last executing test programs: 5.650451511s ago: executing program 2 (id=487): socket$rds(0x15, 0x5, 0x0) r0 = syz_ublk_setup_io_uring(0x2261, &(0x7f0000000300)={0x0, 0xd58c, 0x80, 0x2, 0x30b}, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x12, 0x0, 0x0, 0xffffffffffffffff, &(0x7f00000000c0), 0x1, 0x40, 0x1}) eventfd2(0x1, 0x80001) r4 = eventfd(0xe467) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, 0x0) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0x3b5, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x400, 0x5, 0x255}, &(0x7f0000000a00)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x40000, 0x3, 0xff, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0x2, 0xb2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x20000000, 0xe4, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x200, 0x1, 0x80000250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000080)=r4, 0x1) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000003c0)={0x2e, 0x5, 0x21, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) 4.388904361s ago: executing program 3 (id=492): r0 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) syz_open_dev$MSR(&(0x7f0000000280), 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000080)="95", 0x1}], 0x1) r2 = socket$inet(0x2, 0x2, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="380000006c00010025bd7000ffdbdf2500000000", @ANYRES32=r4, @ANYBLOB="8000010018000000180034801400350069703665727370616e", @ANYBLOB='4'], 0x38}, 0x1, 0x0, 0x0, 0x4040000}, 0x4008010) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0xfffffffffffffffd, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x260, 0x17a00}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}, 0x1, 0x8100}, 0x2800804c) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3, &(0x7f00000000c0)=0x0) io_submit(r7, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x9, 0x1, 0x0, r6, &(0x7f00000001c0)='m', 0xfffffdfc}]) ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f0000000940)={0xa, 0x0, 0x3, {0xa, 0x2, 0x8, 0x200002}}) 4.385608461s ago: executing program 0 (id=501): socket(0x29, 0x80805, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000300)="e8", 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='p:p1 ./file0:0', 0xe) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./tracing/events/uprobes/p1/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='1', 0x1) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x5, 0x12, r0, 0x0) io_submit(0x0, 0x0, 0x0) listxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=""/90, 0x5a) syz_clone(0x4a044000, 0x0, 0x0, 0x0, 0x0, 0x0) 4.133199938s ago: executing program 3 (id=493): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000500)={0x1, &(0x7f0000000000)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) r1 = getpid() listen(0xffffffffffffffff, 0x10000008) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) syz_pidfd_open(r1, 0x0) getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, 0x0, &(0x7f0000000080)) r2 = socket(0x200000000000011, 0x2, 0xd) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) setsockopt$inet6_mreq(r4, 0x29, 0x14, &(0x7f0000000100)={@mcast2, r5}, 0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=@newtfilter={0x24, 0x11, 0xd27, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x74, r5, {0x4, 0xfff2}, {0xafabc05531515610, 0xd}, {0x8, 0x2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x1c005}, 0x24048004) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) close_range(r0, 0xffffffffffffffff, 0x200000000000000) 4.11298695s ago: executing program 0 (id=494): timer_create(0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x7fffffff, 0x0, 0x2}, {0xfffffffffffffffe, 0xffffffffffffffff}, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x2b}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x4000}]}]}, 0xfc}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='bridge_slave_1\x00', 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x810) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) 3.950669569s ago: executing program 3 (id=496): close(0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0) symlinkat(&(0x7f00000004c0)='./sys/bus/pci/drivers/i801_smbus\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./drv\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./drv/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000580)='0000:00:1f.3', 0xc) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='./proc\x00', 0x0, 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f00000006c0)='100', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./drv/bind\x00', 0x1, 0x0) write(r2, &(0x7f0000000740)='0000:00:1f.3', 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 3.621472341s ago: executing program 3 (id=499): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mknodat(r0, &(0x7f0000000100)='./file1/file0\x00', 0x200, 0x7) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000200)='overlay\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/sda\x00', 0x2, 0x0) fremovexattr(r2, &(0x7f0000000000)=@known='system.posix_acl_default\x00') 3.176266985s ago: executing program 0 (id=502): socket$key(0xf, 0x3, 0x2) userfaultfd(0x80001) inotify_init1(0x80000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x2d, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)={0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x8, 0x0, 0x0, 0x3, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x9, 0x0, 0x0, 0x2}, {0xeda7, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x9}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x20000000, 0x0, 0xfffffffffffffff8, 0x0, 0x0, 0x2004cb, 0x3, 0x100000000000000, 0xfffffffffffffff8, 0x0, 0xfffffffffffff2ab, 0x2000000000003ff, 0x2], 0x0, 0x200306}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.919241786s ago: executing program 1 (id=504): r0 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) syz_open_dev$MSR(&(0x7f0000000280), 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000080)="95", 0x1}], 0x1) r2 = socket$inet(0x2, 0x2, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="380000006c00010025bd7000ffdbdf2500000000", @ANYRES32=r4, @ANYBLOB="8000010018000000180034801400350069703665727370616e", @ANYBLOB='4'], 0x38}, 0x1, 0x0, 0x0, 0x4040000}, 0x4008010) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0xfffffffffffffffd, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x260, 0x17a00}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}, 0x1, 0x8100}, 0x2800804c) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3, &(0x7f00000000c0)=0x0) io_submit(r7, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x9, 0x1, 0x0, r6, &(0x7f00000001c0)='m', 0xfffffdfc}]) ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f0000000940)={0xa, 0x0, 0x3, {0xa, 0x2, 0x8, 0x200002}}) 2.584327808s ago: executing program 1 (id=505): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000000000)=0x4, 0x4) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000240), 0x3) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r0, &(0x7f0000002c80)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000440)=""/177, 0xb1}], 0x1}, 0x9}], 0x1, 0x23, 0x0) writev(r0, &(0x7f0000001540)=[{&(0x7f0000000300)='.', 0x1}], 0x1) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 2.476318439s ago: executing program 0 (id=506): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f00000001c0)={0x1, 0x0, 0x0}) close(0x3) r1 = socket$pppoe(0x18, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/i2c/devices/i2c-1/new_device\x00', 0x1, 0x0) write(r2, &(0x7f0000000100)='isp1301 0x2', 0xb) r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r3, &(0x7f0000000100)='isp1301 0x2c', 0xc) connect$pppoe(r1, &(0x7f0000000180)={0x18, 0x0, {0x1, @empty, 'ip6tnl0\x00'}}, 0x1e) writev(r1, &(0x7f00000006c0)=[{&(0x7f0000000680)="c8", 0x1}], 0x1) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x70bd21, 0x25dfdbfb, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}, 0x1, 0xba01, 0x0, 0x400c002}, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x0, 0x0) 1.909107525s ago: executing program 2 (id=507): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000500)={0x1, &(0x7f0000000000)=[{0x6, 0x10, 0x2, 0x7fff7ffc}]}) r1 = getpid() listen(0xffffffffffffffff, 0x10000008) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) syz_pidfd_open(r1, 0x0) getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, 0x0, &(0x7f0000000080)) r2 = socket(0x200000000000011, 0x2, 0xd) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) setsockopt$inet6_mreq(r4, 0x29, 0x14, &(0x7f0000000100)={@mcast2, r5}, 0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=@newtfilter={0x24, 0x11, 0xd27, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x74, r5, {0x4, 0xfff2}, {0xafabc05531515610, 0xd}, {0x8, 0x2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x1c005}, 0x24048004) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) close_range(r0, 0xffffffffffffffff, 0x200000000000000) 1.693448514s ago: executing program 0 (id=508): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000100)='./file0\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$lock(r1, 0x410, &(0x7f0000000200)={0x1, 0x3, 0x1000000000000001, 0x9b}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) renameat(r2, &(0x7f00000001c0)='./file0\x00', r0, &(0x7f00000002c0)='./file1\x00') 1.69312322s ago: executing program 1 (id=509): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001100)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000001140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01010000000000000000020000000900010073797a3000000000080002400000000350000000120a01010000000000000000020000000900010073797a3000000000070002006f303000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323900080003400000000720000480060001000002000005000200110000000c000300080001000000001e14000000110001"], 0xcd0}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000002200)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002000)=ANY=[], 0x28}}, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000400)={0x3, {{0xa, 0x4e24, 0x0, @mcast1, 0xff7ffffd}}, {{0xa, 0x4e08, 0x4a3, @empty, 0x4f1}}}, 0x108) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x2, [@var, @volatile, @volatile, @volatile={0x0, 0x0, 0x0, 0x9, 0x2}]}}, 0x0, 0x4e}, 0x28) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000980)={&(0x7f00000009c0)=ANY=[@ANYRESOCT], 0x0, 0x26, 0x0, 0x1, 0x2}, 0x28) writev(r0, &(0x7f0000000040)=[{0x0}], 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x20004000) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) close(0x3) 1.644169105s ago: executing program 2 (id=510): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) socket$nl_route(0x10, 0x3, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000340), 0x800, 0x0) socket$packet(0x11, 0x3, 0x300) socket$netlink(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x4, 0x6f9, 0x0, 0x0, 0x1000, 0xb}}}, &(0x7f0000000480)=0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r0, &(0x7f00000004c0)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x2f6}, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40000001, 0x335}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x20000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 1.569009881s ago: executing program 1 (id=511): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x141c80, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r5 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, &(0x7f0000000240), &(0x7f0000000280)=0x4) getsockopt(0xffffffffffffffff, 0x200000000114, 0x271a, 0xffffffffffffffff, 0x0) ioctl$PAGEMAP_SCAN(r5, 0xc0606610, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.161765305s ago: executing program 2 (id=512): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x2200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x4040010) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000380)) fcntl$lock(0xffffffffffffffff, 0x26, 0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x312000, 0x800, 0x0, 0x2}, 0x20) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_VCPU_EVENTS(r4, 0x4048aecb, &(0x7f0000000300)) 244.306864ms ago: executing program 2 (id=513): r0 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) syz_open_dev$MSR(&(0x7f0000000280), 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000080)="95", 0x1}], 0x1) r2 = socket$inet(0x2, 0x2, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="380000006c00010025bd7000ffdbdf2500000000", @ANYRES32=r4, @ANYBLOB="8000010018000000180034801400350069703665727370616e", @ANYBLOB='4'], 0x38}, 0x1, 0x0, 0x0, 0x4040000}, 0x4008010) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0xfffffffffffffffd, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x260, 0x17a00}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}, 0x1, 0x8100}, 0x2800804c) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3, &(0x7f00000000c0)=0x0) io_submit(r7, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x9, 0x1, 0x0, r6, &(0x7f00000001c0)='m', 0xfffffdfc}]) ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f0000000940)={0xa, 0x0, 0x3, {0xa, 0x2, 0x8, 0x200002}}) 244.146163ms ago: executing program 3 (id=514): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x3c}}, 0x8000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5) sendto$packet(r0, &(0x7f0000000040)="2717a90af1a30d71286f47000000", 0x6f, 0x40000, &(0x7f0000000180)={0x11, 0x16, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) 241.231607ms ago: executing program 0 (id=521): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@ccm_128={{0x303}, "63a7d38a4937c1fc", "5f90d5f023d7bd5bd799356c95abffc8", "09fe0891", "0aa3b9dd5fe7a771"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "b421eba833d4b156", "56df2295bfda5c4f9fecff61beaa8bb4", "808065e3", "7f1f1c2ab4421d27"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r0, &(0x7f0000008140)=[{{0x0, 0x0, &(0x7f00000032c0)=[{&(0x7f00000022c0)=""/4096, 0x1000}], 0x1}, 0x1fff}, {{0x0, 0x0, &(0x7f0000004440)=[{&(0x7f0000000000)=""/39, 0x27}], 0x1}, 0xfff}], 0x2, 0x0, 0x0) writev(r0, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0xfe86}, {&(0x7f0000000580)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000000500)="de21cff472aa580c2ee9f858", 0xfc96}, {&(0x7f00000014c0)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a0858fe5c7e75ecf92e735452456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd716adbc3f0ba6055ec9790504c9f3865f47e422b1c6ba16c07d0df618cc572b36ec8e519db90a499424a7d689e6fbcc9be1abd843512ec16540c6c7c6d6e2cf50ab2014e4208c2abb0ddfd2ef9dece79389f21d7a9985903f7f01b0394d268349fa41a487bacfe8deba2ffca815ad0b1c6ffa5af2eba6d9436ad298c4e11b68451c7ff001c02ddd3ceb153a865327845349e8b817aa8ed24924f49260f8209d0ddcacf5306d9222320776162fe8396914fa22c85bc261661fa547c3063e20ca37c0862c3b9abd3da9b02e3f58d89be00003509bae9b82f60975c0687c500bb213a580f6e9f08b207d7c31748e3fda05a0cc76b1fdd563610a2bb09a57020d85026a57a178c38839b5b88cd8434d1f0308d872c7356a6445de801ff14c133bda3b42b9ca099fb3ee0d5c7a835f56ed30aa75d47cd97c329b682879290faee167334500d2fe596564f3e4064f41cf3469aaae846f1e84f3d8a7f42d98d0b6b67913c376d6bbde3027aa41b753ace165f88379981685f918ada5043800b5e0a0865dcda94df85fefa9348d6ec4e1ffbd940d023fbbd3b77d5db572981dbe40cbae9f010c1ea02718b1c4b7d0447c9d83d1afea58097a0467d6cdd47aef05f97dab63462f6ea61f4b611040b30e7cf60a499aa9d0bc50c08463f25a47d2dbc958fe1d1cf2399dcf1952987b6fcbc97bf73b12177c374c8fd56c8228fc796c958687104f4eb9d46ab80eeeeedb7096a67ee440ae92a65cbf6f81939e3d1050c67245036b5dcc13d577fbb4d9c3fbf2e2e61aa154074ae225c54e23289c4ef41a07a49a9d40f3103f4c9dfd4d750cc646adadd2e1fe24c74ce099d753d4c59d806a0b7f576ac37ac58a51a120f93162c43d16c1f7e5289c75f5f0a5b838d020040c9ce512ca35d08f42acd24cdbc2e6b1ac3c6809a5ed9e272155e9fa55349bc3ce0e3f2d1624dc60e2396b954587bbab275f38911e86b826b85730c6670a92a221cdcbf18ee0c44aec4591fcd12204b3049a1b5da1215a4cf88ecbe2d877ef975f4f661999d17d7d9ec14e0895ce25034dac4705d50ae42ca162778d0dcfc4e9180517be0daca5deb10773f93e2c61a5fe9b823218a97c35d0d7b436b2e1afb670b5a4c6dacd401afd1832c1dd96e8eba7734954070c6796cc80707441404cfe95fabf214bf03a6e4643ca559c2b8dcf1fa871114f3dc973a056c9aee7cd0ed4cbaf18298377e750869551632c1713bd8372e3f11fa02edf0a68d2c01245459d9e78597ac1eec75064024c1f3c98260d34b611ba8fa4b2022babd44b76ea70c718df8268dba447038b1539f0499603cf2d79bcc49c35a8cf38892d982d153d72253a22ae68da65e84d6399e81a14ebf89ba446630814d9dcf8914acafc8603a5396167c5aa99814af62c1c39a6ba76ad2c6c51a6d56d89fbda5334e626540ef1b1ecad53247531fcdd661a48d28a6d48bac8ef70c888b00db57edceee94425df5161e1b1a1bec9c897e01867442ed8ba000b5f75832a8ec57ef0737994b95f40eac48f3c8da5db80e965fcdf3f0bbb4439a7123b59987f0fdac96bc7ce09c013562ff7c0cb23a882828e45a51f7e748db90c5eaacfdf3657d11a348f747ddd860387de41be3376a5dabf4296bc05282cb73fcd60c4a4148d9e872ae86e30b22db1ce5452ad9fe3fea029f94a583d301e74eac1818da3f1279c63690db6e7166ddaacd1278716fa3221daaa27c98fd97b88e63208d604505ad8f31bd2b83a19f89480b71198d8a31c89cadd258ce338afe1a26b0db248c1a39fe027716e417e45bb6c9a68cab1cd6c3445e9796ee1003650e97eccdadc9bea540e2c8253652c8f1586ba7e508cd29d53467bad11eef729796dbe83d3fc0bc15762c2f1de34c6380a6725f94600a82d87ccf80948babcadec31ca654671d17de360f20aaf04f4d44951661fe8fe7731174ec3aaf330aebeaed9620f694859785a36c5f787ce35e4425ed3387710fa346f04db11255c6985fa4cdbe54d25c942264b3383d60903bd2677611850fe125b", 0xdf3}], 0x5) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 240.323482ms ago: executing program 1 (id=522): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x1d, 0x2, &(0x7f0000000280)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}], 0x0, 0x6, 0x0, 0x0, 0x0, 0x5a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="7103b3"], 0xb6) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r4], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r5, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r6, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 100.956518ms ago: executing program 3 (id=515): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)={0x20, r8, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x48000) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r2, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r1}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 91.093372ms ago: executing program 2 (id=525): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0x0, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x7a, &(0x7f0000000280)={@random="856b934629fa", @local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "381f34", 0x14, 0x2f, 0x0, @private0, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8100, 0x2, 0x892f}, {}, {}, {0xa888}}}}}}}, 0x0) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="0503e5fdd3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x8100, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 0s ago: executing program 1 (id=516): close(0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0) symlinkat(&(0x7f00000004c0)='./sys/bus/pci/drivers/i801_smbus\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./drv\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./drv/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000580)='0000:00:1f.3', 0xc) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='./proc\x00', 0x0, 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f00000006c0)='100', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./drv/bind\x00', 0x1, 0x0) write(r2, &(0x7f0000000740)='0000:00:1f.3', 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) kernel console output (not intermixed with test programs): vsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.878146][ T5778] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.878164][ T5778] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.878182][ T5778] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.878199][ T5778] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.878216][ T5778] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.881579][ T5731] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 39.886144][ T5731] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 39.887852][ T5731] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 39.888967][ T5731] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 39.893376][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.893387][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.904289][ T5742] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.904503][ T5733] veth0_macvtap: entered promiscuous mode [ 39.905422][ T5731] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 39.912486][ T5742] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.918465][ T5733] veth1_macvtap: entered promiscuous mode [ 39.952384][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.958322][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.959109][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.959219][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.979453][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.979537][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.979563][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.979587][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.006672][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.006708][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.025580][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.025593][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.048587][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.048615][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.050623][ T1158] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.050635][ T1158] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.069556][ T1158] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.069569][ T1158] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.371613][ T5909] syzkaller0: entered promiscuous mode [ 40.371628][ T5909] syzkaller0: entered allmulticast mode [ 40.435746][ T5912] syz.1.6 uses obsolete (PF_INET,SOCK_PACKET) [ 41.129872][ T5739] Bluetooth: hci0: command tx timeout [ 41.185853][ T5927] syzkaller0: entered promiscuous mode [ 41.185866][ T5927] syzkaller0: entered allmulticast mode [ 41.209743][ T5739] Bluetooth: hci1: command tx timeout [ 41.218266][ T66] Bluetooth: hci2: command tx timeout [ 41.218311][ T5739] Bluetooth: hci3: command tx timeout [ 42.628048][ T1038] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 42.742092][ T5946] netlink: 12 bytes leftover after parsing attributes in process `syz.2.16'. [ 42.789363][ T1038] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 42.791042][ T1038] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 42.791065][ T1038] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.793191][ T1038] usb 6-1: config 0 descriptor?? [ 42.825117][ T5952] CIFS: bad ip= option (127®0.0.1) [ 42.825145][ T5952] FAULT_INJECTION: forcing a failure. [ 42.825145][ T5952] name fail_futex, interval 1, probability 0, space 0, times 1 [ 42.825160][ T5952] CPU: 1 UID: 0 PID: 5952 Comm: syz.3.19 Not tainted syzkaller #0 PREEMPT(full) [ 42.825173][ T5952] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 42.825180][ T5952] Call Trace: [ 42.825184][ T5952] [ 42.825189][ T5952] dump_stack_lvl+0x100/0x190 [ 42.825208][ T5952] should_fail_ex.cold+0x5/0xa [ 42.825224][ T5952] get_futex_key+0x1d0/0x14f0 [ 42.825245][ T5952] ? __pfx_get_futex_key+0x10/0x10 [ 42.825262][ T5952] futex_wake+0xf4/0x5e0 [ 42.825279][ T5952] ? __pfx_futex_wake+0x10/0x10 [ 42.825301][ T5952] do_futex+0x2b2/0x440 [ 42.825315][ T5952] ? __pfx_do_futex+0x10/0x10 [ 42.825328][ T5952] ? kfree+0x22b/0x6d0 [ 42.825344][ T5952] __ia32_sys_futex_time32+0x2f4/0x470 [ 42.825361][ T5952] ? xfd_validate_state+0x129/0x190 [ 42.825379][ T5952] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 42.825398][ T5952] __do_fast_syscall_32+0x13a/0x8b0 [ 42.825412][ T5952] do_fast_syscall_32+0x32/0x70 [ 42.825424][ T5952] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 42.825440][ T5952] RIP: 0023:0xf746efec [ 42.825452][ T5952] Code: Unable to access opcode bytes at 0xf746efc2. [ 42.825457][ T5952] RSP: 002b:00000000f54865cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 42.825469][ T5952] RAX: ffffffffffffffda RBX: 00000000f7494f8c RCX: 0000000000000081 [ 42.825476][ T5952] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 42.825483][ T5952] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 42.825489][ T5952] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 42.825496][ T5952] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 42.825509][ T5952] [ 42.875904][ T5952] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 42.876658][ T5952] CIFS: Attempting to mount (null) [ 42.878978][ T5952] CIFS: VFS: Error connecting to socket. Aborting operation. [ 42.879016][ T5952] CIFS: VFS: cifs_mount failed w/return code = -111 [ 42.969621][ T43] audit: type=1326 audit(1792083721.484:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5960 comm="syz.0.22" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 42.970026][ T43] audit: type=1326 audit(1792083721.484:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5960 comm="syz.0.22" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 42.974465][ T43] audit: type=1326 audit(1792083721.484:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5960 comm="syz.0.22" exe="/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf748efec code=0x7ffc0000 [ 42.974495][ T43] audit: type=1326 audit(1792083721.484:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5960 comm="syz.0.22" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 42.974584][ T43] audit: type=1326 audit(1792083721.484:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5960 comm="syz.0.22" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 42.974786][ T43] audit: type=1326 audit(1792083721.484:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5960 comm="syz.0.22" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf748efec code=0x7ffc0000 [ 42.975494][ T43] audit: type=1326 audit(1792083721.484:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5960 comm="syz.0.22" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 42.975586][ T43] audit: type=1326 audit(1792083721.484:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5960 comm="syz.0.22" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 42.981588][ T43] audit: type=1326 audit(1792083721.494:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5960 comm="syz.0.22" exe="/syz-executor" sig=0 arch=40000003 syscall=310 compat=1 ip=0xf748efec code=0x7ffc0000 [ 42.982914][ T43] audit: type=1326 audit(1792083721.494:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5960 comm="syz.0.22" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 42.991309][ T5961] Zero length message leads to an empty skb [ 43.007710][ T1038] usbhid 6-1:0.0: can't add hid device: -71 [ 43.007784][ T1038] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 43.024317][ T1038] usb 6-1: USB disconnect, device number 2 [ 43.044498][ T5964] input: syz0 as /devices/virtual/input/input5 [ 43.104325][ T5966] process 'syz.3.24' launched './file1' with NULL argv: empty string added [ 43.208221][ T5739] Bluetooth: hci0: command tx timeout [ 43.215341][ T5942] netlink: 'syz.1.15': attribute type 3 has an invalid length. [ 43.215354][ T5942] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15'. [ 43.289105][ T66] Bluetooth: hci2: command tx timeout [ 43.289136][ T66] Bluetooth: hci1: command tx timeout [ 43.289235][ T5739] Bluetooth: hci3: command tx timeout [ 43.550381][ T1038] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 43.702568][ T5987] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 43.710648][ T1038] usb 6-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 43.713195][ T1038] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.713211][ T1038] usb 6-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 43.713223][ T1038] usb 6-1: config 0 interface 0 has no altsetting 0 [ 43.713240][ T1038] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.723617][ T1038] usb 6-1: config 0 descriptor?? [ 44.343740][ T1038] usbhid 6-1:0.0: can't add hid device: -71 [ 44.343792][ T1038] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 44.352771][ T1038] usb 6-1: USB disconnect, device number 3 [ 45.288274][ T5739] Bluetooth: hci0: command tx timeout [ 45.346175][ T6002] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input6 [ 45.368405][ T5736] Bluetooth: hci1: command tx timeout [ 45.368430][ T5736] Bluetooth: hci2: command tx timeout [ 45.368453][ T5739] Bluetooth: hci3: command tx timeout [ 45.875601][ T6020] tipc: Started in network mode [ 45.875619][ T6020] tipc: Node identity 4, cluster identity 4711 [ 45.875629][ T6020] tipc: Node number set to 4 [ 45.887054][ T6017] jffs2: notice: (6017) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 46.050872][ T12] tipc: Subscription rejected, illegal request [ 46.162655][ T5999] syz.2.34 (5999) used greatest stack depth: 19848 bytes left [ 46.917436][ T6051] netlink: 16 bytes leftover after parsing attributes in process `syz.2.49'. [ 47.095180][ T6059] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 47.096163][ T6059] sch_tbf: burst 10 is lower than device lo mtu (65550) ! [ 47.125942][ T6061] FAULT_INJECTION: forcing a failure. [ 47.125942][ T6061] name failslab, interval 1, probability 0, space 0, times 1 [ 47.125971][ T6061] CPU: 3 UID: 0 PID: 6061 Comm: syz.1.54 Not tainted syzkaller #0 PREEMPT(full) [ 47.125992][ T6061] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 47.126004][ T6061] Call Trace: [ 47.126011][ T6061] [ 47.126019][ T6061] dump_stack_lvl+0x100/0x190 [ 47.126094][ T6061] should_fail_ex.cold+0x5/0xa [ 47.126120][ T6061] should_failslab+0xc2/0x120 [ 47.126172][ T6061] __kmalloc_noprof+0xfc/0x840 [ 47.126211][ T6061] ? evm_inode_alloc_security+0x44/0xc0 [ 47.126233][ T6061] ? sk_prot_alloc+0x10b/0x2a0 [ 47.126284][ T6061] sk_prot_alloc+0x10b/0x2a0 [ 47.126312][ T6061] sk_alloc+0x36/0xe80 [ 47.126335][ T6061] __netlink_create+0x5e/0x2c0 [ 47.126365][ T6061] __netlink_kernel_create+0xed/0x750 [ 47.126386][ T6061] ? __pfx___netlink_kernel_create+0x10/0x10 [ 47.126405][ T6061] ? find_held_lock+0x2b/0x80 [ 47.126431][ T6061] ? __pfx_crypto_netlink_init+0x10/0x10 [ 47.126459][ T6061] crypto_netlink_init+0xb7/0x140 [ 47.126486][ T6061] ? __pfx_crypto_netlink_init+0x10/0x10 [ 47.126511][ T6061] ? __nf_register_net_hook+0x291/0x780 [ 47.126531][ T6061] ? __pfx_crypto_netlink_rcv+0x10/0x10 [ 47.126558][ T6061] ? nf_register_net_hook+0xe2/0x170 [ 47.126598][ T6061] ? nf_register_net_hooks+0xb1/0xd0 [ 47.126627][ T6061] ops_init+0x1e2/0x5f0 [ 47.126655][ T6061] setup_net+0x118/0x3a0 [ 47.126680][ T6061] ? __pfx_setup_net+0x10/0x10 [ 47.126711][ T6061] copy_net_ns+0x345/0x7a0 [ 47.126738][ T6061] create_new_namespaces+0x3ea/0xac0 [ 47.126771][ T6061] unshare_nsproxy_namespaces+0xf2/0x220 [ 47.126801][ T6061] ksys_unshare+0x4a2/0xb30 [ 47.126821][ T6061] ? __pfx_ksys_unshare+0x10/0x10 [ 47.126850][ T6061] __ia32_sys_unshare+0x30/0x40 [ 47.126868][ T6061] __do_fast_syscall_32+0x13a/0x8b0 [ 47.126914][ T6061] ? lockdep_hardirqs_on+0x7d/0x110 [ 47.126945][ T6061] do_fast_syscall_32+0x32/0x70 [ 47.126965][ T6061] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 47.126990][ T6061] RIP: 0023:0xf745efec [ 47.127009][ T6061] Code: Unable to access opcode bytes at 0xf745efc2. [ 47.127017][ T6061] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000136 [ 47.127035][ T6061] RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 0000000000000000 [ 47.127047][ T6061] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 47.127057][ T6061] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 47.127067][ T6061] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 47.127079][ T6061] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 47.127103][ T6061] [ 47.177348][ T6066] syzkaller0: entered promiscuous mode [ 47.177362][ T6066] syzkaller0: entered allmulticast mode [ 47.238553][ T6068] syzkaller0: entered promiscuous mode [ 47.238566][ T6068] syzkaller0: entered allmulticast mode [ 47.332842][ T6074] netlink: 'syz.0.60': attribute type 1 has an invalid length. [ 48.155947][ T6089] netlink: 'syz.1.62': attribute type 4 has an invalid length. [ 48.590468][ T6108] trusted_key: encrypted_key: insufficient parameters specified [ 48.599013][ T6108] FAULT_INJECTION: forcing a failure. [ 48.599013][ T6108] name failslab, interval 1, probability 0, space 0, times 0 [ 48.599042][ T6108] CPU: 3 UID: 0 PID: 6108 Comm: syz.0.66 Not tainted syzkaller #0 PREEMPT(full) [ 48.599063][ T6108] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 48.599073][ T6108] Call Trace: [ 48.599080][ T6108] [ 48.599088][ T6108] dump_stack_lvl+0x100/0x190 [ 48.599119][ T6108] should_fail_ex.cold+0x5/0xa [ 48.599143][ T6108] should_failslab+0xc2/0x120 [ 48.599174][ T6108] kmem_cache_alloc_noprof+0x92/0x6a0 [ 48.599200][ T6108] ? alloc_empty_file+0x5b/0x1c0 [ 48.599221][ T6108] alloc_empty_file+0x5b/0x1c0 [ 48.599240][ T6108] path_openat+0xdb/0x2440 [ 48.599269][ T6108] ? __pfx_path_openat+0x10/0x10 [ 48.599309][ T6108] do_file_open+0x20e/0x430 [ 48.599339][ T6108] ? __pfx_do_file_open+0x10/0x10 [ 48.599383][ T6108] ? _raw_spin_unlock+0x28/0x50 [ 48.599408][ T6108] ? alloc_fd+0x471/0x7a0 [ 48.599440][ T6108] do_sys_openat2+0x10f/0x1e0 [ 48.599460][ T6108] ? __pfx_do_sys_openat2+0x10/0x10 [ 48.599481][ T6108] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 48.599508][ T6108] __ia32_compat_sys_openat+0x12d/0x210 [ 48.599530][ T6108] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 48.599559][ T6108] do_int80_emulation+0x166/0x650 [ 48.599580][ T6108] asm_int80_emulation+0x1a/0x20 [ 48.599599][ T6108] RIP: 0023:0xf71e77eb [ 48.599613][ T6108] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 48.599630][ T6108] RSP: 002b:00000000f54a63cc EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 48.599648][ T6108] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f54a6490 [ 48.599660][ T6108] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 48.599670][ T6108] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 48.599681][ T6108] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 48.599692][ T6108] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 48.599715][ T6108] [ 48.745795][ T43] kauditd_printk_skb: 32 callbacks suppressed [ 48.745815][ T43] audit: type=1326 audit(1792083983.256:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6109 comm="syz.0.67" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x0 [ 49.028712][ T6114] netlink: 'syz.1.68': attribute type 1 has an invalid length. [ 49.249513][ T6104] syzkaller0: entered promiscuous mode [ 49.249537][ T6104] syzkaller0: entered allmulticast mode [ 49.251309][ T42] rxe_eth0 speed is unknown, defaulting to 1000 [ 49.294017][ T66] Bluetooth: hci3: connection err: -111 [ 49.302470][ T6122] syzkaller0: entered promiscuous mode [ 49.302484][ T6122] syzkaller0: entered allmulticast mode [ 49.550267][ T6144] syzkaller0: entered promiscuous mode [ 49.550281][ T6144] syzkaller0: entered allmulticast mode [ 49.693261][ T6150] netlink: 'syz.0.77': attribute type 39 has an invalid length. [ 49.745489][ T6152] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 49.745512][ T6152] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 49.746646][ T6152] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 49.746663][ T6152] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 49.885953][ T6158] FAULT_INJECTION: forcing a failure. [ 49.885953][ T6158] name failslab, interval 1, probability 0, space 0, times 0 [ 49.885972][ T6158] CPU: 2 UID: 0 PID: 6158 Comm: syz.0.79 Not tainted syzkaller #0 PREEMPT(full) [ 49.885985][ T6158] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 49.885991][ T6158] Call Trace: [ 49.885995][ T6158] [ 49.885999][ T6158] dump_stack_lvl+0x100/0x190 [ 49.886018][ T6158] should_fail_ex.cold+0x5/0xa [ 49.886033][ T6158] should_failslab+0xc2/0x120 [ 49.886051][ T6158] __kmalloc_noprof+0xfc/0x840 [ 49.886067][ T6158] ? udpv6_init_sock+0x24e/0x450 [ 49.886087][ T6158] udpv6_init_sock+0x24e/0x450 [ 49.886103][ T6158] ? __pfx_udpv6_init_sock+0x10/0x10 [ 49.886121][ T6158] inet6_create+0xb1a/0x12b0 [ 49.886154][ T6158] ? inet6_create+0x7f/0x12b0 [ 49.886168][ T6158] __sock_create+0x339/0x860 [ 49.886190][ T6158] __sys_socket+0x14d/0x260 [ 49.886207][ T6158] ? xfd_validate_state+0x129/0x190 [ 49.886224][ T6158] ? __pfx___sys_socket+0x10/0x10 [ 49.886247][ T6158] __ia32_sys_socket+0x72/0xb0 [ 49.886258][ T6158] ? lockdep_hardirqs_on+0x7d/0x110 [ 49.886276][ T6158] __do_fast_syscall_32+0x13a/0x8b0 [ 49.886290][ T6158] do_fast_syscall_32+0x32/0x70 [ 49.886303][ T6158] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 49.886318][ T6158] RIP: 0023:0xf748efec [ 49.886331][ T6158] Code: Unable to access opcode bytes at 0xf748efc2. [ 49.886336][ T6158] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 49.886347][ T6158] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000000000002 [ 49.886354][ T6158] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 49.886360][ T6158] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 49.886367][ T6158] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 49.886373][ T6158] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 49.886387][ T6158] [ 50.049938][ T6165] syzkaller0: entered promiscuous mode [ 50.049952][ T6165] syzkaller0: entered allmulticast mode [ 50.173363][ T6168] netlink: 28 bytes leftover after parsing attributes in process `syz.0.83'. [ 50.173388][ T6168] netlink: 28 bytes leftover after parsing attributes in process `syz.0.83'. [ 50.173401][ T6168] netlink: 8 bytes leftover after parsing attributes in process `syz.0.83'. [ 50.667313][ T6179] syzkaller0: entered promiscuous mode [ 50.667326][ T6179] syzkaller0: entered allmulticast mode [ 50.825706][ T6000] udevd[6000]: inotify_add_watch(7, /dev/loop7, 10) failed: No such file or directory [ 50.840437][ T6185] netlink: 144 bytes leftover after parsing attributes in process `syz.1.89'. [ 50.951639][ T6195] syzkaller0: entered promiscuous mode [ 50.951653][ T6195] syzkaller0: entered allmulticast mode [ 50.964536][ T43] audit: type=1326 audit(1792083985.477:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6192 comm="syz.1.92" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 50.964564][ T43] audit: type=1326 audit(1792083985.477:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6192 comm="syz.1.92" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 50.964803][ T43] audit: type=1326 audit(1792083985.477:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6192 comm="syz.1.92" exe="/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf745efec code=0x7ffc0000 [ 50.964989][ T43] audit: type=1326 audit(1792083985.477:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6192 comm="syz.1.92" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 50.965099][ T43] audit: type=1326 audit(1792083985.477:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6192 comm="syz.1.92" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 50.965283][ T43] audit: type=1326 audit(1792083985.477:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6192 comm="syz.1.92" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 50.965372][ T43] audit: type=1326 audit(1792083985.477:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6192 comm="syz.1.92" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 50.965473][ T43] audit: type=1326 audit(1792083985.477:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6192 comm="syz.1.92" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf745efec code=0x7ffc0000 [ 50.965917][ T43] audit: type=1326 audit(1792083985.477:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6192 comm="syz.1.92" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 51.230456][ T6208] syzkaller0: entered promiscuous mode [ 51.230469][ T6208] syzkaller0: entered allmulticast mode [ 51.426071][ T6213] tmpfs: Bad value for 'mpol' [ 51.432588][ T37] IPVS: starting estimator thread 0... [ 51.527858][ T6214] IPVS: using max 43 ests per chain, 103200 per kthread [ 51.889074][ T6238] binder_alloc: 6237: binder_alloc_buf, no vma [ 51.949760][ T6242] IPv6: NLM_F_CREATE should be specified when creating new route [ 51.957715][ T9] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 52.107556][ T9] usb 8-1: Using ep0 maxpacket: 32 [ 52.108010][ T9] usb 8-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 52.108778][ T9] usb 8-1: config 0 has an invalid interface number: 119 but max is 0 [ 52.108791][ T9] usb 8-1: config 0 has no interface number 0 [ 52.108807][ T9] usb 8-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 52.108818][ T9] usb 8-1: config 0 interface 119 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 52.108831][ T9] usb 8-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 52.110305][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 52.110316][ T9] usb 8-1: Product: syz [ 52.110323][ T9] usb 8-1: Manufacturer: syz [ 52.110330][ T9] usb 8-1: SerialNumber: syz [ 52.114315][ T9] usb 8-1: config 0 descriptor?? [ 52.153215][ T9] input: bcm5974 as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.119/input/input7 [ 52.256455][ T6253] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 52.320916][ T6233] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 52.323573][ T6233] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 53.199031][ T6273] syzkaller0: entered promiscuous mode [ 53.199046][ T6273] syzkaller0: entered allmulticast mode [ 53.680099][ T1158] IPVS: starting estimator thread 0... [ 53.779176][ T6295] IPVS: using max 26 ests per chain, 62400 per kthread [ 53.957803][ T6298] syzkaller0: entered promiscuous mode [ 53.957818][ T6298] syzkaller0: entered allmulticast mode [ 54.701265][ T42] usb 8-1: USB disconnect, device number 2 [ 54.961167][ T6323] netlink: 'syz.3.134': attribute type 1 has an invalid length. [ 55.012800][ T6324] netlink: 8 bytes leftover after parsing attributes in process `syz.3.134'. [ 55.302182][ T6327] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 55.337639][ T6327] md: could not open device unknown-block(1,0). [ 55.416965][ T6323] 8021q: adding VLAN 0 to HW filter on device bond1 [ 55.436731][ T6325] bond1: (slave bridge1): making interface the new active one [ 55.441644][ T6325] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 56.644654][ T1038] libceph: connect (1)[c::]:6789 error -101 [ 56.645016][ T1038] libceph: mon0 (1)[c::]:6789 connect error [ 56.692489][ T6357] i801_smbus 0000:00:1f.3: SMBus using PCI interrupt [ 56.714730][ T6357] i2c i2c-1: Memory type 0x07 not supported yet, not instantiating SPD [ 56.790621][ T6352] ceph: No mds server is up or the cluster is laggy [ 56.962257][ T6375] Console: switching to colour dummy device 80x25 [ 57.046139][ T6377] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 57.063462][ T6377] pci 0000:00:01.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 57.063563][ T6377] pci 0000:00:01.0: BAR 2 [mem 0xfeaf4000-0xfeaf4fff] [ 57.063816][ T6377] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 57.064316][ T6377] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 57.084080][ T6377] pci 0000:00:01.0: Adding to iommu group 1 [ 57.091712][ T6377] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 57.091733][ T6377] pci 0000:00:01.0: vgaarb: bridge control possible [ 57.091746][ T6377] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 57.098692][ T6377] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 57.101786][ T6377] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 57.106315][ T6377] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 57.120754][ T6377] [drm] Found bochs VGA, ID 0xb0c5. [ 57.120770][ T6377] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 57.135758][ T6377] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 57.240710][ T6377] Console: switching to colour frame buffer device 160x50 [ 57.257570][ T5828] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 57.284467][ T6377] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 57.288412][ T6381] uhci_hcd 0000:00:1d.0: remove, state 4 [ 57.288473][ T6381] usb usb1: USB disconnect, device number 1 [ 57.314459][ T6381] uhci_hcd 0000:00:1d.0: USB bus 1 deregistered [ 57.391060][ T6383] pci 0000:00:1d.0: [8086:2934] type 00 class 0x0c0300 conventional PCI endpoint [ 57.393816][ T6383] pci 0000:00:1d.0: BAR 4 [io 0xc0e0-0xc0ff] [ 57.400503][ T6383] pci 0000:00:1d.0: Adding to iommu group 7 [ 57.407507][ T6383] pci 0000:00:1d.0: BAR 4 [io 0x2000-0x201f]: assigned [ 57.417501][ T5828] usb 5-1: Using ep0 maxpacket: 16 [ 57.417941][ T5828] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 57.418769][ T5828] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 57.418790][ T5828] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 57.419575][ T5828] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 57.419587][ T5828] usb 5-1: SerialNumber: syz [ 57.457551][ T30] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 57.470634][ T6383] pci 0000:00:1d.0: quirk_usb_early_handoff+0x0/0x1360 took 60498 usecs [ 57.501298][ T6383] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 57.505273][ T6383] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1 [ 57.505489][ T6383] uhci_hcd 0000:00:1d.0: detected 2 ports [ 57.508195][ T6383] uhci_hcd 0000:00:1d.0: irq 16, io port 0x00002000 [ 57.511485][ T6383] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.03 [ 57.513083][ T6383] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 57.513103][ T6383] usb usb1: Product: UHCI Host Controller [ 57.513115][ T6383] usb usb1: Manufacturer: Linux syzkaller uhci_hcd [ 57.513130][ T6383] usb usb1: SerialNumber: 0000:00:1d.0 [ 57.539876][ T6383] hub 1-0:1.0: USB hub found [ 57.541919][ T6383] hub 1-0:1.0: 2 ports detected [ 57.608395][ T30] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 57.608702][ T6386] netlink: 4 bytes leftover after parsing attributes in process `syz.1.153'. [ 57.612006][ T30] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 57.612022][ T30] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 57.612033][ T30] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 57.612051][ T30] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.613319][ T30] usb 7-1: config 0 descriptor?? [ 57.674114][ T5828] cdc_acm 5-1:1.0: skipping garbage [ 57.679718][ T5828] usb 5-1: USB disconnect, device number 2 [ 57.892156][ T6392] netlink: 4 bytes leftover after parsing attributes in process `syz.1.156'. [ 58.032959][ T30] usbhid 7-1:0.0: can't add hid device: -71 [ 58.033049][ T30] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 58.034205][ T30] usb 7-1: USB disconnect, device number 2 [ 58.087521][ T5844] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 58.211779][ T6395] netlink: 12 bytes leftover after parsing attributes in process `syz.0.157'. [ 58.238962][ T5844] usb 8-1: unable to get BOS descriptor or descriptor too short [ 58.238988][ T5844] usb 8-1: New USB device found, idVendor=1a0a, idProduct=0102, bcdDevice=9c.8d [ 58.239860][ T5844] usb 8-1: config 254 has an invalid interface number: 213 but max is 0 [ 58.239873][ T5844] usb 8-1: config 254 has no interface number 0 [ 58.239886][ T5844] usb 8-1: config 254 interface 213 has no altsetting 0 [ 58.241388][ T5844] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 58.241400][ T5844] usb 8-1: Product: syz [ 58.241407][ T5844] usb 8-1: Manufacturer: syz [ 58.241414][ T5844] usb 8-1: SerialNumber: syz [ 58.283272][ T6397] smpboot: CPU 1 is now offline [ 58.313393][ T6397] smpboot: CPU 3 is now offline [ 58.679178][ T5844] usb_ehset_test 8-1:254.213: probe with driver usb_ehset_test failed with error -32 [ 58.685960][ T5844] usb 8-1: USB disconnect, device number 3 [ 59.034475][ T6421] syzkaller0: entered promiscuous mode [ 59.034490][ T6421] syzkaller0: entered allmulticast mode [ 59.035852][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 59.035863][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 59.036074][ T6421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 59.036083][ T6421] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 59.043505][ T6423] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 59.126653][ T6427] netlink: 'syz.2.168': attribute type 13 has an invalid length. [ 59.207377][ T6431] syzkaller0: entered promiscuous mode [ 59.207391][ T6431] syzkaller0: entered allmulticast mode [ 59.215454][ T6431] TC_ACT_REPEAT abuse ? [ 59.500502][ T6440] FAULT_INJECTION: forcing a failure. [ 59.500502][ T6440] name failslab, interval 1, probability 0, space 0, times 0 [ 59.500523][ T6440] CPU: 0 UID: 0 PID: 6440 Comm: syz.1.173 Not tainted syzkaller #0 PREEMPT(full) [ 59.500535][ T6440] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 59.500542][ T6440] Call Trace: [ 59.500546][ T6440] [ 59.500550][ T6440] dump_stack_lvl+0x100/0x190 [ 59.500570][ T6440] should_fail_ex.cold+0x5/0xa [ 59.500585][ T6440] should_failslab+0xc2/0x120 [ 59.500639][ T6440] __kmalloc_cache_noprof+0x91/0x6d0 [ 59.500654][ T6440] ? assoc_array_insert+0x10b/0x32c0 [ 59.500670][ T6440] assoc_array_insert+0x10b/0x32c0 [ 59.500682][ T6440] ? __mutex_lock+0x26c/0x1bd0 [ 59.500712][ T6440] ? __key_link_lock+0x92/0xb0 [ 59.500733][ T6440] ? __pfx___mutex_lock+0x10/0x10 [ 59.500750][ T6440] ? __pfx_assoc_array_insert+0x10/0x10 [ 59.500769][ T6440] ? down_write+0x146/0x1f0 [ 59.500781][ T6440] ? __pfx_down_write+0x10/0x10 [ 59.500796][ T6440] __key_link_begin+0xf5/0x260 [ 59.500814][ T6440] key_instantiate_and_link+0x201/0x4b0 [ 59.500831][ T6440] ? __pfx_key_instantiate_and_link+0x10/0x10 [ 59.500848][ T6440] ? keyctl_get_persistent+0x537/0x940 [ 59.500885][ T6440] keyring_alloc+0x7a/0xc0 [ 59.500904][ T6440] keyctl_get_persistent+0x72b/0x940 [ 59.500922][ T6440] ? __pfx_keyctl_get_persistent+0x10/0x10 [ 59.500937][ T6440] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 59.500951][ T6440] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 59.500974][ T6440] __ia32_compat_sys_keyctl+0x38f/0x550 [ 59.500991][ T6440] __do_fast_syscall_32+0x13a/0x8b0 [ 59.501005][ T6440] do_fast_syscall_32+0x32/0x70 [ 59.501017][ T6440] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 59.501032][ T6440] RIP: 0023:0xf745efec [ 59.501046][ T6440] Code: Unable to access opcode bytes at 0xf745efc2. [ 59.501052][ T6440] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000120 [ 59.501064][ T6440] RAX: ffffffffffffffda RBX: 0000000000000016 RCX: 0000000000000000 [ 59.501071][ T6440] RDX: 0000000015473d9d RSI: 0000000000000000 RDI: 0000000000000000 [ 59.501077][ T6440] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 59.501084][ T6440] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 59.501090][ T6440] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 59.501105][ T6440] [ 60.316565][ T6460] syzkaller0: entered promiscuous mode [ 60.316584][ T6460] syzkaller0: entered allmulticast mode [ 60.567567][ T5739] Bluetooth: hci2: command 0x0406 tx timeout [ 61.008097][ T6456] Set syz1 is full, maxelem 246 reached [ 61.368373][ T25] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 61.372863][ T6468] lo: entered promiscuous mode [ 61.484040][ T6468] tunl0: entered promiscuous mode [ 61.491881][ T6468] gre0: entered promiscuous mode [ 61.508881][ T6468] gretap0: entered promiscuous mode [ 61.513019][ T6468] erspan0: entered promiscuous mode [ 61.516941][ T6468] ip_vti0: entered promiscuous mode [ 61.528812][ T6468] ip6_vti0: entered promiscuous mode [ 61.534733][ T6468] sit0: entered promiscuous mode [ 61.548651][ T6468] ip6tnl0: entered promiscuous mode [ 61.553308][ T6468] ip6gre0: entered promiscuous mode [ 61.569294][ T6468] syz_tun: entered promiscuous mode [ 61.582899][ T6468] ip6gretap0: entered promiscuous mode [ 61.592183][ T6468] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.593187][ T6468] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.603236][ T6468] bridge0: entered promiscuous mode [ 61.615699][ T6468] vcan0: entered promiscuous mode [ 61.620763][ T6468] bond0: entered promiscuous mode [ 61.620775][ T6468] bond_slave_0: entered promiscuous mode [ 61.622023][ T6468] bond_slave_1: entered promiscuous mode [ 61.627299][ T6468] team0: entered promiscuous mode [ 61.627310][ T6468] team_slave_0: entered promiscuous mode [ 61.637675][ T6468] team_slave_1: entered promiscuous mode [ 61.641762][ T6468] dummy0: entered promiscuous mode [ 61.663138][ T6468] nlmon0: entered promiscuous mode [ 61.663969][ T6468] batadv0: entered promiscuous mode [ 61.674728][ T6468] vxcan0: entered promiscuous mode [ 61.675170][ T6468] vxcan1: entered promiscuous mode [ 61.675548][ T6468] veth0: entered promiscuous mode [ 61.686029][ T6468] veth1: entered promiscuous mode [ 61.696509][ T6468] wg0: entered promiscuous mode [ 61.710064][ T6468] wg1: entered promiscuous mode [ 61.714634][ T6468] wg2: entered promiscuous mode [ 61.722968][ T6468] veth0_to_bridge: entered promiscuous mode [ 61.732990][ T6468] veth1_to_bridge: entered promiscuous mode [ 61.740892][ T6468] veth0_to_bond: entered promiscuous mode [ 61.744664][ T6468] veth1_to_bond: entered promiscuous mode [ 61.758547][ T6468] veth0_to_team: entered promiscuous mode [ 61.772020][ T6468] veth1_to_team: entered promiscuous mode [ 61.783994][ T6468] veth0_to_batadv: entered promiscuous mode [ 61.790322][ T6468] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 61.790365][ T6468] batadv_slave_0: entered promiscuous mode [ 61.799022][ T6468] veth1_to_batadv: entered promiscuous mode [ 61.802464][ T6468] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 61.802524][ T6468] batadv_slave_1: entered promiscuous mode [ 61.808381][ T6468] xfrm0: entered promiscuous mode [ 61.811167][ T6468] veth0_to_hsr: entered promiscuous mode [ 61.822007][ T6468] veth1_to_hsr: entered promiscuous mode [ 61.832926][ T6468] hsr0: entered promiscuous mode [ 61.835068][ T6468] veth1_virt_wifi: entered promiscuous mode [ 61.836809][ T6468] veth0_virt_wifi: entered promiscuous mode [ 61.848101][ T6468] virt_wifi0: entered promiscuous mode [ 61.863259][ T6468] vlan0: entered promiscuous mode [ 61.865379][ T6468] vlan1: entered promiscuous mode [ 61.873095][ T6468] macvlan0: entered promiscuous mode [ 61.875974][ T6468] macvlan1: entered promiscuous mode [ 61.880614][ T6468] ipvlan0: entered promiscuous mode [ 61.880832][ T6468] ipvlan1: entered promiscuous mode [ 61.893057][ T6468] macvtap0: entered promiscuous mode [ 61.895396][ T6468] macsec0: entered promiscuous mode [ 61.900865][ T6468] geneve0: entered promiscuous mode [ 61.903274][ T6468] geneve1: entered promiscuous mode [ 61.912788][ T6468] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 61.930710][ T6468] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 61.936077][ T6468] netdevsim netdevsim3 netdevsim2: entered promiscuous mode [ 61.943093][ T6468] netdevsim netdevsim3 netdevsim3: entered promiscuous mode [ 61.960734][ T6468] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 61.972462][ T6468] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 61.975616][ T6468] bond1: entered promiscuous mode [ 61.975628][ T6468] bridge1: entered promiscuous mode [ 61.980524][ T6468] vlan2: entered promiscuous mode [ 62.042793][ T6483] syzkaller0: entered promiscuous mode [ 62.042809][ T6483] syzkaller0: entered allmulticast mode [ 62.092241][ T6516] faux_driver vgem: [drm] Unknown color mode 6; guessing buffer size. [ 63.127757][ T12] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.127797][ T12] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.127826][ T12] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.127854][ T12] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.324228][ T6550] syzkaller0: entered promiscuous mode [ 63.324247][ T6550] syzkaller0: entered allmulticast mode [ 63.333998][ T6550] tipc: Enabled bearer , priority 0 [ 63.341031][ T6549] tipc: Resetting bearer [ 63.386589][ T6549] tipc: Disabling bearer [ 63.389714][ T43] kauditd_printk_skb: 4 callbacks suppressed [ 63.389723][ T43] audit: type=1326 audit(2000000011.050:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6546 comm="syz.0.195" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf748efec code=0x0 [ 63.445112][ T6554] kvm [6546]: vcpu0, guest rIP: 0x1a2 Unhandled WRMSR(0x11e) = 0xffff0ff0000f0006 [ 63.525104][ T6559] syzkaller0: entered promiscuous mode [ 63.525119][ T6559] syzkaller0: entered allmulticast mode [ 63.579361][ T13] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 63.586147][ T6564] Driver unsupported XDP return value 0 on prog (id 18) dev N/A, expect packet loss! [ 63.614463][ T6560] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 63.679080][ T6567] syzkaller0: entered promiscuous mode [ 63.679094][ T6567] syzkaller0: entered allmulticast mode [ 63.717509][ T3376] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 63.731074][ T6569] syzkaller0: entered promiscuous mode [ 63.731087][ T6569] syzkaller0: entered allmulticast mode [ 63.733611][ T6569] TC_ACT_REPEAT abuse ? [ 63.826446][ T66] Bluetooth: hci3: ISO packet for unknown connection handle 0 [ 63.831039][ T66] Bluetooth: Unexpected continuation frame (len 22) [ 63.888053][ T3376] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 63.888974][ T3376] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 63.888995][ T3376] usb 8-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 63.891085][ T3376] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 63.891110][ T3376] usb 8-1: Product: syz [ 63.891123][ T3376] usb 8-1: Manufacturer: syz [ 63.891136][ T3376] usb 8-1: SerialNumber: syz [ 63.900844][ T3376] cdc_mbim 8-1:1.0: skipping garbage [ 63.964696][ T1158] Bluetooth: hci4: Frame reassembly failed (-84) [ 63.964870][ T1158] Bluetooth: hci4: Frame reassembly failed (-84) [ 64.103575][ T6558] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 64.235858][ T13] bond0: (slave bond_slave_0): interface is now down [ 64.235874][ T13] bond0: (slave bond_slave_1): interface is now down [ 64.300145][ T13] nci: nci_rx_work: unknown MT 0x1 [ 64.709476][ T6558] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 64.710397][ T3376] cdc_mbim 8-1:1.0: setting tx_max = 16384 [ 64.732620][ T3376] cdc_mbim 8-1:1.0: cdc-wdm0: USB WDM device [ 64.757367][ T3376] wwan wwan0: port wwan0mbim0 attached [ 64.797873][ T3376] cdc_mbim 8-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, 7e:d3:8a:de:b4:bd [ 64.916739][ T6558] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.916971][ T6558] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 64.920143][ T3376] usb 8-1: USB disconnect, device number 4 [ 64.921366][ T3376] cdc_mbim 8-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 64.963990][ T3376] wwan wwan0: port wwan0mbim0 disconnected [ 65.561865][ T6597] i801_smbus 0000:00:1f.3: SMBus using PCI interrupt [ 65.565602][ T6597] FAULT_INJECTION: forcing a failure. [ 65.565602][ T6597] name failslab, interval 1, probability 0, space 0, times 0 [ 65.565621][ T6597] CPU: 0 UID: 0 PID: 6597 Comm: syz.3.209 Not tainted syzkaller #0 PREEMPT(full) [ 65.565635][ T6597] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 65.565642][ T6597] Call Trace: [ 65.565646][ T6597] [ 65.565651][ T6597] dump_stack_lvl+0x100/0x190 [ 65.565671][ T6597] should_fail_ex.cold+0x5/0xa [ 65.565686][ T6597] should_failslab+0xc2/0x120 [ 65.565706][ T6597] kmem_cache_alloc_noprof+0x92/0x6a0 [ 65.565722][ T6597] ? acpi_ut_allocate_object_desc_dbg+0x86/0x240 [ 65.565741][ T6597] acpi_ut_allocate_object_desc_dbg+0x86/0x240 [ 65.565757][ T6597] acpi_ut_create_internal_object_dbg+0x51/0x260 [ 65.565775][ T6597] acpi_ut_create_integer_object+0x46/0xe0 [ 65.565790][ T6597] acpi_ps_execute_method+0x582/0xe90 [ 65.565811][ T6597] acpi_ns_evaluate+0x640/0x1670 [ 65.565826][ T6597] acpi_evaluate_object+0x420/0xe00 [ 65.565840][ T6597] ? is_bpf_text_address+0x8a/0x1a0 [ 65.565858][ T6597] ? bpf_ksym_find+0x124/0x1c0 [ 65.565873][ T6597] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 65.565890][ T6597] ? __pfx_acpi_evaluate_object+0x10/0x10 [ 65.565905][ T6597] ? kernel_text_address+0x8d/0x100 [ 65.565920][ T6597] ? __kernel_text_address+0xd/0x30 [ 65.565937][ T6597] acpi_evaluate_integer+0xdf/0x220 [ 65.565950][ T6597] ? __pfx_acpi_evaluate_integer+0x10/0x10 [ 65.565970][ T6597] acpi_bus_get_status+0x1a1/0x430 [ 65.565983][ T6597] ? __pfx_acpi_bus_get_status+0x10/0x10 [ 65.565995][ T6597] ? mark_held_locks+0x40/0x70 [ 65.566012][ T6597] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 65.566029][ T6597] ? lockdep_hardirqs_on+0x7d/0x110 [ 65.566049][ T6597] i2c_acpi_do_lookup+0x9b/0x280 [ 65.566064][ T6597] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 65.566080][ T6597] ? __pfx_i2c_acpi_do_lookup+0x10/0x10 [ 65.566115][ T6597] ? acpi_ut_track_stack_ptr+0x114/0x180 [ 65.566137][ T6597] i2c_acpi_get_info+0x115/0x360 [ 65.566153][ T6597] ? __pfx_i2c_acpi_get_info+0x10/0x10 [ 65.566171][ T6597] ? __pfx_acpi_fetch_acpi_dev+0x10/0x10 [ 65.566188][ T6597] ? mark_held_locks+0x40/0x70 [ 65.566207][ T6597] i2c_acpi_add_device+0xb5/0x200 [ 65.566223][ T6597] ? __pfx_i2c_acpi_add_device+0x10/0x10 [ 65.566238][ T6597] ? __pfx_up+0x10/0x10 [ 65.566248][ T6597] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 65.566269][ T6597] ? acpi_os_signal_semaphore+0x11e/0x1a0 [ 65.566289][ T6597] acpi_ns_walk_namespace+0x4cc/0x760 [ 65.566304][ T6597] ? __pfx_i2c_acpi_add_device+0x10/0x10 [ 65.566320][ T6597] ? __pfx_i2c_acpi_add_device+0x10/0x10 [ 65.566336][ T6597] acpi_walk_namespace+0xff/0x1d0 [ 65.566353][ T6597] i2c_acpi_register_devices+0x82/0x160 [ 65.566369][ T6597] i2c_register_adapter+0x8c0/0x13f0 [ 65.566381][ T6597] ? of_alias_get_id+0xb1/0x110 [ 65.566398][ T6597] i801_probe.cold+0x30c/0x84e [ 65.566412][ T6597] ? __pfx_i801_probe+0x10/0x10 [ 65.566428][ T6597] ? mark_held_locks+0x40/0x70 [ 65.566448][ T6597] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 65.566465][ T6597] ? lockdep_hardirqs_on+0x7d/0x110 [ 65.566483][ T6597] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 65.566527][ T6597] ? __pfx_i801_probe+0x10/0x10 [ 65.566540][ T6597] local_pci_probe+0xdd/0x1b0 [ 65.566564][ T6597] pci_call_probe+0x176/0x800 [ 65.566582][ T6597] ? pci_match_device+0x147/0x7d0 [ 65.566599][ T6597] ? __pfx_pci_call_probe+0x10/0x10 [ 65.566621][ T6597] ? __pfx_pci_match_device+0x10/0x10 [ 65.566637][ T6597] ? pci_find_host_bridge+0x3c/0x80 [ 65.566658][ T6597] ? up_write+0x2dc/0x5b0 [ 65.566674][ T6597] pci_device_probe+0x25b/0x400 [ 65.566693][ T6597] ? __pfx_pci_device_probe+0x10/0x10 [ 65.566711][ T6597] ? kernfs_create_link+0x1bd/0x240 [ 65.566729][ T6597] ? sysfs_create_link+0x68/0xc0 [ 65.566746][ T6597] ? __pfx_pci_device_probe+0x10/0x10 [ 65.566764][ T6597] really_probe+0x241/0xa60 [ 65.566779][ T6597] __driver_probe_device+0x210/0x460 [ 65.566794][ T6597] device_driver_attach+0xd1/0x220 [ 65.566808][ T6597] bind_store+0xf4/0x190 [ 65.566824][ T6597] ? __pfx_bind_store+0x10/0x10 [ 65.566842][ T6597] drv_attr_store+0x74/0xb0 [ 65.566858][ T6597] ? __pfx_drv_attr_store+0x10/0x10 [ 65.566874][ T6597] sysfs_kf_write+0xf2/0x150 [ 65.566890][ T6597] kernfs_fop_write_iter+0x3e0/0x5f0 [ 65.566903][ T6597] ? __pfx_sysfs_kf_write+0x10/0x10 [ 65.566919][ T6597] vfs_write+0x6af/0x1050 [ 65.566934][ T6597] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 65.566949][ T6597] ? __pfx_vfs_write+0x10/0x10 [ 65.566962][ T6597] ? find_held_lock+0x2b/0x80 [ 65.566986][ T6597] ksys_write+0x12a/0x250 [ 65.567000][ T6597] ? __pfx_ksys_write+0x10/0x10 [ 65.567019][ T6597] __do_fast_syscall_32+0x13a/0x8b0 [ 65.567033][ T6597] do_fast_syscall_32+0x32/0x70 [ 65.567045][ T6597] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 65.567060][ T6597] RIP: 0023:0xf746efec [ 65.567073][ T6597] Code: Unable to access opcode bytes at 0xf746efc2. [ 65.567078][ T6597] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 65.567089][ T6597] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000740 [ 65.567096][ T6597] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 65.567103][ T6597] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 65.567109][ T6597] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 65.567115][ T6597] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 65.567131][ T6597] [ 65.572082][ T6597] ACPI Error: Could not allocate an object descriptor (20260408/utobject-180) [ 65.572102][ T6597] ACPI Error: ffff888014f25000 walk still has a scope list (20260408/dswstate-694) [ 65.579113][ T6597] i2c i2c-1: Memory type 0x07 not supported yet, not instantiating SPD [ 66.007599][ T5739] Bluetooth: hci4: command 0x1003 tx timeout [ 66.009559][ T66] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 66.592399][ T6607] syzkaller0: entered promiscuous mode [ 66.592420][ T6607] syzkaller0: entered allmulticast mode [ 66.661336][ T6605] FAULT_INJECTION: forcing a failure. [ 66.661336][ T6605] name fail_futex, interval 1, probability 0, space 0, times 0 [ 66.661369][ T6605] CPU: 0 UID: 0 PID: 6605 Comm: syz.3.212 Not tainted syzkaller #0 PREEMPT(full) [ 66.661390][ T6605] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 66.661400][ T6605] Call Trace: [ 66.661407][ T6605] [ 66.661415][ T6605] dump_stack_lvl+0x100/0x190 [ 66.661446][ T6605] should_fail_ex.cold+0x5/0xa [ 66.661470][ T6605] get_futex_key+0x293/0x14f0 [ 66.661493][ T6605] ? __pfx_get_futex_key+0x10/0x10 [ 66.661514][ T6605] ? __mutex_unlock_slowpath+0x35d/0x930 [ 66.661539][ T6605] futex_wake+0xf4/0x5e0 [ 66.661567][ T6605] ? __pfx_futex_wake+0x10/0x10 [ 66.661596][ T6605] ? detach_task_ctx_data+0x83/0x490 [ 66.661621][ T6605] do_futex+0x2b2/0x440 [ 66.661643][ T6605] ? __pfx_do_futex+0x10/0x10 [ 66.661661][ T6605] ? __might_fault+0xc5/0x140 [ 66.661688][ T6605] mm_exit_exec_release+0x256/0x2f0 [ 66.661710][ T6605] do_exit+0x707/0x2a50 [ 66.661735][ T6605] ? __pfx_do_exit+0x10/0x10 [ 66.661755][ T6605] ? do_raw_spin_lock+0x128/0x260 [ 66.661774][ T6605] ? find_held_lock+0x2b/0x80 [ 66.661795][ T6605] ? get_signal+0x7e0/0x21e0 [ 66.661814][ T6605] do_group_exit+0xd5/0x2a0 [ 66.661838][ T6605] get_signal+0x1ec7/0x21e0 [ 66.661864][ T6605] ? __pfx_get_signal+0x10/0x10 [ 66.661883][ T6605] ? do_futex+0x190/0x440 [ 66.661905][ T6605] arch_do_signal_or_restart+0x91/0x7a0 [ 66.661933][ T6605] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 66.661965][ T6605] ? xfd_validate_state+0x129/0x190 [ 66.661998][ T6605] exit_to_user_mode_loop+0x139/0x700 [ 66.662018][ T6605] ? rcu_is_watching+0x13/0xc0 [ 66.662041][ T6605] __do_fast_syscall_32+0x59f/0x8b0 [ 66.662064][ T6605] do_fast_syscall_32+0x32/0x70 [ 66.662083][ T6605] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 66.662105][ T6605] RIP: 0023:0xf746efec [ 66.662125][ T6605] Code: Unable to access opcode bytes at 0xf746efc2. [ 66.662133][ T6605] RSP: 002b:00000000f54655bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 66.662151][ T6605] RAX: fffffffffffffe00 RBX: 00000000f7495020 RCX: 0000000000000080 [ 66.662163][ T6605] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7495024 [ 66.662173][ T6605] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 66.662183][ T6605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 66.662194][ T6605] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 66.662219][ T6605] [ 66.741079][ T13] bond0: (slave bond_slave_0): interface is now down [ 66.741094][ T13] bond0: (slave bond_slave_1): interface is now down [ 66.744598][ T13] bond0: now running without any active interface! [ 67.052644][ T1434] ieee802154 phy0 wpan0: encryption failed: -22 [ 67.052711][ T1434] ieee802154 phy1 wpan1: encryption failed: -22 [ 67.223862][ T6580] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 67.437256][ T6620] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 67.513552][ T6626] lo speed is unknown, defaulting to 1000 [ 67.520192][ T6626] lo speed is unknown, defaulting to 1000 [ 67.522733][ T6626] lo speed is unknown, defaulting to 1000 [ 67.678068][ T6503] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 67.762729][ T6637] syzkaller0: entered promiscuous mode [ 67.762749][ T6637] syzkaller0: entered allmulticast mode [ 67.781619][ T6637] tipc: Enabled bearer , priority 0 [ 67.786753][ T6636] tipc: Resetting bearer [ 67.821280][ T6636] tipc: Disabling bearer [ 67.829682][ T6503] usb 8-1: New USB device found, idVendor=06cd, idProduct=0107, bcdDevice= 1.00 [ 67.830719][ T6503] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 67.832850][ T6503] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.832869][ T6503] usb 8-1: Product: syz [ 67.832881][ T6503] usb 8-1: Manufacturer: syz [ 67.832893][ T6503] usb 8-1: SerialNumber: syz [ 67.875672][ T6503] keyspan 8-1:1.0: Keyspan 1 port adapter converter detected [ 67.888859][ T6503] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 84 [ 67.913064][ T6503] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 81 [ 67.913136][ T6503] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 82 [ 67.913194][ T6503] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 1 [ 67.913257][ T6503] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 2 [ 67.913318][ T6503] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 83 [ 67.913377][ T6503] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 3 [ 67.923569][ T6503] usb 8-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 67.941260][ T6626] infiniband syz0: set active [ 67.941293][ T25] lo speed is unknown, defaulting to 1000 [ 67.941325][ T6626] infiniband syz0: added lo [ 67.968663][ T6626] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 67.968686][ T6626] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 67.968708][ T6626] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 68.047892][ T6645] syzkaller0: entered promiscuous mode [ 68.047906][ T6645] syzkaller0: entered allmulticast mode [ 68.053298][ T6626] RDS/IB: syz0: added [ 68.053342][ T6626] smc: adding ib device syz0 with port count 1 [ 68.053357][ T6626] smc: ib device syz0 port 1 has no pnetid [ 68.053417][ T6503] lo speed is unknown, defaulting to 1000 [ 68.056605][ T6626] lo speed is unknown, defaulting to 1000 [ 68.225032][ T6648] netlink: 'syz.2.222': attribute type 1 has an invalid length. [ 68.283735][ T6650] netlink: 8 bytes leftover after parsing attributes in process `syz.2.222'. [ 68.286622][ T6648] 8021q: adding VLAN 0 to HW filter on device bond1 [ 68.287162][ T6626] lo speed is unknown, defaulting to 1000 [ 68.312748][ T25] usb 8-1: USB disconnect, device number 5 [ 68.341022][ T25] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 68.341438][ T25] keyspan 8-1:1.0: device disconnected [ 68.396325][ T6648] bond1: (slave bridge1): making interface the new active one [ 68.400694][ T6648] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 68.609173][ T6657] netlink: 'syz.1.224': attribute type 1 has an invalid length. [ 68.626839][ T6657] 8021q: adding VLAN 0 to HW filter on device bond1 [ 68.627398][ T6626] lo speed is unknown, defaulting to 1000 [ 68.646136][ T6657] bond1: (slave dummy0): making interface the new active one [ 68.648970][ T6657] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 68.752929][ T6660] syzkaller0: entered promiscuous mode [ 68.752943][ T6660] syzkaller0: entered allmulticast mode [ 68.835833][ T6626] lo speed is unknown, defaulting to 1000 [ 68.917330][ T43] audit: type=1326 audit(2000000016.579:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6663 comm="syz.1.229" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 68.917359][ T43] audit: type=1326 audit(2000000016.579:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6663 comm="syz.1.229" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 68.937213][ T43] audit: type=1326 audit(2000000016.609:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6663 comm="syz.1.229" exe="/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf745efec code=0x7ffc0000 [ 68.937246][ T43] audit: type=1326 audit(2000000016.609:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6663 comm="syz.1.229" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 68.937344][ T43] audit: type=1326 audit(2000000016.609:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6663 comm="syz.1.229" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf745efec code=0x7ffc0000 [ 68.994445][ T43] audit: type=1326 audit(2000000016.659:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6662 comm="syz.3.228" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746efec code=0x7ffc0000 [ 68.995616][ T43] audit: type=1326 audit(2000000016.659:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6662 comm="syz.3.228" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746efec code=0x7ffc0000 [ 68.996324][ T43] audit: type=1326 audit(2000000016.659:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6662 comm="syz.3.228" exe="/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf746efec code=0x7ffc0000 [ 68.998532][ T43] audit: type=1326 audit(2000000016.669:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6662 comm="syz.3.228" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746efec code=0x7ffc0000 [ 68.998706][ T43] audit: type=1326 audit(2000000016.669:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6662 comm="syz.3.228" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746efec code=0x7ffc0000 [ 69.066713][ T6664] kvm [6662]: vcpu0, guest rIP: 0x1a3 Unhandled WRMSR(0x11e) = 0xbe70a111 [ 69.245260][ T6669] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 69.245982][ T6669] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 69.463114][ T6681] netlink: 8 bytes leftover after parsing attributes in process `syz.2.232'. [ 69.463137][ T6681] netlink: 8 bytes leftover after parsing attributes in process `syz.2.232'. [ 69.531151][ T6676] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.531536][ T6676] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.590908][ T6680] netlink: 4 bytes leftover after parsing attributes in process `syz.0.234'. [ 69.616396][ T6680] netlink: 104 bytes leftover after parsing attributes in process `syz.0.234'. [ 69.616413][ T6680] netlink: 104 bytes leftover after parsing attributes in process `syz.0.234'. [ 69.837254][ T6676] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 69.842354][ T6676] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 70.004203][ T6689] syzkaller0: entered promiscuous mode [ 70.004225][ T6689] syzkaller0: entered allmulticast mode [ 70.108066][ T5813] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.108115][ T5813] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.108145][ T5813] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.108172][ T5813] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.273255][ T6711] netlink: 4 bytes leftover after parsing attributes in process `syz.3.240'. [ 70.903723][ T35] cfg80211: failed to load regulatory.db [ 70.939278][ T6723] Bluetooth: MGMT ver 1.23 [ 70.989510][ T5739] Bluetooth: hci2: unexpected event for opcode 0x0000 [ 71.077060][ T6729] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 71.159309][ T6731] ntfs3(sr0): Primary boot signature is not NTFS. [ 71.159650][ T6731] ntfs3(sr0): try to read out of volume at offset 0xf800 [ 71.190669][ T6734] syzkaller0: entered promiscuous mode [ 71.190688][ T6734] syzkaller0: entered allmulticast mode [ 72.400242][ T6759] syz.0.254 invoked oom-killer: gfp_mask=0x400cc0(GFP_KERNEL_ACCOUNT), order=1, oom_score_adj=1000 [ 72.400269][ T6759] CPU: 0 UID: 0 PID: 6759 Comm: syz.0.254 Not tainted syzkaller #0 PREEMPT(full) [ 72.400294][ T6759] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 72.400304][ T6759] Call Trace: [ 72.400309][ T6759] [ 72.400314][ T6759] dump_stack_lvl+0x100/0x190 [ 72.400335][ T6759] dump_header+0xfb/0x606 [ 72.400349][ T6759] oom_kill_process.cold+0xd/0x380 [ 72.400364][ T6759] out_of_memory+0x340/0x14f0 [ 72.400386][ T6759] ? __pfx_out_of_memory+0x10/0x10 [ 72.400409][ T6759] mem_cgroup_out_of_memory+0xc6/0x130 [ 72.400427][ T6759] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 72.400442][ T6759] ? find_held_lock+0x2b/0x80 [ 72.400459][ T6759] ? do_raw_spin_unlock+0x145/0x1e0 [ 72.400472][ T6759] ? _raw_spin_unlock+0x28/0x50 [ 72.400489][ T6759] try_charge_memcg+0x783/0xf60 [ 72.400506][ T6759] ? __pfx_try_charge_memcg+0x10/0x10 [ 72.400518][ T6759] ? find_held_lock+0x2b/0x80 [ 72.400531][ T6759] ? rcu_read_unlock+0x17/0x60 [ 72.400543][ T6759] ? rcu_read_unlock+0x17/0x60 [ 72.400561][ T6759] obj_cgroup_charge_pages+0x2b/0x1f0 [ 72.400575][ T6759] __memcg_slab_post_alloc_hook+0x47f/0x10c0 [ 72.400594][ T6759] ? kasan_unpoison+0x27/0x60 [ 72.400610][ T6759] __kmalloc_node_track_caller_noprof+0x66a/0x870 [ 72.400629][ T6759] ? __devinet_sysctl_register+0xbc/0x360 [ 72.400649][ T6759] kmemdup_noprof+0x29/0x60 [ 72.400662][ T6759] __devinet_sysctl_register+0xbc/0x360 [ 72.400679][ T6759] ? __pfx_neigh_sysctl_register+0x10/0x10 [ 72.400693][ T6759] ? inetdev_init+0x245/0x570 [ 72.400708][ T6759] ? __pfx___devinet_sysctl_register+0x10/0x10 [ 72.400725][ T6759] ? netlink_rcv_skb+0x159/0x420 [ 72.400737][ T6759] ? netlink_unicast+0x65f/0x950 [ 72.400747][ T6759] ? netlink_sendmsg+0x8b0/0xda0 [ 72.400758][ T6759] ? ____sys_sendmsg+0xa4d/0xbe0 [ 72.400775][ T6759] ? ___sys_sendmsg+0x190/0x1e0 [ 72.400792][ T6759] ? __sys_sendmsg+0x160/0x210 [ 72.400805][ T6759] ? __do_fast_syscall_32+0x13a/0x8b0 [ 72.400819][ T6759] devinet_sysctl_register+0x17b/0x210 [ 72.400839][ T6759] inetdev_init+0x2b8/0x570 [ 72.400856][ T6759] inetdev_event+0x827/0x17f0 [ 72.400873][ T6759] ? ib_netdevice_event+0xfc/0x330 [ 72.400888][ T6759] ? __pfx_inetdev_event+0x10/0x10 [ 72.400905][ T6759] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 72.400927][ T6759] notifier_call_chain+0x99/0x3f0 [ 72.400944][ T6759] call_netdevice_notifiers_info+0xbe/0x110 [ 72.400963][ T6759] register_netdevice+0x1998/0x25a0 [ 72.400982][ T6759] ? __pfx_register_netdevice+0x10/0x10 [ 72.400997][ T6759] ? net_generic+0xea/0x2a0 [ 72.401019][ T6759] ip6_tnl_create2+0x80/0x160 [ 72.401031][ T6759] ip6_tnl_newlink+0x22d/0x450 [ 72.401043][ T6759] ? __pfx_ip6_tnl_newlink+0x10/0x10 [ 72.401055][ T6759] ? rtnl_create_link+0xa4b/0xf80 [ 72.401071][ T6759] ? __pfx_ip6_tnl_newlink+0x10/0x10 [ 72.401082][ T6759] rtnl_newlink+0x1697/0x2620 [ 72.401102][ T6759] ? __pfx_rtnl_newlink+0x10/0x10 [ 72.401119][ T6759] ? rcu_is_watching+0x13/0xc0 [ 72.401149][ T6759] ? find_held_lock+0x2b/0x80 [ 72.401166][ T6759] ? lock_acquire+0x1d1/0x380 [ 72.401184][ T6759] ? rtnetlink_rcv_msg+0x1f6/0xe90 [ 72.401200][ T6759] ? find_held_lock+0x2b/0x80 [ 72.401213][ T6759] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 72.401228][ T6759] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 72.401246][ T6759] ? __pfx_rtnl_newlink+0x10/0x10 [ 72.401262][ T6759] rtnetlink_rcv_msg+0x95e/0xe90 [ 72.401279][ T6759] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 72.401299][ T6759] ? ref_tracker_free+0x37e/0x6c0 [ 72.401317][ T6759] netlink_rcv_skb+0x159/0x420 [ 72.401329][ T6759] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 72.401345][ T6759] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 72.401363][ T6759] ? netlink_deliver_tap+0x1ae/0xcc0 [ 72.401377][ T6759] netlink_unicast+0x65f/0x950 [ 72.401391][ T6759] ? __pfx_netlink_unicast+0x10/0x10 [ 72.401408][ T6759] netlink_sendmsg+0x8b0/0xda0 [ 72.401423][ T6759] ? __pfx_netlink_sendmsg+0x10/0x10 [ 72.401437][ T6759] ? apparmor_socket_sendmsg+0x165/0x280 [ 72.401452][ T6759] ____sys_sendmsg+0xa4d/0xbe0 [ 72.401468][ T6759] ? __pfx_netlink_sendmsg+0x10/0x10 [ 72.401482][ T6759] ? __pfx_____sys_sendmsg+0x10/0x10 [ 72.401502][ T6759] ? plist_check_list+0x1b8/0x280 [ 72.401516][ T6759] ? plist_del+0x308/0x510 [ 72.401611][ T6759] ___sys_sendmsg+0x190/0x1e0 [ 72.401633][ T6759] ? __pfx____sys_sendmsg+0x10/0x10 [ 72.401651][ T6759] ? futex_wake+0x220/0x5e0 [ 72.401673][ T6759] ? find_held_lock+0x2b/0x80 [ 72.401698][ T6759] __sys_sendmsg+0x160/0x210 [ 72.401713][ T6759] ? __pfx___sys_sendmsg+0x10/0x10 [ 72.401736][ T6759] __do_fast_syscall_32+0x13a/0x8b0 [ 72.401752][ T6759] do_fast_syscall_32+0x32/0x70 [ 72.401764][ T6759] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 72.401779][ T6759] RIP: 0023:0xf748efec [ 72.401793][ T6759] Code: Unable to access opcode bytes at 0xf748efc2. [ 72.401798][ T6759] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 72.401810][ T6759] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000080 [ 72.401818][ T6759] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 72.401825][ T6759] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 72.401832][ T6759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 72.401839][ T6759] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 72.401855][ T6759] [ 72.537057][ T6759] memory: usage 92kB, limit 96kB, failcnt 30 [ 72.537071][ T6759] memory+swap: usage 92kB, limit 9007199254740988kB, failcnt 0 [ 72.537081][ T6759] kmem: usage 92kB, limit 9007199254740988kB, failcnt 0 [ 72.537088][ T6759] Memory cgroup stats for /syz0/test: [ 72.537285][ T6759] cache 0 [ 72.537291][ T6759] rss 0 [ 72.537295][ T6759] rss_huge 0 [ 72.537299][ T6759] shmem 0 [ 72.537303][ T6759] mapped_file 0 [ 72.537308][ T6759] dirty 0 [ 72.537312][ T6759] writeback 0 [ 72.537317][ T6759] workingset_refault_anon 0 [ 72.540978][ T6759] workingset_refault_file 0 [ 72.540987][ T6759] swap 0 [ 72.540992][ T6759] swapcached 0 [ 72.540997][ T6759] pgpgin 0 [ 72.541002][ T6759] pgpgout 0 [ 72.541008][ T6759] pgfault 0 [ 72.541014][ T6759] pgmajfault 0 [ 72.541020][ T6759] inactive_anon 0 [ 72.541026][ T6759] active_anon 0 [ 72.541032][ T6759] inactive_file 0 [ 72.541038][ T6759] active_file 0 [ 72.541044][ T6759] unevictable 0 [ 72.541051][ T6759] hierarchical_memory_limit 98304 [ 72.541058][ T6759] hierarchical_memsw_limit 9223372036854771712 [ 72.541065][ T6759] total_cache 0 [ 72.541071][ T6759] total_rss 0 [ 72.541077][ T6759] total_rss_huge 0 [ 72.541082][ T6759] total_shmem 0 [ 72.541086][ T6759] total_mapped_file 0 [ 72.541090][ T6759] total_dirty 0 [ 72.541094][ T6759] total_writeback 0 [ 72.541098][ T6759] total_workingset_refault_anon 0 [ 72.541102][ T6759] total_workingset_refault_file 0 [ 72.541106][ T6759] total_swap 0 [ 72.541110][ T6759] total_swapcached 0 [ 72.541114][ T6759] total_pgpgin 0 [ 72.541118][ T6759] total_pgpgout 0 [ 72.541122][ T6759] total_pgfault 0 [ 72.541126][ T6759] total_pgmajfault 0 [ 72.541129][ T6759] total_inactive_anon 0 [ 72.541133][ T6759] total_active_anon 0 [ 72.541137][ T6759] total_inactive_file 0 [ 72.541141][ T6759] total_active_file 0 [ 72.541145][ T6759] total_unevictable 0 [ 72.541149][ T6759] anon_cost 0 [ 72.541153][ T6759] file_cost 0 [ 72.541157][ T6759] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.254,pid=6758,uid=0 [ 72.541503][ T6759] Memory cgroup out of memory: Killed process 6758 (syz.0.254) total-vm:104084kB, anon-rss:276kB, file-rss:23732kB, shmem-rss:0kB, UID:0 pgtables:112kB oom_score_adj:1000 [ 72.560393][ T6760] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 72.773827][ T6765] netlink: 28 bytes leftover after parsing attributes in process `syz.3.257'. [ 72.773842][ T6765] netlink: 28 bytes leftover after parsing attributes in process `syz.3.257'. [ 72.809907][ T6764] syzkaller0: entered promiscuous mode [ 72.809922][ T6764] syzkaller0: entered allmulticast mode [ 72.829805][ T6764] tipc: Started in network mode [ 72.829823][ T6764] tipc: Node identity 7e22290c9765, cluster identity 4711 [ 72.829952][ T6764] tipc: Enabled bearer , priority 0 [ 72.835500][ T6762] tipc: Resetting bearer [ 72.874477][ T6762] tipc: Disabling bearer [ 72.968980][ T5739] Bluetooth: hci0: command 0x0c1a tx timeout [ 72.969035][ T66] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 73.051766][ T6767] syzkaller0: entered promiscuous mode [ 73.051780][ T6767] syzkaller0: entered allmulticast mode [ 74.177813][ T6503] lo speed is unknown, defaulting to 1000 [ 75.050473][ T66] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 75.050537][ T66] Bluetooth: hci2: Injecting HCI hardware error event [ 75.051896][ T5739] Bluetooth: hci2: hardware error 0x00 [ 75.229569][ T6800] syzkaller0: entered promiscuous mode [ 75.229583][ T6800] syzkaller0: entered allmulticast mode [ 77.008396][ T43] kauditd_printk_skb: 24 callbacks suppressed [ 77.008409][ T43] audit: type=1326 audit(2000000024.669:93): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6826 comm="syz.0.278" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 77.008520][ T43] audit: type=1326 audit(2000000024.679:94): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6826 comm="syz.0.278" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 77.012604][ T43] audit: type=1326 audit(2000000024.679:95): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6826 comm="syz.0.278" exe="/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf748efec code=0x7ffc0000 [ 77.012634][ T43] audit: type=1326 audit(2000000024.679:96): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6826 comm="syz.0.278" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 77.012653][ T43] audit: type=1326 audit(2000000024.679:97): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6826 comm="syz.0.278" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 77.015902][ T43] audit: type=1326 audit(2000000024.679:98): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6826 comm="syz.0.278" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 77.015926][ T43] audit: type=1326 audit(2000000024.679:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6826 comm="syz.0.278" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 77.033927][ T43] audit: type=1326 audit(2000000024.679:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6826 comm="syz.0.278" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf748efec code=0x7ffc0000 [ 77.033955][ T43] audit: type=1326 audit(2000000024.679:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6826 comm="syz.0.278" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 77.048882][ T43] audit: type=1326 audit(2000000024.679:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6826 comm="syz.0.278" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efec code=0x7ffc0000 [ 77.120058][ T6812] fuse: fd is not a fuse device [ 77.128681][ T5739] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 77.131851][ T6827] kvm [6826]: vcpu0, guest rIP: 0x1a3 Unhandled WRMSR(0xc2) = 0x8000 [ 77.182162][ T6827] kvm [6826]: vcpu0, guest rIP: 0x1a3 Unhandled WRMSR(0xc2) = 0x8000 [ 77.456816][ T6834] mac80211_hwsim hwsim2 wlan0: left promiscuous mode [ 78.135187][ T6864] netlink: 4 bytes leftover after parsing attributes in process `syz.1.285'. [ 79.134474][ T6672] syz.3.231 (6672) used greatest stack depth: 17704 bytes left [ 79.455624][ T6922] mac80211_hwsim hwsim4 wlan0: left promiscuous mode [ 79.661222][ T6931] netlink: 4 bytes leftover after parsing attributes in process `syz.0.303'. [ 80.041150][ T6945] CIFS: bad ip= option (127®0.0.1) [ 80.041373][ T6945] CIFS: Attempting to mount (null) [ 80.041382][ T6945] FAULT_INJECTION: forcing a failure. [ 80.041382][ T6945] name failslab, interval 1, probability 0, space 0, times 0 [ 80.041397][ T6945] CPU: 0 UID: 0 PID: 6945 Comm: syz.0.309 Not tainted syzkaller #0 PREEMPT(full) [ 80.041410][ T6945] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.041416][ T6945] Call Trace: [ 80.041420][ T6945] [ 80.041425][ T6945] dump_stack_lvl+0x100/0x190 [ 80.041445][ T6945] should_fail_ex.cold+0x5/0xa [ 80.041462][ T6945] should_failslab+0xc2/0x120 [ 80.041481][ T6945] __kmalloc_cache_noprof+0x91/0x6d0 [ 80.041495][ T6945] ? cifs_smb3_do_mount+0x107/0x1b10 [ 80.041512][ T6945] cifs_smb3_do_mount+0x107/0x1b10 [ 80.041528][ T6945] ? __pfx_cifs_smb3_do_mount+0x10/0x10 [ 80.041544][ T6945] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 80.041564][ T6945] smb3_get_tree+0x1fd/0x440 [ 80.041583][ T6945] vfs_get_tree+0x92/0x320 [ 80.041596][ T6945] vfs_cmd_create+0xd7/0x2a0 [ 80.041609][ T6945] __do_sys_fsconfig+0x55a/0xcb0 [ 80.041623][ T6945] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 80.041636][ T6945] ? xfd_validate_state+0x129/0x190 [ 80.041660][ T6945] __do_fast_syscall_32+0x13a/0x8b0 [ 80.041674][ T6945] do_fast_syscall_32+0x32/0x70 [ 80.041686][ T6945] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 80.041700][ T6945] RIP: 0023:0xf748efec [ 80.041713][ T6945] Code: Unable to access opcode bytes at 0xf748efc2. [ 80.041718][ T6945] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 00000000000001af [ 80.041730][ T6945] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000006 [ 80.041737][ T6945] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 80.041743][ T6945] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 80.041750][ T6945] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 80.041757][ T6945] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 80.041773][ T6945] [ 80.563146][ T37] IPVS: starting estimator thread 0... [ 80.565110][ T6952] IPVS: nq: FWM 3 0x00000003 - no destination available [ 80.650705][ T6953] IPVS: using max 43 ests per chain, 103200 per kthread [ 80.666395][ T6957] batman_adv: batadv0: Adding interface: dummy0 [ 80.666406][ T6957] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.666442][ T6957] batman_adv: batadv0: Interface activated: dummy0 [ 80.669169][ T6957] netlink: 4 bytes leftover after parsing attributes in process `syz.2.313'. [ 80.669209][ T6957] netlink: 4 bytes leftover after parsing attributes in process `syz.2.313'. [ 80.764215][ T6961] batadv0: mtu less than device minimum [ 80.765935][ T6961] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 80.766944][ T6961] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 80.767762][ T6961] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 80.768294][ T6961] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 80.768786][ T6961] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 80.769315][ T6961] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 80.769808][ T6961] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 80.770303][ T6961] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 80.777664][ T6964] netlink: 'syz.2.313': attribute type 10 has an invalid length. [ 80.777681][ T6964] netlink: 40 bytes leftover after parsing attributes in process `syz.2.313'. [ 80.803846][ T6964] batadv0: entered promiscuous mode [ 80.803867][ T6964] batadv0: entered allmulticast mode [ 80.813268][ T6964] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.816194][ T6964] bridge0: port 3(batadv0) entered blocking state [ 80.816528][ T6964] bridge0: port 3(batadv0) entered disabled state [ 81.007680][ T13] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 81.007692][ T13] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 81.194445][ T6970] netlink: 'syz.0.323': attribute type 1 has an invalid length. [ 81.215748][ T6970] bond1: entered promiscuous mode [ 81.215965][ T6970] 8021q: adding VLAN 0 to HW filter on device bond1 [ 81.221010][ T6972] netlink: 4 bytes leftover after parsing attributes in process `syz.2.315'. [ 81.254878][ T6970] 8021q: adding VLAN 0 to HW filter on device bond1 [ 81.255115][ T6970] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 81.255127][ T6970] bond1: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 81.266668][ T6970] bond1: (slave wireguard0): making interface the new active one [ 81.266683][ T6970] wireguard0: entered promiscuous mode [ 81.269983][ T6970] bond1: (slave wireguard0): Enslaving as an active interface with an up link [ 81.575200][ T6988] vmclock PNP0103:00: vmclock magic fields invalid [ 81.575214][ T6988] vmclock PNP0103:00: probe with driver vmclock failed with error -22 [ 81.616734][ T6988] vmclock PNP0103:00: vmclock magic fields invalid [ 81.616753][ T6988] vmclock PNP0103:00: probe with driver vmclock failed with error -22 [ 81.642991][ T6991] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 81.804193][ T6991] FAULT_INJECTION: forcing a failure. [ 81.804193][ T6991] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 81.804226][ T6991] CPU: 2 UID: 0 PID: 6991 Comm: syz.3.321 Not tainted syzkaller #0 PREEMPT(full) [ 81.804242][ T6991] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 81.804249][ T6991] Call Trace: [ 81.804254][ T6991] [ 81.804259][ T6991] dump_stack_lvl+0x100/0x190 [ 81.804279][ T6991] should_fail_ex.cold+0x5/0xa [ 81.804296][ T6991] kvm_write_guest_offset_cached+0x1fe/0x510 [ 81.804320][ T6991] kvm_lapic_sync_to_vapic+0x48c/0x6d0 [ 81.804340][ T6991] ? __pfx_kvm_lapic_sync_to_vapic+0x10/0x10 [ 81.804358][ T6991] ? vmx_load_vmcs01+0x9b/0xe0 [ 81.804373][ T6991] ? vmx_update_cr8_intercept+0x1fd/0x390 [ 81.804390][ T6991] vcpu_run+0xf90/0x61a0 [ 81.804402][ T6991] ? vmx_vcpu_load_vmcs+0x21d/0x760 [ 81.804423][ T6991] ? __pfx_vcpu_run+0x10/0x10 [ 81.804437][ T6991] ? lock_acquire+0x1d1/0x380 [ 81.804454][ T6991] ? kvm_arch_vcpu_ioctl_run+0x2e9/0x1dd0 [ 81.804468][ T6991] ? fpu_swap_kvm_fpstate+0x217/0x460 [ 81.804482][ T6991] ? __local_bh_enable_ip+0xa5/0x120 [ 81.804503][ T6991] ? kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 81.804515][ T6991] kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 81.804533][ T6991] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 81.804554][ T6991] kvm_vcpu_ioctl+0x730/0x1700 [ 81.804570][ T6991] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 81.804586][ T6991] ? tomoyo_path_number_perm+0x188/0x580 [ 81.804601][ T6991] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 81.804614][ T6991] ? futex_wait+0x11e/0x370 [ 81.804634][ T6991] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 81.804653][ T6991] ? do_vfs_ioctl+0x226/0x13e0 [ 81.804667][ T6991] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 81.804683][ T6991] ? __fget_files+0x34/0x3d0 [ 81.804702][ T6991] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 81.804718][ T6991] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 81.804734][ T6991] ? __fget_files+0x21f/0x3d0 [ 81.804752][ T6991] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 81.804767][ T6991] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 81.804783][ T6991] __do_fast_syscall_32+0x13a/0x8b0 [ 81.804797][ T6991] do_fast_syscall_32+0x32/0x70 [ 81.804809][ T6991] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 81.804824][ T6991] RIP: 0023:0xf746efec [ 81.804837][ T6991] Code: Unable to access opcode bytes at 0xf746efc2. [ 81.804843][ T6991] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 81.804855][ T6991] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000000ae80 [ 81.804862][ T6991] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 81.804869][ T6991] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 81.804875][ T6991] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 81.804881][ T6991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 81.804896][ T6991] [ 81.835354][ T7004] syzkaller0: entered promiscuous mode [ 81.835367][ T7004] syzkaller0: entered allmulticast mode [ 81.842942][ T7004] tc mirred: Loop (syzkaller0:egress --> syzkaller0:egress) [ 82.279694][ T7017] netlink: 'syz.0.329': attribute type 1 has an invalid length. [ 82.302073][ T7017] 8021q: adding VLAN 0 to HW filter on device bond2 [ 82.331741][ T7017] netlink: 8 bytes leftover after parsing attributes in process `syz.0.329'. [ 82.346202][ T5837] libceph: connect (1)[c::]:6789 error -101 [ 82.346281][ T5837] libceph: mon0 (1)[c::]:6789 connect error [ 82.372407][ T7017] bond2: (slave bridge2): making interface the new active one [ 82.375160][ T7017] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 82.500318][ T7020] ceph: No mds server is up or the cluster is laggy [ 83.381126][ T7039] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 83.386887][ T7037] syzkaller0: entered promiscuous mode [ 83.386900][ T7037] syzkaller0: entered allmulticast mode [ 83.469123][ T7039] md: could not open device unknown-block(1,0). [ 83.644551][ T43] kauditd_printk_skb: 3 callbacks suppressed [ 83.644563][ T43] audit: type=1326 audit(2000000031.319:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7045 comm="syz.1.338" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 83.644589][ T43] audit: type=1326 audit(2000000031.319:107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7045 comm="syz.1.338" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 83.669839][ T43] audit: type=1326 audit(2000000031.339:108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7045 comm="syz.1.338" exe="/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf745efec code=0x7ffc0000 [ 83.669872][ T43] audit: type=1326 audit(2000000031.339:109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7045 comm="syz.1.338" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 83.669891][ T43] audit: type=1326 audit(2000000031.339:110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7045 comm="syz.1.338" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 83.669911][ T43] audit: type=1326 audit(2000000031.339:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7045 comm="syz.1.338" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf745efec code=0x7ffc0000 [ 83.669931][ T43] audit: type=1326 audit(2000000031.339:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7045 comm="syz.1.338" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 83.669950][ T43] audit: type=1326 audit(2000000031.339:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7045 comm="syz.1.338" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf745efec code=0x7ffc0000 [ 83.741756][ T43] audit: type=1326 audit(2000000031.409:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7045 comm="syz.1.338" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 83.741862][ T43] audit: type=1326 audit(2000000031.409:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7045 comm="syz.1.338" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf745efec code=0x7ffc0000 [ 83.976638][ T5736] Bluetooth: Unknown BR/EDR signaling command 0x0f [ 83.976652][ T5736] Bluetooth: Wrong link type (-22) [ 83.984626][ T5736] Bluetooth: hci1: link tx timeout [ 83.984636][ T5736] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 85.212331][ T5736] Bluetooth: hci0: command 0x0c1a tx timeout [ 85.768214][ T66] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 85.851122][ T13] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.910075][ T7087] netlink: 'syz.3.348': attribute type 1 has an invalid length. [ 86.007646][ T66] Bluetooth: hci1: command 0x0406 tx timeout [ 86.017594][ T7087] 8021q: adding VLAN 0 to HW filter on device bond3 [ 86.020587][ T7087] bond2: (slave bond3): making interface the new active one [ 86.020969][ T7087] bond2: (slave bond3): Enslaving as an active interface with an up link [ 86.074260][ T7087] bond2: (slave gretap1): Enslaving as a backup interface with an up link [ 86.142975][ T7091] syzkaller0: entered promiscuous mode [ 86.142990][ T7091] syzkaller0: entered allmulticast mode [ 86.351848][ T7096] netlink: 'syz.1.351': attribute type 1 has an invalid length. [ 86.365703][ T7096] bond2: entered promiscuous mode [ 86.365912][ T7096] 8021q: adding VLAN 0 to HW filter on device bond2 [ 86.399224][ T7096] 8021q: adding VLAN 0 to HW filter on device bond2 [ 86.399401][ T7096] bond2: (slave wireguard0): The slave device specified does not support setting the MAC address [ 86.399412][ T7096] bond2: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 86.403118][ T7096] bond2: (slave wireguard0): making interface the new active one [ 86.403132][ T7096] wireguard0: entered promiscuous mode [ 86.403988][ T7096] bond2: (slave wireguard0): Enslaving as an active interface with an up link [ 86.404773][ T7098] syzkaller0: entered promiscuous mode [ 86.404786][ T7098] syzkaller0: entered allmulticast mode [ 86.444356][ T7100] syzkaller0: entered promiscuous mode [ 86.444369][ T7100] syzkaller0: entered allmulticast mode [ 86.472943][ T7100] net_ratelimit: 15 callbacks suppressed [ 86.472956][ T7100] 0: reclassify loop, rule prio 0, protocol 800 [ 86.654794][ T13] bond0: (slave bond_slave_0): interface is now down [ 86.654816][ T13] bond0: (slave bond_slave_1): interface is now down [ 86.661577][ T7111] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.714176][ T7116] fuse: fd is not a fuse device [ 86.967668][ T25] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 87.117495][ T25] usb 5-1: Using ep0 maxpacket: 32 [ 87.118026][ T25] usb 5-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 87.118931][ T25] usb 5-1: config 0 has an invalid interface number: 119 but max is 0 [ 87.118944][ T25] usb 5-1: config 0 has no interface number 0 [ 87.118961][ T25] usb 5-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 87.118972][ T25] usb 5-1: config 0 interface 119 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 87.118984][ T25] usb 5-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 87.120603][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.120615][ T25] usb 5-1: Product: syz [ 87.120622][ T25] usb 5-1: Manufacturer: syz [ 87.120629][ T25] usb 5-1: SerialNumber: syz [ 87.121927][ T25] usb 5-1: config 0 descriptor?? [ 87.131352][ T25] input: bcm5974 as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.119/input/input8 [ 87.348604][ T7117] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 87.348848][ T7117] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 87.394862][ T7125] netlink: 'syz.1.361': attribute type 1 has an invalid length. [ 87.411528][ T7125] 8021q: adding VLAN 0 to HW filter on device bond3 [ 87.427384][ T7125] netlink: 8 bytes leftover after parsing attributes in process `syz.1.361'. [ 87.447993][ T7125] bond3: (slave bridge1): making interface the new active one [ 87.449214][ T7125] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 87.541927][ T7129] bond1: (slave dummy0): Releasing active interface [ 87.544787][ T7129] batman_adv: batadv0: Adding interface: dummy0 [ 87.544796][ T7129] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.544811][ T7129] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 87.556490][ T7129] netlink: 4 bytes leftover after parsing attributes in process `syz.1.363'. [ 87.556537][ T7129] netlink: 4 bytes leftover after parsing attributes in process `syz.1.363'. [ 87.565153][ T7129] netlink: 'syz.1.363': attribute type 10 has an invalid length. [ 87.565165][ T7129] netlink: 40 bytes leftover after parsing attributes in process `syz.1.363'. [ 87.565179][ T7129] batadv0: entered promiscuous mode [ 87.565188][ T7129] batadv0: entered allmulticast mode [ 87.565583][ T7129] bridge0: port 3(batadv0) entered blocking state [ 87.565663][ T7129] bridge0: port 3(batadv0) entered disabled state [ 87.567111][ T7129] bridge0: port 3(batadv0) entered blocking state [ 87.567157][ T7129] bridge0: port 3(batadv0) entered forwarding state [ 87.597835][ T6703] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 87.597848][ T6703] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 88.179997][ T6703] bond0: (slave bond_slave_0): interface is now down [ 88.180013][ T6703] bond0: (slave bond_slave_1): interface is now down [ 88.237283][ T6703] nci: nci_rx_work: unknown MT 0x1 [ 88.729287][ T7163] syzkaller0: entered promiscuous mode [ 88.729301][ T7163] syzkaller0: entered allmulticast mode [ 89.207586][ T6703] bond0: (slave bond_slave_0): interface is now down [ 89.207609][ T6703] bond0: (slave bond_slave_1): interface is now down [ 89.212418][ T6703] bond0: now running without any active interface! [ 89.697537][ T25] usb 5-1: USB disconnect, device number 3 [ 89.773360][ T7171] FAULT_INJECTION: forcing a failure. [ 89.773360][ T7171] name failslab, interval 1, probability 0, space 0, times 0 [ 89.773388][ T7171] CPU: 2 UID: 0 PID: 7171 Comm: syz.3.375 Not tainted syzkaller #0 PREEMPT(full) [ 89.773410][ T7171] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 89.773421][ T7171] Call Trace: [ 89.773427][ T7171] [ 89.773435][ T7171] dump_stack_lvl+0x100/0x190 [ 89.773464][ T7171] should_fail_ex.cold+0x5/0xa [ 89.773488][ T7171] should_failslab+0xc2/0x120 [ 89.773515][ T7171] __kmalloc_noprof+0xfc/0x840 [ 89.773538][ T7171] ? __register_sysctl_table+0xbc8/0x1650 [ 89.773557][ T7171] ? __register_sysctl_table+0xbe4/0x1650 [ 89.773581][ T7171] __register_sysctl_table+0xbe4/0x1650 [ 89.773606][ T7171] ? __pfx___register_sysctl_table+0x10/0x10 [ 89.773625][ T7171] ? is_module_address+0x5f/0xf0 [ 89.773643][ T7171] ? is_module_address+0x5f/0xf0 [ 89.773666][ T7171] register_net_sysctl_sz+0x325/0x420 [ 89.773687][ T7171] ? __asan_memcpy+0x3c/0x60 [ 89.773713][ T7171] vrf_netns_init+0x152/0x1f0 [ 89.773731][ T7171] ? __pfx_vrf_netns_init+0x10/0x10 [ 89.773747][ T7171] ops_init+0x1e2/0x5f0 [ 89.773771][ T7171] setup_net+0x118/0x3a0 [ 89.773795][ T7171] ? __pfx_setup_net+0x10/0x10 [ 89.773826][ T7171] copy_net_ns+0x345/0x7a0 [ 89.773852][ T7171] create_new_namespaces+0x3ea/0xac0 [ 89.773883][ T7171] unshare_nsproxy_namespaces+0xf2/0x220 [ 89.773925][ T7171] ksys_unshare+0x4a2/0xb30 [ 89.773950][ T7171] ? __pfx_ksys_unshare+0x10/0x10 [ 89.773981][ T7171] __ia32_sys_unshare+0x30/0x40 [ 89.774001][ T7171] __do_fast_syscall_32+0x13a/0x8b0 [ 89.774021][ T7171] ? lockdep_hardirqs_on+0x7d/0x110 [ 89.774049][ T7171] do_fast_syscall_32+0x32/0x70 [ 89.774086][ T7171] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 89.774111][ T7171] RIP: 0023:0xf746efec [ 89.774131][ T7171] Code: Unable to access opcode bytes at 0xf746efc2. [ 89.774139][ T7171] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000136 [ 89.774158][ T7171] RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 0000000000000000 [ 89.774170][ T7171] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 89.774181][ T7171] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 89.774191][ T7171] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 89.774201][ T7171] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 89.774225][ T7171] [ 89.774623][ T7171] sysctl could not get directory: /net/vrf -12 [ 89.846514][ T7178] fuse: fd is not a fuse device [ 90.728036][ T6703] bond0: (slave bond_slave_0): interface is now down [ 90.728052][ T6703] bond0: (slave bond_slave_1): interface is now down [ 90.740309][ T6703] bond0: now running without any active interface! [ 91.166428][ T7154] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 91.166559][ T7178] netlink: 4 bytes leftover after parsing attributes in process `syz.2.376'. [ 92.382253][ T7217] syzkaller0: entered promiscuous mode [ 92.382266][ T7217] syzkaller0: entered allmulticast mode [ 92.478521][ T7220] netlink: 'syz.0.388': attribute type 1 has an invalid length. [ 92.493409][ T7220] 8021q: adding VLAN 0 to HW filter on device bond3 [ 92.512982][ T7220] bond3: (slave dummy0): making interface the new active one [ 92.514725][ T7220] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 93.796103][ T7232] netlink: 40 bytes leftover after parsing attributes in process `syz.3.392'. [ 93.809311][ T7232] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input9 [ 93.817774][ T7231] bond4 (unregistering): Released all slaves [ 93.830740][ T7234] trusted_key: encrypted_key: insufficient parameters specified [ 93.859777][ T7234] FAULT_INJECTION: forcing a failure. [ 93.859777][ T7234] name failslab, interval 1, probability 0, space 0, times 0 [ 93.859810][ T7234] CPU: 0 UID: 0 PID: 7234 Comm: syz.1.391 Not tainted syzkaller #0 PREEMPT(full) [ 93.859835][ T7234] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.859846][ T7234] Call Trace: [ 93.859854][ T7234] [ 93.859863][ T7234] dump_stack_lvl+0x100/0x190 [ 93.859907][ T7234] should_fail_ex.cold+0x5/0xa [ 93.859933][ T7234] should_failslab+0xc2/0x120 [ 93.859964][ T7234] kmem_cache_alloc_noprof+0x92/0x6a0 [ 93.859991][ T7234] ? alloc_empty_file+0x5b/0x1c0 [ 93.860015][ T7234] alloc_empty_file+0x5b/0x1c0 [ 93.860035][ T7234] path_openat+0xdb/0x2440 [ 93.860067][ T7234] ? __pfx_path_openat+0x10/0x10 [ 93.860121][ T7234] do_file_open+0x20e/0x430 [ 93.860152][ T7234] ? __pfx_do_file_open+0x10/0x10 [ 93.860199][ T7234] ? _raw_spin_unlock+0x28/0x50 [ 93.860227][ T7234] ? alloc_fd+0x471/0x7a0 [ 93.860261][ T7234] do_sys_openat2+0x10f/0x1e0 [ 93.860282][ T7234] ? __pfx_do_sys_openat2+0x10/0x10 [ 93.860307][ T7234] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 93.860337][ T7234] __ia32_compat_sys_openat+0x12d/0x210 [ 93.860360][ T7234] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 93.860392][ T7234] do_int80_emulation+0x166/0x650 [ 93.860416][ T7234] asm_int80_emulation+0x1a/0x20 [ 93.860437][ T7234] RIP: 0023:0xf71b77eb [ 93.860454][ T7234] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 93.860473][ T7234] RSP: 002b:00000000f54763cc EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 93.860508][ T7234] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f5476490 [ 93.860521][ T7234] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 93.860534][ T7234] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 93.860546][ T7234] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 93.860559][ T7234] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 93.860584][ T7234] [ 93.988765][ T7239] input: syz0 as /devices/virtual/input/input10 [ 94.066197][ T7243] netlink: 'syz.3.395': attribute type 1 has an invalid length. [ 94.089242][ T7243] bond4: entered promiscuous mode [ 94.089609][ T7243] 8021q: adding VLAN 0 to HW filter on device bond4 [ 94.098268][ T7248] netlink: 'syz.1.397': attribute type 1 has an invalid length. [ 94.118702][ T7248] 8021q: adding VLAN 0 to HW filter on device bond4 [ 94.135669][ T7243] 8021q: adding VLAN 0 to HW filter on device bond4 [ 94.135830][ T7243] bond4: (slave wireguard0): The slave device specified does not support setting the MAC address [ 94.135840][ T7243] bond4: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 94.145718][ T7243] bond4: (slave wireguard0): making interface the new active one [ 94.145732][ T7243] wireguard0: entered promiscuous mode [ 94.150425][ T7243] bond4: (slave wireguard0): Enslaving as an active interface with an up link [ 94.169354][ T7248] bond4: (slave erspan1): making interface the new active one [ 94.171907][ T7248] bond4: (slave erspan1): Enslaving as an active interface with an up link [ 95.053370][ T7246] event trace: Could not enable event p1 [ 95.141696][ T43] audit: type=1800 audit(2000000002.750:116): pid=7259 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.402" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 95.241074][ T7265] trusted_key: encrypted_key: insufficient parameters specified [ 95.242447][ T7265] FAULT_INJECTION: forcing a failure. [ 95.242447][ T7265] name failslab, interval 1, probability 0, space 0, times 0 [ 95.242467][ T7265] CPU: 2 UID: 0 PID: 7265 Comm: syz.3.404 Not tainted syzkaller #0 PREEMPT(full) [ 95.242480][ T7265] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.242487][ T7265] Call Trace: [ 95.242491][ T7265] [ 95.242496][ T7265] dump_stack_lvl+0x100/0x190 [ 95.242561][ T7265] should_fail_ex.cold+0x5/0xa [ 95.242577][ T7265] should_failslab+0xc2/0x120 [ 95.242614][ T7265] kmem_cache_alloc_noprof+0x92/0x6a0 [ 95.242631][ T7265] ? alloc_empty_file+0x5b/0x1c0 [ 95.242645][ T7265] alloc_empty_file+0x5b/0x1c0 [ 95.242657][ T7265] path_openat+0xdb/0x2440 [ 95.242676][ T7265] ? __pfx_path_openat+0x10/0x10 [ 95.242697][ T7265] do_file_open+0x20e/0x430 [ 95.242715][ T7265] ? __pfx_do_file_open+0x10/0x10 [ 95.242741][ T7265] ? _raw_spin_unlock+0x28/0x50 [ 95.242777][ T7265] ? alloc_fd+0x471/0x7a0 [ 95.242796][ T7265] do_sys_openat2+0x10f/0x1e0 [ 95.242808][ T7265] ? __pfx_do_sys_openat2+0x10/0x10 [ 95.242823][ T7265] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 95.242840][ T7265] __ia32_compat_sys_openat+0x12d/0x210 [ 95.242854][ T7265] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 95.242873][ T7265] do_int80_emulation+0x166/0x650 [ 95.242903][ T7265] asm_int80_emulation+0x1a/0x20 [ 95.242918][ T7265] RIP: 0023:0xf71c77eb [ 95.242928][ T7265] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 95.242940][ T7265] RSP: 002b:00000000f54863cc EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 95.242953][ T7265] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f5486490 [ 95.242961][ T7265] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 95.242968][ T7265] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 95.242975][ T7265] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 95.242982][ T7265] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 95.242998][ T7265] [ 95.302214][ T7267] netlink: 'syz.3.405': attribute type 1 has an invalid length. [ 95.325424][ T7270] netlink: 'syz.1.406': attribute type 39 has an invalid length. [ 95.336212][ T7267] 8021q: adding VLAN 0 to HW filter on device bond5 [ 95.372077][ T7267] dummy0: left promiscuous mode [ 95.376313][ T7267] bond5: (slave dummy0): making interface the new active one [ 95.379042][ T7267] bond5: (slave dummy0): Enslaving as an active interface with an up link [ 95.387480][ T7271] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 95.387496][ T7271] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 95.388409][ T7271] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 95.388420][ T7271] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 95.391163][ T7271] batman_adv: batadv0: Removing interface: dummy0 [ 95.403084][ T7271] bridge0: port 3(batadv0) entered disabled state [ 95.409551][ T7271] bridge0: port 3(batadv0) entered disabled state [ 95.880027][ T7295] syz.1.421 invoked oom-killer: gfp_mask=0x400cc0(GFP_KERNEL_ACCOUNT), order=1, oom_score_adj=1000 [ 95.880050][ T7295] CPU: 2 UID: 0 PID: 7295 Comm: syz.1.421 Not tainted syzkaller #0 PREEMPT(full) [ 95.880064][ T7295] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.880071][ T7295] Call Trace: [ 95.880075][ T7295] [ 95.880080][ T7295] dump_stack_lvl+0x100/0x190 [ 95.880100][ T7295] dump_header+0xfb/0x606 [ 95.880115][ T7295] oom_kill_process.cold+0xd/0x380 [ 95.880130][ T7295] out_of_memory+0x340/0x14f0 [ 95.880153][ T7295] ? __pfx_out_of_memory+0x10/0x10 [ 95.880176][ T7295] mem_cgroup_out_of_memory+0xc6/0x130 [ 95.880193][ T7295] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 95.880208][ T7295] ? find_held_lock+0x2b/0x80 [ 95.880224][ T7295] ? do_raw_spin_unlock+0x145/0x1e0 [ 95.880237][ T7295] ? _raw_spin_unlock+0x28/0x50 [ 95.880255][ T7295] try_charge_memcg+0x783/0xf60 [ 95.880271][ T7295] ? __pfx_try_charge_memcg+0x10/0x10 [ 95.880284][ T7295] ? find_held_lock+0x2b/0x80 [ 95.880297][ T7295] ? rcu_read_unlock+0x17/0x60 [ 95.880309][ T7295] ? rcu_read_unlock+0x17/0x60 [ 95.880327][ T7295] obj_cgroup_charge_pages+0x2b/0x1f0 [ 95.880341][ T7295] __memcg_slab_post_alloc_hook+0x47f/0x10c0 [ 95.880360][ T7295] ? kasan_unpoison+0x27/0x60 [ 95.880377][ T7295] __kmalloc_node_track_caller_noprof+0x66a/0x870 [ 95.880395][ T7295] ? find_held_lock+0x2b/0x80 [ 95.880408][ T7295] ? neigh_sysctl_register+0xb4/0x660 [ 95.880464][ T7295] kmemdup_noprof+0x29/0x60 [ 95.880479][ T7295] neigh_sysctl_register+0xb4/0x660 [ 95.880495][ T7295] ? __pfx_neigh_sysctl_register+0x10/0x10 [ 95.880510][ T7295] ? inetdev_init+0x245/0x570 [ 95.880526][ T7295] ? inetdev_event+0x827/0x17f0 [ 95.880541][ T7295] ? notifier_call_chain+0x99/0x3f0 [ 95.880555][ T7295] ? copy_net_ns+0x345/0x7a0 [ 95.880571][ T7295] ? create_new_namespaces+0x3ea/0xac0 [ 95.880587][ T7295] ? unshare_nsproxy_namespaces+0xf2/0x220 [ 95.880604][ T7295] ? ksys_unshare+0x4a2/0xb30 [ 95.880615][ T7295] ? __ia32_sys_unshare+0x30/0x40 [ 95.880627][ T7295] ? __do_fast_syscall_32+0x13a/0x8b0 [ 95.880638][ T7295] ? do_fast_syscall_32+0x32/0x70 [ 95.880652][ T7295] devinet_sysctl_register+0xb6/0x210 [ 95.880669][ T7295] inetdev_init+0x2b8/0x570 [ 95.880686][ T7295] inetdev_event+0x827/0x17f0 [ 95.880703][ T7295] ? ib_netdevice_event+0xfc/0x330 [ 95.880718][ T7295] ? __pfx_inetdev_event+0x10/0x10 [ 95.880734][ T7295] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 95.880754][ T7295] notifier_call_chain+0x99/0x3f0 [ 95.880770][ T7295] call_netdevice_notifiers_info+0xbe/0x110 [ 95.880787][ T7295] register_netdevice+0x1998/0x25a0 [ 95.880806][ T7295] ? __pfx_register_netdevice+0x10/0x10 [ 95.880822][ T7295] ? alloc_netdev_mqs+0x120a/0x15c0 [ 95.880837][ T7295] ? __pfx_loopback_net_init+0x10/0x10 [ 95.880873][ T7295] register_netdev+0x34/0x50 [ 95.880893][ T7295] loopback_net_init+0x7a/0x170 [ 95.880912][ T7295] ? __pfx_loopback_net_init+0x10/0x10 [ 95.880929][ T7295] ops_init+0x1e2/0x5f0 [ 95.880946][ T7295] setup_net+0x118/0x3a0 [ 95.880961][ T7295] ? __pfx_setup_net+0x10/0x10 [ 95.880981][ T7295] copy_net_ns+0x345/0x7a0 [ 95.880999][ T7295] create_new_namespaces+0x3ea/0xac0 [ 95.881020][ T7295] unshare_nsproxy_namespaces+0xf2/0x220 [ 95.881040][ T7295] ksys_unshare+0x4a2/0xb30 [ 95.881052][ T7295] ? __pfx_ksys_unshare+0x10/0x10 [ 95.881071][ T7295] __ia32_sys_unshare+0x30/0x40 [ 95.881083][ T7295] __do_fast_syscall_32+0x13a/0x8b0 [ 95.881097][ T7295] do_fast_syscall_32+0x32/0x70 [ 95.881110][ T7295] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 95.881125][ T7295] RIP: 0023:0xf745efec [ 95.881157][ T7295] Code: Unable to access opcode bytes at 0xf745efc2. [ 95.881163][ T7295] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000136 [ 95.881175][ T7295] RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 0000000000000000 [ 95.881183][ T7295] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 95.881189][ T7295] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 95.881196][ T7295] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 95.881203][ T7295] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 95.881218][ T7295] [ 95.883458][ T7295] memory: usage 192kB, limit 192kB, failcnt 41 [ 95.883470][ T7295] memory+swap: usage 192kB, limit 9007199254740988kB, failcnt 0 [ 95.883477][ T7295] kmem: usage 192kB, limit 9007199254740988kB, failcnt 0 [ 95.883483][ T7295] Memory cgroup stats for /syz1/test: [ 95.883551][ T7295] cache 0 [ 95.883555][ T7295] rss 0 [ 95.883559][ T7295] rss_huge 0 [ 95.883563][ T7295] shmem 0 [ 95.883567][ T7295] mapped_file 0 [ 95.883570][ T7295] dirty 0 [ 95.883574][ T7295] writeback 0 [ 95.883578][ T7295] workingset_refault_anon 0 [ 95.883582][ T7295] workingset_refault_file 0 [ 95.883587][ T7295] swap 0 [ 95.883590][ T7295] swapcached 0 [ 95.883594][ T7295] pgpgin 0 [ 95.883598][ T7295] pgpgout 0 [ 95.883602][ T7295] pgfault 0 [ 95.883605][ T7295] pgmajfault 0 [ 95.883609][ T7295] inactive_anon 0 [ 95.883613][ T7295] active_anon 0 [ 95.883617][ T7295] inactive_file 0 [ 95.883621][ T7295] active_file 0 [ 95.883625][ T7295] unevictable 0 [ 95.883629][ T7295] hierarchical_memory_limit 196608 [ 95.883633][ T7295] hierarchical_memsw_limit 9223372036854771712 [ 95.883638][ T7295] total_cache 0 [ 95.883642][ T7295] total_rss 0 [ 95.883646][ T7295] total_rss_huge 0 [ 95.883650][ T7295] total_shmem 0 [ 95.883654][ T7295] total_mapped_file 0 [ 95.883658][ T7295] total_dirty 0 [ 95.883662][ T7295] total_writeback 0 [ 95.883666][ T7295] total_workingset_refault_anon 0 [ 95.883671][ T7295] total_workingset_refault_file 0 [ 95.883675][ T7295] total_swap 0 [ 95.883679][ T7295] total_swapcached 0 [ 95.883683][ T7295] total_pgpgin 0 [ 95.883687][ T7295] total_pgpgout 0 [ 95.883691][ T7295] total_pgfault 0 [ 95.883695][ T7295] total_pgmajfault 0 [ 95.883699][ T7295] total_inactive_anon 0 [ 95.883703][ T7295] total_active_anon 0 [ 95.883707][ T7295] total_inactive_file 0 [ 95.883711][ T7295] total_active_file 0 [ 95.883715][ T7295] total_unevictable 0 [ 95.883719][ T7295] anon_cost 0 [ 95.883723][ T7295] file_cost 0 [ 95.883727][ T7295] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.421,pid=7293,uid=0 [ 95.885137][ T7295] Memory cgroup out of memory: Killed process 7293 (syz.1.421) total-vm:104084kB, anon-rss:1068kB, file-rss:23384kB, shmem-rss:0kB, UID:0 pgtables:112kB oom_score_adj:1000 [ 96.402134][ T7331] netlink: 'syz.2.423': attribute type 1 has an invalid length. [ 96.415195][ T7331] bond2: entered promiscuous mode [ 96.419576][ T7331] 8021q: adding VLAN 0 to HW filter on device bond2 [ 96.466500][ T7331] 8021q: adding VLAN 0 to HW filter on device bond2 [ 96.466726][ T7331] bond2: (slave wireguard0): The slave device specified does not support setting the MAC address [ 96.466739][ T7331] bond2: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 96.475005][ T7334] i801_smbus 0000:00:1f.3: SMBus using PCI interrupt [ 96.479283][ T7334] FAULT_INJECTION: forcing a failure. [ 96.479283][ T7334] name failslab, interval 1, probability 0, space 0, times 0 [ 96.479301][ T7334] CPU: 0 UID: 0 PID: 7334 Comm: syz.3.422 Not tainted syzkaller #0 PREEMPT(full) [ 96.479314][ T7334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.479321][ T7334] Call Trace: [ 96.479326][ T7334] [ 96.479330][ T7334] dump_stack_lvl+0x100/0x190 [ 96.479350][ T7334] should_fail_ex.cold+0x5/0xa [ 96.479366][ T7334] should_failslab+0xc2/0x120 [ 96.479385][ T7334] kmem_cache_alloc_noprof+0x92/0x6a0 [ 96.479403][ T7334] ? acpi_ut_allocate_object_desc_dbg+0x86/0x240 [ 96.479422][ T7334] acpi_ut_allocate_object_desc_dbg+0x86/0x240 [ 96.479439][ T7334] acpi_ut_create_internal_object_dbg+0x51/0x260 [ 96.479456][ T7334] acpi_ev_install_space_handler+0x316/0x950 [ 96.479469][ T7334] ? __pfx_acpi_ev_default_region_setup+0x10/0x10 [ 96.479481][ T7334] ? __pfx_i2c_acpi_space_handler+0x10/0x10 [ 96.479499][ T7334] acpi_install_address_space_handler_internal+0xab/0x1a0 [ 96.479516][ T7334] ? __pfx_i2c_acpi_space_handler+0x10/0x10 [ 96.479534][ T7334] i2c_acpi_install_space_handler+0x177/0x210 [ 96.479553][ T7334] i2c_register_adapter+0x8b8/0x13f0 [ 96.479565][ T7334] ? of_alias_get_id+0xb1/0x110 [ 96.479582][ T7334] i801_probe.cold+0x30c/0x84e [ 96.479596][ T7334] ? __pfx_i801_probe+0x10/0x10 [ 96.479611][ T7334] ? mark_held_locks+0x40/0x70 [ 96.479628][ T7334] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 96.479646][ T7334] ? lockdep_hardirqs_on+0x7d/0x110 [ 96.479664][ T7334] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 96.479683][ T7334] ? __pfx_i801_probe+0x10/0x10 [ 96.479695][ T7334] local_pci_probe+0xdd/0x1b0 [ 96.479712][ T7334] pci_call_probe+0x176/0x800 [ 96.479729][ T7334] ? pci_match_device+0x147/0x7d0 [ 96.479745][ T7334] ? __pfx_pci_call_probe+0x10/0x10 [ 96.479766][ T7334] ? __pfx_pci_match_device+0x10/0x10 [ 96.479781][ T7334] ? pci_find_host_bridge+0x3c/0x80 [ 96.479801][ T7334] ? up_write+0x2dc/0x5b0 [ 96.479816][ T7334] pci_device_probe+0x25b/0x400 [ 96.479833][ T7334] ? __pfx_pci_device_probe+0x10/0x10 [ 96.479851][ T7334] ? kernfs_create_link+0x1bd/0x240 [ 96.479869][ T7334] ? sysfs_create_link+0x68/0xc0 [ 96.479886][ T7334] ? __pfx_pci_device_probe+0x10/0x10 [ 96.479911][ T7334] really_probe+0x241/0xa60 [ 96.479927][ T7334] __driver_probe_device+0x210/0x460 [ 96.479943][ T7334] device_driver_attach+0xd1/0x220 [ 96.479958][ T7334] bind_store+0xf4/0x190 [ 96.479974][ T7334] ? __pfx_bind_store+0x10/0x10 [ 96.479992][ T7334] drv_attr_store+0x74/0xb0 [ 96.480008][ T7334] ? __pfx_drv_attr_store+0x10/0x10 [ 96.480025][ T7334] sysfs_kf_write+0xf2/0x150 [ 96.480041][ T7334] kernfs_fop_write_iter+0x3e0/0x5f0 [ 96.480054][ T7334] ? __pfx_sysfs_kf_write+0x10/0x10 [ 96.480071][ T7334] vfs_write+0x6af/0x1050 [ 96.480086][ T7334] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 96.480101][ T7334] ? __pfx_vfs_write+0x10/0x10 [ 96.480115][ T7334] ? find_held_lock+0x2b/0x80 [ 96.480138][ T7334] ksys_write+0x12a/0x250 [ 96.480152][ T7334] ? __pfx_ksys_write+0x10/0x10 [ 96.480171][ T7334] __do_fast_syscall_32+0x13a/0x8b0 [ 96.480185][ T7334] do_fast_syscall_32+0x32/0x70 [ 96.480197][ T7334] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 96.480230][ T7334] RIP: 0023:0xf746efec [ 96.480245][ T7334] Code: Unable to access opcode bytes at 0xf746efc2. [ 96.480250][ T7334] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 96.480263][ T7334] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000800005c0 [ 96.480271][ T7334] RDX: 000000000000000d RSI: 0000000000000000 RDI: 0000000000000000 [ 96.480277][ T7334] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 96.480283][ T7334] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 96.480290][ T7334] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 96.480305][ T7334] [ 96.484280][ T7334] ACPI Error: Could not allocate an object descriptor (20260408/evhandler-495) [ 96.484304][ T7334] i2c i2c-1: Error installing i2c space handler [ 96.498284][ T7331] bond2: (slave wireguard0): making interface the new active one [ 96.498298][ T7331] wireguard0: entered promiscuous mode [ 96.505115][ T7331] bond2: (slave wireguard0): Enslaving as an active interface with an up link [ 96.520333][ T7334] i2c i2c-1: Memory type 0x07 not supported yet, not instantiating SPD [ 96.744324][ T7340] bond6 (unregistering): Released all slaves [ 96.935386][ T7348] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 96.953173][ T7348] kvm: pic: non byte read [ 96.959367][ T7348] kvm: pic: level sensitive irq not supported [ 96.961081][ T7348] kvm: pic: non byte read [ 96.968593][ T7348] kvm: pic: level sensitive irq not supported [ 96.969661][ T7348] kvm: pic: non byte read [ 96.971137][ T7348] kvm: pic: level sensitive irq not supported [ 96.971676][ T7348] kvm: pic: non byte read [ 96.972752][ T7348] kvm: pic: level sensitive irq not supported [ 96.973090][ T7348] kvm: pic: non byte read [ 97.195788][ T3376] nintendo 0005:057E:2017.0002: unbalanced collection at end of report description [ 97.196785][ T3376] nintendo 0005:057E:2017.0002: HID parse failed [ 97.207936][ T3376] nintendo 0005:057E:2017.0002: probe - fail = -22 [ 97.207978][ T3376] nintendo 0005:057E:2017.0002: probe with driver nintendo failed with error -22 [ 101.639032][ T43] audit: type=1800 audit(2000000009.249:117): pid=7423 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.449" name="file1" dev="sda1" ino=2038 res=0 errno=0 [ 102.034133][ T7439] overlayfs: failed to clone upperpath [ 103.987615][ T7464] netlink: 'syz.2.467': attribute type 1 has an invalid length. [ 104.024612][ T7466] bond2: left promiscuous mode [ 104.024628][ T7466] wireguard0: left promiscuous mode [ 104.076270][ T7464] 8021q: adding VLAN 0 to HW filter on device bond3 [ 104.152864][ T7464] macvtap1: entered allmulticast mode [ 104.204382][ T7464] bond3: (slave geneve2): making interface the new active one [ 104.211793][ T7464] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 104.217471][ T5813] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.217524][ T5813] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.229363][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.229399][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.402249][ T7484] binder: transaction release 36 bad handle 1, ret = -22 [ 105.228730][ T7496] syzkaller0: entered promiscuous mode [ 105.228744][ T7496] syzkaller0: entered allmulticast mode [ 105.254070][ T7496] tipc: Started in network mode [ 105.254087][ T7496] tipc: Node identity 7eb6469c255, cluster identity 4711 [ 105.254218][ T7496] tipc: Enabled bearer , priority 0 [ 105.256940][ T7495] tipc: Resetting bearer [ 105.305555][ T7495] tipc: Disabling bearer [ 105.711428][ T7508] Set syz0 is full, maxelem 0 reached [ 107.277873][ T7520] netlink: 4 bytes leftover after parsing attributes in process `syz.0.477'. [ 108.734870][ T7557] syzkaller0: entered promiscuous mode [ 108.734890][ T7557] syzkaller0: entered allmulticast mode [ 109.722258][ T7577] ip6erspan0: entered allmulticast mode [ 109.858168][ T7580] netlink: 4 bytes leftover after parsing attributes in process `syz.3.493'. [ 109.922493][ T7585] netlink: 'syz.1.495': attribute type 1 has an invalid length. [ 109.938668][ T7585] 8021q: adding VLAN 0 to HW filter on device bond5 [ 109.952439][ T7585] netlink: 8 bytes leftover after parsing attributes in process `syz.1.495'. [ 109.999586][ T7585] bond5: (slave bridge2): making interface the new active one [ 110.006360][ T7585] bond5: (slave bridge2): Enslaving as an active interface with an up link [ 110.025490][ T7588] netlink: 4 bytes leftover after parsing attributes in process `syz.0.494'. [ 110.210727][ T7595] i801_smbus 0000:00:1f.3: SMBus using PCI interrupt [ 110.260140][ T7595] i2c i2c-1: Memory type 0x07 not supported yet, not instantiating SPD [ 110.543551][ T7599] i801_smbus 0000:00:1f.3: SMBus using PCI interrupt [ 110.559931][ T7599] FAULT_INJECTION: forcing a failure. [ 110.559931][ T7599] name failslab, interval 1, probability 0, space 0, times 0 [ 110.559963][ T7599] CPU: 2 UID: 0 PID: 7599 Comm: syz.1.500 Not tainted syzkaller #0 PREEMPT(full) [ 110.559986][ T7599] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 110.560000][ T7599] Call Trace: [ 110.560007][ T7599] [ 110.560016][ T7599] dump_stack_lvl+0x100/0x190 [ 110.560049][ T7599] should_fail_ex.cold+0x5/0xa [ 110.560077][ T7599] should_failslab+0xc2/0x120 [ 110.560110][ T7599] __kmalloc_noprof+0xfc/0x840 [ 110.560136][ T7599] ? __pfx_acpi_ut_trace_ptr+0x10/0x10 [ 110.560166][ T7599] ? acpi_ns_get_normalized_pathname+0x95/0x250 [ 110.560194][ T7599] acpi_ns_get_normalized_pathname+0x95/0x250 [ 110.560218][ T7599] acpi_ns_evaluate+0x24d/0x1670 [ 110.560246][ T7599] acpi_evaluate_object+0x420/0xe00 [ 110.560271][ T7599] ? is_bpf_text_address+0x8a/0x1a0 [ 110.560302][ T7599] ? bpf_ksym_find+0x124/0x1c0 [ 110.560326][ T7599] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 110.560355][ T7599] ? __pfx_acpi_evaluate_object+0x10/0x10 [ 110.560380][ T7599] ? kernel_text_address+0x8d/0x100 [ 110.560407][ T7599] ? __kernel_text_address+0xd/0x30 [ 110.560436][ T7599] acpi_evaluate_integer+0xdf/0x220 [ 110.560459][ T7599] ? __pfx_acpi_evaluate_integer+0x10/0x10 [ 110.560495][ T7599] acpi_bus_get_status+0x1a1/0x430 [ 110.560519][ T7599] ? __pfx_acpi_bus_get_status+0x10/0x10 [ 110.560541][ T7599] ? mark_held_locks+0x40/0x70 [ 110.560570][ T7599] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 110.560600][ T7599] ? lockdep_hardirqs_on+0x7d/0x110 [ 110.560635][ T7599] i2c_acpi_do_lookup+0x9b/0x280 [ 110.560659][ T7599] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 110.560688][ T7599] ? __pfx_i2c_acpi_do_lookup+0x10/0x10 [ 110.560714][ T7599] ? acpi_ut_track_stack_ptr+0x114/0x180 [ 110.560751][ T7599] i2c_acpi_get_info+0x115/0x360 [ 110.560778][ T7599] ? __pfx_i2c_acpi_get_info+0x10/0x10 [ 110.560809][ T7599] ? __pfx_acpi_fetch_acpi_dev+0x10/0x10 [ 110.560836][ T7599] ? mark_held_locks+0x40/0x70 [ 110.560874][ T7599] i2c_acpi_add_device+0xb5/0x200 [ 110.560901][ T7599] ? __pfx_i2c_acpi_add_device+0x10/0x10 [ 110.560926][ T7599] ? __pfx_up+0x10/0x10 [ 110.560944][ T7599] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 110.560983][ T7599] ? acpi_os_signal_semaphore+0x11e/0x1a0 [ 110.561020][ T7599] acpi_ns_walk_namespace+0x4cc/0x760 [ 110.561047][ T7599] ? __pfx_i2c_acpi_add_device+0x10/0x10 [ 110.561075][ T7599] ? __pfx_i2c_acpi_add_device+0x10/0x10 [ 110.561102][ T7599] acpi_walk_namespace+0xff/0x1d0 [ 110.561135][ T7599] i2c_acpi_register_devices+0x82/0x160 [ 110.561162][ T7599] i2c_register_adapter+0x8c0/0x13f0 [ 110.561183][ T7599] ? of_alias_get_id+0xb1/0x110 [ 110.561213][ T7599] i801_probe.cold+0x30c/0x84e [ 110.561238][ T7599] ? __pfx_i801_probe+0x10/0x10 [ 110.561266][ T7599] ? mark_held_locks+0x40/0x70 [ 110.561295][ T7599] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 110.561324][ T7599] ? lockdep_hardirqs_on+0x7d/0x110 [ 110.561354][ T7599] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 110.561385][ T7599] ? __pfx_i801_probe+0x10/0x10 [ 110.561405][ T7599] local_pci_probe+0xdd/0x1b0 [ 110.561436][ T7599] pci_call_probe+0x176/0x800 [ 110.561465][ T7599] ? pci_match_device+0x147/0x7d0 [ 110.561494][ T7599] ? __pfx_pci_call_probe+0x10/0x10 [ 110.561530][ T7599] ? __pfx_pci_match_device+0x10/0x10 [ 110.561558][ T7599] ? pci_find_host_bridge+0x3c/0x80 [ 110.561592][ T7599] ? up_write+0x2dc/0x5b0 [ 110.561617][ T7599] pci_device_probe+0x25b/0x400 [ 110.561642][ T7599] ? __pfx_pci_device_probe+0x10/0x10 [ 110.561671][ T7599] ? kernfs_create_link+0x1bd/0x240 [ 110.561703][ T7599] ? sysfs_create_link+0x68/0xc0 [ 110.561732][ T7599] ? __pfx_pci_device_probe+0x10/0x10 [ 110.561764][ T7599] really_probe+0x241/0xa60 [ 110.561790][ T7599] __driver_probe_device+0x210/0x460 [ 110.561816][ T7599] device_driver_attach+0xd1/0x220 [ 110.561840][ T7599] bind_store+0xf4/0x190 [ 110.561873][ T7599] ? __pfx_bind_store+0x10/0x10 [ 110.561904][ T7599] drv_attr_store+0x74/0xb0 [ 110.561932][ T7599] ? __pfx_drv_attr_store+0x10/0x10 [ 110.561960][ T7599] sysfs_kf_write+0xf2/0x150 [ 110.561991][ T7599] kernfs_fop_write_iter+0x3e0/0x5f0 [ 110.562013][ T7599] ? __pfx_sysfs_kf_write+0x10/0x10 [ 110.562043][ T7599] vfs_write+0x6af/0x1050 [ 110.562070][ T7599] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 110.562096][ T7599] ? __pfx_vfs_write+0x10/0x10 [ 110.562119][ T7599] ? find_held_lock+0x2b/0x80 [ 110.562162][ T7599] ksys_write+0x12a/0x250 [ 110.562187][ T7599] ? __pfx_ksys_write+0x10/0x10 [ 110.562221][ T7599] __do_fast_syscall_32+0x13a/0x8b0 [ 110.562247][ T7599] do_fast_syscall_32+0x32/0x70 [ 110.562267][ T7599] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 110.562318][ T7599] RIP: 0023:0xf745efec [ 110.562341][ T7599] Code: Unable to access opcode bytes at 0xf745efc2. [ 110.562350][ T7599] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 110.562371][ T7599] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000740 [ 110.562384][ T7599] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 110.562396][ T7599] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 110.562408][ T7599] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 110.562421][ T7599] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 110.562450][ T7599] [ 110.562459][ T7599] ACPI Error: Could not allocate 20 bytes (20260408/nsnames-314) [ 110.716034][ T7599] i2c i2c-1: Memory type 0x07 not supported yet, not instantiating SPD [ 110.945834][ T7604] jffs2: notice: (7604) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 111.026193][ T7605] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 111.044360][ T7605] kvm: pic: non byte read [ 111.046436][ T7605] kvm: pic: level sensitive irq not supported [ 111.046684][ T7605] kvm: pic: non byte read [ 111.049317][ T7605] kvm: pic: level sensitive irq not supported [ 111.049573][ T7605] kvm: pic: non byte read [ 111.050530][ T7605] kvm: pic: level sensitive irq not supported [ 111.050892][ T7605] kvm: pic: non byte read [ 111.265158][ T7611] ip6erspan0: entered allmulticast mode [ 111.671796][ T7616] i2c i2c-1: new_device: Instantiated device isp1301 at 0x02 [ 112.097856][ T7620] netlink: 4 bytes leftover after parsing attributes in process `syz.2.507'. [ 113.777465][ T7636] ip6erspan0: entered allmulticast mode [ 113.782730][ T7638] netlink: 'syz.3.514': attribute type 1 has an invalid length. [ 113.815167][ T7638] 8021q: adding VLAN 0 to HW filter on device bond6 [ 113.838810][ T7638] bond5: (slave dummy0): Releasing active interface [ 113.843021][ T7638] bond6: (slave dummy0): making interface the new active one [ 113.845745][ T7638] bond6: (slave dummy0): Enslaving as an active interface with an up link [ 113.872704][ T5813] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 113.919157][ T7642] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 114.023954][ T7658] ------------[ cut here ]------------ [ 114.023968][ T7658] Device '1-0002' does not have a release() function, it is broken and must be fixed. See Documentation/core-api/kobject.rst. [ 114.023981][ T7658] WARNING: drivers/base/core.c:2642 at device_release+0x1da/0x270, CPU#2: syz.1.516/7658 [ 114.037123][ T7658] Modules linked in: [ 114.039620][ T7658] CPU: 2 UID: 0 PID: 7658 Comm: syz.1.516 Not tainted syzkaller #0 PREEMPT(full) [ 114.044097][ T7658] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 114.048015][ T7658] RIP: 0010:device_release+0x1dd/0x270 [ 114.050181][ T7658] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8b 6b 50 48 85 ed 74 19 e8 5d 55 a1 fb 48 8d 3d 66 96 e7 0b 48 89 ee <67> 48 0f b9 3a e9 eb fe ff ff e8 44 55 a1 fb 48 89 da 48 b8 00 00 [ 114.056965][ T7658] RSP: 0018:ffffc90007477a20 EFLAGS: 00010283 [ 114.059772][ T7658] RAX: 0000000000003f73 RBX: ffff888014f4e020 RCX: ffffc9000c4b2000 [ 114.062684][ T7658] RDX: 0000000000080000 RSI: ffff88804ee405a0 RDI: ffffffff9251e3c0 [ 114.065197][ T7658] RBP: ffff88804ee405a0 R08: 0000000000000001 R09: 0000000000000000 [ 114.067769][ T7658] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880259b1800 [ 114.070232][ T7658] R13: dffffc0000000000 R14: ffff88804ee405a0 R15: 0000000000000000 [ 114.072733][ T7658] FS: 0000000000000000(0000) GS:ffff88809594a000(0063) knlGS:00000000f5476b40 [ 114.075507][ T7658] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 114.077702][ T7658] CR2: 00000000332f6ff8 CR3: 000000006db9b000 CR4: 0000000000352ef0 [ 114.080215][ T7658] Call Trace: [ 114.081274][ T7658] [ 114.082213][ T7658] kobject_put+0x1f7/0x640 [ 114.083655][ T7658] device_unregister+0x2f/0xe0 [ 114.085156][ T7658] i2c_unregister_device+0xf5/0x270 [ 114.086845][ T7658] i2c_deregister_clients+0x255/0x460 [ 114.088705][ T7658] i2c_del_adapter+0x13a/0x2e0 [ 114.090290][ T7658] i801_remove+0xa4/0x3d0 [ 114.091867][ T7658] pci_device_remove+0xb2/0x1d0 [ 114.093448][ T7658] ? __pfx_pci_device_remove+0x10/0x10 [ 114.095184][ T7658] device_remove+0xcb/0x180 [ 114.096624][ T7658] device_release_driver_internal+0x44e/0x620 [ 114.098629][ T7658] unbind_store+0xf8/0x110 [ 114.100045][ T7658] ? __pfx_unbind_store+0x10/0x10 [ 114.101510][ T7658] drv_attr_store+0x74/0xb0 [ 114.103040][ T7658] ? __pfx_drv_attr_store+0x10/0x10 [ 114.104761][ T7658] sysfs_kf_write+0xf2/0x150 [ 114.106236][ T7658] kernfs_fop_write_iter+0x3e0/0x5f0 [ 114.107984][ T7658] ? __pfx_sysfs_kf_write+0x10/0x10 [ 114.109618][ T7658] vfs_write+0x6af/0x1050 [ 114.111002][ T7658] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 114.112856][ T7658] ? __pfx_vfs_write+0x10/0x10 [ 114.114342][ T7658] ? find_held_lock+0x2b/0x80 [ 114.115785][ T7658] ksys_write+0x12a/0x250 [ 114.117115][ T7658] ? __pfx_ksys_write+0x10/0x10 [ 114.118728][ T7658] __do_fast_syscall_32+0x13a/0x8b0 [ 114.120357][ T7658] do_fast_syscall_32+0x32/0x70 [ 114.121858][ T7658] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 114.123823][ T7658] RIP: 0023:0xf745efec [ 114.125083][ T7658] Code: Unable to access opcode bytes at 0xf745efc2. [ 114.127105][ T7658] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 114.129733][ T7658] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000580 [ 114.132252][ T7658] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 114.134767][ T7658] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 114.137341][ T7658] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 114.139827][ T7658] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 114.142303][ T7658] [ 114.143305][ T7658] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 114.145606][ T7658] CPU: 2 UID: 0 PID: 7658 Comm: syz.1.516 Not tainted syzkaller #0 PREEMPT(full) [ 114.148428][ T7658] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 114.151532][ T7658] Call Trace: [ 114.152605][ T7658] [ 114.153543][ T7658] dump_stack_lvl+0x100/0x190 [ 114.155063][ T7658] vpanic+0x553/0x970 [ 114.156327][ T7658] ? __pfx_vpanic+0x10/0x10 [ 114.157758][ T7658] panic+0xd1/0xe0 [ 114.159522][ T7658] ? __pfx_panic+0x10/0x10 [ 114.160937][ T7658] check_panic_on_warn.cold+0x19/0x34 [ 114.162614][ T7658] ? device_release+0x1da/0x270 [ 114.164144][ T7658] __warn.cold+0x191/0x318 [ 114.165550][ T7658] __report_bug+0x30f/0x440 [ 114.166994][ T7658] ? device_release+0x1da/0x270 [ 114.168527][ T7658] ? __pfx___report_bug+0x10/0x10 [ 114.170110][ T7658] ? do_raw_spin_lock+0x128/0x260 [ 114.171698][ T7658] ? find_held_lock+0x2b/0x80 [ 114.173190][ T7658] ? kobj_kset_leave+0x160/0x210 [ 114.174756][ T7658] report_bug_entry+0xe2/0x290 [ 114.176250][ T7658] ? device_release+0x1dd/0x270 [ 114.177775][ T7658] handle_bug+0x1cd/0x2a0 [ 114.179143][ T7658] exc_invalid_op+0x17/0x50 [ 114.180566][ T7658] asm_exc_invalid_op+0x1a/0x20 [ 114.182075][ T7658] RIP: 0010:device_release+0x1dd/0x270 [ 114.183791][ T7658] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8b 6b 50 48 85 ed 74 19 e8 5d 55 a1 fb 48 8d 3d 66 96 e7 0b 48 89 ee <67> 48 0f b9 3a e9 eb fe ff ff e8 44 55 a1 fb 48 89 da 48 b8 00 00 [ 114.189677][ T7658] RSP: 0018:ffffc90007477a20 EFLAGS: 00010283 [ 114.191577][ T7658] RAX: 0000000000003f73 RBX: ffff888014f4e020 RCX: ffffc9000c4b2000 [ 114.194048][ T7658] RDX: 0000000000080000 RSI: ffff88804ee405a0 RDI: ffffffff9251e3c0 [ 114.196498][ T7658] RBP: ffff88804ee405a0 R08: 0000000000000001 R09: 0000000000000000 [ 114.198947][ T7658] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880259b1800 [ 114.201390][ T7658] R13: dffffc0000000000 R14: ffff88804ee405a0 R15: 0000000000000000 [ 114.203850][ T7658] kobject_put+0x1f7/0x640 [ 114.205262][ T7658] device_unregister+0x2f/0xe0 [ 114.206773][ T7658] i2c_unregister_device+0xf5/0x270 [ 114.208406][ T7658] i2c_deregister_clients+0x255/0x460 [ 114.210092][ T7658] i2c_del_adapter+0x13a/0x2e0 [ 114.211603][ T7658] i801_remove+0xa4/0x3d0 [ 114.212969][ T7658] pci_device_remove+0xb2/0x1d0 [ 114.214514][ T7658] ? __pfx_pci_device_remove+0x10/0x10 [ 114.216218][ T7658] device_remove+0xcb/0x180 [ 114.217642][ T7658] device_release_driver_internal+0x44e/0x620 [ 114.219548][ T7658] unbind_store+0xf8/0x110 [ 114.220962][ T7658] ? __pfx_unbind_store+0x10/0x10 [ 114.222557][ T7658] drv_attr_store+0x74/0xb0 [ 114.223999][ T7658] ? __pfx_drv_attr_store+0x10/0x10 [ 114.225626][ T7658] sysfs_kf_write+0xf2/0x150 [ 114.227090][ T7658] kernfs_fop_write_iter+0x3e0/0x5f0 [ 114.228715][ T7658] ? __pfx_sysfs_kf_write+0x10/0x10 [ 114.230277][ T7658] vfs_write+0x6af/0x1050 [ 114.231598][ T7658] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 114.233369][ T7658] ? __pfx_vfs_write+0x10/0x10 [ 114.234872][ T7658] ? find_held_lock+0x2b/0x80 [ 114.236352][ T7658] ksys_write+0x12a/0x250 [ 114.237700][ T7658] ? __pfx_ksys_write+0x10/0x10 [ 114.239232][ T7658] __do_fast_syscall_32+0x13a/0x8b0 [ 114.240851][ T7658] do_fast_syscall_32+0x32/0x70 [ 114.242371][ T7658] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 114.244331][ T7658] RIP: 0023:0xf745efec [ 114.245622][ T7658] Code: Unable to access opcode bytes at 0xf745efc2. [ 114.247690][ T7658] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 114.250283][ T7658] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000580 [ 114.252733][ T7658] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 114.255197][ T7658] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 114.257647][ T7658] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 114.260115][ T7658] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 114.262606][ T7658] [ 114.264116][ T7658] Kernel Offset: disabled [ 114.265483][ T7658] Rebooting in 86400 seconds..