last executing test programs: 1h56m44.327154809s ago: executing program 0 (id=703): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000080)={'macvlan1\x00', @random="a6ffe6815a3c"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000002c0)={'macvlan1\x00', @multicast}) 1h56m38.188519237s ago: executing program 0 (id=704): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r0, 0x603, 0x70bd32, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x32}]}, 0x28}}, 0x10) 1h56m35.215826256s ago: executing program 0 (id=706): r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f00000001c0)=0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x37, 0x7fffffff}]}) close_range(r1, 0xffffffffffffffff, 0x0) 1h56m29.343839849s ago: executing program 0 (id=708): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2901090, 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') mount(0x0, &(0x7f0000000d40)='./file0/../file0/../file0\x00', &(0x7f0000000040)='devpts\x00', 0x0, 0x0) 1h56m21.650721725s ago: executing program 0 (id=710): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000e, 0x204031, 0xffffffffffffffff, 0xd0c6f000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xe, &(0x7f0000000040)={0x0, 0x0}) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) 1h56m17.914943647s ago: executing program 0 (id=712): r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x580, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000000)=0x3) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000009, 0x8012, r0, 0x0) read(r0, 0x0, 0x0) 1h56m0.481818265s ago: executing program 32 (id=712): r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x580, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000000)=0x3) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000009, 0x8012, r0, 0x0) read(r0, 0x0, 0x0) 30m20.875506869s ago: executing program 1 (id=1737): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000000340)={'ip6_vti0\x00', &(0x7f0000000140)=@ethtool_cmd={0x0, 0x80000000, 0xffffffff, 0x9, 0xf, 0x3, 0x3, 0xfc, 0x0, 0xff, 0x0, 0x0, 0x6, 0xff, 0x0, 0x5}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000340)={'tunl0\x00', 0x0}) 30m8.583827727s ago: executing program 1 (id=1739): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180200000004000000000000000000008500000036000000850000000700000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r2, r1, 0x25, 0x0, @val=@tracing}, 0x40) syz_emit_ethernet(0x11dc0, &(0x7f0000002480)=ANY=[], 0x0) 30m2.988943514s ago: executing program 1 (id=1741): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000080)=0x21e6, 0x4) sendmmsg$inet(r0, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x4000800) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x40, &(0x7f0000000140)=0x10, 0x4) recvfrom(r0, 0x0, 0x0, 0x2101, 0x0, 0x0) 29m56.692892001s ago: executing program 1 (id=1742): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='hugetlbfs\x00', 0x0, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) mount$fuseblk(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x24000, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x1a8584c, 0x0) 29m50.867645312s ago: executing program 1 (id=1745): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) write$uinput_user_dev(r0, &(0x7f0000000980)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3cc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81], [0x0, 0x0, 0x0, 0x9, 0x0, 0x7, 0x0, 0xffffffff, 0x4, 0x0, 0x2, 0x53650, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa267, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x55f8, 0x0, 0x0, 0x4, 0x3], [0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff], [0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6311, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0xb, 0x8, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) write$uinput_user_dev(r0, &(0x7f0000000080)={'syz1\x00', {0x4, 0x8, 0x4e3, 0xa}, 0x14, [0x1, 0x3, 0x5, 0x2, 0x6, 0x80000001, 0x3, 0x7, 0x5, 0x80000001, 0x1, 0x71, 0x5, 0x5, 0xfffffffc, 0x6777, 0x10, 0x7f, 0x5, 0x5, 0xfffffffe, 0x100, 0x4, 0x5, 0x7fffffff, 0x9, 0x8, 0x4, 0x8, 0x3, 0x3ff, 0x8a, 0xdfcd0de8, 0x8001, 0x8, 0xb, 0x4, 0x7ff, 0xf4, 0x5, 0x6, 0x2, 0x81, 0xffffffff, 0xfffffffd, 0x9, 0x8, 0x0, 0x7, 0x400, 0x4, 0x8001, 0x10, 0x7b, 0xe, 0x1, 0x10000, 0x516, 0x401, 0xc, 0x9, 0x5, 0x8, 0x8], [0x2, 0xbb36, 0x4, 0x6, 0xfffffc01, 0xbe, 0x0, 0x8, 0x48b87227, 0xf, 0x7, 0x8, 0x6, 0x6, 0xfb0, 0x8, 0x7ff, 0x2, 0x40, 0x498, 0x0, 0x7, 0x10f7, 0x8, 0x8, 0x7, 0x7, 0x9, 0x8, 0x7, 0x2, 0x8, 0x101, 0x5, 0x10, 0x1, 0x7, 0x5, 0xe, 0x100, 0x8, 0x0, 0x51b24be0, 0x5124, 0x8, 0x9, 0x7, 0x0, 0x2, 0x6, 0x5c, 0x859, 0x8, 0x1, 0x4, 0x4, 0x6, 0x5, 0x0, 0x200, 0x4, 0x40, 0x40, 0xc00000], [0xb, 0xb, 0xfffffff8, 0x1, 0x38be, 0x3, 0x5, 0x7, 0x8, 0x5, 0x1, 0x7f, 0x1, 0xa27, 0x3, 0x40, 0x4000000, 0x5, 0xf5c, 0x5, 0x8, 0x0, 0x1, 0xf, 0x7, 0x4, 0x7fffffff, 0x2, 0xb, 0x8, 0x401, 0x0, 0x4, 0x9, 0x6, 0x0, 0x1dfe08e7, 0x400, 0x1000, 0x2fa, 0x4, 0x815c, 0xc08a, 0x4, 0x817, 0x6, 0x4d, 0x10000, 0x1, 0x1304, 0x3dad, 0x800, 0x4, 0x1, 0x7e3, 0x3ff, 0x5, 0x1, 0x7fff, 0x3, 0x1, 0x6, 0x4, 0x7], [0x0, 0xd, 0x10, 0x5, 0x9e2, 0x3, 0xb, 0x9, 0x4, 0x4, 0xfffffff8, 0x2, 0xf, 0x401, 0x9, 0x1, 0x2, 0xffffff81, 0x8, 0xffff, 0xffff, 0x7, 0x0, 0x2, 0x4, 0x1, 0x4, 0x10, 0xf4b, 0x9, 0x1, 0x400, 0x1ff, 0x6ba, 0x9, 0x4, 0x9, 0x1, 0x48000, 0x5, 0x6, 0x8c, 0x1a, 0x80, 0x1, 0x9, 0xfffffff7, 0x7, 0x7, 0x2f65856a, 0x1, 0x4, 0x7, 0x6, 0x9, 0xd, 0xffffffff, 0xe, 0x7fffffff, 0x7f, 0x19, 0x9, 0x0, 0x9]}, 0x45c) 29m41.38211895s ago: executing program 1 (id=1746): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000240)="d3", 0x1, 0x8004881, 0x0, 0x0) recvmmsg(r0, &(0x7f0000003540)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)=""/85, 0x55}], 0x1}}], 0x1, 0x1, 0x0) 29m29.053562879s ago: executing program 33 (id=1746): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000240)="d3", 0x1, 0x8004881, 0x0, 0x0) recvmmsg(r0, &(0x7f0000003540)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)=""/85, 0x55}], 0x1}}], 0x1, 0x1, 0x0) 1m19.256213963s ago: executing program 2 (id=1986): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500f0e66f1500000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaaaaaabb000008000300030000000a000400aaaaaaaab1aa000008000500", @ANYRES32=r1], 0x68}, 0x1, 0x0, 0x0, 0x4010}, 0x28008000) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, 0x0, 0x0) 1m15.496614267s ago: executing program 3 (id=1987): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000580)={0x24, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="002201"], 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffff75, &(0x7f00000002c0)="b9425b44651dd23241963599000000110000004a16941ff5f4b4f1f0add7fcf2b877fceafffffffffff1ffdf4cd9f5d3969890522c77157d88010000003a5bd5531d459dffff03000000000091ff000000e8f5b3371da3635b8b4fa637135800001f65e4b436aa9e50bc0f19b7d3372ff9ebcede1fb5e9428f54d5d1f0cc752cf246a5d2da34a5aa97dc14a469c3dd3e26b41c356484e46fd66e3f2c7807e8773eed7b94fa099ab84feadec2ea95f65bba452eae5b0900f98a979a88c517a2dc360a00237723e2f467af706ea17226296b3a10a351cb47aba2c6b836c90679b4dd859ddc9e4800448aab0000000000000d75f34bb50d8d7084") 1m4.116535926s ago: executing program 2 (id=1988): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000080)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f00000000c0)={0xfffffffffffffffc, 0x0, 0x0, 0x80000001, 0x2, 0x2, 0x0, 0x6, 0x7fffffff}) 55.422767842s ago: executing program 3 (id=1989): r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f00000008c0)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x1}}, {{0xa, 0x0, 0x7, @initdev={0xfe, 0x88, '\x00', 0x3, 0x0}, 0xfffffff8}}}, 0x108) 44.73669918s ago: executing program 2 (id=1990): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_QUOTA_FLAGS={0x8}, @NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="44000000190a0102"], 0x44}}, 0x0) 41.75230834s ago: executing program 3 (id=1991): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = syz_io_uring_setup(0xa0, &(0x7f00000002c0)={0x0, 0x305cc6, 0x1, 0x800004, 0x20a}, &(0x7f0000000380)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x12}) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) 32.966743781s ago: executing program 2 (id=1992): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x3, 0x3, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="2cfea3ae8d80b893d368e00c3c55c21622af0fdb311890eb8b687921ae0bb62db49f4e9256d3d855a052226015d5c66588323cc1f371cf09eea14b30fb26a38aed338b120fadc0c2f2fc69a5929f", 0x4e}, {&(0x7f00000011c0)="79f075ef35f766b765e816a470ccec8af4fb13a0d8ca9a19591dadfdc1e57eca170306467ef4aac6ad2b8a86bcc35657e5df2be848d6a3c32586752ecdbe4f43dcdf1c3aed9f315972978a30d87a72af4ee591c6b94c779c7fde79c14e9d55ddb0cc298b8bf99b4876558642b40006ffd8d2f8888a78cb69f146bb75ab94b854a6e4787e369a56544bb4197ae9b653f4592f9b40491eb11c2ea5a15d0b1777ddcb7377747909cc93847876c2651de428c60130a9afeb5a27bac18a5e398b8a293bbf0e3c23802ea940d8cc0fa1e09ca58a75e4eff5062a779db8ce98e71fab70e77540e2a51a3b13a47357541d55dd45d0fbab6b5e1fd56254823c8bb0630f83ac5386f851dbb3f6751684578015e3025e3a6aaa9d448fd2a7cce614f68d63f520bdca97466f8ee0b2253f8baf295de381cbd53042546f27fb326b6b1ea7e6cfeb54361789195b6f223c0137c08c19bfa7dd70ebd705b459767f2a7a5b34589706988022c777ee0fb0c836cdfeb9e94a1e22112442198dcb3199a0665df14080c0c6a91b964bd4d17ea5b8324d14e32191838fd59cef79d2b5ad0769ba260a006814670630eae72ea25f3ce061fd021c7d777287a1133556341e1e8c775f60fc060228e8b813972b11dc7493371da17ecc14e4f2b96693a74e83065a71732374a5fa1c5cec29cb82bbae294f037d2085b4165b4b737c729b17b192ad98efe4eec7458ab4877cea6fd434da9eed574082b363ce4a168edc878aa6f6b1ee1366ae61f25d82739a948a876cb9fd0869a8a79bd495d5c2bf9b577e1ecdde20d8da414635f15bc5db0b8c25913f698897ad5bc0382024e1fc98a26fae555f9ab97d6ac00540a1de42039879367027f91af04b6a50febefe69396be8bbfc3bbd31e09e92b3e5387b2ed13fdb7349fbb0a36da36f352a8773d4a61d079727d58a975d365dbac555a8154acabc37fd4b46994245ed0846c078c87517071dd1ec2e46a4c8d6caee0f067f8cf7a5d273fc3d4489eb88009e715e0d99dae012e3746b0a16290844df4ee300210853e33c5a0056eba1aa3f5170a8a142456c71011ea8331860cfd2c7777a181dcfa62e296f790b665868d1111e38fff2add5f1180265ee88e9329ebdf605d8183bc016311fedad22a2d2e22007c34b66a32c68095f877e4e989da2fe0d727b8d343f9ec93ec59619bde76070040039325faa7b6e853a834319badf8ba61c32d74c99e4c4d9b61bcf606d1f40ab4b7c87926a2103573befa754408a0ec85644d8c74c9ae03cc66d5b3e81137fba68be834167d6a5b567cf4a54725a89619efded028c29d4290d4a2377f5059735407f1bff2333b727c5a1ce9bddf4a1c6e340406327b7e507b92d007913f4ecff3348991ac2d66b14629a35ca6c48c6478cf5596eab5eb79ca6b81ff94b9ac76f2380ef9ab55a4df6800b5753b51145815b8fd0e4a5a951631bab4f96d7415a698bb06f52eec5bba1cfd9086d5b91b9c931d02b038a49845020076c54fd1791775c987f67bfc770a3921022c79cee3e0d308ece215155b80cdca70302aff8ed7289e516a5e5d14b612daa84e1027114f880eba9079385195bdd7a05f67d892aa135f9ba62f38f96b2ec1cc93152caa2b445e0060eff241e0cc1e4974228d660d088f19c57e51a790115a1aea173736f4595734ba8d2a6402d4c152a0b8c927e6a5d37a05db0e1886fe38ab5e47d36a6767844189436945ab042b5ec39ecdbb29f2f1cac281e24f3a33999cb932cf92c682d0488748d0cd21cb7cf3da4ff97d03a1c33126006d334413304ef7cb410ef6f856e4aacd1b3a59490c351455cfbd2be4ad0a6d701769580aaab742561c65060e818a7152461c1f9e558c5906dfa0218d7cbaa0b156dbef05a36307598dd6575777ea0d24bfc4503fa7db2cd06ed5fe7ae72d43b935374603ff508d2d57670678ba7b5bdd40f40c56d9403edb213904df773987ef8ac887f4a656438953a7f2f794e357b7824ae84600ebe9b1373d265ffac8432760883a68b0f7d34e527e3d34b1525dbf5af593f972e5e9501e378707fc7d3f523412c7ab08f2ee5eb17399b9d3584394275ba3e8ab2ea2204bde1f1f2ffd783b539ec95a0e9092dc4faa408e308e4f8c3fe60ba1094d84da7acb39526b045ef4a33c13aeb0224b0fe88f86e380a359e8adafd418c577ce4814b4630efa06d6edf89db6a355e5f2e39fdc2b5fe8a33cd8fe77e4eadaa24881a4ec583a981336aec907523931a2231d934418e0d30395669cc0965a87a307c0f604c89f66718562d99f2a37d51d167df4c6fba767e5779e4e5b6900c8f8cdf142fe0fb17faf9a38290b0109e75015e7e6cdcc11e237622c87dfca886b6b9624f27b1dcc7f9b6f443e9c7409583d65b8a518002f4ceced6882e15604e8f122c2dd3996db862bb0bac4111870f600716dcf85b28ce677b3d9d09f5b686ab6e15b96e95589777c8d927a75b53e33deca67127d2f90dd7a7d446ad7a382c310324cb2cf9805fc9123cff755bbf354bc017f24909725918968a600e4f160db0437df356a6d968e680124ae0cc413cf91a28c2be750834a30339391d2022974c09eb9cf1d2aab351f2828bb8e8793e518147b6f38831f6c177bfac2df3d1bf22c9a96e5ec22091402a9d0e3d6a98f7e48dffd0d1f74114ea09d22d8367ce962e63b10aba8b1d5558f07a66603b80b5eea66490c914bf101d054489966863066e598084b48dc92e8c90866d57dfb72b513fb59d295a68cc01f0655ac2be4750dc49e9392e75", 0x7b3}], 0x2, 0x0, 0x0, 0x2c}, 0x4000884) 23.251506965s ago: executing program 3 (id=1993): socket$nl_generic(0x10, 0x3, 0x10) r0 = mq_open(&(0x7f0000000380)='&\x00w\xb4N6Bf\xa9\xc2\xd0\b\x06L\xbbQ\xd6T\xe3+SD\xa8\x0f\xefwHw\xdab\xc4\x1a\xe55@hA5\xd6\xec.)\x8f}\xc5#L\x99\"\x84;{\xfa\x04~\xf1\x17\x1d\x90\x83\xfc\x1e\xae\xb0/(\xbb\xd3\xb7\xca\x13j\xab\xfa\xc5Mq\xb7ks\xe0 \x9d\xf8\x7f\x84b\xa4h\xeekc\xffZ\x9fg\x84lm\xd7F\x97\xdcd\v\x00\x00\x90\x03\x12^\xf2{\xf1\xbe\x12[~\xe7\xca\xe4\x13\xd6k\xa6\xf3v5F\xc9.\xce\x87z\xd4<\xa8\xba\xd0\x9c\ff\xe1\xe2\xf9\x18\xc0\xd0\xa1\x02K\xdd] dump_backtrace+0x2e/0x3c [ 2740.609092][ T5563] [] show_stack+0x30/0x3c [ 2740.609673][ T5563] [] dump_stack_lvl+0x114/0x1ac [ 2740.610505][ T5563] [] dump_stack+0x1c/0x28 [ 2740.611339][ T5563] [] warn_alloc+0x188/0x2a4 [ 2740.612001][ T5563] [] __vmalloc_node_range_noprof+0x14fc/0x18e8 [ 2740.612503][ T5563] [] __kvmalloc_node_noprof+0x3fa/0xb60 [ 2740.612946][ T5563] [] drm_property_create_blob+0x7a/0x2f8 [ 2740.613374][ T5563] [] drm_mode_createblob_ioctl+0xf4/0x3d8 [ 2740.613810][ T5563] [] drm_ioctl_kernel+0x1de/0x370 [ 2740.614321][ T5563] [] drm_ioctl+0x4e6/0xb98 [ 2740.615149][ T5563] [] __riscv_sys_ioctl+0x17c/0x1e4 [ 2740.615551][ T5563] [] syscall_handler+0x92/0x114 [ 2740.615940][ T5563] [] do_trap_ecall_u+0x3d2/0x58c [ 2740.616392][ T5563] [] handle_exception+0x15e/0x16a [ 2740.713527][ T5563] Mem-Info: [ 2740.716191][ T5563] active_anon:3310 inactive_anon:0 isolated_anon:0 [ 2740.716191][ T5563] active_file:9217 inactive_file:35089 isolated_file:0 [ 2740.716191][ T5563] unevictable:768 dirty:27 writeback:0 [ 2740.716191][ T5563] slab_reclaimable:2617 slab_unreclaimable:26434 [ 2740.716191][ T5563] mapped:12529 shmem:807 pagetables:812 [ 2740.716191][ T5563] sec_pagetables:0 bounce:0 [ 2740.716191][ T5563] kernel_misc_reclaimable:0 [ 2740.716191][ T5563] free:212233 free_pcp:5626 free_cma:52672 [ 2740.809928][ T5563] Node 0 active_anon:13240kB inactive_anon:0kB active_file:36868kB inactive_file:140356kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:50116kB dirty:108kB writeback:0kB shmem:3228kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:6048kB pagetables:3248kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 2740.814848][ T5563] Node 0 DMA32 free:848932kB boost:0kB min:22528kB low:28160kB high:33792kB reserved_highatomic:0KB free_highatomic:0KB active_anon:13240kB inactive_anon:0kB active_file:36868kB inactive_file:140356kB unevictable:3072kB writepending:108kB zspages:0kB present:2097152kB managed:1427084kB mlocked:0kB bounce:0kB free_pcp:22520kB local_pcp:8524kB free_cma:210688kB [ 2740.911022][ T5563] lowmem_reserve[]: 0 0 0 [ 2740.915623][ T5563] Node 0 DMA32: 606*4kB (UME) 497*8kB (UME) 195*16kB (UME) 7*32kB (UE) 99*64kB (UME) 41*128kB (U) 32*256kB (UEC) 27*512kB (UMC) 15*1024kB (UC) 12*2048kB (UMC) 187*4096kB (UMC) = 849232kB [ 2741.076549][ T5563] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2741.152244][ T5563] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 2741.154688][ T5563] 45113 total pagecache pages [ 2741.156190][ T5563] 0 pages in swap cache [ 2741.180679][ T5563] Free swap = 124996kB [ 2741.182446][ T5563] Total swap = 124996kB [ 2741.184103][ T5563] 524288 pages RAM [ 2741.254278][ T5563] 0 pages HighMem/MovableOnly [ 2741.256111][ T5563] 167517 pages reserved [ 2741.305034][ T5563] 52736 pages cma reserved [ 2755.963214][ T5574] binder: 5573:5574 ioctl 541b 0 returned -22 [ 2777.614169][ T5595] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2777.616395][ T5595] IPv6: NLM_F_CREATE should be set when creating new route [ 2777.621360][ T5595] IPv6: NLM_F_CREATE should be set when creating new route [ 2777.622856][ T5595] IPv6: NLM_F_CREATE should be set when creating new route [ 2777.692164][ T5595] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2779.676796][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 2780.210745][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2780.212667][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2780.399160][ T9] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 2780.400767][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 2780.401938][ T9] usb 1-1: SerialNumber: syz [ 2782.504718][ T9] usb 1-1: 0:2 : does not exist [ 2783.280914][ T9] usb 1-1: USB disconnect, device number 5 [ 2820.063703][ T5440] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 2820.544385][ T5440] usb 2-1: Using ep0 maxpacket: 32 [ 2820.726760][ T5440] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 2820.746359][ T5440] usb 2-1: config 0 has no interface number 0 [ 2821.052459][ T5440] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 2821.055772][ T5440] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2821.069893][ T5440] usb 2-1: Product: syz [ 2821.072423][ T5440] usb 2-1: Manufacturer: syz [ 2821.073789][ T5440] usb 2-1: SerialNumber: syz [ 2821.373774][ T5440] usb 2-1: config 0 descriptor?? [ 2821.513815][ T5440] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 2823.366365][ C0] quatech-serial ttyUSB0: qt2_process_read_urb - xmit_empty message too short [ 2823.539441][ T5440] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 2823.776054][ C0] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 2824.012628][ T5440] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 2824.360959][ T5440] usb 2-1: USB disconnect, device number 4 [ 2825.150163][ T5440] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 2825.545609][ T5440] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 2825.674474][ T5440] quatech2 2-1:0.51: device disconnected [ 2883.813091][ T5705] netlink: 16255 bytes leftover after parsing attributes in process `syz.0.550'. [ 2920.226464][ T5728] input: syz0 as /devices/virtual/input/input8 [ 2962.423011][ C1] Illegal XDP return value 16128 on prog (id 68) dev veth0, expect packet loss! [ 2962.432340][ T5764] A link change request failed with some changes committed already. Interface wg0 may have been left with an inconsistent configuration, please check. [ 3068.234981][ T5829] netlink: 4 bytes leftover after parsing attributes in process `syz.1.601'. [ 3073.461303][ T5834] bond0: option lp_interval: invalid value (18446744073709551607) [ 3073.462907][ T5834] bond0: option lp_interval: allowed values 1 - 2147483647 [ 3094.835272][ T5844] binder: 5843:5844 ioctl 4018620d 0 returned -22 [ 3191.249135][ T5910] macvlan1: entered promiscuous mode [ 3191.254796][ T5910] macvlan1: entered allmulticast mode [ 3191.664967][ T5910] veth1_vlan: entered allmulticast mode [ 3201.171345][ T5915] input: syz0 as /devices/virtual/input/input9 [ 3245.985622][ T5944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.649'. [ 3273.671801][ T5966] input: syz0 as /devices/virtual/input/input10 [ 3276.313781][ T5972] netlink: 16 bytes leftover after parsing attributes in process `syz.1.659'. [ 3328.125480][ T6005] netlink: 9275 bytes leftover after parsing attributes in process `syz.0.671'. [ 3333.461822][ T5880] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 3333.740924][ T5880] usb 1-1: Using ep0 maxpacket: 8 [ 3333.991939][ T5880] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 3333.993999][ T5880] usb 1-1: config 179 has no interface number 0 [ 3333.995983][ T5880] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 3334.019932][ T5880] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 3334.022353][ T5880] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 3334.024365][ T5880] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 3334.026595][ T5880] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 3334.055557][ T5880] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 3334.066753][ T5880] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3334.813371][ T6009] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 3339.676513][ T4433] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input11 [ 3340.141381][ T4339] usb 1-1: USB disconnect, device number 6 [ 3340.149737][ C1] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 3340.151973][ C1] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 3341.831944][ T6029] netlink: 4 bytes leftover after parsing attributes in process `syz.1.674'. [ 3364.112414][ T4339] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 3364.613805][ T6048] veth1_to_team: entered promiscuous mode [ 3364.946032][ T4339] usb 1-1: Using ep0 maxpacket: 32 [ 3365.004068][ T6048] ip6gretap0: entered promiscuous mode [ 3365.066320][ T4339] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 3365.080838][ T4339] usb 1-1: config 0 has no interface number 0 [ 3365.135639][ T6048] hsr1: Slave A (veth1_to_team) is not up; please bring it up to get a fully working HSR network [ 3365.163224][ T6048] hsr1: entered promiscuous mode [ 3365.231368][ T4339] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 3365.235087][ T4339] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3365.248798][ T4339] usb 1-1: Product: syz [ 3365.250565][ T4339] usb 1-1: Manufacturer: syz [ 3365.252279][ T4339] usb 1-1: SerialNumber: syz [ 3365.605695][ T4339] usb 1-1: config 0 descriptor?? [ 3365.928996][ T4339] smsc95xx v2.0.0 [ 3369.515538][ T4339] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 3369.541330][ T4339] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 3369.581024][ T4339] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 3369.639353][ T4339] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 3369.994326][ T4339] usb 1-1: USB disconnect, device number 7 [ 3371.302988][ T6064] netlink: 20 bytes leftover after parsing attributes in process `syz.1.681'. [ 3371.304292][ T6064] netlink: 12 bytes leftover after parsing attributes in process `syz.1.681'. [ 3371.395152][ T6064] netlink: 20 bytes leftover after parsing attributes in process `syz.1.681'. [ 3371.408376][ T6064] netlink: 12 bytes leftover after parsing attributes in process `syz.1.681'. [ 3380.984157][ T6069] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 3415.511513][ T6094] netlink: 332 bytes leftover after parsing attributes in process `syz.0.695'. [ 3415.551885][ T6094] netlink: 196 bytes leftover after parsing attributes in process `syz.0.695'. [ 3422.982574][ T6101] binder: 6100:6101 ioctl c018620c 200000000000 returned -1 [ 3432.529383][ T6111] macvlan1: entered promiscuous mode [ 3432.535031][ T6111] macvlan1: entered allmulticast mode [ 3433.084342][ T6111] veth1_vlan: entered allmulticast mode [ 3458.552399][ T5985] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3460.855645][ T5985] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3462.931419][ T5985] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3464.712354][ T5985] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3467.207218][ T6133] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.713'. [ 3481.697242][ T5985] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3481.895511][ T5985] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3482.214465][ T5985] bond0 (unregistering): Released all slaves [ 3484.374915][ T5985] hsr_slave_0: left promiscuous mode [ 3484.506874][ T5985] hsr_slave_1: left promiscuous mode [ 3485.281011][ T5985] veth1_macvtap: left promiscuous mode [ 3485.284875][ T5985] veth0_macvtap: left promiscuous mode [ 3485.303253][ T5985] veth1_vlan: left allmulticast mode [ 3485.316942][ T5985] veth1_vlan: left promiscuous mode [ 3485.359681][ T5985] veth0_vlan: left promiscuous mode [ 3566.072680][ T5994] bond0: (slave bond_slave_0): interface is now down [ 3566.076659][ T5994] bond0: (slave bond_slave_1): interface is now down [ 3566.082155][ T6273] bond0: Removing last ns target with arp_interval on [ 3566.164654][ T50] bond0: (slave bond_slave_0): interface is now down [ 3566.171900][ T50] bond0: (slave bond_slave_1): interface is now down [ 3566.201969][ T50] bond0: now running without any active interface! [ 3578.504392][ T6156] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3578.695054][ T6156] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3611.286517][ T6156] hsr_slave_0: entered promiscuous mode [ 3611.354019][ T6156] hsr_slave_1: entered promiscuous mode [ 3611.406898][ T6156] debugfs: 'hsr0' already exists in 'hsr' [ 3611.429935][ T6156] Cannot create hsr debugfs directory [ 3633.061535][ T6156] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 3633.286521][ T6156] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 3633.945172][ T6156] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 3634.344345][ T6156] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 3669.797334][ T6156] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3753.429524][ T6156] veth0_vlan: entered promiscuous mode [ 3753.843394][ T6156] veth1_vlan: entered promiscuous mode [ 3755.800896][ T6156] veth0_macvtap: entered promiscuous mode [ 3756.126184][ T6156] veth1_macvtap: entered promiscuous mode [ 3758.033414][ T6160] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3758.112112][ T6160] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3758.115022][ T6160] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3758.117373][ T6160] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3808.584226][ T6604] netem: change failed [ 3810.213789][ T6606] netlink: 16 bytes leftover after parsing attributes in process `syz.1.747'. [ 3814.154409][ T6608] netlink: 76 bytes leftover after parsing attributes in process `syz.2.748'. [ 3883.871398][ T6651] can0: slcan on ttyS3. [ 3885.424929][ T6655] can0 (unregistered): slcan off ttyS3. [ 3887.564351][ T6660] netlink: 36 bytes leftover after parsing attributes in process `syz.1.768'. [ 3927.934844][ T6666] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 3928.106917][ T6666] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 4003.670293][ T6737] faux_driver vgem: [drm] Unknown color mode 13; guessing buffer size. [ 4014.071033][ T6741] netlink: 11 bytes leftover after parsing attributes in process `syz.1.793'. [ 4014.072670][ T6741] netlink: 24 bytes leftover after parsing attributes in process `syz.1.793'. [ 4014.074302][ T6741] netlink: 24 bytes leftover after parsing attributes in process `syz.1.793'. [ 4108.973056][ T6793] netlink: 4 bytes leftover after parsing attributes in process `syz.1.812'. [ 4141.753315][ T6809] IPv6: NLM_F_CREATE should be specified when creating new route [ 4184.612627][ T6824] netlink: 292 bytes leftover after parsing attributes in process `syz.2.825'. [ 4258.275834][ T6872] netlink: 8 bytes leftover after parsing attributes in process `syz.2.841'. [ 4307.612472][ T6901] capability: warning: `syz.1.852' uses 32-bit capabilities (legacy support in use) [ 4316.089708][ T6904] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 4316.175898][ T6904] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 4341.846340][ T6915] bond0: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 4475.683049][ T6989] netlink: 36 bytes leftover after parsing attributes in process `syz.1.889'. [ 4526.049475][ T7015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 4526.117070][ T7015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 4530.563715][ T7026] netlink: 20 bytes leftover after parsing attributes in process `syz.1.900'. [ 4535.240106][ T7019] bond1: entered promiscuous mode [ 4582.273596][ T7078] syz.1.909 uses obsolete (PF_INET,SOCK_PACKET) [ 4790.455613][ T7197] netlink: 'syz.1.958': attribute type 1 has an invalid length. [ 4790.480042][ T7197] netlink: 'syz.1.958': attribute type 2 has an invalid length. [ 4921.612236][ T7275] netlink: 16 bytes leftover after parsing attributes in process `syz.1.988'. [ 4921.834319][ T7275] netlink: 12 bytes leftover after parsing attributes in process `syz.1.988'. [ 4921.837223][ T7275] netlink: 12 bytes leftover after parsing attributes in process `syz.1.988'. [ 4968.302474][ T7306] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1000'. [ 4968.304992][ T7306] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1000'. [ 4976.482565][ T7311] tmpfs: Cannot retroactively limit size [ 5004.245539][ T7325] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1009'. [ 5004.401728][ T7325] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1009'. [ 5016.806731][ T7332] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1012'. [ 5016.835276][ T7332] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 5177.944345][ T7356] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 5178.301246][ T7356] usb 2-1: Using ep0 maxpacket: 8 [ 5178.442253][ T7356] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 5178.582720][ T7356] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 5178.584513][ T7356] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 5178.585916][ T7356] usb 2-1: Product: syz [ 5178.587060][ T7356] usb 2-1: Manufacturer: syz [ 5178.633840][ T7356] usb 2-1: SerialNumber: syz [ 5179.272000][ T7356] usb 2-1: config 0 descriptor?? [ 5186.042088][ T6577] usb 2-1: USB disconnect, device number 5 [ 5247.865856][ T7461] block nbd2: NBD_DISCONNECT [ 5328.861671][ T7511] pim6reg: entered allmulticast mode [ 5329.311159][ T7513] pim6reg: left allmulticast mode [ 5348.313091][ T7528] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1080'. [ 5366.515145][ T7539] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 5366.646256][ T7539] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 5519.469820][ T31] audit: type=1400 audit(5773.899:4): apparmor="DENIED" operation="stack" class="file" info="label not found" error=-2 profile="unconfined" name=26260A3A636173747C6279746573202020207061636B65747320657272732064726F70206669666F20636F6C6C73206361727269657220636F6D707265737365640A202020206C6F3A202031353030303420202020313831392020202030202020203020202020302020202020302020202020202020202030202020202020202020302020203135303030342020202031383139202020203020202020302020202030202020202030202020202020203020202020202020202020300A2074756E6C303A20202020202020302020202020202030202020203020202020302020202030202020202030 pid=7622 comm="syz.2.1118" [ 5526.306171][ T7627] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 5526.336348][ T7627] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1119'. [ 5775.934305][ T7753] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1166'. [ 5791.332304][ T7760] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1169'. [ 5791.702655][ T7760] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1169'. [ 5862.646432][ T7792] netlink: 'syz.2.1185': attribute type 6 has an invalid length. [ 5863.976676][ T7794] input: syz0 as /devices/virtual/input/input14 [ 5887.335769][ T7810] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 5887.338990][ T7810] IPv6: NLM_F_CREATE should be set when creating new route [ 5947.830519][ T7854] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1207'. [ 6008.281514][ T7900] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1224'. [ 6023.591597][ T7914] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1230'. [ 6023.593072][ T7914] netlink: 'syz.2.1230': attribute type 5 has an invalid length. [ 6039.081319][ T7922] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 6109.260454][ T7966] input: syz1 as /devices/virtual/input/input15 [ 6193.817456][ T8006] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1267'. [ 6335.474440][ T31] audit: type=1326 audit(6589.909:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8074 comm="syz.2.1297" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff86d33282 code=0x7ffc0000 [ 6335.564378][ T31] audit: type=1326 audit(6589.949:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8074 comm="syz.2.1297" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff86d33282 code=0x7ffc0000 [ 6335.906455][ T31] audit: type=1326 audit(6590.349:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8074 comm="syz.2.1297" exe="/syz-executor" sig=0 arch=c00000f3 syscall=277 compat=0 ip=0x7fff86d33282 code=0x7ffc0000 [ 6335.992303][ T31] audit: type=1326 audit(6590.429:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8074 comm="syz.2.1297" exe="/syz-executor" sig=31 arch=c00000f3 syscall=98 compat=0 ip=0x7fff86d33282 code=0x0 [ 6389.079748][ T8100] dummy0: entered allmulticast mode [ 6392.421358][ T8102] input: syz1 as /devices/virtual/input/input16 [ 6428.600303][ T6577] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 6429.511578][ T6577] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 6429.514189][ T6577] usb 2-1: config 0 interface 0 has no altsetting 0 [ 6429.950817][ T6577] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 6429.952251][ T6577] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 6429.953330][ T6577] usb 2-1: Product: syz [ 6429.954200][ T6577] usb 2-1: Manufacturer: syz [ 6429.955219][ T6577] usb 2-1: SerialNumber: syz [ 6430.176264][ T6577] usb 2-1: config 0 descriptor?? [ 6431.712724][ T6577] usb 2-1: selecting invalid altsetting 0 [ 6439.431080][ T6991] usb 2-1: USB disconnect, device number 6 [ 6484.084777][ T8172] netlink: 284 bytes leftover after parsing attributes in process `syz.2.1323'. [ 6611.452972][ T8232] input: syz0 as /devices/virtual/input/input17 [ 6630.676768][ T8244] TCP: tcp_parse_options: Illegal window scaling value 255 > 14 received [ 6747.711590][ T8301] Invalid ELF header len 1 [ 6802.871619][ T8326] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1385'. [ 6983.059983][ T8407] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1418'. [ 6983.206860][ T8407] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1418'. [ 6990.315735][ T8411] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1420'. [ 6995.983441][ T8413] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1421'. [ 7007.675684][ T8419] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 7007.825208][ T8419] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 7027.676322][ T8430] block nbd1: shutting down sockets [ 7107.682086][ T8477] netpci0: tun_chr_ioctl cmd 1074025677 [ 7107.685077][ T8477] netpci0: linktype set to 6 [ 7215.292484][ T8535] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1470'. [ 7289.704260][ T8570] TCP: TCP_TX_DELAY enabled [ 7390.280603][ T8209] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 7391.509160][ T8209] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 7391.511674][ T8209] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 7391.770690][ T8209] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 7391.773230][ T8209] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 7391.775318][ T8209] usb 2-1: Product: syz [ 7391.776903][ T8209] usb 2-1: Manufacturer: syz [ 7391.810701][ T8209] usb 2-1: SerialNumber: syz [ 7392.345786][ T8209] usb 2-1: config 0 descriptor?? [ 7406.682039][ T6577] usb 2-1: USB disconnect, device number 7 [ 7454.514672][ T8663] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1515'. [ 7454.717194][ T8663] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1515'. [ 7477.659257][ T8675] loop0: Can't mount, would change RO state [ 7529.693793][ T8706] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1529'. [ 7561.042064][ T8727] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1536'. [ 7568.401525][ T8732] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1538'. [ 7568.405703][ T8732] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1538'. [ 7644.440818][ T8769] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 7675.111454][ T8782] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1560'. [ 7689.104976][ T8789] hub 1-0:1.0: USB hub found [ 7689.283626][ T8789] hub 1-0:1.0: 1 port detected [ 7760.636794][ T8816] netlink: 232 bytes leftover after parsing attributes in process `syz.1.1572'. [ 7760.651192][ T8816] netlink: 232 bytes leftover after parsing attributes in process `syz.1.1572'. [ 7763.585526][ T8818] ALSA: seq fatal error: cannot create timer (-22) [ 7774.561765][ T8826] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 7774.585773][ T8826] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 7903.026626][ T8889] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1600'. [ 7903.032588][ T8889] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1600'. [ 7977.593377][ T8928] netlink: 204 bytes leftover after parsing attributes in process `syz.1.1617'. [ 7977.595165][ T8928] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1617'. [ 7977.672522][ T8928] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1617'. [ 8006.850399][ T8310] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 8007.524888][ T8310] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 8007.531855][ T8310] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 8007.534207][ T8310] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 8007.537243][ T8310] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 8007.584106][ T8310] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 8008.002396][ T8310] usb 2-1: config 0 descriptor?? [ 8011.602882][ T8310] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 8011.604538][ T8310] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 8011.605923][ T8310] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 8011.607299][ T8310] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 8011.660488][ T8310] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 8011.662361][ T8310] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 8011.663505][ T8310] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 8011.665087][ T8310] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 8011.666975][ T8310] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 8011.685055][ T8310] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 8012.244612][ T8310] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 8014.853129][ T6991] usb 2-1: reset high-speed USB device number 8 using dummy_hcd [ 8017.085002][ T8209] usb 2-1: USB disconnect, device number 8 [ 8197.391189][ T9052] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1655'. [ 8197.393551][ T9052] netlink: 'syz.1.1655': attribute type 30 has an invalid length. [ 8198.287170][ T7334] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 8198.291104][ T7334] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 8198.296907][ T7334] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 8198.352274][ T8564] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 8198.494711][ T9055] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1655'. [ 8198.496224][ T9055] netlink: 'syz.1.1655': attribute type 30 has an invalid length. [ 8247.251971][ T9072] pim6reg1: entered promiscuous mode [ 8247.275681][ T9072] pim6reg1: entered allmulticast mode [ 8334.504957][ T9119] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1676'. [ 8370.392805][ T9138] batadv_slave_1: entered promiscuous mode [ 8370.572873][ T9137] batadv_slave_1: left promiscuous mode [ 8387.478470][ T9148] batadv_slave_0: entered promiscuous mode [ 8398.146637][ T9152] hub 1-0:1.0: USB hub found [ 8398.261943][ T9152] hub 1-0:1.0: 1 port detected [ 8435.074222][ T9184] input: syz0 as /devices/virtual/input/input18 [ 8454.503594][ T9199] ======================================================= [ 8454.503594][ T9199] WARNING: The mand mount option has been deprecated and [ 8454.503594][ T9199] and is ignored by this kernel. Remove the mand [ 8454.503594][ T9199] option from the mount to silence this warning. [ 8454.503594][ T9199] ======================================================= [ 8460.932793][ T9203] binder: 9202:9203 ioctl c0306201 2000000003c0 returned -14 [ 8491.851290][ T9219] veth0_to_bridge: entered promiscuous mode [ 8492.532948][ T9217] veth0_to_bridge: left promiscuous mode [ 8498.911423][ T9224] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 8498.915352][ T9224] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 8526.328760][ T9242] dummy0: entered promiscuous mode [ 8526.353003][ T9242] dummy0: left promiscuous mode [ 8577.883857][ T9263] input: syz0 as /devices/virtual/input/input19 [ 8636.723981][ T9308] netlink: 830 bytes leftover after parsing attributes in process `syz.2.1740'. [ 8725.641272][ T9329] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 8725.932019][ T9329] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 8750.763547][ T9329] hsr_slave_0: entered promiscuous mode [ 8750.793944][ T9329] hsr_slave_1: entered promiscuous mode [ 8750.813612][ T9329] debugfs: 'hsr0' already exists in 'hsr' [ 8750.814955][ T9329] Cannot create hsr debugfs directory [ 8762.284752][ T9329] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 8762.535837][ T9329] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 8762.881056][ T9329] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 8763.085281][ T9329] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 8783.131222][ T9329] 8021q: adding VLAN 0 to HW filter on device bond0 [ 8851.976555][ T9329] veth0_vlan: entered promiscuous mode [ 8852.895014][ T9329] veth1_vlan: entered promiscuous mode [ 8857.695924][ T9329] veth0_macvtap: entered promiscuous mode [ 8858.291181][ T9329] veth1_macvtap: entered promiscuous mode [ 8861.414197][ T7595] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 8861.426193][ T7595] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 8861.540028][ T8397] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 8861.542340][ T8397] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 8890.798282][ T9651] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 8890.801635][ T9651] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 8956.522685][ T9691] pim6reg1: entered promiscuous mode [ 8956.547340][ T9691] pim6reg1: entered allmulticast mode [ 8973.692039][ T9707] tmpfs: Invalid gid '0x00000000ffffffff' [ 9045.727134][ T9739] binder: 9738:9739 ioctl c0306201 0 returned -14 [ 9072.216668][ T9751] input: syz0 as /devices/virtual/input/input20 [ 9106.666281][ T9774] syzkaller1: entered promiscuous mode [ 9106.684573][ T9774] syzkaller1: entered allmulticast mode [ 9140.499601][ T9788] Dead loop on virtual device ip6_vti0, fix it urgently! [ 9140.566712][ T9788] Dead loop on virtual device ip6_vti0, fix it urgently! [ 9140.594038][ T9788] Dead loop on virtual device ip6_vti0, fix it urgently! [ 9140.641006][ T9788] Dead loop on virtual device ip6_vti0, fix it urgently! [ 9140.676981][ T9788] Dead loop on virtual device ip6_vti0, fix it urgently! [ 9140.716410][ T9788] Dead loop on virtual device ip6_vti0, fix it urgently! [ 9140.804369][ T9788] Dead loop on virtual device ip6_vti0, fix it urgently! [ 9141.049017][ T9788] Dead loop on virtual device ip6_vti0, fix it urgently! [ 9141.254567][ T9788] Dead loop on virtual device ip6_vti0, fix it urgently! [ 9141.579920][ T9788] Dead loop on virtual device ip6_vti0, fix it urgently! [ 9163.452825][ T31] audit: type=1804 audit(9418.879:9): pid=9798 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1800" name="/newroot/558/file1" dev="tmpfs" ino=2852 res=1 errno=0 [ 9280.535538][ T9850] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 9357.173624][ T9880] input: syz1 as /devices/virtual/input/input21 [ 9417.640483][ T9914] syzkaller1: entered promiscuous mode [ 9417.641943][ T9914] syzkaller1: entered allmulticast mode [ 9440.263004][ T9924] net_ratelimit: 3 callbacks suppressed [ 9440.263730][ T9924] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 9450.750912][ T9931] input: syz1 as /devices/virtual/input/input22 [ 9496.893011][ T9954] netlink: 7 bytes leftover after parsing attributes in process `syz.3.1851'. [ 9496.986719][ T9954] netlink: 7 bytes leftover after parsing attributes in process `syz.3.1851'. [ 9498.919042][ C0] vcan0: j1939_tp_rxtimer: 0xffffaf8036dc6800: rx timeout, send abort [ 9498.934903][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffffaf8036dc6800: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 9507.547153][ T9958] ªªªªªª: renamed from wg2 (while UP) [ 9524.119120][ T9963] GUP no longer grows the stack in syz.3.1856 (9963): 200000006000-20000000a000 (200000002000) [ 9524.134078][ T9963] CPU: 0 UID: 0 PID: 9963 Comm: syz.3.1856 Tainted: G L syzkaller #0 PREEMPT [ 9524.134583][ T9963] Tainted: [L]=SOFTLOCKUP [ 9524.134711][ T9963] Hardware name: riscv-virtio,qemu (DT) [ 9524.134848][ T9963] Call Trace: [ 9524.135032][ T9963] [] dump_backtrace+0x2e/0x3c [ 9524.135504][ T9963] [] show_stack+0x30/0x3c [ 9524.135817][ T9963] [] dump_stack_lvl+0x114/0x1ac [ 9524.136293][ T9963] [] dump_stack+0x1c/0x28 [ 9524.136835][ T9963] [] gup_vma_lookup+0x1e6/0x1fc [ 9524.137299][ T9963] [] __get_user_pages+0x17c/0x2e0c [ 9524.137664][ T9963] [] get_user_pages_remote+0x340/0xa7c [ 9524.137998][ T9963] [] __access_remote_vm+0x29c/0xb30 [ 9524.138459][ T9963] [] access_remote_vm+0x32/0x44 [ 9524.139007][ T9963] [] proc_pid_cmdline_read+0x474/0x798 [ 9524.139531][ T9963] [] vfs_readv+0x52e/0x730 [ 9524.140098][ T9963] [] do_preadv+0x1a6/0x258 [ 9524.140632][ T9963] [] __riscv_sys_preadv+0x88/0xc4 [ 9524.141228][ T9963] [] syscall_handler+0x92/0x114 [ 9524.141811][ T9963] [] do_trap_ecall_u+0x3d2/0x58c [ 9524.142505][ T9963] [] handle_exception+0x15e/0x16a [ 9619.013535][T10006] netlink: 276 bytes leftover after parsing attributes in process `syz.2.1872'. [ 9620.174976][T10006] netlink: 276 bytes leftover after parsing attributes in process `syz.2.1872'. [ 9748.290372][T10067] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1892'. [ 9781.325571][T10085] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1897'. [ 9796.975067][T10094] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 9797.533295][T10094] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 9798.135553][T10009] hid_parser_main: 28 callbacks suppressed [ 9798.136074][T10009] hid-generic 00A0:0006:0003.0003: unknown main item tag 0x0 [ 9798.191516][T10009] hid-generic 00A0:0006:0003.0003: unknown main item tag 0x0 [ 9798.193847][T10009] hid-generic 00A0:0006:0003.0003: unknown main item tag 0x0 [ 9798.196081][T10009] hid-generic 00A0:0006:0003.0003: unknown main item tag 0x0 [ 9798.251516][T10009] hid-generic 00A0:0006:0003.0003: unknown main item tag 0x0 [ 9798.253781][T10009] hid-generic 00A0:0006:0003.0003: unknown main item tag 0x0 [ 9798.255771][T10009] hid-generic 00A0:0006:0003.0003: unknown main item tag 0x0 [ 9798.273076][T10009] hid-generic 00A0:0006:0003.0003: unknown main item tag 0x0 [ 9798.274545][T10009] hid-generic 00A0:0006:0003.0003: unknown main item tag 0x0 [ 9798.276184][T10009] hid-generic 00A0:0006:0003.0003: unknown main item tag 0x0 [ 9798.433880][T10009] hid-generic 00A0:0006:0003.0003: hidraw0: HID v0.05 Device [syz1] on syz0 [ 9915.680119][T10154] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 9915.685053][T10154] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 9915.690099][T10154] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 9915.693589][T10154] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 9915.696912][T10154] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 9915.702009][T10154] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 9915.706103][T10154] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 9915.710962][T10154] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 9915.714138][T10154] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 9915.718429][T10154] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [10092.094285][T10227] comedi comedi3: comedi_test: 10 microvolt, 2046 microsecond waveform attached [10366.736519][T10358] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [10366.995693][T10358] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [10396.183849][T10371] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1990'. [10445.129508][ C0] ------------[ cut here ]------------ [10445.129901][ C0] kernel BUG at [] mm/page_table_check.c:142! [10445.131389][ C0] Kernel BUG [#1] [10445.131767][ C0] Modules linked in: [10445.132417][ C0] CPU: 0 UID: 0 PID: 10386 Comm: syz.2.1996 Tainted: G L syzkaller #0 PREEMPT [10445.133113][ C0] Tainted: [L]=SOFTLOCKUP [10445.133313][ C0] Hardware name: riscv-virtio,qemu (DT) [10445.133630][ C0] epc : __page_table_check_zero+0x396/0x544 [10445.134428][ C0] ra : __page_table_check_zero+0x396/0x544 [10445.135195][ C0] epc : ffffffff80bfdcce ra : ffffffff80bfdcce sp : ffff8f80043473e0 [10445.135606][ C0] gp : ffffffff89f9df20 tp : ffffaf801cbb1a80 t0 : ffff8f8004347380 [10445.136044][ C0] t1 : fffff5ef026a0809 t2 : 0000000000000000 s0 : ffff8f8004347450 [10445.136455][ C0] s1 : ffffaf8013504048 a0 : 0000000000000005 a1 : 0000000000000000 [10445.136901][ C0] a2 : 0000000000000002 a3 : ffffffff80bfdcce a4 : 0000000000000000 [10445.137296][ C0] a5 : ffffaf801cbb2a80 a6 : 0000000000000003 a7 : ffffaf801350404b [10445.137711][ C0] s2 : 0000000000000001 s3 : 0000000000000000 s4 : ffffaf8013504000 [10445.138150][ C0] s5 : dfffffff00000000 s6 : 00000000000b3400 s7 : 0000000000000200 [10445.138550][ C0] s8 : 0000000000000009 s9 : 0000000000007fff s10: fffffffef1416bb0 [10445.138983][ C0] s11: ffffffff8a0b5d80 t3 : 0000000000000001 t4 : fffff5ef026a0809 [10445.139380][ C0] t5 : fffff5ef026a080a t6 : 0000000000000002 ssp : 0000000000000000 [10445.139786][ C0] status: 0000000200000120 badaddr: ffffffff80bfdcce cause: 0000000000000003 [10445.140231][ C0] [] __page_table_check_zero+0x396/0x544 [10445.141035][ C0] [] free_unref_folios+0xa22/0x1dc8 [10445.141750][ C0] [] folios_put_refs+0x41c/0x61c [10445.142375][ C0] [] free_pages_and_swap_cache+0x29c/0x480 [10445.143029][ C0] [] __tlb_batch_free_encoded_pages+0xe4/0x25c [10445.143626][ C0] [] tlb_finish_mmu+0x188/0x824 [10445.144159][ C0] [] exit_mmap+0x396/0xca8 [10445.144637][ C0] [] __mmput+0x106/0x3d0 [10445.145363][ C0] [] mmput+0x74/0x88 [10445.146068][ C0] [] do_exit+0x792/0x2828 [10445.146710][ C0] [] __riscv_sys_exit+0x48/0x54 [10445.147426][ C0] [] syscall_handler+0x92/0x114 [10445.148091][ C0] [] do_trap_ecall_u+0x3d2/0x58c [10445.148869][ C0] [] handle_exception+0x15e/0x16a [10445.150478][ C0] Code: 7f80 8526 c0ef ec3f 8a2a b791 6097 ff90 80e7 7e60 (9002) 6097 [10445.151999][ C0] ---[ end trace 0000000000000000 ]--- [10445.153855][ C0] Kernel panic - not syncing: Fatal exception in interrupt [10445.154917][ C0] SMP: stopping secondary CPUs VM DIAGNOSIS: 13:50:52 Registers: info registers vcpu 0 CPU#0 V = 0 pc ffffffff81f5e52c mhartid 0000000000000000 mstatus 0000000a000001a0 hstatus 0000000200000000 vsstatus 0000000a00000000 mip 0000000000000220 mie 000000000000022a mideleg 0000000000001666 hideleg 0000000000000444 medeleg 0000000000f4b509 hedeleg 000000000000b10d mtvec 00000000800004f8 stvec ffffffff863bb4c0 vstvec 0000000000000000 mepc ffffffff80090e2e sepc ffffffff80bfdcce vsepc 0000000000000000 mcause 0000000000000009 scause 0000000000000003 vscause 0000000000000000 mtval 0000000000000000 stval ffffffff80bfdcce htval 0000000000000000 mtval2 0000000000000000 mscratch 0000000080049000 sscratch 0000000000000000 satp 90599000000afe36 x0/zero 0000000000000000 x1/ra ffffffff81f5e4fc x2/sp ffff8f8004346b60 x3/gp ffffffff89f9df20 x4/tp ffffaf801cbb1a80 x5/t0 552030203a555043 x6/t1 0000000000000001 x7/t2 49552030203a5550 x8/s0 ffff8f8004346ba0 x9/s1 0000000000000000 x10/a0 ffffffff9135abc8 x11/a1 000000000000001f x12/a2 0000000000000000 x13/a3 ffffffff81f5e4fc x14/a4 1ffffffff226b579 x15/a5 ffff8f800006b000 x16/a6 0000000000ff0100 x17/a7 0000000000000003 x18/s2 ffffffff9135ab80 x19/s3 0000000000000020 x20/s4 0000000000000000 x21/s5 0000000000000000 x22/s6 0000000000000000 x23/s7 ffffffff81f5e498 x24/s8 ffffffff9116a115 x25/s9 fffffffef226b57b x26/s10 0000000000000010 x27/s11 000000000000000a x28/t3 ffffffff81f7135c x29/t4 fffff1ef00868d5c x30/t5 fffff1ef00868d5d x31/t6 ffffffff9116a0b7 fcsr 0000000000000000 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000 info registers vcpu 1 CPU#1 V = 0 pc ffffffff800875e6 mhartid 0000000000000001 mstatus 0000000a000000a0 hstatus 0000000200000000 vsstatus 0000000a00000000 mip 0000000000000020 mie 000000000000022a mideleg 0000000000001666 hideleg 0000000000000444 medeleg 0000000000f4b509 hedeleg 000000000000b10d mtvec 00000000800004f8 stvec ffffffff863bb4c0 vstvec 0000000000000000 mepc 00007fffb96721a4 sepc 00007fffb96721a4 vsepc 0000000000000000 mcause 8000000000000003 scause 8000000000000001 vscause 0000000000000000 mtval 0000000000000000 stval 0000000000000000 htval 0000000000000000 mtval2 0000000000000000 mscratch 0000000080047000 sscratch 0000000000000000 satp 90c2a00000095af3 x0/zero 0000000000000000 x1/ra ffffffff800875e2 x2/sp ffff8f8000017e10 x3/gp ffffffff89f9df20 x4/tp ffffaf801d071a80 x5/t0 ffff8f8000010000 x6/t1 fffffffef1415538 x7/t2 000000000000002e x8/s0 ffff8f8000017e40 x9/s1 ffffffff8680cf28 x10/a0 0000000000000001 x11/a1 0000000000000004 x12/a2 0000000000000001 x13/a3 ffffffff800875e2 x14/a4 0000000000000000 x15/a5 ffffaf801d071a80 x16/a6 fffffffef1415539 x17/a7 0000000000000003 x18/s2 0000000000000001 x19/s3 ffffffff8665f000 x20/s4 ffffffff8008732c x21/s5 ffffaf8011e8c800 x22/s6 0000000000000000 x23/s7 0000000000000001 x24/s8 0000000000000007 x25/s9 ffffffff9136c6e8 x26/s10 ffffffff8686d460 x27/s11 0000000000000004 x28/t3 ffffffff87d89ca8 x29/t4 fffffffef1415538 x30/t5 fffffffef1415539 x31/t6 0000000000003a98 fcsr 0000000000000000 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000