0x13/0xc0 [ 229.018481][ T9819] ? trace_contention_end+0x126/0x160 [ 229.018501][ T9819] kvm_mmu_post_init_vm+0x1b3/0x360 [ 229.018514][ T9819] kvm_arch_vcpu_ioctl_run+0xb5/0x1dd0 [ 229.018530][ T9819] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 229.018543][ T9819] ? lock_acquire+0x1d1/0x380 [ 229.018559][ T9819] ? do_raw_write_lock+0x11e/0x260 [ 229.018571][ T9819] ? find_held_lock+0x2b/0x80 [ 229.018587][ T9819] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 229.018605][ T9819] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 229.018628][ T9819] kvm_vcpu_ioctl+0x730/0x1700 [ 229.018648][ T9819] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 229.018669][ T9819] ? tomoyo_path_number_perm+0x188/0x580 [ 229.018686][ T9819] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 229.018700][ T9819] ? get_pid_task+0x106/0x250 [ 229.018721][ T9819] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 229.018738][ T9819] ? do_vfs_ioctl+0x226/0x13e0 [ 229.018752][ T9819] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 229.018767][ T9819] ? __fget_files+0x34/0x3d0 [ 229.018785][ T9819] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 229.018800][ T9819] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 229.018815][ T9819] ? __fget_files+0x21f/0x3d0 [ 229.018833][ T9819] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 229.018848][ T9819] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 229.018863][ T9819] __do_fast_syscall_32+0x13a/0x8b0 [ 229.018874][ T9819] ? lockdep_hardirqs_on+0x7d/0x110 [ 229.018886][ T9819] do_fast_syscall_32+0x32/0x70 [ 229.018898][ T9819] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 229.018913][ T9819] RIP: 0023:0xf73fefec [ 229.018926][ T9819] Code: Unable to access opcode bytes at 0xf73fefc2. [ 229.018931][ T9819] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 229.018942][ T9819] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 229.018950][ T9819] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 229.018956][ T9819] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 229.018962][ T9819] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 229.018968][ T9819] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 229.018982][ T9819] [ 229.019707][ T9819] syz.0.1364: vmalloc error: size 32768, align 0x8000, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 229.019817][ T9819] CPU: 1 UID: 0 PID: 9819 Comm: syz.0.1364 Not tainted syzkaller #0 PREEMPT(full) [ 229.019845][ T9819] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 229.019852][ T9819] Call Trace: [ 229.019856][ T9819] [ 229.019860][ T9819] dump_stack_lvl+0x100/0x190 [ 229.019878][ T9819] warn_alloc.cold+0x9e/0xb2 [ 229.019890][ T9819] ? __pfx_warn_alloc+0x10/0x10 [ 229.019903][ T9819] ? lockdep_hardirqs_on+0x7d/0x110 [ 229.019915][ T9819] ? __get_vm_area_node+0x2f0/0x350 [ 229.019935][ T9819] ? __get_vm_area_node+0x22b/0x350 [ 229.019954][ T9819] __vmalloc_node_range_noprof+0xfa2/0x1420 [ 229.019966][ T9819] ? lock_acquire+0x1d1/0x380 [ 229.019986][ T9819] ? vhost_task_create+0x1db/0x370 [ 229.020001][ T9819] ? __memcg_slab_post_alloc_hook+0x71e/0x10c0 [ 229.020016][ T9819] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 229.020036][ T9819] ? rcu_is_watching+0x13/0xc0 [ 229.020048][ T9819] ? trace_kmem_cache_alloc+0xdd/0x100 [ 229.020067][ T9819] ? vhost_task_create+0x1db/0x370 [ 229.020080][ T9819] __vmalloc_node_noprof+0xad/0xf0 [ 229.020098][ T9819] ? vhost_task_create+0x1db/0x370 [ 229.020113][ T9819] copy_process+0x80b/0x8430 [ 229.020137][ T9819] ? __pfx_copy_process+0x10/0x10 [ 229.020147][ T9819] ? kasan_save_track+0x14/0x30 [ 229.020163][ T9819] ? __kasan_kmalloc+0xaa/0xb0 [ 229.020178][ T9819] ? lockdep_init_map_type+0x5c/0x250 [ 229.020196][ T9819] ? lockdep_init_map_type+0x5c/0x250 [ 229.020214][ T9819] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 229.020231][ T9819] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 229.020245][ T9819] vhost_task_create+0x1db/0x370 [ 229.020259][ T9819] ? __pfx_vhost_task_create+0x10/0x10 [ 229.020278][ T9819] ? __pfx_vhost_task_fn+0x10/0x10 [ 229.020293][ T9819] ? register_lock_class+0x3f/0x7b0 [ 229.020309][ T9819] ? rcu_is_watching+0x13/0xc0 [ 229.020322][ T9819] ? trace_contention_end+0x126/0x160 [ 229.020342][ T9819] kvm_mmu_post_init_vm+0x1b3/0x360 [ 229.020356][ T9819] kvm_arch_vcpu_ioctl_run+0xb5/0x1dd0 [ 229.020372][ T9819] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 229.020385][ T9819] ? lock_acquire+0x1d1/0x380 [ 229.020401][ T9819] ? do_raw_write_lock+0x11e/0x260 [ 229.020413][ T9819] ? find_held_lock+0x2b/0x80 [ 229.020425][ T9819] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 229.020439][ T9819] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 229.020456][ T9819] kvm_vcpu_ioctl+0x730/0x1700 [ 229.020471][ T9819] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 229.020486][ T9819] ? tomoyo_path_number_perm+0x188/0x580 [ 229.020501][ T9819] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 229.020515][ T9819] ? get_pid_task+0x106/0x250 [ 229.020531][ T9819] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 229.020548][ T9819] ? do_vfs_ioctl+0x226/0x13e0 [ 229.020562][ T9819] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 229.020577][ T9819] ? __fget_files+0x34/0x3d0 [ 229.020594][ T9819] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 229.020609][ T9819] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 229.020624][ T9819] ? __fget_files+0x21f/0x3d0 [ 229.020642][ T9819] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 229.020657][ T9819] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 229.020672][ T9819] __do_fast_syscall_32+0x13a/0x8b0 [ 229.020683][ T9819] ? lockdep_hardirqs_on+0x7d/0x110 [ 229.020695][ T9819] do_fast_syscall_32+0x32/0x70 [ 229.020707][ T9819] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 229.020721][ T9819] RIP: 0023:0xf73fefec [ 229.020732][ T9819] Code: Unable to access opcode bytes at 0xf73fefc2. [ 229.020737][ T9819] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 229.020748][ T9819] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 229.020755][ T9819] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 229.020761][ T9819] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 229.020767][ T9819] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 229.020773][ T9819] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 229.020787][ T9819] [ 229.020851][ T9819] Mem-Info: [ 229.020859][ T9819] active_anon:1590 inactive_anon:3202 isolated_anon:0 [ 229.020859][ T9819] active_file:980 inactive_file:21569 isolated_file:0 [ 229.020859][ T9819] unevictable:1000 dirty:253 writeback:0 [ 229.020859][ T9819] slab_reclaimable:6380 slab_unreclaimable:57051 [ 229.020859][ T9819] mapped:22871 shmem:4221 pagetables:1215 [ 229.020859][ T9819] sec_pagetables:327 bounce:0 [ 229.020859][ T9819] kernel_misc_reclaimable:0 [ 229.020859][ T9819] free:29445 free_pcp:4530 free_cma:0 [ 229.020886][ T9819] Node 0 active_anon:32kB inactive_anon:4kB active_file:284kB inactive_file:12kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:204kB dirty:4kB writeback:0kB shmem:2024kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8928kB pagetables:1268kB sec_pagetables:1156kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 229.020913][ T9819] Node 1 active_anon:6328kB inactive_anon:12804kB active_file:3636kB inactive_file:86264kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:91280kB dirty:1008kB writeback:0kB shmem:14860kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:4592kB pagetables:3592kB sec_pagetables:152kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 229.020940][ T9819] Node 0 DMA free:3064kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 229.022284][ T9819] lowmem_reserve[]: 0 259 259 259 259 [ 229.022357][ T9819] Node 0 DMA32 free:18316kB boost:26328kB min:38032kB low:40956kB high:43880kB reserved_highatomic:2048kB free_highatomic:172kB active_anon:32kB inactive_anon:4kB active_file:284kB inactive_file:12kB unevictable:2000kB writepending:4kB zspages:960kB present:1032196kB managed:265348kB mlocked:0kB bounce:0kB free_pcp:5792kB local_pcp:2460kB free_cma:0kB [ 229.022388][ T9819] lowmem_reserve[]: 0 0 0 0 0 [ 229.022406][ T9819] Node 1 DMA32 free:96400kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0kB free_highatomic:0kB active_anon:6328kB inactive_anon:12804kB active_file:3636kB inactive_file:86264kB unevictable:2000kB writepending:1008kB zspages:6860kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:12360kB local_pcp:8920kB free_cma:0kB [ 229.022435][ T9819] lowmem_reserve[]: 0 0 0 0 0 [ 229.022453][ T9819] Node 0 DMA: 112*4kB (UM) 17*8kB (UM) 21*16kB (UM) 25*32kB (UM) 9*64kB (UM) 6*128kB (UM) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 3064kB [ 229.022582][ T9819] Node 0 DMA32: 71*4kB (MEH) 154*8kB (UMEH) 104*16kB (UMEH) 120*32kB (UMEH) 39*64kB (UME) 13*128kB (UME) 6*256kB (M) 7*512kB (M) 2*1024kB (M) 0*2048kB 0*4096kB = 18348kB [ 229.022709][ T9819] Node 1 DMA32: 1737*4kB (UME) 1057*8kB (UME) 589*16kB (UME) 457*32kB (UME) 214*64kB (UME) 97*128kB (UME) 50*256kB (UME) 19*512kB (UM) 4*1024kB (UM) 2*2048kB (UM) 0*4096kB = 96284kB [ 229.022839][ T9819] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 229.022848][ T9819] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 229.022856][ T9819] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 229.022864][ T9819] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 229.022873][ T9819] 27439 total pagecache pages [ 229.022877][ T9819] 671 pages in swap cache [ 229.022880][ T9819] Free swap = 49120kB [ 229.022884][ T9819] Total swap = 124996kB [ 229.022888][ T9819] 524155 pages RAM [ 229.022892][ T9819] 0 pages HighMem/MovableOnly [ 229.022895][ T9819] 216926 pages reserved [ 229.022899][ T9819] 0 pages cma reserved [ 229.310856][ T5851] usb 7-1: USB disconnect, device number 25 [ 229.430833][ T9832] input: syz0 as /devices/virtual/input/input14 [ 229.879041][ T9843] rxe_eth0 speed is unknown, defaulting to 1000 [ 230.208462][ T9851] fuse: fd is not a fuse device [ 230.252760][ T9838] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 230.599495][ T9842] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 230.604246][ T42] audit: type=1326 audit(1792335794.680:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9836 comm="syz.3.1372" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f48fec code=0x7ffc0000 [ 230.605826][ T42] audit: type=1326 audit(1792335794.680:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9836 comm="syz.3.1372" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f48fec code=0x7ffc0000 [ 230.899444][ T9868] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1380'. [ 230.899466][ T9868] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1380'. [ 230.900370][ T5100] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 231.097858][ T1163] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 231.103579][ T9878] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 231.198464][ T9885] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1384'. [ 231.445067][ T9895] FAULT_INJECTION: forcing a failure. [ 231.445067][ T9895] name failslab, interval 1, probability 0, space 0, times 0 [ 231.445088][ T9895] CPU: 3 UID: 0 PID: 9895 Comm: syz.1.1388 Not tainted syzkaller #0 PREEMPT(full) [ 231.445102][ T9895] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 231.445109][ T9895] Call Trace: [ 231.445112][ T9895] [ 231.445117][ T9895] dump_stack_lvl+0x100/0x190 [ 231.445135][ T9895] should_fail_ex.cold+0x5/0xa [ 231.445150][ T9895] should_failslab+0xc2/0x120 [ 231.445169][ T9895] __kmalloc_noprof+0xfc/0x840 [ 231.445183][ T9895] ? __kasan_kmalloc+0xaa/0xb0 [ 231.445198][ T9895] ? nla_strdup+0xc3/0x150 [ 231.445216][ T9895] nla_strdup+0xc3/0x150 [ 231.445231][ T9895] nf_tables_newtable+0xd9c/0x1a90 [ 231.445251][ T9895] ? __pfx_nf_tables_newtable+0x10/0x10 [ 231.445272][ T9895] ? net_generic+0x25/0x2a0 [ 231.445290][ T9895] ? __nla_parse+0x40/0x60 [ 231.445307][ T9895] nfnetlink_rcv_batch+0x1410/0x2880 [ 231.445330][ T9895] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 231.445345][ T9895] ? stack_trace_save+0x8e/0xc0 [ 231.445360][ T9895] ? __pfx_stack_trace_save+0x10/0x10 [ 231.445377][ T9895] ? kasan_save_stack+0x3f/0x50 [ 231.445391][ T9895] ? kasan_save_stack+0x30/0x50 [ 231.445406][ T9895] ? kasan_save_track+0x14/0x30 [ 231.445421][ T9895] ? __kasan_slab_alloc+0x89/0x90 [ 231.445436][ T9895] ? kmem_cache_alloc_node_noprof+0x282/0x6e0 [ 231.445457][ T9895] ? __lock_acquire+0x5c0/0x1f40 [ 231.445486][ T9895] ? __nla_parse+0x40/0x60 [ 231.445504][ T9895] nfnetlink_rcv+0x3bd/0x440 [ 231.445519][ T9895] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 231.445538][ T9895] netlink_unicast+0x65f/0x950 [ 231.445552][ T9895] ? __pfx_netlink_unicast+0x10/0x10 [ 231.445568][ T9895] netlink_sendmsg+0x8b0/0xda0 [ 231.445583][ T9895] ? __pfx_netlink_sendmsg+0x10/0x10 [ 231.445596][ T9895] ? apparmor_socket_sendmsg+0x165/0x280 [ 231.445611][ T9895] ____sys_sendmsg+0xa4d/0xbe0 [ 231.445627][ T9895] ? __pfx_netlink_sendmsg+0x10/0x10 [ 231.445641][ T9895] ? __pfx_____sys_sendmsg+0x10/0x10 [ 231.445664][ T9895] ___sys_sendmsg+0x190/0x1e0 [ 231.445682][ T9895] ? __pfx____sys_sendmsg+0x10/0x10 [ 231.445706][ T9895] ? find_held_lock+0x2b/0x80 [ 231.445727][ T9895] __sys_sendmsg+0x160/0x210 [ 231.445742][ T9895] ? __pfx___sys_sendmsg+0x10/0x10 [ 231.445759][ T9895] ? __pfx_ksys_write+0x10/0x10 [ 231.445776][ T9895] __do_fast_syscall_32+0x13a/0x8b0 [ 231.445789][ T9895] ? lockdep_hardirqs_on+0x7d/0x110 [ 231.445800][ T9895] do_fast_syscall_32+0x32/0x70 [ 231.445812][ T9895] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 231.445826][ T9895] RIP: 0023:0xf73aefec [ 231.445839][ T9895] Code: Unable to access opcode bytes at 0xf73aefc2. [ 231.445844][ T9895] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 231.445856][ T9895] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001040 [ 231.445864][ T9895] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 231.445870][ T9895] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 231.445876][ T9895] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 231.445883][ T9895] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 231.445896][ T9895] [ 231.574355][ T9900] input: syz0 as /devices/virtual/input/input15 [ 231.590476][ T9902] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1391'. [ 231.818896][ T9910] warning: `syz.1.1401' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 231.822497][ T9910] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1401'. [ 231.822542][ T9910] bridge_slave_1: left allmulticast mode [ 231.822560][ T9910] bridge_slave_1: left promiscuous mode [ 231.822685][ T9910] bridge0: port 2(bridge_slave_1) entered disabled state [ 231.832538][ T9910] bridge_slave_0: left allmulticast mode [ 231.832555][ T9910] bridge_slave_0: left promiscuous mode [ 231.832668][ T9910] bridge0: port 1(bridge_slave_0) entered disabled state [ 231.875988][ T9913] input: syz0 as /devices/virtual/input/input16 [ 232.047043][ T9904] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 232.110813][ T9922] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1396'. [ 232.110835][ T9922] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1396'. [ 232.110855][ T9922] syzkaller0: left promiscuous mode [ 232.110864][ T9922] syzkaller0: left allmulticast mode [ 232.113832][ T5100] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 232.750522][ T9938] input: syz0 as /devices/virtual/input/input17 [ 232.793515][ T9940] Invalid ELF header magic: != ELF [ 233.711100][ T1352] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 233.861127][ T1352] usb 7-1: Using ep0 maxpacket: 8 [ 233.861888][ T1352] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 233.862952][ T1352] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 233.862971][ T1352] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 233.863007][ T1352] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 233.863050][ T1352] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.869973][ T1352] hub 7-1:1.0: bad descriptor, ignoring hub [ 233.869995][ T1352] hub 7-1:1.0: probe with driver hub failed with error -5 [ 233.870396][ T1352] cdc_wdm 7-1:1.0: skipping garbage [ 233.870408][ T1352] cdc_wdm 7-1:1.0: skipping garbage [ 233.876280][ T1352] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 233.876298][ T1352] cdc_wdm 7-1:1.0: Unknown control protocol [ 234.928499][ T9916] ceph: No mds server is up or the cluster is laggy [ 235.022202][ T9981] usb 7-1: reset high-speed USB device number 26 using dummy_hcd [ 235.024690][ T9981] usb 7-1: device reset changed ep0 maxpacket size! [ 235.028633][ T5824] usb 7-1: USB disconnect, device number 26 [ 235.161157][ T5824] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 235.312318][ T5824] usb 7-1: New USB device found, idVendor=046d, idProduct=c094, bcdDevice= 0.00 [ 235.315212][ T5824] usb 7-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 235.315230][ T5824] usb 7-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 235.315246][ T5824] usb 7-1: config 0 interface 0 has no altsetting 0 [ 235.315269][ T5824] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 235.317026][ T5824] usb 7-1: config 0 descriptor?? [ 235.523276][ T5824] usbhid 7-1:0.0: can't add hid device: -71 [ 235.523331][ T5824] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 235.527324][ T5824] usb 7-1: USB disconnect, device number 27 [ 235.696626][ T9929] ceph: No mds server is up or the cluster is laggy [ 235.765259][T10003] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1410'. [ 235.765282][T10003] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1410'. [ 235.766555][ T5100] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 235.984319][T10001] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 236.931100][ T5851] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 237.082241][ T5851] usb 7-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 237.083447][ T5851] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 237.083464][ T5851] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 237.083475][ T5851] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 237.083533][ T5851] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 237.085819][ T5851] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 237.085832][ T5851] usb 7-1: Product: syz [ 237.085839][ T5851] usb 7-1: Manufacturer: syz [ 237.085846][ T5851] usb 7-1: SerialNumber: syz [ 237.086912][T10022] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1416'. [ 237.087482][T10022] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1416'. [ 237.089271][ T5851] usb 7-1: config 0 descriptor?? [ 237.244155][T10031] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 237.244520][T10031] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 237.250858][T10032] Falling back ldisc for ttyS3. [ 237.300679][ T5851] adutux 7-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 237.500943][T10017] usb 7-1: Couldn't submit interrupt_out_urb -90 [ 237.681435][T10031] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 237.681630][T10031] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 238.322360][T10045] FAULT_INJECTION: forcing a failure. [ 238.322360][T10045] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 238.322382][T10045] CPU: 2 UID: 0 PID: 10045 Comm: syz.0.1423 Not tainted syzkaller #0 PREEMPT(full) [ 238.322395][T10045] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 238.322401][T10045] Call Trace: [ 238.322405][T10045] [ 238.322410][T10045] dump_stack_lvl+0x100/0x190 [ 238.322429][T10045] should_fail_ex.cold+0x5/0xa [ 238.322444][T10045] _copy_to_user+0x32/0xd0 [ 238.322456][T10045] simple_read_from_buffer+0xcb/0x170 [ 238.322474][T10045] proc_fail_nth_read+0x1af/0x230 [ 238.322490][T10045] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 238.322506][T10045] ? rw_verify_area+0xce/0x6d0 [ 238.322518][T10045] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 238.322533][T10045] vfs_read+0x1e4/0xb40 [ 238.322547][T10045] ? lock_acquire+0x1d1/0x380 [ 238.322568][T10045] ? __fget_files+0x34/0x3d0 [ 238.322583][T10045] ? __pfx_vfs_read+0x10/0x10 [ 238.322595][T10045] ? find_held_lock+0x2b/0x80 [ 238.322608][T10045] ? __fget_files+0x215/0x3d0 [ 238.322625][T10045] ? __fget_files+0x21f/0x3d0 [ 238.322643][T10045] ksys_read+0x12a/0x250 [ 238.322657][T10045] ? __pfx_ksys_read+0x10/0x10 [ 238.322675][T10045] do_int80_emulation+0x166/0x650 [ 238.322689][T10045] asm_int80_emulation+0x1a/0x20 [ 238.322701][T10045] RIP: 0023:0xf71577eb [ 238.322710][T10045] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 238.322720][T10045] RSP: 002b:00000000f53f54bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 238.322732][T10045] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f53f55d0 [ 238.322739][T10045] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 238.322745][T10045] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 238.322751][T10045] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 238.322757][T10045] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 238.322771][T10045] [ 238.500045][ C0] vxcan0: j1939_tp_rxtimer: 0xffff888022fadc00: rx timeout, send abort [ 238.503635][ C0] vxcan0: j1939_xtp_rx_abort_one: 0xffff888022fadc00: 0x20100: (3) A timeout occurred and this is the connection abort to close the session. [ 239.511105][ T5641] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 239.552951][ T5851] usb 7-1: USB disconnect, device number 28 [ 239.557278][T10049] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 239.661668][ T5641] usb 6-1: Using ep0 maxpacket: 8 [ 239.662148][ T5641] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 239.663047][ T5641] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 239.663067][ T5641] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 239.663104][ T5641] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 239.663138][ T5641] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.669545][ T5641] hub 6-1:1.0: bad descriptor, ignoring hub [ 239.669560][ T5641] hub 6-1:1.0: probe with driver hub failed with error -5 [ 239.669783][ T5641] cdc_wdm 6-1:1.0: skipping garbage [ 239.669790][ T5641] cdc_wdm 6-1:1.0: skipping garbage [ 239.674046][ T5641] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 239.674058][ T5641] cdc_wdm 6-1:1.0: Unknown control protocol [ 240.551911][T10053] usb 6-1: reset high-speed USB device number 13 using dummy_hcd [ 240.554858][T10053] usb 6-1: device reset changed ep0 maxpacket size! [ 240.559131][ T5824] usb 6-1: USB disconnect, device number 13 [ 240.691130][ T5824] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 240.843913][ T5824] usb 6-1: New USB device found, idVendor=046d, idProduct=c094, bcdDevice= 0.00 [ 240.844826][ T5824] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 240.844844][ T5824] usb 6-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 240.844857][ T5824] usb 6-1: config 0 interface 0 has no altsetting 0 [ 240.844873][ T5824] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 240.846039][ T5824] usb 6-1: config 0 descriptor?? [ 241.060538][ T5824] usbhid 6-1:0.0: can't add hid device: -71 [ 241.060609][ T5824] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 241.064840][T10079] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.065083][T10079] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 241.070976][T10077] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1435'. [ 241.071067][T10077] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1435'. [ 241.071716][ T5824] usb 6-1: USB disconnect, device number 14 [ 241.073786][ T5100] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 241.091721][T10079] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.092806][T10079] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 242.607519][T10102] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 243.076007][T10117] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1447'. [ 243.076173][T10117] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1447'. [ 243.088090][ T5100] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 243.991276][ T5900] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 244.141112][ T5900] usb 6-1: Using ep0 maxpacket: 8 [ 244.143191][ T5900] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 244.144914][ T5900] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 244.144926][ T5900] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 244.144945][ T5900] usb 6-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 244.144958][ T5900] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 244.144970][ T5900] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 244.144988][ T5900] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.150649][ T5900] hub 6-1:1.0: bad descriptor, ignoring hub [ 244.150662][ T5900] hub 6-1:1.0: probe with driver hub failed with error -5 [ 244.150972][ T5900] cdc_wdm 6-1:1.0: skipping garbage [ 244.150980][ T5900] cdc_wdm 6-1:1.0: skipping garbage [ 244.187519][ T5900] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 244.187531][ T5900] cdc_wdm 6-1:1.0: Unknown control protocol [ 244.422097][T10124] cdc_wdm 6-1:1.0: Error submitting int urb - -90 [ 244.721311][ T1352] usb 6-1: USB disconnect, device number 15 [ 244.827694][T10138] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 244.927683][T10140] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1455'. [ 245.061125][ T1352] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 245.191292][T10143] fuse: Unknown parameter '00000000000000000000' [ 245.221843][ T1352] usb 6-1: New USB device found, idVendor=046d, idProduct=c094, bcdDevice= 0.00 [ 245.222877][ T1352] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 245.222905][ T1352] usb 6-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 245.222927][ T1352] usb 6-1: config 0 interface 0 has no altsetting 0 [ 245.223032][ T1352] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 245.225164][ T1352] usb 6-1: config 0 descriptor?? [ 245.315181][T10146] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1457'. [ 245.550388][ T1352] usbhid 6-1:0.0: can't add hid device: -71 [ 245.550470][ T1352] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 245.590820][ T1352] usb 6-1: USB disconnect, device number 16 [ 245.756642][ T5100] Bluetooth: hci3: unexpected event for opcode 0x1003 [ 245.756693][ T5100] Bluetooth: hci3: unexpected event for opcode 0x1004 [ 245.756730][ T5100] Bluetooth: hci3: unexpected event for opcode 0x2003 [ 246.205243][T10166] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1463'. [ 246.373137][T10172] fuse: fd is not a fuse device [ 246.377395][T10170] rxe_eth0 speed is unknown, defaulting to 1000 [ 246.536604][T10175] netlink: 13 bytes leftover after parsing attributes in process `syz.0.1472'. [ 246.538977][T10175] fuse: Bad value for 'fd' [ 246.662687][T10183] input: syz0 as /devices/virtual/input/input18 [ 246.860653][T10195] FAULT_INJECTION: forcing a failure. [ 246.860653][T10195] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 246.860685][T10195] CPU: 0 UID: 0 PID: 10195 Comm: syz.0.1471 Not tainted syzkaller #0 PREEMPT(full) [ 246.860707][T10195] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 246.860718][T10195] Call Trace: [ 246.860725][T10195] [ 246.860733][T10195] dump_stack_lvl+0x100/0x190 [ 246.860764][T10195] should_fail_ex.cold+0x5/0xa [ 246.860789][T10195] _copy_from_iter+0x1f4/0x1690 [ 246.860816][T10195] ? __pfx__copy_from_iter+0x10/0x10 [ 246.860837][T10195] ? aa_sk_perm+0x389/0xab0 [ 246.860862][T10195] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 246.860891][T10195] ? __pfx_aa_sk_perm+0x10/0x10 [ 246.860917][T10195] hci_sock_sendmsg+0x4a1/0x26a0 [ 246.860946][T10195] ? aa_sock_msg_perm+0x11e/0x200 [ 246.860966][T10195] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 246.861004][T10195] ? apparmor_socket_sendmsg+0x165/0x280 [ 246.861032][T10195] sock_write_iter+0x53a/0x5b0 [ 246.861060][T10195] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 246.861087][T10195] ? __pfx_sock_write_iter+0x10/0x10 [ 246.861120][T10195] ? bpf_lsm_file_permission+0x9/0x10 [ 246.861149][T10195] ? security_file_permission+0x76/0x210 [ 246.861174][T10195] ? rw_verify_area+0xce/0x6d0 [ 246.861199][T10195] vfs_write+0x6af/0x1050 [ 246.861223][T10195] ? __pfx_sock_write_iter+0x10/0x10 [ 246.861252][T10195] ? __pfx_vfs_write+0x10/0x10 [ 246.861290][T10195] ? find_held_lock+0x2b/0x80 [ 246.861329][T10195] ksys_write+0x1f8/0x250 [ 246.861352][T10195] ? __pfx_ksys_write+0x10/0x10 [ 246.861374][T10195] ? ksys_write+0x1ac/0x250 [ 246.861397][T10195] ? __pfx_ksys_write+0x10/0x10 [ 246.861425][T10195] __do_fast_syscall_32+0x13a/0x8b0 [ 246.861447][T10195] ? lockdep_hardirqs_on+0x7d/0x110 [ 246.861468][T10195] do_fast_syscall_32+0x32/0x70 [ 246.861494][T10195] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 246.861518][T10195] RIP: 0023:0xf73fefec [ 246.861540][T10195] Code: Unable to access opcode bytes at 0xf73fefc2. [ 246.861549][T10195] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 246.861567][T10195] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000240 [ 246.861579][T10195] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 246.861590][T10195] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 246.861600][T10195] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 246.861610][T10195] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 246.861635][T10195] [ 247.642631][T10206] fuse: Unknown parameter 'user00000000000000000000' [ 247.906411][T10220] can0: slcan on pts0. [ 248.001266][T10219] can0 (unregistered): slcan off pts0. [ 248.116741][T10222] input: syz0 as /devices/virtual/input/input19 [ 248.207877][T10227] overlayfs: failed to clone upperpath [ 248.447355][T10235] FAULT_INJECTION: forcing a failure. [ 248.447355][T10235] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 248.447384][T10235] CPU: 3 UID: 0 PID: 10235 Comm: syz.1.1485 Not tainted syzkaller #0 PREEMPT(full) [ 248.447403][T10235] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 248.447413][T10235] Call Trace: [ 248.447420][T10235] [ 248.447427][T10235] dump_stack_lvl+0x100/0x190 [ 248.447485][T10235] should_fail_ex.cold+0x5/0xa [ 248.447508][T10235] _copy_from_user+0x2e/0xd0 [ 248.447528][T10235] move_addr_to_kernel+0x65/0x170 [ 248.447555][T10235] __sys_sendto+0x1b8/0x4e0 [ 248.447576][T10235] ? __pfx___sys_sendto+0x10/0x10 [ 248.447612][T10235] ? fput+0x7c/0x100 [ 248.447646][T10235] ? ksys_write+0x1ac/0x250 [ 248.447669][T10235] __ia32_sys_sendto+0xdd/0x1b0 [ 248.447686][T10235] ? __do_fast_syscall_32+0xb3/0x8b0 [ 248.447703][T10235] ? lockdep_hardirqs_on+0x7d/0x110 [ 248.447719][T10235] __do_fast_syscall_32+0x13a/0x8b0 [ 248.447735][T10235] ? lockdep_hardirqs_on+0x7d/0x110 [ 248.447752][T10235] do_fast_syscall_32+0x32/0x70 [ 248.447769][T10235] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 248.447790][T10235] RIP: 0023:0xf73aefec [ 248.447808][T10235] Code: Unable to access opcode bytes at 0xf73aefc2. [ 248.447816][T10235] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 248.447834][T10235] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000 [ 248.447845][T10235] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000080000700 [ 248.447854][T10235] RBP: 000000000000001c R08: 0000000000000000 R09: 0000000000000000 [ 248.447863][T10235] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 248.447873][T10235] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 248.447894][T10235] [ 248.479611][T10237] fuse: fd is not a fuse device [ 248.561966][T10239] dlm: non-version read from control device 36 [ 248.567563][T10239] dlm: non-version read from control device 8224 [ 248.609378][T10246] input: syz0 as /devices/virtual/input/input20 [ 248.639636][ T5100] Bluetooth: hci1: unexpected event for opcode 0x2028 [ 248.707388][T10257] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1494'. [ 248.738802][T10259] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1495'. [ 249.616546][T10270] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1498'. [ 249.616578][T10270] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1498'. [ 249.618390][ T5100] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 250.160352][T10272] can0: slcan on pts0. [ 250.242198][T10271] can0 (unregistered): slcan off pts0. [ 250.325293][T10283] input: syz0 as /devices/virtual/input/input21 [ 250.525289][T10290] bridge0: port 2(bridge_slave_1) entered disabled state [ 250.525757][T10290] bridge0: port 1(bridge_slave_0) entered disabled state [ 250.605389][T10290] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 250.613143][T10290] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 250.792361][ T5831] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 250.792394][ T5831] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 250.792439][ T5831] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 250.792461][ T5831] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 250.792507][ T5831] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 250.792529][ T5831] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 250.792571][ T5831] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 250.792594][ T5831] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 251.802028][T10311] fuse: Unknown parameter 'user_i00000000000000000000' [ 251.886598][T10318] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1507'. [ 252.401222][ T1352] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 252.551976][ T1352] usb 6-1: not running at top speed; connect to a high speed hub [ 252.551997][ T1352] usb 6-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 252.552880][ T1352] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 252.552893][ T1352] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 252.552902][ T1352] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 252.552924][ T1352] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.712878][ T5100] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 252.712947][ T5100] Bluetooth: hci1: Injecting HCI hardware error event [ 252.717837][ T5100] Bluetooth: hci1: hardware error 0x00 [ 252.816310][T10326] can0: slcan on pts0. [ 252.845234][ T1352] usb 6-1: string descriptor 0 read error: -71 [ 252.845282][ T1352] uvcvideo 6-1:1.0: Found UVC 1.00 device (046d:0825) [ 252.845307][ T1352] uvcvideo 6-1:1.0: No valid video chain found. [ 252.849093][ T1352] usb 6-1: USB disconnect, device number 17 [ 252.854723][T10325] can0 (unregistered): slcan off pts0. [ 253.346274][T10334] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1515'. [ 253.346321][T10334] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1515'. [ 253.346421][T10334] FAULT_INJECTION: forcing a failure. [ 253.346421][T10334] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 253.346443][T10334] CPU: 0 UID: 0 PID: 10334 Comm: syz.2.1515 Not tainted syzkaller #0 PREEMPT(full) [ 253.346468][T10334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 253.346479][T10334] Call Trace: [ 253.346485][T10334] [ 253.346492][T10334] dump_stack_lvl+0x100/0x190 [ 253.346519][T10334] should_fail_ex.cold+0x5/0xa [ 253.346545][T10334] _copy_to_user+0x32/0xd0 [ 253.346570][T10334] simple_read_from_buffer+0xcb/0x170 [ 253.346603][T10334] proc_fail_nth_read+0x1af/0x230 [ 253.346629][T10334] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 253.346656][T10334] ? rw_verify_area+0xce/0x6d0 [ 253.346675][T10334] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 253.346701][T10334] vfs_read+0x1e4/0xb40 [ 253.346726][T10334] ? lock_acquire+0x1d1/0x380 [ 253.346751][T10334] ? __fget_files+0x34/0x3d0 [ 253.346774][T10334] ? __pfx_vfs_read+0x10/0x10 [ 253.346792][T10334] ? find_held_lock+0x2b/0x80 [ 253.346812][T10334] ? __fget_files+0x215/0x3d0 [ 253.346839][T10334] ? __fget_files+0x21f/0x3d0 [ 253.346872][T10334] ksys_read+0x12a/0x250 [ 253.346896][T10334] ? __pfx_ksys_read+0x10/0x10 [ 253.346924][T10334] do_int80_emulation+0x166/0x650 [ 253.346945][T10334] asm_int80_emulation+0x1a/0x20 [ 253.346962][T10334] RIP: 0023:0xf71477eb [ 253.346976][T10334] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 253.346991][T10334] RSP: 002b:00000000f54064bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 253.347012][T10334] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54065d0 [ 253.347026][T10334] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 253.347038][T10334] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 253.347048][T10334] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 253.347058][T10334] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 253.347083][T10334] [ 253.426019][T10336] fuse: Unknown parameter 'user_i00000000000000000000' [ 253.715698][T10350] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 253.715900][T10350] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 254.678188][T10370] fuse: fd is not a fuse device [ 254.744493][T10374] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.1529'. [ 254.782868][ T5100] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 254.850755][T10379] veth0: entered promiscuous mode [ 254.860833][T10378] veth0: left promiscuous mode [ 255.272009][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.272039][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.879494][T10391] rxe_eth0 speed is unknown, defaulting to 1000 [ 256.021053][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 256.344571][T10415] kvm: pic: level sensitive irq not supported [ 256.605652][ T5100] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 256.641988][T10424] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1543'. [ 257.337017][T10444] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1548'. [ 257.791855][T10434] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 258.046916][T10452] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1551'. [ 258.047061][T10452] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 258.047073][T10452] IPv6: NLM_F_CREATE should be set when creating new route [ 258.063294][T10452] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1551'. [ 258.111582][T10458] FAULT_INJECTION: forcing a failure. [ 258.111582][T10458] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 258.111603][T10458] CPU: 1 UID: 0 PID: 10458 Comm: syz.2.1553 Not tainted syzkaller #0 PREEMPT(full) [ 258.111616][T10458] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 258.111623][T10458] Call Trace: [ 258.111627][T10458] [ 258.111642][T10458] dump_stack_lvl+0x100/0x190 [ 258.111663][T10458] should_fail_ex.cold+0x5/0xa [ 258.111678][T10458] _copy_to_user+0x32/0xd0 [ 258.111691][T10458] simple_read_from_buffer+0xcb/0x170 [ 258.111708][T10458] proc_fail_nth_read+0x1af/0x230 [ 258.111724][T10458] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 258.111740][T10458] ? rw_verify_area+0xce/0x6d0 [ 258.111752][T10458] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 258.111767][T10458] vfs_read+0x1e4/0xb40 [ 258.111781][T10458] ? lock_acquire+0x1d1/0x380 [ 258.111798][T10458] ? __fget_files+0x34/0x3d0 [ 258.111813][T10458] ? __pfx_vfs_read+0x10/0x10 [ 258.111825][T10458] ? find_held_lock+0x2b/0x80 [ 258.111839][T10458] ? __fget_files+0x215/0x3d0 [ 258.111856][T10458] ? __fget_files+0x21f/0x3d0 [ 258.111875][T10458] ksys_read+0x12a/0x250 [ 258.111889][T10458] ? __pfx_ksys_read+0x10/0x10 [ 258.111907][T10458] do_int80_emulation+0x166/0x650 [ 258.111921][T10458] asm_int80_emulation+0x1a/0x20 [ 258.111932][T10458] RIP: 0023:0xf71477eb [ 258.111941][T10458] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 258.111951][T10458] RSP: 002b:00000000f54064bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 258.111962][T10458] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54065d0 [ 258.111970][T10458] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 258.111976][T10458] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 258.111982][T10458] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 258.111989][T10458] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 258.112003][T10458] [ 258.116994][T10460] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1554'. [ 258.117027][T10460] netlink: 'syz.1.1554': attribute type 11 has an invalid length. [ 258.117039][T10460] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1554'. [ 258.118406][ T5100] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 258.221464][T10468] FAULT_INJECTION: forcing a failure. [ 258.221464][T10468] name failslab, interval 1, probability 0, space 0, times 0 [ 258.221491][T10468] CPU: 2 UID: 0 PID: 10468 Comm: syz.2.1557 Not tainted syzkaller #0 PREEMPT(full) [ 258.221509][T10468] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 258.221518][T10468] Call Trace: [ 258.221524][T10468] [ 258.221530][T10468] dump_stack_lvl+0x100/0x190 [ 258.221554][T10468] should_fail_ex.cold+0x5/0xa [ 258.221574][T10468] should_failslab+0xc2/0x120 [ 258.221596][T10468] __kmalloc_noprof+0xfc/0x840 [ 258.221615][T10468] ? trace_kmalloc+0xeb/0x110 [ 258.221648][T10468] ? lsm_blob_alloc+0x68/0x90 [ 258.221673][T10468] lsm_blob_alloc+0x68/0x90 [ 258.221694][T10468] security_sk_alloc+0x2d/0x290 [ 258.221710][T10468] sk_prot_alloc+0x12a/0x2a0 [ 258.221733][T10468] sk_alloc+0x36/0xe80 [ 258.221750][T10468] bt_sock_alloc+0x3b/0x3c0 [ 258.221769][T10468] hci_sock_create+0xbc/0x1c0 [ 258.221789][T10468] bt_sock_create+0x185/0x350 [ 258.221807][T10468] __sock_create+0x339/0x860 [ 258.221832][T10468] __sys_socket+0x14d/0x260 [ 258.221845][T10468] ? __pfx___sys_socket+0x10/0x10 [ 258.221864][T10468] __ia32_sys_socket+0x72/0xb0 [ 258.221877][T10468] ? lockdep_hardirqs_on+0x7d/0x110 [ 258.221891][T10468] __do_fast_syscall_32+0x13a/0x8b0 [ 258.221906][T10468] ? lockdep_hardirqs_on+0x7d/0x110 [ 258.221921][T10468] do_fast_syscall_32+0x32/0x70 [ 258.221936][T10468] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 258.221954][T10468] RIP: 0023:0xf73eefec [ 258.221971][T10468] Code: Unable to access opcode bytes at 0xf73eefc2. [ 258.221978][T10468] RSP: 002b:00000000f54064bc EFLAGS: 00000246 ORIG_RAX: 0000000000000167 [ 258.221993][T10468] RAX: ffffffffffffffda RBX: 000000000000001f RCX: 0000000000000003 [ 258.222003][T10468] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000f540653c [ 258.222013][T10468] RBP: 00000000f54065ec R08: 0000000000000000 R09: 0000000000000000 [ 258.222022][T10468] R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000 [ 258.222030][T10468] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 258.222049][T10468] [ 258.974653][T10481] overlayfs: failed to clone upperpath [ 259.447011][T10493] fuse: Bad value for 'fd' [ 259.566340][T10497] FAULT_INJECTION: forcing a failure. [ 259.566340][T10497] name failslab, interval 1, probability 0, space 0, times 0 [ 259.566361][T10497] CPU: 2 UID: 0 PID: 10497 Comm: syz.1.1570 Not tainted syzkaller #0 PREEMPT(full) [ 259.566374][T10497] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 259.566380][T10497] Call Trace: [ 259.566384][T10497] [ 259.566389][T10497] dump_stack_lvl+0x100/0x190 [ 259.566408][T10497] should_fail_ex.cold+0x5/0xa [ 259.566423][T10497] should_failslab+0xc2/0x120 [ 259.566441][T10497] __kmalloc_cache_noprof+0x91/0x6d0 [ 259.566454][T10497] ? sctp_add_bind_addr+0xae/0x3e0 [ 259.566475][T10497] sctp_add_bind_addr+0xae/0x3e0 [ 259.566494][T10497] sctp_copy_one_addr.part.0+0xea/0x120 [ 259.566510][T10497] sctp_bind_addr_copy+0x1b4/0x530 [ 259.566524][T10497] sctp_connect_new_asoc+0x1c9/0x770 [ 259.566540][T10497] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 259.566554][T10497] ? sctp_endpoint_lookup_assoc+0x15c/0x2a0 [ 259.566567][T10497] ? sctp_endpoint_lookup_assoc+0x15c/0x2a0 [ 259.566583][T10497] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 259.566602][T10497] sctp_sendmsg+0x1743/0x22e0 [ 259.566620][T10497] ? __pfx_sctp_sendmsg+0x10/0x10 [ 259.566635][T10497] ? __lock_acquire+0x5c0/0x1f40 [ 259.566654][T10497] ? tomoyo_socket_sendmsg_permission+0x14e/0x3c0 [ 259.566675][T10497] ? aa_sock_msg_perm+0x11e/0x200 [ 259.566687][T10497] ? __pfx_sctp_sendmsg+0x10/0x10 [ 259.566703][T10497] inet_sendmsg+0x11c/0x140 [ 259.566714][T10497] ____sys_sendmsg+0x9c9/0xbe0 [ 259.566730][T10497] ? __pfx_inet_sendmsg+0x10/0x10 [ 259.566742][T10497] ? __pfx_____sys_sendmsg+0x10/0x10 [ 259.566765][T10497] ___sys_sendmsg+0x190/0x1e0 [ 259.566784][T10497] ? __pfx____sys_sendmsg+0x10/0x10 [ 259.566808][T10497] ? find_held_lock+0x2b/0x80 [ 259.566830][T10497] __sys_sendmsg+0x160/0x210 [ 259.566844][T10497] ? __pfx___sys_sendmsg+0x10/0x10 [ 259.566861][T10497] ? __pfx_ksys_write+0x10/0x10 [ 259.566879][T10497] __do_fast_syscall_32+0x13a/0x8b0 [ 259.566891][T10497] ? lockdep_hardirqs_on+0x7d/0x110 [ 259.566903][T10497] do_fast_syscall_32+0x32/0x70 [ 259.566915][T10497] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 259.566931][T10497] RIP: 0023:0xf73aefec [ 259.566945][T10497] Code: Unable to access opcode bytes at 0xf73aefc2. [ 259.566950][T10497] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 259.566961][T10497] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000440 [ 259.566968][T10497] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 259.566974][T10497] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 259.566981][T10497] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 259.566987][T10497] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 259.567001][T10497] [ 259.824488][T10504] FAULT_INJECTION: forcing a failure. [ 259.824488][T10504] name failslab, interval 1, probability 0, space 0, times 0 [ 259.824520][T10504] CPU: 1 UID: 0 PID: 10504 Comm: syz.1.1572 Not tainted syzkaller #0 PREEMPT(full) [ 259.824559][T10504] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 259.824570][T10504] Call Trace: [ 259.824577][T10504] [ 259.824585][T10504] dump_stack_lvl+0x100/0x190 [ 259.824615][T10504] should_fail_ex.cold+0x5/0xa [ 259.824640][T10504] should_failslab+0xc2/0x120 [ 259.824668][T10504] kmem_cache_alloc_noprof+0x92/0x6a0 [ 259.824692][T10504] ? security_file_alloc+0x34/0x2c0 [ 259.824722][T10504] security_file_alloc+0x34/0x2c0 [ 259.824745][T10504] init_file+0x95/0x480 [ 259.824771][T10504] alloc_empty_file+0x79/0x1c0 [ 259.824790][T10504] path_openat+0xdb/0x2450 [ 259.824818][T10504] ? __pfx_path_openat+0x10/0x10 [ 259.824850][T10504] do_file_open+0x20e/0x430 [ 259.824876][T10504] ? __pfx_do_file_open+0x10/0x10 [ 259.824918][T10504] ? _raw_spin_unlock+0x28/0x50 [ 259.824942][T10504] ? alloc_fd+0x471/0x7a0 [ 259.824972][T10504] do_sys_openat2+0x10f/0x1e0 [ 259.824997][T10504] ? __pfx_do_sys_openat2+0x10/0x10 [ 259.825018][T10504] ? trace_event_raw_event_msr_trace_class+0x1a1/0x270 [ 259.825062][T10504] ? __pfx_trace_event_raw_event_msr_trace_class+0x10/0x10 [ 259.825089][T10504] __ia32_compat_sys_openat+0x12d/0x210 [ 259.825111][T10504] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 259.825140][T10504] do_int80_emulation+0x166/0x650 [ 259.825163][T10504] asm_int80_emulation+0x1a/0x20 [ 259.825180][T10504] RIP: 0023:0xf71077eb [ 259.825195][T10504] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 259.825211][T10504] RSP: 002b:00000000f53c63cc EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 259.825232][T10504] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f53c6490 [ 259.825245][T10504] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 259.825256][T10504] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 259.825267][T10504] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 259.825278][T10504] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 259.825301][T10504] [ 260.002198][T10513] FAULT_INJECTION: forcing a failure. [ 260.002198][T10513] name failslab, interval 1, probability 0, space 0, times 0 [ 260.002218][T10513] CPU: 2 UID: 0 PID: 10513 Comm: syz.2.1576 Not tainted syzkaller #0 PREEMPT(full) [ 260.002232][T10513] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 260.002241][T10513] Call Trace: [ 260.002245][T10513] [ 260.002250][T10513] dump_stack_lvl+0x100/0x190 [ 260.002270][T10513] should_fail_ex.cold+0x5/0xa [ 260.002285][T10513] should_failslab+0xc2/0x120 [ 260.002303][T10513] kmem_cache_alloc_noprof+0x92/0x6a0 [ 260.002319][T10513] ? __pfx_acpi_ut_track_stack_ptr+0x10/0x10 [ 260.002337][T10513] ? acpi_ut_create_update_state+0x72/0x130 [ 260.002356][T10513] acpi_ut_create_update_state+0x72/0x130 [ 260.002372][T10513] acpi_ut_create_update_state_and_push+0x2f/0x70 [ 260.002387][T10513] acpi_ut_update_object_reference+0x32f/0x800 [ 260.002401][T10513] ? __pfx_acpi_ut_update_object_reference+0x10/0x10 [ 260.002412][T10513] ? __pfx_acpi_ut_trace+0x10/0x10 [ 260.002428][T10513] ? __pfx_acpi_ut_trace+0x10/0x10 [ 260.002444][T10513] ? acpi_ut_status_exit+0x111/0x1c0 [ 260.002463][T10513] acpi_ut_add_reference+0x80/0x170 [ 260.002474][T10513] acpi_ex_resolve_node_to_value+0x7e1/0x9a0 [ 260.002489][T10513] ? __pfx_acpi_ex_resolve_node_to_value+0x10/0x10 [ 260.002507][T10513] ? acpi_ds_create_operand+0x267/0xc20 [ 260.002525][T10513] acpi_ex_resolve_to_value+0x3da/0xcd0 [ 260.002537][T10513] ? __pfx_acpi_ex_resolve_to_value+0x10/0x10 [ 260.002549][T10513] ? __pfx_acpi_ns_lookup+0x10/0x10 [ 260.002565][T10513] ? __asan_memset+0x23/0x50 [ 260.002579][T10513] ? __pfx_acpi_ut_track_stack_ptr+0x10/0x10 [ 260.002598][T10513] acpi_ds_evaluate_name_path+0x30d/0x4a0 [ 260.002614][T10513] ? __pfx_acpi_ds_evaluate_name_path+0x10/0x10 [ 260.002631][T10513] ? acpi_ps_get_next_namepath+0x1f6/0xa10 [ 260.002647][T10513] ? acpi_ut_trace_ptr+0x151/0x2a0 [ 260.002666][T10513] acpi_ds_exec_end_op+0xb78/0x1e60 [ 260.002683][T10513] ? __pfx_acpi_ds_exec_end_op+0x10/0x10 [ 260.002698][T10513] acpi_ps_parse_loop+0x5e1/0x26e0 [ 260.002717][T10513] ? __pfx_acpi_ps_parse_loop+0x10/0x10 [ 260.002732][T10513] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 260.002746][T10513] ? __pfx_acpi_ut_track_stack_ptr+0x10/0x10 [ 260.002779][T10513] ? acpi_ut_create_thread_state+0x6d/0x170 [ 260.002802][T10513] acpi_ps_parse_aml+0x81e/0x1120 [ 260.002823][T10513] acpi_ps_execute_method+0x5c4/0xe90 [ 260.002846][T10513] acpi_ns_evaluate+0x640/0x1670 [ 260.002862][T10513] acpi_ut_evaluate_object+0xf7/0x610 [ 260.002877][T10513] acpi_rs_get_prt_method_data+0xa0/0x150 [ 260.002890][T10513] ? __pfx_acpi_rs_get_prt_method_data+0x10/0x10 [ 260.002903][T10513] ? acpi_ut_status_exit+0x111/0x1c0 [ 260.002935][T10513] ? acpi_rs_validate_parameters+0x104/0x210 [ 260.002948][T10513] acpi_get_irq_routing_table+0xb8/0x140 [ 260.002961][T10513] ? __pfx_acpi_get_irq_routing_table+0x10/0x10 [ 260.002977][T10513] acpi_pci_irq_find_prt_entry+0x179/0xdd0 [ 260.002992][T10513] ? preempt_schedule_thunk+0x16/0x40 [ 260.003007][T10513] ? __pfx_acpi_pci_irq_find_prt_entry+0x10/0x10 [ 260.003025][T10513] acpi_pci_irq_lookup+0x8e/0x6b0 [ 260.003039][T10513] ? __pfx_acpi_pci_irq_lookup+0x10/0x10 [ 260.003055][T10513] acpi_pci_irq_disable+0x1a8/0x360 [ 260.003067][T10513] ? __pfx_acpi_pci_irq_disable+0x10/0x10 [ 260.003079][T10513] pcibios_disable_device+0x89/0xb0 [ 260.003095][T10513] do_pci_disable_device+0x9f/0x100 [ 260.003107][T10513] ? __pfx_do_pci_disable_device+0x10/0x10 [ 260.003120][T10513] ? pci_release_region.part.0+0x15b/0x2e0 [ 260.003136][T10513] pci_disable_device+0x130/0x270 [ 260.003148][T10513] virtio_pci_remove+0xcf/0x110 [ 260.003166][T10513] pci_device_remove+0xb2/0x1d0 [ 260.003181][T10513] ? __pfx_pci_device_remove+0x10/0x10 [ 260.003198][T10513] device_remove+0xcb/0x180 [ 260.003211][T10513] device_release_driver_internal+0x44e/0x620 [ 260.003228][T10513] pci_stop_bus_device+0x120/0x160 [ 260.003240][T10513] pci_stop_and_remove_bus_device+0x58/0xa0 [ 260.003252][T10513] pci_stop_and_remove_bus_device_locked+0x1a/0x20 [ 260.003264][T10513] remove_store+0x123/0x140 [ 260.003278][T10513] ? __pfx_remove_store+0x10/0x10 [ 260.003290][T10513] ? find_held_lock+0x2b/0x80 [ 260.003303][T10513] ? sysfs_file_kobj+0xe4/0x290 [ 260.003317][T10513] ? sysfs_file_kobj+0xe4/0x290 [ 260.003332][T10513] ? __pfx_remove_store+0x10/0x10 [ 260.003343][T10513] dev_attr_store+0x58/0x80 [ 260.003358][T10513] ? __pfx_dev_attr_store+0x10/0x10 [ 260.003371][T10513] sysfs_kf_write+0xf2/0x150 [ 260.003408][T10513] kernfs_fop_write_iter+0x3e0/0x5f0 [ 260.003422][T10513] ? __pfx_sysfs_kf_write+0x10/0x10 [ 260.003439][T10513] vfs_write+0x6af/0x1050 [ 260.003455][T10513] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 260.003476][T10513] ? __pfx_vfs_write+0x10/0x10 [ 260.003497][T10513] ? find_held_lock+0x2b/0x80 [ 260.003540][T10513] ksys_write+0x12a/0x250 [ 260.003557][T10513] ? __pfx_ksys_write+0x10/0x10 [ 260.003577][T10513] __do_fast_syscall_32+0x13a/0x8b0 [ 260.003590][T10513] ? lockdep_hardirqs_on+0x7d/0x110 [ 260.003604][T10513] do_fast_syscall_32+0x32/0x70 [ 260.003617][T10513] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.003632][T10513] RIP: 0023:0xf73eefec [ 260.003646][T10513] Code: Unable to access opcode bytes at 0xf73eefc2. [ 260.003651][T10513] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 260.003663][T10513] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000ac0 [ 260.003670][T10513] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 260.003676][T10513] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 260.003682][T10513] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 260.003689][T10513] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 260.003703][T10513] [ 260.004449][T10513] ACPI Error: AE_NO_MEMORY, Could not update object reference count (20260408/utdelete-651) [ 260.155997][T10517] FAULT_INJECTION: forcing a failure. [ 260.155997][T10517] name failslab, interval 1, probability 0, space 0, times 0 [ 260.156018][T10517] CPU: 2 UID: 0 PID: 10517 Comm: syz.2.1578 Not tainted syzkaller #0 PREEMPT(full) [ 260.156031][T10517] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 260.156038][T10517] Call Trace: [ 260.156041][T10517] [ 260.156046][T10517] dump_stack_lvl+0x100/0x190 [ 260.156065][T10517] should_fail_ex.cold+0x5/0xa [ 260.156080][T10517] should_failslab+0xc2/0x120 [ 260.156098][T10517] __kmalloc_cache_noprof+0x91/0x6d0 [ 260.156111][T10517] ? tty_open+0x134/0xe20 [ 260.156127][T10517] tty_open+0x134/0xe20 [ 260.156142][T10517] ? __pfx_tty_open+0x10/0x10 [ 260.156155][T10517] ? chrdev_open+0x10b/0x6a0 [ 260.156170][T10517] ? chrdev_open+0x10b/0x6a0 [ 260.156187][T10517] ? __pfx_tty_open+0x10/0x10 [ 260.156200][T10517] chrdev_open+0x234/0x6a0 [ 260.156215][T10517] ? __pfx_apparmor_file_open+0x10/0x10 [ 260.156231][T10517] ? __pfx_chrdev_open+0x10/0x10 [ 260.156247][T10517] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 260.156262][T10517] do_dentry_open+0x6ab/0x14d0 [ 260.156276][T10517] ? __pfx_chrdev_open+0x10/0x10 [ 260.156294][T10517] vfs_open+0x82/0x3f0 [ 260.156306][T10517] path_openat+0x1a23/0x2450 [ 260.156324][T10517] ? __pfx_path_openat+0x10/0x10 [ 260.156344][T10517] do_file_open+0x20e/0x430 [ 260.156360][T10517] ? __pfx_do_file_open+0x10/0x10 [ 260.156385][T10517] ? _raw_spin_unlock+0x28/0x50 [ 260.156401][T10517] ? alloc_fd+0x471/0x7a0 [ 260.156420][T10517] do_sys_openat2+0x10f/0x1e0 [ 260.156431][T10517] ? __pfx_do_sys_openat2+0x10/0x10 [ 260.156446][T10517] __ia32_compat_sys_openat+0x12d/0x210 [ 260.156459][T10517] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 260.156476][T10517] __do_fast_syscall_32+0x13a/0x8b0 [ 260.156490][T10517] do_fast_syscall_32+0x32/0x70 [ 260.156507][T10517] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.156521][T10517] RIP: 0023:0xf73eefec [ 260.156533][T10517] Code: Unable to access opcode bytes at 0xf73eefc2. [ 260.156538][T10517] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 260.156548][T10517] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000100 [ 260.156555][T10517] RDX: 0000000000040000 RSI: 0000000000000000 RDI: 0000000000000000 [ 260.156562][T10517] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 260.156568][T10517] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 260.156574][T10517] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 260.156588][T10517] [ 261.070044][T10543] can0: slcan on pts0. [ 261.171789][T10542] can0 (unregistered): slcan off pts0. [ 261.267668][T10537] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 261.308912][T10555] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1589'. [ 261.309684][ T5100] Bluetooth: hci0: Malformed Event: 0x2f [ 261.314031][ T5100] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 261.414851][T10564] ------------[ cut here ]------------ [ 261.414861][T10564] Device '0-0002' does not have a release() function, it is broken and must be fixed. See Documentation/core-api/kobject.rst. [ 261.414870][T10564] WARNING: drivers/base/core.c:2642 at device_release+0x1da/0x270, CPU#3: syz.0.1591/10564 [ 261.424796][T10564] Modules linked in: [ 261.426745][T10564] CPU: 3 UID: 0 PID: 10564 Comm: syz.0.1591 Not tainted syzkaller #0 PREEMPT(full) [ 261.430379][T10564] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 261.433563][T10564] RIP: 0010:device_release+0x1dd/0x270 [ 261.435287][T10564] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8b 6b 50 48 85 ed 74 19 e8 1d 4d a1 fb 48 8d 3d 56 90 e7 0b 48 89 ee <67> 48 0f b9 3a e9 eb fe ff ff e8 04 4d a1 fb 48 89 da 48 b8 00 00 [ 261.441704][T10564] RSP: 0018:ffffc90003867a20 EFLAGS: 00010287 [ 261.443726][T10564] RAX: 0000000000004712 RBX: ffff88801534f020 RCX: ffffc90024101000 [ 261.446440][T10564] RDX: 0000000000080000 RSI: ffff88805c817220 RDI: ffffffff9251e6d0 [ 261.449032][T10564] RBP: ffff88805c817220 R08: 0000000000000001 R09: 0000000000000000 [ 261.451798][T10564] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88802587d000 [ 261.454341][T10564] R13: dffffc0000000000 R14: ffff88805c817220 R15: 0000000000000000 [ 261.456888][T10564] FS: 0000000000000000(0000) GS:ffff888095a4a000(0063) knlGS:00000000f5416b40 [ 261.459714][T10564] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 261.461853][T10564] CR2: 00000000f73d8150 CR3: 0000000055153000 CR4: 0000000000352ef0 [ 261.464397][T10564] DR0: fffffffffffffffc DR1: 0000000000000009 DR2: 0000000040000004 [ 261.467029][T10564] DR3: 0000000000000004 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 261.469571][T10564] Call Trace: [ 261.470637][T10564] [ 261.471650][T10564] kobject_put+0x1f7/0x640 [ 261.473070][T10564] device_unregister+0x2f/0xe0 [ 261.474606][T10564] i2c_unregister_device+0xf5/0x270 [ 261.476259][T10564] i2c_deregister_clients+0x255/0x460 [ 261.477967][T10564] i2c_del_adapter+0x13a/0x2e0 [ 261.479485][T10564] i801_remove+0xa4/0x3d0 [ 261.480800][T10564] pci_device_remove+0xb2/0x1d0 [ 261.482410][T10564] ? __pfx_pci_device_remove+0x10/0x10 [ 261.484120][T10564] device_remove+0xcb/0x180 [ 261.485516][T10564] device_release_driver_internal+0x44e/0x620 [ 261.487401][T10564] unbind_store+0xf8/0x110 [ 261.488755][T10564] ? __pfx_unbind_store+0x10/0x10 [ 261.490259][T10564] drv_attr_store+0x74/0xb0 [ 261.491719][T10564] ? __pfx_drv_attr_store+0x10/0x10 [ 261.493319][T10564] sysfs_kf_write+0xf2/0x150 [ 261.494761][T10564] kernfs_fop_write_iter+0x3e0/0x5f0 [ 261.496366][T10564] ? __pfx_sysfs_kf_write+0x10/0x10 [ 261.498113][T10564] vfs_write+0x6af/0x1050 [ 261.499413][T10564] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 261.501271][T10564] ? __pfx_vfs_write+0x10/0x10 [ 261.502719][T10564] ? find_held_lock+0x2b/0x80 [ 261.504184][T10564] ksys_write+0x12a/0x250 [ 261.505485][T10564] ? __pfx_ksys_write+0x10/0x10 [ 261.507029][T10564] __do_fast_syscall_32+0x13a/0x8b0 [ 261.508833][T10564] do_fast_syscall_32+0x32/0x70 [ 261.510314][T10564] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 261.512311][T10564] RIP: 0023:0xf73fefec [ 261.513548][T10564] Code: Unable to access opcode bytes at 0xf73fefc2. [ 261.515538][T10564] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 261.518018][T10564] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800003c0 [ 261.520386][T10564] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 261.522857][T10564] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 261.525331][T10564] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 261.527775][T10564] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 261.530301][T10564] [ 261.531295][T10564] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 261.533496][T10564] CPU: 3 UID: 0 PID: 10564 Comm: syz.0.1591 Not tainted syzkaller #0 PREEMPT(full) [ 261.536208][T10564] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 261.539172][T10564] Call Trace: [ 261.540186][T10564] [ 261.541084][T10564] dump_stack_lvl+0x100/0x190 [ 261.542540][T10564] vpanic+0x553/0x970 [ 261.543789][T10564] ? __pfx_vpanic+0x10/0x10 [ 261.545165][T10564] panic+0xd1/0xe0 [ 261.546407][T10564] ? __pfx_panic+0x10/0x10 [ 261.548103][T10564] check_panic_on_warn.cold+0x19/0x34 [ 261.549780][T10564] ? device_release+0x1da/0x270 [ 261.551245][T10564] __warn.cold+0x191/0x318 [ 261.552602][T10564] __report_bug+0x30f/0x440 [ 261.553993][T10564] ? device_release+0x1da/0x270 [ 261.555487][T10564] ? __pfx___report_bug+0x10/0x10 [ 261.556994][T10564] ? do_raw_spin_lock+0x128/0x260 [ 261.558550][T10564] ? find_held_lock+0x2b/0x80 [ 261.559984][T10564] ? kobj_kset_leave+0x160/0x210 [ 261.561492][T10564] report_bug_entry+0xe2/0x290 [ 261.562977][T10564] ? device_release+0x1dd/0x270 [ 261.564469][T10564] handle_bug+0x1cd/0x2a0 [ 261.565783][T10564] exc_invalid_op+0x17/0x50 [ 261.567171][T10564] asm_exc_invalid_op+0x1a/0x20 [ 261.568701][T10564] RIP: 0010:device_release+0x1dd/0x270 [ 261.570336][T10564] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8b 6b 50 48 85 ed 74 19 e8 1d 4d a1 fb 48 8d 3d 56 90 e7 0b 48 89 ee <67> 48 0f b9 3a e9 eb fe ff ff e8 04 4d a1 fb 48 89 da 48 b8 00 00 [ 261.576029][T10564] RSP: 0018:ffffc90003867a20 EFLAGS: 00010287 [ 261.577866][T10564] RAX: 0000000000004712 RBX: ffff88801534f020 RCX: ffffc90024101000 [ 261.580209][T10564] RDX: 0000000000080000 RSI: ffff88805c817220 RDI: ffffffff9251e6d0 [ 261.582561][T10564] RBP: ffff88805c817220 R08: 0000000000000001 R09: 0000000000000000 [ 261.584941][T10564] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88802587d000 [ 261.587250][T10564] R13: dffffc0000000000 R14: ffff88805c817220 R15: 0000000000000000 [ 261.589573][T10564] kobject_put+0x1f7/0x640 [ 261.590948][T10564] device_unregister+0x2f/0xe0 [ 261.592445][T10564] i2c_unregister_device+0xf5/0x270 [ 261.594040][T10564] i2c_deregister_clients+0x255/0x460 [ 261.595685][T10564] i2c_del_adapter+0x13a/0x2e0 [ 261.597134][T10564] i801_remove+0xa4/0x3d0 [ 261.598465][T10564] pci_device_remove+0xb2/0x1d0 [ 261.599966][T10564] ? __pfx_pci_device_remove+0x10/0x10 [ 261.601603][T10564] device_remove+0xcb/0x180 [ 261.603027][T10564] device_release_driver_internal+0x44e/0x620 [ 261.604830][T10564] unbind_store+0xf8/0x110 [ 261.606076][T10564] ? __pfx_unbind_store+0x10/0x10 [ 261.607583][T10564] drv_attr_store+0x74/0xb0 [ 261.608973][T10564] ? __pfx_drv_attr_store+0x10/0x10 [ 261.610587][T10564] sysfs_kf_write+0xf2/0x150 [ 261.612359][T10564] kernfs_fop_write_iter+0x3e0/0x5f0 [ 261.614336][T10564] ? __pfx_sysfs_kf_write+0x10/0x10 [ 261.616034][T10564] vfs_write+0x6af/0x1050 [ 261.617352][T10564] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 261.619080][T10564] ? __pfx_vfs_write+0x10/0x10 [ 261.620528][T10564] ? find_held_lock+0x2b/0x80 [ 261.621943][T10564] ksys_write+0x12a/0x250 [ 261.623301][T10564] ? __pfx_ksys_write+0x10/0x10 [ 261.624790][T10564] __do_fast_syscall_32+0x13a/0x8b0 [ 261.626392][T10564] do_fast_syscall_32+0x32/0x70 [ 261.627876][T10564] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 261.629772][T10564] RIP: 0023:0xf73fefec [ 261.631026][T10564] Code: Unable to access opcode bytes at 0xf73fefc2. [ 261.633045][T10564] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 261.635695][T10564] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800003c0 [ 261.638671][T10564] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 261.641370][T10564] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 261.643732][T10564] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 261.646036][T10564] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 261.648330][T10564] [ 261.650291][T10564] Kernel Offset: disabled [ 261.651586][T10564] Rebooting in 86400 seconds..