last executing test programs: 3m48.126120218s ago: executing program 1 (id=21): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000000c0)) syz_genetlink_get_family_id$batadv(&(0x7f00000004c0), r0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="120100020000004032150d01000000000001090224000100000000090400000203000000092100000001229c0a090a81030000fb00009454dd7981ec24fea19f1c38878d69034ca7dd9e2ff316c9ff866d283e770d9ef224833af9bb49a2a244d6c996e9b9a74e6aeff23c581b8238c95441e7726a"], 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) ioctl$HIDIOCGRAWINFO(r1, 0x80084803, &(0x7f0000000640)=""/161) add_key$user(&(0x7f0000002100), &(0x7f0000002180)={'syz', 0x1}, &(0x7f00000021c0)='b', 0x1, 0xfffffffffffffffe) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r2, &(0x7f0000000000), 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000800040044000000088633f43b38001b0000000000"], 0x30}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000840)={r6, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) pread64(0xffffffffffffffff, 0x0, 0x0, 0x200) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bind$inet(r4, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={0x0, &(0x7f0000000300)=""/245, 0x0, 0xf5, 0x0, 0x100}, 0x28) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r2, 0xc00c642d, &(0x7f0000000240)={0x0, 0x21bccdd83b838d55, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SET_UNIQUE(r8, 0x40086410, &(0x7f0000000180)={0x6f, &(0x7f00000005c0)="95f813993b5ac5371bd27d5ae1fc38af1fcbe68ba5889b10a865d2c6563de13b235624e5b33e02afcd156220eb54e889cc469070e50e027915eabe75d057f91c71703a365a86bcb19db095cc5a044b1209ca50472e035013f8f49843b7d4cd3975b07b0b2ddfbe195a31dda26cd8d5"}) 3m46.047038016s ago: executing program 1 (id=28): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000700)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r2, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(r1, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e23, 0x8020000c, @loopback, 0xfffff803}, 0x1c) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = io_uring_setup(0x1b7b, 0x0) io_uring_enter(r3, 0x2219, 0x7725, 0x16, 0x0, 0x0) 3m44.900689084s ago: executing program 1 (id=31): r0 = socket$inet(0x2, 0x3, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x20000080) munmap(&(0x7f00002d2000/0x4000)=nil, 0x4000) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x4d, &(0x7f0000000100)}) close_range(r3, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x3, 'sh\x00', 0x1, 0x5, 0x6d}, 0x2c) r5 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x80800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, 0x0}], 0x1, 0x40800) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000002f00090027bd7000fddbdf250400000007000b00050000006a965e43c97d2242c3ea8c51aa03af6ab596b1d7786a47ebe5664a7c174736f9a8e364d2e835"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x20040004) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e20, 0x3, 'lc\x00', 0x1, 0x323b, 0x55}, {@remote, 0x4e27, 0x2000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0x10) sendto$inet(r0, &(0x7f0000000180)="cbd05508ab7edb4a58", 0xfdef, 0x800, &(0x7f0000000100)={0x2, 0x4e23, @multicast1}, 0x10) 3m43.010913255s ago: executing program 1 (id=33): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x1261}, [@IFLA_MASTER={0x8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x141) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='p:s/_ ./file0:0', 0xf) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = dup3(r0, 0xffffffffffffffff, 0x80000) setsockopt$TIPC_IMPORTANCE(r3, 0x10f, 0x7f, &(0x7f0000000040)=0x4, 0x4) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)=ANY=[@ANYBLOB="580000000306010800000000000000000a00000a0900020073797a30000000000900020073797a30000000000500017307fa2f49251b430073597a30000000000900020773797a300000000009e801007379000000000000"], 0x58}, 0x1, 0x0, 0x0, 0x4010}, 0xc804) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r4, 0x29, 0x36, &(0x7f0000000400)=ANY=[], 0x8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000b40)=@filter={'filter\x00', 0x4, 0x4, 0x3e4, 0xffffffff, 0xe4, 0x0, 0x254, 0xfeffffff, 0xffffffff, 0x31c, 0x31c, 0x31c, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffffff, 0xff000000, 0xff, 0xffffff00], [0xffffff00, 0xffffffff, 0xffffffff, 0xffffffff], 'rose0\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa4, 0xe4}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private2, @empty, [0x0, 0x0, 0xff000000], [0x0, 0x0, 0xff000000], 'sit0\x00', 'batadv_slave_1\x00', {}, {0xff}}, 0x0, 0x130, 0x170, 0x0, {}, [@common=@srh1={{0x8c}, {0x21, 0x12, 0xbe, 0x7, 0x5aa9, @ipv4={'\x00', '\xff\xff', @empty}, @loopback, @local, [0xff000000, 0xff000000, 0x0, 0x100], [0xffffff00, 0xff000000, 0xff], [0x0, 0xffffff, 0xffffff00, 0x7fffff7f], 0x3c80}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x2000010}}}}, {{@uncond, 0x0, 0xa4, 0xc8}, @REJECT={0x24}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x440) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="08000000040000000400000022bf000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fc41f2fdaa520431ffffff0400000000000000000000000000000000009245e464961ff94ac1474627"], 0x50) r6 = timerfd_create(0x9, 0x80000) timerfd_gettime(r6, &(0x7f0000000040)) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000240)='bridge0\x00', 0x10) write(r4, &(0x7f00000000c0)="8f2a0a65bd8c002b0304000e0580a7b6070d63e286a5cefe", 0x5ac) 3m41.596623408s ago: executing program 1 (id=36): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = fsopen(&(0x7f0000000500)='ramfs\x00', 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x0) socket(0x2b, 0x80801, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ptrace(0x4206, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e045f2d20"], 0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_io_uring_setup(0x34b8, 0x0, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_user_confirm_req={{0x33, 0xa}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}}}, 0xd) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x3, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f000000e0c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x74, 0x6, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8}, @NFTA_PAYLOAD_SREG={0x8}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x57}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_PAYLOAD_CSUM_FLAGS={0x8, 0x8, 0x1, 0x0, 0x1}, @NFTA_PAYLOAD_CSUM_TYPE={0x8, 0x6, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x9c}}, 0x4) r9 = dup(r7) r10 = openat$uinput(0xffffff9c, &(0x7f0000000240), 0x803, 0x0) ioctl$UI_SET_PROPBIT(r10, 0x4004556e, 0x14) syz_ublk_setup_queues(r9, r6, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2120, 0x280, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x2, 0x1ed}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x1, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 3m40.492868514s ago: executing program 1 (id=41): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r1 = socket(0x28, 0x5, 0x0) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r2, 0x10000008) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) recvfrom$inet_nvme(r1, 0x0, 0xfffffffffffffea6, 0x40000002, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) 3m40.397176243s ago: executing program 32 (id=41): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r1 = socket(0x28, 0x5, 0x0) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r2, 0x10000008) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) recvfrom$inet_nvme(r1, 0x0, 0xfffffffffffffea6, 0x40000002, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) 29.892930628s ago: executing program 3 (id=815): r0 = socket$inet(0x2, 0x3, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x20000080) munmap(&(0x7f00002d2000/0x4000)=nil, 0x4000) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x4d, &(0x7f0000000100)}) close_range(r3, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x3, 'sh\x00', 0x1, 0x5, 0x6d}, 0x2c) bind$alg(0xffffffffffffffff, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r5 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, 0x0}], 0x1, 0x40800) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000002f00090027bd7000fddbdf250400000007000b00050000006a965e43c97d2242c3ea8c51aa03af6ab596b1d7786a47ebe5664a7c174736f9a8e364d2e835"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x20040004) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e20, 0x3, 'lc\x00', 0x1, 0x323b, 0x55}, {@remote, 0x4e27, 0x2000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) sendto$inet(r0, &(0x7f0000000180)="cbd05508ab7edb4a58", 0xfdef, 0x800, &(0x7f0000000100)={0x2, 0x4e23, @multicast1}, 0x10) 28.915039424s ago: executing program 3 (id=817): bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f00000012c0), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc2c45512, &(0x7f0000000a00)={{0x5, 0x0, 0x0, 0x8000008, 'syz1\x00'}, 0x0, [0x0, 0x2, 0x39e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000240)=0xc) setreuid(r3, 0x0) setreuid(0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha384\x00'}, 0x58) bind$netlink(0xffffffffffffffff, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x40}, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYRES64], 0x7c}, 0x1, 0x0, 0x0, 0x20008814}, 0x0) ioctl$vim2m_VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) recvmmsg(r4, &(0x7f0000007700), 0x318, 0xfc0, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000a80), r5) sendmsg$NFC_CMD_DISABLE_SE(r5, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="1a0025bd7000fbbfc9251200010000000000", @ANYRES32=0x0, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x40001}, 0x4000080) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x800000, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file0\x00', 0x1842, 0x136) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x8, &(0x7f00000002c0)=ANY=[@ANYBLOB="180800000000000400000000000000008510000003000000180000000000000000000000000000009500000000000000bfa000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x3, 0x0, 0x0, 0xb6df4c32c1d5c814}, 0x94) 28.034980726s ago: executing program 3 (id=821): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@newqdisc={0x2c, 0x24, 0x400, 0x1, 0x25dfcbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x9}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x3d}]}, 0x2c}, 0x1, 0x0, 0x0, 0x30044041}, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) 27.860766325s ago: executing program 3 (id=825): r0 = creat(&(0x7f0000000540)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) r1 = socket(0x10, 0x3, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x11) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000580)="2c1798d58790eb84c4b7f900d8d5f5e907020cb13a808bf456576996e67bfc42f2db17f24c2546c54651f295671014dff8f815c6489714ec85cad73396a8c5c769fd3773159cb0f3594194a159c6d9185e79093e8b6cf22b9e08c7a4218d9b375cef19b6cc69da981ed785f93375db413ba0c73d648d146f5db003cd292e6bcd6adae065e21ebd1a04f9dc5c6fda32769f77b022809e770a7bdd4233adae59b420998c15edc6c7d93bb3c441c869d1658f146d10c0d19fdda7288359740ccf921aaab691835709c1ffee1f", 0xcb}], 0x1}, 0x4000841) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000002c0)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40ffffff"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="48005cbef3bdf72f6997e354d94104bbf1e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r1, @ANYRES8=r0], 0x48}}, 0x4084) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3c) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000200)={r0, 0x9093, 0x6, r0}) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs_dir/buffer_size_kb\x00', 0x1, 0x0) writev(r3, &(0x7f00000004c0)=[{&(0x7f0000000180)='3', 0x1}], 0x1) unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) 27.800219156s ago: executing program 3 (id=826): syz_usb_disconnect(0xffffffffffffffff) syz_usb_connect(0x6, 0x24, &(0x7f0000000300)=ANY=[], 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x54, 0x30, 0xb, 0x70bd25, 0x0, {}, [{0xffffffffffffffc7, 0x1, [@m_gact={0x3c, 0x1, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x12e5, 0x6}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000015}, 0xc844) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000500)={0x9, 0x6, 0x5, 0x80000001}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) inotify_add_watch(0xffffffffffffffff, 0x0, 0x850003d1) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4048004) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r1, 0x0, 0x0) 26.976982836s ago: executing program 3 (id=827): r0 = socket$inet(0x2, 0x3, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x20000080) munmap(&(0x7f00002d2000/0x4000)=nil, 0x4000) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x4d, &(0x7f0000000100)}) close_range(r3, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x3, 'sh\x00', 0x1, 0x5, 0x6d}, 0x2c) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x80800) sendmmsg$alg(r6, 0x0, 0x0, 0x40800) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000002f00090027bd7000fddbdf250400000007000b00050000006a965e43c97d2242c3ea8c51aa03af6ab596b1d7786a47ebe5664a7c174736f9a8e364d2e835"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x20040004) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e20, 0x3, 'lc\x00', 0x1, 0x323b, 0x55}, {@remote, 0x4e27, 0x2000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0x10) sendto$inet(r0, &(0x7f0000000180)="cbd05508ab7edb4a58", 0xfdef, 0x800, &(0x7f0000000100)={0x2, 0x4e23, @multicast1}, 0x10) 26.976731874s ago: executing program 33 (id=827): r0 = socket$inet(0x2, 0x3, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x20000080) munmap(&(0x7f00002d2000/0x4000)=nil, 0x4000) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x4d, &(0x7f0000000100)}) close_range(r3, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x3, 'sh\x00', 0x1, 0x5, 0x6d}, 0x2c) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x80800) sendmmsg$alg(r6, 0x0, 0x0, 0x40800) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000002f00090027bd7000fddbdf250400000007000b00050000006a965e43c97d2242c3ea8c51aa03af6ab596b1d7786a47ebe5664a7c174736f9a8e364d2e835"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x20040004) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e20, 0x3, 'lc\x00', 0x1, 0x323b, 0x55}, {@remote, 0x4e27, 0x2000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0x10) sendto$inet(r0, &(0x7f0000000180)="cbd05508ab7edb4a58", 0xfdef, 0x800, &(0x7f0000000100)={0x2, 0x4e23, @multicast1}, 0x10) 9.360343461s ago: executing program 4 (id=916): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r2 = openat$vmci(0xffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000000)={@local}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8a100, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x2a) setresgid(0xee00, 0x0, 0xee00) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYRES8=r1, @ANYRES8=r5, @ANYRES16=r0, @ANYRES32=r0, @ANYBLOB="1cf6"]) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r7 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000000300)) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r7, 0x4068aea3, &(0x7f0000000140)) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r1, 0x7a5, 0x0) r8 = syz_usb_connect(0x0, 0x3f, &(0x7f00000012c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109024a0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e", @ANYRESHEX], 0x0) r9 = openat$zero(0xffffffffffffff9c, &(0x7f0000000740), 0x8202, 0x0) mmap$binder(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x11, r9, 0x0) syz_usb_control_io$printer(r8, 0x0, 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x8) ioctl$HIDIOCGUSAGE(r10, 0x40015b19, &(0x7f0000000000)={0xfffffffe, 0xfffffffe, 0x7, 0xff, 0x1, 0x2}) r11 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES64], 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000340)={0x18, &(0x7f0000000380)=ANY=[@ANYRES8=r11, @ANYRESHEX=r5, @ANYRESOCT=r2, @ANYRES16=r11, @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYRESHEX, @ANYRESHEX=r11, @ANYRESHEX=r2], 0x0, 0x0, 0x0, 0x0}, 0x0) clock_gettime(0x6, &(0x7f0000000080)) openat$nvme_fabrics(0xffffff9c, &(0x7f00000001c0), 0x202000, 0x0) r12 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r13 = dup(r12) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r13, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) 6.478505378s ago: executing program 0 (id=931): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x80) ioctl$KVM_GET_XSAVE(r2, 0x9000aea4, 0x0) 6.400560329s ago: executing program 0 (id=932): r0 = socket$inet(0x2, 0x3, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x20000080) munmap(&(0x7f00002d2000/0x4000)=nil, 0x4000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x4d, &(0x7f0000000100)}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x3, 'sh\x00', 0x1, 0x5, 0x6d}, 0x2c) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) r5 = accept4(r4, 0x0, 0x0, 0x80800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, 0x0}], 0x1, 0x40800) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000002f00090027bd7000fddbdf250400000007000b00050000006a965e43c97d2242c3ea8c51aa03af6ab596b1d7786a47ebe5664a7c174736f9a8e364d2e835"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x20040004) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e20, 0x3, 'lc\x00', 0x1, 0x323b, 0x55}, {@remote, 0x4e27, 0x2000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) sendto$inet(r0, &(0x7f0000000180)="cbd05508ab7edb4a58", 0xfdef, 0x800, &(0x7f0000000100)={0x2, 0x4e23, @multicast1}, 0x10) 6.286873543s ago: executing program 4 (id=934): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x2}, &(0x7f0000000b80)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x4) r1 = openat$dsp(0xffffff9c, &(0x7f0000000000), 0x20000, 0x0) setresgid(0xee00, 0xee01, 0x0) setregid(0xffffffffffffffff, 0x0) ioctl$SOUND_MIXER_READ_RECMASK(r1, 0x80044dfd, &(0x7f0000000080)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) syz_open_dev$usbfs(0x0, 0x75, 0x109301) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) openat$vcsa(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'veth1\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) futex(&(0x7f000000cffc)=0x1, 0xd, 0x1, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0xd, 0x0, 0x0, 0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x3, 0x2000) msgctl$IPC_RMID(0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x100000e, 0x66032, 0xffffffffffffffff, 0x40000000) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) 5.105764617s ago: executing program 0 (id=936): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, 0x0, 0x0) sendmsg$inet_sctp(r0, 0x0, 0x20004805) socket(0x0, 0x80000, 0xfffffffd) fcntl$lock(0xffffffffffffffff, 0x2b, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r1 = socket$inet6(0xa, 0x3, 0x1) sendmmsg(r1, 0x0, 0x0, 0xffe0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x10010, 0xffffffffffffffff, 0xec776000) bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) socket(0x10, 0x3, 0x0) setns(0xc9, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000000)="07000000010000", 0x7) (fail_nth: 5) 5.10490294s ago: executing program 5 (id=937): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, 0x0, 0x0) sendmsg$inet_sctp(r0, 0x0, 0x20004805) socket(0x0, 0x80000, 0xfffffffd) fcntl$lock(0xffffffffffffffff, 0x2b, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r1 = socket$inet6(0xa, 0x3, 0x1) sendmmsg(r1, 0x0, 0x0, 0xffe0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x10010, 0xffffffffffffffff, 0xec776000) bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) socket(0x10, 0x3, 0x0) setns(0xc9, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000000)="07000000010000", 0x7) 5.001071143s ago: executing program 0 (id=938): r0 = socket$inet(0x2, 0x3, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x20000080) munmap(&(0x7f00002d2000/0x4000)=nil, 0x4000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x3, 'sh\x00', 0x1, 0x5, 0x6d}, 0x2c) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) r5 = accept4(r4, 0x0, 0x0, 0x80800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, 0x0}], 0x1, 0x40800) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000002f00090027bd7000fddbdf250400000007000b00050000006a965e43c97d2242c3ea8c51aa03af6ab596b1d7786a47ebe5664a7c174736f9a8e364d2e835"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x20040004) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e20, 0x3, 'lc\x00', 0x1, 0x323b, 0x55}, {@remote, 0x4e27, 0x2000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) sendto$inet(r0, &(0x7f0000000180)="cbd05508ab7edb4a58", 0xfdef, 0x800, &(0x7f0000000100)={0x2, 0x4e23, @multicast1}, 0x10) 5.000906493s ago: executing program 5 (id=939): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000080bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7050000080000001c2400000000000045040400010000001704000001000a00b7040000000100006a0af2fe000000008500000044000000b70000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x7, &(0x7f0000000680)=@framed={{0x18, 0x8, 0x0, 0x60}, [@map_fd, @map_fd]}, &(0x7f0000000000)='GPL\x00', 0x4, 0xea, &(0x7f0000000340)=""/234}, 0x23) 4.911783851s ago: executing program 5 (id=940): syz_usb_disconnect(0xffffffffffffffff) r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x54, 0x30, 0xb, 0x70bd25, 0x0, {}, [{0xffffffffffffffc7, 0x1, [@m_gact={0x3c, 0x1, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x12e5, 0x6}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000015}, 0xc844) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000500)={0x9, 0x6, 0x5, 0x80000001}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) inotify_add_watch(0xffffffffffffffff, 0x0, 0x850003d1) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4048004) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r2, 0x0, 0x0) 3.79952316s ago: executing program 0 (id=942): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000000c0)) syz_genetlink_get_family_id$batadv(&(0x7f00000004c0), r0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="120100020000004032150d01000000000001090224000100000000090400000203000000092100000001229c0a090a81030000fb00009454dd7981ec24fea19f1c38878d69034ca7dd9e2ff316c9ff866d283e770d9ef224833af9bb49a2a244d6c996e9b9a74e6aeff23c581b8238c95441e7726a"], 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) ioctl$HIDIOCGRAWINFO(r1, 0x80084803, &(0x7f0000000640)=""/161) add_key$user(&(0x7f0000002100), &(0x7f0000002180)={'syz', 0x1}, &(0x7f00000021c0)='b', 0x1, 0xfffffffffffffffe) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r2, &(0x7f0000000000), 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000800040044000000088633f43b38001b0000000000"], 0x30}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000840)={r6, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) pread64(0xffffffffffffffff, 0x0, 0x0, 0x200) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r2, 0xc00c642d, &(0x7f0000000240)={0x0, 0x21bccdd83b838d55, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SET_UNIQUE(r8, 0x40086410, &(0x7f0000000180)={0x6f, &(0x7f00000005c0)="95f813993b5ac5371bd27d5ae1fc38af1fcbe68ba5889b10a865d2c6563de13b235624e5b33e02afcd156220eb54e889cc469070e50e027915eabe75d057f91c71703a365a86bcb19db095cc5a044b1209ca50472e035013f8f49843b7d4cd3975b07b0b2ddfbe195a31dda26cd8d5"}) 2.955998097s ago: executing program 5 (id=945): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) r0 = openat$hpet(0xffffff9c, &(0x7f0000000140), 0x800080, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x200000f, 0x50, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, 0x0, 0x841, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2002c4c0}, 0x8001) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000020c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r2 = add_key(&(0x7f0000002340)='big_key\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) keyctl$read(0x2, r2, &(0x7f00000000c0)=""/4096, 0x1000) keyctl$read(0xb, r2, &(0x7f00000010c0)=""/4096, 0x1000) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mknod(&(0x7f00000000c0)='./bus\x00', 0x8000, 0xd02) acct(&(0x7f0000000000)='./bus\x00') acct(0x0) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x8080, 0x8, 0x3, 0x0, 0x0, r1}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r8 = open(&(0x7f0000000140)='./file1\x00', 0x66842, 0x21) syz_ublk_add_dev(r8, r5, r6, r7, &(0x7f00000003c0)={0x2e, 0x71, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000180)=@any_dev={0x4, 0x58e, 0x0, 0x0, 0x1000, 0x9, 0xffffffffffffffff}}}, &(0x7f0000000440)=0x0) syz_ublk_setup_queues(r8, r10, &(0x7f0000000340)={0x0, 0xfb7e, 0x3000, 0x2, 0x3cf, 0x0, r4}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd3db, 0x200, 0xfffffffd, 0x3de, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9e00, 0x200, 0xfffffffe, 0x3da}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdada, 0x1000, 0x3, 0x321}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4c9b3, 0x20, 0x3, 0x80000c4}}], 0x4, &(0x7f0000000e00)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0xf6}, 0x0, r9, '\x00', {0x5, 0xe81, 0x0, 0x0}}, 0x0) add_key(&(0x7f00000001c0)='user\x00', 0x0, &(0x7f0000000a40), 0x0, 0xfffffffffffffffb) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000140)={0xf, 0x4cd, 0x2, 0x3, 0x1, "c4249d0788fa8dccada7257c3105714622383e", 0xe3b, 0x5}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) socket$kcm(0xa, 0x5, 0x0) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) 2.558559237s ago: executing program 4 (id=946): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newtaction={0x68, 0x30, 0x1, 0x70bd29, 0x25dfdbfb, {}, [{0x54, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x2, 0x9, 0x4, 0x8be6, 0x8}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x9, 0xa}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) (fail_nth: 2) 1.334729967s ago: executing program 5 (id=947): mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000002c80)='./file0\x00', &(0x7f00000004c0), 0x800, &(0x7f0000000c00)=ANY=[]) chdir(&(0x7f0000000080)='./file0\x00') prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x80000, 0x0, &(0x7f0000000200)=0x1) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000880)=ANY=[@ANYBLOB="3b00080000030000000000000100202b38d26f8a53000000000000000000000000002db34c55cc4860deb936b5b49c92f68d8bf58eb77f9f17294fa500c2bddadb47f114995a4c20f5bf019c02df04b9f13758b7ac3c39442f5ff90a07dd78172f5f8b5b518ef57434ecd1144e5b6a85a72c7025e9cd72d1a356939edcf09cbdc8b64c2a6b7003f9f35bf32be3f5313d644cfa2b405412ac84b8a67134087e886555a6f6d6d59a7f18436e61fa36571cd2fbed5f5896acadcdd68343c4d06dfff5bdbc854a062941ef05a6827a05a26e7987e4a1470b1de50cb87dca01a69e8e286158c0144c94cfe620d102606b25d2353b242e957985e2c8b28c878d5f2c02a0b664497e7cbf66"], 0x18}}, 0x80) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom1\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) timer_create(0x0, 0x0, &(0x7f0000000300)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000100)=0x48) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount$nfs4(&(0x7f0000000000)='-.%^%\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x20c0c24, &(0x7f0000000500)=ANY=[@ANYBLOB="2f5e2d282d272e2a03212c3970002c236a2c2e2f62696e64657266732f62696e64657230002c2c002c7375626a5f757365723d242e232c66736d616769633d3078383030303030303030303030303030312c7365636c6162656c2c6673636f6e746578743d756e636f6e67696e65645f752c6d61736b3d5e4d41595f2b5845432c61707072616973652c0087e004439811ef4ad70fa96a87a04a948d5fe99cd16fa3f0e5bf7ef431150ca312673ce5c8d3ac3e310df8051a691f40f0f3bd3c0d289dbcf46b5bdd3836649061e44d94fc1d2f3988b522fd15ce705c3a1a4cda5609040b0ce8c450e0381702bc6385321398"]) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x1, @local, 0x4000c7}, 0x21) recvmmsg(r2, &(0x7f0000002e80), 0x4000071, 0x830b, 0x0) r3 = socket$inet6(0xa, 0x4, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x98804, &(0x7f0000000240)={0xa, 0x4e20, 0xed, @private2, 0xfffffffe}, 0x1c) getgroups(0x2, &(0x7f0000000600)=[0x0, 0x0]) sendto$inet6(r3, 0x0, 0x0, 0x4c083, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, 0x0}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') creat(&(0x7f0000000040)='./bus\x00', 0x8) 1.327172736s ago: executing program 4 (id=956): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv4_newnexthop={0x20, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv4_newnexthop={0x20, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, 0x1}]}, 0x20}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newnexthop={0x40, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_GROUP={0x14, 0x2, [{0x1, 0x1}, {0x2, 0x1}]}, @NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0x4}]}]}, 0x40}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv4_newnexthop={0x28, 0x68, 0x501, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x1}, @NHA_OIF={0x8, 0x5, 0x1}]}, 0x38}}, 0x0) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f00000000c0)='proc\x00', 0x2804105, 0x0) 999.736158ms ago: executing program 2 (id=949): r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1/functions/rndis.usb0/host_addr\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/rndis.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/rndis.usb0/host_addr\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='4', 0x1) write(r0, &(0x7f0000000000)="0600000000000000010000000000000000000000000000006c733100"/104, 0x68) 999.331567ms ago: executing program 4 (id=950): r0 = socket$inet6(0xa, 0x2, 0x3a) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x2f4, @empty}, 0x1c) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f00000001c0)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r2, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x1000000000000006, 0x5e, 0xa, 0xd, 0x404, 0x3}) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r2, 0x7af, 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmmsg$sock(r3, &(0x7f0000001140)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)=[@txtime={{0x18, 0x1, 0x51, 0x5}}], 0x18}}], 0x1, 0x2a9b0a4a1e70e25c) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000240)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) close_range(r1, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000000f00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) capset(&(0x7f0000000500)={0x20071026}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0xbe67}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x3, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)=ANY=[@ANYRES32=0x1, @ANYRES32=r6, @ANYBLOB='.\x00\x00\x00'], 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)=ANY=[], 0x20) ioctl$sock_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000003640)={0x0, 'hsr0\x00', {0x1}, 0x7}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000500)={'vlan1\x00', &(0x7f0000000100)=@ethtool_sfeatures}) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000400)={'vcan0\x00'}) socket$can_j1939(0x1d, 0x2, 0x7) 997.565115ms ago: executing program 2 (id=951): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = userfaultfd(0x80001) memfd_create(&(0x7f0000000000)='\x00', 0x6) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x10}) socket$inet(0x2, 0x6000000000000001, 0x0) mmap(&(0x7f0000001000/0x200000)=nil, 0x200000, 0x2000001, 0x2011, r0, 0x4000) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000042000/0x1000)=nil, 0x1000}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000005880), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000005d00)={0x0, 0x0, &(0x7f0000005cc0)={&(0x7f00000058c0)={0x2c, r2, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x2c}}, 0xc040) 920.269428ms ago: executing program 4 (id=952): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = userfaultfd(0x80000) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f0000000040)={{&(0x7f0000b35000/0x3000)=nil, 0x3000}, 0x2}) socket(0x22, 0x80002, 0x3) r1 = userfaultfd(0x80c00) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000010902240001000000000904000002030000000921000027d2e1b1000945810300"/54], 0x0) r2 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) ioctl$HIDIOCGRAWINFO(r2, 0x80084803, &(0x7f0000000640)=""/161) r3 = getpid() process_vm_readv(r3, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x280}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_WRITEPROTECT(r1, 0xc018aa06, &(0x7f00000000c0)={{&(0x7f000040a000/0x800000)=nil, 0x800000}, 0x1}) 919.074246ms ago: executing program 2 (id=954): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000200000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c000000130005002cbd70000000000004000000", @ANYRES32=r2, @ANYBLOB="12030000000800000a000100aaaaaaaaaabb00006520ce79a95d1c4e8c4a76bd25c231d868bc6ceca3f0348e940934634099553b88"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) 850.683297ms ago: executing program 2 (id=955): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup2(r2, r1) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240), 0x4000, &(0x7f0000000080)=ANY=[@ANYBLOB="744766642c7266646e6f3f0000e9ff007cb79746134a8bb9949c1cac9319e8e8747380322c71070630296003f319e1231511243b97cb66324adcde320e8e942b21286188b5fc985bbb2483f210021cc43884ea2b7aca47b5a40fe6850471a2c9fdf9a8636806d9c08cfdceea359d17984c23b6667bf206803470d2c1504e1f4a", @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0, @ANYBLOB=',\x00']) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'team0\x00', 0x0}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r5, 0xc138fd05, &(0x7f0000000000)="0400000002000000000000007e0100003801") bpf$MAP_CREATE(0x0, &(0x7f0000000bc0)=ANY=[@ANYBLOB="090000002e94e7000600000009ffae6d4643fdff", @ANYRES32=r5, @ANYBLOB="0100"/20, @ANYRES32=r4, @ANYRES32=r1, @ANYBLOB="020000000300"/28], 0x50) unshare(0x40000000) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f0000000500)={0x3ff, 0x1, 0x81}, 0xc) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r6 = socket$pppl2tp(0x18, 0x1, 0x1) r7 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r6, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$PPPIOCGCHAN(r6, 0x80047437, &(0x7f00000001c0)) bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x50, &(0x7f0000000c40)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa34810000008611fffe8000000000000000000000000000bbfe8000000000000000000000000000bb00000e2200169078020300000000000000440000000000000000000000a7cfcb0c0b2ee18b0067c070b58cba5ee347a1cfba2fa6dc8be6ee0282007c9667cabc8be4a56fe99dbfbb8ad3718e5efccb4694123788a872d6960b7afa742d8c1ed0a3a08459947241f050df207adc4bf8e163700a2e0e7c560581a66f38afcd1df6472178e05ed39a45aeee0bf06e604f90a373b57bb6939582ffa7fa022ace211612f37163bf65d4c880fd5347dc7d917a09794d74b67ed07fae4edd4ba51582f9b3de08e76c3cc860d8dc280514abb2403bf17ed292"], 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r5) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000ac0)=ANY=[@ANYRES16=r3, @ANYRES16, @ANYRESOCT=r8, @ANYRESDEC, @ANYRESOCT=r0, @ANYRES32=0x0, @ANYRESDEC=r2, @ANYRES8=r7], 0x34}, 0x1, 0x0, 0x0, 0x20000085}, 0x20040000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'veth1_to_hsr\x00'}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000400)={'syztnl0\x00', &(0x7f0000000380)={'syztnl1\x00', r4, 0x29, 0x9, 0x7, 0xfffffffe, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2, 0x8000, 0x80, 0x9, 0x7ff}}) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000440)=0x0, &(0x7f00000004c0)=0x4) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@bloom_filter={0x1e, 0x4, 0x5, 0x57e, 0x8000, r1, 0x5, '\x00', r11, r5, 0x3, 0x1004, 0x2, 0xd, @value=r3}, 0x50) sendmsg$sock(r3, &(0x7f0000000880)={&(0x7f0000000580)=@generic={0x8, "52a2e8e11c75303b42409933fbdd9bf615f269f8af442b098faba59ca700feec6a4249a9444f5a33076a38ae29cf09baae4f137c9412e99624376325b51003b3a98e0a1a3aff3b9fa05e9639cb9d41b759c6471eb97b111b98de6cf7d9f8c4cc47e0b2ec52c5aedc9f0e8075723144f3440aa088fe2a0d70c29031f46163"}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000600)="75c07e91dfcc6f270fcb8382f8979895179770446e371483c325ab35d2787513ec06a596d9b78c67b8e818e6d9a3a5a5538e6dcc26adab72e6a7feb333101c08592f21be997bbef19c923a33bfe2e10793cc07bfd42e8c4550686da87fc6c495945c40afef9c7a520b883faba263cdf7e633d05b8df700ee0f4d3d6d50fb4aa1a933b4a3bd9ade8ea5a271b7e3df597f8556b7", 0x93}, {&(0x7f0000000780)="051cdb77bdef7eee08483518b101434641558db37602e01b24af7b68b5f0e505f95ffa24e4828838bdb40160ddfcb57d38ec445f022f2ea04f75c08e784c2e17ef8f533525c7c5e5a989b6219672c2d9efaa679b088ea381401e373d60d58ec64793e34b1c7ffd0ec1584158e93a47a9500f8cc27280e346549fba91ab8e2964d2dec49cef507209ad4991765c3a18c4da38dd75bf", 0x95}], 0x2}, 0x8814) bpf$BPF_GET_PROG_INFO(0x3, &(0x7f0000000340)={r12, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7c, 0x8, 0x0, 0x0}}, 0x10) sendmsg$ETHTOOL_MSG_TSINFO_GET(r3, &(0x7f0000000740)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000700)={&(0x7f00000008c0)=ANY=[@ANYBLOB="2c010000", @ANYRES16=r9, @ANYBLOB="00082bbd7000fadbdf251900000020000180140002006d61637365633000000000000000000008000300010000004400018014000200776c616e3100000000000000000000001400020073797a5f74756e00000000000000000008000100", @ANYRES32=r4, @ANYRES16=r3, @ANYRES32=r10, @ANYBLOB="1400020069703665727370616e3000000000000008000100", @ANYRES32=r11, @ANYBLOB="08000300020000001400018008000100", @ANYRES32=r4, @ANYBLOB="08000300010000eca5e7b6743e4df2784e31bcfc592a00040001803800018008000300030000000800030003000000080001006e03dcf6b1be56ccfba42e96dfb5f83d85510e10dfeaa88563d6a94db81b7d4ea1cfea0f39388e7f5bce111c310895da271bea0f9785066f9c8d23cdef1016b1fb5fc5cad456a32359b29a80bac22defe03eb334ad76846e2cfc3d775426054ccffe264a9f26c96135833bae5734743049cfd4e1c434082d17f8516fec9c8fa7e376caa37fae3effcd27ef30074c9208498d44125e262dffad457309c9bdf163116d78da8efa3bcdfaa5581c7935a3fd16615d2d16b83dda9a82993e5fcff17a7e486ea4", @ANYRES32=r4, @ANYBLOB="0800030001000000140002007465616d5f736c6176655f30000000002c00018008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r4, @ANYBLOB="080003000100000008000100", @ANYRES32=r4, @ANYBLOB], 0x12c}, 0x1, 0x0, 0x0, 0x80}, 0x0) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) 761.858677ms ago: executing program 2 (id=957): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x1a000}], 0x1}, 0x0) sendmsg$rds(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0xd000, 0x488c4}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x1, &(0x7f0000000200)=[{0xf09d, 0x2, 0x2, 0x7}]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0x24000814) r2 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r2, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x50) r3 = socket$nl_route(0x10, 0x3, 0x0) write(r3, 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f0000000080), 0x2, 0x94000) fsopen(&(0x7f0000000000)='nfs\x00', 0x0) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f00000001c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x8000000}]}, 0x8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000002000/0x2000)=nil}) socket$pppoe(0x18, 0x1, 0x0) 618.67092ms ago: executing program 2 (id=958): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x18, 0x3, &(0x7f0000000440)=ANY=[], 0x0, 0x2, 0xb3, &(0x7f0000000140)=""/179, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfc}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x3, 0x0, 0xfffffffffffffffd, 0xffffffff, 0xffffffffffffffff, 0x3, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_GET_MSRS_cpu(r6, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x400000f5, 0x0, 0xfb}]}) r7 = add_key$keyring(&(0x7f0000000440), 0x0, 0x0, 0x0, 0xfffffffffffffff9) ioctl$TIOCGICOUNT(r0, 0x545d, 0x0) add_key$keyring(&(0x7f0000000280), &(0x7f0000000300)={'syz', 0x2}, 0x0, 0x0, r7) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r8, 0x0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) get_robust_list(r1, 0xffffffffffffffff, 0x0) epoll_create(0x3) syz_open_dev$vbi(0x0, 0x0, 0x2) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYRES16, @ANYBLOB="3f00000021010000300012800b0000000700080000000c002e00030000000000ce76da75c739a6783e1741d4fafeca48276026415e0001bdaf29d0cfb23de9a7d4a692393ec51b9a573e1879fdf8e0f08245b998c1d3d544d3ce17d95aa0911a62e40ea5dba4374628a7776e192c78b6fda023a28ee212bd9a526f040c354341e571c906c1bb0cee933a558bb291c0e2dc20e8c6a766fc28fbdd2d1472e39fa548342ce89507d3d264feda82895b116b2be92c1e0c75a1dd0415395f47e892b5d6153a4ba1eb424441e9251e8a79a7b20d173151ca927af9864588d94dc8ed3cd6daef64bbdb7c9c6effe8284f25e22f"], 0x50}}, 0x40000) 533.197884ms ago: executing program 5 (id=959): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f00000000c0)={0x1, 0x4, 0x8}) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000006c0)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x7, [@var={0x2, 0x0, 0x0, 0xe, 0x3}, @typedef={0x5}, @struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x0, 0x1}]}]}, {0x0, [0x0, 0x2e, 0x0, 0x0, 0x61]}}, 0x0, 0x53, 0x0, 0x1}, 0x28) syz_usb_connect$hid(0x3, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0xff, 0x56a, 0xd2, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x3, 0x0, 0x8, "", [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x1, 0x0, 0x9, {0x9, 0x21, 0x9, 0x2, 0x1, {0x22, 0x419}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x8, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x2, 0x3e, 0x85}}]}}}]}}]}}, &(0x7f0000000140)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x0, 0x6, 0x24, 0x60, 0x60, 0x2}, 0x20, &(0x7f0000000080)={0x5, 0xf, 0x20, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x4, "dfe07bb40bd4cde6594c381940ac4d63"}, @ext_cap={0x7, 0x10, 0x2, 0x30, 0xd, 0x1, 0x7}]}, 0x1, [{0x5b, &(0x7f00000000c0)=@string={0x5b, 0x3, "c471120b7e7a08d47331a684dbaa3096e0ad44a0668de2de6ed77f0f45caf0a9e6cebe0da04b2580cc109adbea3eccccc96ef5a89608114c88511c27d299546fb700563eba880c9e2826bc6d31846eeff66e4b683acca38c22"}}]}) 0s ago: executing program 0 (id=960): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'virt_wifi0\x00'}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000140)) sendmsg$nl_route(r2, 0x0, 0x20008004) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000140)={0x0, {{0xa, 0x0, 0x0, @mcast2}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000200)={0xb, {{0xa, 0x0, 0x0, @mcast2}}, 0x1, 0x1, [{{0xa, 0x4e21, 0xffff, @remote}}]}, 0x110) syz_emit_ethernet(0x4e, 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f0000000100)) setsockopt$packet_int(r0, 0x107, 0x16, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0) ioctl$EVIOCSABS3F(r3, 0x401845ff, 0x0) write(r3, &(0x7f0000000180)='0', 0x1) write(r3, &(0x7f00000001a0)='1', 0x1) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, 0xffffffffffffffff, 0x1000) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) kernel console output (not intermixed with test programs): 0x0001e018: 0x90a7 instead [ 200.005773][ T8062] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0xac45 instead [ 200.009527][ T8062] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead [ 200.012851][ T8062] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead [ 200.016478][ T8062] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0x90a7 instead [ 200.019813][ T10] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 200.026211][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 200.030326][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 200.033489][ T8062] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0xac45 instead [ 200.036834][ T10] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 200.040786][ T8062] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 200.043620][ T8062] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 200.047969][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.051092][ T10] usb 5-1: Product: syz [ 200.052366][ T10] usb 5-1: Manufacturer: syz [ 200.053837][ T10] usb 5-1: SerialNumber: syz [ 200.060663][ T10] hub 5-1:1.0: bad descriptor, ignoring hub [ 200.062715][ T10] hub 5-1:1.0: probe with driver hub failed with error -5 [ 200.222098][ T9] usb 9-1: USB disconnect, device number 13 [ 200.286120][ T10] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 11 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 200.293313][ T8090] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 200.353768][ T8095] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 200.449546][ T8098] openvswitch: netlink: Message has 8 unknown bytes. [ 200.457881][ T5737] Bluetooth: hci2: ACL packet too small [ 200.539467][ T8059] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.542970][ T8059] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 200.688114][ T8114] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 200.724889][ T9] usb 5-1: USB disconnect, device number 11 [ 200.730280][ T9] usblp0: removed [ 200.773478][ T8116] tmpfs: Unknown parameter '^pol' [ 200.789710][ T8116] can0: slcan on ttyS3. [ 200.912281][ T8124] syzkaller0: entered promiscuous mode [ 200.914162][ T8124] syzkaller0: entered allmulticast mode [ 201.034950][ T5903] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 201.145287][ T8128] bridge0: left promiscuous mode [ 201.184337][ T8130] openvswitch: netlink: Message has 8 unknown bytes. [ 201.185127][ T5903] usb 8-1: Using ep0 maxpacket: 8 [ 201.188898][ T5903] usb 8-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 201.193053][ T5903] usb 8-1: config 0 has no interfaces? [ 201.193411][ T5737] Bluetooth: hci1: ACL packet too small [ 201.198032][ T5903] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.198051][ T5903] usb 8-1: Product: syz [ 201.198063][ T5903] usb 8-1: Manufacturer: syz [ 201.198075][ T5903] usb 8-1: SerialNumber: syz [ 201.200031][ T5903] usb 8-1: config 0 descriptor?? [ 201.319044][ T8132] can0 (unregistered): slcan off ttyS3. [ 201.387235][ T8136] Mount JFS Failure: -5 [ 201.393834][ T8137] Mount JFS Failure: -5 [ 201.427616][ T5903] usb 8-1: USB disconnect, device number 8 [ 201.442685][ T8116] nfs4: Unknown parameter 'prot©`n' [ 201.613070][ T8153] netlink: 20 bytes leftover after parsing attributes in process `syz.0.541'. [ 201.708453][ T8157] syzkaller0: entered promiscuous mode [ 201.710841][ T8157] syzkaller0: entered allmulticast mode [ 202.384471][ T8179] openvswitch: netlink: Message has 8 unknown bytes. [ 202.397207][ T5737] Bluetooth: hci1: ACL packet too small [ 202.515107][ T2324] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 202.568018][ T8189] bridge0: entered promiscuous mode [ 202.577726][ T8189] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 202.675410][ T2324] usb 8-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 202.679281][ T2324] usb 8-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 202.683627][ T2324] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.688103][ T2324] usb 8-1: config 0 descriptor?? [ 202.694357][ T2324] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 202.729612][ T8196] netlink: 12 bytes leftover after parsing attributes in process `syz.2.552'. [ 202.732526][ T8196] netlink: 12 bytes leftover after parsing attributes in process `syz.2.552'. [ 202.739187][ T8196] netlink: 12 bytes leftover after parsing attributes in process `syz.2.552'. [ 202.757546][ T8196] netlink: 12 bytes leftover after parsing attributes in process `syz.2.552'. [ 202.774980][ T8196] netlink: 12 bytes leftover after parsing attributes in process `syz.2.552'. [ 202.784241][ T8196] netlink: 12 bytes leftover after parsing attributes in process `syz.2.552'. [ 202.788244][ T8196] netlink: 12 bytes leftover after parsing attributes in process `syz.2.552'. [ 202.792315][ T8196] netlink: 12 bytes leftover after parsing attributes in process `syz.2.552'. [ 202.855328][ T8202] trusted_key: encrypted_key: master key parameter is missing [ 202.948928][ T8209] openvswitch: netlink: Message has 8 unknown bytes. [ 202.954427][ T5737] Bluetooth: hci3: ACL packet too small [ 202.970458][ T8211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 203.005629][ T8211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 203.775736][ T8216] lo: left promiscuous mode [ 203.781504][ T8216] tunl0: left promiscuous mode [ 203.787018][ T8216] gre0: left promiscuous mode [ 203.804415][ T8216] gretap0: left promiscuous mode [ 203.823509][ T8216] erspan0: left promiscuous mode [ 203.838760][ T8216] ip_vti0: left promiscuous mode [ 203.848685][ T8216] ip6_vti0: left promiscuous mode [ 203.858550][ T8216] sit0: left promiscuous mode [ 203.888541][ T8216] ip6tnl0: left promiscuous mode [ 203.904469][ T8216] ip6gre0: left promiscuous mode [ 203.916411][ T8216] syz_tun: left promiscuous mode [ 203.930157][ T8216] ip6gretap0: left promiscuous mode [ 203.938883][ T8216] bridge0: left promiscuous mode [ 203.942254][ T8216] vcan0: left promiscuous mode [ 203.949643][ T8216] bond0: left promiscuous mode [ 203.957616][ T8216] team0: left promiscuous mode [ 203.962127][ T8216] dummy0: left promiscuous mode [ 203.973221][ T8216] nlmon0: left promiscuous mode [ 203.977788][ T8216] batadv0: left promiscuous mode [ 203.987798][ T8216] vxcan0: left promiscuous mode [ 203.991702][ T8216] vxcan1: left promiscuous mode [ 203.995236][ T8216] veth0: left promiscuous mode [ 204.714523][ T8216] veth1: left promiscuous mode [ 204.724409][ T8216] wg0: left promiscuous mode [ 204.731148][ T8216] wg1: left promiscuous mode [ 204.736613][ T8216] wg2: left promiscuous mode [ 204.739074][ T8216] veth0_to_bridge: left promiscuous mode [ 204.745408][ T8216] bridge_slave_0: left promiscuous mode [ 204.751731][ T8216] veth1_to_bridge: left promiscuous mode [ 204.757170][ T8216] bridge_slave_1: left promiscuous mode [ 204.763788][ T8216] veth0_to_bond: left promiscuous mode [ 204.773099][ T8216] bond_slave_0: left promiscuous mode [ 204.778969][ T8216] veth1_to_bond: left promiscuous mode [ 204.784479][ T8216] bond_slave_1: left promiscuous mode [ 204.789985][ T8216] veth0_to_team: left promiscuous mode [ 204.795255][ T8216] team_slave_0: left promiscuous mode [ 204.800453][ T8216] veth1_to_team: left promiscuous mode [ 204.807924][ T8216] team_slave_1: left promiscuous mode [ 204.812814][ T8216] veth0_to_batadv: left promiscuous mode [ 204.822587][ T8216] batadv_slave_0: left promiscuous mode [ 204.831415][ T8216] veth1_to_batadv: left promiscuous mode [ 204.840622][ T8216] batadv_slave_1: left promiscuous mode [ 204.849923][ T8216] xfrm0: left promiscuous mode [ 204.855860][ T8216] veth0_to_hsr: left promiscuous mode [ 204.866961][ T8216] veth1_to_hsr: left promiscuous mode [ 204.876828][ T8216] hsr0: left promiscuous mode [ 204.881136][ T8216] veth1_virt_wifi: left promiscuous mode [ 204.888088][ T8216] veth0_virt_wifi: left promiscuous mode [ 204.892309][ T8216] virt_wifi0: left promiscuous mode [ 204.902591][ T8216] vlan0: left promiscuous mode [ 204.909084][ T8216] vlan1: left promiscuous mode [ 204.915021][ T8216] macvlan0: left promiscuous mode [ 204.920771][ T8216] macvlan1: left promiscuous mode [ 204.926824][ T8216] ipvlan0: left promiscuous mode [ 204.932197][ T8216] ipvlan1: left promiscuous mode [ 204.947519][ T8216] macvtap0: left promiscuous mode [ 204.951215][ T8216] macsec0: left promiscuous mode [ 204.956523][ T8216] geneve0: left promiscuous mode [ 204.961725][ T8216] geneve1: left promiscuous mode [ 204.970229][ T8216] mac80211_hwsim hwsim8 wlan0: left promiscuous mode [ 204.972415][ T8216] mac80211_hwsim hwsim10 wlan1: left promiscuous mode [ 204.974564][ T8216] mac80211_hwsim hwsim11 wlan2: left promiscuous mode [ 204.976767][ T8216] mac80211_hwsim hwsim12 wlan3: left promiscuous mode [ 204.978999][ T8216] mac80211_hwsim hwsim20 wlan4: left promiscuous mode [ 204.981163][ T8216] mac80211_hwsim hwsim21 wlan5: left promiscuous mode [ 204.983291][ T8216] mac80211_hwsim hwsim30 wlan6: left promiscuous mode [ 204.985837][ T8216] mac80211_hwsim hwsim35 wlan7: left promiscuous mode [ 204.988025][ T8216] sit1: left promiscuous mode [ 205.001365][ T8216] mac80211_hwsim hwsim38 wlan8: left promiscuous mode [ 205.003492][ T8216] mac80211_hwsim hwsim39 wlan9: left promiscuous mode [ 205.015313][ T8216] mac80211_hwsim hwsim40 wlan10: left promiscuous mode [ 205.019726][ T8216] mac80211_hwsim hwsim46 wlan11: left promiscuous mode [ 205.023236][ T8216] veth2: left promiscuous mode [ 205.026314][ T8216] veth3: left promiscuous mode [ 205.031003][ T8216] mac80211_hwsim hwsim50 wlan12: left promiscuous mode [ 205.033251][ T8216] syztnl2: left promiscuous mode [ 205.041707][ T8216] netdevsim netdevsim0 eth0: left promiscuous mode [ 205.048451][ T8216] netdevsim netdevsim0 eth1: left promiscuous mode [ 205.054511][ T8216] netdevsim netdevsim0 eth2: left promiscuous mode [ 205.058691][ T8216] netdevsim netdevsim0 eth3: left promiscuous mode [ 205.074846][ T5827] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.095396][ T8229] syzkaller0: entered promiscuous mode [ 205.097127][ T8229] syzkaller0: entered allmulticast mode [ 205.114837][ T8239] __nla_validate_parse: 13 callbacks suppressed [ 205.114848][ T8239] netlink: 44 bytes leftover after parsing attributes in process `syz.0.561'. [ 205.120084][ T8239] netlink: 44 bytes leftover after parsing attributes in process `syz.0.561'. [ 205.851372][ T9] usb 8-1: USB disconnect, device number 9 [ 205.995618][ T8255] openvswitch: netlink: Message has 8 unknown bytes. [ 206.003517][ T5737] Bluetooth: hci2: ACL packet too small [ 206.685314][ T8241] netlink: 12 bytes leftover after parsing attributes in process `syz.4.562'. [ 206.697012][ T8245] netlink: 64 bytes leftover after parsing attributes in process `syz.0.563'. [ 206.715021][ T8259] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 206.727057][ T5827] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.731720][ T5827] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.746347][ T5827] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 207.220472][ T8269] netlink: 20 bytes leftover after parsing attributes in process `syz.3.569'. [ 208.066528][ T8279] openvswitch: netlink: Message has 8 unknown bytes. [ 208.070619][ T5737] Bluetooth: hci2: ACL packet too small [ 208.153875][ T8285] trusted_key: encrypted_key: master key parameter is missing [ 208.186227][ T8288] netlink: 8 bytes leftover after parsing attributes in process `syz.4.572'. [ 208.296170][ T8293] lo: entered promiscuous mode [ 208.298845][ T8293] tunl0: entered promiscuous mode [ 208.301163][ T8293] gre0: entered promiscuous mode [ 208.304173][ T8293] gretap0: entered promiscuous mode [ 208.307516][ T8293] erspan0: entered promiscuous mode [ 208.310965][ T8293] ip_vti0: entered promiscuous mode [ 208.313924][ T8293] ip6_vti0: entered promiscuous mode [ 208.317432][ T8293] sit0: entered promiscuous mode [ 208.323513][ T8293] ip6tnl0: entered promiscuous mode [ 208.325980][ T8293] ip6gre0: entered promiscuous mode [ 208.328219][ T8293] syz_tun: entered promiscuous mode [ 208.330630][ T8293] ip6gretap0: entered promiscuous mode [ 208.333308][ T8293] bridge0: entered promiscuous mode [ 208.337499][ T8293] vcan0: entered promiscuous mode [ 208.339670][ T8293] bond0: entered promiscuous mode [ 208.341644][ T8293] 8021q: adding VLAN 0 to HW filter on device bond0 [ 208.343985][ T8293] team0: entered promiscuous mode [ 208.346057][ T8293] 8021q: adding VLAN 0 to HW filter on device team0 [ 208.348466][ T8293] dummy0: entered promiscuous mode [ 208.351411][ T8293] nlmon0: entered promiscuous mode [ 208.353495][ T8293] batadv0: entered promiscuous mode [ 208.356178][ T8293] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 208.358590][ T8293] vxcan0: entered promiscuous mode [ 208.360665][ T8293] vxcan1: entered promiscuous mode [ 208.362652][ T8293] veth0: entered promiscuous mode [ 208.364999][ T8293] veth1: entered promiscuous mode [ 208.368271][ T8293] wg0: entered promiscuous mode [ 208.371162][ T8293] wg1: entered promiscuous mode [ 208.376883][ T8293] wg2: entered promiscuous mode [ 208.381006][ T8293] veth0_to_bridge: entered promiscuous mode [ 208.383646][ T8293] bridge_slave_0: entered promiscuous mode [ 208.386119][ T8293] veth1_to_bridge: entered promiscuous mode [ 208.388590][ T8293] bridge_slave_1: entered promiscuous mode [ 208.390837][ T8293] veth0_to_bond: entered promiscuous mode [ 208.393279][ T8293] bond_slave_0: entered promiscuous mode [ 208.395694][ T8293] veth1_to_bond: entered promiscuous mode [ 208.398177][ T8293] bond_slave_1: entered promiscuous mode [ 208.400584][ T8293] veth0_to_team: entered promiscuous mode [ 208.403122][ T8293] team_slave_0: entered promiscuous mode [ 208.405358][ T8293] veth1_to_team: entered promiscuous mode [ 208.407848][ T8293] team_slave_1: entered promiscuous mode [ 208.409984][ T8293] veth0_to_batadv: entered promiscuous mode [ 208.412393][ T8293] batadv_slave_0: entered promiscuous mode [ 208.414503][ T8293] veth1_to_batadv: entered promiscuous mode [ 208.417025][ T8293] batadv_slave_1: entered promiscuous mode [ 208.419384][ T8293] xfrm0: entered promiscuous mode [ 208.421690][ T8293] veth0_to_hsr: entered promiscuous mode [ 208.424178][ T8293] veth1_to_hsr: entered promiscuous mode [ 208.426920][ T8293] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 208.430128][ T8293] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 208.433258][ T8293] hsr0: entered promiscuous mode [ 208.435493][ T8293] veth1_virt_wifi: entered promiscuous mode [ 208.437873][ T8293] veth0_virt_wifi: entered promiscuous mode [ 208.440148][ T8293] virt_wifi0: entered promiscuous mode [ 208.441766][ T8293] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 208.946338][ T8303] netlink: 8 bytes leftover after parsing attributes in process `syz.4.579'. [ 209.041967][ T8309] gretap1: entered promiscuous mode [ 209.053735][ T8314] openvswitch: netlink: Message has 8 unknown bytes. [ 209.057785][ T5737] Bluetooth: hci1: ACL packet too small [ 209.099178][ T8316] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 209.104021][ T8316] block device autoloading is deprecated and will be removed. [ 209.307904][ T8325] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 209.392521][ T8325] loop8: detected capacity change from 0 to 7 [ 209.401133][ T8325] Dev loop8: unable to read RDB block 7 [ 209.403568][ T8325] loop8: unable to read partition table [ 209.408114][ T8325] loop8: partition table beyond EOD, truncated [ 209.410843][ T8325] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 209.419173][ T8336] syzkaller0: entered promiscuous mode [ 209.421040][ T8336] syzkaller0: entered allmulticast mode [ 209.424780][ T1485] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 209.574740][ T1485] usb 8-1: Using ep0 maxpacket: 32 [ 209.580478][ T1485] usb 8-1: unable to get BOS descriptor or descriptor too short [ 209.582903][ T1485] usb 8-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 209.589094][ T1485] usb 8-1: config 8 has an invalid interface number: 188 but max is 0 [ 209.592004][ T1485] usb 8-1: config 8 has no interface number 0 [ 209.594557][ T1485] usb 8-1: config 8 interface 188 has no altsetting 0 [ 209.600217][ T1485] usb 8-1: string descriptor 0 read error: -22 [ 209.602914][ T1485] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.609774][ T1485] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 209.612445][ T1485] dw2102: su3000_power_ctrl: 1, initialized 0 [ 209.616731][ T1485] dvb-usb: bulk message failed: -22 (2/0) [ 209.623490][ T1485] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 209.627016][ T1485] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 209.630534][ T1485] usb 8-1: media controller created [ 209.633154][ T1485] dvb-usb: bulk message failed: -22 (6/0) [ 209.636494][ T1485] dw2102: i2c transfer failed. [ 209.640990][ T1485] dvb-usb: bulk message failed: -22 (6/0) [ 209.645193][ T1485] dw2102: i2c transfer failed. [ 209.647300][ T1485] dvb-usb: bulk message failed: -22 (6/0) [ 209.649754][ T1485] dw2102: i2c transfer failed. [ 209.651777][ T1485] dvb-usb: bulk message failed: -22 (6/0) [ 209.654099][ T1485] dw2102: i2c transfer failed. [ 209.657146][ T1485] dvb-usb: bulk message failed: -22 (6/0) [ 209.659558][ T1485] dw2102: i2c transfer failed. [ 209.661575][ T1485] dvb-usb: bulk message failed: -22 (6/0) [ 209.663942][ T1485] dw2102: i2c transfer failed. [ 209.666256][ T1485] dvb-usb: MAC address: 02:02:02:02:02:02 [ 209.670091][ T8340] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 209.675017][ T1485] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 209.691375][ T1485] dvb-usb: bulk message failed: -22 (3/0) [ 209.693260][ T1485] dw2102: command 0x0e transfer failed. [ 209.696179][ T1485] dvb-usb: bulk message failed: -22 (3/0) [ 209.698105][ T1485] dw2102: command 0x0e transfer failed. [ 209.854948][ T8342] openvswitch: netlink: Message has 8 unknown bytes. [ 209.859533][ T5737] Bluetooth: hci0: ACL packet too small [ 209.892346][ T8346] netlink: 4 bytes leftover after parsing attributes in process `syz.4.593'. [ 209.940539][ T8346] macsec1: entered promiscuous mode [ 209.942575][ T8346] macsec1: entered allmulticast mode [ 209.944454][ T8346] batadv0: entered allmulticast mode [ 209.947669][ T8346] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 209.952847][ T8346] batadv0: left allmulticast mode [ 210.008614][ T1485] dvb-usb: bulk message failed: -22 (3/0) [ 210.011163][ T1485] dw2102: command 0x0e transfer failed. [ 210.013978][ T1485] dvb-usb: bulk message failed: -22 (3/0) [ 210.016536][ T1485] dw2102: command 0x0e transfer failed. [ 210.018982][ T1485] dvb-usb: bulk message failed: -22 (1/0) [ 210.021426][ T1485] dw2102: command 0x51 transfer failed. [ 210.028679][ T8323] dvb-usb: bulk message failed: -22 (5/0) [ 210.031781][ T8323] dw2102: i2c transfer failed. [ 210.034061][ T8323] retu-mfd 2-0002: Tahvo v0.1 found [ 210.036561][ T8323] dvb-usb: bulk message failed: -22 (6/0) [ 210.038610][ T8323] dw2102: i2c transfer failed. [ 210.042313][ T8323] dvb-usb: bulk message failed: -22 (5/0) [ 210.043357][ T1485] DVB: Unable to find symbol ds3000_attach() [ 210.047154][ T1485] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 210.048491][ T8323] dw2102: i2c transfer failed. [ 210.055596][ T8323] genirq: Flags mismatch irq 0. 00002000 (TAHVO) vs. 00215a00 (timer) [ 210.059018][ T8323] retu-mfd 2-0002: Failed to request IRQ 0 for TAHVO: -16 [ 210.074464][ T8323] retu-mfd 2-0002: probe with driver retu-mfd failed with error -16 [ 210.082541][ T8323] i2c i2c-2: new_device: Instantiated device tahvo at 0x02 [ 210.095296][ T1485] rc_core: IR keymap rc-su3000 not found [ 210.097837][ T1485] Registered IR keymap rc-empty [ 210.101976][ T1485] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.3/usb8/8-1/rc/rc0 [ 210.111845][ T1485] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.3/usb8/8-1/rc/rc0/input23 [ 210.142631][ T1485] dvb-usb: schedule remote query interval to 150 msecs. [ 210.148321][ T1485] dw2102: su3000_power_ctrl: 0, initialized 1 [ 210.153703][ T1485] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 210.165485][ T1485] usb 8-1: USB disconnect, device number 10 [ 210.234288][ T1485] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 210.374830][ T24] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 210.379296][ T8360] netlink: 4 bytes leftover after parsing attributes in process `syz.2.597'. [ 210.384171][ T8360] netlink: 4 bytes leftover after parsing attributes in process `syz.2.597'. [ 210.388608][ T8360] netlink: 4 bytes leftover after parsing attributes in process `syz.2.597'. [ 210.555224][ T24] usb 9-1: New USB device found, idVendor=05e0, idProduct=0600, bcdDevice= 1.00 [ 210.559226][ T24] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 37, changing to 9 [ 210.562928][ T24] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 10008, setting to 1024 [ 210.568233][ T24] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.571311][ T24] usb 9-1: Product: syz [ 210.572708][ T24] usb 9-1: Manufacturer: syz [ 210.574289][ T24] usb 9-1: SerialNumber: syz [ 210.577693][ T8356] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 210.581177][ T24] symbolserial 9-1:1.0: symbol converter detected [ 210.586272][ T24] usb 9-1: symbol converter now attached to ttyUSB0 [ 210.626687][ T8363] netlink: 64 bytes leftover after parsing attributes in process `syz.0.599'. [ 210.675007][ T5903] usb 7-1: new low-speed USB device number 17 using dummy_hcd [ 210.786140][ T24] usb 9-1: USB disconnect, device number 14 [ 210.825514][ T5903] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 210.825705][ T24] symbol ttyUSB0: symbol converter now disconnected from ttyUSB0 [ 210.830003][ T5903] usb 7-1: config 0 has no interfaces? [ 210.836977][ T24] symbolserial 9-1:1.0: device disconnected [ 210.837488][ T5903] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.847268][ T5903] usb 7-1: config 0 descriptor?? [ 210.895589][ T8370] openvswitch: netlink: Message has 8 unknown bytes. [ 210.900395][ T5737] Bluetooth: hci2: ACL packet too small [ 211.067670][ T8364] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 211.071525][ T8364] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 211.076375][ T8364] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 211.079757][ T8364] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 211.083067][ T8364] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 211.086476][ T8364] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 211.089631][ T8364] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 211.092902][ T8364] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 211.096187][ T8364] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 211.099439][ T8364] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 211.118080][ T41] usb 7-1: USB disconnect, device number 17 [ 211.146021][ T8372] netlink: 64 bytes leftover after parsing attributes in process `syz.3.602'. [ 211.525135][ T8383] syzkaller0: entered promiscuous mode [ 211.536186][ T8383] syzkaller0: entered allmulticast mode [ 211.909716][ T851] usb 7-1: new low-speed USB device number 18 using dummy_hcd [ 212.067136][ T851] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 212.073777][ T851] usb 7-1: config 0 has no interfaces? [ 212.076063][ T851] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.097592][ T851] usb 7-1: config 0 descriptor?? [ 212.316606][ T5903] usb 7-1: USB disconnect, device number 18 [ 212.955077][ T8398] netlink: 20 bytes leftover after parsing attributes in process `syz.2.609'. [ 213.039301][ T8402] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 213.042124][ T8402] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 213.064924][ T8402] vhci_hcd vhci_hcd.0: Device attached [ 213.077940][ T8402] netlink: 'syz.4.611': attribute type 58 has an invalid length. [ 213.083686][ T8402] netlink: 20 bytes leftover after parsing attributes in process `syz.4.611'. [ 213.132157][ T8406] netlink: 8 bytes leftover after parsing attributes in process `syz.4.611'. [ 213.264888][ T2324] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 213.326076][ T2324] usb 45-1: new full-speed USB device number 2 using vhci_hcd [ 213.764089][ T8403] vhci_hcd: connection reset by peer [ 213.772982][ T13] vhci_hcd vhci_hcd.4: stop threads [ 213.776261][ T13] vhci_hcd vhci_hcd.4: release socket [ 213.781193][ T13] vhci_hcd vhci_hcd.4: disconnect device [ 214.195534][ T8420] netlink: 64 bytes leftover after parsing attributes in process `syz.2.615'. [ 214.492975][ T42] kauditd_printk_skb: 19 callbacks suppressed [ 214.492986][ T42] audit: type=1800 audit(1787649026.778:70): pid=8417 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.613" name="bus" dev="ramfs" ino=26934 res=0 errno=0 [ 214.660869][ T8434] syzkaller0: entered promiscuous mode [ 214.673026][ T8434] syzkaller0: entered allmulticast mode [ 214.768203][ T5737] Bluetooth: hci1: ACL packet too small [ 214.845093][ T8392] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 215.130128][ T8441] netlink: 'syz.2.621': attribute type 2 has an invalid length. [ 215.132551][ T8441] netlink: 'syz.2.621': attribute type 8 has an invalid length. [ 215.135420][ T8441] netlink: 132 bytes leftover after parsing attributes in process `syz.2.621'. [ 215.967726][ T8449] sch_tbf: burst 19872 is lower than device lo mtu (65505) ! [ 215.996936][ T8449] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 216.000469][ T8454] FAULT_INJECTION: forcing a failure. [ 216.000469][ T8454] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 216.005708][ T8454] CPU: 3 UID: 0 PID: 8454 Comm: syz.3.625 Tainted: G L syzkaller #0 PREEMPT(full) [ 216.005725][ T8454] Tainted: [L]=SOFTLOCKUP [ 216.005729][ T8454] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 216.005736][ T8454] Call Trace: [ 216.005740][ T8454] [ 216.005744][ T8454] dump_stack_lvl+0x100/0x190 [ 216.005762][ T8454] should_fail_ex.cold+0x5/0xa [ 216.005776][ T8454] _copy_from_user+0x2e/0xd0 [ 216.005790][ T8454] get_compat_msghdr+0xb3/0x480 [ 216.005807][ T8454] ? __pfx_get_compat_msghdr+0x10/0x10 [ 216.005827][ T8454] ___sys_sendmsg+0x1b6/0x1e0 [ 216.005844][ T8454] ? __pfx____sys_sendmsg+0x10/0x10 [ 216.005866][ T8454] ? find_held_lock+0x2b/0x80 [ 216.005884][ T8454] __sys_sendmsg+0x160/0x210 [ 216.005898][ T8454] ? __pfx___sys_sendmsg+0x10/0x10 [ 216.005914][ T8454] ? __pfx_ksys_write+0x10/0x10 [ 216.005932][ T8454] __do_fast_syscall_32+0x13a/0x8b0 [ 216.005945][ T8454] ? lockdep_hardirqs_on+0x7d/0x110 [ 216.005959][ T8454] do_fast_syscall_32+0x32/0x70 [ 216.005973][ T8454] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 216.005987][ T8454] RIP: 0023:0xf7f03fec [ 216.005998][ T8454] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 216.006003][ T8454] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 216.006014][ T8454] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 216.006020][ T8454] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 216.006026][ T8454] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 216.006032][ T8454] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 216.006038][ T8454] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 216.006051][ T8454] [ 216.134755][ T8460] net_ratelimit: 102 callbacks suppressed [ 216.134767][ T8460] openvswitch: netlink: Message has 8 unknown bytes. [ 216.139866][ T5737] Bluetooth: hci1: ACL packet too small [ 216.325253][ T8470] FAULT_INJECTION: forcing a failure. [ 216.325253][ T8470] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 216.330120][ T8470] CPU: 0 UID: 0 PID: 8470 Comm: syz.4.632 Tainted: G L syzkaller #0 PREEMPT(full) [ 216.330154][ T8470] Tainted: [L]=SOFTLOCKUP [ 216.330159][ T8470] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 216.330170][ T8470] Call Trace: [ 216.330175][ T8470] [ 216.330182][ T8470] dump_stack_lvl+0x100/0x190 [ 216.330211][ T8470] should_fail_ex.cold+0x5/0xa [ 216.330234][ T8470] _copy_from_user+0x2e/0xd0 [ 216.330257][ T8470] get_compat_msghdr+0xb3/0x480 [ 216.330284][ T8470] ? __pfx_get_compat_msghdr+0x10/0x10 [ 216.330312][ T8470] ? lock_acquire+0x1b9/0x370 [ 216.330337][ T8470] ___sys_sendmsg+0x1b6/0x1e0 [ 216.330366][ T8470] ? __pfx____sys_sendmsg+0x10/0x10 [ 216.330403][ T8470] ? find_held_lock+0x2b/0x80 [ 216.330434][ T8470] __sys_sendmsg+0x160/0x210 [ 216.330456][ T8470] ? __pfx___sys_sendmsg+0x10/0x10 [ 216.330490][ T8470] __do_fast_syscall_32+0x13a/0x8b0 [ 216.330517][ T8470] do_fast_syscall_32+0x32/0x70 [ 216.330540][ T8470] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 216.330563][ T8470] RIP: 0023:0xf7fc2fec [ 216.330581][ T8470] Code: Unable to access opcode bytes at 0xf7fc2fc2. [ 216.330589][ T8470] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 216.330606][ T8470] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 216.330617][ T8470] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 216.330627][ T8470] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 216.330636][ T8470] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 216.330646][ T8470] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 216.330668][ T8470] [ 216.530191][ T8477] syzkaller0: entered promiscuous mode [ 216.532172][ T8477] syzkaller0: entered allmulticast mode [ 216.772874][ T8486] FAULT_INJECTION: forcing a failure. [ 216.772874][ T8486] name failslab, interval 1, probability 0, space 0, times 0 [ 216.777887][ T8486] CPU: 1 UID: 0 PID: 8486 Comm: syz.2.637 Tainted: G L syzkaller #0 PREEMPT(full) [ 216.777911][ T8486] Tainted: [L]=SOFTLOCKUP [ 216.777914][ T8486] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 216.777923][ T8486] Call Trace: [ 216.777929][ T8486] [ 216.777935][ T8486] dump_stack_lvl+0x100/0x190 [ 216.777963][ T8486] should_fail_ex.cold+0x5/0xa [ 216.777983][ T8486] should_failslab+0xc2/0x120 [ 216.777998][ T8486] kmem_cache_alloc_noprof+0x92/0x6a0 [ 216.778022][ T8486] ? do_getname+0x35/0x390 [ 216.778052][ T8486] do_getname+0x35/0x390 [ 216.778073][ T8486] user_path_at+0x26/0x60 [ 216.778092][ T8486] __ia32_sys_mount+0x1fb/0x310 [ 216.778111][ T8486] ? __pfx___ia32_sys_mount+0x10/0x10 [ 216.778128][ T8486] ? ksys_write+0x1ac/0x250 [ 216.778150][ T8486] ? __pfx_ksys_write+0x10/0x10 [ 216.778171][ T8486] __do_fast_syscall_32+0x13a/0x8b0 [ 216.778192][ T8486] ? lockdep_hardirqs_on+0x7d/0x110 [ 216.778214][ T8486] do_fast_syscall_32+0x32/0x70 [ 216.778235][ T8486] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 216.778253][ T8486] RIP: 0023:0xf6ffefec [ 216.778270][ T8486] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 216.778277][ T8486] RSP: 002b:00000000f53cc50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 216.778293][ T8486] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000700 [ 216.778304][ T8486] RDX: 0000000000000000 RSI: 0000000000080000 RDI: 0000000000000000 [ 216.778314][ T8486] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 216.778323][ T8486] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 216.778331][ T8486] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 216.778347][ T8486] [ 217.038545][ T8490] __nla_validate_parse: 1 callbacks suppressed [ 217.038557][ T8490] netlink: 20 bytes leftover after parsing attributes in process `syz.3.638'. [ 217.354825][ T5903] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 217.505179][ T5903] usb 9-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 217.508988][ T5903] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 217.512998][ T5903] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.517220][ T5903] usb 9-1: config 0 descriptor?? [ 217.521271][ T5903] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 217.552239][ T8498] syzkaller0: entered promiscuous mode [ 217.554115][ T8498] syzkaller0: entered allmulticast mode [ 217.828641][ T8506] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 217.839120][ T8506] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.159885][ T8513] netlink: 8 bytes leftover after parsing attributes in process `syz.4.639'. [ 218.434830][ T2324] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 218.694783][ T10] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 218.845407][ T10] usb 8-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice= 1.00 [ 218.850201][ T10] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 218.854054][ T10] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 5 [ 218.858988][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.866956][ T8524] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 218.870142][ T8524] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 218.875749][ T10] cyberjack 8-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 218.885214][ T10] usb 8-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 219.097893][ T10] usb 8-1: USB disconnect, device number 11 [ 219.114648][ T10] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 219.120879][ T10] cyberjack 8-1:1.0: device disconnected [ 219.139906][ T6038] usb 9-1: USB disconnect, device number 15 [ 219.474783][ T9] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 219.626290][ T9] usb 5-1: New USB device found, idVendor=1df7, idProduct=2500, bcdDevice= 1.00 [ 219.630862][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 219.634203][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.822179][ T8544] netlink: 20 bytes leftover after parsing attributes in process `syz.4.652'. [ 220.113670][ T8550] netlink: 64 bytes leftover after parsing attributes in process `syz.2.653'. [ 220.119116][ T8550] netlink: 92 bytes leftover after parsing attributes in process `syz.2.653'. [ 220.713755][ T9] msi2500 5-1:1.0: Registered as swradio24 [ 220.724768][ T9] msi2500 5-1:1.0: SDR API is still slightly experimental and functionality changes may follow [ 220.729740][ T9] usb 5-1: USB disconnect, device number 12 [ 220.872829][ T8557] netlink: 12 bytes leftover after parsing attributes in process `syz.3.656'. [ 220.876421][ T8557] trusted_key: encrypted_key: master key parameter is missing [ 221.030135][ T8550] syz.2.653 (8550) used greatest stack depth: 19000 bytes left [ 221.083441][ T42] audit: type=1804 audit(1787649033.368:71): pid=8567 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.659" name="/newroot/154/file1" dev="tmpfs" ino=888 res=1 errno=0 [ 221.284806][ T2324] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 221.343177][ T8579] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(9) [ 221.345030][ T8579] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 221.348908][ T8579] vhci_hcd vhci_hcd.0: Device attached [ 221.434850][ T2324] usb 8-1: Using ep0 maxpacket: 16 [ 221.439264][ T2324] usb 8-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 221.443918][ T2324] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 221.450532][ T2324] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 221.454868][ T2324] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 221.462028][ T2324] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.467808][ T2324] usb 8-1: config 0 descriptor?? [ 221.544730][ T1485] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 221.544786][ T10] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 221.614990][ T6038] usb 38-1: SetAddress Request (2) to port 0 [ 221.617898][ T6038] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 221.696768][ T1485] usb 9-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 221.701158][ T1485] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 221.705195][ T1485] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 221.705243][ T10] usb 7-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 221.712723][ T1485] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 221.712736][ T10] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 221.716038][ T1485] usb 9-1: SerialNumber: syz [ 221.720035][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.730284][ T10] usb 7-1: config 0 descriptor?? [ 221.735693][ T10] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 221.919791][ T8580] vhci_hcd: connection reset by peer [ 221.925593][ T13] vhci_hcd vhci_hcd.0: stop threads [ 221.927241][ T13] vhci_hcd vhci_hcd.0: release socket [ 221.931030][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 221.933556][ T8578] netlink: 4 bytes leftover after parsing attributes in process `syz.4.662'. [ 221.937894][ T8578] netlink: 12 bytes leftover after parsing attributes in process `syz.4.662'. [ 221.943920][ T8578] netlink: 8 bytes leftover after parsing attributes in process `syz.4.662'. [ 221.948294][ T8578] netlink: 36 bytes leftover after parsing attributes in process `syz.4.662'. [ 221.993386][ T8583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.996523][ T8583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 222.105306][ T8583] netlink: 8 bytes leftover after parsing attributes in process `syz.2.661'. [ 222.114701][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 222.832534][ T8588] netlink: 20 bytes leftover after parsing attributes in process `syz.4.663'. [ 223.093337][ T1485] usb 9-1: USB disconnect, device number 16 [ 223.468764][ T8579] orangefs_mount: mount request failed with -4 [ 223.532649][ T10] usb 7-1: USB disconnect, device number 19 [ 223.808024][ T8598] netlink: 12 bytes leftover after parsing attributes in process `syz.4.666'. [ 223.813528][ T8598] trusted_key: encrypted_key: master key parameter is missing [ 224.001716][ T8603] mmap: syz.4.668 (8603) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 224.425434][ T2324] usbhid 8-1:0.0: can't add hid device: -71 [ 224.428531][ T2324] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 224.433108][ T2324] usb 8-1: USB disconnect, device number 12 [ 224.599616][ T8615] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 224.974093][ T8621] netlink: 20 bytes leftover after parsing attributes in process `syz.4.673'. [ 225.526690][ T8626] netlink: 12 bytes leftover after parsing attributes in process `syz.3.675'. [ 225.530202][ T8626] trusted_key: encrypted_key: master key parameter is missing [ 225.885191][ T24] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 226.115313][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 226.123801][ T24] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 226.136724][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 226.142188][ T24] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 226.150357][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.188255][ T24] usb 5-1: config 0 descriptor?? [ 226.240010][ T24] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 226.575282][ T24] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 226.684763][ T6038] usb 38-1: device descriptor read/8, error -110 [ 226.738253][ T24] usb 9-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 226.757802][ T24] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 226.763218][ T24] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.827884][ T24] usb 9-1: config 0 descriptor?? [ 226.862173][ T24] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 227.075256][ T6038] usb usb38-port1: attempt power cycle [ 227.112184][ T8643] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 227.121023][ T8641] netlink: 4 bytes leftover after parsing attributes in process `syz.0.677'. [ 227.133445][ T8643] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 227.345739][ T8645] netlink: 8 bytes leftover after parsing attributes in process `syz.4.678'. [ 227.447322][ T8647] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 227.651081][ T6038] usb usb38-port1: unable to enumerate USB device [ 227.760765][ T8655] sctp: [Deprecated]: syz.2.683 (pid 8655) Use of int in max_burst socket option. [ 227.760765][ T8655] Use struct sctp_assoc_value instead [ 228.005481][ T8657] 9p: Bad value for 'rfdno' [ 228.008856][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x4255 instead [ 228.012554][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0001 instead [ 228.016082][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0x90a7 instead [ 228.019365][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000003c: 0xac45 instead [ 228.023101][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000040: 0x4255 instead [ 228.026613][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000044: 0x0101 instead [ 228.029903][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000048: 0xff7f instead [ 228.033102][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000007c: 0xb365 instead [ 228.036583][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000128: 0x16f1 instead [ 228.040833][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000001d4: 0x16f1 instead [ 228.047290][ T8657] jffs2: Further such events for this erase block will not be printed [ 228.050968][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001000: 0x4255 instead [ 228.055415][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001004: 0x0001 instead [ 228.059275][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001018: 0x90a7 instead [ 228.062643][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000103c: 0xac45 instead [ 228.066302][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001040: 0x4255 instead [ 228.069663][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001044: 0x0101 instead [ 228.073341][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001048: 0xff7f instead [ 228.076800][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000107c: 0xef7b instead [ 228.080159][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001128: 0x16f1 instead [ 228.083912][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000011d4: 0x16f1 instead [ 228.088962][ T8657] jffs2: Further such events for this erase block will not be printed [ 228.091899][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002000: 0x4255 instead [ 228.095290][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002004: 0x0001 instead [ 228.098535][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002018: 0x90a7 instead [ 228.101832][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000203c: 0xac45 instead [ 228.106146][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003000: 0x4255 instead [ 228.109444][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003004: 0x0001 instead [ 228.113093][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003018: 0x90a7 instead [ 228.116535][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000303c: 0xac45 instead [ 228.119837][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004000: 0x4255 instead [ 228.122961][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004004: 0x0001 instead [ 228.128843][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004018: 0x90a7 instead [ 228.132393][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000403c: 0xac45 instead [ 228.135814][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005000: 0x4255 instead [ 228.139226][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005004: 0x0001 instead [ 228.142593][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005018: 0x90a7 instead [ 228.146172][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000503c: 0xac45 instead [ 228.149562][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006000: 0x4255 instead [ 228.152896][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006004: 0x0001 instead [ 228.156513][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006018: 0x90a7 instead [ 228.159945][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000603c: 0xac45 instead [ 228.163321][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007000: 0x4255 instead [ 228.166882][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007004: 0x0001 instead [ 228.170422][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007018: 0x90a7 instead [ 228.173752][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000703c: 0xac45 instead [ 228.178025][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008000: 0x4255 instead [ 228.181395][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008004: 0x0001 instead [ 228.185440][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008018: 0x90a7 instead [ 228.189329][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000803c: 0xac45 instead [ 228.192468][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009000: 0x4255 instead [ 228.197956][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009004: 0x0001 instead [ 228.201173][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009018: 0x90a7 instead [ 228.204297][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000903c: 0xac45 instead [ 228.208136][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a000: 0x4255 instead [ 228.211562][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a004: 0x0001 instead [ 228.215101][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a018: 0x90a7 instead [ 228.218749][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a03c: 0xac45 instead [ 228.222017][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b000: 0x4255 instead [ 228.225681][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b004: 0x0001 instead [ 228.229241][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b018: 0x90a7 instead [ 228.232425][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b03c: 0xac45 instead [ 228.235923][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c000: 0x4255 instead [ 228.240190][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c004: 0x0001 instead [ 228.244600][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c018: 0x90a7 instead [ 228.249023][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c03c: 0xac45 instead [ 228.253581][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d000: 0x4255 instead [ 228.257842][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d004: 0x0001 instead [ 228.261883][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d018: 0x90a7 instead [ 228.266208][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d03c: 0xac45 instead [ 228.270529][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e000: 0x4255 instead [ 228.275265][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e004: 0x0001 instead [ 228.279811][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e018: 0x90a7 instead [ 228.284080][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e03c: 0xac45 instead [ 228.288460][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f000: 0x4255 instead [ 228.292782][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f004: 0x0001 instead [ 228.297034][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f018: 0x90a7 instead [ 228.301193][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f03c: 0xac45 instead [ 228.308647][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x4255 instead [ 228.313132][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0x0001 instead [ 228.317479][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0x90a7 instead [ 228.322031][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001003c: 0xac45 instead [ 228.326732][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011000: 0x4255 instead [ 228.330941][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011004: 0x0001 instead [ 228.335352][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011018: 0x90a7 instead [ 228.339653][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001103c: 0xac45 instead [ 228.343875][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012000: 0x4255 instead [ 228.348172][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012004: 0x0001 instead [ 228.352149][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012018: 0x90a7 instead [ 228.356096][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001203c: 0xac45 instead [ 228.359644][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013000: 0x4255 instead [ 228.362775][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013004: 0x0001 instead [ 228.366060][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013018: 0x90a7 instead [ 228.369236][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001303c: 0xac45 instead [ 228.372829][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014000: 0x4255 instead [ 228.376383][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014004: 0x0001 instead [ 228.379944][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014018: 0x90a7 instead [ 228.384319][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001403c: 0xac45 instead [ 228.388101][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015000: 0x4255 instead [ 228.392253][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015004: 0x0001 instead [ 228.396678][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015018: 0x90a7 instead [ 228.399963][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001503c: 0xac45 instead [ 228.403185][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016000: 0x4255 instead [ 228.406896][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016004: 0x0001 instead [ 228.410144][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016018: 0x90a7 instead [ 228.413248][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001603c: 0xac45 instead [ 228.420377][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017000: 0x4255 instead [ 228.423654][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017004: 0x0001 instead [ 228.427729][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017018: 0x90a7 instead [ 228.431143][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001703c: 0xac45 instead [ 228.435213][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0x4255 instead [ 228.438412][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0x0001 instead [ 228.441758][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0x90a7 instead [ 228.445280][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001803c: 0xac45 instead [ 228.448973][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x4255 instead [ 228.452553][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0x0001 instead [ 228.456047][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0x90a7 instead [ 228.461400][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001903c: 0xac45 instead [ 228.464844][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x4255 instead [ 228.468059][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x0001 instead [ 228.471185][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0x90a7 instead [ 228.474424][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a03c: 0xac45 instead [ 228.477856][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x4255 instead [ 228.481627][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x0001 instead [ 228.485174][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0x90a7 instead [ 228.488930][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b03c: 0xac45 instead [ 228.492147][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0x4255 instead [ 228.495442][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x0001 instead [ 228.498860][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0x90a7 instead [ 228.502297][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c03c: 0xac45 instead [ 228.505694][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0x4255 instead [ 228.508936][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x0001 instead [ 228.512269][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0x90a7 instead [ 228.515674][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d03c: 0xac45 instead [ 228.519105][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0x4255 instead [ 228.522455][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x0001 instead [ 228.527956][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0x90a7 instead [ 228.531332][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0xac45 instead [ 228.535029][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead [ 228.538679][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead [ 228.542701][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0x90a7 instead [ 228.546076][ T8657] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0xac45 instead [ 228.550304][ T8657] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 228.554218][ T8657] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 228.627095][ T8660] netlink: 12 bytes leftover after parsing attributes in process `syz.2.685'. [ 228.630111][ T8660] netlink: 12 bytes leftover after parsing attributes in process `syz.2.685'. [ 228.633057][ T8660] netlink: 12 bytes leftover after parsing attributes in process `syz.2.685'. [ 228.637603][ T8660] netlink: 12 bytes leftover after parsing attributes in process `syz.2.685'. [ 228.641155][ T8660] netlink: 12 bytes leftover after parsing attributes in process `syz.2.685'. [ 228.645821][ T8660] netlink: 12 bytes leftover after parsing attributes in process `syz.2.685'. [ 228.650318][ T8660] netlink: 12 bytes leftover after parsing attributes in process `syz.2.685'. [ 228.659115][ T8660] netlink: 12 bytes leftover after parsing attributes in process `syz.2.685'. [ 228.676235][ T8660] trusted_key: encrypted_key: master key parameter is missing [ 228.689697][ T2324] usb 5-1: USB disconnect, device number 13 [ 229.219608][ T41] usb 9-1: USB disconnect, device number 17 [ 229.497880][ T8675] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 229.501943][ T8675] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 229.504546][ T8675] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 229.775548][ T8688] virt_wifi0 speed is unknown, defaulting to 1000 [ 230.684119][ T10] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 230.845964][ T10] usb 8-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 230.847577][ T10] usb 8-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 230.847656][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.856939][ T10] usb 8-1: config 0 descriptor?? [ 230.864551][ T10] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 231.119620][ T8719] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 231.147853][ T8715] bond1 (unregistering): Released all slaves [ 231.149623][ T8719] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 231.463293][ T8724] FAULT_INJECTION: forcing a failure. [ 231.463293][ T8724] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 231.473918][ T8724] CPU: 0 UID: 0 PID: 8724 Comm: syz.4.704 Tainted: G L syzkaller #0 PREEMPT(full) [ 231.473948][ T8724] Tainted: [L]=SOFTLOCKUP [ 231.473952][ T8724] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 231.473958][ T8724] Call Trace: [ 231.473962][ T8724] [ 231.473967][ T8724] dump_stack_lvl+0x100/0x190 [ 231.473986][ T8724] should_fail_ex.cold+0x5/0xa [ 231.474000][ T8724] _copy_from_user+0x2e/0xd0 [ 231.474014][ T8724] get_compat_msghdr+0xb3/0x480 [ 231.474031][ T8724] ? __pfx_get_compat_msghdr+0x10/0x10 [ 231.474051][ T8724] ___sys_sendmsg+0x1b6/0x1e0 [ 231.474068][ T8724] ? __pfx____sys_sendmsg+0x10/0x10 [ 231.474091][ T8724] ? find_held_lock+0x2b/0x80 [ 231.474109][ T8724] __sys_sendmsg+0x160/0x210 [ 231.474122][ T8724] ? __pfx___sys_sendmsg+0x10/0x10 [ 231.474138][ T8724] ? __pfx_ksys_write+0x10/0x10 [ 231.474161][ T8724] __do_fast_syscall_32+0x13a/0x8b0 [ 231.474176][ T8724] ? lockdep_hardirqs_on+0x7d/0x110 [ 231.474190][ T8724] do_fast_syscall_32+0x32/0x70 [ 231.474204][ T8724] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 231.474218][ T8724] RIP: 0023:0xf7fc2fec [ 231.474230][ T8724] Code: Unable to access opcode bytes at 0xf7fc2fc2. [ 231.474235][ T8724] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 231.474245][ T8724] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000100 [ 231.474252][ T8724] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 231.474258][ T8724] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 231.474264][ T8724] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 231.474270][ T8724] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 231.474283][ T8724] [ 232.851070][ T8740] FAULT_INJECTION: forcing a failure. [ 232.851070][ T8740] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 232.863041][ T8740] CPU: 1 UID: 0 PID: 8740 Comm: syz.0.709 Tainted: G L syzkaller #0 PREEMPT(full) [ 232.863072][ T8740] Tainted: [L]=SOFTLOCKUP [ 232.863076][ T8740] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 232.863082][ T8740] Call Trace: [ 232.863086][ T8740] [ 232.863090][ T8740] dump_stack_lvl+0x100/0x190 [ 232.863107][ T8740] should_fail_ex.cold+0x5/0xa [ 232.863121][ T8740] _copy_from_user+0x2e/0xd0 [ 232.863135][ T8740] get_compat_msghdr+0xb3/0x480 [ 232.863156][ T8740] ? __pfx_get_compat_msghdr+0x10/0x10 [ 232.863171][ T8740] ? do_raw_spin_unlock+0x145/0x1e0 [ 232.863188][ T8740] ? debug_object_assert_init+0x1c4/0x310 [ 232.863216][ T8740] ? rcu_is_watching+0x13/0xc0 [ 232.863234][ T8740] ___sys_sendmsg+0x1b6/0x1e0 [ 232.863252][ T8740] ? __pfx____sys_sendmsg+0x10/0x10 [ 232.863275][ T8740] ? find_held_lock+0x2b/0x80 [ 232.863292][ T8740] __sys_sendmsg+0x160/0x210 [ 232.863306][ T8740] ? __pfx___sys_sendmsg+0x10/0x10 [ 232.863325][ T8740] __do_fast_syscall_32+0x13a/0x8b0 [ 232.863340][ T8740] ? lockdep_hardirqs_on+0x7d/0x110 [ 232.863354][ T8740] do_fast_syscall_32+0x32/0x70 [ 232.863368][ T8740] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 232.863382][ T8740] RIP: 0023:0xf701efec [ 232.863394][ T8740] Code: Unable to access opcode bytes at 0xf701efc2. [ 232.863398][ T8740] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 232.863409][ T8740] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800001c0 [ 232.863416][ T8740] RDX: 0000000000008804 RSI: 0000000000000000 RDI: 0000000000000000 [ 232.863422][ T8740] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 232.863428][ T8740] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 232.863434][ T8740] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 232.863447][ T8740] [ 233.328841][ T8753] syzkaller0: entered promiscuous mode [ 233.330579][ T8753] syzkaller0: entered allmulticast mode [ 233.646833][ T8767] __nla_validate_parse: 5 callbacks suppressed [ 233.646851][ T8767] netlink: 4 bytes leftover after parsing attributes in process `syz.4.716'. [ 233.715923][ T8771] virt_wifi0 speed is unknown, defaulting to 1000 [ 233.959407][ T41] usb 8-1: USB disconnect, device number 13 [ 234.312095][ T8794] netlink: 44 bytes leftover after parsing attributes in process `syz.3.726'. [ 234.806817][ T2324] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 234.978260][ T2324] usb 8-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 234.989984][ T2324] usb 8-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 234.994075][ T2324] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 235.011059][ T2324] usb 8-1: config 0 descriptor?? [ 235.063409][ T2324] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 235.312328][ T8821] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.316410][ T8821] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.621557][ T8821] netlink: 8 bytes leftover after parsing attributes in process `syz.3.729'. [ 235.838187][ T8835] syzkaller0: entered promiscuous mode [ 235.840072][ T8835] syzkaller0: entered allmulticast mode [ 236.180569][ T8839] netlink: 64 bytes leftover after parsing attributes in process `syz.0.739'. [ 237.438466][ T8864] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 237.503086][ T8869] FAULT_INJECTION: forcing a failure. [ 237.503086][ T8869] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 237.507472][ T8869] CPU: 1 UID: 0 PID: 8869 Comm: syz.2.749 Tainted: G L syzkaller #0 PREEMPT(full) [ 237.507489][ T8869] Tainted: [L]=SOFTLOCKUP [ 237.507493][ T8869] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 237.507499][ T8869] Call Trace: [ 237.507503][ T8869] [ 237.507507][ T8869] dump_stack_lvl+0x100/0x190 [ 237.507525][ T8869] should_fail_ex.cold+0x5/0xa [ 237.507544][ T8869] _copy_from_iter+0x1f4/0x1690 [ 237.507559][ T8869] ? __lock_acquire+0x4c5/0x1ec0 [ 237.507572][ T8869] ? __lock_acquire+0x4c5/0x1ec0 [ 237.507586][ T8869] ? __pfx__copy_from_iter+0x10/0x10 [ 237.507600][ T8869] ? _parse_integer_limit+0x1ac/0x220 [ 237.507622][ T8869] tun_get_user+0x265/0x3cc0 [ 237.507637][ T8869] ? aa_file_perm+0x7f3/0x14d0 [ 237.507653][ T8869] ? __pfx_tun_get_user+0x10/0x10 [ 237.507668][ T8869] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 237.507689][ T8869] ? find_held_lock+0x2b/0x80 [ 237.507699][ T8869] ? tun_get+0x191/0x370 [ 237.507709][ T8869] ? tun_get+0x191/0x370 [ 237.507724][ T8869] tun_chr_write_iter+0xdc/0x200 [ 237.507739][ T8869] vfs_write+0x6af/0x1050 [ 237.507755][ T8869] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 237.507770][ T8869] ? __pfx_vfs_write+0x10/0x10 [ 237.507784][ T8869] ? find_held_lock+0x2b/0x80 [ 237.507802][ T8869] ksys_write+0x12a/0x250 [ 237.507818][ T8869] ? __pfx_ksys_write+0x10/0x10 [ 237.507832][ T8869] ? ksys_write+0x1ac/0x250 [ 237.507848][ T8869] ? __pfx_ksys_write+0x10/0x10 [ 237.507866][ T8869] __do_fast_syscall_32+0x13a/0x8b0 [ 237.507880][ T8869] ? lockdep_hardirqs_on+0x7d/0x110 [ 237.507895][ T8869] do_fast_syscall_32+0x32/0x70 [ 237.507910][ T8869] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 237.507924][ T8869] RIP: 0023:0xf6ffefec [ 237.507938][ T8869] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 237.507943][ T8869] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 237.507954][ T8869] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000240 [ 237.507961][ T8869] RDX: 000000000000fdef RSI: 0000000000000000 RDI: 0000000000000000 [ 237.507968][ T8869] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 237.507974][ T8869] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 237.507980][ T8869] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 237.507993][ T8869] [ 237.515280][ T851] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 237.600490][ T5903] usb 8-1: USB disconnect, device number 14 [ 237.758446][ T851] usb 5-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 237.764634][ T851] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 237.771396][ T851] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.805594][ T851] usb 5-1: config 0 descriptor?? [ 237.920787][ T851] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 238.168208][ T8898] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 238.178486][ T8898] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 238.493046][ T8900] netlink: 8 bytes leftover after parsing attributes in process `syz.0.744'. [ 239.609330][ T8908] netlink: 20 bytes leftover after parsing attributes in process `syz.4.755'. [ 240.382690][ T5903] usb 5-1: USB disconnect, device number 14 [ 240.611397][ T8921] netlink: 'syz.3.759': attribute type 9 has an invalid length. [ 240.744800][ T5903] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 240.775654][ T8919] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 240.793640][ T8919] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 240.919106][ T5903] usb 5-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 241.630014][ T5903] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 241.713590][ T5903] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.718230][ T5903] usb 5-1: config 0 descriptor?? [ 241.723448][ T5903] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 241.757483][ T8937] CIFS: VFS: UNC: path must begin with // or \\ [ 241.759247][ T8937] Malformed UNC in devname [ 241.759247][ T8937] [ 241.761129][ T8937] CIFS: VFS: Malformed UNC in devname [ 241.883309][ T8940] netlink: 'syz.4.766': attribute type 1 has an invalid length. [ 241.887270][ T8940] netlink: 4 bytes leftover after parsing attributes in process `syz.4.766'. [ 241.976628][ T8942] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.979969][ T8942] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 242.090727][ T8945] netlink: 8 bytes leftover after parsing attributes in process `syz.0.758'. [ 243.329758][ T8953] binder_alloc: 8951: binder_alloc_buf, no vma [ 243.458086][ T8956] netlink: 20 bytes leftover after parsing attributes in process `syz.4.770'. [ 243.519789][ T851] usb 5-1: USB disconnect, device number 15 [ 243.608748][ T8960] tipc: Started in network mode [ 243.610398][ T8960] tipc: Node identity aea230a5e5a2, cluster identity 4711 [ 243.613092][ T8960] tipc: Enabled bearer , priority 0 [ 243.644457][ T8962] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 243.652916][ T8958] tipc: Disabling bearer [ 244.229359][ T8970] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 244.452002][ T8977] netlink: 64 bytes leftover after parsing attributes in process `syz.3.777'. [ 244.456549][ T8977] netlink: 8 bytes leftover after parsing attributes in process `syz.3.777'. [ 244.459284][ T8977] netlink: 8 bytes leftover after parsing attributes in process `syz.3.777'. [ 244.527356][ T5903] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 244.696576][ T5903] usb 5-1: Using ep0 maxpacket: 8 [ 244.699336][ T5903] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 244.706880][ T5903] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 244.715365][ T5903] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.725450][ T5903] usb 5-1: config 0 descriptor?? [ 244.731778][ T8980] syzkaller0: left promiscuous mode [ 244.938548][ T5903] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 244.953010][ T42] audit: type=1326 audit(1787649057.238:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8986 comm="syz.2.779" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 244.960346][ T42] audit: type=1326 audit(1787649057.248:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8986 comm="syz.2.779" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 244.966917][ T42] audit: type=1326 audit(1787649057.258:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8986 comm="syz.2.779" exe="/syz-executor" sig=0 arch=40000003 syscall=114 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 245.016025][ T8989] netlink: 16 bytes leftover after parsing attributes in process `syz.2.779'. [ 245.031704][ T5737] Bluetooth: hci3: SCO packet for unknown connection handle 201 [ 245.227720][ T42] audit: type=1326 audit(1787649057.518:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8986 comm="syz.2.779" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fff008 code=0x7ffc0000 [ 245.236311][ T42] audit: type=1326 audit(1787649057.528:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8986 comm="syz.2.779" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 245.242201][ T42] audit: type=1326 audit(1787649057.528:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8986 comm="syz.2.779" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 245.275132][ T5903] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 245.444805][ T5903] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 245.447493][ T8994] syzkaller0: entered promiscuous mode [ 245.460883][ T5903] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.467525][ T5903] usb 7-1: Product: syz [ 245.469004][ T5903] usb 7-1: Manufacturer: syz [ 245.473137][ T5903] usb 7-1: SerialNumber: syz [ 245.521110][ T8969] serio: Serial port ptm0 [ 245.544494][ T41] usb 7-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 245.582925][ T34] usb 5-1: USB disconnect, device number 16 [ 245.757777][ T42] audit: type=1326 audit(1787649058.048:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8986 comm="syz.2.779" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 245.764902][ T5886] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 245.765021][ T42] audit: type=1326 audit(1787649058.048:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8986 comm="syz.2.779" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71374eb code=0x7ffc0000 [ 245.915452][ T5886] usb 9-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 245.920024][ T5886] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 245.925049][ T5886] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 245.930305][ T5886] usb 9-1: config 0 descriptor?? [ 245.936376][ T5886] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 245.958135][ T42] audit: type=1326 audit(1787649058.248:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8986 comm="syz.2.779" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 245.964801][ T42] audit: type=1326 audit(1787649058.248:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8986 comm="syz.2.779" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 246.011475][ T8987] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 246.014086][ T8987] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 246.016529][ T8987] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 246.028206][ T8987] netlink: 20 bytes leftover after parsing attributes in process `syz.2.779'. [ 246.110545][ T5886] usb 7-1: USB disconnect, device number 20 [ 246.191936][ T9000] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 246.196445][ T9000] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 246.330814][ T9000] netlink: 8 bytes leftover after parsing attributes in process `syz.4.781'. [ 246.673074][ T41] ath9k_htc 7-1:1.0: ath9k_htc: Target is unresponsive [ 247.142583][ T41] ath9k_htc: Failed to initialize the device [ 247.249120][ T9006] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 247.573252][ T5886] usb 7-1: ath9k_htc: USB layer deinitialized [ 247.886693][ T9010] netlink: 20 bytes leftover after parsing attributes in process `syz.0.785'. [ 248.045265][ T5739] Bluetooth: hci2: command 0x0c1a tx timeout [ 248.047623][ T5737] Bluetooth: hci3: command 0x0c1a tx timeout [ 248.055259][ T5739] Bluetooth: hci1: command 0x0c1a tx timeout [ 248.268106][ T10] usb 9-1: USB disconnect, device number 18 [ 248.340842][ T9015] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(9) [ 248.342879][ T9015] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 248.349610][ T9015] vhci_hcd vhci_hcd.0: Device attached [ 248.538916][ T9019] FAULT_INJECTION: forcing a failure. [ 248.538916][ T9019] name failslab, interval 1, probability 0, space 0, times 0 [ 248.555072][ T9019] CPU: 3 UID: 0 PID: 9019 Comm: syz.3.786 Tainted: G L syzkaller #0 PREEMPT(full) [ 248.555091][ T9019] Tainted: [L]=SOFTLOCKUP [ 248.555095][ T9019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 248.555101][ T9019] Call Trace: [ 248.555105][ T9019] [ 248.555109][ T9019] dump_stack_lvl+0x100/0x190 [ 248.555128][ T9019] should_fail_ex.cold+0x5/0xa [ 248.555142][ T9019] should_failslab+0xc2/0x120 [ 248.555154][ T9019] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 248.555173][ T9019] ? __alloc_skb+0x140/0x710 [ 248.555202][ T9019] __alloc_skb+0x140/0x710 [ 248.555213][ T9019] ? __alloc_skb+0x5b7/0x710 [ 248.555225][ T9019] ? __pfx___alloc_skb+0x10/0x10 [ 248.555236][ T9019] ? genl_rcv_msg+0x4be/0x800 [ 248.555252][ T9019] netlink_ack+0x117/0xb80 [ 248.555266][ T9019] netlink_rcv_skb+0x333/0x420 [ 248.555277][ T9019] ? __pfx_genl_rcv_msg+0x10/0x10 [ 248.555290][ T9019] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 248.555306][ T9019] ? netlink_deliver_tap+0x1ae/0xcc0 [ 248.555324][ T9019] genl_rcv+0x28/0x40 [ 248.555335][ T9019] netlink_unicast+0x585/0x850 [ 248.555347][ T9019] ? __pfx_netlink_unicast+0x10/0x10 [ 248.555362][ T9019] netlink_sendmsg+0x8b0/0xda0 [ 248.555374][ T9019] ? __pfx_netlink_sendmsg+0x10/0x10 [ 248.555387][ T9019] ? apparmor_socket_sendmsg+0x15b/0x270 [ 248.555405][ T9019] ____sys_sendmsg+0xa4d/0xbe0 [ 248.555420][ T9019] ? __pfx_netlink_sendmsg+0x10/0x10 [ 248.555431][ T9019] ? __pfx_____sys_sendmsg+0x10/0x10 [ 248.555453][ T9019] ___sys_sendmsg+0x190/0x1e0 [ 248.555470][ T9019] ? __pfx____sys_sendmsg+0x10/0x10 [ 248.555493][ T9019] ? find_held_lock+0x2b/0x80 [ 248.555512][ T9019] __sys_sendmsg+0x160/0x210 [ 248.555525][ T9019] ? __pfx___sys_sendmsg+0x10/0x10 [ 248.555542][ T9019] ? __pfx_ksys_write+0x10/0x10 [ 248.555560][ T9019] __do_fast_syscall_32+0x13a/0x8b0 [ 248.555574][ T9019] ? lockdep_hardirqs_on+0x7d/0x110 [ 248.555588][ T9019] do_fast_syscall_32+0x32/0x70 [ 248.555602][ T9019] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 248.555616][ T9019] RIP: 0023:0xf7f03fec [ 248.555628][ T9019] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 248.555633][ T9019] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 248.555644][ T9019] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 248.555650][ T9019] RDX: 0000000000040000 RSI: 0000000000000000 RDI: 0000000000000000 [ 248.555656][ T9019] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 248.555662][ T9019] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 248.555668][ T9019] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 248.555681][ T9019] [ 248.566100][ T9016] vhci_hcd: connection closed [ 248.696115][ T5827] vhci_hcd vhci_hcd.2: stop threads [ 248.699713][ T5827] vhci_hcd vhci_hcd.2: release socket [ 248.703599][ T5827] vhci_hcd vhci_hcd.2: disconnect device [ 248.714812][ T1485] usb 42-1: enqueue for inactive port 0 [ 249.206179][ T1485] usb usb42-port1: attempt power cycle [ 249.649813][ T9038] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 249.716842][ T9042] netlink: 12 bytes leftover after parsing attributes in process `syz.4.796'. [ 249.720548][ T9042] trusted_key: encrypted_key: master key parameter is missing [ 249.784728][ T9044] netlink: 12 bytes leftover after parsing attributes in process `syz.4.797'. [ 249.821127][ T1485] usb usb42-port1: unable to enumerate USB device [ 250.404807][ T1485] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 250.468874][ T5739] Bluetooth: hci3: ACL packet too small [ 250.496569][ T5886] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 250.520866][ T9054] netlink: 'syz.2.800': attribute type 2 has an invalid length. [ 250.556246][ T1485] usb 8-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 250.561275][ T1485] usb 8-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 250.566743][ T1485] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.572631][ T1485] usb 8-1: config 0 descriptor?? [ 250.578596][ T1485] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 250.679253][ T9056] virt_wifi0 speed is unknown, defaulting to 1000 [ 250.830166][ T9059] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 250.836747][ T9059] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 251.021516][ T9060] netlink: 8 bytes leftover after parsing attributes in process `syz.3.799'. [ 251.993035][ T9048] netlink: 20 bytes leftover after parsing attributes in process `syz.0.795'. [ 253.033625][ T5886] usb 9-1: device descriptor read/all, error -71 [ 253.091905][ T9067] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 253.193700][ T9072] netlink: 12 bytes leftover after parsing attributes in process `syz.4.805'. [ 253.199842][ T9072] trusted_key: encrypted_key: master key parameter is missing [ 254.180708][ T5886] usb 8-1: USB disconnect, device number 15 [ 255.242188][ T1434] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.288427][ T9094] netlink: 20 bytes leftover after parsing attributes in process `syz.3.811'. [ 255.395452][ T1434] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.499253][ T9099] netlink: 17780 bytes leftover after parsing attributes in process `syz.2.812'. [ 255.833993][ T9103] syzkaller0: entered promiscuous mode [ 255.840564][ T9103] syzkaller0: entered allmulticast mode [ 256.057063][ T9106] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 257.158186][ T9118] netlink: 8 bytes leftover after parsing attributes in process `syz.3.817'. [ 257.166917][ T9118] netlink: 8 bytes leftover after parsing attributes in process `syz.3.817'. [ 257.170189][ T9118] netlink: 8 bytes leftover after parsing attributes in process `syz.3.817'. [ 257.173721][ T9118] netlink: 8 bytes leftover after parsing attributes in process `syz.3.817'. [ 257.179662][ T9118] netlink: 8 bytes leftover after parsing attributes in process `syz.3.817'. [ 257.975668][ T5903] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 258.004520][ T9129] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 258.105366][ T5903] usb 5-1: device descriptor read/64, error -71 [ 258.134423][ T9135] netlink: 24 bytes leftover after parsing attributes in process `syz.3.825'. [ 258.138122][ T9135] netlink: 24 bytes leftover after parsing attributes in process `syz.3.825'. [ 258.172288][ T5741] overlayfs: failed lookup in lower (newroot/225, name='bus', err=-40): overlapping layers [ 258.177517][ T5741] overlayfs: failed lookup in lower (newroot/225, name='bus', err=-40): overlapping layers [ 258.234865][ T2324] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 258.294901][ T851] usb 7-1: new full-speed USB device number 21 using dummy_hcd [ 258.344959][ T5903] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 258.385553][ T2324] usb 9-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 258.390006][ T2324] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 258.394075][ T2324] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 258.411350][ T9128] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 258.415908][ T2324] opticon 9-1:1.0: opticon converter detected [ 258.421058][ T2324] usb 9-1: opticon converter now attached to ttyUSB0 [ 258.480112][ T5903] usb 5-1: device descriptor read/64, error -71 [ 258.491384][ T851] usb 7-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 258.493167][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.512006][ T851] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 258.518838][ T851] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 258.522963][ T851] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 258.530401][ T851] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.533694][ T851] usb 7-1: Product: syz [ 258.535477][ T851] usb 7-1: Manufacturer: syz [ 258.537395][ T851] usb 7-1: SerialNumber: syz [ 258.540405][ T851] usb 7-1: config 0 descriptor?? [ 258.543019][ T9131] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 258.588574][ T5903] usb usb5-port1: attempt power cycle [ 258.595426][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.598316][ T851] rc_core: IR keymap rc-streamzap not found [ 258.606236][ T851] Registered IR keymap rc-empty [ 258.623928][ T851] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0 [ 258.636231][ T851] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0/input24 [ 258.680283][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.744603][ T5737] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 258.754911][ T5737] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 258.758634][ T5737] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 258.763803][ T5737] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 258.768838][ T5737] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 258.775547][ T41] usb 7-1: USB disconnect, device number 21 [ 258.789384][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.925065][ T5903] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 258.946671][ T5903] usb 5-1: device descriptor read/8, error -71 [ 259.090086][ T10] usb 9-1: USB disconnect, device number 21 [ 259.097716][ T13] bond0 (unregistering): (slave macvlan1): Releasing backup interface [ 259.099459][ T10] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 259.104851][ T10] opticon 9-1:1.0: device disconnected [ 259.106243][ T13] bond0 (unregistering): Released all slaves [ 259.114903][ T13] bond1 (unregistering): Released all slaves [ 259.186917][ T5903] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 259.205641][ T5903] usb 5-1: device descriptor read/8, error -71 [ 259.208465][ T13] tipc: Disabling bearer [ 259.215762][ T13] tipc: Left network mode [ 259.239510][ T9140] virt_wifi0 speed is unknown, defaulting to 1000 [ 259.306377][ T5447] 8021q: adding VLAN 0 to HW filter on device eth6 [ 259.329726][ T5903] usb usb5-port1: unable to enumerate USB device [ 259.378311][ T9140] bridge0: port 1(bridge_slave_0) entered blocking state [ 259.380596][ T9140] bridge0: port 1(bridge_slave_0) entered disabled state [ 259.382805][ T9140] bridge_slave_0: entered allmulticast mode [ 259.385373][ T9140] bridge_slave_0: entered promiscuous mode [ 259.388528][ T9140] bridge0: port 2(bridge_slave_1) entered blocking state [ 259.390878][ T9140] bridge0: port 2(bridge_slave_1) entered disabled state [ 259.393100][ T9140] bridge_slave_1: entered allmulticast mode [ 259.397323][ T9140] bridge_slave_1: entered promiscuous mode [ 259.444217][ T9140] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 259.451431][ T9140] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 259.477187][ T9140] team0: Port device team_slave_0 added [ 259.481724][ T9140] team0: Port device team_slave_1 added [ 259.502715][ T9140] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 259.507802][ T9140] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 259.517845][ T9140] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 259.529368][ T5447] 8021q: adding VLAN 0 to HW filter on device eth7 [ 259.540874][ T9140] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 259.543685][ T9140] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 259.552335][ T9140] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 259.586460][ T9140] hsr_slave_0: entered promiscuous mode [ 259.588891][ T9140] hsr_slave_1: entered promiscuous mode [ 259.591092][ T9140] debugfs: 'hsr0' already exists in 'hsr' [ 259.593040][ T9140] Cannot create hsr debugfs directory [ 259.681366][ T9177] netlink: 8 bytes leftover after parsing attributes in process `syz.4.830'. [ 259.691145][ T9177] netlink: 4 bytes leftover after parsing attributes in process `syz.4.830'. [ 259.696189][ T9177] netlink: 'syz.4.830': attribute type 11 has an invalid length. [ 259.771541][ T5447] 8021q: adding VLAN 0 to HW filter on device eth8 [ 259.776842][ T9177] syzkaller0: entered promiscuous mode [ 259.778607][ T9177] syzkaller0: entered allmulticast mode [ 259.839384][ T9140] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 259.844313][ T9140] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 259.848508][ T9140] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 259.855121][ T9140] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 259.858014][ T9140] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 259.862216][ T9140] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 259.870794][ T9140] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 259.886224][ T9140] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 259.923027][ T9193] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 259.933220][ T9140] bridge0: port 2(bridge_slave_1) entered blocking state [ 259.935477][ T9140] bridge0: port 2(bridge_slave_1) entered forwarding state [ 259.937831][ T9140] bridge0: port 1(bridge_slave_0) entered blocking state [ 259.940087][ T9140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 259.951587][ T5447] 8021q: adding VLAN 0 to HW filter on device eth9 [ 260.007951][ T9140] 8021q: adding VLAN 0 to HW filter on device bond0 [ 260.018927][ T7296] bridge0: port 1(bridge_slave_0) entered disabled state [ 260.022578][ T7296] bridge0: port 2(bridge_slave_1) entered disabled state [ 260.037422][ T9140] 8021q: adding VLAN 0 to HW filter on device team0 [ 260.056298][ T7296] bridge0: port 1(bridge_slave_0) entered blocking state [ 260.058560][ T7296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 260.061759][ T7296] bridge0: port 2(bridge_slave_1) entered blocking state [ 260.064167][ T7296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 260.234829][ T5903] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 260.378851][ T9140] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 260.387375][ T5903] usb 9-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 260.391049][ T5903] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 260.394991][ T5903] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 260.400493][ T5903] usb 9-1: config 0 descriptor?? [ 260.404585][ T5903] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 260.533739][ T9140] veth0_vlan: entered promiscuous mode [ 260.540673][ T9140] veth1_vlan: entered promiscuous mode [ 260.575919][ T9140] veth0_macvtap: entered promiscuous mode [ 260.581225][ T9140] veth1_macvtap: entered promiscuous mode [ 260.590149][ T9140] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 260.599537][ T9140] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 260.704861][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.708206][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.711107][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.713875][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.844825][ T5737] Bluetooth: hci2: command tx timeout [ 261.056562][ T9223] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 261.062745][ T9223] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 261.066298][ T9223] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 261.068290][ T9223] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 261.072818][ T9223] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 261.079247][ T9230] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 261.084261][ T9230] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 261.224620][ T9244] netlink: 8 bytes leftover after parsing attributes in process `syz.4.833'. [ 261.516701][ T60] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 261.685420][ T60] usb 7-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 261.689572][ T60] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 261.694485][ T60] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 261.701347][ T60] usb 7-1: config 0 descriptor?? [ 261.712708][ T60] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 261.909063][ T9248] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 261.914615][ T9248] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 261.920118][ T13] team0 (unregistering): Port device dummy0 removed [ 262.011960][ T7297] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 262.024908][ T7297] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 262.300488][ T7297] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 262.304710][ T7297] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 262.534936][ T5737] Bluetooth: hci1: command 0x0c1a tx timeout [ 263.094797][ T5737] Bluetooth: hci2: command 0x040f tx timeout [ 263.094831][ T5739] Bluetooth: hci3: command 0x0c1a tx timeout [ 263.488613][ T5903] usb 9-1: USB disconnect, device number 22 [ 263.722716][ T9262] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 263.786969][ T13] IPVS: stop unused estimator thread 0... [ 263.830803][ T9263] __nla_validate_parse: 1 callbacks suppressed [ 263.830839][ T9263] netlink: 20 bytes leftover after parsing attributes in process `syz.0.839'. [ 264.700924][ T60] usb 7-1: USB disconnect, device number 22 [ 265.164784][ T5737] Bluetooth: hci2: command 0x040f tx timeout [ 265.188307][ T9291] virt_wifi0 speed is unknown, defaulting to 1000 [ 265.194876][ T851] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 265.344742][ T5903] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 265.365031][ T851] usb 5-1: Using ep0 maxpacket: 32 [ 265.378305][ T851] usb 5-1: unable to get BOS descriptor or descriptor too short [ 265.387137][ T851] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 265.400200][ T851] usb 5-1: string descriptor 0 read error: -22 [ 265.402128][ T851] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.417465][ T851] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 265.425484][ T851] dw2102: su3000_power_ctrl: 1, initialized 0 [ 265.427379][ T851] dvb-usb: bulk message failed: -22 (2/0) [ 265.453128][ T851] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 265.463111][ T851] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 265.469815][ T851] usb 5-1: media controller created [ 265.477234][ T851] dvb-usb: bulk message failed: -22 (6/0) [ 265.478965][ T851] dw2102: i2c transfer failed. [ 265.484945][ T851] dvb-usb: bulk message failed: -22 (6/0) [ 265.490220][ T851] dw2102: i2c transfer failed. [ 265.494053][ T851] dvb-usb: bulk message failed: -22 (6/0) [ 265.499531][ T851] dw2102: i2c transfer failed. [ 265.503380][ T851] dvb-usb: bulk message failed: -22 (6/0) [ 265.505419][ T851] dw2102: i2c transfer failed. [ 265.511573][ T851] dvb-usb: bulk message failed: -22 (6/0) [ 265.513384][ T851] dw2102: i2c transfer failed. [ 265.515187][ T5903] usb 10-1: Using ep0 maxpacket: 8 [ 265.519121][ T5903] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 265.519942][ T851] dvb-usb: bulk message failed: -22 (6/0) [ 265.528794][ T5903] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 265.530908][ T851] dw2102: i2c transfer failed. [ 265.532799][ T851] dvb-usb: MAC address: 02:02:02:02:02:02 [ 265.535748][ T5903] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 265.545458][ T5903] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 265.553663][ T5903] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 265.555319][ T851] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 265.565376][ T5903] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 265.569157][ T851] dvb-usb: bulk message failed: -22 (3/0) [ 265.572099][ T5903] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.573347][ T851] dw2102: command 0x0e transfer failed. [ 265.578744][ T851] dvb-usb: bulk message failed: -22 (3/0) [ 265.581257][ T851] dw2102: command 0x0e transfer failed. [ 265.828990][ T5903] usb 10-1: usb_control_msg returned -32 [ 265.830812][ T5903] usbtmc 10-1:16.0: can't read capabilities [ 265.898153][ T851] dvb-usb: bulk message failed: -22 (3/0) [ 265.904763][ T851] dw2102: command 0x0e transfer failed. [ 265.906503][ T851] dvb-usb: bulk message failed: -22 (3/0) [ 265.908372][ T851] dw2102: command 0x0e transfer failed. [ 265.910093][ T851] dvb-usb: bulk message failed: -22 (1/0) [ 265.920598][ T851] dw2102: command 0x51 transfer failed. [ 265.940893][ T9283] dvb-usb: bulk message failed: -22 (31/0) [ 265.985683][ T9283] dw2102: i2c transfer failed. [ 265.997647][ T851] DVB: Unable to find symbol ds3000_attach() [ 265.999501][ T851] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 266.054924][ T851] rc_core: IR keymap rc-su3000 not found [ 266.065456][ T851] Registered IR keymap rc-empty [ 266.068165][ T9309] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 266.086038][ T851] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.0/usb5/5-1/rc/rc0 [ 266.091721][ T42] kauditd_printk_skb: 34 callbacks suppressed [ 266.091734][ T42] audit: type=1326 audit(1787649078.378:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9308 comm="syz.4.853" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc2fec code=0x7ffc0000 [ 266.104687][ T851] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.0/usb5/5-1/rc/rc0/input25 [ 266.118748][ T42] audit: type=1326 audit(1787649078.378:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9308 comm="syz.4.853" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc2fec code=0x7ffc0000 [ 266.138299][ T42] audit: type=1326 audit(1787649078.398:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9308 comm="syz.4.853" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc2fec code=0x7ffc0000 [ 266.147876][ T851] dvb-usb: schedule remote query interval to 150 msecs. [ 266.154780][ T42] audit: type=1326 audit(1787649078.398:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9308 comm="syz.4.853" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc2fec code=0x7ffc0000 [ 266.154860][ T851] dw2102: su3000_power_ctrl: 0, initialized 1 [ 266.163613][ T9310] kvm: kvm [9308]: vcpu0, guest rIP: 0x1a3 Unhandled WRMSR(0xc2) = 0x8000 [ 266.166484][ T42] audit: type=1326 audit(1787649078.398:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9308 comm="syz.4.853" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf7fc2fec code=0x7ffc0000 [ 266.166776][ T851] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 266.169186][ T851] usb 5-1: USB disconnect, device number 21 [ 266.183001][ T42] audit: type=1326 audit(1787649078.398:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9308 comm="syz.4.853" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc2fec code=0x7ffc0000 [ 266.184758][ T5903] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 266.191520][ T42] audit: type=1326 audit(1787649078.398:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9308 comm="syz.4.853" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc2fec code=0x7ffc0000 [ 266.201535][ T42] audit: type=1326 audit(1787649078.398:123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9308 comm="syz.4.853" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fc2fec code=0x7ffc0000 [ 266.208858][ T42] audit: type=1326 audit(1787649078.398:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9308 comm="syz.4.853" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc2fec code=0x7ffc0000 [ 266.215908][ T42] audit: type=1326 audit(1787649078.398:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9308 comm="syz.4.853" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc2fec code=0x7ffc0000 [ 266.250251][ T851] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 266.346243][ T9315] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 266.355785][ T5903] usb 7-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 266.372654][ T5903] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 266.376760][ T5903] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.388309][ T9317] syzkaller0: entered promiscuous mode [ 266.388926][ T5903] usb 7-1: config 0 descriptor?? [ 266.390034][ T9317] syzkaller0: entered allmulticast mode [ 266.391689][ T9317] tipc: Started in network mode [ 266.398668][ T5903] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 266.399784][ T9317] tipc: Node identity 325e2ecfe9c1, cluster identity 4711 [ 266.408334][ T9317] tipc: Enabled bearer , priority 0 [ 266.416905][ T9316] tipc: Resetting bearer [ 266.429385][ T9316] tipc: Disabling bearer [ 266.598242][ T9322] usbtmc 10-1:16.0: usb_control_msg returned -32 [ 266.602478][ T9322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.606320][ T9322] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 266.649719][ T9326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.653670][ T9326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 266.734826][ T60] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 266.894954][ T9326] netlink: 8 bytes leftover after parsing attributes in process `syz.2.852'. [ 266.904650][ T9331] netlink: 4 bytes leftover after parsing attributes in process `syz.0.859'. [ 266.910470][ T60] usb 9-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 266.915824][ T60] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 266.920037][ T60] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 266.924808][ T60] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 266.928015][ T60] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 266.932686][ T60] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 266.935442][ T60] usb 9-1: Product: syz [ 266.936876][ T60] usb 9-1: Manufacturer: syz [ 266.943603][ T60] cdc_wdm 9-1:1.0: skipping garbage [ 266.946214][ T60] cdc_wdm 9-1:1.0: skipping garbage [ 266.953238][ T60] cdc_wdm 9-1:1.0: cdc-wdm1: USB WDM device [ 266.955717][ T60] cdc_wdm 9-1:1.0: Unknown control protocol [ 267.148089][ T9321] autofs: Unknown parameter '@' [ 267.154492][ T9321] netlink: 'syz.4.856': attribute type 5 has an invalid length. [ 267.162373][ T60] usb 9-1: USB disconnect, device number 23 [ 267.245119][ T5737] Bluetooth: hci2: command 0x040f tx timeout [ 267.376138][ T9334] overlayfs: failed to resolve './file2': -2 [ 267.788901][ T9339] overlayfs: missing 'lowerdir' [ 267.796171][ T9339] netlink: 'syz.4.860': attribute type 3 has an invalid length. [ 267.816319][ T9339] netlink: 'syz.4.860': attribute type 2 has an invalid length. [ 267.827008][ T9339] : entered promiscuous mode [ 267.836328][ T9340] netlink: 'syz.0.869': attribute type 1 has an invalid length. [ 267.903708][ T9342] 9pnet_virtio: no channels available for device syz [ 267.996816][ T60] usb 10-1: USB disconnect, device number 2 [ 268.078839][ T9340] 8021q: adding VLAN 0 to HW filter on device bond1 [ 268.182290][ T9350] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 268.712542][ T9364] FAULT_INJECTION: forcing a failure. [ 268.712542][ T9364] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 268.716976][ T9364] CPU: 0 UID: 0 PID: 9364 Comm: syz.5.871 Tainted: G L syzkaller #0 PREEMPT(full) [ 268.717005][ T9364] Tainted: [L]=SOFTLOCKUP [ 268.717009][ T9364] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 268.717015][ T9364] Call Trace: [ 268.717019][ T9364] [ 268.717023][ T9364] dump_stack_lvl+0x100/0x190 [ 268.717043][ T9364] should_fail_ex.cold+0x5/0xa [ 268.717056][ T9364] _copy_to_user+0x32/0xd0 [ 268.717071][ T9364] simple_read_from_buffer+0xcb/0x170 [ 268.717089][ T9364] proc_fail_nth_read+0x1af/0x230 [ 268.717104][ T9364] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 268.717120][ T9364] ? rw_verify_area+0xce/0x6d0 [ 268.717134][ T9364] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 268.717149][ T9364] vfs_read+0x1e4/0xb40 [ 268.717166][ T9364] ? __pfx_vfs_read+0x10/0x10 [ 268.717179][ T9364] ? find_held_lock+0x2b/0x80 [ 268.717190][ T9364] ? __fget_files+0x215/0x3d0 [ 268.717208][ T9364] ? __fget_files+0x21f/0x3d0 [ 268.717227][ T9364] ksys_read+0x12a/0x250 [ 268.717242][ T9364] ? __pfx_ksys_read+0x10/0x10 [ 268.717277][ T9364] do_int80_emulation+0x166/0x650 [ 268.717296][ T9364] asm_int80_emulation+0x1a/0x20 [ 268.717307][ T9364] RIP: 0023:0xf71474eb [ 268.717317][ T9364] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 268.717327][ T9364] RSP: 002b:00000000f53e54bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 268.717338][ T9364] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f53e55d0 [ 268.717344][ T9364] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 268.717350][ T9364] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 268.717356][ T9364] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 268.717361][ T9364] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 268.717375][ T9364] [ 269.104786][ T9] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 269.167666][ T60] usb 7-1: USB disconnect, device number 23 [ 269.324752][ T5737] Bluetooth: hci2: command 0x040f tx timeout [ 269.456800][ T9378] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 269.511477][ T9381] netlink: 28 bytes leftover after parsing attributes in process `syz.2.876'. [ 269.522344][ T9381] netlink: 'syz.2.876': attribute type 7 has an invalid length. [ 269.529846][ T9381] netlink: 'syz.2.876': attribute type 8 has an invalid length. [ 269.533298][ T9381] netlink: 4 bytes leftover after parsing attributes in process `syz.2.876'. [ 269.871650][ T9394] FAULT_INJECTION: forcing a failure. [ 269.871650][ T9394] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 269.875952][ T9394] CPU: 2 UID: 0 PID: 9394 Comm: syz.0.879 Tainted: G L syzkaller #0 PREEMPT(full) [ 269.875969][ T9394] Tainted: [L]=SOFTLOCKUP [ 269.875972][ T9394] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 269.875978][ T9394] Call Trace: [ 269.875982][ T9394] [ 269.875986][ T9394] dump_stack_lvl+0x100/0x190 [ 269.876004][ T9394] should_fail_ex.cold+0x5/0xa [ 269.876017][ T9394] _copy_from_user+0x2e/0xd0 [ 269.876031][ T9394] get_compat_msghdr+0xb3/0x480 [ 269.876047][ T9394] ? __pfx_get_compat_msghdr+0x10/0x10 [ 269.876067][ T9394] ___sys_sendmsg+0x1b6/0x1e0 [ 269.876084][ T9394] ? __pfx____sys_sendmsg+0x10/0x10 [ 269.876106][ T9394] ? find_held_lock+0x2b/0x80 [ 269.876123][ T9394] __sys_sendmsg+0x160/0x210 [ 269.876137][ T9394] ? __pfx___sys_sendmsg+0x10/0x10 [ 269.876153][ T9394] ? __pfx_ksys_write+0x10/0x10 [ 269.876171][ T9394] __do_fast_syscall_32+0x13a/0x8b0 [ 269.876185][ T9394] ? lockdep_hardirqs_on+0x7d/0x110 [ 269.876199][ T9394] do_fast_syscall_32+0x32/0x70 [ 269.876213][ T9394] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 269.876227][ T9394] RIP: 0023:0xf701efec [ 269.876239][ T9394] Code: Unable to access opcode bytes at 0xf701efc2. [ 269.876244][ T9394] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 269.876254][ T9394] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 269.876260][ T9394] RDX: 0000000000008810 RSI: 0000000000000000 RDI: 0000000000000000 [ 269.876266][ T9394] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 269.876272][ T9394] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 269.876278][ T9394] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 269.876291][ T9394] [ 269.885136][ T9] usb 10-1: device descriptor read/64, error -71 [ 270.114777][ T60] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 270.184843][ T9] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 270.265238][ T60] usb 7-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 270.268972][ T60] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 270.272992][ T60] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.282513][ T60] usb 7-1: config 0 descriptor?? [ 270.288660][ T60] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 270.314826][ T9] usb 10-1: device descriptor read/64, error -71 [ 270.425547][ T9] usb usb10-port1: attempt power cycle [ 270.542393][ T9409] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 270.548416][ T9409] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 270.688631][ T9411] netlink: 8 bytes leftover after parsing attributes in process `syz.2.882'. [ 270.748009][ T9410] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 270.773025][ T9] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 270.818835][ T9] usb 10-1: device descriptor read/8, error -71 [ 270.890196][ T9420] netlink: 'syz.4.885': attribute type 1 has an invalid length. [ 270.916994][ T9420] 8021q: adding VLAN 0 to HW filter on device bond1 [ 270.942354][ T9420] 9pnet_virtio: no channels available for device syz [ 271.077393][ T9] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 271.109185][ T9] usb 10-1: device descriptor read/8, error -71 [ 271.428173][ T5737] Bluetooth: hci2: command 0x040f tx timeout [ 271.802579][ T9] usb usb10-port1: unable to enumerate USB device [ 273.065352][ T9491] input: syz1 as /devices/virtual/input/input26 [ 273.114867][ T29] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 273.285315][ T29] usb 5-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 273.289789][ T29] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 273.294955][ T29] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 273.299537][ T29] usb 5-1: config 0 descriptor?? [ 273.303764][ T29] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 273.397051][ T9] usb 7-1: USB disconnect, device number 24 [ 273.450860][ T9497] netlink: 28 bytes leftover after parsing attributes in process `syz.2.896'. [ 273.596723][ T9502] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 273.602887][ T9502] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 273.771728][ T9507] netlink: 8 bytes leftover after parsing attributes in process `syz.0.900'. [ 274.194834][ T34] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 274.365137][ T34] usb 10-1: Using ep0 maxpacket: 8 [ 274.367453][ T34] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 274.371164][ T34] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 274.373824][ T34] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 274.377068][ T34] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 274.380070][ T34] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 274.383055][ T34] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 274.387458][ T34] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 274.594584][ T34] usb 10-1: usb_control_msg returned -32 [ 274.596455][ T34] usbtmc 10-1:16.0: can't read capabilities [ 275.150417][ T5903] usb 10-1: USB disconnect, device number 7 [ 275.855657][ T5737] Bluetooth: hci2: ACL packet too small [ 275.900848][ T9524] netlink: 28 bytes leftover after parsing attributes in process `syz.5.903'. [ 275.903697][ T9524] netlink: 28 bytes leftover after parsing attributes in process `syz.5.903'. [ 276.251037][ T1485] usb 5-1: USB disconnect, device number 22 [ 276.289040][ T5737] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 276.292840][ T5737] Bluetooth: hci1: unexpected event for opcode 0x4ad0 [ 276.383093][ T9538] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 276.396577][ T5737] Bluetooth: hci1: ACL packet too small [ 276.415529][ T5903] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 276.568223][ T5903] usb 10-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 276.575212][ T5903] usb 10-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 276.581630][ T5903] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.598361][ T5903] usb 10-1: config 0 descriptor?? [ 276.601916][ T9560] fuse: Bad value for 'fd' [ 276.605094][ T5903] usbhid 10-1:0.0: couldn't find an input interrupt endpoint [ 276.852654][ T9573] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.920'. [ 276.854072][ T9574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 276.857453][ T10] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 276.860430][ T9574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 276.874294][ T9573] IPVS: sed: TCP 127.0.0.1:21 - no destination available [ 277.003916][ T9576] netlink: 8 bytes leftover after parsing attributes in process `syz.5.905'. [ 277.015638][ T10] usb 9-1: Using ep0 maxpacket: 8 [ 277.043286][ T10] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 277.056135][ T10] usb 9-1: config index 0 descriptor too short (expected 74, got 45) [ 277.060137][ T10] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 277.072092][ T10] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 277.076591][ T10] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 277.085351][ T10] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 277.089522][ T10] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 277.097712][ T10] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 277.441523][ T10] usb 9-1: usb_control_msg returned -32 [ 277.443691][ T10] usbtmc 9-1:16.0: can't read capabilities [ 277.836116][ T9578] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 277.841047][ T9578] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 278.006716][ T5737] Bluetooth: hci1: ACL packet too small [ 278.966851][ T10] usb 10-1: USB disconnect, device number 8 [ 279.004466][ T9601] tipc: Enabling of bearer rejected, failed to enable media [ 279.435425][ T5737] Bluetooth: hci1: ACL packet too small [ 279.631115][ T24] usb 9-1: USB disconnect, device number 24 [ 279.793426][ T29] Process accounting resumed [ 282.364161][ T5737] Bluetooth: hci3: ACL packet too small [ 282.544805][ T5903] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 282.696746][ T5903] usb 5-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 282.702246][ T5903] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 282.706509][ T5903] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 282.712726][ T5903] usb 5-1: config 0 descriptor?? [ 282.716184][ T5903] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 282.973521][ T9662] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 282.977805][ T9662] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 283.088061][ T9663] netlink: 8 bytes leftover after parsing attributes in process `syz.0.942'. [ 283.182347][ T10] Process accounting resumed [ 284.955793][ T9688] dlm: Unknown command passed to DLM device : 0 [ 284.955793][ T9688] [ 285.035566][ T9694] netlink: 'syz.2.954': attribute type 1 has an invalid length. [ 285.050478][ T9694] veth0_to_bond: left promiscuous mode [ 285.058018][ T9694] bond1: (slave veth0_to_bond): making interface the new active one [ 285.061651][ T9694] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 285.110014][ T9700] virt_wifi0 speed is unknown, defaulting to 1000 [ 285.151946][ T5739] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 285.155743][ T5739] CPU: 0 UID: 0 PID: 5739 Comm: kworker/u34:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 285.155763][ T5739] Tainted: [L]=SOFTLOCKUP [ 285.155767][ T5739] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 285.155774][ T5739] Workqueue: hci3 hci_rx_work [ 285.155789][ T5739] Call Trace: [ 285.155793][ T5739] [ 285.155798][ T5739] dump_stack_lvl+0x100/0x190 [ 285.155815][ T5739] sysfs_warn_dup.cold+0x1c/0x28 [ 285.155838][ T5739] sysfs_create_dir_ns+0x24b/0x2b0 [ 285.155855][ T5739] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 285.155872][ T5739] ? find_held_lock+0x2b/0x80 [ 285.155882][ T5739] ? kobject_add_internal+0x25f/0x930 [ 285.155899][ T5739] ? kobject_add_internal+0x25f/0x930 [ 285.155916][ T5739] ? do_raw_spin_unlock+0x145/0x1e0 [ 285.155934][ T5739] kobject_add_internal+0x2c8/0x930 [ 285.155953][ T5739] kobject_add+0x16a/0x1e0 [ 285.155969][ T5739] ? __pfx_kobject_add+0x10/0x10 [ 285.155984][ T5739] ? class_to_subsys+0x10f/0x150 [ 285.156002][ T5739] ? kobject_put+0xb9/0x640 [ 285.156015][ T5739] ? _raw_spin_unlock+0x28/0x50 [ 285.156029][ T5739] device_add+0x294/0x1970 [ 285.156044][ T5739] ? __pfx_dev_set_name+0x10/0x10 [ 285.156061][ T5739] ? __pfx_device_add+0x10/0x10 [ 285.156075][ T5739] ? mgmt_send_event_skb+0x2fb/0x460 [ 285.156091][ T5739] hci_conn_add_sysfs+0x1a3/0x260 [ 285.156105][ T5739] le_conn_complete_evt+0x121b/0x2120 [ 285.156121][ T5739] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 285.156131][ T5739] ? hci_event_packet+0x186/0xcd0 [ 285.156141][ T5739] ? hci_event_packet+0x186/0xcd0 [ 285.156155][ T5739] hci_le_enh_conn_complete_evt+0x23d/0x3b0 [ 285.156168][ T5739] ? skb_pull_data+0x15f/0x1e0 [ 285.156185][ T5739] hci_le_meta_evt+0x34a/0x5f0 [ 285.156197][ T5739] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 285.156211][ T5739] hci_event_packet+0x51c/0xcd0 [ 285.156222][ T5739] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 285.156235][ T5739] ? __pfx_hci_event_packet+0x10/0x10 [ 285.156248][ T5739] ? lockdep_hardirqs_on+0x7d/0x110 [ 285.156264][ T5739] hci_rx_work+0x451/0xfc0 [ 285.156277][ T5739] process_one_work+0xac7/0x1b10 [ 285.156296][ T5739] ? __pfx_process_one_work+0x10/0x10 [ 285.156313][ T5739] ? __pfx_hci_rx_work+0x10/0x10 [ 285.156327][ T5739] worker_thread+0x5ef/0xe50 [ 285.156343][ T5739] ? kthread+0x13a/0x450 [ 285.156352][ T5739] ? __pfx_worker_thread+0x10/0x10 [ 285.156362][ T5739] kthread+0x373/0x450 [ 285.156371][ T5739] ? __pfx_kthread+0x10/0x10 [ 285.156381][ T5739] ret_from_fork+0x730/0xd60 [ 285.156397][ T5739] ? __pfx_ret_from_fork+0x10/0x10 [ 285.156411][ T5739] ? native_load_gs_index+0x1e/0xc0 [ 285.156423][ T5739] ? __switch_to+0x800/0x10f0 [ 285.156434][ T5739] ? __pfx_kthread+0x10/0x10 [ 285.156445][ T5739] ret_from_fork_asm+0x1a/0x30 [ 285.156462][ T5739] [ 285.156477][ T5739] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 285.250018][ T5739] Bluetooth: hci3: failed to register connection device [ 285.345253][ T24] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 285.474840][ T24] usb 9-1: device descriptor read/64, error -71 [ 285.724832][ T24] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 285.854767][ T24] usb 9-1: device descriptor read/64, error -71 [ 285.904825][ T5903] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 285.964458][ T34] usb 5-1: USB disconnect, device number 23 [ 285.965145][ T24] usb usb9-port1: attempt power cycle [ 286.016032][ T27] select_fallback_rq: 3 callbacks suppressed [ 286.016044][ T27] process 9705 (syz.2.958) no longer affine to cpu1 [ 286.036604][ T27] ================================================================== [ 286.039146][ T27] BUG: KASAN: slab-use-after-free in irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 286.041827][ T27] Read of size 8 at addr ffff8880245d01a8 by task migration/1/27 [ 286.045098][ T27] [ 286.046598][ T27] CPU: 1 UID: 0 PID: 27 Comm: migration/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 286.046614][ T27] Tainted: [L]=SOFTLOCKUP [ 286.046617][ T27] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 286.046624][ T27] Stopper: multi_cpu_stop+0x0/0x4b0 <- __stop_cpus.constprop.0+0xb1/0x140 [ 286.046653][ T27] Call Trace: [ 286.046657][ T27] [ 286.046661][ T27] dump_stack_lvl+0x100/0x190 [ 286.046677][ T27] print_report+0x13d/0x4b0 [ 286.046692][ T27] ? __virt_addr_valid+0x239/0x430 [ 286.046708][ T27] ? irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 286.046723][ T27] kasan_report+0xdf/0x1c0 [ 286.046734][ T27] ? irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 286.046751][ T27] irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 286.046767][ T27] ? native_cpu_disable+0x54/0x80 [ 286.046782][ T27] ? __pfx_take_cpu_down+0x10/0x10 [ 286.046795][ T27] fixup_irqs+0x2b/0x280 [ 286.046811][ T27] ? __pfx_take_cpu_down+0x10/0x10 [ 286.046824][ T27] native_cpu_disable+0x59/0x80 [ 286.046838][ T27] take_cpu_down+0xb6/0x190 [ 286.046850][ T27] multi_cpu_stop+0x16a/0x4b0 [ 286.046866][ T27] ? __stop_cpus.constprop.0+0xb1/0x140 [ 286.046881][ T27] ? __pfx_multi_cpu_stop+0x10/0x10 [ 286.046895][ T27] cpu_stopper_thread+0x21e/0x450 [ 286.046911][ T27] ? __pfx_cpu_stopper_thread+0x10/0x10 [ 286.046925][ T27] smpboot_thread_fn+0x3d3/0xab0 [ 286.046941][ T27] ? kthread+0x13a/0x450 [ 286.046950][ T27] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 286.046965][ T27] kthread+0x373/0x450 [ 286.046974][ T27] ? __pfx_kthread+0x10/0x10 [ 286.046983][ T27] ret_from_fork+0x730/0xd60 [ 286.046998][ T27] ? __pfx_ret_from_fork+0x10/0x10 [ 286.047013][ T27] ? __switch_to+0x800/0x10f0 [ 286.047024][ T27] ? __pfx_kthread+0x10/0x10 [ 286.047033][ T27] ret_from_fork_asm+0x1a/0x30 [ 286.047045][ T27] [ 286.047048][ T27] [ 286.104685][ T27] Allocated by task 5813: [ 286.106013][ T27] kasan_save_stack+0x30/0x50 [ 286.107516][ T27] kasan_save_track+0x14/0x30 [ 286.109332][ T27] __kasan_kmalloc+0xaa/0xb0 [ 286.110755][ T27] __kmalloc_node_track_caller_noprof+0x33d/0x870 [ 286.112726][ T27] kmalloc_reserve+0xe8/0x350 [ 286.114190][ T27] pskb_expand_head+0x249/0x10e0 [ 286.115712][ T27] batadv_skb_head_push+0xec/0x280 [ 286.117312][ T27] batadv_send_skb_packet+0xe9/0x6e0 [ 286.119208][ T27] batadv_iv_send_outstanding_bat_ogm_packet+0x6a2/0x7d0 [ 286.121342][ T27] process_one_work+0xac7/0x1b10 [ 286.122868][ T27] worker_thread+0x5ef/0xe50 [ 286.124290][ T27] kthread+0x373/0x450 [ 286.125553][ T27] ret_from_fork+0x730/0xd60 [ 286.126985][ T27] ret_from_fork_asm+0x1a/0x30 [ 286.128482][ T27] [ 286.129243][ T27] Freed by task 5813: [ 286.130464][ T27] kasan_save_stack+0x30/0x50 [ 286.131903][ T27] kasan_save_track+0x14/0x30 [ 286.133340][ T27] kasan_save_free_info+0x3b/0x70 [ 286.134885][ T27] __kasan_slab_free+0x5f/0x80 [ 286.136348][ T27] kfree+0x22b/0x6d0 [ 286.137674][ T27] skb_free_head+0xb9/0x160 [ 286.139087][ T27] skb_release_data+0x6c5/0x8e0 [ 286.140584][ T27] sk_skb_reason_drop+0x102/0x1b0 [ 286.142131][ T27] __netif_receive_skb_core.constprop.0+0x571/0x3530 [ 286.144151][ T27] __netif_receive_skb_one_core+0xb0/0x1e0 [ 286.145931][ T27] __netif_receive_skb+0x1f/0x120 [ 286.147509][ T27] process_backlog+0x487/0x1600 [ 286.148995][ T27] __napi_poll.constprop.0+0xaf/0x450 [ 286.150660][ T27] net_rx_action+0xa40/0xf20 [ 286.152072][ T27] handle_softirqs+0x1e6/0x9d0 [ 286.153546][ T27] do_softirq+0xaf/0xf0 [ 286.154823][ T27] __local_bh_enable_ip+0xff/0x120 [ 286.156382][ T27] __dev_queue_xmit+0xa27/0x4970 [ 286.158079][ T27] batadv_send_skb_packet+0x53a/0x6e0 [ 286.159806][ T27] batadv_iv_send_outstanding_bat_ogm_packet+0x6a2/0x7d0 [ 286.161901][ T27] process_one_work+0xac7/0x1b10 [ 286.163374][ T27] worker_thread+0x5ef/0xe50 [ 286.164746][ T27] kthread+0x373/0x450 [ 286.165982][ T27] ret_from_fork+0x730/0xd60 [ 286.167439][ T27] ret_from_fork_asm+0x1a/0x30 [ 286.168901][ T27] [ 286.169657][ T27] The buggy address belongs to the object at ffff8880245d0000 [ 286.169657][ T27] which belongs to the cache kmalloc-1k of size 1024 [ 286.173808][ T27] The buggy address is located 424 bytes inside of [ 286.173808][ T27] freed 1024-byte region [ffff8880245d0000, ffff8880245d0400) [ 286.178475][ T27] [ 286.179250][ T27] The buggy address belongs to the physical page: [ 286.181166][ T27] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x245d0 [ 286.183806][ T27] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 286.186358][ T27] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 286.188657][ T27] page_type: f5(slab) [ 286.189906][ T27] raw: 00fff00000000040 ffff88801c042dc0 dead000000000100 dead000000000122 [ 286.192477][ T27] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 286.195227][ T27] head: 00fff00000000040 ffff88801c042dc0 dead000000000100 dead000000000122 [ 286.198043][ T27] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 286.200712][ T27] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 286.203316][ T27] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 286.205933][ T27] page dumped because: kasan: bad access detected [ 286.207941][ T27] page_owner tracks the page as allocated [ 286.209708][ T27] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5863, tgid 5863 (kworker/u33:0), ts 48941492765 [ 286.215534][ T27] post_alloc_hook+0xfd/0x120 [ 286.217013][ T27] get_page_from_freelist+0x110d/0x35b0 [ 286.218965][ T27] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 286.220772][ T27] new_slab+0xa9/0x6e0 [ 286.222044][ T27] refill_objects+0xe3/0x410 [ 286.223468][ T27] __pcs_replace_empty_main+0x35e/0x650 [ 286.225102][ T27] __kmalloc_noprof+0x67c/0x840 [ 286.226575][ T27] load_elf_phdrs+0x102/0x210 [ 286.228156][ T27] load_elf_binary+0x298/0x51a0 [ 286.229703][ T27] bprm_execve+0x8cd/0x1940 [ 286.231066][ T27] kernel_execve+0x31e/0x3a0 [ 286.232455][ T27] call_usermodehelper_exec_async+0x239/0x4b0 [ 286.234271][ T27] ret_from_fork+0x730/0xd60 [ 286.235671][ T27] ret_from_fork_asm+0x1a/0x30 [ 286.237085][ T27] page last free pid 5858 tgid 5858 ts 48928290565 stack trace: [ 286.239856][ T27] __free_frozen_pages+0x79f/0x10f0 [ 286.241437][ T27] qlist_free_all+0x47/0xf0 [ 286.242780][ T27] kasan_quarantine_reduce+0x1a0/0x1f0 [ 286.244414][ T27] __kasan_slab_alloc+0x69/0x90 [ 286.245861][ T27] kmem_cache_alloc_noprof+0x269/0x6a0 [ 286.247531][ T27] vm_area_dup+0x27/0x8e0 [ 286.249228][ T27] __split_vma+0x19b/0x1800 [ 286.250668][ T27] vma_modify+0x12ad/0x25c0 [ 286.251988][ T27] vma_modify_flags+0x254/0x3c0 [ 286.253417][ T27] mprotect_fixup+0x27a/0xe00 [ 286.254803][ T27] do_mprotect_pkey+0xa51/0xdd0 [ 286.256246][ T27] __x64_sys_mprotect+0x78/0xc0 [ 286.257743][ T27] do_syscall_64+0x121/0x770 [ 286.259148][ T27] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.260875][ T27] [ 286.261610][ T27] Memory state around the buggy address: [ 286.263247][ T27] ffff8880245d0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 286.265599][ T27] ffff8880245d0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 286.268135][ T27] >ffff8880245d0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 286.270544][ T27] ^ [ 286.272085][ T27] ffff8880245d0200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 286.274424][ T27] ffff8880245d0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 286.276738][ T27] ================================================================== [ 286.279644][ T27] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 286.281763][ T27] CPU: 1 UID: 0 PID: 27 Comm: migration/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 286.284840][ T27] Tainted: [L]=SOFTLOCKUP [ 286.286104][ T27] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 286.289368][ T27] Stopper: multi_cpu_stop+0x0/0x4b0 <- __stop_cpus.constprop.0+0xb1/0x140 [ 286.291883][ T27] Call Trace: [ 286.292897][ T27] [ 286.293796][ T27] dump_stack_lvl+0x100/0x190 [ 286.295212][ T27] vpanic+0x553/0x970 [ 286.296411][ T27] ? __pfx_vpanic+0x10/0x10 [ 286.297849][ T27] ? __pfx_vprintk_emit+0x10/0x10 [ 286.299371][ T27] ? irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 286.301195][ T27] panic+0xd1/0xe0 [ 286.302351][ T27] ? __pfx_panic+0x10/0x10 [ 286.303693][ T27] check_panic_on_warn.cold+0x19/0x34 [ 286.305290][ T27] end_report.part.0+0x3a/0x90 [ 286.306731][ T27] kasan_report.cold+0xe/0x18 [ 286.308353][ T27] ? irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 286.310276][ T27] irq_migrate_all_off_this_cpu+0xaaf/0xc30 [ 286.312055][ T27] ? native_cpu_disable+0x54/0x80 [ 286.313567][ T27] ? __pfx_take_cpu_down+0x10/0x10 [ 286.315105][ T27] fixup_irqs+0x2b/0x280 [ 286.316385][ T27] ? __pfx_take_cpu_down+0x10/0x10 [ 286.318094][ T27] native_cpu_disable+0x59/0x80 [ 286.319559][ T27] take_cpu_down+0xb6/0x190 [ 286.320896][ T27] multi_cpu_stop+0x16a/0x4b0 [ 286.322329][ T27] ? __stop_cpus.constprop.0+0xb1/0x140 [ 286.323969][ T27] ? __pfx_multi_cpu_stop+0x10/0x10 [ 286.325528][ T27] cpu_stopper_thread+0x21e/0x450 [ 286.327016][ T27] ? __pfx_cpu_stopper_thread+0x10/0x10 [ 286.329128][ T27] smpboot_thread_fn+0x3d3/0xab0 [ 286.330818][ T27] ? kthread+0x13a/0x450 [ 286.332547][ T27] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 286.334699][ T27] kthread+0x373/0x450 [ 286.336180][ T27] ? __pfx_kthread+0x10/0x10 [ 286.337951][ T27] ret_from_fork+0x730/0xd60 [ 286.339430][ T27] ? __pfx_ret_from_fork+0x10/0x10 [ 286.340980][ T27] ? __switch_to+0x800/0x10f0 [ 286.342383][ T27] ? __pfx_kthread+0x10/0x10 [ 286.343749][ T27] ret_from_fork_asm+0x1a/0x30 [ 286.345165][ T27] [ 287.411144][ T27] Shutting down cpus with NMI [ 287.413190][ T27] Kernel Offset: disabled [ 287.414518][ T27] Rebooting in 86400 seconds.. VM DIAGNOSIS: 09:11:39 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000000 RBX=0000000000000003 RCX=0000000000000001 RDX=ffff88801cb4cb00 RSI=ffffffff8206c579 RDI=ffffffff8bed5970 RBP=ffffc9000dddf894 RSP=ffffc9000045fd28 R8 =0000000000000005 R9 =0000000000000004 R10=0000000000000003 R11=0000000000000000 R12=ffffc9000dddf870 R13=fffff52001bbbf12 R14=0000000000000003 R15=0000000000000003 RIP=ffffffff8206c57b RFL=00000093 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096982000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f53cbff4 CR3=000000004bf7c000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=000000000cdc000e DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000032 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85ab23f5 RDI=ffffffff9bc351c0 RBP=ffffffff9bc35180 RSP=ffffc90000557658 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=20666f2064616552 R12=0000000000000000 R13=0000000000000032 R14=ffffffff9b9341f3 R15=ffffffff85ab2390 RIP=ffffffff85ab241f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096a82000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000000c2c6705 CR3=000000000eb94000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000000 RBX=0000000000000003 RCX=0000000000000001 RDX=ffff88801cf32580 RSI=ffffffff8206c579 RDI=ffffffff8bed5970 RBP=ffffc9000dddf894 RSP=ffffc900004ffd30 R8 =0000000000000005 R9 =0000000000000004 R10=0000000000000003 R11=0000000000000000 R12=ffffc9000dddf870 R13=fffff52001bbbf12 R14=0000000000000003 R15=0000000000000003 RIP=ffffffff8206c756 RFL=00000093 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096b82000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000000000000 CR3=0000000029791000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000200001 Opmask01=0000000000000001 Opmask02=0000000000000800 Opmask03=0000000000000000 Opmask04=00000000ffffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffdc6388c7b 00007ffdc6388c7b ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffdc6389180 0000003000000018 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffdc6389180 0000003000000018 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0a0a0a0a0a0a0a0a 0a0a0a0a0a0a0a0a 0a0a0a0a0a0a0a0a 0a0a0a0a0a0a0a0a ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2e35383220205b3e 343c00303178302f 303178302b646165 7268746b5f786600 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2435323220205134 3436003031723025 3031723021646165 7262746155726600 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 7a79732820353037 3920737365636f72 70205d3732542020 205b5d3434303631 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2e79726f74636572 696420656d617320 656874206e692065 6d616e20656d6173 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2065687420687469 772073676e696874 2072657473696765 72206f7420797274 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2074276e6f64202c 5453495845452d20 6874697720303a33 69636820726f6620 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 64656c696166206c 616e7265746e695f 6464615f7463656a 626f6b203a746365 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 65746e656d676172 66206562206c6c69 7720656361667265 746e692073696874 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=dffffc0000000000 RBX=0000000000000003 RCX=0000000000000001 RDX=1ffffffff1cd5d27 RSI=ffffffff81d0aeff RDI=ffffffff8e6ae938 RBP=00000000000036b0 RSP=ffffc900005afcf8 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000003 R11=0000000000000000 R12=00000000fffffa00 R13=ffffffff8ea0f280 R14=00000000fffffa0f R15=ffffffff948a2238 RIP=ffffffff81d0af2d RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096c82000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f7f4a190 CR3=0000000074996000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=000000000000000e DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000