last executing test programs: 57.044566947s ago: executing program 2 (id=30): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=ANY=[@ANYBLOB="0000d6725321b325cadd4fdcea6ecfe023f54e2d1ee6a4b0194214b13cdb994dc5b1a5c28690c487fa8413955c", @ANYRES16=r1, @ANYBLOB="01000000000000000000010000000c0001800500020009000000"], 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, 0x0) ioctl$IOMMU_HWPT_ALLOC$NONE(0xffffffffffffffff, 0x3b89, &(0x7f0000000180)={0x28, 0x1, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(0xffffffffffffffff, 0x3b89, &(0x7f0000000200)={0x28, 0x0, 0x0, r3, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) ioctl$IOMMU_HWPT_INVALIDATE$TEST(0xffffffffffffffff, 0x3b8d, &(0x7f0000000280)={0x20, r4, &(0x7f00000002c0)=[{}], 0xdeadbeef, 0x8, 0x80000}) ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(0xffffffffffffffff, 0x3b8c, &(0x7f00000000c0)={0x30, r4, 0x0, 0x0, 0x4, 0x178, 0x4079, &(0x7f0000000040)=""/77}) r5 = socket$pppl2tp(0x18, 0x1, 0x1) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e13010042000000aaaaaaaaaa2010000000000100"], 0x16) syz_emit_vhci(&(0x7f0000000200)=ANY=[@ANYBLOB="043e0c040042000000000000000000"], 0xf) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r7, 0x11c, 0x9, &(0x7f0000000140)=""/36, &(0x7f00000001c0)=0x24) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="fc000000190001010000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a0000000000007299000000000000020000000000000801000000000000000100000044000500fc020000000000000000000000000000000000003c00000002000000ffffffff00000000000000000000000006000000040100"/176], 0xfc}, 0x1, 0x0, 0x0, 0x5575fb9d55d41c01}, 0x0) r9 = epoll_create(0x7) clock_nanosleep(0x6, 0x1, &(0x7f0000000440), &(0x7f00000005c0)) r10 = epoll_create1(0x0) r11 = epoll_create(0x7) ioctl$SIOCX25SCUDMATCHLEN(0xffffffffffffffff, 0x89e7, &(0x7f0000000780)={0xa}) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r9, &(0x7f00000004c0)) epoll_ctl$EPOLL_CTL_ADD(r11, 0x1, r10, &(0x7f0000000500)) connect$inet6(r6, &(0x7f0000000180)={0xa, 0x4e1d, 0x0, @empty, 0x61}, 0x1c) r12 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r12, &(0x7f0000000380)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4000, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1, 0xffffffff, 0x2}}, 0x2e) 56.769380307s ago: executing program 2 (id=38): r0 = socket(0xa, 0x3, 0xff) close(r0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000540)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/streaming_maxpacket\x00', 0x2, 0x0) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x309c880, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000ac0)='./dev/mtdblock0\x00', 0x48682, 0x0) r2 = openat$sndtimer(0xffffff9c, &(0x7f0000000040), 0x2) ioctl$SNDRV_TIMER_IOCTL_INFO(r2, 0x80e05411, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f00000000c0)={0x5, {{0xa, 0x4e20, 0x0, @mcast1={0xff, 0x7}, 0x9}}, {{0xa, 0x3, 0x0, @loopback}}}, 0x108) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000200)={0x5, {{0xa, 0x0, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x10}}, {{0xa, 0x0, 0x0, @remote}}}, 0xfffffe95) setsockopt$inet6_group_source_req(r5, 0x29, 0x2b, &(0x7f0000000340)={0x0, {{0xa, 0xfffc, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e20, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xfffffffe}}}, 0x104) close_range(r3, 0xffffffffffffffff, 0x0) openat$dir(0xffffff9c, &(0x7f0000000480)='./dev\x00', 0x400, 0x0) openat(r1, 0x0, 0x42, 0x1ff) 56.706457618s ago: executing program 2 (id=41): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c00000010004b0422000000000000007a000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800b00010062726964676500001c000280080004"], 0x4c}}, 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000006c0)=ANY=[@ANYBLOB="180100003600010000000000fcdbdf250701f2800c00180008ac0f0000000000140001"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc0185502, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newqdisc={0x3c, 0x24, 0xf0b, 0x0, 0x25dfdbff, {0x60, 0x0, 0x0, r5, {0x0, 0xc}, {0xffff, 0xffff}, {0x2, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}]}}]}, 0x3c}}, 0x40440c0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@gettaction={0x16c, 0x32, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@action_gd=@TCA_ACT_TAB={0x50, 0x1, [{0xc, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0x10, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x0, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0x14, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xffffffffffffff93}, @action_gd=@TCA_ACT_TAB={0x84, 0x1, [{0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x10, 0x14, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0x14, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0xa, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x200}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x10, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x14, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x78, 0x1, [{0x10, 0x1f, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0x14, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x48d}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x38000000}}, {0x10, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}]}, 0x16c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r1, 0x40806685, &(0x7f0000000240)={0x1, 0x1, 0x1000, 0xee, &(0x7f0000000000)="8cbdba9277d54534e3bfaf7e5a223005ac6fc49d54f2c1eb104469fad926f07687a54692bc918096bf9c0d65b0c6b4e140ec3502b0552b8e63860707417a83ad13451f4effda51cfccf68768e0970101369ce168b0549ebbe08a97c75653832cae75aadff87147093ea233b0cb4e067befaaec2317129bac81db2231e5158e81add42bc2576f3b205b82dc60a480de44b0a8fa62d179f3e0aaec7b2b8ad9108ca28632e3cc58d78a6c29599456077b00adda1e68affbc9448bd3c9a4a837e9f0e6fe065c185567a1a2353b68dbc255cb50124792e3b61f1e39177767f30da703f1bed2a4ecbed7a4f63b00320880", 0x86, 0x0, &(0x7f0000000100)="17b270ea773c4af7baefc4063adefb1b61ea0cc2dfd2caaa1e586ffa23ee1c80df92d51dce62db30fcde0f9f9b16e9985efec122364d07d7a9995957a1c5f98e357ea10f440d3232692b83abd5956fc4bedfc310f1c010ca3761507b905d78a6a0175fddd779d97d98a63ffc790861266cb4ef12ad2d5634d8556c44e65a89866c1b5660c161"}) 56.558487377s ago: executing program 2 (id=42): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='0x1234\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='0x5678\n', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='1234\n', 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0) mknodat$null(0xffffffffffffffff, &(0x7f00000008c0)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x103) write(r3, &(0x7f0000000400)='8\n', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0) write(r4, &(0x7f0000000480)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f) symlinkat(&(0x7f00000004c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r5, &(0x7f0000000580)='dummy_udc.0\n', 0xc) nanosleep(&(0x7f00000005c0)={0x0, 0xbebc200}, 0x0) r6 = syz_open_dev$usbfs(&(0x7f00000007c0), 0x11, 0x2) ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000640)) unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r7 = getpid() mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0) r8 = syz_pidfd_open(r7, 0x0) setns(r8, 0x24020000) syz_clone(0x38024100, 0x0, 0x0, 0x0, 0x0, 0x0) 55.90557904s ago: executing program 2 (id=44): unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = gettid() r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000280), 0x440, 0x0) preadv(r1, &(0x7f00000002c0)=[{&(0x7f0000000300)=""/4096, 0x1000}], 0x1, 0x6, 0x0) timer_create(0x0, &(0x7f0000001300)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000001340)) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602240000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x90) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000013c0)='blkio.bfq.empty_time\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000001400), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r3, 0x0) 55.536730552s ago: executing program 2 (id=47): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x67) mount$9p_virtio(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x10, &(0x7f0000000140)={'trans=virtio,', {[{@noxattr}]}}) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') read$FUSE(r0, &(0x7f0000001840)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/power/pm_freeze_timeout', 0x82, 0x0) write$FUSE_ATTR(r2, &(0x7f0000000780)={0x78, 0x0, 0x0, {0x10000, 0x2, 0x0, {0x5, 0x2, 0x9, 0x1, 0x1, 0x3, 0xffffffa5, 0x841, 0x8001, 0x2000, 0x71, 0xffffffffffffffff, 0x0, 0x1, 0x5}}}, 0x78) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f00000001c0)={0x3ffffffffffffe96, &(0x7f0000000200)=[{0x2000, 0x5}]}) r4 = add_key$keyring(&(0x7f0000000240), &(0x7f0000000280)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r5 = add_key$keyring(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000340)='asymmetric\x00', &(0x7f0000000380)) keyctl$KEYCTL_MOVE(0x1e, r4, 0xfffffffffffffffe, r5, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000001800)={0x18, 0x43, 0x107, 0x70bd2a, 0x25dfdbfc, {0x2, 0x7c}, [@nested={0x4, 0x145}]}, 0x18}, 0x1, 0x0, 0x0, 0x8}, 0x2004c000) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000003900019732a1ee3d9f9700ff12000000"], 0x14}}, 0x40800) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000003c0)='.dead\x00', &(0x7f0000000400)=@keyring={'key_or_keyring:', r5}) sendmsg$nl_generic(r0, &(0x7f00000006c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000540)={0x120, 0x16, 0x2, 0x70bd27, 0x25dfdbfb, {0x7}, [@generic="9acf2cb901e1fe506c0dcaf54e7ccbaf1d2a7d27d514f4326f4cc83d7bd30bae", @typed={0x14, 0x3d, 0x0, 0x0, @ipv6=@private0}, @typed={0x8, 0xb0, 0x0, 0x0, @u32=0x8}, @generic="4d1778411ef600aed2086a51de6a08b79ffc0b5850e930b331ce7a766605a665290ba74dae3604858ae773931dd2fdf483a45228143468f85af0550ed8b63e1608fb64d9639e3a7714c634682a451162db3e141bbc2b7167f439557cc29ff98f2ef24df1d34cd2c9c026396090d07570db6d93fe986587525ced50bc63fd69d56e514127c548aa21b5df888a76b760144c3e285616abe1d061", @typed={0x8, 0xbb, 0x0, 0x0, @pid=r1}, @typed={0x29, 0xb1, 0x0, 0x0, @binary="e3d1ac0335fcf5ca65f734bcb177912179437faf08123841f57b162dd7b3d750ecbc4fc785"}]}, 0x120}, 0x1, 0x0, 0x0, 0x44084}, 0x81) 55.457600503s ago: executing program 32 (id=47): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x67) mount$9p_virtio(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x10, &(0x7f0000000140)={'trans=virtio,', {[{@noxattr}]}}) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') read$FUSE(r0, &(0x7f0000001840)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/power/pm_freeze_timeout', 0x82, 0x0) write$FUSE_ATTR(r2, &(0x7f0000000780)={0x78, 0x0, 0x0, {0x10000, 0x2, 0x0, {0x5, 0x2, 0x9, 0x1, 0x1, 0x3, 0xffffffa5, 0x841, 0x8001, 0x2000, 0x71, 0xffffffffffffffff, 0x0, 0x1, 0x5}}}, 0x78) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f00000001c0)={0x3ffffffffffffe96, &(0x7f0000000200)=[{0x2000, 0x5}]}) r4 = add_key$keyring(&(0x7f0000000240), &(0x7f0000000280)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r5 = add_key$keyring(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000340)='asymmetric\x00', &(0x7f0000000380)) keyctl$KEYCTL_MOVE(0x1e, r4, 0xfffffffffffffffe, r5, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000001800)={0x18, 0x43, 0x107, 0x70bd2a, 0x25dfdbfc, {0x2, 0x7c}, [@nested={0x4, 0x145}]}, 0x18}, 0x1, 0x0, 0x0, 0x8}, 0x2004c000) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000003900019732a1ee3d9f9700ff12000000"], 0x14}}, 0x40800) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000003c0)='.dead\x00', &(0x7f0000000400)=@keyring={'key_or_keyring:', r5}) sendmsg$nl_generic(r0, &(0x7f00000006c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000540)={0x120, 0x16, 0x2, 0x70bd27, 0x25dfdbfb, {0x7}, [@generic="9acf2cb901e1fe506c0dcaf54e7ccbaf1d2a7d27d514f4326f4cc83d7bd30bae", @typed={0x14, 0x3d, 0x0, 0x0, @ipv6=@private0}, @typed={0x8, 0xb0, 0x0, 0x0, @u32=0x8}, @generic="4d1778411ef600aed2086a51de6a08b79ffc0b5850e930b331ce7a766605a665290ba74dae3604858ae773931dd2fdf483a45228143468f85af0550ed8b63e1608fb64d9639e3a7714c634682a451162db3e141bbc2b7167f439557cc29ff98f2ef24df1d34cd2c9c026396090d07570db6d93fe986587525ced50bc63fd69d56e514127c548aa21b5df888a76b760144c3e285616abe1d061", @typed={0x8, 0xbb, 0x0, 0x0, @pid=r1}, @typed={0x29, 0xb1, 0x0, 0x0, @binary="e3d1ac0335fcf5ca65f734bcb177912179437faf08123841f57b162dd7b3d750ecbc4fc785"}]}, 0x120}, 0x1, 0x0, 0x0, 0x44084}, 0x81) 39.159772957s ago: executing program 3 (id=174): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, 0x0, 0xf00) (async) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000080)="1611664b7c6a21892cb80dc6ea7d8704ef01634f047dd65847978eddb284017587b8042384a45673265306d58ae709af5cf03340e233c828b39fb709fd8fd77b7c83c8f44922d9087bbaeb7e6e67e0f81508c0160954f57a29094596b438ddbe2e44710caeba4f388faa1dafa7121b3ccaa9dd459bcbbdcfd0f9565feb502da23baf91c08b9a7ce764789e622088b79f2e1c41488d080d671f677089a73e463594d6c8593d3106d9ca3657bbd2ffc15cf43ecce9eb995361f4c8cd837176d99a1d7d3e55d4ee9ba52d24067a72a635e6b30246ed4fcb49701574a8d3a85ddd72866c87241853799d25dbc4259e59b3947a82d0dadb248868d42f832b1252163f") (async, rerun: 32) write(r0, &(0x7f0000000200)='transport=loop,nqn=nqn.2014-08.org.nvmexpress.discovery', 0x37) (rerun: 32) 38.260449232s ago: executing program 3 (id=181): r0 = syz_open_dev$swradio(&(0x7f0000000380), 0x0, 0x2) r1 = dup(r0) read(r1, &(0x7f00000003c0), 0x0) syz_usb_connect(0x0, 0x371, &(0x7f0000000840)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd010203010902"], 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000a80)={0x1, &(0x7f0000000ac0)=[{0x6, 0x0, 0xfe, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x2000000) 37.097530584s ago: executing program 3 (id=192): r0 = gettid() r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/psched\x00') lseek(r1, 0x2000, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) mkdir(&(0x7f00000002c0)='./file0\x00', 0x48) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000100)='./file0\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) pwritev2(r2, &(0x7f0000001c40)=[{&(0x7f0000000540)="be", 0x1}], 0x1, 0x0, 0xa, 0x14) 36.23815026s ago: executing program 3 (id=194): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) mknodat$loop(0xffffffffffffffff, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x178) mount(&(0x7f0000000040)=@filename='mtd0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000100)='./file0\x00') lremovexattr(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)=@known='trusted.overlay.impure\x00') 36.034916236s ago: executing program 3 (id=195): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x20, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41000, 0xe, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mprotect(&(0x7f00000df000/0x2000)=nil, 0x2000, 0x5) mkdirat(0xffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x8000, 0x0) (async) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x8000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) mknodat$null(r0, &(0x7f0000000140)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x4, 0x103) (async) mknodat$null(r0, &(0x7f0000000140)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x4, 0x103) socket$rds(0x15, 0x5, 0x0) (async) socket$rds(0x15, 0x5, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302) (async) ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000180)='\x00', &(0x7f00000001c0)='./sys/bus/i2c/devices/i2c-0/new_device\x00', r0) getpid() (async) r2 = getpid() sched_setscheduler(r2, 0x2, 0x0) (async) sched_setscheduler(r2, 0x2, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, 0x0, 0x24000808) write(r0, &(0x7f0000000100)='isp1301 0x2', 0xb) syz_clone3(&(0x7f0000000380)={0x85000000, 0x0, 0x0, 0x0, {0x37}, 0x0, 0x0, 0x0, 0x0}, 0x58) 35.930387899s ago: executing program 3 (id=197): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_NAME={0xa, 0x1, 'owner\x00'}, @NFTA_MATCH_INFO={0x18, 0x3, "000000000000000000000000ffff000002000000"}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf0}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) r1 = socket$inet(0x2, 0x2, 0x11) sendto$inet(r1, &(0x7f00000003c0)="1234", 0x4, 0x0, &(0x7f0000000400)={0x2, 0x1234, @local}, 0x10) r2 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="0d01000009000008250592d20700006a3b010902241700fa0074980904e4ff11070103000905010200ffe0000009058202", @ANYRES32], 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_raw(r3, &(0x7f00000000c0)={0x1d, r4}, 0x10) setsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f0000000100)=0x1, 0x4) sendmsg$can_raw(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@can={{0x4, 0x0, 0x0, 0x1}, 0x3, 0x1}, 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x40040) syz_usb_control_io(r2, 0x0, &(0x7f0000000200)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x3000000) 20.922791671s ago: executing program 33 (id=197): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_NAME={0xa, 0x1, 'owner\x00'}, @NFTA_MATCH_INFO={0x18, 0x3, "000000000000000000000000ffff000002000000"}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf0}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) r1 = socket$inet(0x2, 0x2, 0x11) sendto$inet(r1, &(0x7f00000003c0)="1234", 0x4, 0x0, &(0x7f0000000400)={0x2, 0x1234, @local}, 0x10) r2 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="0d01000009000008250592d20700006a3b010902241700fa0074980904e4ff11070103000905010200ffe0000009058202", @ANYRES32], 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_raw(r3, &(0x7f00000000c0)={0x1d, r4}, 0x10) setsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f0000000100)=0x1, 0x4) sendmsg$can_raw(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@can={{0x4, 0x0, 0x0, 0x1}, 0x3, 0x1}, 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x40040) syz_usb_control_io(r2, 0x0, &(0x7f0000000200)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x3000000) 4.029640622s ago: executing program 4 (id=406): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000840)={'wlan0\x00', 0x0}) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') memfd_create(&(0x7f0000000240)='nl80211\x00', 0x1) read$eventfd(r3, &(0x7f0000000040), 0x51) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, &(0x7f00000000c0)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r4, 0xc01064b5, &(0x7f0000000100)={&(0x7f0000000140)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r4, 0xc02064b6, &(0x7f0000000180)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r4, 0xc02064b9, &(0x7f00000001c0)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240), 0x3, r6}) ioctl$DRM_IOCTL_MODE_ATOMIC(r4, 0xc03864bc, &(0x7f0000000280)={0x401, 0x1, &(0x7f00000002c0)=[r6], &(0x7f0000000300)=[0x3], &(0x7f0000000340)=[r7], &(0x7f0000000380), 0x0, 0xffffffffffffffff}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000a80)={0x44, r1, 0x1, 0x70bd2a, 0x1, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_AUTH_TYPE={0x8}, @key_params=[@NL80211_ATTR_MAC={0xa, 0x6, @device_b}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040040}, 0x0) 3.920283081s ago: executing program 4 (id=407): r0 = socket(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x1}, 0xc) write(r0, &(0x7f0000000100)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) connect$netlink(r0, &(0x7f0000000140)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f00000001c0)=0x10, 0x4) write(r0, &(0x7f0000000200)='\"', 0x1) recvmmsg(r0, &(0x7f0000000240), 0x3ffffffffffff81, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) listen(r1, 0x7fffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000280)={0x2, &(0x7f00000002c0)=[{0x20, 0x18, 0x9, 0xfffff00c}, {0x6, 0xff, 0x7}]}, 0x8) sendmmsg$inet(r2, &(0x7f0000000300)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)="2a73ed35", 0x4}], 0x1}}], 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000003c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@bridge_newneigh={0x30, 0x1c, 0x114236db3b607435, 0x70bd28, 0x25dfd3fe, {0x2, 0x0, 0x0, r4, 0x40, 0x80, 0x4}, [@NDA_DST_IPV4={0x8, 0x1, @empty}, @NDA_LLADDR={0xa, 0x2, @random="fa74cb111784"}]}, 0x30}, 0x1, 0x0, 0x0, 0x200040c0}, 0x40080c0) 3.277574607s ago: executing program 1 (id=411): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x27, 0x803, 0x0) openat$proc_mixer(0xffffff9c, &(0x7f0000000380)='/proc/asound/card1/oss_mixer\x00', 0x402400, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) mkdir(&(0x7f00000002c0)='./cgroup/../file0\x00', 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000280), &(0x7f0000000300)=0x4) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=@setneightbl={0x28, 0x43, 0x200, 0x70bd29, 0x25dfdbff, {0x7}, [@NDTA_PARMS={0x4}, @NDTA_PARMS={0x10, 0x6, 0x0, 0x1, [@NDTPA_DELAY_PROBE_TIME={0xc, 0x7, 0x9}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40040}, 0x4044) sendto$packet(r1, &(0x7f0000000140)="c986ad469f771e71178db20847613167bbbe552697cbfdab1703293512a81bf31f09e9af0dea8babdb7d760de58c16663a426e15e73a80e78c0a9ae58704c380cfaf20c309e8338390a7f7531cfed26075a5486585345bed7a359aa261714acfb22b8a4c6d907d36f4f5959e90627c8c22938f4ce24c1ae0b20a95458cc65d60b55a9fbf3fb4f5109f15b728365cf40dd8cc5faabf9e248c8590dd15b0f676ced38df1840c9fe1d25a3e8054454029", 0xaf, 0x40, &(0x7f0000000200)={0x11, 0x1, r2, 0x1, 0x1, 0x6, @multicast}, 0x14) 3.204787115s ago: executing program 1 (id=412): r0 = syz_open_dev$cec(&(0x7f0000000280), 0x0, 0x0) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) (fail_nth: 4) ioctl$CEC_S_MODE(r0, 0x40046109, &(0x7f00000002c0)=0xd0) 3.098542025s ago: executing program 1 (id=413): sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x40000) r0 = getpid() r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r1, &(0x7f0000000040)='\x00', 0x1, 0x1be) pwrite64(r1, &(0x7f0000000080)="01", 0x1, 0x18) r2 = openat$binderfs(0xffffff9c, &(0x7f0000000400)='./binderfs/binder0\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x100) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000780)={0x1, &(0x7f00000007c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r4 = fanotify_init(0x200, 0x0) fanotify_mark(r4, 0x1, 0x8000000, r3, 0x0) mount(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='devtmpfs\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r6, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000700)='\x00', 0x1}], 0x1}, 0x49cf75490397e68f) recvmsg$unix(r5, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x41) mount$tmpfs(0x0, &(0x7f00000004c0)='./file0\x00', 0x0, 0x21, &(0x7f0000000a00)=ANY=[@ANYBLOB="75937271756f74615f626c6f6306089e0100646c0a2ac302696d69743d312c00"]) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000280)={0x73622a85, 0x1100}) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f0000000340)=[@acquire]}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="680000001000010400000000000000f4ebff010000000000000023a64b17609097e9aa3c9073bc00030073797a6b616c6c6572300000340012800a00010076786c61000000002400028008000b000000020000"], 0x68}}, 0x8810) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000380)={0x20, 0x0, &(0x7f00000003c0)=[@request_death={0x400c630e, 0x0, 0x200000000000}, @clear_death]}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f0000000100)={{0x2, 0x2, 0x4, 0x4af, 'syz0\x00', 0x2}, 0x6, 0x2, 0x10000, r0, 0x1, 0x4, 'syz0\x00', &(0x7f00000000c0)=['-\\:\\:(!\x00'], 0x8}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(r9, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r10, @ANYBLOB="8b332abd7000000000000500000008000300", @ANYRES32=0x0, @ANYBLOB="ba9bed9e03a951dbf00f60533b19ae7089c202f7c448cf43a35d643208b34be6faf0a167bf161be6d4ee25a15a7d209abe8d06eeb1e72ccd003e3618216dc35ca549d737ee242362e4ab0ac5001bea13725b373e2d6ce3426bda7055494fadee590ce675d9833bfda0119ef380d22e848f7ed1d1241553fe2dc6071a96d7802f9106867d534cc1c9b28ef31869fd3cafa61c5a3f215b2c2cd6134bb1d5054e2bf9ebabee796b46e4795b9741f6877a7ba9f1f1c176932dce85d6384275f0d894c03b32a7c328475795edca53f2bb9420d50d5217918f12a0"], 0x1c}}, 0x24000000) syz_emit_ethernet(0x46, &(0x7f0000000b80)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd6060624000102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa11000001", @ANYRESOCT, @ANYBLOB="23c98799e4b8608d25e8bf87398dc224aae2940c22a12f54484e55317a58b4004fa6009a7916813d88a14e6f262609b55d58a633b1027f7f32bdd5faf58135bbfc8eac61eaf216dbbad563ece75b91d23d4d617d51704f35d42a8ef579bbc1", @ANYRES8=r0, @ANYRES16=r7, @ANYRES64=r5, @ANYRES64=r1, @ANYRESDEC=0x0, @ANYRESDEC=r4, @ANYRESOCT=r0], 0x0) preadv(r7, &(0x7f0000000640), 0x0, 0x3, 0x5) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000940)={0x11, 0x3, &(0x7f0000000a00)=ANY=[], &(0x7f0000000a40)='GPL\x00', 0x2, 0xaf, &(0x7f0000000a80)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000b40)={0x6, 0x87}, 0x0) 3.057934705s ago: executing program 1 (id=414): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x8010) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, 0x0, 0x20004084) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$inet6(0xa, 0x4, 0x1) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$netlink(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r4, &(0x7f0000000500)={0x0, 0x4500, &(0x7f0000000540)={&(0x7f0000000580)={0x34, r5, 0x1, 0x0, 0x25dfdbff, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x24004804) 2.090191992s ago: executing program 5 (id=415): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_usb_connect(0x0, 0x45, 0x0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:02.0/rom\x00', 0x2, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), r3) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000008c0)={&(0x7f00000007c0)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x4005}, 0x81) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) setns(0xc9, 0x0) r6 = socket(0x2a, 0x2, 0x9) bind$inet(r6, &(0x7f00000003c0)={0x2a, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="3c0000df070085e7ffffff801b00082b33cb18692d463c0f00f0ffff00007fb4d9c9e9e8510f33ea72b93415ed93555ad7f11b20711947dbf8050a", @ANYRESHEX=r1, @ANYRESDEC, @ANYRES16=r4], 0x3c}, 0x1, 0x0, 0x0, 0x20048800}, 0x20044000) sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYRES64=r2, @ANYRES16=r0, @ANYRES64, @ANYRES32=r5, @ANYRESDEC=r4], 0x3c}, 0x1, 0x0, 0x0, 0x44851}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000640)='./gadget\x00', &(0x7f0000000680)='gadgetfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r8, &(0x7f0000000700)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000480)=r1, 0x4) write$UHID_GET_REPORT_REPLY(r8, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000500)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES8=r4, @ANYBLOB="a42804a68f715673de38f54178c90400000000001400350064756d6d79300000000000000000000008000a00", @ANYRESOCT=r2, @ANYBLOB], 0x3c}}, 0x8000) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f00000005c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) connect$unix(r1, &(0x7f0000000000)=@abs={0x1}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) 2.086328339s ago: executing program 4 (id=416): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x600) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000040)={0x3, 0x3, 0x4, 0x1}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000ec0)={'syz0\x00', {0x0, 0x0, 0xfffc, 0x4}, 0x0, [0x9faf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x4, 0xfeffffff, 0x0, 0x0, 0xffff, 0x1, 0x0, 0x0, 0x20000000, 0x0, 0x4, 0x0, 0x6, 0x8, 0x7fff, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28000000, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffffffc, 0x3, 0x0, 0x401, 0x0, 0xffffffff, 0xdc, 0xa, 0x0, 0x2d52c0], [0x0, 0x1, 0x2, 0xb16, 0x0, 0xffffffcb, 0x0, 0x0, 0x0, 0x2000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x9, 0x0, 0x0, 0xfffffffd, 0xfffffffe, 0x0, 0x0, 0x10, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0x1000, 0x0, 0xf, 0xff, 0x2000002, 0x0, 0x0, 0x0, 0xfffffffe, 0x20000100, 0x1, 0x0, 0x0, 0x66bd, 0x0, 0xfefffffd, 0x1, 0x8, 0xd77, 0x0, 0x0, 0xfffff37a, 0x0, 0x0, 0x9bd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf, 0x0, 0x2], [0x8, 0xa, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x9, 0x0, 0x7, 0x20000, 0xfffffffd, 0x2, 0xe, 0xffff, 0x0, 0x0, 0xffffff7f, 0x9, 0x0, 0x0, 0x0, 0x9, 0x0, 0x2, 0xf, 0x0, 0xd12, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x1000001, 0x8000000, 0x403, 0x0, 0x0, 0x0, 0x80, 0x8, 0x0, 0x7, 0xca, 0x0, 0xfffffffe, 0x4], [0x0, 0xfffffffc, 0xfffffffc, 0xc, 0x6, 0x0, 0x7, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x3, 0x2, 0x0, 0xe, 0x4000000, 0x0, 0x0, 0x8d, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffeffff, 0x1fd, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffd, 0x7fd, 0x0, 0x40002, 0x2, 0x0, 0x0, 0x6, 0x0, 0x401, 0x100000, 0x4, 0x10000, 0x0, 0x0, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x40]}, 0x45c) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1ffffc, 0xb66, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0xa546) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', r5, 0x4, 0x0, 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x3a}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x80, 0x0, 0x1, 0x1}}) add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r6 = syz_io_uring_setup(0x34b8, &(0x7f0000000780)={0x0, 0x2730, 0x800, 0x1, 0x149}, &(0x7f0000000800)=0x0, &(0x7f0000000840)=0x0, &(0x7f0000000880)=0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000900)=[{0x0}, {&(0x7f0000000980)=""/250, 0xfa}], 0x2}}], 0x1, 0x34000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000a80)='./mnt\x00', 0x1ff) mount(&(0x7f0000000ac0)=@filename='127.0.0.1:/\x00', &(0x7f0000000b00)='./mnt\x00', &(0x7f0000000b40)='nfs\x00', 0x0, &(0x7f0000000b80)='nolock,v3,addr=127.0.0.1\x00') ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000bc0)={0x30, 0x0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) setxattr(0x0, &(0x7f0000000c00)=@known='trusted.overlay.redirect\x00', 0x0, 0x0, 0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f0000000c40)=@IORING_OP_CLOSE={0x13, 0x49, 0x0, r6}) mmap(&(0x7f00002c5000/0x1000)=nil, 0x1000, 0x300000a, 0x4031, r4, 0xd696b000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000cc0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r11, 0x1, 0x1a, &(0x7f0000000d00)={0x3, &(0x7f0000000d40)=[{0x20, 0xc, 0x77, 0xfffff024}, {0x28}, {0x6, 0x0, 0x0, 0x2}]}, 0x8) sendmmsg(r10, &(0x7f0000000d80), 0x400000000000159, 0x40840) openat(0xffffffffffffffff, &(0x7f0000000dc0)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) 1.859963257s ago: executing program 0 (id=419): mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) syz_open_dev$vim2m(&(0x7f00000001c0), 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x4) socket$nl_generic(0x10, 0x3, 0x10) landlock_create_ruleset(&(0x7f0000000200)={0x40, 0x1, 0x3}, 0x18, 0x1) r0 = openat$kvm(0xffffff9c, &(0x7f0000000240), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0xc008ae88, &(0x7f00000002c0)={0x1, 0x0, [{0x40000095, 0x0, 0xfffffffffffffffd}]}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000300)={0xffffffffffffffff, 0xc8, 0x3}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000340)={0x3, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000580)={[0x67c, 0x6, 0xf3b8, 0xfffffffffffffffe, 0x1000, 0x400, 0x4002004c4, 0x8, 0x0, 0x2000000097, 0x10, 0x0, 0x5, 0x4, 0x0, 0x8], 0xeeee8000, 0x402}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000640)) ioctl$KVM_RUN(r2, 0xae80, 0x0) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/tty/ttyS1/console\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f0000000140), 0x12) r7 = syz_io_uring_setup(0xf03, &(0x7f0000000380)={0x0, 0x2944, 0x80, 0x0, 0x51}, &(0x7f0000000400)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000480)=0x0) r11 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f00000004c0)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, r11, 0x0, 0x0, 0x0, 0x100}) io_uring_enter(r7, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 1.833384709s ago: executing program 1 (id=420): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000540)={0x1, &(0x7f0000000580)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f00000005c0), 0xa2003, 0x0) r2 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r2, &(0x7f0000000000)={&(0x7f0000000040)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x2f}}, 0x10, 0x0}, 0x340060c1) setsockopt$sock_int(r2, 0x1, 0x9, &(0x7f0000000080), 0x4) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000600)={0x20004, r0, 0x2}) r4 = syz_open_dev$dri(&(0x7f0000000640), 0x1ff, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000680)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_GEM_FLINK(r4, 0xc008640a, &(0x7f00000006c0)={r5}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000700)={0x1, &(0x7f0000000740)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r6, 0xffffffffffffffff, 0x0) 1.720179444s ago: executing program 1 (id=421): r0 = syz_open_dev$video4linux(&(0x7f0000000040), 0x7, 0x0) ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r0, 0xc0305616, &(0x7f0000000080)={0x0, {0x0, 0xfffffff7}}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000880)=@raw={'raw\x00', 0x3c1, 0x3, 0x304, 0x224, 0x940c, 0x3002, 0x224, 0x2c0, 0x330, 0x3d8, 0x3d8, 0x330, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0xe8, 0x130, 0x0, {}, [@common=@unspec=@nfacct={{0x44}, {'syz1\x00', 0x8}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@remote, 'virt_wifi0\x00'}}}, {{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00', [0x0, 0x0, 0xff000000, 0xff], [0xffffff00, 0xffffff00, 0xff000000, 0xffffffff], 'bond_slave_1\x00', 'vxcan1\x00', {0xff}, {}, 0x886215f4d37bb4bb, 0x90, 0x1, 0x69}, 0x0, 0xa4, 0x10c}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1d, 0x0, 0x0, 0x0, 'syz1\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x360) mkdir(0x0, 0x0) mount(&(0x7f0000000280)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000340)='./bus\x00', &(0x7f00000003c0)='exfat\x00', 0x8080, &(0x7f0000000440)='discard') syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x28102) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f0000000400)=0x200) write$dsp(r3, &(0x7f00000005c0)="5cba91a4", 0xffffffd9) 1.589619829s ago: executing program 4 (id=422): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f000000850000"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x5}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x64}}, 0x0) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$sequencer(0xffffff9c, &(0x7f0000000440), 0x4040, 0x0) syz_fuse_handle_req(r3, 0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x50, 0x0, 0xfff, {0x7, 0x29, 0xcf940281, 0xa00010, 0x1, 0x3a76, 0x10, 0x1801, 0x0, 0x0, 0x2, 0x2000009e}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r3, &(0x7f00000042c0)="0d9ec529eb18ec94a35378619cb10ff8c913f67139447b7ee0cca809e36c363ba1d3975a7446b70c6bdd99e2cff540eda7589ea89efeb498df568916036f0848ede5f089bf502b483c67c0432c34b98b1bc085a99e2981103397e0b0eed2ec64c1075798b56a42ea532091f5326c97622a47c53fbf42e71c3ed4b954c559424b49a13598c6c63ef65b62384b038b3e6e98ebecd178289831eaecd986a01c751e8cca7a57c009f2b5310fe9dd8a63b91c4b5b13d1c44d2b874b32ae3e961b9e96a511ffaa3ed20248dfb470460d305e44ffcd287b355380319fd31f7538c6d00de06ddb8f72b3a59c4699c94d7379e1e190c6dd7786e12096f9e963a038b6b4375535047135ecc07b16035ceeb27ed09d77f52b6eae27a03071e060b05bf347b9ba44a984e5db346d230ae9c5324ecfd4e7725bc5019a9f4d20237c820359d73b82f9c668ae71f6b85d5350140a16f988bb2b8010effb52636e0b728be1b1ed37c1b8868ec67edd52951dbf65b479aa25e92667a98c755d88995e6303a48a64317bd4b201fc6dea59381abfb5e0fb1035bbd32a97a6324b08f404fe3991879a0c6362032864031737941d9cc534697da61a43c8723ecd1062906b65c504d86383cdf9631f228372b13aee64f8ea8db00dffc37fa092ab5daeb7431dab37091c44f91c9202df60876a6e06ceee3e6a095406fe5cc1f83de1a4adf36fbef5a94a622132cc85e56fb53a9cff67bc69a24d8c259ccfe19b1925061f0cad95d6b4158c1394b8acfa9a8f52a566c6cb4e0b14dd30c85b309289a5f395e01d981735f6fce6ab30994643d70b2f322b7a233a339e621ea2eb00a0082a175c231b330a58062680546c28db8ff5b7e66c0e3df0a9b74ab72abfd241fcbe1e3d27a2d1eab44cf88180dcef4482c866324133f9e4780b891a7c5000b005cab0c131c225e944fd1aab5de9e8d17b8770b4472b6e4a13b6cce90ba152e5144acf74cd8a9821ce3eae72dc7ddc81b76482226098329c3a8ecb923822610aa0b086f44329522dd8f9ae355b4666d1a10911ef8e21377578b42fe6ee0b2a77917157488d6e0bb388951f80551dcaebf212b396d1f922aec595bd340390d310f6006c4b3efdd80838f39d25470db39d6205ba8f52bac634f8145a3c10ed007acc2f25c5dbfe911f18f44a0c57cee33725eb8c5f2d9112f91787c2c323b67b67d9d1f593f16430d77189d4678fd8d7c11c1f2d744ad59a03a8cffc52ee0293c90b00d61897c80184aa63fcf43c109b06af20c808035af0a0bf9cbe544681768f92a2ebe3b4458dd020fb0550822bc2f769631e00d63bd91e7100299bbc4ce53a35e993e24028dc5c81d46f5377d21f2f38a9688ed981044346b865161b68f3390a50c2e625052396cdb6637e9434904c63d8ca45aa2325626293cdd9cd0179b1d995be10281fa8d281db16320f520e42af268ff30dc2d8885aa3d9e7f294eadb4d827d195cd5d18632928f2153261345c231efd143288b881638b61dc5dab8114c1948d83b8ac4e278f131ec3eef4e87e43a36f4b41a699a741ef3a7cd4f0bc5dbd2dffb1d223a5c5b38b98e49092631a176d15c4f3c077d639726a3482bf2fdc73c2bdb09208aaf90bc64b5fee89d231bb1679de3e5d31662db2c5824ce9941f94500e5a11b8fe79da548efed8cc44e9bc1d5175dd77fc16f8219a83b83ccce2181bf411b0945312598817e08e5277530eccffff17d198613cc8c991349141ced56e79031ab6cb98f3f39e5f20bac76017083041a1ee99ca257d0e0cf95e59617139afb08cf0c6a607d3f2ac2b5d3f4394a4a063c9769bb884ec522d46138228c7e9b5c7ea5e3a6c70815b565ce15a13fd0a5deb28e710c15fe25c744b430b4f6482532fb96566381c56e12632cab5acb5e08d6f973003c96a7d81ff76966e0f93c83c462bfcef230939e48c4983bfed78f68b0f540d1fff2196cbd1f1c1a1c310ec10f5a2745407000bc6db1fcc8540282cc7e96cf5582c4eaf874a2fe6369534176429b7505eb0aade883260806be2d86a42e76b315a76e5f686ca669f49e1f9054a77b8eaff14a43e9a9801244e8e94ff50a17b60dee0122ea70819bae3375070466c7f202c4ea0fc0c9aaae50c43cb65febea224c2b554e937f67689b3e18ed543749a7ef0997a7a7530b918c4ef935137137e1ee7e6a8919fb76a8f008ddcc2d8b2e18f3eb90f7a13cf4f49170ccf50c75de82e92a5e2d1f311e59071ff202b6cae4d6243fc3787cb9fbd401938cc18dcf5620f8b8f74e9e3b13dcde85ef896f31f5a2458118addae77206ab1506882f91873b4828950a7b91ddae74888155a9c486c7c60492813ac0e33362dc4e21e00538e5b05b78271d82486a0d156d4a5a07085bb1cd74f5d63763f18648a489352b5d05107909fe54b5d332cde2900c82c150b11071e028eeb275cc9a9614f1eda4e4830b128870e732d473100c24152aff2aa1659daa65d7e9591ebfcae5dca4e84c9a0965a01668e59843ef4a093d9b01067a0ae9d09e3d810c2cb63600ee05b10fc8685e8cb150e2d6d75baecfb8762f7a7d131417eb0721e19e1d21f5adcc1e09489f06b81d91b48608107fc7b3853e214a3c786a9812113ccbcf09907506d0e9cd72c79793584b4fe06a18a627bd969f628a5936367961f1e7d117d03a8fabc85f5ecdd0ddcfae49aa293893a2e5ae376be11031abc0e05ff250b35926345b52f8d3dc02b7497f7513e759247353db9b8e493120e73981aef4c4d9747621537a089848754c14cda1cad18084274e98ea2bf7400ca846184e0e31a571f9bd770222b1038a4ce60dcf8fe9cca4d60048cc29c37c1345de992e9dc7128ef093c1ce80232a88a3da7ae8bc87120c5b1f405d5186141288998fed9e021cd0ad6b12b51c217849390be3ea00cbd6c755958140bfb9b2a2765ad1f51ac045fdc5c28ee5886b1436015b88bd90d19328f91394110b0d891678e63b63d6cc4d35279f6f616d7692c6fe177a79d80ae8f7e4ad5078d8d7096f3ee664dcdb2f634eba98f4788de1f5e34f32ef09e2f0aee4fdc5bec4bc4aeec5721ac3a2da1bf52da017c3312095403d50dcde39671242b610f13132773796557f71455376a7741ab242a9fc94464180bf224d5e8c79b462e3a816f6c08ab0f5503386d34ddfd808b4b8d5d333548d4b873923c6c297b2fa1abe433ec9264385c50dca40316c37ed85db382e7c853ba331c727043cb3345de9f89b1c804e98205eda3d6b6e042c9c41877d456dcb8f12663e6dc1ba809229536fbcc4c58d01a137eb80af8596dfc7b5fa7a044cd141238aa82e440526e55a28c4ed2f4b26157a0eebb4a77c5ab66fcce2602e1a70aea07e5e7e7e5321d58ad128a5ea6b574730037f24a7300e0ad6fc96bd18e03763bbbf21bd3c388aff1cc5ea13728ba2f8e1eb70148d2603e55bb01cce0763c2020b5627a0ccb35ae3a9b3df380e6d9800d9506219a90971a3b8bde1dae6a43fce2aaecbc026be8f4e9bd749e10c87ed7d78f92014342fa449eef28e7175548e5a8ec4fe7d31fc86737aee63ef40b54485380b6898161676f0d82f76113b12a529fbce4482dd278a90aa416077c677aea623ddb3761bc81527ab7e3d73a3b4c8c3e4352c7c083cee8953ebd972a83caed837587e8d7cf360f28ce6ca71de75c9174e8744ba1098513bb6c7fdc6a3c7c8e5870223d6cc0b18b5d6edea926d5376aeb85488d3712e8f67128f0d3fb2b42f82363a0d4c1c806ff283f6e4ddc10ce4a0803be66a247207d6606c7dd67cd293dada159016d7fd7e88c4df53d09bdd9fd9fa3c732da45fb92bdf6f442eda15edd97bf1928a7699008f0b482240a684ff5efef0cadbf1b4f16888650d59b2bdaeae0d1112a79c5522dd0933ccc16fed7cd0ccabe929f625de8947b3b1532dc04253cca988a1584df2b31492b19410d6f681d614eaa20029592c00c948a98973a9fba87f1397f8859ba543edeb5c0b0db92f65462a1103947d780b539433332d65bd1418bc00c9e815f73e0cc0aca5fcc9f95f707c455013a55a0c4a29093b05b94edc5b5284ec7ccf3ec091002b4229036c174e2927127f40769ece890612bbeb960d9392f442765a2ca8990c52ad7d4441e975a7cf079d139945f2b2a8a34f0e85d76cbc96efbb52cf8b5ae681234e14b6648244d41cfee2d9b189cd831cc2f31ae7e5f11aaaff1629f8c2cf73494ac38e58da7010dd986f8b6134ee0dabfdcb30617d15720cffbec7651f22253aea21696d2ece4fe026543ea2f3473e4c12e65dbb3cbf764ffa0b3a396382b9b7f0c24eaaf3495554b2319b66f3cabf01a8d6cfd1382d94ab71cd11eae2a42e4dc841d4a9732c395688d3377c8ccff7e3f88a3129855a5f41a7de6b6a9ac40a87c288f4821295edfc4f5b8fe5a1fc0162e9820205c809935cc6047e8a835c651be02fb41c21de30ac770d7a7f2108c6a3f1cf2649cac444f028a6ebf4db422cbbdb7fd0cb39109a3130ffae17810bb58f5c557c99670224c2678fa07f1064911e6c665c0d1c26cd2f40f7089789208a48eb339bb8885910e035b4b8c69b1c3ad79270ac6e70b963493a6628b90501822878cdfac866268d914d8af2814612b0198f9e4c6b48e739e414d61f34e2f69ff7cdc4fc7ffe45a64c5faf191ef6c4e31cecebe09a2f6a63d60926ebaa7e925ccea5c93e403c7ec0ee55423ce4893471440006d4c09c141e489dda5577f73b57ecfc764ee5bc1bc88f7866dc6a494e3ee560c956dc12ae51842030251f1cedf2caca15549d0bb4ee3bef03702197350cd7586b5916ef6a0abcb5f30548d22ce5d8c4dbd82030b8d7b5481c51676b7d14d35c20346c74dcc7d96ea0b13f890f755a219993e88739da8246283ebbd82eb1b15956b5ec16ad523768c19ceba9199f97d7bb43b85fa11349ff7fb89a97b463b34c584ae9e2af6c8f20ab528750a22ff6c2297e400065fbd9a4660ec2c658afff6db9b67070352d2aa5e6cfe534eeb5ff271575b828dfd7f537e3627a1a6419ed0c84297fc3d362a52f3860a2eb7ae0a50f06d3c68c4a1463ec331ead7af2dba792332218b04d5b585de1a471d296df6e10316852d50f211e07643f749a1d75410e66e47db40bfcefe4b708d0b2879a50ccbd85939b89fe4b905a6a89a2d5a4e28d18c048e66108a06d8b6a64ec5737b5ae283d914484167c8ac7dde7ec007aad1999854c4d6a0e5f887f99de3662610d5e8d49bac7d41d6fb7d90b4b04939638e2151ba67e75362aded50edfb7d9919b345b5b7df6a909193ce64b20470e3480c68bd764968f4d8a5779ffd9a35e58558272a214ae26a094360b9f2ec97c5e0a7693f4b7509b962cd8537e90ce7be70b54e9531e7295f894b94566df49c50c2265842392dff50e17ed3f7beb9ba4ad0520a73db1d8d3b39759e7fffcbf26517316bc74437fef944fc915ec24affc1a53748cfc883e3ddea9e25063ea8383b06f0d5c9db13a0ff335f52699226b391543060ae5e2c25b585b9efdd5ff9495a4873cac58b5feff5f08717b04e81bfea349accc58fcc6a6505de3aa6ff4985d9c38bb83e8daa663ccb356df3ed52343ed7723687e416816f987c565eae22c7548c1d6b56a5b6819583da0ddf92739f65e604e37b3275a6cb1252d4ef7a515c4b1e9068d714be80066bf0d422f1e4d2ce6f95c9eac081d6e4596a6a8e16a57b732b575b7de16f176ff0e34e84b293d3fd77fa30a7b7cf12a1edd54170e56bf7f2d40620ad56acbc5cc615556300ff9e95ce3dda93c8333f23f0d97a5da12a0fe58f95d6b911f614563d343ac6e4f9fee1d149c94fc75a97ac839b6d8d7b27c5efb870d2bfc6dbe6b688490b23597d83982d7858215c59011042b1957a0b386842621c72f89a9b524008794ffa0c179753ab48d0f73e5ff13624b3b90287edaf6a5367dcfe4094a21ffad3e881b428b77ccac6924d5bde9c781d4189654d8f29885fbde070a004c6406dd3ece359c6ac7c6147f5c4906e56764e9980a669bfdddd9eb780e7f9988630d1eb098b3e4fd4c795f11441fb6d0ff7cf086eb291b1ec8d90092e1eaf9722ccdcd15408617cdb8c49043bf71a6ea0ee6b7e840344fbcd377b995bfb1faf22754fcb363f6c630501b619bbd87cc13d5df0948a176771d2d69236eb50dd313817d9687967e7d71f854db6bff803f4501d999dfe3da37ccfdf894a7914c4c113fa7a18c3468a52d646a5070614a6f02b7ff21c9f6927f5de55be85ba815f4bb9e29f26a94423c58338947c804e0627d69bc5a6e93fc5fe8cae851700253f2d494622c6127b4d77bf54a1ac27957234628cbe2fea1729ec53be7d90806d510ccddfd76fab1b9bf1207db8b05c3eaa88fa4c0a5db13cec9310f4e02c1d8114705446fd6649df3829aa12786b8d10b4540d8c1f1c8208c4b41998435e3fa1ec5199cb2d3d0c5c04c5e0b3ffd69112252106bb39333ff23b38d167a9b45ad1bdabf434c8695e2676d461b34c5f048e70b67a44d824baa090c8be13a22ef0d0970cc7a94ed4b77bfc3a40427c6c11abd2b415817243f6801d535a3adc9924a1671b645100e822a0c1876a37d9c9e230e3d762f1cfbb89a8b28255ba4cc5b46cb1635cf185578fa068b68bac93991982b48e7faacc09745a7e33bb12de6b25a2342a7e03cff06dde29b4d05de84e56c78fc6d9dcd180438da3136767d5846bfe7168faeac5b9434394bd747126c5c1ecc6621d10817ce9b6540433828a3bb8f6da0cd8f2b54a47cd5473f6bc3dc1234bd115a6890aa678d1bce7840d7a4559cda556740860079e46217c20e45ee59b8b7078d9b70cb6a249eb2e5e4071d044f456fb61649f261689b8d7a532afaf88eb30041242ce491fb7e654a1f06add370e2706f75c2fe1afe8e065804414c660ec4d96f496b1ad87592de8b7d04baa7ab142f580f262c64c57fce8ef933f18904f001809cfdf94eb679c9eced5d125b4f1d0064ca2ccf5eaf61bb7841bd408ae213deeb15d860f7ee7224b9d2dd38ee9f6c3fca6590335715c218db8f8c98e6339a6944817a1ce2e115ae984699861631b9893c143f594d6dde0895a0c7edb9912f3fcd8fd0765227b3963033306d15711387044bc373ac10d7be73cd80f1a79cf1ea0989ea9ae8a0dbbd1227bc33df652792a6bd95f1d21c6497c4c35b9a1eadc0217e322285a2eb832753aae74ef42fc983e58a126b7c23e4b0bac16f0de1eff7d41477bb25052f32cc9cc956ebd209d6b945b1fa9182857e180672a6be7edeb5234830668b1ea749d0a0dd3a244684d4dd76221c3bdf98c2f1eacb7a6dcccafd249b0ba2592c88790de40895799ea4dfb045cc2392dbb623bfe420b24e5a425b84a4b24d787a68bbec9db363ac4e9453df597f0224d8b7b21629e1989e53accbae97e189cf9b59ebf8bb89591fe3fda450af548ffc46eff98b5216e238a9246e2fb95810f8f4d89504633a6d223484a765b9e6e5497159b31c51fa6cc10641bafa81b10c5ab853f3136fa1b4334bcbde99cb4689f077ca3c29c2f1aca2a05762943073d5992aac4d9b0d411ba25905c34fd02b8eb7b9db375a6f6516446cc195eb55eda1e007e26328e9e2642a9c4e90c56440cc60a1db77713860a56820901b3022d55c621e9d54f759dd17fc5b59331c63cf30e07081bf0cdee6cc94ddfe8c6179e7ed86607d4ba7d5f1e97fbc1139b43ae5fd04c1c715f4600f028d0852a421d472b1b48e591b6edfebcd86be3db2caf967b06776096e14f0deffc9bb126ec329c49ada996b963e942d9c404967dc23bdbd0eee951b2879f2ef7ae224d4ff25edac4ddeb2c0b8e579af283e87c625d3fae5286fa855930e45207af7054763937a9247dc38e37e6dee2e325b617280846012e463707b6ccfa2fc399a66e534221a45626cd18c79d46f5c77c2d359e19ea870cd230709b5e33cd52fd43388ef91dea0a1e0df6c72688d9fd32bb67f489a3618604ef1dfa0d7f569d40cc68e39994e4edab4007c988998f59485ce4723c1eeb7c72f7e833418bab47735a91c7ab24e8555d2ccf3a812b6c634c0c3a68271ec8b536aaa442e056945feca6fb4e54d2cf60a0334f494b2bdb6fbd597de0ce9d2cf03333a0c7121e086aa4c657360fbfb60f3ce0fc0d90ff12b03464e8ff0e5e546ff79735c5c800a0f9b680a478c772f60173a760e280d8287681986038444f2103e2894d5809d062cfe8380e34bca86475da3d7634131c2a8cdc98c5927bc137db61f94eaf9a74f87cc85072c201766eae17fbd5b732859fb1b1c980b36e377aa41a95bca18ccea529420e742899af7b968c1fb9c0d181da9f86358dbeea877c3e9123a9289c362fa61d96c707ac94b427318a1e5f21078aa9d1fd7a52704e0d73e527f3ca65b7b459734dd30db5335c450f1dbcc1e4259d657d13b6d6b4adddc3d0eae034d1878cd0aa1825991d75f8e6b5b4c0d6d17e8ce709b19ff794a8ef856abdfac65cd13631f1b66b20f2ebf2f3122d18e03cbfff88206a5998fc3cb2b40634fcecdb8f5bdbfe044dbf169ccd2cd60f7bf033272f38f587943fcc75d2d65d9028c02891c8415706c2b2459b7a3c5cc82b0446088d3b3bcc033ad453136afd4ac4678320fc17288dbfa1c5180ad57508a2a298ed4ebc716ede34fded574d9779be5d56517d4dd40f197312390c488f46914b0927b13901ce70c1684801f2811168fab533998a1fdabbb6e683abfa021f6b80077f19455c34cecf5dbdb2fa6e3930eb5940cb14504050cc74249424310dff81116b8f2076b8ebece84c302e758fa90af5a1888aa8a5a2bff4aeb7ebd1c7a216bdbb84bf9c021caf3c8efbfdc5d3aede46381bcda372a5398c89868ad57287736fec2a7e8ed638974fde5875eafa506a6bd7f772d2b221f4bde4920fe0c56f8e0847e2a7e8387c64ddef4203d77a526c46d7871befe0c5f9128bd67319acd963fc040185aac4e7815f728bbd7ffd8f3d125e63320182f202fa9a52505be9585556a5d1308c118ccdf01978027cbace7ab339d6f53d15e795b7f3fedae4f86c3f257ed80ee634375dc2333ceed1ccaeab1b6be7a9611ff33d79dccdec2007558c06dfc06612d56d37882e5f1de340cf05f4fffbe1a5def6d045bc5bdaf633f07360f9028cedd103bf03fec8beb9fdbf8c5fc684d12efae1859c53e2cc3e2f508a9cd0410ec036648d3760dd591f7ae04e4cdd61a2566319c943f0b63d87e422dfe5c0d1edcb2dc515778a0d7bb2c93ced3b1435adbc51d3fdca9c13679397bc4490093d64869998d6a28bb862ead0fa411585289cc00dc199eac6c607b8a84123dad3be80dd8fd86aa202113131046336352235f34c05f5ea6d5265adda98edbbfd11d6839c5b1bfe4fad4e688558d633d4a281df44d9c0a35abd464e01f8ab01a1e272cc8cd155a40b8aca4c6b1dc894c0fdc02f15a8f67ce94c7f99b6fcc0e4a3a8a71365645ad7809d47bb26f46ed8bd02f6e8f3d277224f82f3d41695f367e343ac6d507413f4bdacf9e344a49156c4de36d68c075415f8004748055b38b8a4110f869fafcc59cdae5663eda72a05be365a50e98bfd4b00e35aef687afae7bd6622cdd725326776f6fb1476c8cf8c20a0e5223e2bea494a1bbe4e79b25a5e48ba34bc66a84ecc4a0aba98e74ca2b1f61893e61a29498d855a778a2a9ce7b7fcaa44b4aedcbd0e28d6c49bdb6776975bf69161f372b964e4288ce6a3b877c3126f90c4c9749d45b8c5c840983b035993e484a945be5fc9d2d1bd3f3de4e6de7bc74a7a07b13e9e82acc11db85454f1d928fe52ad42ca783fd20dd3e94471b498c2736af40d2a45ff74f9ef874639e33306daa8a667674571e2ed93a48f49b57e9e3382fa8090774bc795609ee510b6a1ca48d9833819cbe8ac77eeebb0e3b6c59ced2d1ab355264934ff1914a3f654249bba60a692dd36368b8a866b333320e57e9c7d3646c375696ff14e303780ffd7b957d89ccdf57823d2d1e158773c2075233dd2f331eafe3802da683c293eaa24cd8b63a7582ddb202cd6f8c837c74f823727641c7eb680fe51ce7f250adb34956e4cab17b8a5f10edf144c700e376c682dd46c8fc89830fee1a44fafe0a5a2e7581d5d16ad6267d1dc2d5be8547f9352d1591b42de94f2559b44a80038360c6394541a77d95b196558a479b609882fc597b9cbe285ad7c7a41133ed85c8ab6e6dec5bf70f9e787985512d48865022705098a6703b255a6f2b05b62fc7ab32e67f06d785ccb33fb348205a76939e6c2991486c5aae8ec1556b2f8e30ca445a4a495cbf2c6013042b8cea615e58899fccbbf1fc4f17a6dc37e46b17ada0be033dc67904fbd7903086d3417e423af64338426a84ca0c2a3252db62695f9cdf10ebc09b9da5747d30e7f4adfb374e1d2bb24542b0373b1fb897690b49fe24d8575ec9800f019c9c76459421c11f002989ac82c13c04a202cf7f9f38b053f9a680d4d5012887a11d25cad201df20a4eee6d2c0474055579ac729c7514a88b1675bbf6b773448c6c1a5ccd157f44f7e032a6b848f2e734d773f029e48fd13c90d41666f9bd4e9bea91950737b6e7502f9d2677938f240e3f905d6095bb0f8bbe961b99b2d025538c3888bfff8957e3592ee5326a75399b59c697f59fcdfbbe3bcffb8777340875611bf75486d2378e68de771800bfffe0572fb36ca855ec5fc8cb90c76455773c36ec40b101fb30c48f8a8e775f5220e024b4da9dddc2fcf4da413e7c5db9e0567cbb5fad0c91d779a0939debd9247d3f7d8107fd986f73a9c9067e6594fabde0b9e887040cfbe7d31332f41259de57b38f33275597725392efea51f290b8e1b5c243ffd9eb4c0231600f9b4b204344736849d527156c4720a463bbe88fbbdc333099d949853d5c6fda98bcd35ad3f1fb1d5a7d00541a8a202c8590e35360bb9d25d6431476649e1898f901fad37975d6dce9833956e7a78d0306f533d4aa3c9676017c7abc7e1f8f2f117774a4f5beba55d1c3cd580fb18defccc349cce24e94a4cf1f4c6f45d783ee0167a55369c9b5e1eb6d0a836f3eb2354fad3cd771a9d777ff84c63120baee86ddc52b3e6817dce339ac9c240e75f3e2f77afbffbc1d54eb5936d045370ce3b77365c5320892dc7bc36e488019461d2e552969de9f25bd8de049d693be450c43c5d22d7569fc384e8d56ddb577c5f3c3471f5ba2998bc0c697a06b6d8ba5f2f7236e78aaed69b468e761a5f07145c0326ebb94f50aaa8c5666c92006d8d139036f981003933f8e2eba106a0e251fa9f5407544e44aedbbb271a3bf1c660a9cb8c74dbd0713aaebba2dd046af8b9428709646521d6bf387a92996b35748e1e67b602309b7da0fb642e89de19f550925f4db082ef7e9821ac4b2aee93c9cf791c086751c4cb4172608a4f903dc40727858046851529205b45786e294c17abf5e5f6bc730cbfb8fd977c5501a8140ac7984a267880b53cb94157be9ac157be1cf12d8a9e5612947772b734ed6ae30e548a3b2faecf94a7e03f86317f52ac797aefb957d2a29de8f8ced414ce22c800e0dc7e49d3672fca633248f3e68c00", 0x2000, &(0x7f000000dcc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x78, 0x0, 0xa, {0x8, 0x0, 0x0, {0x4, 0xffffffffffffff9f, 0x10000000000, 0x8, 0x40000000000003, 0xfffffffffffffffe, 0x0, 0x35741061, 0x52, 0xa593e9c1ca988eda, 0xfffffff8, 0x0, 0x0, 0x3d, 0xe}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r4, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e0001"], 0x50}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) setgroups(0xefff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000480)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) openat$sndseq(0xffffff9c, &(0x7f0000000600), 0x600140) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_SIOCGIFCONF(r5, 0x8912, &(0x7f0000000700)=@req={0x20, &(0x7f00000007c0)={'nicvf0\x00', @ifru_addrs=@xdp={0x2c, 0x6, 0x0, 0x1b, 0x2000}}}) 1.288782242s ago: executing program 0 (id=423): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, 0x7, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0xea}]}, 0x28}}, 0x8000) open(&(0x7f0000000380)='./file0\x00', 0x2a5c0, 0x113) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file3\x00', 0x12c) r1 = open(&(0x7f0000000440)='./file0\x00', 0x0, 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r1, 0x410, &(0x7f0000000480)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0xc369d000) renameat2(0xffffffffffffff9c, &(0x7f00000004c0)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000540)={0x1, &(0x7f0000000580)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) r2 = add_key$keyring(&(0x7f0000000300), &(0x7f0000000340)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$KEYCTL_MOVE(0x1e, 0x0, 0x0, r2, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070008060900010073797a30000000003c000000090a010400000000000000000700000308000a40000000000900020073797a31000000000900010073797a30000000000800054000000021900000000c0a01030000000000200000070000000900020073797a31000000000900010073797a3000000000640003806000008004000180580007800b000100746172676574000048000280080002400000000230000300b08c674515113085726709225a7547b6f14c1aa7a7202afc0811618e3b5a514fb651ff7360e7749fe5bee39009000100534e4154"], 0x114}}, 0x0) 1.14181437s ago: executing program 5 (id=424): bpf$MAP_CREATE(0xfffff000, &(0x7f0000000040)=@base={0x4, 0x4, 0x4, 0x10005, 0x804, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x200}, 0x50) 744.149377ms ago: executing program 5 (id=425): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) openat(0xffffffffffffffff, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x4000, 0x1a0) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = fsopen(&(0x7f00000000c0)='ceph\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000140)='/sys/fs/smackfs/access\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='1', 0x1) 463.779551ms ago: executing program 4 (id=426): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0xf5ffffff, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_LOG_GROUP={0x6}, @NFTA_LOG_SNAPLEN={0x8, 0x3, 0x1, 0x0, 0x100}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x78}}, 0x0) 372.248221ms ago: executing program 4 (id=427): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_io_uring_setup(0x156, &(0x7f0000000000)={0x0, 0x595f, 0x800, 0x2, 0x51}, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000140)=@IORING_OP_FADVISE={0x18, 0x40, 0x0, @fd=r1, 0xffffffffffff8001, 0x0, 0x2, 0x4, 0x1}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000840)=ANY=[@ANYRES64=0x0, @ANYRESHEX=r7, @ANYRESDEC=r7, @ANYRESHEX=r6, @ANYRESDEC=r6], 0x24}, 0x1, 0x0, 0x0, 0x8814}, 0x800) r8 = mq_open(&(0x7f0000000300)='@+\\\x00', 0x40, 0x0, 0x0) mq_timedsend(r8, 0x0, 0x0, 0x7, 0x0) sendmsg$NL80211_CMD_CONNECT(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x44, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480)) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=ANY=[@ANYBLOB="10080500080211000001ffffffffffff505050505050950004102d00ffff0103820412dde5020431af9d7723c8f3332ff1c3e02b87f91c08bbf08b0a59a1596ea6133a20101462c86133b46b3c49a1a47f87b721d86fd540c514856f33dafa91ee8d559307fef1e5c0eb19f7ab94cd050583c17b6210551a0ffbaf7f794aa501f29f614ff7aee04696b816da893cec70fe97f79e30edeab7d0a7e3365e36051955e3b3d3de1948e65d1384ae9ef3dbc0a84c1a7a6a3d20853c51e831eaac02d25b8294cd57773d829fdaa82dd44d4581389ed99f8d55e811ed0d739302cb81f823b5394d246b9d234bb5ec2a8a4c1c1bf80a762ffd5759635201baa5dcfad705596b10c0a42ac10eb703"], 0x10a) nanosleep(&(0x7f0000000640)={0x0, 0x2faf080}, &(0x7f0000000680)) syz_80211_inject_frame(&(0x7f00000006c0)=@device_b, &(0x7f0000000ac0)=ANY=[@ANYBLOB="10000000080211000001080211000000ffffffffffff2000010000000100010882848b960c121824b38bb9991827f0d341449eabb12a464d435d2365b8b53fc3e307f4f8596a7806f1bb1cb229e9002fc722f0e4995c3e75b3b842d473b5103b524b9e4060d972c848dd1b3c8815857185ae7783463628326d86de5283e84c03311913d161b9ced314fb34c5f2d84f78878bb35438d68671ac60bebfe811a13ea96025e16ba6b0d47a41b4faf8762d40e8d9b5713f13e88fa92725f46396352bb888c55482904eea4f"], 0x28) nanosleep(&(0x7f0000000740)={0x0, 0x5f5e100}, &(0x7f0000000780)) r9 = getpid() r10 = syz_open_procfs(r9, &(0x7f00000008c0)='net/dev\x00') lseek(r10, 0x47ea, 0x667ffca8cf06c461) sendmsg$nl_route_sched(r10, &(0x7f0000000900)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000980)={&(0x7f00000009c0)=@deltclass={0x2c, 0x29, 0x1, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xb, 0xd}, {0x4, 0xf}, {0xb, 0xd}}, [@TCA_RATE={0x6, 0x5, {0x1, 0xf}}]}, 0x2c}}, 0x40041) bind$bt_hci(r0, &(0x7f0000000a00)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) r11 = socket$inet6_udp(0xa, 0x2, 0x0) r12 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r12, &(0x7f0000000a40)={0x23, 0x4, 0x3, 0xcc}, 0x10) r13 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r13, &(0x7f0000000a80)={0x23, 0x14}, 0x10) close_range(r11, 0xffffffffffffffff, 0x0) 290.34407ms ago: executing program 5 (id=428): r0 = openat$sndseq(0xffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r0, 0xc058534b, &(0x7f0000000140)={0x705, 0xb1, 0xa, 0x406e, 0x4, 0x1ff}) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x40806685, &(0x7f00000005c0)={0x1, 0x0, 0x1000, 0x40, &(0x7f0000000480)="af4cfc87932f1d63935b3984c6473646e2445553a1e8cfa13234fe9843e648e8f0b7a559776568ad0dd85c013582a4d700eb319fac33ef2203a5898232900499", 0xb1, 0x0, &(0x7f0000000500)="7f099107573cb40a2347bcefd5fc5ca1b2b0382163d0283c9df2fa63ad375ca514f319852dc2b01982b09000d07754d4f4f3c51b8d053792ac893f85c20b26f4b33da5f2ee660234deb0de6651c01f95b5366c3b27eef278cc7d0f59f132e874ce879f9f3fd5227e0be7d0db40b6c33893ab83fb8f490347805ed1a1ff6045280ea0b8d4a3a81690ef8cdb5aa64b12d30d18838d523333dfc73688f95f96e469c2ddd8358b78c4cdbb1cd21ee711a7078f"}) 224.828023ms ago: executing program 5 (id=429): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000980)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) syz_emit_ethernet(0x4a, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6000000000140640fc010000000000000000000000000000fe8000000000000000000000000000aa4e224e22", @ANYRES32=0x41424344, @ANYRES32=0x0, @ANYBLOB="5038108090ff0000"], 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x51, 0x1}}, './file0\x00'}) syz_open_dev$vbi(&(0x7f0000000140), 0x0, 0x2) sendto$inet(r1, &(0x7f0000000040)="e3cf7901d6be83bad032b665b5123778e7619e501cde69158ddab145a1d5d8416461fe3870580466c6d7783d2fdef4b75b20618a212c6b68efa79ab1f0e5da430bb613b4b39f568af90da7627eca50a3463999097198dea785dcab40aaba4a32d43995446d742a5c50057dee219dff57d613f35dc6be59976abc5bd0aa660da2c60461f35ca6d6201ec2f2376be45644c87b449a14676ffaf5e6580da30cbc8b93c041c8af447d5a6c95", 0xaa, 0x20000000, &(0x7f0000000100)={0x2, 0x4e22, @loopback}, 0x10) 221.379292ms ago: executing program 5 (id=430): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000100000027bf000000050000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00( ^ ', @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x2000009, 0x13, r0, 0x6b6c0000) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=ANY=[@ANYBLOB="0a00000016000000b30000007f"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x14, &(0x7f0000000740)=ANY=[@ANYBLOB="06000000000000000000000000000000851000000600000018100000", @ANYRES32=r1, @ANYBLOB="000000000000000018350000020000000000000000000000180000000000000000000000000000009500000000000000368a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x4, 0xde, &(0x7f0000000340)=""/222}, 0x94) r2 = fsopen(&(0x7f0000000280)='jffs2\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\n\x8c0x0}, 0x2020) getpgid(r4) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x2, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:1d.0/remove\x00', 0x1, 0x0) write(r5, &(0x7f0000000400)='1', 0x1) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) r8 = openat$cgroup_ro(r7, 0x0, 0x0, 0x0) preadv(r8, &(0x7f0000000240)=[{0x0}], 0x1, 0x1000, 0x0) r9 = socket$rds(0x15, 0x5, 0x0) openat$cgroup_pressure(r8, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) bind$rds(r9, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r3, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x5}], 0x1}, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/pci/rescan\x00', 0x1, 0x0) 127.856579ms ago: executing program 0 (id=431): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x80000, 0x0, 0xffffffffffffffff}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0xffffffffffffffea, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="6400000010000305160000000000000000008847", @ANYRES32=0x0, @ANYRESHEX=r0], 0xc3}, 0x1, 0x100000000000000}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x10000}, 0xc) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x200, r1, 0x2}) 119.825851ms ago: executing program 0 (id=432): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x6f) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000180)={{0x3, 0x1, 0x1, 0x1}, 'syz0\x00'}) ioctl$UI_DEV_CREATE(r0, 0x5501) write$input_event(r0, &(0x7f0000000300)={{0x0, 0x2}, 0x1, 0x6f, 0x1}, 0x18) write$input_event(r0, &(0x7f0000000340)={{0x0, 0x2}, 0x0, 0x12}, 0x18) 340.147µs ago: executing program 0 (id=433): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a50000000060a01040000000000000000020000c0600d2f56a733394be087244b450a0900010073797a30000000000900020073797a30000000002400048020000180080001006c6f67001400028006000140000000000800034000000000140000001100010000000000000000000200000a55d2b48e6eab44299649052daf721a7afb2fea4de2cb99c4f08e0d08a5fcf8ca7488b47e2da0519e2d21fc15093635f3dbcead8643246eb37e50cb6cb3349ff99dbbccb09034d45b01aa58ae9b523cd7ebb159810221f87ea1bc51792842570e3fb26d8f91a8c776b5f94ada24d8122b14df"], 0x78}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e21}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x20008080) 0s ago: executing program 0 (id=434): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys\x00', 0x105) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) symlinkat(&(0x7f0000000280)='./sys/bus/pci/drivers/i801_smbus\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./drv\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./drv/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000003c0)='0000:00:1f.3', 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x4000, 0x0) syz_open_dev$sndctrl(&(0x7f0000000000), 0x7, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x311000) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000080)={0x8, 0x3, 0x9414, 0x58, 'syz1\x00', 0x3}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)={0x5c, 0x42, 0x1, 0xfffffffd, 0x0, {0x3, 0x1}, [@generic="0f000000", @typed={0x3c, 0x1, 0x0, 0x0, @binary="00112233445566778899aabb86dd2c00001c0000000001110001010253aa58fe6cbdf0357065ae44132403b1fd606412c3258e3c67000000"}, @nested={0x4, 0x8002}, @nested={0x4, 0x8003}]}, 0x5c}}, 0x0) write(r2, &(0x7f0000000500)="020030", 0x3) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) syz_clone3(&(0x7f0000000100)={0x180801400, 0x0, 0x0, 0x0, {0x1}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, 0x0, 0x0) syz_open_dev$vbi(&(0x7f00000000c0), 0x3, 0x2) bind$inet6(r4, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./drv/bind\x00', 0x1, 0x0) write(r5, &(0x7f00000005c0)='0000:00:1f.3\x00', 0xd) kernel console output (not intermixed with test programs): tsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 59.087058][ T5890] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 59.087071][ T5890] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 59.087085][ T5890] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 59.087105][ T5890] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 59.089571][ T6500] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 59.105657][ T34] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 59.256954][ T987] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 59.259368][ T987] usb 6-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 59.275627][ T34] usb 9-1: Using ep0 maxpacket: 8 [ 59.276085][ T34] usb 9-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 59.276955][ T34] usb 9-1: config index 0 descriptor too short (expected 5924, got 36) [ 59.276968][ T34] usb 9-1: config 250 has an invalid interface number: 228 but max is -1 [ 59.276978][ T34] usb 9-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 59.276988][ T34] usb 9-1: config 250 has no interface number 0 [ 59.277006][ T34] usb 9-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 59.277019][ T34] usb 9-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 59.277030][ T34] usb 9-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid wMaxPacketSize 0 [ 59.277041][ T34] usb 9-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 0 [ 59.277052][ T34] usb 9-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 59.277065][ T34] usb 9-1: config 250 interface 228 has no altsetting 0 [ 59.281835][ T34] usb 9-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 59.281849][ T34] usb 9-1: Product: syz [ 59.281856][ T34] usb 9-1: SerialNumber: syz [ 59.288963][ T34] hub 9-1:250.228: bad descriptor, ignoring hub [ 59.288977][ T34] hub 9-1:250.228: probe with driver hub failed with error -5 [ 59.498981][ T34] usblp 9-1:250.228: usblp0: USB Bidirectional printer dev 3 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 60.005708][ T5093] Bluetooth: hci3: command 0x041b tx timeout [ 60.065782][ T34] usb 9-1: USB disconnect, device number 3 [ 60.069640][ T34] usblp0: removed [ 61.393787][ T226] IPVS: starting estimator thread 0... [ 61.410066][ T6538] dvmrp0: entered allmulticast mode [ 61.475699][ T6539] IPVS: using max 43 ests per chain, 103200 per kthread [ 61.572952][ T6541] netlink: 8 bytes leftover after parsing attributes in process `syz.4.160'. [ 61.667979][ T5836] usb 6-1: USB disconnect, device number 4 [ 61.686201][ T5836] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 61.686749][ T5836] ftdi_sio 6-1:0.0: device disconnected [ 61.725098][ T1525] usb 5-1: USB disconnect, device number 2 [ 61.725124][ C2] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 61.725151][ C2] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 61.837136][ T6563] netlink: 'syz.0.162': attribute type 10 has an invalid length. [ 62.095857][ T5093] Bluetooth: hci3: command 0x041b tx timeout [ 62.398570][ T6576] ======================================================= [ 62.398570][ T6576] WARNING: The mand mount option has been deprecated and [ 62.398570][ T6576] and is ignored by this kernel. Remove the mand [ 62.398570][ T6576] option from the mount to silence this warning. [ 62.398570][ T6576] ======================================================= [ 62.399463][ T6576] jffs2: notice: (6576) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 62.822271][ T1170] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 62.822966][ T6604] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 62.924436][ T6602] input: syz0 as /devices/virtual/input/input6 [ 62.949265][ T6602] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3303861288 (422894244864 ns) > initial count (241705619456 ns). Using initial count to start timer. [ 62.979293][ T1161] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 62.979983][ T6604] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 63.025395][ T6615] jffs2: notice: (6615) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 63.131087][ T1161] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 63.131156][ T6604] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 63.254735][ T1161] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 63.255935][ T6604] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 63.325655][ T5836] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 63.397370][ T108] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 63.397487][ T6604] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 63.455658][ T5836] usb 5-1: device descriptor read/64, error -71 [ 63.529257][ T6625] netlink: 4 bytes leftover after parsing attributes in process `syz.4.178'. [ 63.529771][ T1161] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 63.530019][ T6604] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 63.533496][ T6625] gretap0: entered promiscuous mode [ 63.535692][ T6625] macvtap1: entered promiscuous mode [ 63.535785][ T6625] macvtap1: entered allmulticast mode [ 63.535793][ T6625] gretap0: entered allmulticast mode [ 63.538428][ T6625] netlink: 4 bytes leftover after parsing attributes in process `syz.4.178'. [ 63.541382][ T6625] gretap0: left allmulticast mode [ 63.541458][ T6625] gretap0: left promiscuous mode [ 63.544335][ T6625] macvtap1: left promiscuous mode [ 63.544345][ T6625] macvtap1: left allmulticast mode [ 63.580617][ T6627] netlink: 'syz.4.179': attribute type 5 has an invalid length. [ 63.673851][ T6633] netlink: 'syz.4.180': attribute type 10 has an invalid length. [ 63.695655][ T5836] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 63.825673][ T5836] usb 5-1: device descriptor read/64, error -71 [ 63.905710][ T5846] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 63.937236][ T5836] usb usb5-port1: attempt power cycle [ 64.065691][ T5846] usb 8-1: Using ep0 maxpacket: 32 [ 64.066281][ T5846] usb 8-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 64.066716][ T5846] usb 8-1: config 0 has no interfaces? [ 64.068621][ T5846] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 64.068757][ T5846] usb 8-1: Product: syz [ 64.068766][ T5846] usb 8-1: Manufacturer: syz [ 64.068773][ T5846] usb 8-1: SerialNumber: syz [ 64.070110][ T5846] usb 8-1: config 0 descriptor?? [ 64.096290][ T6643] jffs2: notice: (6643) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 64.165709][ T5741] Bluetooth: hci3: command 0x041b tx timeout [ 64.275701][ T5836] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 64.278973][ T5846] usb 8-1: USB disconnect, device number 2 [ 64.296123][ T5836] usb 5-1: device descriptor read/8, error -71 [ 64.501076][ T6649] phram: illegal erasesize or len [ 64.511391][ T6649] x_tables: ip6_tables: set.3 match: invalid size 48 (kernel) != (user) 32 [ 64.535759][ T5836] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 64.556041][ T5836] usb 5-1: device descriptor read/8, error -71 [ 64.648103][ T6655] Driver unsupported XDP return value 0 on prog (id 17) dev N/A, expect packet loss! [ 64.666026][ T5836] usb usb5-port1: unable to enumerate USB device [ 64.716916][ T6657] FAULT_INJECTION: forcing a failure. [ 64.716916][ T6657] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 64.716936][ T6657] CPU: 3 UID: 0 PID: 6657 Comm: syz.4.191 Not tainted syzkaller #0 PREEMPT(full) [ 64.716948][ T6657] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 64.716954][ T6657] Call Trace: [ 64.716959][ T6657] [ 64.716963][ T6657] dump_stack_lvl+0x100/0x190 [ 64.716982][ T6657] should_fail_ex.cold+0x5/0xa [ 64.716995][ T6657] ? prepare_alloc_pages+0x16d/0x5b0 [ 64.717013][ T6657] should_fail_alloc_page+0xeb/0x140 [ 64.717038][ T6657] prepare_alloc_pages+0x1f0/0x5b0 [ 64.717057][ T6657] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 64.717072][ T6657] ? __pfx_get_page_from_freelist+0x10/0x10 [ 64.717085][ T6657] ? prepare_alloc_pages+0x1f0/0x5b0 [ 64.717102][ T6657] ? is_bpf_text_address+0x94/0x1a0 [ 64.717119][ T6657] ? rcu_is_watching+0x13/0xc0 [ 64.717132][ T6657] ? __alloc_frozen_pages_noprof+0x56b/0x3300 [ 64.717148][ T6657] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 64.717164][ T6657] ? stack_trace_save+0x8e/0xc0 [ 64.717179][ T6657] ? __pfx_stack_trace_save+0x10/0x10 [ 64.717193][ T6657] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 64.717209][ T6657] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 64.717222][ T6657] ? is_bpf_text_address+0x94/0x1a0 [ 64.717241][ T6657] ? kasan_save_track+0x14/0x30 [ 64.717255][ T6657] ? __kasan_slab_alloc+0x89/0x90 [ 64.717270][ T6657] ? kmem_cache_alloc_node_noprof+0x282/0x6e0 [ 64.717284][ T6657] ? alloc_vmap_area+0x640/0x2bb0 [ 64.717298][ T6657] ? __get_vm_area_node+0x1ed/0x350 [ 64.717333][ T6657] ? __vmalloc_node_range_noprof+0x268/0x1420 [ 64.717344][ T6657] ? __vmalloc_node_noprof+0xad/0xf0 [ 64.717361][ T6657] ? __vmalloc_noprof+0xa3/0x120 [ 64.717371][ T6657] ? __vcalloc_noprof+0x4d/0x80 [ 64.717385][ T6657] ? kvm_arch_prepare_memory_region+0x35c/0x8d0 [ 64.717413][ T6657] ? kvm_set_memslot+0x139/0x1740 [ 64.717433][ T6657] ? kvm_set_memory_region+0xe78/0x15e0 [ 64.717447][ T6657] ? kvm_vm_ioctl+0x216a/0x4170 [ 64.717458][ T6657] ? kvm_vm_compat_ioctl+0x2f7/0x3f0 [ 64.717470][ T6657] ? __ia32_compat_sys_ioctl+0x2cf/0x360 [ 64.717488][ T6657] alloc_pages_bulk_noprof+0x5e1/0x13c0 [ 64.717506][ T6657] ? policy_nodemask+0xed/0x4f0 [ 64.717517][ T6657] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 64.717540][ T6657] __kasan_populate_vmalloc+0xf0/0x210 [ 64.717558][ T6657] alloc_vmap_area+0x95d/0x2bb0 [ 64.717579][ T6657] ? kasan_save_track+0x14/0x30 [ 64.717594][ T6657] ? __kasan_kmalloc+0xaa/0xb0 [ 64.717609][ T6657] ? __pfx_alloc_vmap_area+0x10/0x10 [ 64.717625][ T6657] ? __mod_memcg_lruvec_state+0x18c/0x5b0 [ 64.717640][ T6657] ? __get_vm_area_node+0x124/0x350 [ 64.717658][ T6657] __get_vm_area_node+0x1ed/0x350 [ 64.717677][ T6657] __vmalloc_node_range_noprof+0x268/0x1420 [ 64.717689][ T6657] ? __vcalloc_noprof+0x4d/0x80 [ 64.717707][ T6657] ? __vcalloc_noprof+0x4d/0x80 [ 64.717723][ T6657] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 64.717740][ T6657] ? lock_acquire+0x1d1/0x380 [ 64.717755][ T6657] ? kvm_set_memslot+0x34/0x1740 [ 64.717772][ T6657] ? __vcalloc_noprof+0x4d/0x80 [ 64.717784][ T6657] __vmalloc_node_noprof+0xad/0xf0 [ 64.717801][ T6657] ? __vcalloc_noprof+0x4d/0x80 [ 64.717816][ T6657] __vmalloc_noprof+0xa3/0x120 [ 64.717826][ T6657] ? __pfx___vmalloc_noprof+0x10/0x10 [ 64.717837][ T6657] ? __pfx___mutex_lock+0x10/0x10 [ 64.717852][ T6657] __vcalloc_noprof+0x4d/0x80 [ 64.717865][ T6657] kvm_arch_prepare_memory_region+0x35c/0x8d0 [ 64.717885][ T6657] kvm_set_memslot+0x139/0x1740 [ 64.717897][ T6657] ? kvm_set_memory_region+0xc43/0x15e0 [ 64.717914][ T6657] kvm_set_memory_region+0xe78/0x15e0 [ 64.717935][ T6657] kvm_vm_ioctl+0x216a/0x4170 [ 64.717948][ T6657] ? tomoyo_path_number_perm+0x46d/0x580 [ 64.717962][ T6657] ? stack_trace_save+0x8e/0xc0 [ 64.717977][ T6657] ? __pfx_stack_trace_save+0x10/0x10 [ 64.717993][ T6657] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 64.718003][ T6657] ? __lock_acquire+0x5c0/0x1f40 [ 64.718019][ T6657] ? tomoyo_path_number_perm+0x46d/0x580 [ 64.718037][ T6657] ? kasan_save_stack+0x3f/0x50 [ 64.718052][ T6657] ? kasan_save_stack+0x30/0x50 [ 64.718066][ T6657] ? kasan_save_track+0x14/0x30 [ 64.718081][ T6657] ? kasan_save_free_info+0x3b/0x70 [ 64.718094][ T6657] ? __kasan_slab_free+0x5f/0x80 [ 64.718110][ T6657] ? kfree+0x22b/0x6d0 [ 64.718121][ T6657] ? tomoyo_path_number_perm+0x46d/0x580 [ 64.718135][ T6657] ? security_file_ioctl_compat+0xd3/0x230 [ 64.718149][ T6657] ? __ia32_compat_sys_ioctl+0xc2/0x360 [ 64.718161][ T6657] ? __do_fast_syscall_32+0x13a/0x8b0 [ 64.718173][ T6657] ? kvm_arch_vm_compat_ioctl+0x2d0/0x470 [ 64.718191][ T6657] ? __pfx_kvm_arch_vm_compat_ioctl+0x10/0x10 [ 64.718221][ T6657] ? kasan_quarantine_put+0x104/0x240 [ 64.718235][ T6657] ? lockdep_hardirqs_on+0x7d/0x110 [ 64.718246][ T6657] ? find_held_lock+0x2b/0x80 [ 64.718259][ T6657] ? tomoyo_path_number_perm+0x28f/0x580 [ 64.718283][ T6657] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 64.718300][ T6657] ? do_vfs_ioctl+0x226/0x13e0 [ 64.718313][ T6657] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 64.718327][ T6657] kvm_vm_compat_ioctl+0x2f7/0x3f0 [ 64.718339][ T6657] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 64.718350][ T6657] ? __fget_files+0x34/0x3d0 [ 64.718364][ T6657] ? find_held_lock+0x2b/0x80 [ 64.718377][ T6657] ? __fget_files+0x215/0x3d0 [ 64.718390][ T6657] ? hook_file_ioctl_common+0x140/0x440 [ 64.718406][ T6657] ? __fget_files+0x21f/0x3d0 [ 64.718423][ T6657] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 64.718435][ T6657] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 64.718450][ T6657] __do_fast_syscall_32+0x13a/0x8b0 [ 64.718463][ T6657] do_fast_syscall_32+0x32/0x70 [ 64.718475][ T6657] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 64.718489][ T6657] RIP: 0023:0xf7f77fec [ 64.718502][ T6657] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 64.718507][ T6657] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 64.718519][ T6657] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000004020ae46 [ 64.718525][ T6657] RDX: 0000000080001580 RSI: 0000000000000000 RDI: 0000000000000000 [ 64.718532][ T6657] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 64.718538][ T6657] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 64.718544][ T6657] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 64.718558][ T6657] [ 64.720167][ T6657] syz.4.191: vmalloc error: size 4, align 0x1, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 64.720243][ T6657] CPU: 3 UID: 0 PID: 6657 Comm: syz.4.191 Not tainted syzkaller #0 PREEMPT(full) [ 64.720256][ T6657] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 64.720262][ T6657] Call Trace: [ 64.720266][ T6657] [ 64.720271][ T6657] dump_stack_lvl+0x100/0x190 [ 64.720287][ T6657] warn_alloc.cold+0x9e/0xb2 [ 64.720312][ T6657] ? __pfx_warn_alloc+0x10/0x10 [ 64.720326][ T6657] ? lockdep_hardirqs_on+0x7d/0x110 [ 64.720338][ T6657] ? __get_vm_area_node+0x2f0/0x350 [ 64.720360][ T6657] ? __get_vm_area_node+0x22b/0x350 [ 64.720379][ T6657] __vmalloc_node_range_noprof+0xfa2/0x1420 [ 64.720394][ T6657] ? __vcalloc_noprof+0x4d/0x80 [ 64.720412][ T6657] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 64.720430][ T6657] ? lock_acquire+0x1d1/0x380 [ 64.720446][ T6657] ? kvm_set_memslot+0x34/0x1740 [ 64.720463][ T6657] ? __vcalloc_noprof+0x4d/0x80 [ 64.720476][ T6657] __vmalloc_node_noprof+0xad/0xf0 [ 64.720493][ T6657] ? __vcalloc_noprof+0x4d/0x80 [ 64.720508][ T6657] __vmalloc_noprof+0xa3/0x120 [ 64.720518][ T6657] ? __pfx___vmalloc_noprof+0x10/0x10 [ 64.720532][ T6657] ? __pfx___mutex_lock+0x10/0x10 [ 64.720546][ T6657] __vcalloc_noprof+0x4d/0x80 [ 64.720559][ T6657] kvm_arch_prepare_memory_region+0x35c/0x8d0 [ 64.720578][ T6657] kvm_set_memslot+0x139/0x1740 [ 64.720591][ T6657] ? kvm_set_memory_region+0xc43/0x15e0 [ 64.720608][ T6657] kvm_set_memory_region+0xe78/0x15e0 [ 64.720628][ T6657] kvm_vm_ioctl+0x216a/0x4170 [ 64.720641][ T6657] ? tomoyo_path_number_perm+0x46d/0x580 [ 64.720655][ T6657] ? stack_trace_save+0x8e/0xc0 [ 64.720669][ T6657] ? __pfx_stack_trace_save+0x10/0x10 [ 64.720684][ T6657] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 64.720694][ T6657] ? __lock_acquire+0x5c0/0x1f40 [ 64.720711][ T6657] ? tomoyo_path_number_perm+0x46d/0x580 [ 64.720724][ T6657] ? kasan_save_stack+0x3f/0x50 [ 64.720738][ T6657] ? kasan_save_stack+0x30/0x50 [ 64.720752][ T6657] ? kasan_save_track+0x14/0x30 [ 64.720766][ T6657] ? kasan_save_free_info+0x3b/0x70 [ 64.720778][ T6657] ? __kasan_slab_free+0x5f/0x80 [ 64.720792][ T6657] ? kfree+0x22b/0x6d0 [ 64.720803][ T6657] ? tomoyo_path_number_perm+0x46d/0x580 [ 64.720815][ T6657] ? security_file_ioctl_compat+0xd3/0x230 [ 64.720828][ T6657] ? __ia32_compat_sys_ioctl+0xc2/0x360 [ 64.720839][ T6657] ? __do_fast_syscall_32+0x13a/0x8b0 [ 64.720850][ T6657] ? kvm_arch_vm_compat_ioctl+0x2d0/0x470 [ 64.720867][ T6657] ? __pfx_kvm_arch_vm_compat_ioctl+0x10/0x10 [ 64.720899][ T6657] ? kasan_quarantine_put+0x104/0x240 [ 64.720914][ T6657] ? lockdep_hardirqs_on+0x7d/0x110 [ 64.720924][ T6657] ? find_held_lock+0x2b/0x80 [ 64.720936][ T6657] ? tomoyo_path_number_perm+0x28f/0x580 [ 64.720960][ T6657] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 64.720977][ T6657] ? do_vfs_ioctl+0x226/0x13e0 [ 64.720989][ T6657] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 64.721003][ T6657] kvm_vm_compat_ioctl+0x2f7/0x3f0 [ 64.721014][ T6657] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 64.721036][ T6657] ? __fget_files+0x34/0x3d0 [ 64.721052][ T6657] ? find_held_lock+0x2b/0x80 [ 64.721065][ T6657] ? __fget_files+0x215/0x3d0 [ 64.721080][ T6657] ? hook_file_ioctl_common+0x140/0x440 [ 64.721098][ T6657] ? __fget_files+0x21f/0x3d0 [ 64.721116][ T6657] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 64.721128][ T6657] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 64.721143][ T6657] __do_fast_syscall_32+0x13a/0x8b0 [ 64.721158][ T6657] do_fast_syscall_32+0x32/0x70 [ 64.721170][ T6657] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 64.721183][ T6657] RIP: 0023:0xf7f77fec [ 64.721195][ T6657] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 64.721200][ T6657] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 64.721210][ T6657] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000004020ae46 [ 64.721217][ T6657] RDX: 0000000080001580 RSI: 0000000000000000 RDI: 0000000000000000 [ 64.721223][ T6657] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 64.721229][ T6657] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 64.721235][ T6657] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 64.721249][ T6657] [ 64.721254][ T6657] Mem-Info: [ 64.721259][ T6657] active_anon:653 inactive_anon:659 isolated_anon:0 [ 64.721259][ T6657] active_file:3635 inactive_file:11010 isolated_file:0 [ 64.721259][ T6657] unevictable:1000 dirty:123 writeback:0 [ 64.721259][ T6657] slab_reclaimable:6154 slab_unreclaimable:54978 [ 64.721259][ T6657] mapped:22705 shmem:1001 pagetables:1221 [ 64.721259][ T6657] sec_pagetables:307 bounce:0 [ 64.721259][ T6657] kernel_misc_reclaimable:0 [ 64.721259][ T6657] free:81319 free_pcp:14601 free_cma:0 [ 64.721285][ T6657] Node 0 active_anon:0kB inactive_anon:36kB active_file:108kB inactive_file:28kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:4kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8800kB pagetables:1592kB sec_pagetables:1128kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 64.721313][ T6657] Node 1 active_anon:2612kB inactive_anon:2600kB active_file:14432kB inactive_file:44012kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:90792kB dirty:488kB writeback:0kB shmem:2004kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:4868kB pagetables:3292kB sec_pagetables:100kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 64.721340][ T6657] Node 0 DMA free:1880kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:4kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:16kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:536kB local_pcp:132kB free_cma:0kB [ 64.721371][ T6657] lowmem_reserve[]: 0 259 259 259 259 [ 64.721391][ T6657] Node 0 DMA32 free:14228kB boost:0kB min:11704kB low:14628kB high:17552kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:32kB active_file:108kB inactive_file:28kB unevictable:2000kB writepending:4kB zspages:3668kB present:1032196kB managed:265348kB mlocked:0kB bounce:0kB free_pcp:3804kB local_pcp:2136kB free_cma:0kB [ 64.721421][ T6657] lowmem_reserve[]: 0 0 0 0 0 [ 64.721440][ T6657] Node 1 DMA32 free:309168kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0kB free_highatomic:0kB active_anon:2612kB inactive_anon:2600kB active_file:14432kB inactive_file:44012kB unevictable:2000kB writepending:488kB zspages:2836kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:54064kB local_pcp:16368kB free_cma:0kB [ 64.721470][ T6657] lowmem_reserve[]: 0 0 0 0 0 [ 64.721488][ T6657] Node 0 DMA: 44*4kB (UM) 9*8kB (U) 2*16kB (UM) 4*32kB (UM) 3*64kB (UM) 4*128kB (UM) 3*256kB (M) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 1880kB [ 64.721575][ T6657] Node 0 DMA32: 113*4kB (UME) 78*8kB (UME) 112*16kB (UME) 143*32kB (UME) 48*64kB (UME) 9*128kB (UME) 4*256kB (UM) 3*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 14228kB [ 64.721656][ T6657] Node 1 DMA32: 614*4kB (UME) 505*8kB (UME) 237*16kB (UME) 339*32kB (UME) 225*64kB (UME) 203*128kB (UME) 189*256kB (UM) 83*512kB (UM) 51*1024kB (UM) 27*2048kB (U) 12*4096kB (U) = 309072kB [ 64.721745][ T6657] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 64.721753][ T6657] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 64.721761][ T6657] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 64.721769][ T6657] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 64.721777][ T6657] 16435 total pagecache pages [ 64.721781][ T6657] 791 pages in swap cache [ 64.721784][ T6657] Free swap = 99048kB [ 64.721788][ T6657] Total swap = 124996kB [ 64.721792][ T6657] 524155 pages RAM [ 64.721795][ T6657] 0 pages HighMem/MovableOnly [ 64.721799][ T6657] 216926 pages reserved [ 64.721802][ T6657] 0 pages cma reserved [ 65.135739][ T853] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 65.275625][ T853] usb 9-1: Using ep0 maxpacket: 32 [ 65.276692][ T853] usb 9-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 65.277592][ T853] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 65.277607][ T853] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 65.277618][ T853] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 65.279332][ T853] usb 9-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 65.279348][ T853] usb 9-1: Product: syz [ 65.279356][ T853] usb 9-1: Manufacturer: syz [ 65.279363][ T853] usb 9-1: SerialNumber: syz [ 65.294902][ T853] input: appletouch as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:1.0/input/input7 [ 65.831357][ T6674] jffs2: notice: (6674) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 65.949011][ T6677] i2c i2c-0: new_device: Instantiated device isp1301 at 0x02 [ 65.999776][ T6682] netlink: 'syz.1.196': attribute type 10 has an invalid length. [ 66.094254][ T5846] usb 9-1: USB disconnect, device number 4 [ 66.122459][ T5846] appletouch 9-1:1.0: input: appletouch disconnected [ 66.170776][ T6685] openvswitch: netlink: Missing key (keys=c0, expected=20100) [ 66.246460][ T5093] Bluetooth: hci3: command 0x041b tx timeout [ 66.378547][ T6693] pim6reg: entered allmulticast mode [ 66.379339][ T6694] pim6reg: left allmulticast mode [ 66.424530][ T6699] program syz.4.199 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 66.570145][ T6700] netlink: 'syz.4.199': attribute type 4 has an invalid length. [ 66.573312][ T6693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.203'. [ 66.615091][ T6693] hsr_slave_1 (unregistering): left promiscuous mode [ 66.637034][ T6693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.203'. [ 66.637112][ T6693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.203'. [ 66.637181][ T6693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.203'. [ 66.637250][ T6693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.203'. [ 66.637318][ T6693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.203'. [ 66.637392][ T6693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.203'. [ 66.637464][ T6693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.203'. [ 66.706249][ T6705] jffs2: notice: (6705) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 66.866518][ T6712] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3303861288 (422894244864 ns) > initial count (241705619456 ns). Using initial count to start timer. [ 66.866902][ T6712] kvm: Disabled LAPIC found during irq injection [ 66.988858][ T6717] netlink: 'syz.1.208': attribute type 10 has an invalid length. [ 67.209335][ T6719] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 67.376122][ T1525] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 67.395647][ T29] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 67.527870][ T1525] usb 5-1: Using ep0 maxpacket: 16 [ 67.528837][ T1525] usb 5-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 67.531767][ T1525] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.531810][ T1525] usb 5-1: Product: syz [ 67.531823][ T1525] usb 5-1: Manufacturer: syz [ 67.531837][ T1525] usb 5-1: SerialNumber: syz [ 67.555703][ T29] usb 6-1: Using ep0 maxpacket: 16 [ 67.557188][ T29] usb 6-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 67.558217][ T29] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 67.558229][ T29] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 67.558238][ T29] usb 6-1: config 0 has no interface number 0 [ 67.558301][ T29] usb 6-1: config 0 interface 1 altsetting 3 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 67.558315][ T29] usb 6-1: config 0 interface 1 has no altsetting 0 [ 67.558331][ T29] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 67.560813][ T29] usb 6-1: config 0 descriptor?? [ 67.569754][ T29] usbhid 6-1:0.1: couldn't find an input interrupt endpoint [ 67.754103][ T1525] usb 5-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 67.765819][ T1525] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 67.766012][ T1525] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 67.766034][ T1525] usb 5-1: media controller created [ 67.773394][ T1525] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 67.954153][ T6725] FAULT_INJECTION: forcing a failure. [ 67.954153][ T6725] name failslab, interval 1, probability 0, space 0, times 0 [ 67.954175][ T6725] CPU: 1 UID: 0 PID: 6725 Comm: syz.0.211 Tainted: G L syzkaller #0 PREEMPT(full) [ 67.954201][ T6725] Tainted: [L]=SOFTLOCKUP [ 67.954206][ T6725] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 67.954212][ T6725] Call Trace: [ 67.954216][ T6725] [ 67.954220][ T6725] dump_stack_lvl+0x100/0x190 [ 67.954240][ T6725] should_fail_ex.cold+0x5/0xa [ 67.954255][ T6725] should_failslab+0xc2/0x120 [ 67.954272][ T6725] __kmalloc_noprof+0xfc/0x840 [ 67.954286][ T6725] ? rcu_is_watching+0x13/0xc0 [ 67.954299][ T6725] ? tomoyo_realpath_from_path+0xb6/0x690 [ 67.954318][ T6725] tomoyo_realpath_from_path+0xb6/0x690 [ 67.954337][ T6725] tomoyo_path_number_perm+0x23c/0x580 [ 67.954350][ T6725] ? tomoyo_path_number_perm+0x22e/0x580 [ 67.954364][ T6725] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 67.954378][ T6725] ? get_pid_task+0x106/0x250 [ 67.954394][ T6725] ? __lock_acquire+0x5c0/0x1f40 [ 67.954417][ T6725] ? __fget_files+0x34/0x3d0 [ 67.954431][ T6725] ? find_held_lock+0x2b/0x80 [ 67.954444][ T6725] ? __fget_files+0x215/0x3d0 [ 67.954457][ T6725] ? hook_file_ioctl_common+0x140/0x440 [ 67.954471][ T6725] ? __fget_files+0x215/0x3d0 [ 67.954487][ T6725] ? __fget_files+0x21f/0x3d0 [ 67.954504][ T6725] security_file_ioctl_compat+0xd3/0x230 [ 67.954519][ T6725] __ia32_compat_sys_ioctl+0xc2/0x360 [ 67.954534][ T6725] __do_fast_syscall_32+0x13a/0x8b0 [ 67.954547][ T6725] ? lockdep_hardirqs_on+0x7d/0x110 [ 67.954558][ T6725] do_fast_syscall_32+0x32/0x70 [ 67.954570][ T6725] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 67.954585][ T6725] RIP: 0023:0xf7f78fec [ 67.954598][ T6725] Code: Unable to access opcode bytes at 0xf7f78fc2. [ 67.954603][ T6725] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 67.954614][ T6725] RAX: ffffffffffffffda RBX: 000000000000000e RCX: 0000000000000707 [ 67.954621][ T6725] RDX: 0000000080000580 RSI: 0000000000000000 RDI: 0000000000000000 [ 67.954627][ T6725] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 67.954633][ T6725] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 67.954639][ T6725] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 67.954653][ T6725] [ 67.954694][ T6725] ERROR: Out of memory at tomoyo_realpath_from_path. [ 67.987193][ T1525] zl10353_read_register: readreg error (reg=127, ret==-110) [ 68.006203][ T1525] dvb_usb_gl861 5-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 68.045071][ T29] usb 5-1: USB disconnect, device number 7 [ 68.118944][ T6729] FAULT_INJECTION: forcing a failure. [ 68.118944][ T6729] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 68.118967][ T6729] CPU: 1 UID: 0 PID: 6729 Comm: syz.1.210 Tainted: G L syzkaller #0 PREEMPT(full) [ 68.118982][ T6729] Tainted: [L]=SOFTLOCKUP [ 68.118986][ T6729] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 68.118992][ T6729] Call Trace: [ 68.118997][ T6729] [ 68.119002][ T6729] dump_stack_lvl+0x100/0x190 [ 68.119020][ T6729] should_fail_ex.cold+0x5/0xa [ 68.119035][ T6729] _copy_from_user+0x2e/0xd0 [ 68.119048][ T6729] move_addr_to_kernel+0x65/0x170 [ 68.119066][ T6729] __sys_bind+0x11d/0x260 [ 68.119077][ T6729] ? __pfx___sys_bind+0x10/0x10 [ 68.119097][ T6729] __ia32_sys_bind+0x71/0xb0 [ 68.119107][ T6729] ? lockdep_hardirqs_on+0x7d/0x110 [ 68.119118][ T6729] __do_fast_syscall_32+0x13a/0x8b0 [ 68.119132][ T6729] do_fast_syscall_32+0x32/0x70 [ 68.119145][ T6729] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 68.119158][ T6729] RIP: 0023:0xf7fa8fec [ 68.119171][ T6729] Code: Unable to access opcode bytes at 0xf7fa8fc2. [ 68.119176][ T6729] RSP: 002b:00000000f543550c EFLAGS: 00000292 ORIG_RAX: 0000000000000169 [ 68.119187][ T6729] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000440 [ 68.119195][ T6729] RDX: 000000000000001c RSI: 0000000000000000 RDI: 0000000000000000 [ 68.119201][ T6729] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 68.119208][ T6729] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 68.119215][ T6729] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 68.119229][ T6729] [ 68.825652][ T29] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 68.977156][ T29] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 68.978191][ T29] usb 5-1: config 0 has an invalid interface number: 50 but max is 0 [ 68.978211][ T29] usb 5-1: config 0 has no interface number 0 [ 68.978236][ T29] usb 5-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 68.980376][ T29] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.980394][ T29] usb 5-1: Product: syz [ 68.980405][ T29] usb 5-1: Manufacturer: syz [ 68.980415][ T29] usb 5-1: SerialNumber: syz [ 68.982368][ T29] usb 5-1: config 0 descriptor?? [ 68.993553][ T29] yurex 5-1:0.50: USB YUREX device now attached to Yurex #0 [ 69.198793][ T6731] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 69.199623][ T6731] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 69.203575][ T6731] __nla_validate_parse: 57 callbacks suppressed [ 69.203588][ T6731] netlink: 68 bytes leftover after parsing attributes in process `syz.0.213'. [ 69.393684][ T6740] FAULT_INJECTION: forcing a failure. [ 69.393684][ T6740] name failslab, interval 1, probability 0, space 0, times 0 [ 69.393717][ T6740] CPU: 3 UID: 0 PID: 6740 Comm: syz.4.217 Tainted: G L syzkaller #0 PREEMPT(full) [ 69.393738][ T6740] Tainted: [L]=SOFTLOCKUP [ 69.393742][ T6740] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 69.393748][ T6740] Call Trace: [ 69.393752][ T6740] [ 69.393757][ T6740] dump_stack_lvl+0x100/0x190 [ 69.393776][ T6740] should_fail_ex.cold+0x5/0xa [ 69.393791][ T6740] should_failslab+0xc2/0x120 [ 69.393808][ T6740] __kvmalloc_node_noprof+0x113/0x9b0 [ 69.393824][ T6740] ? __pfx___mutex_lock+0x10/0x10 [ 69.393837][ T6740] ? nf_hook_entries_grow+0x255/0x870 [ 69.393865][ T6740] nf_hook_entries_grow+0x255/0x870 [ 69.393877][ T6740] ? __call_rcu_common.constprop.0+0x3f2/0x9b0 [ 69.393899][ T6740] __nf_register_net_hook+0x112/0x780 [ 69.393916][ T6740] nf_register_net_hook+0xdb/0x170 [ 69.393928][ T6740] nf_register_net_hooks+0x5d/0xd0 [ 69.393941][ T6740] nf_defrag_ipv6_enable+0xc1/0x130 [ 69.393971][ T6740] nf_ct_netns_do_get+0x1f9/0x610 [ 69.393985][ T6740] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 69.393999][ T6740] ? xt_find_match+0x1dc/0x280 [ 69.394022][ T6740] nf_ct_netns_get+0x3d/0x160 [ 69.394035][ T6740] helper_mt_check+0x8b/0x150 [ 69.394052][ T6740] ? __pfx_helper_mt_check+0x10/0x10 [ 69.394068][ T6740] xt_check_match+0x117/0x1c0 [ 69.394085][ T6740] find_check_entry.isra.0+0x356/0xa00 [ 69.394103][ T6740] ? __pfx_find_check_entry.isra.0+0x10/0x10 [ 69.394122][ T6740] ? kasan_quarantine_put+0x104/0x240 [ 69.394136][ T6740] ? lockdep_hardirqs_on+0x7d/0x110 [ 69.394148][ T6740] ? translate_table+0xb50/0x1770 [ 69.394161][ T6740] ? translate_table+0xbd8/0x1770 [ 69.394174][ T6740] ? kfree+0x22b/0x6d0 [ 69.394185][ T6740] ? xt_check_table_hooks+0x206/0x330 [ 69.394202][ T6740] translate_table+0xcb9/0x1770 [ 69.394222][ T6740] ? __pfx_translate_table+0x10/0x10 [ 69.394240][ T6740] translate_compat_table+0x12fb/0x17e0 [ 69.394260][ T6740] ? __pfx_translate_compat_table+0x10/0x10 [ 69.394276][ T6740] ? lock_acquire+0x1d1/0x380 [ 69.394291][ T6740] ? __might_fault+0xc5/0x140 [ 69.394312][ T6740] compat_do_replace+0x279/0x500 [ 69.394326][ T6740] ? print_kernel_ident+0x10/0x40 [ 69.394339][ T6740] ? __pfx_compat_do_replace+0x10/0x10 [ 69.394354][ T6740] ? __local_bh_enable_ip+0xa5/0x120 [ 69.394380][ T6740] ? lock_acquire+0x1d1/0x380 [ 69.394400][ T6740] ? bpf_lsm_capable+0x9/0x10 [ 69.394416][ T6740] ? security_capable+0x80/0x260 [ 69.394429][ T6740] do_ip6t_set_ctl+0x2cb/0xbe0 [ 69.394442][ T6740] ? nf_sockopt_find.isra.0+0x222/0x290 [ 69.394459][ T6740] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 69.394473][ T6740] ? __mutex_unlock_slowpath+0x35d/0x930 [ 69.394486][ T6740] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 69.394498][ T6740] ? __lock_acquire+0x5c0/0x1f40 [ 69.394518][ T6740] ? nf_sockopt_find.isra.0+0x222/0x290 [ 69.394534][ T6740] nf_setsockopt+0x8d/0xf0 [ 69.394549][ T6740] ipv6_setsockopt+0x135/0x170 [ 69.394566][ T6740] tcp_setsockopt+0xa7/0x100 [ 69.394585][ T6740] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 69.394604][ T6740] do_sock_setsockopt+0xf3/0x1d0 [ 69.394621][ T6740] __sys_setsockopt+0x119/0x190 [ 69.394637][ T6740] __ia32_sys_setsockopt+0xbc/0x160 [ 69.394649][ T6740] ? __do_fast_syscall_32+0xb3/0x8b0 [ 69.394661][ T6740] ? lockdep_hardirqs_on+0x7d/0x110 [ 69.394671][ T6740] __do_fast_syscall_32+0x13a/0x8b0 [ 69.394682][ T6740] ? lockdep_hardirqs_on+0x7d/0x110 [ 69.394693][ T6740] do_fast_syscall_32+0x32/0x70 [ 69.394705][ T6740] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 69.394720][ T6740] RIP: 0023:0xf7f77fec [ 69.394734][ T6740] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 69.394741][ T6740] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 69.394758][ T6740] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000029 [ 69.394769][ T6740] RDX: 0000000000000040 RSI: 00000000800028c0 RDI: 0000000000000388 [ 69.394779][ T6740] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 69.394791][ T6740] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 69.394801][ T6740] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 69.394826][ T6740] [ 69.395005][ T6740] xt_helper: cannot load conntrack support for proto=10 [ 69.546858][ T6743] netlink: 'syz.4.218': attribute type 10 has an invalid length. [ 70.001542][ T6748] 8021q: VLANs not supported on gre0 [ 70.164179][ T29] usb 6-1: USB disconnect, device number 5 [ 70.483718][ T6761] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.484055][ T6761] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.522088][ T6761] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 70.524882][ T6761] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 70.625718][ T5804] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.625759][ T5804] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.625786][ T5804] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.625814][ T5804] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.640669][ T6763] FAULT_INJECTION: forcing a failure. [ 70.640669][ T6763] name failslab, interval 1, probability 0, space 0, times 0 [ 70.640692][ T6763] CPU: 1 UID: 0 PID: 6763 Comm: syz.1.225 Tainted: G L syzkaller #0 PREEMPT(full) [ 70.640708][ T6763] Tainted: [L]=SOFTLOCKUP [ 70.640712][ T6763] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.640719][ T6763] Call Trace: [ 70.640723][ T6763] [ 70.640742][ T6763] dump_stack_lvl+0x100/0x190 [ 70.640763][ T6763] should_fail_ex.cold+0x5/0xa [ 70.640779][ T6763] should_failslab+0xc2/0x120 [ 70.640797][ T6763] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 70.640813][ T6763] ? create_new_namespaces+0x3ea/0xac0 [ 70.640830][ T6763] ? unshare_nsproxy_namespaces+0xf2/0x220 [ 70.640848][ T6763] ? sock_alloc_inode+0x26/0x2c0 [ 70.640866][ T6763] ? __pfx_sock_alloc_inode+0x10/0x10 [ 70.640882][ T6763] sock_alloc_inode+0x26/0x2c0 [ 70.640896][ T6763] ? __pfx_sock_alloc_inode+0x10/0x10 [ 70.640911][ T6763] alloc_inode+0x68/0x250 [ 70.640927][ T6763] sock_alloc+0x44/0x280 [ 70.640940][ T6763] ? security_socket_create+0x7f/0x250 [ 70.640953][ T6763] sock_create_lite+0x82/0x120 [ 70.640968][ T6763] __netlink_kernel_create+0xbd/0x750 [ 70.640992][ T6763] ? __lock_acquire+0x5c0/0x1f40 [ 70.641010][ T6763] ? __pfx___netlink_kernel_create+0x10/0x10 [ 70.641030][ T6763] ? __pfx_diag_net_init+0x10/0x10 [ 70.641051][ T6763] diag_net_init+0xbd/0x140 [ 70.641064][ T6763] ? __pfx_diag_net_init+0x10/0x10 [ 70.641076][ T6763] ? find_held_lock+0x2b/0x80 [ 70.641089][ T6763] ? __pfx_sock_diag_rcv+0x10/0x10 [ 70.641100][ T6763] ? __pfx_sock_diag_bind+0x10/0x10 [ 70.641115][ T6763] ? __raw_spin_lock_init+0x3a/0x110 [ 70.641127][ T6763] ? __pfx_cma_init_net+0x10/0x10 [ 70.641149][ T6763] ops_init+0x1e2/0x5f0 [ 70.641164][ T6763] setup_net+0x118/0x3a0 [ 70.641179][ T6763] ? __pfx_setup_net+0x10/0x10 [ 70.641198][ T6763] copy_net_ns+0x345/0x7a0 [ 70.641216][ T6763] create_new_namespaces+0x3ea/0xac0 [ 70.641237][ T6763] unshare_nsproxy_namespaces+0xf2/0x220 [ 70.641256][ T6763] ksys_unshare+0x4a2/0xb30 [ 70.641270][ T6763] ? __pfx_ksys_unshare+0x10/0x10 [ 70.641288][ T6763] __ia32_sys_unshare+0x30/0x40 [ 70.641300][ T6763] __do_fast_syscall_32+0x13a/0x8b0 [ 70.641312][ T6763] ? lockdep_hardirqs_on+0x7d/0x110 [ 70.641324][ T6763] do_fast_syscall_32+0x32/0x70 [ 70.641336][ T6763] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 70.641350][ T6763] RIP: 0023:0xf7fa8fec [ 70.641363][ T6763] Code: Unable to access opcode bytes at 0xf7fa8fc2. [ 70.641368][ T6763] RSP: 002b:00000000f543550c EFLAGS: 00000292 ORIG_RAX: 0000000000000136 [ 70.641379][ T6763] RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 0000000000000000 [ 70.641386][ T6763] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 70.641392][ T6763] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 70.641398][ T6763] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 70.641404][ T6763] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 70.641418][ T6763] [ 70.891172][ T6771] netlink: 'syz.1.227': attribute type 10 has an invalid length. [ 70.892440][ T1434] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.892963][ T1434] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.894148][ T6771] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.895701][ T6771] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 70.896267][ T10] cfg80211: failed to load regulatory.db [ 71.035806][ T5890] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 71.134029][ T6777] capability: warning: `syz.1.228' uses deprecated v2 capabilities in a way that may be insecure [ 71.196462][ T5890] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 71.197474][ T5890] usb 9-1: config 0 has an invalid interface number: 50 but max is 0 [ 71.197492][ T5890] usb 9-1: config 0 has no interface number 0 [ 71.197511][ T5890] usb 9-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 71.199487][ T5890] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.199504][ T5890] usb 9-1: Product: syz [ 71.199515][ T5890] usb 9-1: Manufacturer: syz [ 71.199526][ T5890] usb 9-1: SerialNumber: syz [ 71.209915][ T5890] usb 9-1: config 0 descriptor?? [ 71.215384][ T5890] yurex 9-1:0.50: USB YUREX device now attached to Yurex #1 [ 71.295882][ C1] usb 5-1: yurex_control_callback - control failed: -2 [ 71.301850][ T29] usb 5-1: USB disconnect, device number 8 [ 71.311666][ T29] yurex 5-1:0.50: USB YUREX #0 now disconnected [ 71.565523][ T6779] IPVS: Scheduler module ip_vs_sip not found [ 71.899323][ T6784] netlink: 56 bytes leftover after parsing attributes in process `syz.0.231'. [ 72.065123][ T6790] tipc: Failed to clone mcast rcv buffer [ 72.127792][ T6792] mmap: syz.1.234 (6792) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 72.136101][ T6792] netlink: 20 bytes leftover after parsing attributes in process `syz.1.234'. [ 72.375659][ T10] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 72.525670][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 72.526249][ T10] usb 6-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 72.527251][ T10] usb 6-1: config index 0 descriptor too short (expected 5924, got 36) [ 72.527269][ T10] usb 6-1: config 250 has an invalid interface number: 228 but max is -1 [ 72.527284][ T10] usb 6-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 72.527300][ T10] usb 6-1: config 250 has no interface number 0 [ 72.527333][ T10] usb 6-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 72.527354][ T10] usb 6-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 72.527371][ T10] usb 6-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid maxpacket 65535, setting to 1024 [ 72.527391][ T10] usb 6-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 1024 [ 72.527409][ T10] usb 6-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 72.527429][ T10] usb 6-1: config 250 interface 228 has no altsetting 0 [ 72.528895][ T10] usb 6-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 72.528913][ T10] usb 6-1: Product: syz [ 72.528924][ T10] usb 6-1: SerialNumber: syz [ 72.536083][ T10] hub 6-1:250.228: bad descriptor, ignoring hub [ 72.536102][ T10] hub 6-1:250.228: probe with driver hub failed with error -5 [ 72.747522][ T10] usblp 6-1:250.228: usblp0: USB Bidirectional printer dev 6 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 72.766163][ T10] usb 6-1: USB disconnect, device number 6 [ 72.773692][ T10] usblp0: removed [ 73.315701][ T29] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 73.446036][ T29] usb 5-1: device descriptor read/64, error -71 [ 73.685660][ T29] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 73.801744][ T5836] usb 9-1: USB disconnect, device number 5 [ 73.812310][ T5836] yurex 9-1:0.50: USB YUREX #1 now disconnected [ 73.825671][ T29] usb 5-1: device descriptor read/64, error -71 [ 73.948089][ T29] usb usb5-port1: attempt power cycle [ 74.145713][ T5836] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 74.298200][ T5836] usb 9-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 74.305651][ T29] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 74.306302][ T5836] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.306315][ T5836] usb 9-1: Product: syz [ 74.306328][ T5836] usb 9-1: Manufacturer: syz [ 74.306335][ T5836] usb 9-1: SerialNumber: syz [ 74.326165][ T29] usb 5-1: device descriptor read/8, error -71 [ 74.364271][ T6808] netlink: 'syz.1.239': attribute type 1 has an invalid length. [ 74.595661][ T29] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 74.624146][ T2314] usb 9-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 74.626026][ T29] usb 5-1: device descriptor read/8, error -71 [ 74.737958][ T29] usb usb5-port1: unable to enumerate USB device [ 75.696715][ T2314] ath9k_htc 9-1:1.0: ath9k_htc: Target is unresponsive [ 75.697441][ T2314] ath9k_htc: Failed to initialize the device [ 75.723166][ T2314] usb 9-1: ath9k_htc: USB layer deinitialized [ 76.839383][ T6802] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 76.839541][ T6802] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 76.839679][ T6802] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 76.839823][ T6802] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 76.885727][ T5890] usb 9-1: USB disconnect, device number 6 [ 76.967084][ T5093] Bluetooth: hci1: command 0x040f tx timeout [ 77.082767][ T6828] netlink: 'syz.4.243': attribute type 10 has an invalid length. [ 77.430627][ T6839] dummy0 speed is unknown, defaulting to 1000 [ 77.430663][ T6839] dummy0 speed is unknown, defaulting to 1000 [ 77.431189][ T6839] dummy0 speed is unknown, defaulting to 1000 [ 77.431636][ T6839] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 77.431654][ T6839] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 77.431677][ T6839] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 77.437473][ T6839] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 77.441318][ T6839] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 77.466208][ T6839] dummy0 speed is unknown, defaulting to 1000 [ 77.467068][ T6839] dummy0 speed is unknown, defaulting to 1000 [ 77.467897][ T6839] dummy0 speed is unknown, defaulting to 1000 [ 77.471663][ T6839] dummy0 speed is unknown, defaulting to 1000 [ 77.483387][ T6839] netlink: 4 bytes leftover after parsing attributes in process `syz.0.247'. [ 78.530479][ T6866] Invalid ELF header magic: != ELF [ 78.714427][ T6871] netlink: 'syz.4.257': attribute type 8 has an invalid length. [ 78.886975][ T5093] Bluetooth: hci3: command 0x041b tx timeout [ 78.887009][ T5093] Bluetooth: hci2: command 0x0419 tx timeout [ 78.887934][ T5741] Bluetooth: hci0: command 0x0419 tx timeout [ 79.057656][ T6890] netlink: 'syz.4.264': attribute type 10 has an invalid length. [ 79.281361][ T6895] netlink: 'syz.1.266': attribute type 2 has an invalid length. [ 79.405019][ T6902] netlink: 'syz.4.269': attribute type 1 has an invalid length. [ 79.416425][ T6902] bond1: entered promiscuous mode [ 79.419304][ T6902] 8021q: adding VLAN 0 to HW filter on device bond1 [ 79.433766][ T6902] wireguard0: entered allmulticast mode [ 79.959318][ T5835] bond0: (slave netdevsim1): Releasing backup interface [ 79.960236][ T5835] netdevsim netdevsim0 netdevsim1 (unregistering): left promiscuous mode [ 80.003215][ T64] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 80.004894][ T64] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 80.007238][ T64] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 80.013019][ T64] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.014249][ T64] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. [ 80.252749][ T5835] bridge_slave_1: left allmulticast mode [ 80.252766][ T5835] bridge_slave_1: left promiscuous mode [ 80.252876][ T5835] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.259989][ T5835] bridge_slave_0: left allmulticast mode [ 80.260003][ T5835] bridge_slave_0: left promiscuous mode [ 80.260228][ T5835] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.372016][ T5835] bond0 (unregistering): left promiscuous mode [ 80.372031][ T5835] bond_slave_0: left promiscuous mode [ 80.372098][ T5835] bond_slave_1: left promiscuous mode [ 80.373176][ T5835] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 80.374416][ T5835] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 80.374958][ T5835] bond0 (unregistering): Released all slaves [ 80.391793][ T6924] rxe_eth0 speed is unknown, defaulting to 1000 [ 80.563614][ T6924] dummy0 speed is unknown, defaulting to 1000 [ 80.643626][ T5447] 8021q: adding VLAN 0 to HW filter on device eth6 [ 80.785657][ T29] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 80.864743][ T5447] 8021q: adding VLAN 0 to HW filter on device eth7 [ 80.916313][ T6963] FAULT_INJECTION: forcing a failure. [ 80.916313][ T6963] name failslab, interval 1, probability 0, space 0, times 0 [ 80.916344][ T6963] CPU: 0 UID: 0 PID: 6963 Comm: syz.4.281 Tainted: G L syzkaller #0 PREEMPT(full) [ 80.916370][ T6963] Tainted: [L]=SOFTLOCKUP [ 80.916377][ T6963] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.916388][ T6963] Call Trace: [ 80.916395][ T6963] [ 80.916403][ T6963] dump_stack_lvl+0x100/0x190 [ 80.916433][ T6963] should_fail_ex.cold+0x5/0xa [ 80.916457][ T6963] should_failslab+0xc2/0x120 [ 80.916486][ T6963] __kvmalloc_node_noprof+0x113/0x9b0 [ 80.916515][ T6963] ? traverse.part.0.constprop.0+0x397/0x650 [ 80.916545][ T6963] traverse.part.0.constprop.0+0x397/0x650 [ 80.916578][ T6963] seq_read_iter+0x93f/0x1270 [ 80.916602][ T6963] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 80.916635][ T6963] kernfs_fop_read_iter+0x46c/0x610 [ 80.916664][ T6963] copy_splice_read+0x4ba/0xbb0 [ 80.916697][ T6963] ? __pfx_copy_splice_read+0x10/0x10 [ 80.916725][ T6963] ? look_up_lock_class+0x55/0x120 [ 80.916742][ T6963] ? rcu_is_watching+0x13/0xc0 [ 80.916768][ T6963] ? lockdep_init_map_type+0x5c/0x250 [ 80.916801][ T6963] ? __pfx_copy_splice_read+0x10/0x10 [ 80.916827][ T6963] do_splice_read+0x285/0x370 [ 80.916856][ T6963] splice_direct_to_actor+0x2a1/0xa30 [ 80.916885][ T6963] ? __pfx_direct_splice_actor+0x10/0x10 [ 80.916917][ T6963] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 80.916954][ T6963] ? lock_acquire+0x1d1/0x380 [ 80.916983][ T6963] do_splice_direct+0x174/0x240 [ 80.917011][ T6963] ? __pfx_do_splice_direct+0x10/0x10 [ 80.917039][ T6963] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 80.917070][ T6963] ? rw_verify_area+0xce/0x6d0 [ 80.917093][ T6963] do_sendfile+0xadc/0xe20 [ 80.917121][ T6963] ? __pfx_do_sendfile+0x10/0x10 [ 80.917143][ T6963] ? __might_fault+0xc5/0x140 [ 80.917172][ T6963] __ia32_compat_sys_sendfile+0x162/0x220 [ 80.917200][ T6963] ? __pfx___ia32_compat_sys_sendfile+0x10/0x10 [ 80.917227][ T6963] ? ksys_write+0x1ac/0x250 [ 80.917249][ T6963] ? __pfx_ksys_write+0x10/0x10 [ 80.917278][ T6963] __do_fast_syscall_32+0x13a/0x8b0 [ 80.917297][ T6963] ? lockdep_hardirqs_on+0x7d/0x110 [ 80.917317][ T6963] do_fast_syscall_32+0x32/0x70 [ 80.917337][ T6963] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 80.917360][ T6963] RIP: 0023:0xf7f77fec [ 80.917379][ T6963] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 80.917388][ T6963] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 00000000000000bb [ 80.917423][ T6963] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000003 [ 80.917435][ T6963] RDX: 00000000800009c0 RSI: 0000000000000008 RDI: 0000000000000000 [ 80.917446][ T6963] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 80.917457][ T6963] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 80.917467][ T6963] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 80.917493][ T6963] [ 80.927873][ T6924] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.928041][ T6924] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.928141][ T6924] bridge_slave_0: entered allmulticast mode [ 80.929515][ T6924] bridge_slave_0: entered promiscuous mode [ 80.966396][ T29] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 80.969023][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.969037][ T29] usb 6-1: Product: syz [ 80.969044][ T29] usb 6-1: Manufacturer: syz [ 80.969051][ T29] usb 6-1: SerialNumber: syz [ 80.988903][ T5835] batadv0: left promiscuous mode [ 81.007450][ T29] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 81.060607][ T5835] hsr_slave_0: left promiscuous mode [ 81.061217][ T5835] hsr_slave_1: left promiscuous mode [ 81.062953][ T5835] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 81.067624][ T5835] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 81.101379][ T5741] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 81.104336][ T5741] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 81.104975][ T5741] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 81.107400][ T5741] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 81.108715][ T5741] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 81.259357][ T5835] team0 (unregistering): Port device team_slave_1 removed [ 81.283553][ T5835] team0 (unregistering): Port device team_slave_0 removed [ 81.387883][ T6924] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.387957][ T6924] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.388074][ T6924] bridge_slave_1: entered allmulticast mode [ 81.389376][ T6924] bridge_slave_1: entered promiscuous mode [ 81.411483][ T6981] FAULT_INJECTION: forcing a failure. [ 81.411483][ T6981] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 81.411536][ T6981] CPU: 2 UID: 0 PID: 6981 Comm: syz.4.287 Tainted: G L syzkaller #0 PREEMPT(full) [ 81.411553][ T6981] Tainted: [L]=SOFTLOCKUP [ 81.411557][ T6981] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 81.411564][ T6981] Call Trace: [ 81.411568][ T6981] [ 81.411573][ T6981] dump_stack_lvl+0x100/0x190 [ 81.411592][ T6981] should_fail_ex.cold+0x5/0xa [ 81.411611][ T6981] _copy_to_user+0x32/0xd0 [ 81.411632][ T6981] simple_read_from_buffer+0xcb/0x170 [ 81.411655][ T6981] proc_fail_nth_read+0x1af/0x230 [ 81.411679][ T6981] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 81.411702][ T6981] ? rw_verify_area+0xce/0x6d0 [ 81.411740][ T6981] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 81.411764][ T6981] vfs_read+0x1e4/0xb40 [ 81.411784][ T6981] ? lock_acquire+0x1d1/0x380 [ 81.411800][ T6981] ? __fget_files+0x34/0x3d0 [ 81.411814][ T6981] ? __pfx_vfs_read+0x10/0x10 [ 81.411826][ T6981] ? find_held_lock+0x2b/0x80 [ 81.411840][ T6981] ? __fget_files+0x215/0x3d0 [ 81.411857][ T6981] ? __fget_files+0x21f/0x3d0 [ 81.411876][ T6981] ksys_read+0x12a/0x250 [ 81.411889][ T6981] ? __pfx_ksys_read+0x10/0x10 [ 81.411907][ T6981] do_int80_emulation+0x166/0x650 [ 81.411921][ T6981] asm_int80_emulation+0x1a/0x20 [ 81.411933][ T6981] RIP: 0023:0xf71677eb [ 81.411943][ T6981] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 81.411953][ T6981] RSP: 002b:00000000f54264bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 81.411965][ T6981] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54265d0 [ 81.411972][ T6981] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 81.411976][ T1170] smbdirect: ib_dev[syz0] removed [ 81.411978][ T6981] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 81.411984][ T6981] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 81.411991][ T6981] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 81.412005][ T6981] [ 81.439766][ T6944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 81.440110][ T6944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 81.540281][ T5806] usb 6-1: USB disconnect, device number 7 [ 81.540473][ T6924] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.551368][ T6924] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.591466][ T6924] team0: Port device team_slave_0 added [ 81.592791][ T6924] team0: Port device team_slave_1 added [ 81.604578][ T6924] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.604587][ T6924] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.604600][ T6924] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.605421][ T6924] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.605429][ T6924] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.605441][ T6924] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.626776][ T6924] hsr_slave_0: entered promiscuous mode [ 81.627166][ T6924] hsr_slave_1: entered promiscuous mode [ 81.627556][ T6924] debugfs: 'hsr0' already exists in 'hsr' [ 81.627569][ T6924] Cannot create hsr debugfs directory [ 81.682824][ T6969] rxe_eth0 speed is unknown, defaulting to 1000 [ 81.782006][ T5447] 8021q: adding VLAN 0 to HW filter on device eth8 [ 81.796159][ T2314] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 81.883000][ T5835] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 81.948245][ T5835] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 81.957513][ T2314] usb 9-1: Using ep0 maxpacket: 16 [ 81.959311][ T2314] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 81.961006][ T2314] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 81.961030][ T2314] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 81.961043][ T2314] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 81.961054][ T2314] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 81.961065][ T2314] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 81.965471][ T2314] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 81.965491][ T2314] usb 9-1: Manufacturer: syz [ 81.968953][ T2314] usb 9-1: config 0 descriptor?? [ 82.019792][ T5835] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 82.094251][ T5835] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 82.096369][ T5741] Bluetooth: hci0: command tx timeout [ 82.096643][ T7016] FAULT_INJECTION: forcing a failure. [ 82.096643][ T7016] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 82.096671][ T7016] CPU: 1 UID: 0 PID: 7016 Comm: syz.1.291 Tainted: G L syzkaller #0 PREEMPT(full) [ 82.096696][ T7016] Tainted: [L]=SOFTLOCKUP [ 82.096701][ T7016] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 82.096711][ T7016] Call Trace: [ 82.096718][ T7016] [ 82.096725][ T7016] dump_stack_lvl+0x100/0x190 [ 82.096754][ T7016] should_fail_ex.cold+0x5/0xa [ 82.096778][ T7016] _copy_from_user+0x2e/0xd0 [ 82.096814][ T7016] kstrtouint_from_user+0xd6/0x1d0 [ 82.096839][ T7016] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 82.096869][ T7016] ? lock_acquire+0x1d1/0x380 [ 82.096901][ T7016] proc_fail_nth_write+0x83/0x220 [ 82.096927][ T7016] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 82.096958][ T7016] vfs_write+0x2aa/0x1050 [ 82.096982][ T7016] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 82.097006][ T7016] ? lock_acquire+0x1d1/0x380 [ 82.097029][ T7016] ? __fget_files+0x34/0x3d0 [ 82.097053][ T7016] ? __pfx_vfs_write+0x10/0x10 [ 82.097073][ T7016] ? find_held_lock+0x2b/0x80 [ 82.097095][ T7016] ? __fget_files+0x215/0x3d0 [ 82.097123][ T7016] ? __fget_files+0x21f/0x3d0 [ 82.097153][ T7016] ksys_write+0x12a/0x250 [ 82.097175][ T7016] ? __pfx_ksys_write+0x10/0x10 [ 82.097203][ T7016] do_int80_emulation+0x166/0x650 [ 82.097227][ T7016] asm_int80_emulation+0x1a/0x20 [ 82.097244][ T7016] RIP: 0023:0xf71977eb [ 82.097261][ T7016] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 82.097284][ T7016] RSP: 002b:00000000f54564bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 82.097302][ T7016] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f54565d0 [ 82.097313][ T7016] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 82.097324][ T7016] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 82.097334][ T7016] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 82.097343][ T7016] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 82.097367][ T7016] [ 82.255736][ T2314] rc_core: IR keymap rc-hauppauge not found [ 82.255768][ T2314] Registered IR keymap rc-empty [ 82.256220][ T2314] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 82.257393][ T29] usb 6-1: Service connection timeout for: 256 [ 82.257408][ T29] ath9k_htc 6-1:1.0: ath9k_htc: Unable to initialize HTC services [ 82.257894][ T29] ath9k_htc: Failed to initialize the device [ 82.259001][ T5806] usb 6-1: ath9k_htc: USB layer deinitialized [ 82.276791][ T2314] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 82.282826][ T6924] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 82.290714][ T6924] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.291308][ T6924] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 82.297533][ T2314] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 82.298669][ T2314] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input9 [ 82.302832][ T6924] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.311476][ T2314] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 82.335845][ T2314] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 82.336845][ T6924] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 82.340688][ T6924] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.341349][ T6924] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 82.343877][ T6924] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.369201][ T2314] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 82.373748][ T6969] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.373825][ T6969] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.373974][ T6969] bridge_slave_0: entered allmulticast mode [ 82.379749][ T6969] bridge_slave_0: entered promiscuous mode [ 82.386407][ T2314] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 82.388911][ T6969] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.388988][ T6969] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.389072][ T6969] bridge_slave_1: entered allmulticast mode [ 82.389821][ T6969] bridge_slave_1: entered promiscuous mode [ 82.409848][ T2314] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 82.421049][ T42] audit: type=1326 audit(1792344101.610:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6986 comm="syz.4.289" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 82.423457][ T42] audit: type=1326 audit(1792344101.620:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6986 comm="syz.4.289" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 82.423484][ T42] audit: type=1326 audit(1792344101.620:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6986 comm="syz.4.289" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 82.423504][ T42] audit: type=1326 audit(1792344101.620:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6986 comm="syz.4.289" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 82.423523][ T42] audit: type=1326 audit(1792344101.620:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6986 comm="syz.4.289" exe="/syz-executor" sig=0 arch=40000003 syscall=306 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 82.423542][ T42] audit: type=1326 audit(1792344101.620:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6986 comm="syz.4.289" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 82.423561][ T42] audit: type=1326 audit(1792344101.620:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6986 comm="syz.4.289" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 82.423581][ T42] audit: type=1326 audit(1792344101.620:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6986 comm="syz.4.289" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 82.423601][ T42] audit: type=1326 audit(1792344101.620:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6986 comm="syz.4.289" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 82.423751][ T42] audit: type=1326 audit(1792344101.620:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6986 comm="syz.4.289" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 82.432164][ T2314] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 82.447988][ T2314] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 82.464953][ T6987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 82.465148][ T6987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 82.475861][ T2314] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 82.499560][ T2314] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 82.515828][ T2314] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 82.533801][ T5835] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 82.536798][ T2314] mceusb 9-1:0.0: Registered with mce emulator interface version 1 [ 82.536811][ T2314] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 82.542171][ T2314] usb 9-1: USB disconnect, device number 7 [ 82.552942][ T5835] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 82.557157][ T5835] bond0 (unregistering): Released all slaves [ 82.588928][ T6969] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.598418][ T6969] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.620061][ T6969] team0: Port device team_slave_0 added [ 82.620091][ T5835] : left promiscuous mode [ 82.637278][ T6969] team0: Port device team_slave_1 added [ 82.658538][ T6969] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.658555][ T6969] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.658576][ T6969] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.660152][ T6969] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.660164][ T6969] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.660313][ T6969] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.699626][ T6969] hsr_slave_0: entered promiscuous mode [ 82.700485][ T6969] hsr_slave_1: entered promiscuous mode [ 82.701066][ T6969] debugfs: 'hsr0' already exists in 'hsr' [ 82.701083][ T6969] Cannot create hsr debugfs directory [ 82.804594][ T5447] 8021q: adding VLAN 0 to HW filter on device eth6 [ 82.872230][ T6924] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.872589][ T6969] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 82.878541][ T6969] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.884711][ T6969] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 82.893594][ T6969] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.894053][ T6969] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 82.900812][ T6969] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.901640][ T6969] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 82.907457][ T6969] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.930262][ T6924] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.940738][ T108] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.940822][ T108] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.960395][ T1161] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.960476][ T1161] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.993980][ T5835] hsr_slave_0: left promiscuous mode [ 82.994888][ T5835] hsr_slave_1: left promiscuous mode [ 82.998170][ T5835] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 82.998188][ T5835] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 82.999044][ T5835] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 82.999057][ T5835] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 83.010692][ T5835] veth1_macvtap: left promiscuous mode [ 83.010743][ T5835] veth0_macvtap: left promiscuous mode [ 83.010852][ T5835] veth1_vlan: left promiscuous mode [ 83.010975][ T5835] veth0_vlan: left promiscuous mode [ 83.129832][ T5741] Bluetooth: hci4: command tx timeout [ 83.214496][ T5835] team0 (unregistering): Port device team_slave_1 removed [ 83.225029][ T5835] team0 (unregistering): Port device team_slave_0 removed [ 83.312062][ T5447] 8021q: adding VLAN 0 to HW filter on device eth7 [ 83.374498][ T6969] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.394833][ T6969] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.402776][ T1170] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.402860][ T1170] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.406144][ T29] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 83.407699][ T1170] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.407801][ T1170] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.556248][ T29] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 83.556539][ T5447] 8021q: adding VLAN 0 to HW filter on device eth8 [ 83.557090][ T29] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 83.557113][ T29] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.564182][ T29] keyspan 9-1:1.0: Keyspan 2 port adapter converter detected [ 83.564396][ T29] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 81 [ 83.564450][ T29] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 1 [ 83.569664][ T29] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 84 [ 83.569724][ T29] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 2 [ 83.581075][ T29] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 83.587524][ T29] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 88 [ 83.587597][ T29] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 6 [ 83.591748][ T29] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 83.624253][ T6924] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.649711][ T6924] veth0_vlan: entered promiscuous mode [ 83.655025][ T6924] veth1_vlan: entered promiscuous mode [ 83.673374][ T6924] veth0_macvtap: entered promiscuous mode [ 83.675478][ T6924] veth1_macvtap: entered promiscuous mode [ 83.689776][ T6924] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.698803][ T6924] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.726428][ T5835] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.726453][ T5835] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.726470][ T5835] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.726488][ T5835] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.755384][ T6969] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.763454][ T5447] 8021q: adding VLAN 0 to HW filter on device eth9 [ 83.806990][ T1170] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.807011][ T1170] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.819699][ T226] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.819738][ T226] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.994163][ T6969] veth0_vlan: entered promiscuous mode [ 84.002533][ T6969] veth1_vlan: entered promiscuous mode [ 84.023445][ T7123] netlink: 8 bytes leftover after parsing attributes in process `syz.0.296'. [ 84.045728][ T6969] veth0_macvtap: entered promiscuous mode [ 84.048326][ T6969] veth1_macvtap: entered promiscuous mode [ 84.064164][ T6969] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.071206][ T6969] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.156003][ T5835] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.156038][ T5835] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.156056][ T5835] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.156073][ T5835] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.167464][ T5741] Bluetooth: hci0: command tx timeout [ 84.197811][ T74] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.197831][ T74] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.198761][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.198771][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.538388][ T5806] usb 9-1: USB disconnect, device number 8 [ 84.544311][ T5806] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 84.547380][ T5806] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 84.547655][ T5806] keyspan 9-1:1.0: device disconnected [ 84.625807][ T34] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 84.807038][ T34] usb 10-1: New USB device found, idVendor=0644, idProduct=8020, bcdDevice= 0.40 [ 84.819266][ T34] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.819285][ T34] usb 10-1: Product: syz [ 84.819293][ T34] usb 10-1: Manufacturer: syz [ 84.819300][ T34] usb 10-1: SerialNumber: syz [ 84.914682][ T7135] fuse: Bad value for 'fd' [ 85.076619][ T34] usb 10-1: Can't get UAC3 power state for id 10 [ 85.086550][ T34] usb 10-1: BAAD HEADSET c_chmask mismatch [ 85.205719][ T5741] Bluetooth: hci4: command tx timeout [ 85.459931][ T7151] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input10 [ 85.736749][ T7154] FAULT_INJECTION: forcing a failure. [ 85.736749][ T7154] name failslab, interval 1, probability 0, space 0, times 0 [ 85.736781][ T7154] CPU: 1 UID: 0 PID: 7154 Comm: syz.1.306 Tainted: G L syzkaller #0 PREEMPT(full) [ 85.736805][ T7154] Tainted: [L]=SOFTLOCKUP [ 85.736812][ T7154] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.736823][ T7154] Call Trace: [ 85.736830][ T7154] [ 85.736838][ T7154] dump_stack_lvl+0x100/0x190 [ 85.736867][ T7154] should_fail_ex.cold+0x5/0xa [ 85.736891][ T7154] should_failslab+0xc2/0x120 [ 85.736918][ T7154] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 85.736943][ T7154] ? __alloc_skb+0x5b7/0x710 [ 85.736964][ T7154] ? __alloc_skb+0x140/0x710 [ 85.736989][ T7154] __alloc_skb+0x140/0x710 [ 85.737008][ T7154] ? __alloc_skb+0x5b7/0x710 [ 85.737028][ T7154] ? __pfx___alloc_skb+0x10/0x10 [ 85.737047][ T7154] ? __might_fault+0xc5/0x140 [ 85.737067][ T7154] ? __pfx___up_read+0x10/0x10 [ 85.737085][ T7154] ? hidp_session_find+0xf8/0x150 [ 85.737126][ T7154] ? hidp_session_find+0xf8/0x150 [ 85.737154][ T7154] hidp_send_message.isra.0+0x9b/0x230 [ 85.737184][ T7154] hidp_connection_del+0x1fb/0x2a0 [ 85.737212][ T7154] do_hidp_sock_ioctl.isra.0+0x19a/0x520 [ 85.737240][ T7154] ? __pfx_do_hidp_sock_ioctl.isra.0+0x10/0x10 [ 85.737270][ T7154] ? tomoyo_path_number_perm+0x46d/0x580 [ 85.737293][ T7154] ? stack_trace_save+0x8e/0xc0 [ 85.737328][ T7154] ? kasan_save_free_info+0x3b/0x70 [ 85.737348][ T7154] ? __kasan_slab_free+0x5f/0x80 [ 85.737373][ T7154] ? kfree+0x22b/0x6d0 [ 85.737391][ T7154] ? tomoyo_path_number_perm+0x46d/0x580 [ 85.737415][ T7154] ? security_file_ioctl_compat+0xd3/0x230 [ 85.737436][ T7154] ? __ia32_compat_sys_ioctl+0xc2/0x360 [ 85.737457][ T7154] ? __do_fast_syscall_32+0x13a/0x8b0 [ 85.737476][ T7154] ? do_fast_syscall_32+0x32/0x70 [ 85.737495][ T7154] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 85.737540][ T7154] hidp_sock_compat_ioctl+0xf8/0x4e0 [ 85.737567][ T7154] ? __pfx_hidp_sock_compat_ioctl+0x10/0x10 [ 85.737599][ T7154] ? kasan_quarantine_put+0x104/0x240 [ 85.737622][ T7154] ? lockdep_hardirqs_on+0x7d/0x110 [ 85.737642][ T7154] ? find_held_lock+0x2b/0x80 [ 85.737662][ T7154] ? tomoyo_path_number_perm+0x28f/0x580 [ 85.737684][ T7154] ? tomoyo_path_number_perm+0x28f/0x580 [ 85.737710][ T7154] ? tomoyo_path_number_perm+0x188/0x580 [ 85.737734][ T7154] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 85.737757][ T7154] ? get_pid_task+0x106/0x250 [ 85.737784][ T7154] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 85.737814][ T7154] ? do_vfs_ioctl+0x226/0x13e0 [ 85.737856][ T7154] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 85.737880][ T7154] ? __pfx_hidp_sock_compat_ioctl+0x10/0x10 [ 85.737907][ T7154] compat_sock_ioctl+0x179/0x760 [ 85.737930][ T7154] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 85.737947][ T7154] ? hook_file_ioctl_common+0x140/0x440 [ 85.737975][ T7154] ? __fget_files+0x21f/0x3d0 [ 85.738004][ T7154] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 85.738023][ T7154] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 85.738049][ T7154] __do_fast_syscall_32+0x13a/0x8b0 [ 85.738067][ T7154] ? lockdep_hardirqs_on+0x7d/0x110 [ 85.738087][ T7154] do_fast_syscall_32+0x32/0x70 [ 85.738106][ T7154] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 85.738128][ T7154] RIP: 0023:0xf7fa8fec [ 85.738149][ T7154] Code: Unable to access opcode bytes at 0xf7fa8fc2. [ 85.738157][ T7154] RSP: 002b:00000000f541450c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 85.738176][ T7154] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000400448c9 [ 85.738188][ T7154] RDX: 00000000800013c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 85.738198][ T7154] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 85.738210][ T7154] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 85.738222][ T7154] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 85.738246][ T7154] [ 85.738284][ T7154] Bluetooth: Can't allocate memory for new frame [ 85.942449][ T7159] Bluetooth: MGMT ver 1.23 [ 86.061186][ T7161] fuse: Bad value for 'fd' [ 86.080035][ T34] snd-usb-audio 10-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 86.084630][ T34] usb 10-1: USB disconnect, device number 2 [ 86.116702][ T5747] udevd[5747]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 86.213882][ T7169] pci_bus 0000:01: busn_res: [bus 01] is released [ 86.246042][ T64] Bluetooth: hci0: command tx timeout [ 86.267153][ T7174] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 86.270600][ T7174] pci 0000:00:04.0: PCI bridge to [bus 01] [ 86.270739][ T7174] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 86.270833][ T7174] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 86.272251][ T7174] pci 0000:00:04.0: bridge window [mem 0xfe000000-0xfe1fffff 64bit pref] [ 86.272833][ T7174] pci 0000:00:04.0: enabling Extended Tags [ 86.274484][ T7169] jffs2: notice: (7169) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 86.299748][ T7174] pci 0000:00:04.0: Adding to iommu group 4 [ 86.324840][ T7174] pci 0000:00:04.0: PCI bridge to [bus 01] [ 86.327347][ T7174] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 86.327378][ T7174] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 86.327458][ T7174] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 86.327474][ T7174] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 86.327490][ T7174] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 86.327558][ T7174] pci 0000:00:04.0: PCI bridge to [bus 01] [ 86.327619][ T7174] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 86.329630][ T7174] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 86.330361][ T7174] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 86.388191][ T7174] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 86.402431][ T7174] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 86.555670][ T34] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 86.715665][ T34] usb 10-1: Using ep0 maxpacket: 8 [ 86.716453][ T34] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 86.717253][ T34] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 86.717275][ T34] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 86.717286][ T34] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 86.717298][ T34] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 86.717310][ T34] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 86.717329][ T34] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.930447][ T7176] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 86.930652][ T7176] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 86.948778][ T34] usb 10-1: usb_control_msg returned -71 [ 86.948800][ T34] usbtmc 10-1:16.0: can't read capabilities [ 86.958295][ T34] usb 10-1: USB disconnect, device number 3 [ 87.004040][ T7191] netlink: 64 bytes leftover after parsing attributes in process `syz.4.315'. [ 87.176775][ T7196] No source specified [ 87.285896][ T64] Bluetooth: hci4: command tx timeout [ 87.568838][ T7213] Invalid ELF header magic: != ELF [ 87.738092][ T7217] FAULT_INJECTION: forcing a failure. [ 87.738092][ T7217] name failslab, interval 1, probability 0, space 0, times 0 [ 87.738128][ T7217] CPU: 3 UID: 0 PID: 7217 Comm: syz.1.325 Tainted: G L syzkaller #0 PREEMPT(full) [ 87.738153][ T7217] Tainted: [L]=SOFTLOCKUP [ 87.738159][ T7217] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.738170][ T7217] Call Trace: [ 87.738177][ T7217] [ 87.738185][ T7217] dump_stack_lvl+0x100/0x190 [ 87.738217][ T7217] should_fail_ex.cold+0x5/0xa [ 87.738243][ T7217] should_failslab+0xc2/0x120 [ 87.738275][ T7217] __kmalloc_cache_noprof+0x91/0x6d0 [ 87.738299][ T7217] ? io_uring_setup.cold+0x6c/0x1c0e [ 87.738333][ T7217] io_uring_setup.cold+0x6c/0x1c0e [ 87.738361][ T7217] ? find_held_lock+0x2b/0x80 [ 87.738385][ T7217] ? __pfx_io_uring_setup+0x10/0x10 [ 87.738408][ T7217] ? do_futex+0x190/0x440 [ 87.738429][ T7217] ? __pfx_do_futex+0x10/0x10 [ 87.738449][ T7217] ? __fget_files+0x215/0x3d0 [ 87.738485][ T7217] ? xfd_validate_state+0x129/0x190 [ 87.738538][ T7217] __ia32_sys_io_uring_setup+0xc2/0x170 [ 87.738563][ T7217] __do_fast_syscall_32+0x13a/0x8b0 [ 87.738586][ T7217] ? lockdep_hardirqs_on+0x7d/0x110 [ 87.738606][ T7217] do_fast_syscall_32+0x32/0x70 [ 87.738628][ T7217] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 87.738649][ T7217] RIP: 0023:0xf7fa8fec [ 87.738671][ T7217] Code: Unable to access opcode bytes at 0xf7fa8fc2. [ 87.738678][ T7217] RSP: 002b:00000000f54564bc EFLAGS: 00000282 ORIG_RAX: 00000000000001a9 [ 87.738699][ T7217] RAX: ffffffffffffffda RBX: 0000000000000020 RCX: 00000000800001c0 [ 87.738711][ T7217] RDX: 00000000f71c1217 RSI: 0000000000000001 RDI: 00000000f545653c [ 87.738722][ T7217] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 87.738735][ T7217] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 87.738746][ T7217] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 87.738769][ T7217] [ 87.763590][ T7217] netlink: 4 bytes leftover after parsing attributes in process `syz.1.325'. [ 88.005735][ T5741] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 88.326162][ T5741] Bluetooth: hci0: command 0x0419 tx timeout [ 88.395743][ T5890] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 88.545653][ T5890] usb 9-1: Using ep0 maxpacket: 8 [ 88.546411][ T5890] usb 9-1: New USB device found, idVendor=68b1, idProduct=115e, bcdDevice=80.0f [ 88.546444][ T5890] usb 9-1: no configurations [ 88.546454][ T5890] usb 9-1: can't read configurations, error -22 [ 88.693704][ T5890] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 88.855659][ T5890] usb 9-1: Using ep0 maxpacket: 8 [ 88.856434][ T5890] usb 9-1: New USB device found, idVendor=68b1, idProduct=115e, bcdDevice=80.0f [ 88.856466][ T5890] usb 9-1: no configurations [ 88.856477][ T5890] usb 9-1: can't read configurations, error -22 [ 88.857654][ T5890] usb usb9-port1: attempt power cycle [ 88.941924][ T7235] Invalid ELF header magic: != ELF [ 89.215216][ T7242] Invalid ELF header magic: != ELF [ 89.365690][ T5741] Bluetooth: hci4: command tx timeout [ 89.425644][ T5890] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 89.446086][ T5890] usb 9-1: Using ep0 maxpacket: 8 [ 89.446542][ T5890] usb 9-1: New USB device found, idVendor=68b1, idProduct=115e, bcdDevice=80.0f [ 89.446564][ T5890] usb 9-1: no configurations [ 89.446570][ T5890] usb 9-1: can't read configurations, error -22 [ 89.576470][ T5890] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 89.600271][ T5890] usb 9-1: Using ep0 maxpacket: 8 [ 89.600804][ T5890] usb 9-1: New USB device found, idVendor=68b1, idProduct=115e, bcdDevice=80.0f [ 89.600838][ T5890] usb 9-1: no configurations [ 89.600849][ T5890] usb 9-1: can't read configurations, error -22 [ 89.601061][ T5890] usb usb9-port1: unable to enumerate USB device [ 90.243146][ T7258] rxe_eth0 speed is unknown, defaulting to 1000 [ 90.265081][ T7248] FAULT_INJECTION: forcing a failure. [ 90.265081][ T7248] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 90.265113][ T7248] CPU: 0 UID: 0 PID: 7248 Comm: syz.1.333 Tainted: G L syzkaller #0 PREEMPT(full) [ 90.265136][ T7248] Tainted: [L]=SOFTLOCKUP [ 90.265142][ T7248] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 90.265152][ T7248] Call Trace: [ 90.265158][ T7248] [ 90.265166][ T7248] dump_stack_lvl+0x100/0x190 [ 90.265194][ T7248] should_fail_ex.cold+0x5/0xa [ 90.265216][ T7248] _copy_from_user+0x2e/0xd0 [ 90.265235][ T7248] get_compat_msghdr+0xb3/0x480 [ 90.265276][ T7248] ? __pfx_get_compat_msghdr+0x10/0x10 [ 90.265301][ T7248] ? rcu_is_watching+0x13/0xc0 [ 90.265320][ T7248] ? ___sys_recvmsg+0x177/0x1a0 [ 90.265344][ T7248] ? kfree+0x1e5/0x6d0 [ 90.265366][ T7248] ___sys_recvmsg+0x193/0x1a0 [ 90.265391][ T7248] ? __pfx____sys_recvmsg+0x10/0x10 [ 90.265416][ T7248] ? lock_acquire+0x1d1/0x380 [ 90.265451][ T7248] ? __pfx___might_resched+0x10/0x10 [ 90.265478][ T7248] do_recvmmsg+0x54d/0x740 [ 90.265506][ T7248] ? __pfx_do_recvmmsg+0x10/0x10 [ 90.265532][ T7248] ? find_held_lock+0x2b/0x80 [ 90.265575][ T7248] ? ksys_write+0x190/0x250 [ 90.265596][ T7248] ? ksys_write+0x190/0x250 [ 90.265624][ T7248] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 90.265646][ T7248] __sys_recvmmsg+0x21f/0x270 [ 90.265668][ T7248] ? __pfx___sys_recvmmsg+0x10/0x10 [ 90.265691][ T7248] ? ksys_write+0x1ac/0x250 [ 90.265713][ T7248] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 90.265745][ T7248] ? __do_fast_syscall_32+0xb3/0x8b0 [ 90.265763][ T7248] ? lockdep_hardirqs_on+0x7d/0x110 [ 90.265780][ T7248] __do_fast_syscall_32+0x13a/0x8b0 [ 90.265823][ T7248] ? lockdep_hardirqs_on+0x7d/0x110 [ 90.265842][ T7248] do_fast_syscall_32+0x32/0x70 [ 90.265860][ T7248] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 90.265881][ T7248] RIP: 0023:0xf7fa8fec [ 90.265899][ T7248] Code: Unable to access opcode bytes at 0xf7fa8fc2. [ 90.265907][ T7248] RSP: 002b:00000000f543550c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 90.265925][ T7248] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000600 [ 90.265935][ T7248] RDX: 0000000000000700 RSI: 0000000040002002 RDI: 0000000000000000 [ 90.265946][ T7248] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 90.265956][ T7248] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 90.265966][ T7248] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 90.265989][ T7248] [ 90.405739][ T5741] Bluetooth: hci0: command 0x0419 tx timeout [ 90.581059][ T7265] FAULT_INJECTION: forcing a failure. [ 90.581059][ T7265] name failslab, interval 1, probability 0, space 0, times 0 [ 90.581083][ T7265] CPU: 1 UID: 0 PID: 7265 Comm: syz.1.337 Tainted: G L syzkaller #0 PREEMPT(full) [ 90.581099][ T7265] Tainted: [L]=SOFTLOCKUP [ 90.581103][ T7265] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 90.581109][ T7265] Call Trace: [ 90.581114][ T7265] [ 90.581118][ T7265] dump_stack_lvl+0x100/0x190 [ 90.581137][ T7265] should_fail_ex.cold+0x5/0xa [ 90.581152][ T7265] should_failslab+0xc2/0x120 [ 90.581170][ T7265] __kmalloc_noprof+0xfc/0x840 [ 90.581184][ T7265] ? rcu_is_watching+0x13/0xc0 [ 90.581197][ T7265] ? tomoyo_realpath_from_path+0xb6/0x690 [ 90.581217][ T7265] tomoyo_realpath_from_path+0xb6/0x690 [ 90.581236][ T7265] tomoyo_path_number_perm+0x23c/0x580 [ 90.581249][ T7265] ? tomoyo_path_number_perm+0x22e/0x580 [ 90.581263][ T7265] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 90.581278][ T7265] ? get_pid_task+0x106/0x250 [ 90.581297][ T7265] ? __lock_acquire+0x5c0/0x1f40 [ 90.581319][ T7265] ? __fget_files+0x34/0x3d0 [ 90.581334][ T7265] ? find_held_lock+0x2b/0x80 [ 90.581347][ T7265] ? __fget_files+0x215/0x3d0 [ 90.581361][ T7265] ? hook_file_ioctl_common+0x140/0x440 [ 90.581374][ T7265] ? __fget_files+0x215/0x3d0 [ 90.581391][ T7265] ? __fget_files+0x21f/0x3d0 [ 90.581408][ T7265] security_file_ioctl_compat+0xd3/0x230 [ 90.581422][ T7265] __ia32_compat_sys_ioctl+0xc2/0x360 [ 90.581438][ T7265] __do_fast_syscall_32+0x13a/0x8b0 [ 90.581451][ T7265] ? lockdep_hardirqs_on+0x7d/0x110 [ 90.581462][ T7265] do_fast_syscall_32+0x32/0x70 [ 90.581474][ T7265] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 90.581488][ T7265] RIP: 0023:0xf7fa8fec [ 90.581501][ T7265] Code: Unable to access opcode bytes at 0xf7fa8fc2. [ 90.581506][ T7265] RSP: 002b:00000000f543550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 90.581518][ T7265] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000000089e0 [ 90.581525][ T7265] RDX: 0000000080000280 RSI: 0000000000000000 RDI: 0000000000000000 [ 90.581531][ T7265] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 90.581537][ T7265] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 90.581544][ T7265] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 90.581557][ T7265] [ 90.581562][ T7265] ERROR: Out of memory at tomoyo_realpath_from_path. [ 91.526074][ T7287] Invalid ELF header magic: != ELF [ 91.887223][ T7291] netlink: 'syz.1.344': attribute type 1 has an invalid length. [ 92.145629][ T10] usb 6-1: new full-speed USB device number 8 using dummy_hcd [ 92.306258][ T10] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 92.307605][ T10] usb 6-1: config 0 interface 0 altsetting 255 endpoint 0x9 has an invalid bInterval 0, changing to 10 [ 92.307623][ T10] usb 6-1: config 0 interface 0 altsetting 255 endpoint 0x9 has invalid maxpacket 169, setting to 64 [ 92.307637][ T10] usb 6-1: config 0 interface 0 has no altsetting 0 [ 92.309810][ T10] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 92.309825][ T10] usb 6-1: Product: syz [ 92.309833][ T10] usb 6-1: Manufacturer: syz [ 92.309841][ T10] usb 6-1: SerialNumber: syz [ 92.311758][ T10] usb 6-1: config 0 descriptor?? [ 92.315953][ T7291] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 92.322821][ T10] usb 6-1: selecting invalid altsetting 0 [ 92.346448][ T7300] FAULT_INJECTION: forcing a failure. [ 92.346448][ T7300] name fail_futex, interval 1, probability 0, space 0, times 0 [ 92.346481][ T7300] CPU: 2 UID: 0 PID: 7300 Comm: syz.4.348 Tainted: G L syzkaller #0 PREEMPT(full) [ 92.346507][ T7300] Tainted: [L]=SOFTLOCKUP [ 92.346514][ T7300] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.346527][ T7300] Call Trace: [ 92.346534][ T7300] [ 92.346542][ T7300] dump_stack_lvl+0x100/0x190 [ 92.346573][ T7300] should_fail_ex.cold+0x5/0xa [ 92.346599][ T7300] get_futex_key+0x1d0/0x14f0 [ 92.346624][ T7300] ? __pfx_get_futex_key+0x10/0x10 [ 92.346654][ T7300] futex_wake+0xf4/0x5e0 [ 92.346684][ T7300] ? __pfx_futex_wake+0x10/0x10 [ 92.346732][ T7300] ? percpu_counter_add_batch+0xb9/0x230 [ 92.346756][ T7300] ? errseq_sample+0x51/0x70 [ 92.346777][ T7300] ? file_init_path+0x48e/0x670 [ 92.346812][ T7300] do_futex+0x2b2/0x440 [ 92.346835][ T7300] ? __pfx_do_futex+0x10/0x10 [ 92.346858][ T7300] ? fd_install+0x223/0x580 [ 92.346888][ T7300] __ia32_sys_futex_time32+0x2f4/0x470 [ 92.346911][ T7300] ? xfd_validate_state+0x129/0x190 [ 92.346936][ T7300] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 92.346969][ T7300] __do_fast_syscall_32+0x13a/0x8b0 [ 92.346994][ T7300] do_fast_syscall_32+0x32/0x70 [ 92.347013][ T7300] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 92.347039][ T7300] RIP: 0023:0xf7f77fec [ 92.347059][ T7300] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 92.347068][ T7300] RSP: 002b:00000000f54265cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 92.347087][ T7300] RAX: ffffffffffffffda RBX: 00000000f7434f8c RCX: 0000000000000081 [ 92.347099][ T7300] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 92.347111][ T7300] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 92.347122][ T7300] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 92.347132][ T7300] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 92.347156][ T7300] [ 92.464247][ T7302] Invalid ELF header magic: != ELF [ 92.521638][ T7291] usb 6-1: cannot submit urb 0, error -2: endpoint not enabled [ 92.522925][ T9] usb 6-1: USB disconnect, device number 8 [ 92.564255][ T7291] capability: warning: `syz.1.344' uses 32-bit capabilities (legacy support in use) [ 93.177552][ T7311] netlink: 8 bytes leftover after parsing attributes in process `syz.5.351'. [ 93.318229][ T7321] netlink: 20 bytes leftover after parsing attributes in process `syz.5.354'. [ 93.368424][ T7321] ipvlan2: entered promiscuous mode [ 93.376926][ T7321] bridge0: port 3(ipvlan2) entered blocking state [ 93.377880][ T7321] bridge0: port 3(ipvlan2) entered disabled state [ 93.377997][ T7321] ipvlan2: entered allmulticast mode [ 93.378010][ T7321] bridge0: entered allmulticast mode [ 93.392775][ T7321] ipvlan2: left allmulticast mode [ 93.392799][ T7321] bridge0: left allmulticast mode [ 93.424626][ T7328] openvswitch: netlink: Duplicate or invalid key (type 0). [ 93.552140][ T7331] FAULT_INJECTION: forcing a failure. [ 93.552140][ T7331] name failslab, interval 1, probability 0, space 0, times 0 [ 93.552172][ T7331] CPU: 0 UID: 0 PID: 7331 Comm: syz.1.359 Tainted: G L syzkaller #0 PREEMPT(full) [ 93.552198][ T7331] Tainted: [L]=SOFTLOCKUP [ 93.552205][ T7331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.552217][ T7331] Call Trace: [ 93.552224][ T7331] [ 93.552233][ T7331] dump_stack_lvl+0x100/0x190 [ 93.552263][ T7331] should_fail_ex.cold+0x5/0xa [ 93.552286][ T7331] should_failslab+0xc2/0x120 [ 93.552314][ T7331] __kmalloc_cache_noprof+0x91/0x6d0 [ 93.552336][ T7331] ? __pfx_get_mtd_device+0x10/0x10 [ 93.552372][ T7331] ? do_raw_spin_lock+0x128/0x260 [ 93.552393][ T7331] ? mtdchar_open+0x1e5/0x340 [ 93.552427][ T7331] mtdchar_open+0x1e5/0x340 [ 93.552455][ T7331] ? __pfx_mtdchar_open+0x10/0x10 [ 93.552482][ T7331] chrdev_open+0x234/0x6a0 [ 93.552509][ T7331] ? __pfx_chrdev_open+0x10/0x10 [ 93.552535][ T7331] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 93.552560][ T7331] do_dentry_open+0x6ab/0x14d0 [ 93.552585][ T7331] ? __pfx_chrdev_open+0x10/0x10 [ 93.552617][ T7331] vfs_open+0x82/0x3f0 [ 93.552639][ T7331] path_openat+0x1a23/0x2450 [ 93.552670][ T7331] ? __pfx_path_openat+0x10/0x10 [ 93.552703][ T7331] do_file_open+0x20e/0x430 [ 93.552732][ T7331] ? __pfx_do_file_open+0x10/0x10 [ 93.552776][ T7331] ? _raw_spin_unlock+0x28/0x50 [ 93.552845][ T7331] ? alloc_fd+0x471/0x7a0 [ 93.552881][ T7331] do_sys_openat2+0x10f/0x1e0 [ 93.552901][ T7331] ? __pfx_do_sys_openat2+0x10/0x10 [ 93.552924][ T7331] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 93.552947][ T7331] ? __ia32_sys_futex_time32+0x2fd/0x470 [ 93.552973][ T7331] __ia32_compat_sys_openat+0x12d/0x210 [ 93.552996][ T7331] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 93.553028][ T7331] do_int80_emulation+0x166/0x650 [ 93.553053][ T7331] asm_int80_emulation+0x1a/0x20 [ 93.553072][ T7331] RIP: 0023:0xf71977eb [ 93.553088][ T7331] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 93.553106][ T7331] RSP: 002b:00000000f545603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 93.553124][ T7331] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f5456100 [ 93.553137][ T7331] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 93.553148][ T7331] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 93.553159][ T7331] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 93.553170][ T7331] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 93.553194][ T7331] [ 93.673855][ T7341] FAULT_INJECTION: forcing a failure. [ 93.673855][ T7341] name failslab, interval 1, probability 0, space 0, times 0 [ 93.673887][ T7341] CPU: 0 UID: 0 PID: 7341 Comm: syz.1.362 Tainted: G L syzkaller #0 PREEMPT(full) [ 93.673911][ T7341] Tainted: [L]=SOFTLOCKUP [ 93.673918][ T7341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.673929][ T7341] Call Trace: [ 93.673936][ T7341] [ 93.673943][ T7341] dump_stack_lvl+0x100/0x190 [ 93.673973][ T7341] should_fail_ex.cold+0x5/0xa [ 93.673998][ T7341] should_failslab+0xc2/0x120 [ 93.674024][ T7341] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 93.674051][ T7341] ? __d_alloc+0x35/0xa50 [ 93.674081][ T7341] __d_alloc+0x35/0xa50 [ 93.674103][ T7341] ? __ns_ref_active_get+0x9f/0x1b0 [ 93.674126][ T7341] path_from_stashed+0x431/0x760 [ 93.674152][ T7341] ? do_raw_spin_unlock+0x145/0x1e0 [ 93.674177][ T7341] ns_get_path+0x60/0x80 [ 93.674203][ T7341] proc_ns_get_link+0x260/0x2e0 [ 93.674233][ T7341] ? __pfx_proc_ns_get_link+0x10/0x10 [ 93.674262][ T7341] ? atime_needs_update+0x8b/0x760 [ 93.674287][ T7341] pick_link+0xd17/0x13c0 [ 93.674306][ T7341] ? rcu_is_watching+0x13/0xc0 [ 93.674328][ T7341] ? __pfx_proc_ns_get_link+0x10/0x10 [ 93.674358][ T7341] step_into_slowpath+0x9ba/0xf90 [ 93.674380][ T7341] ? proc_ns_dir_lookup+0x1da/0x390 [ 93.674409][ T7341] ? __pfx_step_into_slowpath+0x10/0x10 [ 93.674461][ T7341] path_openat+0xeef/0x2450 [ 93.674490][ T7341] ? __pfx_path_openat+0x10/0x10 [ 93.674522][ T7341] do_file_open+0x20e/0x430 [ 93.674550][ T7341] ? __pfx_do_file_open+0x10/0x10 [ 93.674593][ T7341] ? _raw_spin_unlock+0x28/0x50 [ 93.674619][ T7341] ? alloc_fd+0x471/0x7a0 [ 93.674651][ T7341] do_sys_openat2+0x10f/0x1e0 [ 93.674670][ T7341] ? __pfx_do_sys_openat2+0x10/0x10 [ 93.674688][ T7341] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 93.674708][ T7341] ? __fget_files+0x21f/0x3d0 [ 93.674735][ T7341] __ia32_compat_sys_openat+0x12d/0x210 [ 93.674755][ T7341] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 93.674780][ T7341] ? ksys_write+0x1ac/0x250 [ 93.674827][ T7341] do_int80_emulation+0x166/0x650 [ 93.674852][ T7341] asm_int80_emulation+0x1a/0x20 [ 93.674869][ T7341] RIP: 0023:0xf71977eb [ 93.674884][ T7341] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 93.674899][ T7341] RSP: 002b:00000000f545642c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 93.674917][ T7341] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f7262355 [ 93.674928][ T7341] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 93.674938][ T7341] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 93.674947][ T7341] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 93.674956][ T7341] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 93.674979][ T7341] [ 93.775457][ T7347] netlink: 20 bytes leftover after parsing attributes in process `syz.5.364'. [ 93.794948][ T7349] FAULT_INJECTION: forcing a failure. [ 93.794948][ T7349] name failslab, interval 1, probability 0, space 0, times 0 [ 93.794971][ T7349] CPU: 1 UID: 0 PID: 7349 Comm: syz.1.365 Tainted: G L syzkaller #0 PREEMPT(full) [ 93.794988][ T7349] Tainted: [L]=SOFTLOCKUP [ 93.794993][ T7349] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.795000][ T7349] Call Trace: [ 93.795004][ T7349] [ 93.795009][ T7349] dump_stack_lvl+0x100/0x190 [ 93.795028][ T7349] should_fail_ex.cold+0x5/0xa [ 93.795045][ T7349] should_failslab+0xc2/0x120 [ 93.795064][ T7349] __kmalloc_noprof+0xfc/0x840 [ 93.795078][ T7349] ? find_held_lock+0x2b/0x80 [ 93.795092][ T7349] ? nft_obj_init+0x62/0x390 [ 93.795107][ T7349] nft_obj_init+0x62/0x390 [ 93.795118][ T7349] ? nft_obj_type_get+0x213/0x480 [ 93.795135][ T7349] nf_tables_newobj+0xa87/0x2850 [ 93.795150][ T7349] ? __pfx___nla_validate_parse+0x10/0x10 [ 93.795168][ T7349] ? __pfx_nf_tables_newobj+0x10/0x10 [ 93.795179][ T7349] ? net_generic+0x25/0x2a0 [ 93.795197][ T7349] ? __nla_parse+0x40/0x60 [ 93.795215][ T7349] nfnetlink_rcv_batch+0x1410/0x2880 [ 93.795238][ T7349] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 93.795255][ T7349] ? kasan_save_stack+0x30/0x50 [ 93.795276][ T7349] ? kasan_save_track+0x14/0x30 [ 93.795291][ T7349] ? __kasan_kmalloc+0xaa/0xb0 [ 93.795313][ T7349] ? __kmalloc_node_track_caller_noprof+0x33d/0x870 [ 93.795335][ T7349] ? kmalloc_reserve+0xe8/0x350 [ 93.795371][ T7349] ? __lock_acquire+0x5c0/0x1f40 [ 93.795409][ T7349] ? __nla_parse+0x40/0x60 [ 93.795426][ T7349] nfnetlink_rcv+0x3bd/0x440 [ 93.795442][ T7349] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 93.795460][ T7349] netlink_unicast+0x65f/0x950 [ 93.795475][ T7349] ? __pfx_netlink_unicast+0x10/0x10 [ 93.795491][ T7349] netlink_sendmsg+0x8b0/0xda0 [ 93.795505][ T7349] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.795519][ T7349] ? apparmor_socket_sendmsg+0x165/0x280 [ 93.795548][ T7349] ____sys_sendmsg+0xa4d/0xbe0 [ 93.795567][ T7349] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.795582][ T7349] ? __pfx_____sys_sendmsg+0x10/0x10 [ 93.795606][ T7349] ___sys_sendmsg+0x190/0x1e0 [ 93.795625][ T7349] ? __pfx____sys_sendmsg+0x10/0x10 [ 93.795643][ T7349] ? futex_wait+0x11e/0x370 [ 93.795681][ T7349] ? find_held_lock+0x2b/0x80 [ 93.795707][ T7349] __sys_sendmsg+0x160/0x210 [ 93.795723][ T7349] ? __pfx___sys_sendmsg+0x10/0x10 [ 93.795746][ T7349] __do_fast_syscall_32+0x13a/0x8b0 [ 93.795761][ T7349] do_fast_syscall_32+0x32/0x70 [ 93.795773][ T7349] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 93.795788][ T7349] RIP: 0023:0xf7fa8fec [ 93.795802][ T7349] Code: Unable to access opcode bytes at 0xf7fa8fc2. [ 93.795807][ T7349] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 93.795819][ T7349] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000000 [ 93.795827][ T7349] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 93.795834][ T7349] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 93.795841][ T7349] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 93.795847][ T7349] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 93.795862][ T7349] [ 93.829130][ T7349] netlink: 20 bytes leftover after parsing attributes in process `syz.1.365'. [ 94.185718][ T1525] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 94.515755][ T1525] usb 9-1: Using ep0 maxpacket: 32 [ 94.644710][ T7374] bond0: (slave netdevsim1): Releasing backup interface [ 94.712683][ T1525] usb 9-1: unable to get BOS descriptor or descriptor too short [ 94.712732][ T1525] usb 9-1: New USB device found, idVendor=0b05, idProduct=1739, bcdDevice= 0.40 [ 94.782369][ T1525] usb 9-1: config 1 has an invalid descriptor of length 21, skipping remainder of the config [ 94.782516][ T1525] usb 9-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 94.970441][ T1525] usb 9-1: language id specifier not provided by device, defaulting to English [ 95.047852][ T1525] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.047870][ T1525] usb 9-1: Product: syz [ 95.047877][ T1525] usb 9-1: SerialNumber: syz [ 95.144251][ T7406] netlink: 16 bytes leftover after parsing attributes in process `syz.5.379'. [ 95.250501][ T7408] comedi comedi0: adq12b: a I/O base address must be specified [ 95.442950][ T7420] FAULT_INJECTION: forcing a failure. [ 95.442950][ T7420] name failslab, interval 1, probability 0, space 0, times 0 [ 95.442971][ T7420] CPU: 3 UID: 0 PID: 7420 Comm: syz.5.384 Tainted: G L syzkaller #0 PREEMPT(full) [ 95.442987][ T7420] Tainted: [L]=SOFTLOCKUP [ 95.442991][ T7420] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.442997][ T7420] Call Trace: [ 95.443001][ T7420] [ 95.443006][ T7420] dump_stack_lvl+0x100/0x190 [ 95.443025][ T7420] should_fail_ex.cold+0x5/0xa [ 95.443041][ T7420] should_failslab+0xc2/0x120 [ 95.443058][ T7420] __kmalloc_cache_noprof+0x91/0x6d0 [ 95.443072][ T7420] ? alloc_netdev_mqs+0xe3c/0x15c0 [ 95.443090][ T7420] alloc_netdev_mqs+0xe3c/0x15c0 [ 95.443107][ T7420] vti6_locate+0x3f2/0x6d0 [ 95.443122][ T7420] ? __pfx_vti6_locate+0x10/0x10 [ 95.443139][ T7420] vti6_siocdevprivate+0x581/0x760 [ 95.443154][ T7420] ? __pfx_vti6_siocdevprivate+0x10/0x10 [ 95.443167][ T7420] ? kasan_save_track+0x14/0x30 [ 95.443191][ T7420] ? rcu_is_watching+0x13/0xc0 [ 95.443204][ T7420] ? full_name_hash+0xbc/0x100 [ 95.443224][ T7420] dev_ifsioc+0xc2f/0x1ee0 [ 95.443240][ T7420] ? __pfx_dev_ifsioc+0x10/0x10 [ 95.443252][ T7420] ? __pfx___mutex_lock+0x10/0x10 [ 95.443268][ T7420] ? lock_acquire+0x1d1/0x380 [ 95.443286][ T7420] ? dev_load+0x8e/0x240 [ 95.443299][ T7420] ? dev_load+0x8e/0x240 [ 95.443315][ T7420] dev_ioctl+0x70e/0x1070 [ 95.443330][ T7420] sock_ioctl+0x494/0x6b0 [ 95.443340][ T7420] ? __pfx_sock_ioctl+0x10/0x10 [ 95.443354][ T7420] ? do_vfs_ioctl+0x226/0x13e0 [ 95.443368][ T7420] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 95.443382][ T7420] compat_sock_ioctl+0x400/0x760 [ 95.443395][ T7420] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 95.443405][ T7420] ? hook_file_ioctl_common+0x140/0x440 [ 95.443423][ T7420] ? __fget_files+0x21f/0x3d0 [ 95.443439][ T7420] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 95.443451][ T7420] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 95.443466][ T7420] __do_fast_syscall_32+0x13a/0x8b0 [ 95.443478][ T7420] ? lockdep_hardirqs_on+0x7d/0x110 [ 95.443490][ T7420] do_fast_syscall_32+0x32/0x70 [ 95.443502][ T7420] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 95.443516][ T7420] RIP: 0023:0xf7ff8fec [ 95.443529][ T7420] Code: Unable to access opcode bytes at 0xf7ff8fc2. [ 95.443534][ T7420] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 95.443545][ T7420] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000000089f1 [ 95.443552][ T7420] RDX: 0000000080000840 RSI: 0000000000000000 RDI: 0000000000000000 [ 95.443558][ T7420] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 95.443565][ T7420] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 95.443571][ T7420] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 95.443585][ T7420] [ 95.487788][ T1525] usb 9-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 95.516119][ T1525] usb 9-1: USB disconnect, device number 13 [ 95.544537][ T5776] udevd[5776]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 95.578570][ T7390] nvme_tcp: queue 0: failed to receive icresp, error -104 [ 95.785304][ T7431] Invalid ELF header magic: != ELF [ 95.787864][ T7431] overlayfs: overlapping lowerdir path [ 95.819918][ T7432] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 95.819923][ T7429] tipc: Started in network mode [ 95.819941][ T7429] tipc: Node identity 0010000000000000002, cluster identity 1 [ 95.866757][ T7434] FAULT_INJECTION: forcing a failure. [ 95.866757][ T7434] name failslab, interval 1, probability 0, space 0, times 0 [ 95.866781][ T7434] CPU: 2 UID: 0 PID: 7434 Comm: syz.0.386 Tainted: G L syzkaller #0 PREEMPT(full) [ 95.866796][ T7434] Tainted: [L]=SOFTLOCKUP [ 95.866801][ T7434] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.866807][ T7434] Call Trace: [ 95.866811][ T7434] [ 95.866815][ T7434] dump_stack_lvl+0x100/0x190 [ 95.866836][ T7434] should_fail_ex.cold+0x5/0xa [ 95.866851][ T7434] should_failslab+0xc2/0x120 [ 95.866868][ T7434] __kmalloc_noprof+0xfc/0x840 [ 95.866890][ T7434] ? kasan_save_stack+0x3f/0x50 [ 95.866906][ T7434] ? __d_alloc+0x650/0xa50 [ 95.866925][ T7434] __d_alloc+0x650/0xa50 [ 95.866959][ T7434] ? __lock_acquire+0x5c0/0x1f40 [ 95.866979][ T7434] d_alloc_parallel+0x105/0x14c0 [ 95.866996][ T7434] ? lock_acquire+0x1d1/0x380 [ 95.867012][ T7434] ? lookup_slow+0x42/0x70 [ 95.867023][ T7434] ? __pfx_d_alloc_parallel+0x10/0x10 [ 95.867037][ T7434] ? __pfx___might_resched+0x10/0x10 [ 95.867051][ T7434] ? find_held_lock+0x2b/0x80 [ 95.867064][ T7434] ? __d_lookup+0x25c/0x4a0 [ 95.867078][ T7434] ? down_read+0x13b/0x4c0 [ 95.867092][ T7434] ? __pfx_down_read+0x10/0x10 [ 95.867106][ T7434] __lookup_slow+0x98/0x320 [ 95.867119][ T7434] lookup_slow+0x50/0x70 [ 95.867130][ T7434] lookup_one_positive_unlocked+0x129/0x170 [ 95.867147][ T7434] ovl_lookup_index+0x1d6/0x660 [ 95.867178][ T7434] ? __pfx_ovl_lookup_index+0x10/0x10 [ 95.867191][ T7434] ? __kmalloc_noprof+0x350/0x840 [ 95.867206][ T7434] ? ovl_lookup_layers+0x13ff/0x2ac0 [ 95.867223][ T7434] ovl_lookup_layers+0x60b/0x2ac0 [ 95.867245][ T7434] ? __pfx_ovl_lookup_layers+0x10/0x10 [ 95.867259][ T7434] ? apparmor_capable+0x1d7/0x4d0 [ 95.867273][ T7434] ? privileged_wrt_inode_uidgid+0xc1/0x1d0 [ 95.867290][ T7434] ? bpf_lsm_capable+0x9/0x10 [ 95.867304][ T7434] ? capable_wrt_inode_uidgid+0xde/0x170 [ 95.867323][ T7434] ? generic_permission+0xae/0x800 [ 95.867336][ T7434] ovl_lookup+0x4a8/0x6b0 [ 95.867349][ T7434] ? inode_permission+0x374/0x620 [ 95.867362][ T7434] ? __pfx_ovl_lookup+0x10/0x10 [ 95.867375][ T7434] ? ovl_permission+0x17b/0x2d0 [ 95.867395][ T7434] ? bpf_lsm_inode_create+0x9/0x10 [ 95.867409][ T7434] ? security_inode_create+0xc4/0x280 [ 95.867426][ T7434] ? may_o_create+0x46/0x3a0 [ 95.867439][ T7434] ? __pfx_ovl_lookup+0x10/0x10 [ 95.867452][ T7434] lookup_open+0xa79/0x1990 [ 95.867470][ T7434] path_openat+0x10a0/0x2450 [ 95.867488][ T7434] ? __pfx_path_openat+0x10/0x10 [ 95.867508][ T7434] do_file_open+0x20e/0x430 [ 95.867525][ T7434] ? __pfx_do_file_open+0x10/0x10 [ 95.867551][ T7434] ? _raw_spin_unlock+0x28/0x50 [ 95.867567][ T7434] ? alloc_fd+0x471/0x7a0 [ 95.867586][ T7434] do_sys_openat2+0x10f/0x1e0 [ 95.867598][ T7434] ? __pfx_do_sys_openat2+0x10/0x10 [ 95.867611][ T7434] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 95.867625][ T7434] __ia32_compat_sys_openat+0x12d/0x210 [ 95.867638][ T7434] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 95.867649][ T7434] ? fput+0x7c/0x100 [ 95.867687][ T7434] ? ksys_write+0x1ac/0x250 [ 95.867701][ T7434] ? __pfx_ksys_write+0x10/0x10 [ 95.867717][ T7434] __do_fast_syscall_32+0x13a/0x8b0 [ 95.867729][ T7434] ? lockdep_hardirqs_on+0x7d/0x110 [ 95.867741][ T7434] do_fast_syscall_32+0x32/0x70 [ 95.867753][ T7434] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 95.867767][ T7434] RIP: 0023:0xf739efec [ 95.867781][ T7434] Code: Unable to access opcode bytes at 0xf739efc2. [ 95.867786][ T7434] RSP: 002b:00000000f53b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 95.867797][ T7434] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000300 [ 95.867804][ T7434] RDX: 0000000000000040 RSI: 0000000000000083 RDI: 0000000000000000 [ 95.867811][ T7434] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 95.867817][ T7434] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 95.867823][ T7434] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 95.867838][ T7434] [ 95.874916][ T7434] overlayfs: failed inode index lookup (ino=122, key=00fb210001ba123ff8bfd5486bb0a06d1ecc073671cad14d357a00000000000000, err=-12); [ 95.874916][ T7434] overlayfs: mount with '-o index=off' to disable inodes index. [ 96.963768][ T7469] rxe_eth0 speed is unknown, defaulting to 1000 [ 97.072679][ T7471] block nbd4: Device being setup by another task [ 97.235746][ T5836] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 97.394112][ T7478] tipc: Started in network mode [ 97.394128][ T7478] tipc: Node identity ac1414aa, cluster identity 4711 [ 97.394715][ T7478] tipc: New replicast peer: 172.20.20.187 [ 97.395322][ T7478] tipc: Enabled bearer , priority 10 [ 97.395882][ T5836] usb 5-1: Using ep0 maxpacket: 8 [ 97.396409][ T5836] usb 5-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 97.403105][ T5836] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.403119][ T5836] usb 5-1: Product: syz [ 97.403128][ T5836] usb 5-1: Manufacturer: syz [ 97.403136][ T5836] usb 5-1: SerialNumber: syz [ 97.404580][ T5836] usb 5-1: config 0 descriptor?? [ 97.407778][ T5836] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 97.550106][ T7490] netlink: 'syz.1.404': attribute type 10 has an invalid length. [ 97.550258][ T7490] netlink: 14 bytes leftover after parsing attributes in process `syz.1.404'. [ 97.553859][ T7490] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 97.564970][ T7489] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 97.571129][ T7490] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 97.572621][ T7490] bond0 (unregistering): Released all slaves [ 97.685703][ T6666] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 97.760450][ T7466] block nbd4: shutting down sockets [ 97.830953][ T7469] syzkaller1: entered promiscuous mode [ 97.830976][ T7469] syzkaller1: entered allmulticast mode [ 97.855630][ T6666] usb 10-1: Using ep0 maxpacket: 8 [ 97.856357][ T6666] usb 10-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 97.858062][ T6666] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 97.858075][ T6666] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 97.858096][ T6666] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 97.858115][ T6666] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.863425][ T6666] hub 10-1:1.0: bad descriptor, ignoring hub [ 97.863446][ T6666] hub 10-1:1.0: probe with driver hub failed with error -5 [ 97.864201][ T6666] cdc_wdm 10-1:1.0: skipping garbage [ 97.864210][ T6666] cdc_wdm 10-1:1.0: skipping garbage [ 97.867328][ T7469] overlayfs: conflicting lowerdir path [ 97.869599][ T6666] cdc_wdm 10-1:1.0: cdc-wdm0: USB WDM device [ 97.869610][ T6666] cdc_wdm 10-1:1.0: Unknown control protocol [ 97.937328][ T5836] gspca_sonixj: reg_r err -71 [ 97.937380][ T5836] sonixj 5-1:0.0: probe with driver sonixj failed with error -71 [ 97.945045][ T5836] usb 5-1: USB disconnect, device number 13 [ 98.399320][ T5836] tipc: Node number set to 2886997162 [ 98.633239][ T7511] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 98.681321][ T7515] netlink: 12 bytes leftover after parsing attributes in process `syz.1.411'. [ 98.732652][ T7480] usb 10-1: reset high-speed USB device number 4 using dummy_hcd [ 98.734547][ T7480] usb 10-1: device reset changed ep0 maxpacket size! [ 98.743982][ T6666] usb 10-1: USB disconnect, device number 4 [ 98.766245][ T7518] FAULT_INJECTION: forcing a failure. [ 98.766245][ T7518] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 98.766270][ T7518] CPU: 1 UID: 0 PID: 7518 Comm: syz.1.412 Tainted: G L syzkaller #0 PREEMPT(full) [ 98.766285][ T7518] Tainted: [L]=SOFTLOCKUP [ 98.766289][ T7518] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.766296][ T7518] Call Trace: [ 98.766300][ T7518] [ 98.766305][ T7518] dump_stack_lvl+0x100/0x190 [ 98.766330][ T7518] should_fail_ex.cold+0x5/0xa [ 98.766345][ T7518] _copy_to_user+0x32/0xd0 [ 98.766358][ T7518] simple_read_from_buffer+0xcb/0x170 [ 98.766375][ T7518] proc_fail_nth_read+0x1af/0x230 [ 98.766391][ T7518] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 98.766406][ T7518] ? rw_verify_area+0xce/0x6d0 [ 98.766419][ T7518] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 98.766433][ T7518] vfs_read+0x1e4/0xb40 [ 98.766447][ T7518] ? lock_acquire+0x1d1/0x380 [ 98.766463][ T7518] ? __fget_files+0x34/0x3d0 [ 98.766477][ T7518] ? __pfx_vfs_read+0x10/0x10 [ 98.766490][ T7518] ? find_held_lock+0x2b/0x80 [ 98.766503][ T7518] ? __fget_files+0x215/0x3d0 [ 98.766520][ T7518] ? __fget_files+0x21f/0x3d0 [ 98.766539][ T7518] ksys_read+0x12a/0x250 [ 98.766552][ T7518] ? __pfx_ksys_read+0x10/0x10 [ 98.766570][ T7518] do_int80_emulation+0x166/0x650 [ 98.766584][ T7518] asm_int80_emulation+0x1a/0x20 [ 98.766595][ T7518] RIP: 0023:0xf71977eb [ 98.766604][ T7518] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 98.766615][ T7518] RSP: 002b:00000000f54564bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 98.766626][ T7518] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54565d0 [ 98.766633][ T7518] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 98.766639][ T7518] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 98.766646][ T7518] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 98.766652][ T7518] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 98.766666][ T7518] [ 98.860408][ T7521] netlink: 72 bytes leftover after parsing attributes in process `syz.1.413'. [ 98.905789][ T6666] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 99.067696][ T6666] usb 10-1: New USB device found, idVendor=046d, idProduct=c094, bcdDevice= 0.00 [ 99.068574][ T6666] usb 10-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 99.068590][ T6666] usb 10-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 99.068603][ T6666] usb 10-1: config 0 interface 0 has no altsetting 0 [ 99.068619][ T6666] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.071602][ T6666] usb 10-1: config 0 descriptor?? [ 99.282834][ T6666] usbhid 10-1:0.0: can't add hid device: -71 [ 99.282887][ T6666] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 99.301610][ T6666] usb 10-1: USB disconnect, device number 5 [ 99.908487][ T7533] gadgetfs: bound to dummy_udc driver [ 101.621969][ T7566] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 101.733605][ T7564] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 101.801497][ T7574] netlink: 68 bytes leftover after parsing attributes in process `syz.0.431'. [ 101.856227][ T7576] input: syz0 as /devices/virtual/input/input12 [ 101.918887][ T7578] netlink: 60 bytes leftover after parsing attributes in process `syz.0.433'. [ 101.966671][ T5806] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 101.974936][ T7580] ------------[ cut here ]------------ [ 101.974951][ T7580] Device '0-0002' does not have a release() function, it is broken and must be fixed. See Documentation/core-api/kobject.rst. [ 101.974965][ T7580] WARNING: drivers/base/core.c:2642 at device_release+0x1da/0x270, CPU#0: syz.0.434/7580 [ 101.990124][ T7580] Modules linked in: [ 101.991869][ T7580] CPU: 0 UID: 0 PID: 7580 Comm: syz.0.434 Tainted: G L syzkaller #0 PREEMPT(full) [ 101.996327][ T7580] Tainted: [L]=SOFTLOCKUP [ 101.998227][ T7580] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.002436][ T7580] RIP: 0010:device_release+0x1dd/0x270 [ 102.005199][ T7580] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8b 6b 50 48 85 ed 74 19 e8 1d 4d a1 fb 48 8d 3d 56 90 e7 0b 48 89 ee <67> 48 0f b9 3a e9 eb fe ff ff e8 04 4d a1 fb 48 89 da 48 b8 00 00 [ 102.013457][ T7580] RSP: 0018:ffffc90002d17a20 EFLAGS: 00010287 [ 102.016193][ T7580] RAX: 00000000000043f6 RBX: ffff888014f40020 RCX: ffffc900269fb000 [ 102.019449][ T7580] RDX: 0000000000080000 RSI: ffff888028bc7b40 RDI: ffffffff9251e6d0 [ 102.022773][ T7580] RBP: ffff888028bc7b40 R08: 0000000000000001 R09: 0000000000000000 [ 102.026157][ T7580] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88801f6d5800 [ 102.029486][ T7580] R13: dffffc0000000000 R14: ffff888028bc7b40 R15: 0000000000000000 [ 102.032040][ T7580] FS: 0000000000000000(0000) GS:ffff88809574a000(0063) knlGS:00000000f53b6b40 [ 102.034853][ T7580] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 102.037002][ T7580] CR2: 00000000f71df7bc CR3: 000000005eddb000 CR4: 0000000000352ef0 [ 102.039471][ T7580] Call Trace: [ 102.040538][ T7580] [ 102.041482][ T7580] kobject_put+0x1f7/0x640 [ 102.042868][ T7580] device_unregister+0x2f/0xe0 [ 102.044372][ T7580] i2c_unregister_device+0xf5/0x270 [ 102.046127][ T7580] i2c_deregister_clients+0x255/0x460 [ 102.047832][ T7580] i2c_del_adapter+0x13a/0x2e0 [ 102.049341][ T7580] i801_remove+0xa4/0x3d0 [ 102.050751][ T7580] pci_device_remove+0xb2/0x1d0 [ 102.052307][ T7580] ? __pfx_pci_device_remove+0x10/0x10 [ 102.054137][ T7580] device_remove+0xcb/0x180 [ 102.055950][ T7580] device_release_driver_internal+0x44e/0x620 [ 102.057921][ T7580] unbind_store+0xf8/0x110 [ 102.059331][ T7580] ? __pfx_unbind_store+0x10/0x10 [ 102.061386][ T7580] drv_attr_store+0x74/0xb0 [ 102.063172][ T7580] ? __pfx_drv_attr_store+0x10/0x10 [ 102.065016][ T7580] sysfs_kf_write+0xf2/0x150 [ 102.066550][ T7580] kernfs_fop_write_iter+0x3e0/0x5f0 [ 102.068213][ T7580] ? __pfx_sysfs_kf_write+0x10/0x10 [ 102.069847][ T7580] vfs_write+0x6af/0x1050 [ 102.071227][ T7580] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 102.073061][ T7580] ? __pfx_vfs_write+0x10/0x10 [ 102.074608][ T7580] ? find_held_lock+0x2b/0x80 [ 102.076198][ T7580] ksys_write+0x12a/0x250 [ 102.077607][ T7580] ? __pfx_ksys_write+0x10/0x10 [ 102.079148][ T7580] __do_fast_syscall_32+0x13a/0x8b0 [ 102.080800][ T7580] do_fast_syscall_32+0x32/0x70 [ 102.082334][ T7580] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 102.084350][ T7580] RIP: 0023:0xf739efec [ 102.085763][ T7580] Code: Unable to access opcode bytes at 0xf739efc2. SYZFAIL: failed to recv rpc [ 102.087938][ T7580] RSP: 002b:00000000f53b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 102.090560][ T7580] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800003c0 [ 102.093126][ T7580] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 102.096225][ T7580] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 102.098683][ T7580] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 102.101610][ T7580] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 102.104857][ T7580] [ 102.106694][ T7580] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 102.109173][ T7580] CPU: 0 UID: 0 PID: 7580 Comm: syz.0.434 Tainted: G L syzkaller #0 PREEMPT(full) [ 102.113544][ T7580] Tainted: [L]=SOFTLOCKUP [ 102.115373][ T7580] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.119590][ T7580] Call Trace: [ 102.121056][ T7580] [ 102.122311][ T7580] dump_stack_lvl+0x100/0x190 [ 102.124311][ T7580] vpanic+0x553/0x970 [ 102.126023][ T7580] ? __pfx_vpanic+0x10/0x10 [ 102.127971][ T7580] panic+0xd1/0xe0 [ 102.129578][ T7580] ? __pfx_panic+0x10/0x10 [ 102.131486][ T7580] check_panic_on_warn.cold+0x19/0x34 [ 102.133837][ T7580] ? device_release+0x1da/0x270 [ 102.135929][ T7580] __warn.cold+0x191/0x318 [ 102.137833][ T7580] __report_bug+0x30f/0x440 [ 102.139768][ T7580] ? device_release+0x1da/0x270 [ 102.141878][ T7580] ? __pfx___report_bug+0x10/0x10 [ 102.144053][ T7580] ? do_raw_spin_lock+0x128/0x260 [ 102.145710][ T7580] ? find_held_lock+0x2b/0x80 [ 102.147243][ T7580] ? kobj_kset_leave+0x160/0x210 [ 102.148858][ T7580] report_bug_entry+0xe2/0x290 [ 102.150431][ T7580] ? device_release+0x1dd/0x270 [ 102.152523][ T7580] handle_bug+0x1cd/0x2a0 [ 102.154369][ T7580] exc_invalid_op+0x17/0x50 [ 102.156315][ T7580] asm_exc_invalid_op+0x1a/0x20 [ 102.158404][ T7580] RIP: 0010:device_release+0x1dd/0x270 [ 102.160710][ T7580] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8b 6b 50 48 85 ed 74 19 e8 1d 4d a1 fb 48 8d 3d 56 90 e7 0b 48 89 ee <67> 48 0f b9 3a e9 eb fe ff ff e8 04 4d a1 fb 48 89 da 48 b8 00 00 [ 102.168557][ T7580] RSP: 0018:ffffc90002d17a20 EFLAGS: 00010287 [ 102.171112][ T7580] RAX: 00000000000043f6 RBX: ffff888014f40020 RCX: ffffc900269fb000 [ 102.174448][ T7580] RDX: 0000000000080000 RSI: ffff888028bc7b40 RDI: ffffffff9251e6d0 [ 102.177751][ T7580] RBP: ffff888028bc7b40 R08: 0000000000000001 R09: 0000000000000000 [ 102.180995][ T7580] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88801f6d5800 [ 102.184240][ T7580] R13: dffffc0000000000 R14: ffff888028bc7b40 R15: 0000000000000000 [ 102.186929][ T7580] kobject_put+0x1f7/0x640 [ 102.188387][ T7580] device_unregister+0x2f/0xe0 [ 102.189903][ T7580] i2c_unregister_device+0xf5/0x270 [ 102.191563][ T7580] i2c_deregister_clients+0x255/0x460 [ 102.193314][ T7580] i2c_del_adapter+0x13a/0x2e0 [ 102.194953][ T7580] i801_remove+0xa4/0x3d0 [ 102.196332][ T7580] pci_device_remove+0xb2/0x1d0 [ 102.198184][ T7580] ? __pfx_pci_device_remove+0x10/0x10 [ 102.200472][ T7580] device_remove+0xcb/0x180 [ 102.202008][ T7580] device_release_driver_internal+0x44e/0x620 [ 102.204060][ T7580] unbind_store+0xf8/0x110 [ 102.205636][ T7580] ? __pfx_unbind_store+0x10/0x10 [ 102.207464][ T7580] drv_attr_store+0x74/0xb0 [ 102.209306][ T7580] ? __pfx_drv_attr_store+0x10/0x10 [ 102.211479][ T7580] sysfs_kf_write+0xf2/0x150 [ 102.213150][ T7580] kernfs_fop_write_iter+0x3e0/0x5f0 [ 102.215046][ T7580] ? __pfx_sysfs_kf_write+0x10/0x10 [ 102.217156][ T7580] vfs_write+0x6af/0x1050 [ 102.218884][ T7580] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 102.221220][ T7580] ? __pfx_vfs_write+0x10/0x10 [ 102.223152][ T7580] ? find_held_lock+0x2b/0x80 [ 102.225113][ T7580] ksys_write+0x12a/0x250 [ 102.226822][ T7580] ? __pfx_ksys_write+0x10/0x10 [ 102.228782][ T7580] __do_fast_syscall_32+0x13a/0x8b0 [ 102.230898][ T7580] do_fast_syscall_32+0x32/0x70 [ 102.232890][ T7580] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 102.235420][ T7580] RIP: 0023:0xf739efec [ 102.237067][ T7580] Code: Unable to access opcode bytes at 0xf739efc2. [ 102.239707][ T7580] RSP: 002b:00000000f53b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 102.242998][ T7580] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800003c0 [ 102.246158][ T7580] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 102.249293][ T7580] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 102.252441][ T7580] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 102.255603][ T7580] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 102.258761][ T7580] [ 102.260731][ T7580] Kernel Offset: disabled [ 102.262487][ T7580] Rebooting in 86400 seconds..