last executing test programs: 1m29.414819119s ago: executing program 0 (id=17336): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000100), 0x2) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000140)={r0, 0x1, 0x2000, 0x8000}) 1m29.360248376s ago: executing program 0 (id=17338): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x7, 0x4, 0x900, 0x4, 0x28}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000003000000000000000300000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7030000fb000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5516, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000580)="c794", 0x2}, 0x50) 1m29.299836267s ago: executing program 0 (id=17339): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000014c0)=@base={0x6, 0x4, 0x2, 0x7, 0x0, 0x1, 0xe92}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x100}, [@call={0x85, 0x0, 0x0, 0x6d}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xc3}}]}, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x27, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r1, r0}, 0xc) 1m29.14970299s ago: executing program 0 (id=17342): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000040)='/', &(0x7f0000000080)='./file0\x00', 0x0, 0x197841, 0x0) umount2(&(0x7f00000000c0)='./file0\x00', 0x1) 1m29.071684882s ago: executing program 0 (id=17346): syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x18, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x6}}]}}, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x541b, 0x0) 1m28.822337959s ago: executing program 0 (id=17350): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x18, r1, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) 1m28.729391456s ago: executing program 32 (id=17350): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x18, r1, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) 1m24.033985363s ago: executing program 2 (id=17461): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1f, 0x11, &(0x7f0000000800)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, [@call={0x85, 0x0, 0x0, 0x7}, @snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0xa7}}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r1}, 0xc) 1m23.916789848s ago: executing program 2 (id=17467): r0 = syz_open_dev$vbi(&(0x7f00000005c0), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f0000000580)=0x3) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f00000007c0)) 1m23.819971105s ago: executing program 2 (id=17472): prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000140)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) getcwd(&(0x7f0000000000)=""/125, 0x7d) 1m23.75552465s ago: executing program 2 (id=17473): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_clone3(&(0x7f0000000380)={0x20000000, 0x0, 0x0, 0x0, {0x37}, 0x0, 0x0, 0x0, 0x0}, 0x58) 1m23.652822307s ago: executing program 2 (id=17477): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x100) fcntl$notify(r0, 0x402, 0x8000000b) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x20) 1m23.602371489s ago: executing program 2 (id=17479): mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) connect$bt_rfcomm(r0, &(0x7f0000000080)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0xdf}, 0xa) 1m7.534868492s ago: executing program 33 (id=17479): mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) connect$bt_rfcomm(r0, &(0x7f0000000080)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0xdf}, 0xa) 14.482837775s ago: executing program 5 (id=19972): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), r0) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x3c, r1, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_FLAGS={0xc}]}]}, 0x3c}}, 0x0) 14.438291962s ago: executing program 5 (id=19975): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = inotify_init1(0x800) inotify_add_watch(r0, &(0x7f0000000200)='.\x00', 0x44000160) 14.407413707s ago: executing program 5 (id=19976): unshare(0x22020600) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) fsync(r0) 14.111009725s ago: executing program 5 (id=19979): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000040)='/', &(0x7f0000000080)='./file0\x00', 0x0, 0x197841, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0xc) 14.019148235s ago: executing program 5 (id=19981): ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0f0000000400000008000000da"], 0x48) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000100)={r0, 0x58, &(0x7f0000000400)}, 0x10) 13.586260378s ago: executing program 5 (id=19995): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0x2) ioctl$TCSETS2(r0, 0x402c542b, 0x0) 13.483275005s ago: executing program 34 (id=19995): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0x2) ioctl$TCSETS2(r0, 0x402c542b, 0x0) 1.508473284s ago: executing program 3 (id=20330): openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x40, 0x16f) lsetxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000140)=@ng={0x4, 0xd}, 0x2, 0x1) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 1.450015325s ago: executing program 3 (id=20332): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000140), 0x80800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000280)={0x2, "fa02790d2a69a2610f0200000000000000110001000000c642000000677c00", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r1, 0xc0303e03, 0x0) 1.429678731s ago: executing program 3 (id=20335): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(r0, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000b40)={0x34, r1, 0x1, 0x70bd28, 0x25dfdbff, {}, [@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x10000000) 1.382401168s ago: executing program 3 (id=20338): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_GET_CLOCK(r1, 0x8030ae7c, &(0x7f0000000000)) 1.039265231s ago: executing program 3 (id=20347): pselect6(0x0, 0x0, 0x0, &(0x7f0000000180)={0xdde, 0x7ff, 0xfffffffffffffffa, 0x13, 0xd43, 0x2, 0xff, 0x2}, 0x0, 0x0) r0 = openat$ndctl0(0xffffffffffffff9c, &(0x7f0000000000), 0x129d01, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000000180)) 677.118489ms ago: executing program 6 (id=20365): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1, 0x4, 0x8, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xb, &(0x7f0000000000)=@framed={{}, [@map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0xbf, 0x3, 0xa}, @generic={0x7, 0x3, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x4, 0x0, 0x0, 0x1}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000340)='\x00'/14, 0x0, 0x3b66, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 599.197538ms ago: executing program 6 (id=20368): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000003e40), r0) sendmsg$SEG6_CMD_DUMPHMAC(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000140)={0x14, r1, 0x307, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x4000) 576.421758ms ago: executing program 6 (id=20370): syz_open_procfs(0x0, &(0x7f0000000080)='pagemap\x00') r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0xfe, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) 543.377818ms ago: executing program 6 (id=20373): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1503, 0x2000000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) 443.746288ms ago: executing program 6 (id=20377): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000070601080000000000000000000000000500010006"], 0x1c}}, 0x0) recvmmsg(r0, &(0x7f0000003840)=[{{0x0, 0x0, &(0x7f0000002780)=[{&(0x7f00000002c0)=""/127, 0x7f}, {&(0x7f0000000340)=""/240, 0xf0}, {&(0x7f00000016c0)=""/4096, 0x1000}], 0x3}, 0x1}], 0x1, 0x20, 0x0) 409.398666ms ago: executing program 6 (id=20379): r0 = io_uring_setup(0x7d2, &(0x7f0000000180)={0x0, 0xddf7, 0x1, 0xfffffffe, 0x181}) close_range(r0, r0, 0x0) clock_nanosleep(0xfffffff2, 0x0, &(0x7f0000000140)={0x77359400}, 0x0) 334.049923ms ago: executing program 1 (id=20383): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) r0 = getpgid(0x0) sched_rr_get_interval(r0, &(0x7f0000000140)) 278.316067ms ago: executing program 1 (id=20386): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000040), r1, 0x0, 0x1, 0x4}}, 0x20) 248.049201ms ago: executing program 4 (id=20387): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff0000000002000000000000000400010008000a000008000005001e"], 0x50}}, 0x4000850) r0 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0x4924b68, 0x0) 231.488288ms ago: executing program 1 (id=20388): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000240)={'vcan0\x00', 0x0}) sendmsg$can_raw(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x1d, r1}, 0x10, &(0x7f0000000000)={&(0x7f0000000040)=@can={{}, 0x4, 0x1, 0x4, 0x0, "36e932c486d275cc"}, 0x10}, 0x1, 0x0, 0x0, 0x88000}, 0x48880) 207.035377ms ago: executing program 4 (id=20389): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000fddbdf25010000001400020077673100000000000000000000000000500008804c000080240001000000000000000000000000000000000000000000000000000000000000000000240009801c000080060001000200000008000200e0000001050003000100000004"], 0x78}, 0x1, 0x0, 0x0, 0x4000880}, 0x48000) 191.884462ms ago: executing program 1 (id=20390): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x2, 0x2) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f00000001c0)=0x1) ioctl$VIDIOC_S_FREQUENCY(r0, 0x402c5639, &(0x7f0000000080)={0x0, 0x2, 0x7}) 156.096384ms ago: executing program 4 (id=20391): setns(0xc9, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001140)=@newlink={0x48, 0x10, 0x401, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0x66f31}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x48}}, 0x2040000) 98.311174ms ago: executing program 3 (id=20392): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x2) 97.145578ms ago: executing program 4 (id=20400): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000880)=@bridge_dellink={0x24, 0x11, 0x5, 0x1000000, 0xfffffffe, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x800c000}, 0x0) 96.346841ms ago: executing program 1 (id=20393): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r1, 0xfffff000, 0xe, 0x0, &(0x7f0000001700)="61df7100c80400d5721ff59fe864", 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0}, 0x4c) 56.239536ms ago: executing program 1 (id=20394): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1f, 0x0, 0x0, 0x1000, 0x0, 0x1}, 0x48) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x28011, r0, 0x0) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) 52.758491ms ago: executing program 4 (id=20395): setns(0xc9, 0x0) r0 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r0, &(0x7f0000000140)={&(0x7f0000000100)={0xa, 0x4e20, 0x180000, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="28000000290000003900000087020201"], 0x28}, 0xc000) 0s ago: executing program 4 (id=20396): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r0, 0x0) connect$bt_rfcomm(r0, &(0x7f00000005c0)={0x1f, @none, 0x11}, 0xa) kernel console output (not intermixed with test programs): ] 8021q: adding VLAN 0 to HW filter on device team0 [ 391.245731][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 391.245781][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 391.252593][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 391.252675][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 391.402831][T12256] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 391.640293][ T12] hsr_slave_0: left promiscuous mode [ 391.662158][ T12] hsr_slave_1: left promiscuous mode [ 391.842876][ T12] team0 (unregistering): Port device team_slave_1 removed [ 391.870035][ T12] team0 (unregistering): Port device team_slave_0 removed [ 391.930542][T11571] smbdirect: ib_dev[syz2] removed [ 392.141450][T12256] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 392.399317][T12256] veth0_vlan: entered promiscuous mode [ 392.429495][T12256] veth1_vlan: entered promiscuous mode [ 392.455037][T12256] veth0_macvtap: entered promiscuous mode [ 392.483647][T12256] veth1_macvtap: entered promiscuous mode [ 392.529438][T12922] bridge0: port 3(team0) entered blocking state [ 392.529881][T12922] bridge0: port 3(team0) entered disabled state [ 392.530097][T12922] team0: entered allmulticast mode [ 392.530107][T12922] team_slave_0: entered allmulticast mode [ 392.530791][T12922] team_slave_1: entered allmulticast mode [ 392.535022][T12922] team0: entered promiscuous mode [ 392.535033][T12922] team_slave_0: entered promiscuous mode [ 392.536437][T12922] team_slave_1: entered promiscuous mode [ 392.537840][T12922] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 392.569287][T12256] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 392.590870][T12256] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 392.648918][T12934] openvswitch: netlink: Missing key (keys=40, expected=100) [ 392.673754][T12930] syz.3.17453: page allocation failure: order:2, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 392.673797][T12930] CPU: 1 UID: 0 PID: 12930 Comm: syz.3.17453 Tainted: G L syzkaller #0 PREEMPT(full) [ 392.673814][T12930] Tainted: [L]=SOFTLOCKUP [ 392.673818][T12930] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 392.673825][T12930] Call Trace: [ 392.673829][T12930] [ 392.673834][T12930] dump_stack_lvl+0x100/0x190 [ 392.673854][T12930] warn_alloc.cold+0x9e/0xb2 [ 392.673868][T12930] ? __pfx_warn_alloc+0x10/0x10 [ 392.673885][T12930] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 392.673903][T12930] ? __pfx_get_page_from_freelist+0x10/0x10 [ 392.673921][T12930] __alloc_frozen_pages_noprof+0xcb6/0x3300 [ 392.673944][T12930] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 392.673961][T12930] ? stack_trace_save+0x8e/0xc0 [ 392.673978][T12930] ? __pfx_stack_trace_save+0x10/0x10 [ 392.673994][T12930] ? stack_depot_save_flags+0x27/0x9f0 [ 392.674011][T12930] ? comedi_isadma_alloc+0xc6/0x620 [ 392.674023][T12930] ? pcl816_attach+0x909/0xb30 [ 392.674038][T12930] ? comedi_device_attach+0x40e/0x6b0 [ 392.674052][T12930] ? do_devconfig_ioctl+0x1b3/0x6d0 [ 392.674069][T12930] ? comedi_unlocked_ioctl+0x860/0x3310 [ 392.674089][T12930] alloc_pages_node_noprof+0x93/0x200 [ 392.674103][T12930] ? __pfx_alloc_pages_node_noprof+0x10/0x10 [ 392.674121][T12930] __dma_direct_alloc_pages.isra.0+0x35e/0x540 [ 392.674140][T12930] dma_direct_alloc+0x104/0x8a0 [ 392.674156][T12930] dma_alloc_attrs+0x1b9/0x3e0 [ 392.674170][T12930] ? __pfx_dma_alloc_attrs+0x10/0x10 [ 392.674183][T12930] ? __kmalloc_noprof+0x350/0x840 [ 392.674197][T12930] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 392.674211][T12930] ? dma_direct_supported+0xca/0x220 [ 392.674229][T12930] comedi_isadma_alloc+0x331/0x620 [ 392.674242][T12930] ? __pfx_comedi_isadma_alloc+0x10/0x10 [ 392.674254][T12930] ? request_threaded_irq+0x27b/0x3e0 [ 392.674274][T12930] pcl816_attach+0x909/0xb30 [ 392.674291][T12930] comedi_device_attach+0x40e/0x6b0 [ 392.674310][T12930] do_devconfig_ioctl+0x1b3/0x6d0 [ 392.674327][T12930] ? comedi_unlocked_ioctl+0x180/0x3310 [ 392.674341][T12930] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 392.674366][T12930] ? tomoyo_path_number_perm+0x46d/0x580 [ 392.674380][T12930] ? kasan_save_stack+0x3f/0x50 [ 392.674395][T12930] ? kasan_save_stack+0x30/0x50 [ 392.674410][T12930] ? kasan_save_track+0x14/0x30 [ 392.674424][T12930] ? kasan_save_free_info+0x3b/0x70 [ 392.674440][T12930] comedi_unlocked_ioctl+0x860/0x3310 [ 392.674457][T12930] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 392.674482][T12930] ? kasan_quarantine_put+0x104/0x240 [ 392.674496][T12930] ? lockdep_hardirqs_on+0x7d/0x110 [ 392.674512][T12930] ? find_held_lock+0x2b/0x80 [ 392.674526][T12930] ? tomoyo_path_number_perm+0x28f/0x580 [ 392.674538][T12930] ? tomoyo_path_number_perm+0x28f/0x580 [ 392.674553][T12930] ? tomoyo_path_number_perm+0x188/0x580 [ 392.674569][T12930] comedi_compat_ioctl+0x438/0xe20 [ 392.674582][T12930] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 392.674596][T12930] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 392.674614][T12930] ? do_vfs_ioctl+0x226/0x13e0 [ 392.674628][T12930] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 392.674648][T12930] ? __fget_files+0x34/0x3d0 [ 392.674664][T12930] ? find_held_lock+0x2b/0x80 [ 392.674676][T12930] ? __fget_files+0x215/0x3d0 [ 392.674690][T12930] ? hook_file_ioctl_common+0x140/0x440 [ 392.674707][T12930] ? __fget_files+0x21f/0x3d0 [ 392.674725][T12930] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 392.674738][T12930] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 392.674753][T12930] __do_fast_syscall_32+0x13a/0x8b0 [ 392.674771][T12930] do_fast_syscall_32+0x32/0x70 [ 392.674786][T12930] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 392.674801][T12930] RIP: 0023:0xf7fa4fec [ 392.674815][T12930] Code: Unable to access opcode bytes at 0xf7fa4fc2. [ 392.674820][T12930] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 392.674831][T12930] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040946400 [ 392.674838][T12930] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 392.674845][T12930] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 392.674852][T12930] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 392.674859][T12930] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 392.674874][T12930] [ 392.674878][T12930] Mem-Info: [ 392.674883][T12930] active_anon:16180 inactive_anon:3908 isolated_anon:0 [ 392.674883][T12930] active_file:6622 inactive_file:16638 isolated_file:0 [ 392.674883][T12930] unevictable:1000 dirty:470 writeback:0 [ 392.674883][T12930] slab_reclaimable:7193 slab_unreclaimable:67068 [ 392.674883][T12930] mapped:22465 shmem:1070 pagetables:1476 [ 392.674883][T12930] sec_pagetables:339 bounce:0 [ 392.674883][T12930] kernel_misc_reclaimable:0 [ 392.674883][T12930] free:41261 free_pcp:0 free_cma:0 [ 392.674910][T12930] Node 0 active_anon:0kB inactive_anon:8kB active_file:104kB inactive_file:32kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:0kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8480kB pagetables:1220kB sec_pagetables:1144kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 392.674938][T12930] Node 0 DMA free:2604kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 392.674990][T12930] lowmem_reserve[]: 0 278 278 278 278 [ 392.675013][T12930] Node 0 DMA: 49*4kB (U) 23*8kB (U) 7*16kB (UE) 8*32kB (U) 1*64kB (E) 0*128kB 1*256kB (E) 1*512kB (E) 1*1024kB (E) 0*2048kB 0*4096kB = 2604kB [ 392.675091][T12930] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 392.675100][T12930] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 392.675108][T12930] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 392.675117][T12930] Node 1 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 392.675125][T12930] 25685 total pagecache pages [ 392.675129][T12930] 1357 pages in swap cache [ 392.675133][T12930] Free swap = 105816kB [ 392.675137][T12930] Total swap = 124996kB [ 392.675141][T12930] 524155 pages RAM [ 392.675144][T12930] 0 pages HighMem/MovableOnly [ 392.675148][T12930] 212075 pages reserved [ 392.675152][T12930] 0 pages cma reserved [ 392.712422][ T5938] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.712623][ T5938] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.712816][ T5938] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.738772][ T1066] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 392.738790][ T1066] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 392.775650][ T5938] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.842074][T11571] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 392.842089][T11571] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 393.184736][ T50] hid-sensor-hub 0003:1234:5678.0006: hidraw0: USB HID v0.01 Device [syz0] on syz0 [ 393.225792][T12986] fido_id[12986]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 393.231672][ T43] audit: type=1326 audit(1700006664.971:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12995 comm="syz.2.17472" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf739efec code=0x7ffc0000 [ 393.232530][ T43] audit: type=1326 audit(1700006664.971:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12995 comm="syz.2.17472" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf739efec code=0x7ffc0000 [ 393.232650][ T43] audit: type=1326 audit(1700006664.971:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12995 comm="syz.2.17472" exe="/syz-executor" sig=0 arch=40000003 syscall=183 compat=1 ip=0xf739efec code=0x7ffc0000 [ 393.756961][T13037] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17487'. [ 393.896490][T13046] tipc: Enabling of bearer rejected, failed to enable media [ 394.058133][T13052] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 394.074557][T13054] xt_IDLETIMER: label is empty or not nul-terminated [ 394.506956][T13083] netlink: 16 bytes leftover after parsing attributes in process `syz.3.17508'. [ 394.601731][T13090] netlink: 260 bytes leftover after parsing attributes in process `syz.1.17510'. [ 394.891269][T13106] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 395.376597][T13152] netlink: 20 bytes leftover after parsing attributes in process `syz.4.17539'. [ 395.402921][T13152] ipvlan2: entered promiscuous mode [ 395.403846][T13152] bridge0: port 3(ipvlan2) entered blocking state [ 395.403915][T13152] bridge0: port 3(ipvlan2) entered disabled state [ 395.403971][T13152] ipvlan2: entered allmulticast mode [ 395.403979][T13152] bridge0: entered allmulticast mode [ 395.405216][T13152] ipvlan2: left allmulticast mode [ 395.405224][T13152] bridge0: left allmulticast mode [ 395.948738][T13190] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17555'. [ 395.954883][T13194] comedi comedi3: s526: I/O base address or length out of range [ 395.997724][T13197] netlink: 72 bytes leftover after parsing attributes in process `syz.3.17557'. [ 395.997740][T13197] netlink: 24 bytes leftover after parsing attributes in process `syz.3.17557'. [ 395.997747][T13197] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17557'. [ 396.168716][T13215] netlink: 'syz.4.17563': attribute type 10 has an invalid length. [ 396.201041][T13215] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 396.202421][T13215] team0: Port device netdevsim1 added [ 396.207499][T13215] netlink: 'syz.4.17563': attribute type 10 has an invalid length. [ 396.214224][T13215] team0: Port device netdevsim1 removed [ 396.215878][T13215] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 396.216803][T13215] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 396.547863][T13242] lo speed is unknown, defaulting to 1000 [ 396.548577][T13242] lo speed is unknown, defaulting to 1000 [ 396.737206][T13266] lo speed is unknown, defaulting to 1000 [ 396.740431][T13275] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 396.740579][T13275] overlayfs: overlapping lowerdir path [ 396.754785][T13266] lo speed is unknown, defaulting to 1000 [ 396.914569][T13286] netlink: 'syz.1.17582': attribute type 21 has an invalid length. [ 396.914585][T13286] netlink: 128 bytes leftover after parsing attributes in process `syz.1.17582'. [ 396.933332][T13286] netlink: 3 bytes leftover after parsing attributes in process `syz.1.17582'. [ 397.486307][T13324] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17592'. [ 397.961530][T13354] netlink: 96 bytes leftover after parsing attributes in process `syz.1.17603'. [ 398.054383][T13360] netlink: 'syz.1.17605': attribute type 12 has an invalid length. [ 398.054398][T13360] netlink: 'syz.1.17605': attribute type 29 has an invalid length. [ 398.054405][T13360] netlink: 148 bytes leftover after parsing attributes in process `syz.1.17605'. [ 398.054415][T13360] netlink: 59 bytes leftover after parsing attributes in process `syz.1.17605'. [ 398.206397][T13371] tipc: Started in network mode [ 398.206415][T13371] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 398.206555][T13371] tipc: Enabled bearer , priority 10 [ 399.269236][ T5970] tipc: Node number set to 10005162 [ 399.614576][T13439] random: crng reseeded on system resumption [ 399.723157][T13447] netlink: 20 bytes leftover after parsing attributes in process `syz.1.17644'. [ 399.796914][T13452] vivid-003: disconnect [ 399.804717][T13452] vivid-003: reconnect [ 399.851723][ T43] kauditd_printk_skb: 6 callbacks suppressed [ 399.851736][ T43] audit: type=1326 audit(1700006671.169:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13456 comm="syz.1.17650" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 399.851846][ T43] audit: type=1326 audit(1700006671.169:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13456 comm="syz.1.17650" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 399.853704][ T43] audit: type=1326 audit(1700006671.169:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13456 comm="syz.1.17650" exe="/syz-executor" sig=0 arch=40000003 syscall=125 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 399.853731][ T43] audit: type=1326 audit(1700006671.169:286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13456 comm="syz.1.17650" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 399.853751][ T43] audit: type=1326 audit(1700006671.169:287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13456 comm="syz.1.17650" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 399.854538][ T43] audit: type=1326 audit(1700006671.169:288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13456 comm="syz.1.17650" exe="/syz-executor" sig=0 arch=40000003 syscall=286 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 399.854646][ T43] audit: type=1326 audit(1700006671.169:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13456 comm="syz.1.17650" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 399.854739][ T43] audit: type=1326 audit(1700006671.169:290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13456 comm="syz.1.17650" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 399.952391][T13463] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17652'. [ 399.970674][T13467] netlink: 'syz.3.17654': attribute type 2 has an invalid length. [ 399.970688][T13467] netlink: 'syz.3.17654': attribute type 7 has an invalid length. [ 400.009011][T13467] U#: entered promiscuous mode [ 400.502984][T13513] sctp: [Deprecated]: syz.3.17672 (pid 13513) Use of int in max_burst socket option. [ 400.502984][T13513] Use struct sctp_assoc_value instead [ 400.732294][T13531] Bluetooth: hci0: unsupported parameter 5135 [ 400.732310][T13531] Bluetooth: hci0: unsupported parameter 8192 [ 400.732317][T13531] Bluetooth: hci0: unsupported parameter 5135 [ 400.732872][T13531] Bluetooth: hci0: unsupported parameter 8192 [ 400.875177][T13540] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 400.875195][T13540] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 400.883609][T13540] vhci_hcd vhci_hcd.0: Device attached [ 400.887796][T13542] vhci_hcd: connection closed [ 400.888052][ T5938] vhci_hcd vhci_hcd.4: stop threads [ 400.888073][ T5938] vhci_hcd vhci_hcd.4: release socket [ 400.888089][ T5938] vhci_hcd vhci_hcd.4: disconnect device [ 400.907780][T13545] netlink: 'syz.1.17685': attribute type 9 has an invalid length. [ 400.907801][T13545] netlink: 'syz.1.17685': attribute type 7 has an invalid length. [ 400.907812][T13545] netlink: 'syz.1.17685': attribute type 8 has an invalid length. [ 401.008630][T13553] Bluetooth: MGMT ver 1.23 [ 402.750062][T13607] netlink: 'syz.3.17713': attribute type 10 has an invalid length. [ 402.988897][T13622] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17721'. [ 403.883333][ T5960] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 404.061278][ T5960] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 404.062180][ T5960] usb 8-1: config 0 has an invalid interface number: 50 but max is 0 [ 404.062194][ T5960] usb 8-1: config 0 has no interface number 0 [ 404.062213][ T5960] usb 8-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 404.063877][ T5960] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 404.063889][ T5960] usb 8-1: Product: syz [ 404.063896][ T5960] usb 8-1: Manufacturer: syz [ 404.063903][ T5960] usb 8-1: SerialNumber: syz [ 404.083582][ T5960] usb 8-1: config 0 descriptor?? [ 404.107419][ T5960] yurex 8-1:0.50: USB YUREX device now attached to Yurex #0 [ 404.313927][T13707] trusted_key: encrypted_key: key user:syz not found [ 404.372126][T13713] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17751'. [ 404.404056][T13714] IPVS: sync thread started: state = BACKUP, mcast_ifn = ip6gretap0, syncid = 4, id = 0 [ 404.408341][T13711] IPVS: stopping backup sync thread 13714 ... [ 404.433492][T13718] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17753'. [ 404.435220][T13718] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17753'. [ 404.468324][T13720] syz.4.17754 (13720): drop_caches: 4 [ 404.509466][T13724] iwpm_parse_nlmsg: Invalid attribute (msg type Query Mapping response ret = -34) [ 404.565624][T13731] openvswitch: netlink: Missing key (keys=40, expected=100) [ 404.592132][ T43] audit: type=1326 audit(1700006675.607:291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13732 comm="syz.4.17759" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 404.592204][ T43] audit: type=1326 audit(1700006675.607:292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13732 comm="syz.4.17759" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 404.709126][T13741] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17763'. [ 404.709147][T13741] netlink: 'syz.4.17763': attribute type 5 has an invalid length. [ 404.709156][T13741] netlink: 20 bytes leftover after parsing attributes in process `syz.4.17763'. [ 404.769738][ T5970] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 404.930263][ T5970] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 404.931091][ T5970] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 404.931104][ T5970] usb 6-1: config 0 has no interfaces? [ 404.931118][ T5970] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.934312][ T5970] usb 6-1: config 0 descriptor?? [ 405.159439][ T5970] usb 6-1: USB disconnect, device number 14 [ 405.218552][T13767] devpts: Bad value for 'max' [ 405.488788][ T1167] IPVS: starting estimator thread 0... [ 405.581307][T13778] IPVS: using max 46 ests per chain, 110400 per kthread [ 405.976770][T13796] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 406.033676][T13799] sg_write: data in/out 19942/44 bytes for SCSI command 0x32-- guessing data in; [ 406.033676][T13799] program syz.1.17784 not setting count and/or reply_len properly [ 406.212916][T13811] netlink: zone id is out of range [ 406.212927][T13811] netlink: zone id is out of range [ 406.212932][T13811] netlink: zone id is out of range [ 406.212935][T13811] netlink: zone id is out of range [ 406.212939][T13811] netlink: zone id is out of range [ 406.212943][T13811] netlink: zone id is out of range [ 406.212949][T13811] netlink: zone id is out of range [ 406.212953][T13811] netlink: zone id is out of range [ 406.473388][ C2] usb 8-1: yurex_control_callback - control failed: -2 [ 406.476534][ T5960] usb 8-1: USB disconnect, device number 18 [ 406.492956][ T5960] yurex 8-1:0.50: USB YUREX #0 now disconnected [ 406.674827][T13842] netlink: 36 bytes leftover after parsing attributes in process `syz.4.17800'. [ 406.737649][T13847] pim6reg: entered allmulticast mode [ 406.742266][T13847] pim6reg: left allmulticast mode [ 408.311762][T13845] syz.1.17802 (13845) used greatest stack depth: 19736 bytes left [ 408.473986][T13879] XFS (nbd4): SB validate failed with error -5. [ 408.518267][T13879] XFS (nbd4): io_pages changed from 0 to 1024, not restoring. [ 408.518528][T13879] XFS (nbd4): ra_pages changed from 0 to 64, not restoring. [ 408.544802][T13888] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17816'. [ 408.594188][ T43] kauditd_printk_skb: 12 callbacks suppressed [ 408.594205][ T43] audit: type=1326 audit(1700006679.362:305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13889 comm="syz.1.17818" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 408.596165][ T43] audit: type=1326 audit(1700006679.362:306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13889 comm="syz.1.17818" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 408.607440][ T43] audit: type=1326 audit(1700006679.371:307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13889 comm="syz.1.17818" exe="/syz-executor" sig=0 arch=40000003 syscall=298 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 408.607484][ T43] audit: type=1326 audit(1700006679.371:308): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13889 comm="syz.1.17818" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 408.607518][ T43] audit: type=1326 audit(1700006679.371:309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13889 comm="syz.1.17818" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 409.431895][T13927] team0: Device ipvlan1 is already an upper device of the team interface [ 409.551136][ T5874] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 409.558213][ T5874] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 409.561186][ T5874] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 409.576429][ T5874] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 409.579626][ T5874] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 409.724195][T13964] tc_dump_action: action bad kind [ 409.743716][ T5842] veth1_to_bridge: left allmulticast mode [ 409.743734][ T5842] veth1_to_bridge: left promiscuous mode [ 409.743836][ T5842] bridge0: port 1(veth1_to_bridge) entered disabled state [ 409.768587][ T5842] batman_adv: batadv0: Interface deactivated: gretap1 [ 410.142504][ T5842] batman_adv: batadv0: Removing interface: gretap1 [ 410.196565][T14008] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17859'. [ 410.196582][T14008] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17859'. [ 410.196597][T14008] netlink: 'syz.3.17859': attribute type 13 has an invalid length. [ 410.196605][T14008] netlink: 'syz.3.17859': attribute type 14 has an invalid length. [ 410.203424][T14010] random: crng reseeded on system resumption [ 410.284186][ T5842] bond0 (unregistering): Released all slaves [ 410.287024][ T5842] bond1 (unregistering): Released all slaves [ 410.292539][ T5842] bond2 (unregistering): Released all slaves [ 410.297725][ T5842] bond3 (unregistering): Released all slaves [ 410.303268][ T5842] bond4 (unregistering): Released all slaves [ 410.309309][ T5842] bond5 (unregistering): Released all slaves [ 410.315873][ T5842] bond6 (unregistering): Released all slaves [ 410.325240][ T5842] bond7 (unregistering): Released all slaves [ 410.330511][ T5842] bond8 (unregistering): Released all slaves [ 410.342635][ T5842] bond9 (unregistering): Released all slaves [ 410.545332][T13935] lo speed is unknown, defaulting to 1000 [ 410.548178][ T5842] tipc: Left network mode [ 410.550359][T14028] futex_wake_op: syz.3.17865 tries to shift op by -1; fix this program [ 410.553711][T13935] lo speed is unknown, defaulting to 1000 [ 411.001367][T13935] bridge0: port 1(bridge_slave_0) entered blocking state [ 411.001445][T13935] bridge0: port 1(bridge_slave_0) entered disabled state [ 411.001506][T13935] bridge_slave_0: entered allmulticast mode [ 411.002243][T13935] bridge_slave_0: entered promiscuous mode [ 411.003808][T13935] bridge0: port 2(bridge_slave_1) entered blocking state [ 411.003874][T13935] bridge0: port 2(bridge_slave_1) entered disabled state [ 411.003929][T13935] bridge_slave_1: entered allmulticast mode [ 411.004616][T13935] bridge_slave_1: entered promiscuous mode [ 411.039405][T13935] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 411.041053][T13935] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 411.091369][T14216] net_ratelimit: 498 callbacks suppressed [ 411.091382][T14216] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 411.091394][T14216] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 411.117893][T14221] comedi comedi3: fl512: I/O base address not correctly aligned [ 411.139069][T13935] team0: Port device team_slave_0 added [ 411.143678][T13935] team0: Port device team_slave_1 added [ 411.144172][T14215] netlink: 16 bytes leftover after parsing attributes in process `syz.3.17885'. [ 411.191763][T13935] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 411.191775][T13935] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 411.191791][T13935] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 411.203665][T14239] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17889'. [ 411.267590][T13935] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 411.267602][T13935] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 411.267616][T13935] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 411.309513][T14265] netlink: 'syz.3.17894': attribute type 58 has an invalid length. [ 411.309528][T14265] netlink: 20 bytes leftover after parsing attributes in process `syz.3.17894'. [ 411.471402][T13935] hsr_slave_0: entered promiscuous mode [ 411.471861][T13935] hsr_slave_1: entered promiscuous mode [ 411.472160][T13935] debugfs: 'hsr0' already exists in 'hsr' [ 411.472171][T13935] Cannot create hsr debugfs directory [ 411.767988][ T5860] Bluetooth: hci4: command tx timeout [ 412.096936][ T5968] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 412.099582][T13935] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 412.102791][T13935] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 412.123126][ T5842] hsr_slave_0: left promiscuous mode [ 412.124943][ T5842] hsr_slave_1: left promiscuous mode [ 412.256540][ T5968] usb 8-1: Using ep0 maxpacket: 16 [ 412.257058][ T5968] usb 8-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 412.257917][ T5968] usb 8-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 412.257931][ T5968] usb 8-1: config 0 interface 0 altsetting 1 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 412.257943][ T5968] usb 8-1: config 0 interface 0 altsetting 1 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 412.257955][ T5968] usb 8-1: config 0 interface 0 altsetting 1 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 412.257968][ T5968] usb 8-1: config 0 interface 0 has no altsetting 0 [ 412.261055][ T5968] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.261067][ T5968] usb 8-1: Product: syz [ 412.261074][ T5968] usb 8-1: Manufacturer: syz [ 412.261082][ T5968] usb 8-1: SerialNumber: syz [ 412.270110][ T5968] usb 8-1: config 0 descriptor?? [ 412.272834][T14446] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 412.339462][ T56] smbdirect: ib_dev[syz0] removed [ 412.349079][T13935] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 412.359054][T13935] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 412.359799][T13935] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 412.371616][T13935] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 412.377959][T13935] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 412.388099][T13935] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 412.497555][T14590] netlink: 'syz.4.17919': attribute type 1 has an invalid length. [ 412.497575][T14590] netlink: 220 bytes leftover after parsing attributes in process `syz.4.17919'. [ 412.515233][T14446] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 412.535042][ T5968] input: syz syz as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/input/input50 [ 412.659217][T14601] devpts: Bad value for 'max' [ 412.736488][ T5858] usb 8-1: USB disconnect, device number 19 [ 412.736572][ C2] synaptics_usb 8-1:0.0: synusb_irq - usb_submit_urb failed with result: -19 [ 412.833133][T13935] 8021q: adding VLAN 0 to HW filter on device bond0 [ 412.845652][ T5842] IPVS: stop unused estimator thread 0... [ 412.863562][T13935] 8021q: adding VLAN 0 to HW filter on device team0 [ 412.882349][T11571] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.882397][T11571] bridge0: port 1(bridge_slave_0) entered forwarding state [ 412.886212][T11571] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.886263][T11571] bridge0: port 2(bridge_slave_1) entered forwarding state [ 412.922972][T14631] veth1_macvtap: left promiscuous mode [ 412.922991][T14631] macsec0: entered promiscuous mode [ 412.923000][T14631] macsec0: entered allmulticast mode [ 412.930126][T14631] veth1_macvtap: entered promiscuous mode [ 412.930144][T14631] veth1_macvtap: entered allmulticast mode [ 412.930430][T14631] macsec0: left promiscuous mode [ 412.930582][T14631] macsec0: left allmulticast mode [ 412.930594][T14631] veth1_macvtap: left allmulticast mode [ 413.195831][T13935] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 413.357473][T14683] netlink: 116 bytes leftover after parsing attributes in process `syz.1.17939'. [ 413.401130][T13935] veth0_vlan: entered promiscuous mode [ 413.409237][T13935] veth1_vlan: entered promiscuous mode [ 413.445433][T13935] veth0_macvtap: entered promiscuous mode [ 413.468291][T13935] veth1_macvtap: entered promiscuous mode [ 413.476116][T13935] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 413.477918][T13935] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 413.561732][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.561778][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.563745][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.563769][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.588016][ T56] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.588034][ T56] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.628011][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.628033][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.988489][T14736] netlink: 8 bytes leftover after parsing attributes in process `syz.5.17956'. [ 413.988514][T14736] netlink: 8 bytes leftover after parsing attributes in process `syz.5.17956'. [ 413.988526][T14736] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Add Mapping response ret = -22) [ 413.997676][ T5860] Bluetooth: hci4: command tx timeout [ 414.207421][T14775] PKCS8: Unsupported PKCS#8 version [ 414.214944][ T5960] kernel read not supported for file /vcs (pid: 5960 comm: kworker/2:4) [ 414.313063][T14789] wireguard: wg2: Could not create IPv4 socket [ 414.325098][T14795] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 414.475118][T14820] tipc: Invalid UDP bearer configuration [ 414.475142][T14820] tipc: Enabling of bearer rejected, failed to enable media [ 414.501874][T14826] netlink: 'syz.4.17997': attribute type 21 has an invalid length. [ 414.501889][T14826] netlink: 128 bytes leftover after parsing attributes in process `syz.4.17997'. [ 414.501927][T14826] netlink: 'syz.4.17997': attribute type 4 has an invalid length. [ 414.501935][T14826] netlink: 'syz.4.17997': attribute type 5 has an invalid length. [ 414.501942][T14826] netlink: 3 bytes leftover after parsing attributes in process `syz.4.17997'. [ 414.502933][T14826] netlink: 'syz.4.17997': attribute type 21 has an invalid length. [ 414.502943][T14826] netlink: 128 bytes leftover after parsing attributes in process `syz.4.17997'. [ 414.502966][T14826] netlink: 'syz.4.17997': attribute type 4 has an invalid length. [ 414.502973][T14826] netlink: 'syz.4.17997': attribute type 5 has an invalid length. [ 414.502979][T14826] netlink: 3 bytes leftover after parsing attributes in process `syz.4.17997'. [ 414.717159][T14858] netlink: 240 bytes leftover after parsing attributes in process `syz.5.18011'. [ 414.845859][T14885] tipc: Enabling of bearer rejected, failed to enable media [ 414.851597][T14886] i2c i2c-1: DVB: adapter 0 frontend 0 frequency 51000000 out of range (51000..2150000) [ 414.908567][T14896] netlink: 224 bytes leftover after parsing attributes in process `syz.3.18028'. [ 414.950936][T14904] netlink: 56 bytes leftover after parsing attributes in process `syz.4.18032'. [ 414.999405][ T43] audit: type=1326 audit(1700006685.345:310): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14913 comm="syz.4.18035" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 415.003024][ T43] audit: type=1326 audit(1700006685.354:311): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14913 comm="syz.4.18035" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 415.007590][ T43] audit: type=1326 audit(1700006685.354:312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14913 comm="syz.4.18035" exe="/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf748efec code=0x7ffc0000 [ 415.007694][ T43] audit: type=1326 audit(1700006685.354:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14913 comm="syz.4.18035" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 415.007792][ T43] audit: type=1326 audit(1700006685.354:314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14913 comm="syz.4.18035" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 415.009684][ T43] audit: type=1326 audit(1700006685.354:315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14913 comm="syz.4.18035" exe="/syz-executor" sig=0 arch=40000003 syscall=78 compat=1 ip=0xf748efec code=0x7ffc0000 [ 415.009779][ T43] audit: type=1326 audit(1700006685.354:316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14913 comm="syz.4.18035" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 415.009874][ T43] audit: type=1326 audit(1700006685.354:317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14913 comm="syz.4.18035" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 415.208125][T14942] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 415.208149][T14942] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 415.208173][T14942] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 415.212103][T14942] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 415.613089][T15013] netlink: 964 bytes leftover after parsing attributes in process `syz.3.18077'. [ 415.613106][T15013] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 416.139478][T15071] [U]  [ 416.208942][ T5860] Bluetooth: hci4: command tx timeout [ 416.228247][T15081] validate_nla: 3 callbacks suppressed [ 416.228261][T15081] netlink: 'syz.5.18108': attribute type 5 has an invalid length. [ 416.357030][ T5842] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 416.357108][ T5842] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 416.357147][ T5842] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 416.357170][ T5842] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 416.574540][T15117] vxcan1: Master is either lo or non-ether device [ 416.606584][T15114] syz.3.18121: page allocation failure: order:1, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 416.606626][T15114] CPU: 2 UID: 0 PID: 15114 Comm: syz.3.18121 Tainted: G L syzkaller #0 PREEMPT(full) [ 416.606642][T15114] Tainted: [L]=SOFTLOCKUP [ 416.606647][T15114] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 416.606653][T15114] Call Trace: [ 416.606658][T15114] [ 416.606663][T15114] dump_stack_lvl+0x100/0x190 [ 416.606682][T15114] warn_alloc.cold+0x9e/0xb2 [ 416.606696][T15114] ? __pfx_warn_alloc+0x10/0x10 [ 416.606713][T15114] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 416.606731][T15114] ? __pfx_get_page_from_freelist+0x10/0x10 [ 416.606749][T15114] __alloc_frozen_pages_noprof+0xcb6/0x3300 [ 416.606770][T15114] ? do_raw_spin_lock+0x128/0x260 [ 416.606798][T15114] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 416.606816][T15114] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 416.606830][T15114] ? lockdep_hardirqs_on+0x7d/0x110 [ 416.606844][T15114] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 416.606874][T15114] ? stack_depot_save_flags+0x49a/0x9f0 [ 416.606894][T15114] ? comedi_isadma_alloc+0xc6/0x620 [ 416.606904][T15114] ? pcl812_attach+0x18f5/0x2300 [ 416.606919][T15114] ? comedi_device_attach+0x40e/0x6b0 [ 416.606933][T15114] ? do_devconfig_ioctl+0x1b3/0x6d0 [ 416.606950][T15114] ? comedi_unlocked_ioctl+0x860/0x3310 [ 416.606970][T15114] alloc_pages_node_noprof+0x93/0x200 [ 416.606984][T15114] ? __pfx_alloc_pages_node_noprof+0x10/0x10 [ 416.607003][T15114] __dma_direct_alloc_pages.isra.0+0x35e/0x540 [ 416.607021][T15114] dma_direct_alloc+0x104/0x8a0 [ 416.607037][T15114] dma_alloc_attrs+0x1b9/0x3e0 [ 416.607051][T15114] ? __pfx_dma_alloc_attrs+0x10/0x10 [ 416.607064][T15114] ? __kmalloc_noprof+0x350/0x840 [ 416.607078][T15114] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 416.607091][T15114] ? dma_direct_supported+0xca/0x220 [ 416.607109][T15114] comedi_isadma_alloc+0x331/0x620 [ 416.607122][T15114] ? __pfx_comedi_isadma_alloc+0x10/0x10 [ 416.607135][T15114] ? request_threaded_irq+0x27b/0x3e0 [ 416.607154][T15114] pcl812_attach+0x18f5/0x2300 [ 416.607173][T15114] comedi_device_attach+0x40e/0x6b0 [ 416.607192][T15114] do_devconfig_ioctl+0x1b3/0x6d0 [ 416.607209][T15114] ? comedi_unlocked_ioctl+0x180/0x3310 [ 416.607223][T15114] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 416.607248][T15114] ? tomoyo_path_number_perm+0x46d/0x580 [ 416.607261][T15114] ? kasan_save_stack+0x3f/0x50 [ 416.607275][T15114] ? kasan_save_stack+0x30/0x50 [ 416.607290][T15114] ? kasan_save_track+0x14/0x30 [ 416.607304][T15114] ? kasan_save_free_info+0x3b/0x70 [ 416.607319][T15114] comedi_unlocked_ioctl+0x860/0x3310 [ 416.607350][T15114] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 416.607375][T15114] ? kasan_quarantine_put+0x104/0x240 [ 416.607389][T15114] ? lockdep_hardirqs_on+0x7d/0x110 [ 416.607404][T15114] ? find_held_lock+0x2b/0x80 [ 416.607417][T15114] ? tomoyo_path_number_perm+0x28f/0x580 [ 416.607429][T15114] ? tomoyo_path_number_perm+0x28f/0x580 [ 416.607445][T15114] ? tomoyo_path_number_perm+0x188/0x580 [ 416.607460][T15114] comedi_compat_ioctl+0x438/0xe20 [ 416.607474][T15114] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 416.607491][T15114] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 416.607510][T15114] ? do_vfs_ioctl+0x226/0x13e0 [ 416.607524][T15114] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 416.607540][T15114] ? __fget_files+0x34/0x3d0 [ 416.607554][T15114] ? find_held_lock+0x2b/0x80 [ 416.607567][T15114] ? __fget_files+0x215/0x3d0 [ 416.607581][T15114] ? hook_file_ioctl_common+0x140/0x440 [ 416.607597][T15114] ? __fget_files+0x21f/0x3d0 [ 416.607615][T15114] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 416.607628][T15114] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 416.607643][T15114] __do_fast_syscall_32+0x13a/0x8b0 [ 416.607661][T15114] do_fast_syscall_32+0x32/0x70 [ 416.607676][T15114] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 416.607691][T15114] RIP: 0023:0xf7fa4fec [ 416.607705][T15114] Code: Unable to access opcode bytes at 0xf7fa4fc2. [ 416.607710][T15114] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 416.607721][T15114] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040946400 [ 416.607729][T15114] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 416.607735][T15114] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 416.607742][T15114] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 416.607748][T15114] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 416.607763][T15114] [ 416.608457][T15114] Mem-Info: [ 416.608465][T15114] active_anon:2574 inactive_anon:9871 isolated_anon:0 [ 416.608465][T15114] active_file:413 inactive_file:23151 isolated_file:0 [ 416.608465][T15114] unevictable:1000 dirty:503 writeback:0 [ 416.608465][T15114] slab_reclaimable:7274 slab_unreclaimable:67446 [ 416.608465][T15114] mapped:22982 shmem:1016 pagetables:1821 [ 416.608465][T15114] sec_pagetables:344 bounce:0 [ 416.608465][T15114] kernel_misc_reclaimable:0 [ 416.608465][T15114] free:52583 free_pcp:0 free_cma:0 [ 416.608498][T15114] Node 0 active_anon:0kB inactive_anon:8kB active_file:52kB inactive_file:84kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:0kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8320kB pagetables:1172kB sec_pagetables:1144kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 416.608526][T15114] Node 0 DMA free:2612kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 416.608581][T15114] lowmem_reserve[]: 0 278 278 278 278 [ 416.608603][T15114] Node 0 DMA: 48*4kB (U) 27*8kB (U) 7*16kB (UE) 8*32kB (U) 1*64kB (E) 0*128kB 1*256kB (E) 1*512kB (E) 1*1024kB (E) 0*2048kB 0*4096kB = 2632kB [ 416.608697][T15114] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 416.608706][T15114] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 416.608714][T15114] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 416.608745][T15114] Node 1 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 416.608755][T15114] 25615 total pagecache pages [ 416.608759][T15114] 1037 pages in swap cache [ 416.608763][T15114] Free swap = 72972kB [ 416.608766][T15114] Total swap = 124996kB [ 416.608771][T15114] 524155 pages RAM [ 416.608774][T15114] 0 pages HighMem/MovableOnly [ 416.608778][T15114] 212075 pages reserved [ 416.608782][T15114] 0 pages cma reserved [ 418.430355][ T5860] Bluetooth: hci4: command tx timeout [ 418.592987][T15284] program syz.3.18191 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 418.625925][T15289] netlink: Setting conntrack mark requires 'commit' flag. [ 418.625941][T15289] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 419.678817][T15402] __nla_validate_parse: 4 callbacks suppressed [ 419.678831][T15402] netlink: 4 bytes leftover after parsing attributes in process `syz.3.18242'. [ 419.836034][T15418] binder: 15417:15418 ioctl 400c620e 80000100 returned -22 [ 420.000763][T15431] netdevsim netdevsim3 netdevsim3 (unregistering): left allmulticast mode [ 420.003788][T15431] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20003 - 0 [ 420.003812][T15431] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 420.047566][T15440] netlink: 24 bytes leftover after parsing attributes in process `syz.5.18257'. [ 420.156940][T15431] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20003 - 0 [ 420.156965][T15431] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 420.295140][T15431] bond0: (slave netdevsim1): Releasing backup interface [ 420.296290][T15431] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20003 - 0 [ 420.296312][T15431] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 420.381090][T15467] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 420.484694][T15431] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20003 - 0 [ 420.484719][T15431] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 420.563832][T15485] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 420.563851][T15485] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 420.564586][T15485] vhci_hcd vhci_hcd.0: Device attached [ 420.565600][T15487] vhci_hcd: connection closed [ 420.565754][ T5938] vhci_hcd vhci_hcd.4: stop threads [ 420.565769][ T5938] vhci_hcd vhci_hcd.4: release socket [ 420.565779][ T5938] vhci_hcd vhci_hcd.4: disconnect device [ 420.640564][ T5938] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 420.640584][ T5938] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 20003 - 0 [ 420.661994][ T5842] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 420.662037][ T5842] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 20003 - 0 [ 420.685740][ T5842] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 420.685761][ T5842] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 20003 - 0 [ 420.685873][ T5842] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 420.685888][ T5842] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 20003 - 0 [ 420.742291][T15504] lo speed is unknown, defaulting to 1000 [ 421.108648][T15063] Process accounting paused [ 421.301021][T15572] tipc: Enabled bearer , priority 4 [ 422.924445][T15648] veth0_to_bond: entered allmulticast mode [ 422.962522][T15653] usb usb7: usbfs: interface 0 claimed by hub while 'syz.3.18327' resets device [ 422.964775][T15654] netlink: 4 bytes leftover after parsing attributes in process `syz.5.18326'. [ 422.978520][T15654] batadv0: entered promiscuous mode [ 422.984263][T15654] macsec1: entered promiscuous mode [ 422.984464][T15654] macsec1: entered allmulticast mode [ 422.984478][T15654] batadv0: entered allmulticast mode [ 422.985420][T15654] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 422.992482][T15654] batadv0: left allmulticast mode [ 422.992740][T15654] batadv0: left promiscuous mode [ 423.163169][T15674] nicvf0: renamed from team0 (while UP) [ 423.167592][T15674] nicvf0: Cannot enslave team device to itself [ 423.167612][T15674] A link change request failed with some changes committed already. Interface nicvf0 may have been left with an inconsistent configuration, please check. [ 423.174405][ T30] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 423.311943][ T5960] kernel write not supported for file /sg0 (pid: 5960 comm: kworker/2:4) [ 423.364399][ T30] usb 9-1: Using ep0 maxpacket: 8 [ 423.364914][ T30] usb 9-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 423.365740][ T30] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 423.365760][ T30] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 423.365773][ T30] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 423.367401][ T30] usb 9-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 423.367413][ T30] usb 9-1: Product: syz [ 423.367421][ T30] usb 9-1: Manufacturer: syz [ 423.367428][ T30] usb 9-1: SerialNumber: syz [ 423.372989][ T30] usb 9-1: config 0 descriptor?? [ 423.451316][ T30] rc_core: IR keymap rc-imon-rsc not found [ 423.451329][ T30] Registered IR keymap rc-empty [ 423.452365][ T30] rc rc0: iMON Station as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 423.453201][ T30] input: iMON Station as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input51 [ 423.521129][ T43] audit: type=1326 audit(1700006693.332:318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15724 comm="syz.3.18352" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fa4fec code=0x0 [ 423.613443][ T5960] usb 9-1: USB disconnect, device number 2 [ 423.689377][T15752] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 423.974382][ T5858] kernel write not supported for file /vcs (pid: 5858 comm: kworker/2:2) [ 424.777397][T15845] ptrace attach of "/syz-executor exec"[15846] was attempted by "/syz-executor exec"[15845] [ 424.961318][T15865] netlink: 4 bytes leftover after parsing attributes in process `syz.4.18409'. [ 425.587190][T15899] xt_time: unknown flags 0xf4 [ 425.822512][T15925] loop8: detected capacity change from 0 to 7 [ 425.843679][ C1] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 425.849192][ C1] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 425.849371][ C1] Buffer I/O error on dev loop8, logical block 0, async page read [ 425.855734][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 425.855793][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 425.856417][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 425.856464][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 425.856879][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 425.856926][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 425.857351][ C0] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 425.857398][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 425.875894][ C3] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 425.875950][ C3] Buffer I/O error on dev loop8, logical block 0, async page read [ 425.876667][ C3] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 425.876703][ C3] Buffer I/O error on dev loop8, logical block 0, async page read [ 425.882388][ C3] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 425.882430][ C3] Buffer I/O error on dev loop8, logical block 0, async page read [ 425.882588][ C3] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 425.882617][ C3] Buffer I/O error on dev loop8, logical block 0, async page read [ 425.882753][ C3] Buffer I/O error on dev loop8, logical block 0, async page read [ 425.883100][T15925] ldm_validate_partition_table(): Disk read failed. [ 425.889897][T15925] Dev loop8: unable to read RDB block 0 [ 425.890466][T15925] loop8: unable to read partition table [ 425.890624][T15925] loop8: partition table beyond EOD, truncated [ 425.890644][T15925] loop_reread_partitions: partition scan of loop8 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 426.027679][T15947] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 426.117305][T15957] loop7: detected capacity change from 0 to 7 [ 426.202905][T15957] Dev loop7: unable to read RDB block 7 [ 426.202929][T15957] loop7: unable to read partition table [ 426.203024][T15957] loop7: partition table beyond EOD, truncated [ 426.203043][T15957] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 426.501038][T16002] netlink: 24 bytes leftover after parsing attributes in process `syz.1.18468'. [ 426.651861][T16023] Bluetooth: hci0: unsupported parameter 5135 [ 426.651875][T16023] Bluetooth: hci0: unsupported parameter 8192 [ 426.651882][T16023] Bluetooth: hci0: unsupported parameter 5135 [ 426.651888][T16023] Bluetooth: hci0: unsupported parameter 8192 [ 426.679141][T16024] netlink: 8 bytes leftover after parsing attributes in process `syz.4.18476'. [ 426.679399][T16024] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 426.915951][T16059] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_vlan, syncid = 0, id = 0 [ 427.069781][T16083] GUP no longer grows the stack in syz.1.18503 (16083): 80001000-80c01000 (80000000) [ 427.069802][T16083] CPU: 1 UID: 0 PID: 16083 Comm: syz.1.18503 Tainted: G L syzkaller #0 PREEMPT(full) [ 427.069818][T16083] Tainted: [L]=SOFTLOCKUP [ 427.069822][T16083] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 427.069830][T16083] Call Trace: [ 427.069834][T16083] [ 427.069839][T16083] dump_stack_lvl+0x100/0x190 [ 427.069859][T16083] gup_vma_lookup.cold+0x83/0x96 [ 427.069877][T16083] __get_user_pages+0x252/0x2c30 [ 427.069899][T16083] ? __pfx___get_user_pages+0x10/0x10 [ 427.069915][T16083] ? __pfx_down_read_killable+0x10/0x10 [ 427.069937][T16083] __gup_longterm_locked+0x87d/0x16f0 [ 427.069957][T16083] ? __pfx___gup_longterm_locked+0x10/0x10 [ 427.069973][T16083] ? lock_acquire+0x1d1/0x380 [ 427.069990][T16083] ? gup_fast_fallback+0x13f7/0x2790 [ 427.070006][T16083] ? find_held_lock+0x2b/0x80 [ 427.070019][T16083] ? gup_fast_fallback+0x1467/0x2790 [ 427.070058][T16083] gup_fast_fallback+0x16dc/0x2790 [ 427.070087][T16083] ? __pfx_gup_fast_fallback+0x10/0x10 [ 427.070103][T16083] ? rcu_is_watching+0x13/0xc0 [ 427.070121][T16083] ? __lock_acquire+0x5c0/0x1f40 [ 427.070141][T16083] get_user_pages_fast+0xa7/0xf0 [ 427.070158][T16083] ? __pfx_get_user_pages_fast+0x10/0x10 [ 427.070177][T16083] ? lock_acquire+0x1d1/0x380 [ 427.070196][T16083] get_futex_key+0x2c6/0x14f0 [ 427.070210][T16083] ? __pfx_get_futex_key+0x10/0x10 [ 427.070222][T16083] ? futex_unqueue+0x13d/0x2c0 [ 427.070234][T16083] ? __futex_wait+0x256/0x300 [ 427.070251][T16083] futex_requeue+0x227/0x22e0 [ 427.070272][T16083] ? __pfx_futex_requeue+0x10/0x10 [ 427.070297][T16083] ? up_write+0x2dc/0x5b0 [ 427.070310][T16083] do_futex+0x3ae/0x440 [ 427.070324][T16083] ? __pfx_do_futex+0x10/0x10 [ 427.070354][T16083] __ia32_sys_futex_time32+0x2f4/0x470 [ 427.070370][T16083] ? xfd_validate_state+0x129/0x190 [ 427.070387][T16083] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 427.070407][T16083] __do_fast_syscall_32+0x13a/0x8b0 [ 427.070426][T16083] do_fast_syscall_32+0x32/0x70 [ 427.070443][T16083] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 427.070458][T16083] RIP: 0023:0xf7fb3fec [ 427.070475][T16083] Code: Unable to access opcode bytes at 0xf7fb3fc2. [ 427.070481][T16083] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 427.070494][T16083] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000000004 [ 427.070502][T16083] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 427.070510][T16083] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 427.070518][T16083] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 427.070526][T16083] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 427.070542][T16083] [ 427.389907][T16121] netlink: 8 bytes leftover after parsing attributes in process `syz.3.18508'. [ 427.389931][T16121] netlink: 'syz.3.18508': attribute type 10 has an invalid length. [ 427.389940][T16121] netlink: 32 bytes leftover after parsing attributes in process `syz.3.18508'. [ 427.427285][T16127] netlink: 'syz.1.18520': attribute type 3 has an invalid length. [ 427.429345][ T5947] logitech-hidpp-device 0005:046D:B012.0007: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 427.532389][T16132] fido_id[16132]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 427.595425][T16183] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 427.625993][T16197] program syz.3.18532 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 428.826070][T16311] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0xb993 instead [ 428.826086][T16311] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x9785 instead [ 428.826096][T16311] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000008: 0xd254 instead [ 428.826105][T16311] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000000c: 0x84e9 instead [ 428.826114][T16311] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000010: 0xd202 instead [ 428.826124][T16311] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000014: 0x32d4 instead [ 428.826252][T16311] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000840: 0x642f instead [ 428.826261][T16311] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000844: 0x6d2f instead [ 428.826271][T16311] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000848: 0x0023 instead [ 428.826546][T16311] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001980: 0x00c0 instead [ 428.826561][T16311] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000198c: 0x00e4 instead [ 428.856517][T16311] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 428.856527][T16311] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 429.336278][T16371] lo: MTU too low for tipc bearer [ 429.336301][T16371] tipc: Enabling of bearer rejected, failed to enable media [ 429.337675][T16372] netlink: 4 bytes leftover after parsing attributes in process `syz.4.18568'. [ 429.415698][T16378] nbd: must specify a size in bytes for the device [ 429.484763][ T43] audit: type=1326 audit(1700006699.910:319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16387 comm="syz.5.18580" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf739efec code=0x7ffc0000 [ 429.484795][ T43] audit: type=1326 audit(1700006699.910:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16387 comm="syz.5.18580" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf739efec code=0x7ffc0000 [ 429.484818][ T43] audit: type=1326 audit(1700006699.920:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16387 comm="syz.5.18580" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf739efec code=0x7ffc0000 [ 429.484838][ T43] audit: type=1326 audit(1700006699.920:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16387 comm="syz.5.18580" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf739efec code=0x7ffc0000 [ 429.486668][ T43] audit: type=1326 audit(1700006699.920:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16387 comm="syz.5.18580" exe="/syz-executor" sig=0 arch=40000003 syscall=399 compat=1 ip=0xf739efec code=0x7ffc0000 [ 429.486700][ T43] audit: type=1326 audit(1700006699.920:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16387 comm="syz.5.18580" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf739efec code=0x7ffc0000 [ 429.486758][ T43] audit: type=1326 audit(1700006699.920:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16387 comm="syz.5.18580" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf739efec code=0x7ffc0000 [ 429.487167][ T43] audit: type=1326 audit(1700006699.920:326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16387 comm="syz.5.18580" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf739efec code=0x7ffc0000 [ 429.487193][ T43] audit: type=1326 audit(1700006699.920:327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16387 comm="syz.5.18580" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf739efec code=0x7ffc0000 [ 429.487215][ T43] audit: type=1326 audit(1700006699.920:328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16387 comm="syz.5.18580" exe="/syz-executor" sig=0 arch=40000003 syscall=400 compat=1 ip=0xf739efec code=0x7ffc0000 [ 429.508514][T16392] netlink: 16 bytes leftover after parsing attributes in process `syz.3.18582'. [ 429.699436][T16419] netlink: 'syz.1.18594': attribute type 2 has an invalid length. [ 429.952157][T16443] tmpfs: Cannot change global quota limit on remount [ 429.958705][T16430] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.031337][T16453] usb usb8: usbfs: process 16453 (syz.5.18608) did not claim interface 0 before use [ 430.113739][T16430] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.120904][T16466] netlink: 292 bytes leftover after parsing attributes in process `syz.5.18613'. [ 430.181982][T16430] bond0: (slave netdevsim1): Releasing backup interface [ 430.187135][T16430] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.471043][T16430] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.597506][T16513] program syz.3.18632 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 430.597545][T16513] ata1.00: invalid service action 4 [ 430.633673][T16522] program syz.3.18635 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 430.672513][ T12] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.683230][ T12] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.683255][ T12] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.683273][ T12] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.737045][ T5970] wacom 0003:056A:003F.0008: hidraw0: USB HID v0.00 Gamepad [syz0] on syz0 [ 430.793787][T16550] fido_id[16550]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 430.903463][T16570] netlink: 8 bytes leftover after parsing attributes in process `syz.3.18652'. [ 431.967248][T16604] netlink: Failed to add batadv0 helper -22 [ 431.967277][T16604] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 432.087243][T16613] UHID_CREATE from different security context by process 9752 (syz.3.18668), this is not allowed. [ 432.952104][T16732] 0x000000000001-0x000000010001 : "" [ 432.961251][T16732] ftl_cs: FTL header not found. [ 433.066429][T16743] netlink: 4 bytes leftover after parsing attributes in process `syz.5.18723'. [ 433.632546][ T5970] sony 0005:054C:03D5.0009: UNIQ does not contain a MAC address; duplicate check skipped [ 433.683768][ T5970] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.0009/input/input55 [ 433.710674][ T5970] sony 0005:054C:03D5.0009: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 433.781429][T16788] fido_id[16788]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 433.861895][T16809] macvtap1: entered promiscuous mode [ 433.861911][T16809] dummy0: entered promiscuous mode [ 433.862083][T16809] macvtap1: entered allmulticast mode [ 433.862092][T16809] dummy0: entered allmulticast mode [ 433.932254][T16817] netlink: 16 bytes leftover after parsing attributes in process `syz.1.18744'. [ 434.020604][T16827] overlayfs: fs on './cgroup' does not support file handles, falling back to index=off,nfs_export=off. [ 434.020617][T16827] overlayfs: fs on './cgroup' does not support file handles, falling back to xino=off. [ 434.231330][T16848] netlink: 52 bytes leftover after parsing attributes in process `syz.3.18757'. [ 434.397528][T16866] netlink: 4 bytes leftover after parsing attributes in process `syz.5.18765'. [ 434.421920][T16868] smc: net device ip6_vti0 applied user defined pnetid SYZ2 [ 434.717237][ T10] usb 10-1: new full-speed USB device number 2 using dummy_hcd [ 434.888563][ T10] usb 10-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 434.889763][ T10] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 434.889781][ T10] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 434.889815][ T10] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 434.892389][ T10] usb 10-1: config 0 descriptor?? [ 434.897891][ T10] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 434.898139][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 434.904467][ T10] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 434.911743][ T10] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 434.911774][ T10] usb 10-1: media controller created [ 434.913301][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 434.948000][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 434.948052][ T10] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 434.952102][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb10/10-1/input/input56 [ 434.963105][ T10] dvb-usb: schedule remote query interval to 150 msecs. [ 434.963118][ T10] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 435.113784][ T30] usb 10-1: USB disconnect, device number 2 [ 435.309261][T16938] netlink: 348 bytes leftover after parsing attributes in process `syz.1.18784'. [ 435.410443][ T30] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 435.511146][T16957] syz.4.18789 (16957) used greatest stack depth: 19256 bytes left [ 435.622246][T16970] Invalid ELF header len 3 [ 435.680721][T16978] IPVS: Unknown mcast interface: veth1_vlan [ 435.840962][T17002] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 435.840986][T17002] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 435.844885][T17002] vhci_hcd vhci_hcd.0: Device attached [ 435.849642][T17005] vhci_hcd: connection closed [ 435.850049][ T12] vhci_hcd vhci_hcd.1: stop threads [ 435.850064][ T12] vhci_hcd vhci_hcd.1: release socket [ 435.850074][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 435.995069][T17030] netlink: 8 bytes leftover after parsing attributes in process `syz.5.18821'. [ 436.121499][T17043] tipc: Started in network mode [ 436.121525][T17043] tipc: Node identity fe80000000000000000000000000001, cluster identity 4711 [ 436.122052][T17043] tipc: Enabled bearer , priority 4 [ 436.231597][T17059] netlink: 44 bytes leftover after parsing attributes in process `syz.3.18835'. [ 436.295491][T17065] netlink: 8 bytes leftover after parsing attributes in process `syz.3.18838'. [ 436.303860][T17067] netlink: 8 bytes leftover after parsing attributes in process `syz.4.18839'. [ 436.305224][T17067] netlink: 16 bytes leftover after parsing attributes in process `syz.4.18839'. [ 436.596327][T17107] Could not find key with description: [0123456789abcdef] [ 436.596339][T17107] process_request_key_err: No key [ 436.596345][T17107] Could not find valid key in user session keyring for sig specified in mount option: [0123456789abcdef] [ 436.596351][T17107] One or more global auth toks could not properly register; rc = [-2] [ 436.596364][T17107] Error validating options; rc = [-2] [ 436.846301][T17136] Bluetooth: MGMT ver 1.23 [ 436.885351][ T10] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 436.886802][T17138] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0xb993 instead [ 436.886819][T17138] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x9785 instead [ 436.886830][T17138] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000008: 0xd254 instead [ 436.886844][T17138] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000000c: 0x84e9 instead [ 436.886857][T17138] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000010: 0xd202 instead [ 436.886870][T17138] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000014: 0x32d4 instead [ 436.887045][T17138] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000840: 0x642f instead [ 436.887059][T17138] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000844: 0x6d2f instead [ 436.887073][T17138] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000848: 0x0023 instead [ 436.887433][T17138] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001980: 0x00c0 instead [ 436.887448][T17138] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000198c: 0x00e4 instead [ 436.901371][T17138] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 436.901382][T17138] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 436.908385][T17140] can0: slcan on ttyS3. [ 437.025590][T17139] can0 (unregistered): slcan off ttyS3. [ 437.067360][ T10] usb 10-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice= 1.00 [ 437.068195][ T10] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 437.069464][ T10] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 437.069476][ T10] usb 10-1: Product: syz [ 437.069483][ T10] usb 10-1: Manufacturer: syz [ 437.077627][ T10] usb 10-1: selecting invalid altsetting 1 [ 437.080776][ T10] dvb_ttusb_budget: ttusb_init_controller: error [ 437.080786][ T10] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 437.124398][ T10] DVB: Unable to find symbol cx22700_attach() [ 437.158685][ T10] DVB: Unable to find symbol tda10046_attach() [ 437.158695][ T10] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 437.295088][T17109] dvb_ttusb_budget: failed urb submission (0: err = -2)! [ 437.295872][ T5960] usb 10-1: USB disconnect, device number 3 [ 437.314440][ T5938] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 437.314593][ T5938] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 437.336661][ T5858] tipc: Node number set to 4269801488 [ 437.356697][ T5970] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 437.462360][ T58] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 437.622684][ T58] usb 8-1: Using ep0 maxpacket: 8 [ 437.623182][ T58] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 437.623655][ T58] usb 8-1: config 0 has no interfaces? [ 437.623672][ T58] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 437.630211][ T58] usb 8-1: config 0 descriptor?? [ 437.729304][ T5970] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 437.853583][ T58] usb 8-1: USB disconnect, device number 20 [ 437.878741][ T5970] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 438.295640][T17247] Could not find key with description: [0123456789abcdef] [ 438.295655][T17247] process_request_key_err: No key [ 438.295664][T17247] Could not find valid key in user session keyring for sig specified in mount option: [0123456789abcdef] [ 438.295675][T17247] One or more global auth toks could not properly register; rc = [-2] [ 438.295697][T17247] Error validating options; rc = [-2] [ 438.597129][T17278] __nla_validate_parse: 3 callbacks suppressed [ 438.597143][T17278] netlink: 20 bytes leftover after parsing attributes in process `syz.4.18911'. [ 439.235922][T17379] lo speed is unknown, defaulting to 1000 [ 439.803684][T17446] netlink: 4 bytes leftover after parsing attributes in process `syz.4.18968'. [ 439.992198][T17465] ubi: bad wear-leveling threshold -2147483200 [ 440.188253][T17487] netlink: 4 bytes leftover after parsing attributes in process `syz.3.18985'. [ 440.424096][T17514] netlink: 'syz.3.19001': attribute type 1 has an invalid length. [ 440.424117][T17514] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 440.756376][T17548] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 440.920681][T17561] netlink: 'syz.1.19023': attribute type 11 has an invalid length. [ 440.989551][T17573] netlink: 'syz.4.19027': attribute type 4 has an invalid length. [ 440.989565][T17573] netlink: 224 bytes leftover after parsing attributes in process `syz.4.19027'. [ 441.038405][T17579] netlink: 4 bytes leftover after parsing attributes in process `syz.5.19017'. [ 441.175232][T17594] netlink: 128 bytes leftover after parsing attributes in process `syz.3.19036'. [ 441.254573][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 441.298573][T17617] netlink: 4 bytes leftover after parsing attributes in process `syz.3.19045'. [ 441.387236][T17629] netlink: 'syz.3.19050': attribute type 7 has an invalid length. [ 441.387256][T17629] netlink: 'syz.3.19050': attribute type 8 has an invalid length. [ 441.431265][ T5960] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 441.431960][ T5960] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 441.432648][ T5960] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 441.433330][ T5960] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 441.433341][ T5960] rtc rtc0: __rtc_set_alarm: err=-22 [ 441.518053][ T1066] IPVS: starting estimator thread 0... [ 441.617174][T17654] IPVS: using max 47 ests per chain, 112800 per kthread [ 441.781689][T17683] netlink: 12 bytes leftover after parsing attributes in process `syz.5.19076'. [ 442.412374][T17741] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 442.606496][T17763] usb usb8: check_ctrlrecip: process 17763 (syz.4.19114) requesting ep 01 but needs 81 [ 442.606526][T17763] usb usb8: usbfs: process 17763 (syz.4.19114) did not claim interface 0 before use [ 442.656123][T17771] vivid-006: disconnect [ 442.661085][T17769] vivid-006: reconnect [ 442.726503][T17782] netlink: 4 bytes leftover after parsing attributes in process `syz.3.19120'. [ 442.775707][T17789] tipc: Enabling of bearer rejected, failed to enable media [ 442.938672][T17819] netlink: 20 bytes leftover after parsing attributes in process `syz.4.19139'. [ 442.938691][T17819] openvswitch: netlink: IPv4 frag type 110 is out of range max 2 [ 443.414402][T17899] nicvf0: renamed from team0 (while UP) [ 443.434186][T17899] nicvf0: Cannot enslave team device to itself [ 443.434203][T17899] A link change request failed with some changes committed already. Interface nicvf0 may have been left with an inconsistent configuration, please check. [ 443.865089][T17934] nicvf0: renamed from team0 [ 443.873248][T17934] nicvf0: left allmulticast mode [ 443.873262][T17934] team_slave_0: left allmulticast mode [ 443.873272][T17934] team_slave_1: left allmulticast mode [ 443.873283][T17934] nicvf0: left promiscuous mode [ 443.873291][T17934] team_slave_0: left promiscuous mode [ 443.873381][T17934] team_slave_1: left promiscuous mode [ 443.873470][T17934] mac80211_hwsim hwsim2 wlan0: left promiscuous mode [ 443.873630][T17934] bridge0: port 3(nicvf0) entered disabled state [ 443.893250][T17934] nicvf0: Cannot enslave team device to itself [ 443.893265][T17934] A link change request failed with some changes committed already. Interface nicvf0 may have been left with an inconsistent configuration, please check. [ 443.999536][T17942] loop7: detected capacity change from 0 to 7 [ 444.047356][T17942] Dev loop7: unable to read RDB block 7 [ 444.047381][T17942] loop7: unable to read partition table [ 444.047482][T17942] loop7: partition table beyond EOD, truncated [ 444.047500][T17942] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 444.546940][T17974] tipc: Enabling of bearer rejected, already enabled [ 444.653188][T17989] netlink: 'syz.4.19207': attribute type 1 has an invalid length. [ 444.739329][T18002] netlink: Conntrack attr type has unexpected length (type=9, length=0, expected=32) [ 444.925547][T18030] usb usb9: usbfs: process 18030 (syz.4.19235) did not claim interface 20 before use [ 445.250120][T18050] netlink: 'syz.5.19236': attribute type 9 has an invalid length. [ 445.379453][T18063] lo speed is unknown, defaulting to 1000 [ 445.425540][T18043] bond0: (slave netdevsim1): Releasing backup interface [ 445.427828][T18043] netdevsim netdevsim1 netdevsim1 (unregistering): left promiscuous mode [ 445.427856][T18043] netdevsim netdevsim1 netdevsim1 (unregistering): left allmulticast mode [ 445.529707][T18091] __nla_validate_parse: 2 callbacks suppressed [ 445.529722][T18091] netlink: 20 bytes leftover after parsing attributes in process `syz.5.19241'. [ 445.877811][T18118] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 446.178884][T18144] input input57: cannot allocate more than FF_MAX_EFFECTS effects [ 446.461653][T18158] netlink: 4 bytes leftover after parsing attributes in process `syz.3.19266'. [ 446.625862][T18176] netlink: 'syz.1.19274': attribute type 1 has an invalid length. [ 446.625885][T18176] netlink: 240 bytes leftover after parsing attributes in process `syz.1.19274'. [ 446.625899][T18176] netlink: 'syz.1.19274': attribute type 1 has an invalid length. [ 447.079795][T18220] 0x000000000001-0x000000010001 : "" [ 447.104788][T18220] ftl_cs: FTL header not found. [ 447.459452][ T43] kauditd_printk_skb: 14 callbacks suppressed [ 447.459464][ T43] audit: type=1326 audit(1700006716.745:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18276 comm="syz.4.19318" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 447.462055][ T43] audit: type=1326 audit(1700006716.745:344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18276 comm="syz.4.19318" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 447.466138][ T43] audit: type=1326 audit(1700006716.745:345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18276 comm="syz.4.19318" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 447.466169][ T43] audit: type=1326 audit(1700006716.745:346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18276 comm="syz.4.19318" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 447.468599][ T43] audit: type=1326 audit(1700006716.745:347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18276 comm="syz.4.19318" exe="/syz-executor" sig=0 arch=40000003 syscall=435 compat=1 ip=0xf748efec code=0x7ffc0000 [ 447.490405][ T43] audit: type=1326 audit(1700006716.764:348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18276 comm="syz.4.19318" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 447.490524][ T43] audit: type=1326 audit(1700006716.764:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18276 comm="syz.4.19318" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 447.491197][ T43] audit: type=1326 audit(1700006716.773:350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18278 comm="syz.4.19318" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71e75eb code=0x7ffc0000 [ 447.536304][ T43] audit: type=1326 audit(1700006716.820:351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18276 comm="syz.4.19318" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 447.536432][ T43] audit: type=1326 audit(1700006716.820:352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18276 comm="syz.4.19318" exe="/syz-executor" sig=0 arch=40000003 syscall=270 compat=1 ip=0xf748efec code=0x7ffc0000 [ 447.710367][T18298] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19334'. [ 447.884527][T18321] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 448.026768][T18339] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0xb993 instead [ 448.026785][T18339] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x9785 instead [ 448.026795][T18339] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000008: 0xd254 instead [ 448.026804][T18339] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000000c: 0x84e9 instead [ 448.026813][T18339] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000010: 0xd202 instead [ 448.026822][T18339] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000014: 0x32d4 instead [ 448.026949][T18339] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000840: 0x642f instead [ 448.026958][T18339] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000844: 0x6d2f instead [ 448.026967][T18339] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000848: 0x0023 instead [ 448.027209][T18339] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001980: 0x00c0 instead [ 448.027219][T18339] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000198c: 0x00e4 instead [ 448.034298][T18339] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 448.034311][T18339] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 448.094985][T18347] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 448.369949][T18370] netlink: 8 bytes leftover after parsing attributes in process `syz.5.19358'. [ 448.372011][T18370] netlink: 8 bytes leftover after parsing attributes in process `syz.5.19358'. [ 448.418255][T18378] netlink: 20 bytes leftover after parsing attributes in process `syz.5.19361'. [ 448.553453][T18395] lo speed is unknown, defaulting to 1000 [ 449.002252][T18478] CIFS: Attempting to mount //127.0.0.1/share [ 449.027552][T18478] CIFS: VFS: Error connecting to socket. Aborting operation. [ 449.027578][T18478] CIFS: VFS: cifs_mount failed w/return code = -111 [ 449.086517][T18488] No buffer was provided with the request [ 449.160882][T18498] ptrace attach of "/syz-executor exec"[13935] was attempted by " [ 449.445504][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 450.255271][T18618] netlink: 8 bytes leftover after parsing attributes in process `syz.3.19452'. [ 450.280620][T18622] nicvf0: renamed from team0 (while UP) [ 450.292948][T18622] nicvf0: Cannot enslave team device to itself [ 450.292962][T18622] A link change request failed with some changes committed already. Interface nicvf0 may have been left with an inconsistent configuration, please check. [ 450.313594][T18628] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 450.313613][T18628] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 450.315337][T18628] vhci_hcd vhci_hcd.0: Device attached [ 450.326525][T18628] vhci_hcd vhci_hcd.0: pdev(4) rhport(1) sockfd(5) [ 450.326542][T18628] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 450.326583][T18628] vhci_hcd vhci_hcd.0: Device attached [ 450.332319][T18628] vhci_hcd vhci_hcd.0: pdev(4) rhport(2) sockfd(7) [ 450.332335][T18628] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 450.332374][T18628] vhci_hcd vhci_hcd.0: Device attached [ 450.334727][T18633] vhci_hcd: connection closed [ 450.334891][T18629] vhci_hcd: connection closed [ 450.335060][T18631] vhci_hcd: connection closed [ 450.335859][ T5938] vhci_hcd vhci_hcd.4: stop threads [ 450.335880][ T5938] vhci_hcd vhci_hcd.4: release socket [ 450.335896][ T5938] vhci_hcd vhci_hcd.4: disconnect device [ 450.336022][ T5938] vhci_hcd vhci_hcd.4: stop threads [ 450.336031][ T5938] vhci_hcd vhci_hcd.4: release socket [ 450.336040][ T5938] vhci_hcd vhci_hcd.4: disconnect device [ 450.336162][ T5938] vhci_hcd vhci_hcd.4: stop threads [ 450.336173][ T5938] vhci_hcd vhci_hcd.4: release socket [ 450.336182][ T5938] vhci_hcd vhci_hcd.4: disconnect device [ 450.347598][T18637] netlink: 4 bytes leftover after parsing attributes in process `syz.1.19458'. [ 450.349577][T18637] netlink: 4 bytes leftover after parsing attributes in process `syz.1.19458'. [ 450.725650][T18675] option changes via remount are deprecated (pid=18674 comm=syz.5.19474) [ 450.946441][T18704] netlink: 4 bytes leftover after parsing attributes in process `syz.1.19483'. [ 451.132377][T18724] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 451.481366][T18745] sock: sock_timestamping_bind_phc: sock not bind to device [ 453.186132][T18881] vlan2: entered promiscuous mode [ 453.186148][T18881] dummy0: entered promiscuous mode [ 453.187974][T18881] vlan2: entered allmulticast mode [ 453.285358][T18881] Process accounting resumed [ 453.349161][T18897] can0: slcan on ptm0. [ 453.451881][T18896] can0 (unregistered): slcan off ptm0. [ 453.545887][T18922] macvtap1: entered promiscuous mode [ 453.545902][T18922] dummy0: entered promiscuous mode [ 453.546005][T18922] macvtap1: entered allmulticast mode [ 453.546014][T18922] dummy0: entered allmulticast mode [ 453.611150][ T1126] ata1.00: exception Emask 0x0 SAct 0x8 SErr 0x0 action 0x6 [ 453.611167][ T1126] ata1.00: waking up from sleep [ 453.611203][ T1126] ata1: hard resetting link [ 453.958028][ T1126] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300) [ 453.960539][ T1126] ata1.00: configured for UDMA/100 [ 453.960678][ T1126] ata1: EH complete [ 454.074829][T18965] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.19596'. [ 454.448636][T19002] xt_IDLETIMER: timeout value is too big [ 454.450706][ T43] kauditd_printk_skb: 4 callbacks suppressed [ 454.450722][ T43] audit: type=1326 audit(1700006723.290:357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19003 comm="syz.3.19612" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 454.451010][ T43] audit: type=1326 audit(1700006723.290:358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19003 comm="syz.3.19612" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 454.452428][ T43] audit: type=1326 audit(1700006723.290:359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19003 comm="syz.3.19612" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 454.455519][ T43] audit: type=1326 audit(1700006723.290:360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19003 comm="syz.3.19612" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 454.455566][ T43] audit: type=1326 audit(1700006723.290:361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19003 comm="syz.3.19612" exe="/syz-executor" sig=0 arch=40000003 syscall=435 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 454.464389][ T43] audit: type=1326 audit(1700006723.299:362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19003 comm="syz.3.19612" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 454.464679][ T43] audit: type=1326 audit(1700006723.299:363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19005 comm="syz.3.19612" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71975eb code=0x7ffc0000 [ 454.464788][ T43] audit: type=1326 audit(1700006723.299:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19003 comm="syz.3.19612" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 454.494167][ T43] audit: type=1326 audit(1700006723.327:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19003 comm="syz.3.19612" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 454.494312][ T43] audit: type=1326 audit(1700006723.327:366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19003 comm="syz.3.19612" exe="/syz-executor" sig=0 arch=40000003 syscall=270 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 454.531787][T19009] program syz.3.19614 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 454.678030][T19031] netlink: 20 bytes leftover after parsing attributes in process `syz.3.19625'. [ 454.678055][T19031] netlink: 12 bytes leftover after parsing attributes in process `syz.3.19625'. [ 454.828324][ T5947] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 454.988993][ T5947] usb 6-1: Using ep0 maxpacket: 8 [ 454.989733][ T5947] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 454.990276][ T5947] usb 6-1: config 0 has no interfaces? [ 454.990295][ T5947] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.993614][ T5947] usb 6-1: config 0 descriptor?? [ 455.041662][T19071] netlink: 68 bytes leftover after parsing attributes in process `syz.4.19640'. [ 455.228621][ T30] usb 6-1: USB disconnect, device number 15 [ 455.294914][T19101] random: crng reseeded on system resumption [ 455.309928][T19101] Restarting kernel threads ... [ 455.310565][T19101] Done restarting kernel threads. [ 455.573286][T19126] netlink: 8 bytes leftover after parsing attributes in process `syz.5.19662'. [ 455.573303][T19126] netlink: 4 bytes leftover after parsing attributes in process `syz.5.19662'. [ 455.667643][T19140] openvswitch: netlink: Unknown key attributes 20 [ 455.703299][T19141] syz.3.19668: page allocation failure: order:1, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 455.703343][T19141] CPU: 1 UID: 0 PID: 19141 Comm: syz.3.19668 Tainted: G L syzkaller #0 PREEMPT(full) [ 455.703367][T19141] Tainted: [L]=SOFTLOCKUP [ 455.703372][T19141] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 455.703380][T19141] Call Trace: [ 455.703385][T19141] [ 455.703391][T19141] dump_stack_lvl+0x100/0x190 [ 455.703410][T19141] warn_alloc.cold+0x9e/0xb2 [ 455.703424][T19141] ? __pfx_warn_alloc+0x10/0x10 [ 455.703443][T19141] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 455.703460][T19141] ? __pfx_get_page_from_freelist+0x10/0x10 [ 455.703479][T19141] __alloc_frozen_pages_noprof+0xcb6/0x3300 [ 455.703503][T19141] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 455.703520][T19141] ? stack_trace_save+0x8e/0xc0 [ 455.703536][T19141] ? __pfx_stack_trace_save+0x10/0x10 [ 455.703552][T19141] ? stack_depot_save_flags+0x27/0x9f0 [ 455.703570][T19141] ? comedi_isadma_alloc+0xc6/0x620 [ 455.703582][T19141] ? pcl812_attach+0x18f5/0x2300 [ 455.703596][T19141] ? comedi_device_attach+0x40e/0x6b0 [ 455.703610][T19141] ? do_devconfig_ioctl+0x1b3/0x6d0 [ 455.703627][T19141] ? comedi_unlocked_ioctl+0x860/0x3310 [ 455.703647][T19141] alloc_pages_node_noprof+0x93/0x200 [ 455.703662][T19141] ? __pfx_alloc_pages_node_noprof+0x10/0x10 [ 455.703680][T19141] __dma_direct_alloc_pages.isra.0+0x35e/0x540 [ 455.703699][T19141] dma_direct_alloc+0x104/0x8a0 [ 455.703716][T19141] dma_alloc_attrs+0x1b9/0x3e0 [ 455.703733][T19141] ? __pfx_dma_alloc_attrs+0x10/0x10 [ 455.703747][T19141] ? __kmalloc_noprof+0x350/0x840 [ 455.703762][T19141] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 455.703775][T19141] ? dma_direct_supported+0xca/0x220 [ 455.703793][T19141] comedi_isadma_alloc+0x331/0x620 [ 455.703806][T19141] ? __pfx_comedi_isadma_alloc+0x10/0x10 [ 455.703819][T19141] ? request_threaded_irq+0x27b/0x3e0 [ 455.703839][T19141] pcl812_attach+0x18f5/0x2300 [ 455.703858][T19141] comedi_device_attach+0x40e/0x6b0 [ 455.703878][T19141] do_devconfig_ioctl+0x1b3/0x6d0 [ 455.703897][T19141] ? comedi_unlocked_ioctl+0x180/0x3310 [ 455.703911][T19141] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 455.703937][T19141] ? tomoyo_path_number_perm+0x46d/0x580 [ 455.703950][T19141] ? kasan_save_stack+0x3f/0x50 [ 455.703966][T19141] ? kasan_save_stack+0x30/0x50 [ 455.703981][T19141] ? kasan_save_track+0x14/0x30 [ 455.703996][T19141] ? kasan_save_free_info+0x3b/0x70 [ 455.704025][T19141] comedi_unlocked_ioctl+0x860/0x3310 [ 455.704046][T19141] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 455.704071][T19141] ? kasan_quarantine_put+0x104/0x240 [ 455.704087][T19141] ? lockdep_hardirqs_on+0x7d/0x110 [ 455.704102][T19141] ? find_held_lock+0x2b/0x80 [ 455.704116][T19141] ? tomoyo_path_number_perm+0x28f/0x580 [ 455.704128][T19141] ? tomoyo_path_number_perm+0x28f/0x580 [ 455.704144][T19141] ? tomoyo_path_number_perm+0x188/0x580 [ 455.704160][T19141] comedi_compat_ioctl+0x438/0xe20 [ 455.704174][T19141] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 455.704188][T19141] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 455.704207][T19141] ? do_vfs_ioctl+0x226/0x13e0 [ 455.704221][T19141] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 455.704237][T19141] ? __fget_files+0x34/0x3d0 [ 455.704252][T19141] ? find_held_lock+0x2b/0x80 [ 455.704266][T19141] ? __fget_files+0x215/0x3d0 [ 455.704280][T19141] ? hook_file_ioctl_common+0x140/0x440 [ 455.704297][T19141] ? __fget_files+0x21f/0x3d0 [ 455.704315][T19141] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 455.704328][T19141] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 455.704344][T19141] __do_fast_syscall_32+0x13a/0x8b0 [ 455.704366][T19141] do_fast_syscall_32+0x32/0x70 [ 455.704382][T19141] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 455.704397][T19141] RIP: 0023:0xf7fa4fec [ 455.704412][T19141] Code: Unable to access opcode bytes at 0xf7fa4fc2. [ 455.704417][T19141] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 455.704429][T19141] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040946400 [ 455.704437][T19141] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 455.704444][T19141] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 455.704451][T19141] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 455.704458][T19141] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 455.704473][T19141] [ 455.707266][T19141] Mem-Info: [ 455.707274][T19141] active_anon:5100 inactive_anon:615 isolated_anon:0 [ 455.707274][T19141] active_file:420 inactive_file:26628 isolated_file:0 [ 455.707274][T19141] unevictable:1000 dirty:438 writeback:0 [ 455.707274][T19141] slab_reclaimable:7362 slab_unreclaimable:69329 [ 455.707274][T19141] mapped:24439 shmem:2335 pagetables:1992 [ 455.707274][T19141] sec_pagetables:345 bounce:0 [ 455.707274][T19141] kernel_misc_reclaimable:0 [ 455.707274][T19141] free:40818 free_pcp:0 free_cma:0 [ 455.707302][T19141] Node 0 active_anon:0kB inactive_anon:8kB active_file:84kB inactive_file:52kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:0kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8352kB pagetables:1172kB sec_pagetables:1144kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 455.707331][T19141] Node 0 DMA free:2632kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 455.707367][T19141] lowmem_reserve[]: 0 278 278 278 278 [ 455.707387][T19141] Node 0 DMA: 48*4kB (U) 27*8kB (U) 7*16kB (UE) 8*32kB (U) 1*64kB (E) 0*128kB 1*256kB (E) 1*512kB (E) 1*1024kB (E) 0*2048kB 0*4096kB = 2632kB [ 455.707466][T19141] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 455.707475][T19141] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 455.707484][T19141] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 455.707492][T19141] Node 1 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 455.707501][T19141] 30331 total pagecache pages [ 455.707506][T19141] 950 pages in swap cache [ 455.707510][T19141] Free swap = 41772kB [ 455.707514][T19141] Total swap = 124996kB [ 455.707519][T19141] 524155 pages RAM [ 455.707523][T19141] 0 pages HighMem/MovableOnly [ 455.707527][T19141] 212075 pages reserved [ 455.707530][T19141] 0 pages cma reserved [ 455.975713][T19166] netlink: Invalid conntrack timeout [ 455.975730][T19166] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 455.997970][T19168] ovs-dp0: entered promiscuous mode [ 456.199319][T19193] netlink: 'syz.3.19690': attribute type 7 has an invalid length. [ 456.199334][T19193] netlink: 'syz.3.19690': attribute type 8 has an invalid length. [ 456.201121][T19194] netlink: 8 bytes leftover after parsing attributes in process `syz.5.19689'. [ 456.226813][T19196] CIFS: Attempting to mount //127.0.0.1/share [ 456.234551][T19196] CIFS: VFS: Error connecting to socket. Aborting operation. [ 456.234577][T19196] CIFS: VFS: cifs_mount failed w/return code = -111 [ 456.346825][T19205] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19693'. [ 456.367485][T19205] veth3: entered promiscuous mode [ 456.629588][T19302] lo speed is unknown, defaulting to 1000 [ 457.119708][T19365] netlink: 20 bytes leftover after parsing attributes in process `syz.5.19728'. [ 457.269679][T19393] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 457.365083][T19399] netlink: 8 bytes leftover after parsing attributes in process `syz.5.19739'. [ 457.534628][T19419] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19748'. [ 457.534645][T19419] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 457.692632][T19442] netlink: 4 bytes leftover after parsing attributes in process `syz.3.19760'. [ 457.733879][T19446] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 457.734198][T19449] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 457.786494][T19454] netlink: 12 bytes leftover after parsing attributes in process `syz.3.19764'. [ 457.786520][T19454] block nbd0: Unsupported socket: should be TCP or UNIX. [ 458.069140][T19480] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19776'. [ 458.556894][T19532] netlink: 'syz.4.19802': attribute type 1 has an invalid length. [ 458.556909][T19532] netlink: 212 bytes leftover after parsing attributes in process `syz.4.19802'. [ 458.844756][T19561] sch_tbf: peakrate 11404892913778152675 is lower than or equals to rate 17950757323683981889 ! [ 459.032708][T19587] netlink: 252 bytes leftover after parsing attributes in process `syz.3.19824'. [ 459.301583][T19614] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 459.301600][T19614] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 459.301686][T19614] vhci_hcd vhci_hcd.0: Device attached [ 459.308271][T19614] vhci_hcd vhci_hcd.0: pdev(5) rhport(1) sockfd(5) [ 459.308293][T19614] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 459.308330][T19614] vhci_hcd vhci_hcd.0: Device attached [ 459.313455][T19614] vhci_hcd vhci_hcd.0: pdev(5) rhport(2) sockfd(7) [ 459.313469][T19614] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 459.313508][T19614] vhci_hcd vhci_hcd.0: Device attached [ 459.314816][T19622] vhci_hcd: connection closed [ 459.314927][ T12] vhci_hcd vhci_hcd.5: stop threads [ 459.314944][ T12] vhci_hcd vhci_hcd.5: release socket [ 459.314955][ T12] vhci_hcd vhci_hcd.5: disconnect device [ 459.315096][T19620] vhci_hcd: connection closed [ 459.315142][T19616] vhci_hcd: connection closed [ 459.315343][ T12] vhci_hcd vhci_hcd.5: stop threads [ 459.315352][ T12] vhci_hcd vhci_hcd.5: release socket [ 459.315362][ T12] vhci_hcd vhci_hcd.5: disconnect device [ 459.315404][ T12] vhci_hcd vhci_hcd.5: stop threads [ 459.315411][ T12] vhci_hcd vhci_hcd.5: release socket [ 459.315426][ T12] vhci_hcd vhci_hcd.5: disconnect device [ 459.482115][T19645] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 459.585948][T19659] netlink: 'syz.4.19851': attribute type 10 has an invalid length. [ 459.585964][T19659] netlink: 40 bytes leftover after parsing attributes in process `syz.4.19851'. [ 459.586029][T19659] gretap0: entered promiscuous mode [ 459.586041][T19659] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 460.355934][T19712] bond8: (slave bond_slave_1): Device is not bonding slave [ 460.355960][T19712] bond8: option active_slave: invalid value (bond_slave_1) [ 460.359431][T19712] bond8 (unregistering): Released all slaves [ 461.247345][T19865] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Mapping Error Msg ret = -22) [ 461.371415][T19886] xt_IDLETIMER: timeout value is too big [ 461.612877][T19922] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 461.860259][T20002] __nla_validate_parse: 6 callbacks suppressed [ 461.860277][T20002] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19941'. [ 461.916742][T20022] netlink: 12 bytes leftover after parsing attributes in process `syz.4.19943'. [ 461.916774][T20022] openvswitch: netlink: Missing key (keys=c0, expected=40300) [ 462.218617][T20086] veth0: entered promiscuous mode [ 462.218986][T20085] veth0: left promiscuous mode [ 462.666636][T20146] xt_socket: unknown flags 0x20 [ 463.051186][T20156] binder: 20155:20156 ioctl c0306201 0 returned -14 [ 463.214378][T20166] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 463.280876][T20175] binder_alloc: binder_alloc_mmap_handler: 20174 80ffd000-81000000 already mapped failed -16 [ 463.348589][T20183] Invalid source name [ 463.348603][T20183] UBIFS error (pid: 20183): cannot open "./file0", error -22 [ 463.512035][ T5842] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 463.512060][ T5842] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.603659][T20200] netlink: 108 bytes leftover after parsing attributes in process `syz.4.20000'. [ 463.650836][ T5874] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 463.654249][ T5874] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 463.655599][ T5874] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 463.660132][ T5874] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 463.664373][ T5874] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 463.808229][ T5842] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 463.808252][ T5842] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.929946][ T5842] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 463.929968][ T5842] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.062732][T20203] lo speed is unknown, defaulting to 1000 [ 464.197153][ T5842] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 464.197183][ T5842] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.317888][T20203] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.317970][T20203] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.318030][T20203] bridge_slave_0: entered allmulticast mode [ 464.318790][T20203] bridge_slave_0: entered promiscuous mode [ 464.323623][T20203] bridge0: port 2(bridge_slave_1) entered blocking state [ 464.323667][T20203] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.323731][T20203] bridge_slave_1: entered allmulticast mode [ 464.324442][T20203] bridge_slave_1: entered promiscuous mode [ 464.353185][T20203] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 464.354759][T20203] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 464.411786][T20371] netlink: 4 bytes leftover after parsing attributes in process `syz.1.20016'. [ 464.416709][T20203] team0: Port device team_slave_0 added [ 464.433579][T20203] team0: Port device team_slave_1 added [ 464.459496][T20203] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 464.459508][T20203] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 464.459522][T20203] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 464.461863][T20203] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 464.461873][T20203] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 464.461886][T20203] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 464.483405][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 464.526470][ T5842] bridge_slave_1: left allmulticast mode [ 464.526488][ T5842] bridge_slave_1: left promiscuous mode [ 464.526602][ T5842] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.532188][ T5842] bridge_slave_0: left allmulticast mode [ 464.532207][ T5842] bridge_slave_0: left promiscuous mode [ 464.532310][ T5842] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.769620][ T5842] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 464.775310][ T5842] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 464.778568][ T5842] bond0 (unregistering): Released all slaves [ 464.822420][T20203] hsr_slave_0: entered promiscuous mode [ 464.822854][T20203] hsr_slave_1: entered promiscuous mode [ 464.873180][ T5842] tipc: Disabling bearer [ 464.891695][ T5842] tipc: Left network mode [ 465.129648][ T5450] 8021q: adding VLAN 0 to HW filter on device eth11 [ 465.216818][T20203] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 465.221188][T20203] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 465.221832][T20203] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 465.227744][T20203] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 465.243571][T20203] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 465.245433][T20203] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 465.245953][T20203] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 465.247522][T20203] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 465.271903][ T5842] hsr_slave_0: left promiscuous mode [ 465.272304][ T5842] hsr_slave_1: left promiscuous mode [ 465.272721][ T5842] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 465.272733][ T5842] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 465.273252][ T5842] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 465.273262][ T5842] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 465.288777][ T5842] dummy0: left allmulticast mode [ 465.288948][ T5842] veth1_macvtap: left promiscuous mode [ 465.288985][ T5842] veth0_macvtap: left promiscuous mode [ 465.293265][ T5842] veth1_vlan: left promiscuous mode [ 465.293331][ T5842] veth0_vlan: left promiscuous mode [ 465.322545][T20592] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20039'. [ 465.322597][T20592] netlink: 4 bytes leftover after parsing attributes in process `syz.1.20039'. [ 465.322614][T20592] netlink: 'syz.1.20039': attribute type 7 has an invalid length. [ 465.496978][ T5842] nicvf0 (unregistering): Port device team_slave_1 removed [ 465.507825][ T5842] nicvf0 (unregistering): Port device team_slave_0 removed [ 465.561808][ T5450] 8021q: adding VLAN 0 to HW filter on device eth12 [ 465.601120][T20203] 8021q: adding VLAN 0 to HW filter on device bond0 [ 465.618554][T20203] 8021q: adding VLAN 0 to HW filter on device team0 [ 465.628928][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.629016][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 465.656945][T20617] netlink: 12 bytes leftover after parsing attributes in process `syz.1.20046'. [ 465.656970][T20617] block nbd1: Unsupported socket: should be TCP or UNIX. [ 465.659073][T11524] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.659156][T11524] bridge0: port 2(bridge_slave_1) entered forwarding state [ 465.730530][ T5450] 8021q: adding VLAN 0 to HW filter on device eth13 [ 465.850680][ T5860] Bluetooth: hci1: command tx timeout [ 465.919932][ T5842] IPVS: stop unused estimator thread 0... [ 465.959575][ T5450] 8021q: adding VLAN 0 to HW filter on device eth14 [ 465.989098][T20203] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 466.157084][T20203] veth0_vlan: entered promiscuous mode [ 466.164505][T20203] veth1_vlan: entered promiscuous mode [ 466.189220][T20203] veth0_macvtap: entered promiscuous mode [ 466.191670][T20203] veth1_macvtap: entered promiscuous mode [ 466.202291][T20203] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 466.207203][T20203] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 466.266917][ T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.266957][ T13] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.266983][ T13] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.267001][ T13] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.326669][T11524] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.326691][T11524] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 466.349596][T11524] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.349610][T11524] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 466.556253][T20713] scsi_nl_rcv_msg: Msgtype 1 failed - err -3 [ 467.027710][ T5858] usb 11-1: new high-speed USB device number 2 using dummy_hcd [ 467.196288][ T5858] usb 11-1: Using ep0 maxpacket: 8 [ 467.196919][ T5858] usb 11-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 467.197883][ T5858] usb 11-1: config 168 descriptor has 1 excess byte, ignoring [ 467.197904][ T5858] usb 11-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 467.197922][ T5858] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 467.197936][ T5858] usb 11-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 467.197949][ T5858] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 467.197962][ T5858] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 467.197975][ T5858] usb 11-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 467.197988][ T5858] usb 11-1: config 168 interface 0 has no altsetting 0 [ 467.198855][ T5858] usb 11-1: config 168 descriptor has 1 excess byte, ignoring [ 467.198871][ T5858] usb 11-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 467.198888][ T5858] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 467.198904][ T5858] usb 11-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 467.198916][ T5858] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 467.198929][ T5858] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 467.198942][ T5858] usb 11-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 467.198955][ T5858] usb 11-1: config 168 interface 0 has no altsetting 0 [ 467.199806][ T5858] usb 11-1: config 168 descriptor has 1 excess byte, ignoring [ 467.199821][ T5858] usb 11-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 467.199838][ T5858] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 467.199852][ T5858] usb 11-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 467.199864][ T5858] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 467.199877][ T5858] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 467.199890][ T5858] usb 11-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 467.199905][ T5858] usb 11-1: config 168 interface 0 has no altsetting 0 [ 467.202449][ T5858] usb 11-1: string descriptor 0 read error: -22 [ 467.202506][ T5858] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.207508][ T5858] adutux 11-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 468.072240][ T5860] Bluetooth: hci1: command tx timeout [ 469.611182][ T5968] usb 11-1: USB disconnect, device number 2 [ 470.032124][T20790] netlink: 4 bytes leftover after parsing attributes in process `syz.1.20104'. [ 470.195932][T20788] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.293589][ T5860] Bluetooth: hci1: command tx timeout [ 470.344936][T20788] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.482737][T20788] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.593569][T20788] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.670109][T20825] binder: 20824:20825 ioctl c018620c 80000200 returned -22 [ 470.763553][T20833] netlink: 'syz.1.20114': attribute type 1 has an invalid length. [ 470.763569][T20833] netlink: 4 bytes leftover after parsing attributes in process `syz.1.20114'. [ 470.827582][ T13] netdevsim netdevsim6 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 470.827610][ T13] netdevsim netdevsim6 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 470.827627][ T13] netdevsim netdevsim6 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 470.827645][ T13] netdevsim netdevsim6 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 471.193920][T20873] comedi comedi3: dt2817: I/O base address or length out of range [ 471.240807][T20879] netlink: 12 bytes leftover after parsing attributes in process `syz.4.20132'. [ 471.306944][ T43] kauditd_printk_skb: 26 callbacks suppressed [ 471.306956][ T43] audit: type=1326 audit(1700006739.066:393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20888 comm="syz.3.20144" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 471.307069][ T43] audit: type=1326 audit(1700006739.066:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20888 comm="syz.3.20144" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 471.310482][ T43] audit: type=1326 audit(1700006739.076:395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20888 comm="syz.3.20144" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 471.312929][ T43] audit: type=1326 audit(1700006739.076:396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20888 comm="syz.3.20144" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 471.313031][ T43] audit: type=1326 audit(1700006739.076:397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20888 comm="syz.3.20144" exe="/syz-executor" sig=0 arch=40000003 syscall=245 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 471.313354][ T43] audit: type=1326 audit(1700006739.076:398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20888 comm="syz.3.20144" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 471.315777][ T43] audit: type=1326 audit(1700006739.076:399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20888 comm="syz.3.20144" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 471.316599][ T43] audit: type=1326 audit(1700006739.076:400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20888 comm="syz.3.20144" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 471.320298][ T43] audit: type=1326 audit(1700006739.085:401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20888 comm="syz.3.20144" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 471.320410][ T43] audit: type=1326 audit(1700006739.085:402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20888 comm="syz.3.20144" exe="/syz-executor" sig=0 arch=40000003 syscall=247 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 471.438695][T20900] netlink: 'syz.3.20141': attribute type 178 has an invalid length. [ 471.665529][T20929] netlink: 44 bytes leftover after parsing attributes in process `syz.4.20155'. [ 471.667075][T20929] netlink: 32 bytes leftover after parsing attributes in process `syz.4.20155'. [ 471.808924][T20945] program syz.4.20163 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 471.843876][T20949] veth0: entered promiscuous mode [ 471.844013][T20948] veth0: left promiscuous mode [ 472.438550][T21025] Invalid logical block size (768) [ 472.453159][T21027] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 472.517235][ T5860] Bluetooth: hci1: command tx timeout [ 472.584585][T21047] ALSA: seq fatal error: cannot create timer (-22) [ 472.807524][T21067] netlink: 'syz.6.20218': attribute type 1 has an invalid length. [ 472.807547][T21067] netlink: 200 bytes leftover after parsing attributes in process `syz.6.20218'. [ 472.807561][T21067] netlink: 'syz.6.20218': attribute type 1 has an invalid length. [ 472.807573][T21067] netlink: 29 bytes leftover after parsing attributes in process `syz.6.20218'. [ 473.159740][T21101] program syz.3.20235 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 473.159797][T21101] ata1.00: non-matching transfer count (8388608/133) [ 473.216210][T21109] netlink: 4 bytes leftover after parsing attributes in process `syz.6.20240'. [ 473.380155][T21133] devtmpfs: Cannot change global quota limit on remount [ 474.826173][T21213] netlink: 56 bytes leftover after parsing attributes in process `syz.4.20283'. [ 474.956418][T21234] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 474.967293][T21237] netlink: 12 bytes leftover after parsing attributes in process `syz.4.20293'. [ 475.160359][T21269] netlink: 'syz.3.20309': attribute type 9 has an invalid length. [ 475.707574][T21355] __nla_validate_parse: 2 callbacks suppressed [ 475.707588][T21355] netlink: 28 bytes leftover after parsing attributes in process `syz.1.20342'. [ 475.707616][T21355] netlink: 28 bytes leftover after parsing attributes in process `syz.1.20342'. [ 475.723931][T21346] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 475.724011][T21346] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 475.761539][T21346] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 475.803943][T21346] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 475.804252][T21346] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 475.811940][T21346] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 476.261535][T21413] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20357'. [ 476.283618][T21416] netlink: 4 bytes leftover after parsing attributes in process `syz.6.20359'. [ 476.283645][T21416] netlink: 12 bytes leftover after parsing attributes in process `syz.6.20359'. [ 476.353947][T21427] binder: 21425:21427 ioctl 4018620d 0 returned -22 [ 476.354397][T21428] netlink: 4 bytes leftover after parsing attributes in process `syz.1.20363'. [ 476.354432][T21427] binder: 21425:21427 ioctl c0306201 80000180 returned -11 [ 476.489587][T21440] bond0: (slave macsec1): Error -34 calling dev_set_mtu [ 476.705643][ T43] kauditd_printk_skb: 26 callbacks suppressed [ 476.705655][ T43] audit: type=1326 audit(1700006744.132:429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21472 comm="syz.1.20383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 476.708030][ T43] audit: type=1326 audit(1700006744.132:430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21472 comm="syz.1.20383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 476.711509][ T43] audit: type=1326 audit(1700006744.132:431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21472 comm="syz.1.20383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 476.711633][ T43] audit: type=1326 audit(1700006744.132:432): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21472 comm="syz.1.20383" exe="/syz-executor" sig=0 arch=40000003 syscall=132 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 476.711728][ T43] audit: type=1326 audit(1700006744.132:433): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21472 comm="syz.1.20383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 476.711814][ T43] audit: type=1326 audit(1700006744.132:434): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21472 comm="syz.1.20383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 476.711908][ T43] audit: type=1326 audit(1700006744.132:435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21472 comm="syz.1.20383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 476.712115][ T43] audit: type=1326 audit(1700006744.132:436): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21472 comm="syz.1.20383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 476.712214][ T43] audit: type=1326 audit(1700006744.132:437): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21472 comm="syz.1.20383" exe="/syz-executor" sig=0 arch=40000003 syscall=161 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 476.712853][ T43] audit: type=1326 audit(1700006744.141:438): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21472 comm="syz.1.20383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb3fec code=0x7ffc0000 [ 476.793165][T21483] netlink: 36 bytes leftover after parsing attributes in process `syz.4.20387'. [ 476.873017][T21492] geneve1: entered promiscuous mode [ 477.055830][T21513] [ 477.056663][T21513] ====================================================== [ 477.058843][T21513] WARNING: possible circular locking dependency detected [ 477.061480][T21513] syzkaller #0 Tainted: G L [ 477.063419][T21513] ------------------------------------------------------ [ 477.065606][T21513] syz.4.20396/21513 is trying to acquire lock: [ 477.068142][T21513] ffff8880537740b8 (&hdev->lock){+.+.}-{4:4}, at: l2cap_chan_connect+0xac/0x2110 [ 477.072802][T21513] [ 477.072802][T21513] but task is already holding lock: [ 477.075183][T21513] ffffffff90f86f60 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0x92/0xac0 [ 477.078091][T21513] [ 477.078091][T21513] which lock already depends on the new lock. [ 477.078091][T21513] [ 477.081571][T21513] [ 477.081571][T21513] the existing dependency chain (in reverse order) is: [ 477.084439][T21513] [ 477.084439][T21513] -> #2 (rfcomm_mutex){+.+.}-{4:4}: [ 477.087826][T21513] lock_acquire+0x1d1/0x380 [ 477.090025][T21513] __mutex_lock+0x1a4/0x1bd0 [ 477.092443][T21513] rfcomm_security_cfm+0x3f/0x4b0 [ 477.094887][T21513] hci_key_refresh_complete_evt+0x6ea/0x1030 [ 477.097654][T21513] hci_event_packet+0x8e9/0xcd0 [ 477.099974][T21513] hci_rx_work+0x451/0xfc0 [ 477.102041][T21513] process_one_work+0xac7/0x1b10 [ 477.104341][T21513] worker_thread+0x5ef/0xe50 [ 477.106434][T21513] kthread+0x373/0x450 [ 477.107739][ T13] netdevsim netdevsim5 eth14: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.107762][ T13] netdevsim netdevsim5 eth13: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.107778][ T13] netdevsim netdevsim5 eth12: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.107794][ T13] netdevsim netdevsim5 eth11: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.107810][ T13] netdevsim netdevsim0 eth10: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.107827][ T13] netdevsim netdevsim0 eth9: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.107843][ T13] netdevsim netdevsim0 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.107858][ T13] netdevsim netdevsim0 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.107874][ T13] netdevsim netdevsim2 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.107890][ T13] netdevsim netdevsim2 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.107905][ T13] netdevsim netdevsim2 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.107921][ T13] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.146395][T21513] ret_from_fork+0x730/0xd60 [ 477.148476][T21513] ret_from_fork_asm+0x1a/0x30 [ 477.150721][T21513] [ 477.150721][T21513] -> #1 (hci_cb_list_lock){+.+.}-{4:4}: [ 477.153985][T21513] lock_acquire+0x1d1/0x380 [ 477.156174][T21513] __mutex_lock+0x1a4/0x1bd0 [ 477.158344][T21513] hci_remote_features_evt+0x485/0x9b0 [ 477.160355][T21513] hci_event_packet+0x8e9/0xcd0 [ 477.162025][T21513] hci_rx_work+0x451/0xfc0 [ 477.163582][T21513] process_one_work+0xac7/0x1b10 [ 477.165284][T21513] worker_thread+0x5ef/0xe50 [ 477.166878][T21513] kthread+0x373/0x450 [ 477.168328][T21513] ret_from_fork+0x730/0xd60 [ 477.169960][T21513] ret_from_fork_asm+0x1a/0x30 [ 477.171632][T21513] [ 477.171632][T21513] -> #0 (&hdev->lock){+.+.}-{4:4}: [ 477.173897][T21513] check_prev_add+0xeb/0xe60 [ 477.175616][T21513] __lock_acquire+0x1528/0x1f40 [ 477.177349][T21513] lock_acquire+0x1d1/0x380 [ 477.178883][T21513] __mutex_lock+0x1a4/0x1bd0 [ 477.180520][T21513] l2cap_chan_connect+0xac/0x2110 [ 477.182269][T21513] l2cap_sock_connect+0x37a/0x770 [ 477.184031][T21513] kernel_connect+0x107/0x160 [ 477.185678][T21513] rfcomm_dlc_open+0x838/0xac0 [ 477.187363][T21513] rfcomm_sock_connect+0x42c/0x690 [ 477.189171][T21513] __sys_connect_file+0x146/0x1a0 [ 477.190926][T21513] __sys_connect+0x141/0x170 [ 477.192484][T21513] __ia32_sys_connect+0x71/0xb0 [ 477.194178][T21513] __do_fast_syscall_32+0x13a/0x8b0 [ 477.195979][T21513] do_fast_syscall_32+0x32/0x70 [ 477.197691][T21513] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 477.199879][T21513] [ 477.199879][T21513] other info that might help us debug this: [ 477.199879][T21513] [ 477.203034][T21513] Chain exists of: [ 477.203034][T21513] &hdev->lock --> hci_cb_list_lock --> rfcomm_mutex [ 477.203034][T21513] [ 477.206767][T21513] Possible unsafe locking scenario: [ 477.206767][T21513] [ 477.209100][T21513] CPU0 CPU1 [ 477.210788][T21513] ---- ---- [ 477.212483][T21513] lock(rfcomm_mutex); [ 477.213812][T21513] lock(hci_cb_list_lock); [ 477.215991][T21513] lock(rfcomm_mutex); [ 477.218070][T21513] lock(&hdev->lock); [ 477.219392][T21513] [ 477.219392][T21513] *** DEADLOCK *** [ 477.219392][T21513] [ 477.221733][T21513] locks held by syz.4.20396/21513: 1, last CPU#0: [ 477.223723][T21513] #0: ffffffff90f86f60 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0x92/0xac0 [ 477.226612][T21513] [ 477.226612][T21513] stack backtrace: [ 477.228456][T21513] CPU: 0 UID: 0 PID: 21513 Comm: syz.4.20396 Tainted: G L syzkaller #0 PREEMPT(full) [ 477.231880][T21513] Tainted: [L]=SOFTLOCKUP [ 477.233243][T21513] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 477.236398][T21513] Call Trace: [ 477.237423][T21513] [ 477.238339][T21513] dump_stack_lvl+0x100/0x190 [ 477.239774][T21513] print_circular_bug.cold+0x178/0x1be [ 477.241524][T21513] check_noncircular+0x146/0x160 [ 477.243047][T21513] check_prev_add+0xeb/0xe60 [ 477.244436][T21513] __lock_acquire+0x1528/0x1f40 [ 477.245908][T21513] lock_acquire+0x1d1/0x380 [ 477.247308][T21513] ? l2cap_chan_connect+0xac/0x2110 [ 477.248867][T21513] ? __pfx___might_resched+0x10/0x10 [ 477.250542][T21513] __mutex_lock+0x1a4/0x1bd0 [ 477.251961][T21513] ? l2cap_chan_connect+0xac/0x2110 [ 477.253599][T21513] ? l2cap_chan_connect+0xac/0x2110 [ 477.255246][T21513] ? hci_get_route+0x368/0x520 [ 477.256740][T21513] ? hci_get_route+0x368/0x520 [ 477.258209][T21513] ? __pfx___mutex_lock+0x10/0x10 [ 477.259819][T21513] ? _raw_read_unlock+0x28/0x50 [ 477.261374][T21513] ? hci_get_route+0x368/0x520 [ 477.262999][T21513] ? __pfx_hci_get_route+0x10/0x10 [ 477.264628][T21513] ? reacquire_held_locks+0xdd/0x1f0 [ 477.266299][T21513] ? release_sock+0x21/0x280 [ 477.267797][T21513] ? l2cap_chan_connect+0xac/0x2110 [ 477.269444][T21513] l2cap_chan_connect+0xac/0x2110 [ 477.271043][T21513] ? __local_bh_enable_ip+0xa5/0x120 [ 477.272704][T21513] l2cap_sock_connect+0x37a/0x770 [ 477.274284][T21513] ? __pfx_l2cap_sock_connect+0x10/0x10 [ 477.276018][T21513] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 477.277847][T21513] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 477.279700][T21513] kernel_connect+0x107/0x160 [ 477.281192][T21513] ? __pfx_kernel_connect+0x10/0x10 [ 477.282831][T21513] ? timer_init_key+0x150/0x310 [ 477.284375][T21513] rfcomm_dlc_open+0x838/0xac0 [ 477.285869][T21513] ? __pfx_rfcomm_dlc_open+0x10/0x10 [ 477.287499][T21513] ? rfcomm_sock_connect+0x3e8/0x690 [ 477.289178][T21513] ? find_held_lock+0x2b/0x80 [ 477.290629][T21513] ? rfcomm_sock_connect+0x3e8/0x690 [ 477.292234][T21513] ? __local_bh_enable_ip+0xa5/0x120 [ 477.293886][T21513] rfcomm_sock_connect+0x42c/0x690 [ 477.295512][T21513] __sys_connect_file+0x146/0x1a0 [ 477.297094][T21513] __sys_connect+0x141/0x170 [ 477.298565][T21513] ? __pfx___sys_connect+0x10/0x10 [ 477.300293][T21513] ? rfcomm_sock_shutdown+0xa2/0x2c0 [ 477.301919][T21513] __ia32_sys_connect+0x71/0xb0 [ 477.303480][T21513] ? lockdep_hardirqs_on+0x7d/0x110 [ 477.305130][T21513] __do_fast_syscall_32+0x13a/0x8b0 [ 477.306724][T21513] ? lockdep_hardirqs_on+0x7d/0x110 [ 477.308346][T21513] do_fast_syscall_32+0x32/0x70 [ 477.309841][T21513] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 477.311860][T21513] RIP: 0023:0xf748efec [ 477.313169][T21513] Code: Unable to access opcode bytes at 0xf748efc2. [ 477.315255][T21513] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 000000000000016a [ 477.317859][T21513] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800005c0 [ 477.320354][T21513] RDX: 000000000000000a RSI: 0000000000000000 RDI: 0000000000000000 [ 477.322787][T21513] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 477.325256][T21513] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 477.327639][T21513] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 477.330129][T21513] [ 477.897874][ T5874] Bluetooth: hci2: command 0x040f tx timeout [ 477.983356][ T5874] Bluetooth: hci1: command 0x0c1a tx timeout [ 480.119425][ T5860] Bluetooth: hci2: command 0x040f tx timeout [ 480.205004][ T5860] Bluetooth: hci1: command 0x0c1a tx timeout [ 482.340891][ T5860] Bluetooth: hci2: command 0x040f tx timeout [ 482.426399][ T5860] Bluetooth: hci1: command 0x0c1a tx timeout [ 484.562398][ T5860] Bluetooth: hci2: command 0x040f tx timeout [ 484.647831][ T5860] Bluetooth: hci1: command 0x0c1a tx timeout [ 486.783910][ T5860] Bluetooth: hci2: command 0x040f tx timeout