last executing test programs: 4m41.101100414s ago: executing program 0 (id=34): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) r4 = socket(0x11, 0x2, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000080)={0x6}) bind$packet(r4, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f0000000440)={0x1, 0x0, [{0xc001001b, 0x0, 0x7}]}) 4m41.002491695s ago: executing program 0 (id=35): bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f00000000c0)="9d", 0x1, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) ftruncate(0xffffffffffffffff, 0xc17a) pselect6(0x40, &(0x7f00000000c0)={0x6, 0x8, 0x5, 0x1, 0x7f, 0x7fff, 0x8, 0x7f}, &(0x7f0000000100)={0x8, 0x401, 0x7, 0x1, 0x7fff, 0x7, 0x3, 0x5}, 0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={[0x1]}, 0x8}) 4m40.935088766s ago: executing program 0 (id=36): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000001000010400000000000000", @ANYRES32=r1, @ANYBLOB="00001700000000001c0037800b00012d6970768a616e08000c0002800600010000000000050027"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x48004) r2 = socket$netlink(0x10, 0x3, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x4044) 4m40.934148446s ago: executing program 0 (id=37): mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2a) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x103090, 0x0) mount$bind(&(0x7f0000001900)='.\x00', &(0x7f0000000380)='./file0/file0\x00', 0x0, 0x2a05004, 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0/file0\x00', 0x0, 0x24000, 0x0) 4m40.853467862s ago: executing program 0 (id=38): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000d10ffc)=0xfffffffffffffff9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x1, 0x5, @rand_addr=' \x01\x00', 0x8}, 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000004c0)=[@in6={0xa, 0x0, 0x0, @local, 0x1}], 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, 0x0, 0x0) 4m40.565105966s ago: executing program 0 (id=42): mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_sys/bus/pci/devices/0000:00:01.0/config\x00', 0x2, 0x0) sendfile(r0, r0, 0x0, 0x9) 4m40.496109549s ago: executing program 32 (id=42): mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_sys/bus/pci/devices/0000:00:01.0/config\x00', 0x2, 0x0) sendfile(r0, r0, 0x0, 0x9) 5.965743994s ago: executing program 2 (id=1943): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x52, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd604dd318001c0600fc010000000000000000000000000000fe8000000000000000000000000000aafffe4001", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="70ff7f0000780000fe08f98974f603ae"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="56c78e3c733d76696e65459beb1fb664f6ce6c0c7274696f7874656e642c6163638173733d616e792c63616368653d66736361636865"]) chdir(&(0x7f0000000080)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x181242, 0x148) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) syz_emit_ethernet(0x113, &(0x7f00000024c0)={@broadcast, @multicast, @val={@val={0x88a8, 0x1, 0x1, 0x3}, {0x8100, 0x1, 0x0, 0x2}}, {@llc_tr={0x11, {@snap={0xab, 0x0, "ef", '\b\x00', 0x1a, "78e9e08eb74da8d0ae64285f5e86387c8915999fe431647e55226d5487b64a530a14f5d9d69d29e349a3b96e3abe53982c9fb68ef5e7f6a049abbe730f048c604a7c20c6d127c682a13ab3604fb26c5151e9a320bfd8c6b70a1c055aff8dc65cffd922c7c0290a975198a4306bb9f33ad0a5a21aa744a8aa6e762599f62bcc4f104dec5630ef6518bd81f2555d7c667ac4f7422d68d7d21ac8564a0138d7413bc596803b4f7d9b6c7cba60cd06216e4fafeefdb97e5a8f0b96f5db79dc51db1b3ec825d09125459018aa97f4f7b869f53264c0e82a7509ec46de9df072a85e090265b9b351344cef5ce5e325c7eb07dae0775be006"}}}}}, &(0x7f0000002600)={0x0, 0x1, [0xd8a, 0x3ad, 0x727, 0x861]}) syz_open_procfs$userns(r2, &(0x7f0000000200)) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) r5 = add_key$user(&(0x7f0000000080), &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) fsetxattr(r1, 0x0, 0x0, 0x0, 0x2) keyctl$KEYCTL_MOVE(0x1e, r5, 0xfffffffffffffffb, 0xffffffffffffffff, 0x1) r6 = bpf$MAP_CREATE(0x0, 0x0, 0x48) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000002480), 0xce4, r6}, 0x38) bpf$MAP_UPDATE_BATCH(0x1b, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xd, 0xd, &(0x7f00000023c0)=ANY=[@ANYBLOB="18000006000000000000000600110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b708000000000000638a4bff00000000bfa20000000001000783312ae43dffffb703000008000000b7041f0000040000850000005800c936850000002a00000495e8789300941768c200000000000000000000000000d629603e771f6d391e41bcf31d1a6cab7690c6ec85f88c37663ee836f24816844c7a1f695212fc1ce5d6a8b48159253142b15cd7c2fc72867118b0a3db9bd02d266e971b7e73d11e50b91d1d90"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r7, 0xc0502100, &(0x7f00000001c0)) prlimit64(0x0, 0xe, 0x0, 0x0) 5.965481881s ago: executing program 3 (id=1944): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f00000000c0)={0x4, 0xfffffffffffff18f, 0x1, 0x0, 0x2, 0x3, 0x1, 0x6, 0x7fffffff}) 5.895011551s ago: executing program 3 (id=1945): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x48}}, 0x0) socket(0x10, 0x80002, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008011}, 0x4000800) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x23, &(0x7f0000000000), 0x0) prctl$PR_SET_IO_FLUSHER(0x39, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) symlinkat(&(0x7f00000000c0)='./file2\x00', r0, &(0x7f0000000100)='./file2\x00') ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000080)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) 5.076831047s ago: executing program 2 (id=1947): socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000780)="7de463200689982b90659330e05e325ab2d13120ef8e20b97ea320d8289fb2bd00a9144648ebcff405719a2b25b2fdfb1b9825afbd081e5f3f25eaf508b9d2fe6d8c319c5a4cd6efb98329ed1e4a582cbd48efdee426780d35114539b67a", 0x5e, 0x0) add_key(0x0, &(0x7f0000000180), 0x0, 0x0, 0xfffffffffffffffe) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x1, 0x800001, 0x0, 0x0, 0x0) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) mincore(&(0x7f0000ff5000/0x4000)=nil, 0x4000, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) 4.909889325s ago: executing program 3 (id=1949): syz_usb_connect(0x2, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100003f3fdc20221802324a130102030109021b0001000010000904cdf100d3"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="183f0000000300000000000003000000950000000000000095"], &(0x7f00000003c0)='GPL\x00', 0x2, 0x1007, &(0x7f00000005c0)=""/4103, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0xc0) 4.655332118s ago: executing program 1 (id=1951): bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x39) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0x80200, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) io_setup(0x7, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) rseq(0x0, 0x0, 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000440)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x1, @remote}, 0xa, 0x0, 0x3}}, 0x26) sendmmsg$inet(r2, &(0x7f0000005f80)=[{{0x0, 0x0, &(0x7f0000005dc0)}}], 0x1a000, 0x8040) r3 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) r4 = syz_io_uring_setup(0x3eb1, &(0x7f00000034c0)={0x0, 0x764a, 0x8000, 0x3, 0x70}, 0x0, &(0x7f0000003580), 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r5, 0x0) io_uring_register$IORING_UNREGISTER_RING_FDS(r4, 0x15, &(0x7f0000002080)=[{0x200, 0x0, &(0x7f0000000600)}, {0x7fffffff, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000640)=""/131, 0x83}, {0x0}, {&(0x7f0000000880)=""/242, 0xf2}, {&(0x7f0000000980)=""/20, 0x14}]}, {0xd6, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000a00)=""/4096, 0x1000}, {&(0x7f0000001a00)=""/88, 0x58}, {&(0x7f0000001a80)=""/171, 0xab}, {&(0x7f0000001b80)=""/168, 0xa8}, {&(0x7f0000001c40)=""/89, 0x59}, {&(0x7f0000001cc0)=""/246, 0xf6}]}, {0x1, 0x0, &(0x7f0000002040)=[{&(0x7f0000001e00)=""/148, 0x94}, {&(0x7f0000001ec0)=""/137, 0x89}, {&(0x7f0000001f80)=""/106, 0x6a}, {&(0x7f0000002000)=""/6, 0x6}]}], 0x4) bind$alg(0xffffffffffffffff, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) syz_open_dev$vim2m(&(0x7f0000000100), 0x1, 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) 3.535943416s ago: executing program 3 (id=1955): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x4e24, 0x14, @loopback}], 0x1c) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) memfd_create(0x0, 0x4) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000080)={0x7ff, 0x10, 0x8}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000380)={0x0, 0x2}, 0x8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b30, &(0x7f00000000c0)={'wlan0\x00'}) syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000400)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106-gcm-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000c00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=[@assoc={0x18, 0x117, 0x4, 0x10}], 0x18, 0x40040}], 0x1, 0x8040) syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), r3) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000005c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010026bd7000fddbdf252800000005002b0002c0060005002e00040000000a0001007770616e3100000008002c00090000006f98657f67b62f12f75d62528e6d70d3f1ad244316d0a0a25fb27a3e75636051e370d5ac98b70bc346521b5f72ea1d73255b606cba43b912045d02ef4323e7c06dd177fc0c87b85d11bc9cd40615b3dcecfaf907ad2632c27ea63d81c006163dae2b653894f4b045e029935f52265c19049ee19fd8228d97052ba9667de7d5b215daeaf82ceadede4c7f6995da26e344f41436d89aab7f78a6b38c31c20a88e45d634436cff88730"], 0x38}, 0x1, 0x0, 0x0, 0x20000010}, 0xc800) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0xfffffffffffffffd, 0x0, 0x0, 0x3ff, 0x0, 0x2, 0x28, 0xfa}) sendto$inet6(r0, &(0x7f00000001c0)="0225", 0x2, 0x8003, &(0x7f0000000040)={0xa, 0x4e24, 0x7, @loopback, 0x8}, 0x1c) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./trace\x00', 0x1ff) socket(0x2, 0x80805, 0x0) 3.334044671s ago: executing program 2 (id=1956): r0 = socket$inet_sctp(0x2, 0x0, 0x84) setsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x10, &(0x7f0000000000)=@assoc_value={0x0, 0x2}, 0x8) socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e131f8104c1302007eac0102030109021b0001000000000904000001098b7500090583", @ANYRES8], 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000240), 0xc0000) 3.106041258s ago: executing program 1 (id=1957): timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x2}, &(0x7f0000bbdffc)) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d491009b3426c8928f3d97cb", 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x6000, {}, [@IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_PORT={0x6}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}]}, 0x5c}}, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger\x00', 0x1, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') read$FUSE(r3, 0x0, 0x4a) sendmsg$IPVS_CMD_SET_SERVICE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x83}, 0x8010) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x80080, 0x0) ioctl$KVM_CREATE_VM(r4, 0x40086806, 0x21) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x800, 0x2}, 0x0, &(0x7f0000000240)={0x1f, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) read$alg(r2, &(0x7f0000000000)=""/35, 0x23) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0xfffffffffffffe10, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6, 0x1, 0x1, 0x0, 0x4}, @NFTA_QUEUE_TOTAL={0x6, 0x2, 0x1, 0x0, 0x7765}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc4}}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 2.795263593s ago: executing program 4 (id=1961): ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) signalfd(r0, &(0x7f0000000040)={[0x0, 0x5]}, 0x8) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000100)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$radio(&(0x7f0000000340), 0x2, 0x2) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sequencer(0xffffff9c, &(0x7f0000000140), 0x288202, 0x0) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0x12, 0x80000006, 0xb06c}, 0x0, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x110, 0xffffffffffffffff, 0x91c6b000) unshare(0x6020400) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0x19, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000d1000c000000000001000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000b0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000b7080000000000007b8af8ff00000000b70800000b0000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b705000008000000850000006900000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0xe, 0x0, &(0x7f00000000c0)="9dbaac999f69835fc48373a1ee57", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket(0x2, 0x3, 0xff) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$inet(r4, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmsg$rds(r4, &(0x7f00000001c0)={&(0x7f0000000240)={0x2, 0x4e24, @multicast1}, 0x10, &(0x7f0000000180)=[{&(0x7f00000004c0)=""/250, 0xfa}], 0x1, 0x0, 0x0, 0x4c880}, 0x48800) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)=ANY=[]) read$FUSE(r5, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000000340)={0x50, 0x0, r6, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2, 0x1}}, 0x50) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) 2.655594753s ago: executing program 4 (id=1962): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'ip6gre0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x84, 0x0, &(0x7f0000000500)) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) bpf$PROG_LOAD(0x15, &(0x7f0000000340)={0x3, 0x0, 0x0, 0x0, 0x8000004, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x88840, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = syz_open_dev$dvb_frontend(&(0x7f00000003c0), 0x0, 0xe82) ioctl$FE_GET_EVENT(r11, 0x80286f4e, &(0x7f0000000080)={0x0, {0x0, 0x0, @qam}}) r12 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x1) ioctl$KVM_SET_NESTED_STATE(r12, 0x4080aebf, &(0x7f0000003680)=@vmx={0x3, 0x0, 0x2080, {0x0, 0xc000}, {"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005c5e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e3ffffffffffffff00", "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008bc584c800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001f6f38740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a4900"}}) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r8}, @IFLA_MASTER={0x8}]}, 0x44}}, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) r14 = socket(0x1, 0x803, 0x0) getsockname$packet(r14, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r13, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x400}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r15}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_BYTEMODE={0x8, 0x7, 0x1}]}}]}, 0x38}}, 0x0) 2.515293084s ago: executing program 4 (id=1963): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) keyctl$join(0x1, &(0x7f00000000c0)={'syz', 0x0}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r2, &(0x7f0000ccb000)={0x2, 0x4e24, @local}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, 0x0, &(0x7f00002bf000)='GPL\x00', 0x4, 0xb7, &(0x7f0000000040)=""/183, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000180)={r2, r3}) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)="be177d", 0x3}, {&(0x7f0000000380)="f94b5cd0a63d1f7028d8262c4362f1b488077d57c67985cdf3ed506c64547ef6ab1e61fb602dccdd3690811fd12b3a608a2d93d8fc8d1b4cc05a62ede115be7115ee", 0x42}], 0x2}}], 0x1, 0x40) close(0xffffffffffffffff) r4 = getpid() sched_setattr(r4, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x7ffd, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x118f}, 0x0) r5 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) keyctl$read(0xb, r5, &(0x7f0000001300)=""/4096, 0xffffffffffffffd2) syz_open_dev$video(0x0, 0x1d24, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="14000000100000fc00000000000000000000000a3c000000120a09000000000000000000020000000900020073797a310000000008000440000000000900010073797a30000000000800034000000005520000001100010000000000000000000000000ab98b7290cceee835ab1f351d6ab0fb09435d180cea4a2be2b969b5fcf571963f392e4ecb6e779c649d83dd6be53a85c1a0db833f4b892595ebc7a9ce2f9b5d30e3ae4bb82b8a9fcc45e52656af4963a79924177eb8deddffd016cb3e8e8f98c119ce11f06166a9e2a504a00b7e56add6695ec73e9eca00535532d3f4689fe993db39"], 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) r7 = syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r8 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r8, 0x11b, 0x4, 0x0, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) ioctl$CDROMVOLCTRL(0xffffffffffffffff, 0x530a, &(0x7f0000000200)={0xb0, 0x4, 0xf6, 0xd4}) ioctl$vim2m_VIDIOC_STREAMOFF(r7, 0x40045612, &(0x7f00000012c0)=0x2) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) mremap(&(0x7f00007ff000/0x4000)=nil, 0x4000, 0x4000, 0x0, &(0x7f0000580000/0x4000)=nil) 2.133956961s ago: executing program 1 (id=1964): socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000780)="7de463200689982b90659330e05e325ab2d13120ef8e20b97ea320d8289fb2bd00a9144648ebcff405719a2b25b2fdfb1b9825afbd081e5f3f25eaf508b9d2fe6d8c319c5a4cd6efb98329ed1e4a582cbd48efdee426780d35114539b67a", 0x5e, 0x0) add_key(0x0, &(0x7f0000000180), &(0x7f0000000100), 0x0, 0xfffffffffffffffe) futex(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x1, 0x800001, 0x0, 0x0, 0x0) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) mincore(&(0x7f0000ff5000/0x4000)=nil, 0x4000, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) 1.547322293s ago: executing program 4 (id=1965): bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x39) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0x80200, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) io_setup(0x7, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) rseq(0x0, 0x0, 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000440)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x1, @remote}, 0xa, 0x0, 0x3}}, 0x26) sendmmsg$inet(r2, &(0x7f0000005f80)=[{{0x0, 0x0, &(0x7f0000005dc0)}}], 0x1a000, 0x8040) r3 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) r4 = syz_io_uring_setup(0x3eb1, &(0x7f00000034c0)={0x0, 0x764a, 0x8000, 0x3, 0x70}, 0x0, &(0x7f0000003580), 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r5, 0x0) io_uring_register$IORING_UNREGISTER_RING_FDS(r4, 0x15, &(0x7f0000002080)=[{0x200, 0x0, &(0x7f0000000600)}, {0x7fffffff, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000640)=""/131, 0x83}, {0x0}, {&(0x7f0000000880)=""/242, 0xf2}, {&(0x7f0000000980)=""/20, 0x14}]}, {0xd6, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000a00)=""/4096, 0x1000}, {&(0x7f0000001a00)=""/88, 0x58}, {&(0x7f0000001a80)=""/171, 0xab}, {&(0x7f0000001b80)=""/168, 0xa8}, {&(0x7f0000001c40)=""/89, 0x59}, {&(0x7f0000001cc0)=""/246, 0xf6}]}, {0x1, 0x0, &(0x7f0000002040)=[{&(0x7f0000001e00)=""/148, 0x94}, {&(0x7f0000001ec0)=""/137, 0x89}, {&(0x7f0000001f80)=""/106, 0x6a}, {&(0x7f0000002000)=""/6, 0x6}]}], 0x4) bind$alg(0xffffffffffffffff, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) syz_open_dev$vim2m(&(0x7f0000000100), 0x1, 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) 1.415894485s ago: executing program 1 (id=1966): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) r1 = openat$tun(0xffffff9c, &(0x7f0000000040), 0x402000, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[], 0x48) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e045f2d20"], 0x7) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="040026bd7000fcdbdf250f000000080031000200000008003400000000000500370001000000"], 0x2c}, 0x1, 0x0, 0x0, 0x8841}, 0x4008041) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r5 = dup(0xffffffffffffffff) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x1, 0x1, 0x1, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r8 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r8, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r8, 0xda90) r9 = accept4(r8, 0x0, 0x0, 0x0) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="1700000000c8930000000000000000000000002c74f38348e5fabe60528212b390367d3ae73321f6a9ae0dbfb79d39fc3efac781d77a07adfb7b84266e4b99e3a1e697ce2bda133979ea0e9b535aceda8144c5b1aea865a24306557d925f52b4c997a41da4b76a197271f021e04c13b86d6a495b10fa1ca85df5ab0096171afb7078318efea300"/149, @ANYRESDEC=r3, @ANYBLOB="0600"/20, @ANYRES32=r7, @ANYRES32=r0, @ANYRES64=0x0, @ANYRESHEX=r1, @ANYBLOB='\x00\x00\x00\x00', @ANYRESHEX=r6, @ANYRES32, @ANYRESHEX=r9], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x11, 0x13, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000002000000000000000300000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70200001400e9ffb6030000000000008500000083000000bf09000000000000550901000000deff940000000000000001e73406c6107f1304550a0004000000186100000b0000000000000053020000bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000480)='syzkaller\x00', 0x58a9db0f, 0x24, &(0x7f00000004c0)=""/36, 0x41100, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000006c0)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000000700)={0x4, 0xe, 0x3, 0x35}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000007c0)=[r10, r5, r2], 0x0, 0x10, 0xfffffffb}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x400}) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 1.335629311s ago: executing program 2 (id=1967): pipe(&(0x7f0000000140)) r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read(r0, &(0x7f0000000040)=""/253, 0xfd) write$6lowpan_control(r0, &(0x7f0000000140)='connect aa:aa:aa:aa:aa:10 2', 0x1b) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000001c0)={{{@in6=@loopback, @in6=@private1}}, {{@in6=@private1}, 0x0, @in6=@loopback}}, &(0x7f00000002c0)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@empty, @in=@private}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000400)=0xe8) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0xde7ee25abc313986}, 0xc, 0x0}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreq(r1, 0x0, 0x24, &(0x7f00000018c0)={@multicast2, @private=0xa010101}, 0x8) socketpair$unix(0x1, 0x1, 0x0, 0x0) gettid() getgid() syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$unix(0xffffffffffffffff, 0x0, 0x400c0) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, 0x0, 0x0) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000021c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000022c0)={&(0x7f0000002180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000002280)={&(0x7f0000002200)={0x34, r3, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BACKEND_IDENTIFIER={0xa, 0xa, '%)&-,\x00'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x34}}, 0x1000) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000002840)={{r1, &(0x7f0000002400)='\xf1)]\x00', 0x40200, &(0x7f0000002440)={@align=0x8000, {0x0, 0x1000, 0xfffffff9, 0x5}}, 0x0, &(0x7f0000002480), &(0x7f00000024c0)=0xae12b44}, 0x3, &(0x7f00000027c0)=[{0x2, 0x5, &(0x7f0000002500)='-@\x00', &(0x7f0000002540)="10da5212485ca56571998db618ce34cb4f5a769953f1921fdd3d234400838a9666f5af57fe83bff5d8dca12c29b78ba3cd34020c4f15ba517d42dbb37a454c36a8525b6af2a7a5a413c8a27170172c595c801087265358876b4496a2d13b", 0x5e, 0x1a}, {0x2, 0x9, &(0x7f00000025c0)='\\-\x9d%\x00', &(0x7f0000002600)="298e23c4feabe0d874144efb8675835690038e0b9f68eb063154fba59126261c104d0abe00cf9f6ea39a5d2624b99afd1883d8ddecf602a31d4f52c1f0163ea74eac346c7ad236226cf4c61143fe564d63f5fef4b26788b0d2f76f5731d74bdd8486a8e3c339b26ffb52ff94aa0b4718550989f7350ab3350045158a70789845c55f5371be6e08f73c29f9ba0cb844ba9d71327f289f17e37addafade4d1bca5ca9aa3c4f2bec235ca7953d5cb8b6a217a00367fc07be238ab4a51e016a9fcedf6327e", 0xc3, 0x18}, {0x3, 0x6c7, &(0x7f0000002700)='wlan0\x00', &(0x7f0000002740)="09164b2f92eae6f0de031e96d3a67d4044f9af0eaf1650c68779b54d5c045d2f93e42f0d6af20ecd479f4ee79e6149cbc021ffe4555110e432631982b64053fe97562626337498c2e05a18dcd420f52c6178125ed92441bfebfba1ac819000009c3010aaffe3d161ab5abfe7e8f9b1c59d2c50cc16", 0x75, 0x32}]}) bind$inet6(r4, &(0x7f00000028c0)={0xa, 0x4e23, 0x9, @mcast1, 0x6}, 0x1c) ioctl$EXT4_IOC_GETSTATE(0xffffffffffffffff, 0x40046629, &(0x7f0000002900)) sendmsg$BATADV_CMD_GET_VLAN(r4, &(0x7f0000002a40)={&(0x7f0000002940)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000002a00)={&(0x7f00000005c0)=ANY=[@ANYBLOB="5800610cc9350000", @ANYRES16=0x0, @ANYBLOB="000426bd7000fedbdf251100000008003200030000000a000900aaaaaaaaaa41000005002a0000000000050038000000000008003c000000008008003400010001000500290001000000080039006f050000"], 0x58}, 0x1, 0x0, 0x0, 0x14}, 0x20000004) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000002ac0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000002bc0)={&(0x7f0000002a80), 0xc, &(0x7f0000002b80)={&(0x7f00000004c0)=ANY=[@ANYBLOB="000000004c6851c9319793d193d108abe849a6623f84c78509edeef75336900a9317cdd736e7962506f0f61e988f44096fff06e572f7ed328f2ad474f947dd927f8272d303381d22f28e4cd543e98533debbf28e439bacba2f8040495c7ac731596ee3693b0cdf7e0b5f9217c8aae783d0755c70bf675cf8e2be", @ANYRES16=r5, @ANYBLOB="000828bd7000fedbdf2501000000340007800c00018008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="0c0003004692000000000000"], 0x54}, 0x1, 0x0, 0x0, 0x840}, 0x4000) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f0000000340), 0x42, 0x0) 1.335353315s ago: executing program 2 (id=1968): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x38, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TDLS_ACTION={0x5}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x1}, @NL80211_ATTR_TDLS_DIALOG_TOKEN={0x5}, @NL80211_ATTR_IE={0x4}]}, 0x38}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'dvmrp1\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_open_dev$rtc(&(0x7f0000000000), 0x1, 0x210003) pidfd_getfd(0xffffffffffffffff, r6, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0xa0, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, r4, 0x800, 0x55007}, [@IFLA_LINKINFO={0x80, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x70, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}, @IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}, @IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}, @IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}, @IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}, @IFLA_BATADV_ALGO_NAME={0xd, 0x1, 'BATMAN_IV'}, @IFLA_BATADV_ALGO_NAME={0xd, 0x1, 'BATMAN_IV'}, @IFLA_BATADV_ALGO_NAME={0xd, 0x1, 'BATMAN_IV'}]}}}]}, 0xa0}, 0x1, 0x0, 0x0, 0x800}, 0x0) 1.235882309s ago: executing program 2 (id=1969): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) syz_usb_disconnect(r0) syz_usb_disconnect(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@ipv4_newrule={0x24, 0x21, 0x801, 0xfffffffc, 0xfffffffc, {0x2, 0x20}, [@FRA_DST={0x8, 0x1, @empty}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000200), 0x80000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r3, 0x4010ae67, &(0x7f0000000000)={0xffffffff, 0x2000}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r3, 0x4010ae68, &(0x7f0000000040)={0x0, 0x10000}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000280)='dummy_udc.0', 0xb) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='sched\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00', 0x0) 432.910189ms ago: executing program 4 (id=1970): r0 = syz_open_dev$MSR(&(0x7f0000000040), 0xa, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000100)) write(r1, &(0x7f0000000040)="c021", 0x2) ioctl$X86_IOC_RDMSR_REGS(r0, 0xc02063a0, &(0x7f00000010c0)=[0xfffff801, 0x4, 0x6a, 0x81, 0x4, 0x7f, 0x101, 0x7]) 431.950968ms ago: executing program 1 (id=1971): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'ip6gre0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x84, 0x0, &(0x7f0000000500)) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) bpf$PROG_LOAD(0x15, &(0x7f0000000340)={0x3, 0x0, 0x0, 0x0, 0x8000004, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x88840, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = syz_open_dev$dvb_frontend(&(0x7f00000003c0), 0x0, 0xe82) ioctl$FE_GET_EVENT(r12, 0x80286f4e, &(0x7f0000000080)={0x0, {0x0, 0x0, @qam}}) ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x1) ioctl$ifreq_SIOCGIFINDEX_team(r9, 0x8933, 0x0) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r8}, @IFLA_MASTER={0x8}]}, 0x44}}, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) r14 = socket(0x1, 0x803, 0x0) getsockname$packet(r14, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r13, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x400}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r15}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_BYTEMODE={0x8, 0x7, 0x1}]}}]}, 0x38}}, 0x0) 418.18728ms ago: executing program 3 (id=1972): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000300)={@fallback=r0, r0, 0x2f}, 0x20) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000012c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000180)={@cgroup=r0, r1, 0x2f, 0x10, 0x4, @void, @value=r1}, 0x20) 315.927631ms ago: executing program 3 (id=1973): syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x41) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x1000002, 0x1c1102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000001800010000000000000000000a0020000000000000000000050014000000000008000400", @ANYRES32=0x0, @ANYBLOB="0c000e"], 0x38}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r1, 0x8910, &(0x7f0000000000)={'vlan0\x00', @ifru_ivalue=0x8}) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da070000000000010902240001000000000904000009030000000921000000012222000905810308"], 0x0) syz_emit_vhci(&(0x7f00000002c0)=ANY=[@ANYBLOB="8ef82a328805c0aa92abe93065a4ba7861cea1f7f2567926f52ac72f987f5e5d898994976ec3a9475844ff8625577522c828c26d7fe30d5941c65f9b56fc5b63ef35df816430eed2820ad784a35191ce4ceb6896df1c9ee32b5262031022c2a310cdc0cda96e8673eda9bfc7542bd70e000758f223a0b216f49c999a2fa58bac31b1a1beb57037"], 0x7) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)) io_setup(0x401, &(0x7f0000000280)=0x0) io_submit(r3, 0x1, &(0x7f0000000800)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0, 0xffffffffffffffb2}]) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x8200, 0x0) ioctl$COMEDI_INSN(r4, 0x8028640c, &(0x7f0000000040)={0xc000003, 0xf, &(0x7f0000000080)=[0x1e, 0x9, 0x2, 0x4, 0x4, 0xffffdffa, 0x2d7b, 0x40000003, 0x5d, 0x5, 0xfffffffa, 0x8, 0x6, 0x880e, 0x5], 0x2, 0x4000007}) socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x1, @local}, 0x10) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f00000003c0)=[@in6={0xa, 0x4e23, 0xa, @private1={0xfc, 0x1, '\x00', 0x1}, 0x4}]}, &(0x7f0000000040)=0x10) shutdown(r6, 0x2) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, &(0x7f0000000080)={r7, 0x8001}, &(0x7f00000000c0)=0x8) connect$inet(r5, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x0) 242.802997ms ago: executing program 4 (id=1974): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) r1 = openat$tun(0xffffff9c, &(0x7f0000000040), 0x402000, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e045f2d20"], 0x7) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="040026bd7000fcdbdf250f000000080031000200000008003400000000000500370001000000"], 0x2c}, 0x1, 0x0, 0x0, 0x8841}, 0x4008041) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r4 = dup(0xffffffffffffffff) r5 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x2e9d, 0xc00, 0x1, 0x11}, &(0x7f0000000100)=0x0, 0x0, 0x0) syz_io_uring_submit(r6, 0x0, 0x0, 0x0) io_uring_enter(r5, 0x1, 0x1, 0x1, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000280)=@HCI_EVENT_PKT={0x4, @hci_ev_link_key_notify={{0x18, 0x17}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, "6b62a1bffeb0b48bdc84b505933f1279", 0x7}}}, 0x1a) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$MRT6_DEL_MFC(r4, 0x29, 0xcd, &(0x7f0000000080)={{0xa, 0x4e22, 0xffff26c0, @loopback, 0x28}, {0xa, 0x4e22, 0x5, @mcast1}, 0x0, {[0x8, 0x8, 0x101, 0x8, 0x1, 0x200, 0x8, 0x6]}}, 0x5c) r9 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r9, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r9, 0xda90) r10 = accept4(r9, 0x0, 0x0, 0x0) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="1700000000c8930000000000000000000000002c74f38348e5fabe60528212b390367d3ae73321f6a9ae0dbfb79d39fc3efac781d77a07adfb7b84266e4b99e3a1e697ce2bda133979ea0e9b535aceda8144c5b1aea865a24306557d925f52b4c997a41da4b76a197271f021e04c13b86d6a495b10fa1ca85df5ab0096171afb7078318efea300"/149, @ANYRESDEC=r2, @ANYBLOB="0600"/20, @ANYRES32=r8, @ANYRES32=r0, @ANYRES64=0x0, @ANYRESHEX=r1, @ANYBLOB='\x00\x00\x00\x00', @ANYRESHEX=r7, @ANYRES32=r6, @ANYRESHEX=r10], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x11, 0x13, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000002000000000000000300000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70200001400e9ffb6030000000000008500000083000000bf09000000000000550901000000deff940000000000000001e73406c6107f1304550a0004000000186100000b0000000000000053020000bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000480)='syzkaller\x00', 0x58a9db0f, 0x24, &(0x7f00000004c0)=""/36, 0x41100, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000006c0)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000000700)={0x4, 0xe, 0x3, 0x35}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000007c0)=[r11, r4, 0xffffffffffffffff], 0x0, 0x10, 0xfffffffb}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x400}) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 0s ago: executing program 1 (id=1975): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0x1) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x91c6b000) unshare(0x6020400) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x20000040) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x20, &(0x7f0000000000)=[0xffffffffffffffff], 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x4) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000b0, 0x0, 0x7fff}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ec) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r4, 0xc01064b5, &(0x7f0000000180)={&(0x7f00000003c0)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r4, 0xc02064b6, &(0x7f00000001c0)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/tracing/trace_marker\x00', 0x1, 0x0) write(r6, &(0x7f0000001000)='A', 0x1) kernel console output (not intermixed with test programs): back:0kB shmem:7568kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5796kB pagetables:3508kB sec_pagetables:88kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 246.615011][T10499] Node 0 DMA free:2020kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:240kB local_pcp:120kB free_cma:0kB [ 246.625050][T10499] lowmem_reserve[]: 0 280 280 280 280 [ 246.626852][T10499] Node 0 DMA32 free:17900kB boost:2048kB min:14820kB low:18012kB high:21204kB reserved_highatomic:0KB free_highatomic:0KB active_anon:196kB inactive_anon:32kB active_file:276kB inactive_file:0kB unevictable:1536kB writepending:12kB zspages:0kB present:1032196kB managed:286888kB mlocked:0kB bounce:0kB free_pcp:11816kB local_pcp:1504kB free_cma:0kB [ 246.632994][ T5827] usb 9-1: device descriptor read/8, error -71 [ 246.644364][T10499] lowmem_reserve[]: 0 0 0 0 0 [ 246.646006][T10499] Node 1 DMA32 free:170220kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:26332kB inactive_anon:60kB active_file:9976kB inactive_file:118048kB unevictable:5592kB writepending:1580kB zspages:1820kB present:1048432kB managed:948212kB mlocked:56kB bounce:0kB free_pcp:43756kB local_pcp:6132kB free_cma:0kB [ 246.665028][T10499] lowmem_reserve[]: 0 0 0 0 0 [ 246.666696][T10499] Node 0 DMA: 1*4kB (M) 2*8kB (UM) 1*16kB (M) 4*32kB (UM) 1*64kB (M) 0*128kB 1*256kB (M) 1*512kB (M) 1*1024kB (M) 0*2048kB 0*4096kB = 2020kB [ 246.671499][T10499] Node 0 DMA32: 211*4kB (UM) 60*8kB (UME) 42*16kB (UME) 117*32kB (UME) 50*64kB (UME) 16*128kB (UME) 5*256kB (UM) 5*512kB (UM) 3*1024kB (UM) 0*2048kB 0*4096kB = 17900kB [ 246.677288][T10499] Node 1 DMA32: 1759*4kB (UME) 668*8kB (UME) 172*16kB (UME) 241*32kB (UME) 193*64kB (UME) 151*128kB (UME) 84*256kB (ME) 38*512kB (UME) 17*1024kB (ME) 14*2048kB (UM) 7*4096kB (UM) = 170236kB [ 246.684194][T10499] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 246.687959][T10499] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 246.691816][T10499] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 246.695795][T10499] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 246.699694][T10499] 34478 total pagecache pages [ 246.702011][T10499] 129 pages in swap cache [ 246.703784][T10499] Free swap = 122244kB [ 246.705196][T10499] Total swap = 124996kB [ 246.706809][T10499] 524155 pages RAM [ 246.708108][T10499] 0 pages HighMem/MovableOnly [ 246.710066][T10499] 211540 pages reserved [ 246.711434][T10499] 0 pages cma reserved [ 246.742060][ T5827] usb usb9-port1: unable to enumerate USB device [ 246.779405][T10506] syzkaller0: entered promiscuous mode [ 246.781209][T10506] syzkaller0: entered allmulticast mode [ 246.986798][T10522] netlink: 'syz.2.1577': attribute type 1 has an invalid length. [ 247.006931][T10522] 8021q: adding VLAN 0 to HW filter on device bond6 [ 247.029211][T10522] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1577'. [ 247.034231][T10522] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1577'. [ 247.114815][T10532] trusted_key: encrypted_key: keylen parameter is missing [ 247.205828][ T29] usb 8-1: new high-speed USB device number 43 using dummy_hcd [ 247.278142][T10539] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1580'. [ 247.380246][ T29] usb 8-1: Using ep0 maxpacket: 32 [ 247.615423][ T29] usb 8-1: config index 0 descriptor too short (expected 17179, got 27) [ 247.623381][ T29] usb 8-1: config 83 has too many interfaces: 65, using maximum allowed: 32 [ 247.629956][ T29] usb 8-1: config 83 has an invalid descriptor of length 32, skipping remainder of the config [ 247.637682][ T29] usb 8-1: config 83 has 0 interfaces, different from the descriptor's value: 65 [ 247.643881][ T29] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 247.647282][ T29] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 247.650192][ T29] usb 8-1: Product: syz [ 247.651721][ T29] usb 8-1: Manufacturer: syz [ 247.653459][ T29] usb 8-1: SerialNumber: syz [ 248.282021][T10563] sd 0:0:0:0: PR command failed: 1026 [ 248.283831][T10563] sd 0:0:0:0: Sense Key : Illegal Request [current] [ 248.286697][T10563] sd 0:0:0:0: Add. Sense: Invalid command operation code [ 248.549947][ T5827] usb 7-1: new low-speed USB device number 41 using dummy_hcd [ 248.715124][ T5827] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 248.718452][ T5827] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 248.724698][ T5827] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 248.729504][ T5827] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 248.734272][ T5827] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 248.740527][ T5827] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 248.743727][ T5827] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 248.747998][ T5827] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 248.752968][ T5827] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 248.757373][ T5827] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 248.764242][ T5827] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 248.769438][ T5827] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 248.773939][ T5827] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 248.778697][ T5827] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 248.779549][ T29] usb 8-1: USB disconnect, device number 43 [ 248.783189][ T5827] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 248.793774][ T5827] usb 7-1: string descriptor 0 read error: -22 [ 248.796532][ T5827] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 248.801308][ T5827] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.834719][ T5827] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 249.052711][ T5827] usb 7-1: USB disconnect, device number 41 [ 249.357348][T10590] netlink: 'syz.1.1586': attribute type 1 has an invalid length. [ 249.377871][T10590] 8021q: adding VLAN 0 to HW filter on device bond4 [ 249.393368][T10590] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1586'. [ 249.396355][T10590] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1586'. [ 249.454337][T10593] binder: 10592:10593 ioctl c00c6211 0 returned -14 [ 249.604720][T10595] trusted_key: encrypted_key: keylen parameter is missing [ 249.642523][T10597] netlink: 'syz.2.1589': attribute type 1 has an invalid length. [ 249.648597][ T5101] Bluetooth: hci3: unexpected event for opcode 0x202d [ 249.656918][T10597] 8021q: adding VLAN 0 to HW filter on device bond7 [ 249.749623][T10602] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1589'. [ 249.753256][T10602] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1589'. [ 249.988713][T10609] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1592'. [ 250.826197][T10613] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 250.861082][T10616] FAULT_INJECTION: forcing a failure. [ 250.861082][T10616] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 250.867615][T10616] CPU: 1 UID: 0 PID: 10616 Comm: syz.1.1595 Tainted: G L syzkaller #0 PREEMPT(full) [ 250.867635][T10616] Tainted: [L]=SOFTLOCKUP [ 250.867639][T10616] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 250.867646][T10616] Call Trace: [ 250.867650][T10616] [ 250.867655][T10616] dump_stack_lvl+0x100/0x190 [ 250.867673][T10616] should_fail_ex.cold+0x5/0xa [ 250.867686][T10616] _copy_from_iter+0x1f4/0x1690 [ 250.867720][T10616] ? __asan_memset+0x23/0x50 [ 250.867733][T10616] ? __pfx__copy_from_iter+0x10/0x10 [ 250.867750][T10616] ? __pfx___alloc_skb+0x10/0x10 [ 250.867770][T10616] netlink_sendmsg+0x808/0xda0 [ 250.867786][T10616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 250.867801][T10616] ? apparmor_socket_sendmsg+0x15b/0x270 [ 250.867816][T10616] ____sys_sendmsg+0xa4d/0xbe0 [ 250.867846][T10616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 250.867862][T10616] ? __pfx_____sys_sendmsg+0x10/0x10 [ 250.867893][T10616] ___sys_sendmsg+0x190/0x1e0 [ 250.867907][T10616] ? __pfx____sys_sendmsg+0x10/0x10 [ 250.867925][T10616] ? find_held_lock+0x2b/0x80 [ 250.867948][T10616] __sys_sendmsg+0x160/0x210 [ 250.867964][T10616] ? __pfx___sys_sendmsg+0x10/0x10 [ 250.867984][T10616] ? __pfx_ksys_write+0x10/0x10 [ 250.867998][T10616] __do_fast_syscall_32+0xe7/0x970 [ 250.868014][T10616] ? lockdep_hardirqs_on+0x78/0x100 [ 250.868029][T10616] do_fast_syscall_32+0x32/0x70 [ 250.868045][T10616] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 250.868059][T10616] RIP: 0023:0xf70befec [ 250.868072][T10616] Code: Unable to access opcode bytes at 0xf70befc2. [ 250.868077][T10616] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 250.868088][T10616] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000480 [ 250.868095][T10616] RDX: 0000000000000840 RSI: 0000000000000000 RDI: 0000000000000000 [ 250.868101][T10616] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 250.868117][T10616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 250.868123][T10616] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 250.868137][T10616] [ 250.881190][T10618] lo speed is unknown, defaulting to 1000 [ 250.891614][T10619] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1594'. [ 250.959245][T10623] IPv6: NLM_F_CREATE should be specified when creating new route [ 250.962586][T10623] IPv6: Can't replace route, no match found [ 251.197013][T10627] trusted_key: encrypted_key: keylen parameter is missing [ 251.266763][ T5751] Bluetooth: hci1: unexpected event for opcode 0x202d [ 251.899969][ T5101] Bluetooth: hci0: unexpected event for opcode 0x202d [ 252.456609][ T5101] Bluetooth: hci0: unexpected event for opcode 0x202d [ 252.538084][T10660] trusted_key: encrypted_key: keylen parameter is missing [ 252.570691][T10662] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1608'. [ 252.573578][T10662] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1608'. [ 252.766329][T10668] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 253.898420][T10687] trusted_key: encrypted_key: keylen parameter is missing [ 254.366838][ T5101] Bluetooth: hci1: unexpected event for opcode 0x202d [ 254.440682][ T5835] usb 9-1: new low-speed USB device number 29 using dummy_hcd [ 254.465812][T10698] overlayfs: invalid origin (00000079000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000) [ 254.612362][ T5835] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 254.617869][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 254.621453][ T5835] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 254.626270][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 254.642086][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 254.655564][ T5835] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 254.666670][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 254.685647][ T5835] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 254.689531][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 254.693236][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 254.699208][ T5835] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 254.704062][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 254.709719][ T5835] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 254.715897][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 254.722230][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 254.740456][ T5835] usb 9-1: string descriptor 0 read error: -22 [ 254.743060][ T5835] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 254.746023][ T5835] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 254.798624][ T5835] adutux 9-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 255.194258][ T1442] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.196423][ T1442] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.539014][T10713] trusted_key: encrypted_key: keylen parameter is missing [ 256.020038][T10726] syzkaller1: entered promiscuous mode [ 256.022480][T10726] syzkaller1: entered allmulticast mode [ 256.802020][T10734] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 257.033568][ T5101] Bluetooth: hci1: unexpected event for opcode 0x202d [ 257.265035][ T24] usb 9-1: USB disconnect, device number 29 [ 258.225161][ T5101] Bluetooth: hci2: unexpected event for opcode 0x202d [ 258.485209][T10753] trusted_key: encrypted_key: keylen parameter is missing [ 258.528230][ T5101] Bluetooth: hci0: unexpected event for opcode 0x202d [ 259.539449][ T5101] Bluetooth: hci3: unexpected event for opcode 0x202d [ 259.634253][T10776] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(7) [ 259.636509][T10776] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 259.639430][T10776] vhci_hcd vhci_hcd.0: Device attached [ 259.655269][T10776] tipc: Started in network mode [ 259.657610][T10776] tipc: Node identity 4, cluster identity 4711 [ 259.659682][T10776] tipc: Node number set to 4 [ 259.671391][T10776] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1643'. [ 259.929995][ T24] usb 40-1: SetAddress Request (2) to port 0 [ 259.932416][ T24] usb 40-1: new SuperSpeed USB device number 2 using vhci_hcd [ 260.320011][ T61] usb 9-1: new low-speed USB device number 30 using dummy_hcd [ 260.383057][T10777] vhci_hcd: connection reset by peer [ 260.387520][ T5820] vhci_hcd vhci_hcd.1: stop threads [ 260.390110][ T5820] vhci_hcd vhci_hcd.1: release socket [ 260.395229][ T5820] vhci_hcd vhci_hcd.1: disconnect device [ 260.472229][ T61] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 260.475402][ T61] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 260.479619][ T61] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 260.484294][ T61] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 260.488733][ T61] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 260.494780][ T61] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 260.497934][ T61] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 260.502360][ T61] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 260.507035][ T61] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 260.511649][ T61] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 260.517588][ T61] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 260.520903][ T61] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 260.525290][ T61] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 260.530194][ T61] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 260.534753][ T61] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 260.549418][ T61] usb 9-1: string descriptor 0 read error: -22 [ 260.552946][ T61] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 260.556718][ T61] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.575175][ T61] adutux 9-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 260.750581][T10792] FAULT_INJECTION: forcing a failure. [ 260.750581][T10792] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 260.761611][T10792] CPU: 2 UID: 0 PID: 10792 Comm: syz.2.1646 Tainted: G L syzkaller #0 PREEMPT(full) [ 260.761645][T10792] Tainted: [L]=SOFTLOCKUP [ 260.761651][T10792] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 260.761662][T10792] Call Trace: [ 260.761669][T10792] [ 260.761677][T10792] dump_stack_lvl+0x100/0x190 [ 260.761704][T10792] should_fail_ex.cold+0x5/0xa [ 260.761725][T10792] _copy_from_user+0x2e/0xd0 [ 260.761755][T10792] rtc_dev_ioctl+0x376/0xd90 [ 260.761802][T10792] ? __pfx_rtc_dev_ioctl+0x10/0x10 [ 260.761828][T10792] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 260.761863][T10792] ? __fget_files+0x215/0x3d0 [ 260.761879][T10792] ? hook_file_ioctl_common+0x140/0x440 [ 260.761909][T10792] ? __fget_files+0x21f/0x3d0 [ 260.761930][T10792] rtc_dev_compat_ioctl+0x5a/0x160 [ 260.761958][T10792] ? __pfx_rtc_dev_compat_ioctl+0x10/0x10 [ 260.761986][T10792] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 260.762015][T10792] __do_fast_syscall_32+0xe7/0x970 [ 260.762040][T10792] ? lockdep_hardirqs_on+0x78/0x100 [ 260.762065][T10792] do_fast_syscall_32+0x32/0x70 [ 260.762090][T10792] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.762113][T10792] RIP: 0023:0xf6fcefec [ 260.762135][T10792] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 260.762143][T10792] RSP: 002b:00000000f53bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 260.762162][T10792] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040247007 [ 260.762174][T10792] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 260.762185][T10792] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 260.762194][T10792] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 260.762204][T10792] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 260.762228][T10792] [ 261.324611][T10801] syzkaller1: entered promiscuous mode [ 261.327094][T10801] syzkaller1: entered allmulticast mode [ 261.429186][T10804] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 262.259108][T10812] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 262.330154][ T5101] Bluetooth: hci0: unexpected event for opcode 0x202d [ 262.573496][ T5827] usb 9-1: USB disconnect, device number 30 [ 262.977275][T10826] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 262.983913][T10826] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.746725][T10838] syz.4.1657: page allocation failure: order:2, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 263.752551][T10838] CPU: 2 UID: 0 PID: 10838 Comm: syz.4.1657 Tainted: G L syzkaller #0 PREEMPT(full) [ 263.752571][T10838] Tainted: [L]=SOFTLOCKUP [ 263.752575][T10838] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 263.752582][T10838] Call Trace: [ 263.752587][T10838] [ 263.752591][T10838] dump_stack_lvl+0x100/0x190 [ 263.752609][T10838] warn_alloc.cold+0x94/0xa8 [ 263.752623][T10838] ? __pfx_warn_alloc+0x10/0x10 [ 263.752640][T10838] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 263.752657][T10838] ? __pfx_get_page_from_freelist+0x10/0x10 [ 263.752674][T10838] __alloc_frozen_pages_noprof+0x159f/0x2dc0 [ 263.752695][T10838] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 263.752709][T10838] ? mark_held_locks+0x40/0x70 [ 263.752727][T10838] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 263.752740][T10838] ? lockdep_hardirqs_on+0x78/0x100 [ 263.752755][T10838] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 263.752772][T10838] ? kasan_save_track+0x14/0x30 [ 263.752786][T10838] ? __kasan_kmalloc+0xaa/0xb0 [ 263.752799][T10838] ? __kmalloc_noprof+0x322/0x820 [ 263.752811][T10838] ? comedi_isadma_alloc+0xc6/0x620 [ 263.752861][T10838] ? pcl816_attach+0x909/0xb30 [ 263.752893][T10838] __alloc_pages_noprof+0xb/0x110 [ 263.752913][T10838] __dma_direct_alloc_pages.isra.0+0x47c/0x8f0 [ 263.752945][T10838] ? __pfx___dma_direct_alloc_pages.isra.0+0x10/0x10 [ 263.752973][T10838] ? dma_alloc_from_dev_coherent+0x2e0/0x570 [ 263.753003][T10838] dma_direct_alloc+0x8f/0x590 [ 263.753022][T10838] dma_alloc_attrs+0x182/0x3a0 [ 263.753035][T10838] ? __pfx_dma_alloc_attrs+0x10/0x10 [ 263.753049][T10838] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 263.753061][T10838] ? dma_direct_supported+0xca/0x220 [ 263.753079][T10838] comedi_isadma_alloc+0x331/0x620 [ 263.753097][T10838] ? __pfx_comedi_isadma_alloc+0x10/0x10 [ 263.753115][T10838] ? request_threaded_irq+0x27b/0x3e0 [ 263.753139][T10838] pcl816_attach+0x909/0xb30 [ 263.753154][T10838] comedi_device_attach+0x40e/0x6b0 [ 263.753171][T10838] do_devconfig_ioctl+0x1b3/0x6d0 [ 263.753187][T10838] ? comedi_unlocked_ioctl+0x180/0x3310 [ 263.753199][T10838] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 263.753222][T10838] ? tomoyo_path_number_perm+0x46d/0x580 [ 263.753237][T10838] ? kasan_save_stack+0x3f/0x50 [ 263.753252][T10838] ? kasan_save_stack+0x30/0x50 [ 263.753265][T10838] ? kasan_save_track+0x14/0x30 [ 263.753278][T10838] ? kasan_save_free_info+0x3b/0x70 [ 263.753291][T10838] comedi_unlocked_ioctl+0x860/0x3310 [ 263.753305][T10838] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 263.753327][T10838] ? kasan_quarantine_put+0x104/0x240 [ 263.753340][T10838] ? lockdep_hardirqs_on+0x78/0x100 [ 263.753355][T10838] ? find_held_lock+0x2b/0x80 [ 263.753369][T10838] ? tomoyo_path_number_perm+0x28f/0x580 [ 263.753382][T10838] ? tomoyo_path_number_perm+0x28f/0x580 [ 263.753399][T10838] ? tomoyo_path_number_perm+0x188/0x580 [ 263.753417][T10838] comedi_compat_ioctl+0x438/0xe20 [ 263.753428][T10838] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 263.753440][T10838] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 263.753457][T10838] ? do_vfs_ioctl+0x226/0x13e0 [ 263.753473][T10838] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 263.753493][T10838] ? find_held_lock+0x2b/0x80 [ 263.753506][T10838] ? __fget_files+0x215/0x3d0 [ 263.753516][T10838] ? hook_file_ioctl_common+0x140/0x440 [ 263.753534][T10838] ? __fget_files+0x21f/0x3d0 [ 263.753547][T10838] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 263.753558][T10838] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 263.753576][T10838] __do_fast_syscall_32+0xe7/0x970 [ 263.753595][T10838] do_fast_syscall_32+0x32/0x70 [ 263.753611][T10838] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 263.753627][T10838] RIP: 0023:0xf7fc5fec [ 263.753642][T10838] Code: Unable to access opcode bytes at 0xf7fc5fc2. [ 263.753647][T10838] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 263.753658][T10838] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040946400 [ 263.753665][T10838] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 263.753672][T10838] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 263.753678][T10838] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 263.753684][T10838] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 263.753698][T10838] [ 263.758902][T10838] Mem-Info: [ 263.878169][T10832] netlink: 'syz.1.1655': attribute type 10 has an invalid length. [ 263.881724][T10838] active_anon:6756 inactive_anon:22 isolated_anon:0 [ 263.881724][T10838] active_file:2555 inactive_file:29526 isolated_file:0 [ 263.881724][T10838] unevictable:1768 dirty:224 writeback:0 [ 263.881724][T10838] slab_reclaimable:6750 slab_unreclaimable:57444 [ 263.881724][T10838] mapped:24405 shmem:2275 pagetables:1257 [ 263.881724][T10838] sec_pagetables:300 bounce:0 [ 263.881724][T10838] kernel_misc_reclaimable:0 [ 263.881724][T10838] free:46395 free_pcp:60 free_cma:0 [ 263.922046][T10838] Node 0 active_anon:20kB inactive_anon:32kB active_file:244kB inactive_file:32kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:40kB dirty:8kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8864kB pagetables:1164kB sec_pagetables:1112kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 263.939681][T10838] Node 0 DMA free:2020kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:240kB local_pcp:76kB free_cma:0kB [ 263.973984][T10838] lowmem_reserve[]: 0 280 280 280 280 [ 263.979201][T10838] Node 0 DMA: 1*4kB (M) 2*8kB (UM) 1*16kB (M) 4*32kB (UM) 1*64kB (M) 0*128kB 1*256kB (M) 1*512kB (M) 1*1024kB (M) 0*2048kB 0*4096kB = 2020kB [ 263.990746][T10838] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 263.994353][T10838] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 263.997336][T10838] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 264.001001][T10838] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 264.004413][T10838] 34482 total pagecache pages [ 264.005884][T10838] 129 pages in swap cache [ 264.007271][T10838] Free swap = 122244kB [ 264.008720][T10838] Total swap = 124996kB [ 264.010619][T10838] 524155 pages RAM [ 264.012069][T10838] 0 pages HighMem/MovableOnly [ 264.013829][T10838] 211540 pages reserved [ 264.016234][T10838] 0 pages cma reserved [ 264.449990][ T6027] usb 8-1: new low-speed USB device number 44 using dummy_hcd [ 264.590983][ T5101] Bluetooth: hci0: unexpected event for opcode 0x202d [ 264.601716][ T6027] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 264.604169][ T6027] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 264.607722][ T6027] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 264.611852][ T6027] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 264.615477][ T6027] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 264.620443][ T6027] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 264.623066][ T6027] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 264.626504][ T6027] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 264.630359][ T6027] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 264.633862][ T6027] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 264.638116][ T6027] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 264.641427][ T6027] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 264.644854][ T6027] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 264.648499][ T6027] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 264.653239][ T6027] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 264.659658][ T6027] usb 8-1: string descriptor 0 read error: -22 [ 264.662039][ T6027] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 264.664965][ T6027] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.670931][ T6027] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 264.720398][ T5835] usb 9-1: new low-speed USB device number 31 using dummy_hcd [ 264.892873][ T5835] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 264.900563][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 264.906318][ T5835] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 264.910150][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 264.913921][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 264.922891][ T5835] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 264.925841][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 264.929381][ T5835] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 264.933624][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 264.937504][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 264.943123][ T5835] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 264.947751][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 264.951335][ T5835] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 264.955044][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 264.958796][ T5835] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 264.967724][ T5835] usb 9-1: string descriptor 0 read error: -22 [ 264.970130][ T5835] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 264.974530][ T5835] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.992234][ T5835] adutux 9-1:168.0: ADU100 now attached to /dev/usb/adutux1 [ 265.040307][ T24] usb 40-1: device descriptor read/8, error -110 [ 265.442264][ T24] usb usb40-port1: attempt power cycle [ 266.021141][ T24] usb usb40-port1: unable to enumerate USB device [ 266.480606][T10878] skbuff: bad partial csum: csum=65535/127 headroom=178 headlen=65664 [ 267.128693][ T10] usb 8-1: USB disconnect, device number 44 [ 267.324645][ T29] usb 9-1: USB disconnect, device number 31 [ 267.478928][T10895] 9p: Bad value for 'source' [ 268.388776][T10906] FAULT_INJECTION: forcing a failure. [ 268.388776][T10906] name failslab, interval 1, probability 0, space 0, times 0 [ 268.393768][T10906] CPU: 3 UID: 0 PID: 10906 Comm: syz.1.1678 Tainted: G L syzkaller #0 PREEMPT(full) [ 268.393787][T10906] Tainted: [L]=SOFTLOCKUP [ 268.393791][T10906] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 268.393798][T10906] Call Trace: [ 268.393802][T10906] [ 268.393807][T10906] dump_stack_lvl+0x100/0x190 [ 268.393824][T10906] should_fail_ex.cold+0x5/0xa [ 268.393838][T10906] should_failslab+0xc2/0x120 [ 268.393854][T10906] __kmalloc_noprof+0xfc/0x820 [ 268.393868][T10906] ? tomoyo_encode2+0xfb/0x3c0 [ 268.393889][T10906] tomoyo_encode2+0xfb/0x3c0 [ 268.393907][T10906] tomoyo_encode+0x29/0x50 [ 268.393922][T10906] tomoyo_realpath_from_path+0x18c/0x690 [ 268.393943][T10906] tomoyo_path_number_perm+0x23c/0x580 [ 268.393957][T10906] ? tomoyo_path_number_perm+0x22e/0x580 [ 268.393972][T10906] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 268.393988][T10906] ? get_pid_task+0x106/0x250 [ 268.394015][T10906] ? find_held_lock+0x2b/0x80 [ 268.394029][T10906] ? __fget_files+0x215/0x3d0 [ 268.394038][T10906] ? hook_file_ioctl_common+0x140/0x440 [ 268.394054][T10906] ? __fget_files+0x215/0x3d0 [ 268.394067][T10906] ? __fget_files+0x21f/0x3d0 [ 268.394079][T10906] security_file_ioctl_compat+0xd3/0x230 [ 268.394095][T10906] __ia32_compat_sys_ioctl+0xc2/0x360 [ 268.394113][T10906] __do_fast_syscall_32+0xe7/0x970 [ 268.394129][T10906] ? lockdep_hardirqs_on+0x78/0x100 [ 268.394144][T10906] do_fast_syscall_32+0x32/0x70 [ 268.394160][T10906] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 268.394175][T10906] RIP: 0023:0xf70befec [ 268.394189][T10906] Code: Unable to access opcode bytes at 0xf70befc2. [ 268.394194][T10906] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 268.394206][T10906] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000004b66 [ 268.394212][T10906] RDX: 0000000080001080 RSI: 0000000000000000 RDI: 0000000000000000 [ 268.394219][T10906] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 268.394225][T10906] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 268.394231][T10906] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 268.394245][T10906] [ 268.394256][T10906] ERROR: Out of memory at tomoyo_realpath_from_path. [ 269.132365][ T5101] Bluetooth: hci1: unexpected event for opcode 0x202d [ 269.215200][T10923] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1682'. [ 269.460387][ T5827] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 269.589995][ T5827] usb 9-1: new full-speed USB device number 32 using dummy_hcd [ 269.747388][ T5827] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 269.752105][ T5827] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 269.758588][ T5827] usb 9-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 269.764056][ T5827] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.767538][ T5827] usb 9-1: Product: syz [ 269.769368][ T5827] usb 9-1: Manufacturer: syz [ 269.772729][ T5827] usb 9-1: SerialNumber: syz [ 269.779067][ T5827] usb 9-1: config 0 descriptor?? [ 269.784026][ T5827] hub 9-1:0.0: bad descriptor, ignoring hub [ 269.786915][ T5827] hub 9-1:0.0: probe with driver hub failed with error -5 [ 269.797111][ T5827] input: syz syz as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/input/input22 [ 270.153376][ T5948] IPVS: starting estimator thread 0... [ 270.240012][T10935] IPVS: using max 26 ests per chain, 62400 per kthread [ 270.754254][T10941] netlink: 'syz.3.1685': attribute type 1 has an invalid length. [ 270.759391][T10941] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1685'. [ 271.855639][T10953] FAULT_INJECTION: forcing a failure. [ 271.855639][T10953] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 271.860812][T10953] CPU: 0 UID: 0 PID: 10953 Comm: syz.1.1688 Tainted: G L syzkaller #0 PREEMPT(full) [ 271.860843][T10953] Tainted: [L]=SOFTLOCKUP [ 271.860850][T10953] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 271.860861][T10953] Call Trace: [ 271.860868][T10953] [ 271.860875][T10953] dump_stack_lvl+0x100/0x190 [ 271.860901][T10953] should_fail_ex.cold+0x5/0xa [ 271.860923][T10953] _copy_from_iter+0x1f4/0x1690 [ 271.860960][T10953] ? __asan_memset+0x23/0x50 [ 271.860979][T10953] ? __pfx__copy_from_iter+0x10/0x10 [ 271.861005][T10953] ? __pfx___alloc_skb+0x10/0x10 [ 271.861038][T10953] netlink_sendmsg+0x808/0xda0 [ 271.861064][T10953] ? __pfx_netlink_sendmsg+0x10/0x10 [ 271.861087][T10953] ? apparmor_socket_sendmsg+0x15b/0x270 [ 271.861112][T10953] ____sys_sendmsg+0xa4d/0xbe0 [ 271.861130][T10953] ? __pfx_netlink_sendmsg+0x10/0x10 [ 271.861152][T10953] ? __pfx_____sys_sendmsg+0x10/0x10 [ 271.861181][T10953] ___sys_sendmsg+0x190/0x1e0 [ 271.861202][T10953] ? __pfx____sys_sendmsg+0x10/0x10 [ 271.861233][T10953] ? find_held_lock+0x2b/0x80 [ 271.861270][T10953] __sys_sendmsg+0x160/0x210 [ 271.861295][T10953] ? __pfx___sys_sendmsg+0x10/0x10 [ 271.861327][T10953] ? __pfx_ksys_write+0x10/0x10 [ 271.861348][T10953] __do_fast_syscall_32+0xe7/0x970 [ 271.861373][T10953] ? lockdep_hardirqs_on+0x78/0x100 [ 271.861397][T10953] do_fast_syscall_32+0x32/0x70 [ 271.861421][T10953] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 271.861444][T10953] RIP: 0023:0xf70befec [ 271.861463][T10953] Code: Unable to access opcode bytes at 0xf70befc2. [ 271.861471][T10953] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 271.861488][T10953] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000180 [ 271.861499][T10953] RDX: 000000000600c800 RSI: 0000000000000000 RDI: 0000000000000000 [ 271.861508][T10953] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 271.861518][T10953] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 271.861529][T10953] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 271.861549][T10953] [ 271.988947][T10955] trusted_key: encrypted_key: keylen parameter is missing [ 272.312803][T10966] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 272.544570][T10970] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 272.751278][ T29] usb 9-1: USB disconnect, device number 32 [ 272.998998][ T5101] Bluetooth: hci2: unexpected event for opcode 0x202d [ 274.015687][ T5101] Bluetooth: hci0: unexpected event for opcode 0x202d [ 274.159873][ T5827] usb 9-1: new high-speed USB device number 33 using dummy_hcd [ 274.315405][ T5827] usb 9-1: config index 0 descriptor too short (expected 45, got 36) [ 274.318458][ T5827] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 274.322561][ T5827] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 274.326401][ T5827] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 274.330977][ T5827] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 274.334317][ T5827] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 274.342636][ T5827] usb 9-1: config 0 descriptor?? [ 275.165180][T10996] trusted_key: encrypted_key: keylen parameter is missing [ 275.476271][T11000] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1700'. [ 276.849638][ T5827] usbhid 9-1:0.0: can't add hid device: -71 [ 276.852106][ T5827] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 276.860135][ T5827] usb 9-1: USB disconnect, device number 33 [ 277.204011][T11018] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 277.531187][T11022] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1705'. [ 277.830067][ T5101] Bluetooth: hci0: unexpected event for opcode 0x202d [ 277.948920][T11033] trusted_key: encrypted_key: keylen parameter is missing [ 279.766944][ T5101] Bluetooth: hci3: unexpected event for opcode 0x202d [ 279.775691][T11049] netlink: 'syz.2.1713': attribute type 1 has an invalid length. [ 279.920679][T11049] 8021q: adding VLAN 0 to HW filter on device bond8 [ 280.136801][T11058] netlink: 'syz.2.1714': attribute type 1 has an invalid length. [ 280.171218][T11058] 8021q: adding VLAN 0 to HW filter on device bond9 [ 281.164994][T11073] trusted_key: encrypted_key: keylen parameter is missing [ 281.510009][ T5827] usb 9-1: new high-speed USB device number 34 using dummy_hcd [ 281.570686][T11088] netlink: 'syz.1.1722': attribute type 1 has an invalid length. [ 281.594470][T11088] 8021q: adding VLAN 0 to HW filter on device bond6 [ 281.608635][T11088] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1722'. [ 282.307101][T11097] netlink: 'syz.1.1726': attribute type 1 has an invalid length. [ 282.334692][T11097] 8021q: adding VLAN 0 to HW filter on device bond7 [ 282.391288][T11097] macvlan2: entered promiscuous mode [ 282.393681][T11097] macvlan2: entered allmulticast mode [ 282.416084][T11097] bond7: (slave ip6gretap1): making interface the new active one [ 282.419517][T11097] bond7: (slave ip6gretap1): Enslaving as an active interface with an up link [ 282.460243][ T5827] usb 9-1: device descriptor read/64, error -71 [ 282.620409][T11107] trusted_key: encrypted_key: keylen parameter is missing [ 282.710836][ T5827] usb 9-1: new high-speed USB device number 35 using dummy_hcd [ 282.850113][ T5827] usb 9-1: device descriptor read/64, error -71 [ 282.879792][ T29] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 282.963735][ T5827] usb usb9-port1: attempt power cycle [ 283.033465][ T29] usb 6-1: config index 0 descriptor too short (expected 45, got 36) [ 283.036381][ T29] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 283.040139][ T29] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 283.043418][ T29] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 283.047799][ T29] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 283.051255][ T29] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.055710][ T29] usb 6-1: config 0 descriptor?? [ 283.251087][T11113] netlink: 'syz.2.1731': attribute type 1 has an invalid length. [ 283.298128][T11113] 8021q: adding VLAN 0 to HW filter on device bond10 [ 283.313611][T11113] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1731'. [ 283.329796][ T5827] usb 9-1: new high-speed USB device number 36 using dummy_hcd [ 283.353054][ T5827] usb 9-1: device descriptor read/8, error -71 [ 283.609960][ T5827] usb 9-1: new high-speed USB device number 37 using dummy_hcd [ 283.631768][ T5827] usb 9-1: device descriptor read/8, error -71 [ 283.741483][ T5827] usb usb9-port1: unable to enumerate USB device [ 284.399837][ T41] usb 8-1: new high-speed USB device number 45 using dummy_hcd [ 284.549861][ T41] usb 8-1: Using ep0 maxpacket: 32 [ 284.555533][ T41] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 284.560660][ T41] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 284.569993][ T41] usb 8-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 284.574073][ T41] usb 8-1: New USB device strings: Mfr=229, Product=129, SerialNumber=131 [ 284.576788][ T41] usb 8-1: Product: syz [ 284.578584][ T41] usb 8-1: Manufacturer: syz [ 284.581068][ T41] usb 8-1: SerialNumber: syz [ 284.593368][ T41] input: appletouch as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:1.0/input/input23 [ 284.809835][ T5827] usb 7-1: new full-speed USB device number 42 using dummy_hcd [ 284.961716][ T5827] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 284.966294][ T5827] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 284.971465][ T5827] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 284.980473][ T5827] usb 7-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 284.984222][ T5827] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.986819][ T5827] usb 7-1: Product: syz [ 284.988148][ T5827] usb 7-1: Manufacturer: syz [ 284.989652][ T5827] usb 7-1: SerialNumber: syz [ 284.994177][ T5827] usb 7-1: config 0 descriptor?? [ 284.996578][T11130] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 285.039923][ T5827] rc_core: IR keymap rc-streamzap not found [ 285.041938][T11135] overlayfs: conflicting options: userxattr,redirect_dir=on [ 285.046172][ T5827] Registered IR keymap rc-empty [ 285.048580][ T5827] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0 [ 285.057255][ T5827] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0/input24 [ 285.602573][ T29] usbhid 6-1:0.0: can't add hid device: -71 [ 285.606345][ T29] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 285.610094][ T29] usb 6-1: USB disconnect, device number 22 [ 285.635921][T11139] netlink: 'syz.4.1737': attribute type 10 has an invalid length. [ 285.638486][T11139] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 285.665768][T11141] netlink: 'syz.4.1739': attribute type 1 has an invalid length. [ 285.668285][T11141] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1739'. [ 285.714228][T11145] trusted_key: encrypted_key: keylen parameter is missing [ 285.863072][T11153] tipc: Failed to remove unknown binding: 66,0,0/4:206534383/206534385 [ 285.875604][T11153] tipc: Failed to remove unknown binding: 66,0,0/4:206534383/206534384 [ 285.884341][T11153] tipc: Failed to remove unknown binding: 66,0,0/4:206534383/206534385 [ 285.902829][T11153] tipc: Failed to remove unknown binding: 66,0,0/4:206534383/206534384 [ 285.981424][T11154] blktrace: Concurrent blktraces are not allowed on sg0 [ 286.344743][ T29] usb 9-1: new low-speed USB device number 38 using dummy_hcd [ 286.493755][ T29] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 286.496710][ T29] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 286.501426][ T29] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 286.505256][ T29] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 286.508956][ T29] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 286.516567][ T29] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 286.519402][ T29] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 286.523640][ T29] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 286.527328][ T29] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 286.531783][ T29] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 286.563432][ T29] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 286.566672][ T29] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 286.599807][ T29] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 286.632580][ T29] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 286.636202][ T29] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 286.642246][ T29] usb 9-1: string descriptor 0 read error: -22 [ 286.644459][ T29] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 286.647341][ T29] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 286.658604][ T29] adutux 9-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 287.288333][ T41] usb 8-1: USB disconnect, device number 45 [ 287.345057][ T41] appletouch 8-1:1.0: input: appletouch disconnected [ 287.460385][ T5851] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 287.547957][ T6027] usb 7-1: USB disconnect, device number 42 [ 287.624417][ T5851] usb 6-1: config index 0 descriptor too short (expected 45, got 36) [ 287.627946][ T5851] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 287.635627][ T5851] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 287.639849][ T5851] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 287.645121][ T5851] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 287.648878][ T5851] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 287.653455][ T5851] usb 6-1: config 0 descriptor?? [ 287.809782][ T41] usb 8-1: new low-speed USB device number 46 using dummy_hcd [ 287.971650][ T41] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 287.976717][ T41] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 287.981497][ T41] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 287.986408][ T41] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 287.990868][ T41] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 287.995420][ T41] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 287.998206][ T41] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 288.002299][ T41] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 288.006312][ T41] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 288.009939][ T41] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 288.015286][ T41] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 288.017970][ T41] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 288.023780][ T41] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 288.027529][ T41] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 288.031230][ T41] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 288.037362][ T41] usb 8-1: string descriptor 0 read error: -22 [ 288.039451][ T41] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 288.042375][ T41] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 288.066283][ T41] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux1 [ 289.255619][T11173] trusted_key: encrypted_key: keylen parameter is missing [ 289.303330][T11175] netlink: 'syz.2.1750': attribute type 10 has an invalid length. [ 289.306672][T11175] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 289.355443][ T10] usb 9-1: USB disconnect, device number 38 [ 289.381392][T11179] netlink: 'syz.2.1752': attribute type 1 has an invalid length. [ 289.383980][T11179] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1752'. [ 289.553267][ T5851] usbhid 6-1:0.0: can't add hid device: -71 [ 289.555225][ T5851] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 289.566221][ T5851] usb 6-1: USB disconnect, device number 23 [ 289.949891][ T5827] usb 9-1: new low-speed USB device number 39 using dummy_hcd [ 290.084814][ T5101] Bluetooth: hci1: unexpected event for opcode 0x202d [ 290.115877][ T5827] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 290.121235][ T5827] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 290.125963][ T5827] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 290.131394][ T5827] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 290.137037][ T5827] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 290.143135][ T5827] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 290.146120][ T5827] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 290.150728][ T5827] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 290.155617][ T5827] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 290.160386][ T5827] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 290.166292][ T5827] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 290.169441][ T5827] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 290.173972][ T5827] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 290.178769][ T5827] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 290.183870][ T5827] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 290.191781][ T5827] usb 9-1: string descriptor 0 read error: -22 [ 290.194510][ T5827] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 290.198204][ T5827] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.211430][ T5827] adutux 9-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 290.732111][ T5827] usb 9-1: USB disconnect, device number 39 [ 291.082792][ T60] usb 8-1: USB disconnect, device number 46 [ 291.182479][ T5101] Bluetooth: hci3: unexpected event for opcode 0x202d [ 291.232463][T11200] trusted_key: encrypted_key: keylen parameter is missing [ 291.574584][T11204] netlink: 'syz.4.1760': attribute type 10 has an invalid length. [ 291.578028][T11204] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 291.773893][ T5101] Bluetooth: hci2: unexpected event for opcode 0x202d [ 292.089883][ T41] usb 6-1: new low-speed USB device number 24 using dummy_hcd [ 292.102562][T11216] syzkaller1: entered promiscuous mode [ 292.104788][T11216] syzkaller1: entered allmulticast mode [ 292.240364][T11219] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1765'. [ 292.247833][T11219] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1765'. [ 292.308229][T11219] netlink: 27 bytes leftover after parsing attributes in process `syz.3.1765'. [ 292.352015][ T41] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 292.430677][T11224] syzkaller1: entered promiscuous mode [ 292.432462][T11224] syzkaller1: entered allmulticast mode [ 292.870135][ T41] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 292.999447][ T41] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 293.006221][ T41] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 293.009871][ T41] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 293.025274][ T41] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 293.032377][ T41] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 293.035826][ T41] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 293.040179][ T41] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 293.043866][ T41] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 293.048476][ T41] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 293.050925][ T41] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 293.054281][ T41] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 293.057908][ T41] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 293.061891][ T41] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 293.068081][ T41] usb 6-1: string descriptor 0 read error: -22 [ 293.070140][ T41] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 293.072975][ T41] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 293.080660][ T41] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 293.317812][ T5827] usb 6-1: USB disconnect, device number 24 [ 293.496259][T11233] netlink: 'syz.3.1769': attribute type 10 has an invalid length. [ 293.498777][T11233] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 293.546717][T11235] trusted_key: encrypted_key: keylen parameter is missing [ 294.020010][ T10] usb 9-1: new full-speed USB device number 40 using dummy_hcd [ 294.303035][ T10] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 294.306987][ T10] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 294.310690][ T10] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 294.316588][ T10] usb 9-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 294.319848][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.322546][ T10] usb 9-1: Product: syz [ 294.323979][ T10] usb 9-1: Manufacturer: syz [ 294.325644][ T10] usb 9-1: SerialNumber: syz [ 294.329492][ T10] usb 9-1: config 0 descriptor?? [ 294.332390][T11245] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 294.381754][ T10] rc_core: IR keymap rc-streamzap not found [ 294.383915][ T10] Registered IR keymap rc-empty [ 294.391238][ T10] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 294.401112][ T10] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input25 [ 294.699894][ T60] usb 7-1: new full-speed USB device number 43 using dummy_hcd [ 294.856905][ T60] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 294.861683][ T60] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 294.894991][ T60] usb 7-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 294.899354][ T60] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.903319][ T60] usb 7-1: Product: syz [ 294.908331][ T60] usb 7-1: Manufacturer: syz [ 294.912373][ T60] usb 7-1: SerialNumber: syz [ 294.930449][ T60] usb 7-1: config 0 descriptor?? [ 294.948477][ T60] hub 7-1:0.0: bad descriptor, ignoring hub [ 294.953165][ T60] hub 7-1:0.0: probe with driver hub failed with error -5 [ 295.191623][T11266] trusted_key: encrypted_key: keylen parameter is missing [ 295.248773][ T60] input: syz syz as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/input/input26 [ 295.300614][T11270] netlink: 'syz.1.1781': attribute type 1 has an invalid length. [ 295.421534][ T60] usb 7-1: USB disconnect, device number 43 [ 295.433765][T11270] 8021q: adding VLAN 0 to HW filter on device bond8 [ 295.511280][T11275] macvlan3: entered promiscuous mode [ 295.515208][T11275] macvlan3: entered allmulticast mode [ 295.888709][ T5101] Bluetooth: hci0: unexpected event for opcode 0x202d [ 296.729870][ T61] usb 6-1: new low-speed USB device number 25 using dummy_hcd [ 296.838652][ T10] usb 9-1: USB disconnect, device number 40 [ 296.891906][ T61] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 296.896789][ T61] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 296.906468][ T61] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 296.915692][ T61] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 296.925616][ T61] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 296.943410][ T61] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 296.949888][ T61] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 296.960388][ T61] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 296.978303][ T61] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 296.984496][ T61] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 296.998331][ T61] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 297.003334][ T61] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 297.018582][ T61] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 297.029591][ T61] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 297.036373][ T61] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 297.044367][ T61] usb 6-1: string descriptor 0 read error: -22 [ 297.046452][ T61] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 297.049426][ T61] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.072960][ T61] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 297.090893][ T5101] Bluetooth: hci2: unexpected event for opcode 0x202d [ 297.260762][T11297] trusted_key: encrypted_key: keylen parameter is missing [ 297.283296][ T61] usb 6-1: USB disconnect, device number 25 [ 298.094405][T11306] netlink: 'syz.4.1792': attribute type 1 has an invalid length. [ 298.202428][T11306] 8021q: adding VLAN 0 to HW filter on device bond9 [ 298.218322][ T5101] Bluetooth: hci1: unexpected event for opcode 0x202d [ 298.223259][T11308] macvlan2: entered promiscuous mode [ 298.230269][T11308] macvlan2: entered allmulticast mode [ 298.368504][T11306] bond9: (slave ip6gretap1): making interface the new active one [ 298.372745][T11306] bond9: (slave ip6gretap1): Enslaving as an active interface with an up link [ 298.479839][ T6027] usb 8-1: new full-speed USB device number 47 using dummy_hcd [ 298.642387][ T6027] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 298.647406][ T6027] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 298.658847][ T6027] usb 8-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 298.663070][ T6027] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.666433][ T6027] usb 8-1: Product: syz [ 298.668262][ T6027] usb 8-1: Manufacturer: syz [ 298.670555][ T6027] usb 8-1: SerialNumber: syz [ 298.674938][ T6027] usb 8-1: config 0 descriptor?? [ 298.680128][ T6027] hub 8-1:0.0: bad descriptor, ignoring hub [ 298.682743][ T6027] hub 8-1:0.0: probe with driver hub failed with error -5 [ 298.688102][ T6027] input: syz syz as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/input/input27 [ 299.000048][T11331] trusted_key: encrypted_key: keylen parameter is missing [ 299.003676][ T6027] usb 8-1: USB disconnect, device number 47 [ 299.097405][T11335] netlink: 'syz.2.1801': attribute type 1 has an invalid length. [ 299.102258][T11335] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1801'. [ 299.109829][ T61] usb 9-1: new high-speed USB device number 41 using dummy_hcd [ 299.272790][ T61] usb 9-1: config index 0 descriptor too short (expected 45, got 36) [ 299.275696][ T61] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 299.278980][ T61] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 299.282224][ T61] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 299.286153][ T61] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 299.288892][ T61] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 299.295015][ T61] usb 9-1: config 0 descriptor?? [ 299.833877][ T10] usb 6-1: new low-speed USB device number 26 using dummy_hcd [ 300.000727][ T10] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 300.005357][ T10] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 300.009448][ T10] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 300.014591][ T10] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 300.022358][ T10] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 300.031169][ T10] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 300.035314][ T10] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 300.039361][ T10] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 300.045039][ T10] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 300.049918][ T10] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 300.064030][ T10] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 300.075029][ T10] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 300.087846][ T10] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 300.102887][ T10] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 300.108666][ T10] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 300.136750][ T10] usb 6-1: string descriptor 0 read error: -22 [ 300.141771][ T10] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 300.145651][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 300.286519][ T10] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 300.374419][T11355] netlink: 'syz.2.1805': attribute type 1 has an invalid length. [ 300.572782][T11355] 8021q: adding VLAN 0 to HW filter on device bond11 [ 300.593855][ T10] usb 6-1: USB disconnect, device number 26 [ 300.641558][T11355] macvlan2: entered promiscuous mode [ 300.651294][T11355] macvlan2: entered allmulticast mode [ 300.823195][T11355] bond11: (slave ip6gretap1): making interface the new active one [ 300.839289][T11355] bond11: (slave ip6gretap1): Enslaving as an active interface with an up link [ 300.873134][T11360] netlink: 'syz.3.1806': attribute type 1 has an invalid length. [ 300.875735][T11360] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1806'. [ 301.130377][ T5101] Bluetooth: hci3: unexpected event for opcode 0x202d [ 301.238269][T11364] trusted_key: encrypted_key: keylen parameter is missing [ 301.545585][T11369] netlink: 'syz.2.1810': attribute type 1 has an invalid length. [ 301.548816][T11369] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1810'. [ 301.747802][T11373] netlink: 'syz.1.1811': attribute type 1 has an invalid length. [ 301.839765][ T61] usbhid 9-1:0.0: can't add hid device: -71 [ 301.839982][T11373] 8021q: adding VLAN 0 to HW filter on device bond9 [ 301.841721][ T61] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 301.849613][ T61] usb 9-1: USB disconnect, device number 41 [ 302.040036][ T60] usb 7-1: new full-speed USB device number 44 using dummy_hcd [ 302.192681][ T60] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 302.196454][ T60] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 302.204179][ T60] usb 7-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 302.207349][ T60] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 302.210047][ T60] usb 7-1: Product: syz [ 302.212608][ T60] usb 7-1: Manufacturer: syz [ 302.214557][ T60] usb 7-1: SerialNumber: syz [ 302.249819][ T6027] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 302.276179][ T60] usb 7-1: config 0 descriptor?? [ 302.284571][ T60] hub 7-1:0.0: bad descriptor, ignoring hub [ 302.289286][ T60] hub 7-1:0.0: probe with driver hub failed with error -5 [ 302.295469][ T60] input: syz syz as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/input/input28 [ 302.326186][ T5101] Bluetooth: hci3: unexpected event for opcode 0x202d [ 302.378285][T11391] netlink: 'syz.4.1816': attribute type 21 has an invalid length. [ 302.380989][ T6027] usb 6-1: device descriptor read/64, error -71 [ 302.640093][ T6027] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 302.779947][ T6027] usb 6-1: device descriptor read/64, error -71 [ 302.901827][ T6027] usb usb6-port1: attempt power cycle [ 302.909494][T11399] trusted_key: encrypted_key: keylen parameter is missing [ 303.001048][ T5101] Bluetooth: hci2: unexpected event for opcode 0x202d [ 303.164763][T11407] netlink: 'syz.3.1821': attribute type 1 has an invalid length. [ 303.167244][T11407] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1821'. [ 303.262698][ T6027] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 303.281768][ T6027] usb 6-1: device descriptor read/8, error -71 [ 303.449897][ T61] usb 9-1: new high-speed USB device number 42 using dummy_hcd [ 303.519956][ T6027] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 303.540346][ T6027] usb 6-1: device descriptor read/8, error -71 [ 303.601822][ T61] usb 9-1: config index 0 descriptor too short (expected 45, got 36) [ 303.605192][ T61] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 303.609481][ T61] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 303.613509][ T61] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 303.617997][ T61] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 303.621445][ T61] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 303.629402][ T61] usb 9-1: config 0 descriptor?? [ 303.652090][ T6027] usb usb6-port1: unable to enumerate USB device [ 305.403387][T11430] trusted_key: encrypted_key: keylen parameter is missing [ 305.636952][ T5101] Bluetooth: hci0: unexpected event for opcode 0x202d [ 305.650233][ T60] usb 8-1: new high-speed USB device number 48 using dummy_hcd [ 305.800881][T11439] netlink: 'syz.2.1832': attribute type 1 has an invalid length. [ 305.806251][T11439] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1832'. [ 305.826118][ T60] usb 8-1: config index 0 descriptor too short (expected 45, got 36) [ 305.828954][ T60] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 305.833963][ T60] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 305.839453][ T60] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 305.860204][ T60] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 305.865997][ T60] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.880594][ T60] usb 8-1: config 0 descriptor?? [ 306.187248][ T41] usb 7-1: USB disconnect, device number 44 [ 306.342190][ T61] usbhid 9-1:0.0: can't add hid device: -71 [ 306.344154][ T61] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 306.349532][ T61] usb 9-1: USB disconnect, device number 42 [ 307.008349][T11451] bond10: entered allmulticast mode [ 307.639748][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 307.754503][T11458] Invalid source name [ 307.757580][T11458] UBIFS error (pid: 11458): cannot open "./file0", error -22 [ 308.069062][T11454] bond0: (slave veth0_to_bond): Releasing backup interface [ 308.092518][T11454] bond0: (slave bond_slave_0): Releasing backup interface [ 308.095147][ T60] usbhid 8-1:0.0: can't add hid device: -71 [ 308.097073][ T60] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 308.108443][ T60] usb 8-1: USB disconnect, device number 48 [ 308.114485][T11454] bond0: (slave c@0Ù): Releasing backup interface [ 308.128364][T11454] team0: Port device team_slave_0 removed [ 308.135178][T11454] team0: Port device team_slave_1 removed [ 308.139615][T11454] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 308.146618][T11454] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 308.151194][T11454] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 308.160713][T11454] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 308.164294][T11454] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 308.228850][ T5101] Bluetooth: hci0: unexpected event for opcode 0x202d [ 308.477126][T11472] netlink: 'syz.4.1841': attribute type 1 has an invalid length. [ 308.479847][T11472] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1841'. [ 309.620126][T11494] binder: 11493:11494 ioctl 4014f50b 80000000 returned -22 [ 309.622958][T11494] binder: 11493:11494 unknown command 0 [ 309.625100][T11494] binder: 11493:11494 ioctl c0306201 80000580 returned -22 [ 309.682970][T11500] netlink: 'syz.3.1850': attribute type 1 has an invalid length. [ 309.685886][T11500] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1850'. [ 309.929802][ T60] usb 6-1: new full-speed USB device number 31 using dummy_hcd [ 310.081964][ T60] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 310.085216][ T60] usb 6-1: config 0 has an invalid descriptor of length 159, skipping remainder of the config [ 310.089322][ T60] usb 6-1: config 0 has no interface number 0 [ 310.095201][ T60] usb 6-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 310.102617][ T60] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 310.106528][ T60] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 310.110847][ T60] usb 6-1: Product: syz [ 310.112737][ T60] usb 6-1: SerialNumber: syz [ 310.117090][ T60] usb 6-1: config 0 descriptor?? [ 310.122767][ T60] usbhid 6-1:0.8: couldn't find an input interrupt endpoint [ 310.767831][T11518] FAULT_INJECTION: forcing a failure. [ 310.767831][T11518] name failslab, interval 1, probability 0, space 0, times 0 [ 310.773676][T11518] CPU: 1 UID: 0 PID: 11518 Comm: syz.4.1855 Tainted: G L syzkaller #0 PREEMPT(full) [ 310.773720][T11518] Tainted: [L]=SOFTLOCKUP [ 310.773725][T11518] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 310.773734][T11518] Call Trace: [ 310.773741][T11518] [ 310.773747][T11518] dump_stack_lvl+0x100/0x190 [ 310.773771][T11518] should_fail_ex.cold+0x5/0xa [ 310.773791][T11518] should_failslab+0xc2/0x120 [ 310.773813][T11518] __kmalloc_cache_noprof+0x91/0x6c0 [ 310.773845][T11518] ? lockdep_init_map_type+0x5c/0x250 [ 310.773864][T11518] ? rfcomm_dev_ioctl+0xaa4/0x1db0 [ 310.773903][T11518] rfcomm_dev_ioctl+0xaa4/0x1db0 [ 310.773920][T11518] ? bt_sock_ioctl+0x1df/0x580 [ 310.773947][T11518] ? __pfx_bt_sock_ioctl+0x10/0x10 [ 310.773965][T11518] ? __pfx_rfcomm_dev_ioctl+0x10/0x10 [ 310.773984][T11518] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 310.774009][T11518] ? do_vfs_ioctl+0x226/0x13e0 [ 310.774034][T11518] rfcomm_sock_ioctl+0xcc/0xf0 [ 310.774059][T11518] ? __pfx_rfcomm_sock_compat_ioctl+0x10/0x10 [ 310.774082][T11518] compat_sock_ioctl+0x179/0x760 [ 310.774106][T11518] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 310.774124][T11518] ? hook_file_ioctl_common+0x140/0x440 [ 310.774149][T11518] ? __fget_files+0x21f/0x3d0 [ 310.774171][T11518] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 310.774189][T11518] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 310.774232][T11518] __do_fast_syscall_32+0xe7/0x970 [ 310.774252][T11518] ? lockdep_hardirqs_on+0x78/0x100 [ 310.774281][T11518] do_fast_syscall_32+0x32/0x70 [ 310.774302][T11518] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 310.774323][T11518] RIP: 0023:0xf7fc5fec [ 310.774342][T11518] Code: Unable to access opcode bytes at 0xf7fc5fc2. [ 310.774349][T11518] RSP: 002b:00000000f546550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 310.774363][T11518] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 00000000400452c8 [ 310.774373][T11518] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 310.774384][T11518] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 310.774393][T11518] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 310.774403][T11518] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 310.774420][T11518] [ 310.963210][ T5101] Bluetooth: hci0: unexpected event for opcode 0x202d [ 311.923038][T11512] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 311.942619][T11512] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 311.950441][T11512] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 311.957455][T11513] xt_hashlimit: size too large, truncated to 1048576 [ 311.963265][T11512] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 311.968825][T11513] xt_hashlimit: max too large, truncated to 1048576 [ 312.184247][T11536] syzkaller1: entered promiscuous mode [ 312.184264][T11536] syzkaller1: entered allmulticast mode [ 313.030925][ T5101] Bluetooth: hci0: command 0x0406 tx timeout [ 313.180254][ T5948] usb 6-1: USB disconnect, device number 31 [ 313.263534][T11545] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1860'. [ 313.307756][ T5101] Bluetooth: hci0: unexpected event for opcode 0x202d [ 313.365015][T11557] netlink: 'syz.1.1865': attribute type 1 has an invalid length. [ 313.383768][T11557] 8021q: adding VLAN 0 to HW filter on device bond10 [ 313.402964][T11557] macvlan4: entered promiscuous mode [ 313.404744][T11557] macvlan4: entered allmulticast mode [ 313.991855][ T5751] Bluetooth: hci3: command 0x0406 tx timeout [ 313.994039][ T5753] Bluetooth: hci1: command 0x0406 tx timeout [ 314.000550][ T5101] Bluetooth: hci2: command 0x0405 tx timeout [ 314.309829][ T5851] usb 9-1: new high-speed USB device number 43 using dummy_hcd [ 314.403524][T11569] FAULT_INJECTION: forcing a failure. [ 314.403524][T11569] name failslab, interval 1, probability 0, space 0, times 0 [ 314.420495][T11569] CPU: 1 UID: 0 PID: 11569 Comm: syz.1.1868 Tainted: G L syzkaller #0 PREEMPT(full) [ 314.420528][T11569] Tainted: [L]=SOFTLOCKUP [ 314.420535][T11569] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 314.420545][T11569] Call Trace: [ 314.420552][T11569] [ 314.420560][T11569] dump_stack_lvl+0x100/0x190 [ 314.420586][T11569] should_fail_ex.cold+0x5/0xa [ 314.420609][T11569] should_failslab+0xc2/0x120 [ 314.420636][T11569] __kmalloc_node_noprof+0x101/0x830 [ 314.420657][T11569] ? __get_vm_area_node+0x1dc/0x330 [ 314.420682][T11569] ? __get_vm_area_node+0x208/0x330 [ 314.420703][T11569] ? __vmalloc_node_range_noprof+0x409/0x1630 [ 314.420730][T11569] __vmalloc_node_range_noprof+0x409/0x1630 [ 314.420760][T11569] ? vhost_task_create+0x1db/0x370 [ 314.420787][T11569] ? __memcg_slab_post_alloc_hook+0x749/0x1160 [ 314.420812][T11569] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 314.420841][T11569] ? trace_kmem_cache_alloc+0xdd/0x100 [ 314.420872][T11569] ? vhost_task_create+0x1db/0x370 [ 314.420893][T11569] __vmalloc_node_noprof+0xad/0xf0 [ 314.420915][T11569] ? vhost_task_create+0x1db/0x370 [ 314.420938][T11569] copy_process+0x7fb/0x8030 [ 314.420969][T11569] ? __pfx_copy_process+0x10/0x10 [ 314.420987][T11569] ? __kasan_kmalloc+0xaa/0xb0 [ 314.421007][T11569] ? lockdep_init_map_type+0x5c/0x250 [ 314.421024][T11569] ? lockdep_init_map_type+0x5c/0x250 [ 314.421039][T11569] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 314.421065][T11569] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 314.421089][T11569] vhost_task_create+0x1db/0x370 [ 314.421110][T11569] ? __pfx_vhost_task_create+0x10/0x10 [ 314.421137][T11569] ? __pfx_vhost_task_fn+0x10/0x10 [ 314.421160][T11569] ? __pfx___mutex_lock+0x10/0x10 [ 314.421186][T11569] kvm_mmu_post_init_vm+0x1b3/0x360 [ 314.421208][T11569] kvm_arch_vcpu_ioctl_run+0x66/0x1960 [ 314.421228][T11569] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 314.421247][T11569] kvm_vcpu_ioctl+0x730/0x1700 [ 314.421268][T11569] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 314.421284][T11569] ? tomoyo_path_number_perm+0x188/0x580 [ 314.421305][T11569] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 314.421325][T11569] ? get_pid_task+0x106/0x250 [ 314.421349][T11569] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 314.421372][T11569] ? do_vfs_ioctl+0x226/0x13e0 [ 314.421393][T11569] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 314.421422][T11569] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 314.421438][T11569] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 314.421454][T11569] ? __fget_files+0x21f/0x3d0 [ 314.421472][T11569] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 314.421488][T11569] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 314.421512][T11569] __do_fast_syscall_32+0xe7/0x970 [ 314.421532][T11569] ? lockdep_hardirqs_on+0x78/0x100 [ 314.421552][T11569] do_fast_syscall_32+0x32/0x70 [ 314.421573][T11569] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 314.421609][T11569] RIP: 0023:0xf70befec [ 314.421627][T11569] Code: Unable to access opcode bytes at 0xf70befc2. [ 314.421634][T11569] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 314.421650][T11569] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000000ae80 [ 314.421659][T11569] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 314.421668][T11569] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 314.421676][T11569] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 314.421684][T11569] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 314.421703][T11569] [ 314.421712][T11569] syz.1.1868: vmalloc error: size 32768, failed to allocated page array size 64, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null) [ 314.464634][T11573] FAULT_INJECTION: forcing a failure. [ 314.464634][T11573] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 314.465790][T11569] ,cpuset= [ 314.467049][T11573] CPU: 3 UID: 0 PID: 11573 Comm: syz.2.1869 Tainted: G L syzkaller #0 PREEMPT(full) [ 314.467067][T11573] Tainted: [L]=SOFTLOCKUP [ 314.467071][T11573] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 314.467078][T11573] Call Trace: [ 314.467082][T11573] [ 314.467087][T11573] dump_stack_lvl+0x100/0x190 [ 314.467104][T11573] should_fail_ex.cold+0x5/0xa [ 314.467117][T11573] _copy_to_user+0x32/0xd0 [ 314.467136][T11573] simple_read_from_buffer+0xcb/0x170 [ 314.467156][T11573] proc_fail_nth_read+0x1af/0x230 [ 314.467185][T11573] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 314.467201][T11573] ? rw_verify_area+0xce/0x6d0 [ 314.467217][T11573] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 314.467232][T11573] vfs_read+0x1e4/0xb40 [ 314.467244][T11573] ? __pfx_vfs_read+0x10/0x10 [ 314.467254][T11573] ? find_held_lock+0x2b/0x80 [ 314.467268][T11573] ? __fget_files+0x215/0x3d0 [ 314.467281][T11573] ? __fget_files+0x21f/0x3d0 [ 314.467295][T11573] ksys_read+0x12a/0x250 [ 314.467304][T11573] ? __pfx_ksys_read+0x10/0x10 [ 314.467318][T11573] do_int80_emulation+0x14b/0x720 [ 314.467336][T11573] asm_int80_emulation+0x1a/0x20 [ 314.467347][T11573] RIP: 0023:0xf71073eb [ 314.467357][T11573] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 314.467368][T11573] RSP: 002b:00000000f53bd4bc EFLAGS: 00000246 [ 314.467365][T11575] syzkaller1: entered promiscuous mode [ 314.467374][T11573] ORIG_RAX: 0000000000000003 [ 314.467379][T11573] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53bd5d0 [ 314.467386][T11573] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 314.467392][T11573] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 314.467398][T11573] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 314.467404][T11573] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 314.467417][T11573] [ 314.468715][T11569] / [ 314.470959][T11575] syzkaller1: entered allmulticast mode [ 314.475111][T11569] ,mems_allowed=0-1 [ 314.482896][ T5851] usb 9-1: config index 0 descriptor too short (expected 45, got 36) [ 314.484196][T11569] [ 314.486033][ T5851] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 314.488180][T11569] CPU: 2 UID: 0 PID: 11569 Comm: syz.1.1868 Tainted: G L syzkaller #0 PREEMPT(full) [ 314.488198][T11569] Tainted: [L]=SOFTLOCKUP [ 314.488202][T11569] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 314.488208][T11569] Call Trace: [ 314.488213][T11569] [ 314.488217][T11569] dump_stack_lvl+0x100/0x190 [ 314.488235][T11569] warn_alloc.cold+0x94/0xa8 [ 314.488247][T11569] ? __pfx_warn_alloc+0x10/0x10 [ 314.488259][T11569] ? dump_stack_lvl+0x17c/0x190 [ 314.488271][T11569] ? rcu_is_watching+0x12/0xc0 [ 314.488285][T11569] ? __kasan_kmalloc+0x8a/0xb0 [ 314.488300][T11569] ? __kmalloc_node_noprof+0x357/0x830 [ 314.488314][T11569] ? __get_vm_area_node+0x1dc/0x330 [ 314.488329][T11569] ? __get_vm_area_node+0x208/0x330 [ 314.488344][T11569] ? __vmalloc_node_range_noprof+0x409/0x1630 [ 314.488364][T11569] __vmalloc_node_range_noprof+0x1394/0x1630 [ 314.488385][T11569] ? vhost_task_create+0x1db/0x370 [ 314.488405][T11569] ? __memcg_slab_post_alloc_hook+0x749/0x1160 [ 314.488423][T11569] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 314.488449][T11569] ? trace_kmem_cache_alloc+0xdd/0x100 [ 314.488467][T11569] ? vhost_task_create+0x1db/0x370 [ 314.488483][T11569] __vmalloc_node_noprof+0xad/0xf0 [ 314.488499][T11569] ? vhost_task_create+0x1db/0x370 [ 314.488517][T11569] copy_process+0x7fb/0x8030 [ 314.488538][T11569] ? __pfx_copy_process+0x10/0x10 [ 314.488551][T11569] ? __kasan_kmalloc+0xaa/0xb0 [ 314.488566][T11569] ? lockdep_init_map_type+0x5c/0x250 [ 314.488577][T11569] ? lockdep_init_map_type+0x5c/0x250 [ 314.488588][T11569] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 314.488608][T11569] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 314.488626][T11569] vhost_task_create+0x1db/0x370 [ 314.488643][T11569] ? __pfx_vhost_task_create+0x10/0x10 [ 314.488663][T11569] ? __pfx_vhost_task_fn+0x10/0x10 [ 314.488681][T11569] ? __pfx___mutex_lock+0x10/0x10 [ 314.488700][T11569] kvm_mmu_post_init_vm+0x1b3/0x360 [ 314.488716][T11569] kvm_arch_vcpu_ioctl_run+0x66/0x1960 [ 314.488731][T11569] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 314.488745][T11569] kvm_vcpu_ioctl+0x730/0x1700 [ 314.488757][T11569] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 314.488769][T11569] ? tomoyo_path_number_perm+0x188/0x580 [ 314.488785][T11569] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 314.488800][T11569] ? get_pid_task+0x106/0x250 [ 314.488817][T11569] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 314.488834][T11569] ? do_vfs_ioctl+0x226/0x13e0 [ 314.488851][T11569] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 314.488872][T11569] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 314.488884][T11569] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 314.488896][T11569] ? __fget_files+0x21f/0x3d0 [ 314.488909][T11569] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 314.488921][T11569] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 314.488939][T11569] __do_fast_syscall_32+0xe7/0x970 [ 314.488955][T11569] ? lockdep_hardirqs_on+0x78/0x100 [ 314.488970][T11569] do_fast_syscall_32+0x32/0x70 [ 314.488986][T11569] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 314.489000][T11569] RIP: 0023:0xf70befec [ 314.489014][T11569] Code: Unable to access opcode bytes at 0xf70befc2. [ 314.489019][T11569] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 314.489029][T11569] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000000ae80 [ 314.489036][T11569] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 314.489043][T11569] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 314.489049][T11569] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 314.489055][T11569] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 314.489069][T11569] [ 314.489073][T11569] Mem-Info: [ 314.490262][ T5851] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 314.494992][T11569] active_anon:5723 inactive_anon:963 isolated_anon:0 [ 314.494992][T11569] active_file:4427 inactive_file:28603 isolated_file:0 [ 314.494992][T11569] unevictable:1788 dirty:360 writeback:0 [ 314.494992][T11569] slab_reclaimable:6684 slab_unreclaimable:58788 [ 314.494992][T11569] mapped:24476 shmem:2252 pagetables:1294 [ 314.494992][T11569] sec_pagetables:301 bounce:0 [ 314.494992][T11569] kernel_misc_reclaimable:0 [ 314.494992][T11569] free:40398 free_pcp:16162 free_cma:0 [ 314.500580][ T5851] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 314.501298][T11569] Node 0 active_anon:4kB inactive_anon:48kB active_file:260kB inactive_file:16kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:40kB dirty:12kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8768kB pagetables:1164kB sec_pagetables:1112kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 314.503204][ T5851] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 314.505016][T11569] Node 1 active_anon:22888kB inactive_anon:3804kB active_file:17448kB inactive_file:114396kB unevictable:5616kB isolated(anon):0kB isolated(file):0kB mapped:97864kB dirty:1428kB writeback:0kB shmem:7472kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:6268kB pagetables:4012kB sec_pagetables:92kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 314.507333][ T5851] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.508750][T11569] Node 0 DMA free:2020kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:252kB local_pcp:76kB free_cma:0kB [ 314.508787][T11569] lowmem_reserve[]: 0 280 280 280 280 [ 314.508810][T11569] Node 0 DMA32 free:17732kB boost:2048kB min:14820kB low:18012kB high:21204kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4kB inactive_anon:48kB active_file:260kB inactive_file:16kB unevictable:1536kB writepending:12kB zspages:0kB present:1032196kB managed:286888kB mlocked:0kB bounce:0kB free_pcp:13400kB local_pcp:3852kB free_cma:0kB [ 314.514561][ T5851] usb 9-1: config 0 descriptor?? [ 314.516328][T11569] lowmem_reserve[]: 0 0 0 0 0 [ 314.516355][T11569] Node 1 DMA32 free:141592kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22888kB inactive_anon:3804kB active_file:17448kB inactive_file:114396kB unevictable:5616kB writepending:1428kB zspages:1820kB present:1048432kB managed:948212kB mlocked:80kB bounce:0kB free_pcp:50900kB local_pcp:8864kB free_cma:0kB [ 314.847183][T11569] lowmem_reserve[]: 0 0 0 0 0 [ 314.848872][T11569] Node 0 DMA: 1*4kB (M) 2*8kB (UM) 1*16kB (M) 4*32kB (UM) 1*64kB (M) 0*128kB 1*256kB (M) 1*512kB (M) 1*1024kB (M) 0*2048kB 0*4096kB = 2020kB [ 314.854623][T11569] Node 0 DMA32: 311*4kB (UM) 95*8kB (UME) 37*16kB (UME) 83*32kB (UME) 53*64kB (UME) 17*128kB (UME) 5*256kB (UM) 5*512kB (UM) 3*1024kB (UM) 0*2048kB 0*4096kB = 17732kB [ 314.861904][T11569] Node 1 DMA32: 261*4kB (UM) 486*8kB (UME) 407*16kB (UME) 327*32kB (UME) 235*64kB (UME) 169*128kB (UME) 83*256kB (UME) 18*512kB (UME) 12*1024kB (ME) 11*2048kB (UM) 4*4096kB (UM) = 140244kB [ 314.869127][T11569] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 314.872922][T11569] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 314.875883][T11569] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 314.879763][T11569] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 314.882708][T11569] 35410 total pagecache pages [ 314.884259][T11569] 131 pages in swap cache [ 314.885662][T11569] Free swap = 122244kB [ 314.886986][T11569] Total swap = 124996kB [ 314.888342][T11569] 524155 pages RAM [ 314.889547][T11569] 0 pages HighMem/MovableOnly [ 314.891135][T11569] 211540 pages reserved [ 314.892411][T11569] 0 pages cma reserved [ 315.648285][T11589] netlink: 'syz.3.1874': attribute type 13 has an invalid length. [ 315.764247][T11598] lo speed is unknown, defaulting to 1000 [ 315.767266][T11598] lo speed is unknown, defaulting to 1000 [ 315.770775][T11598] lo speed is unknown, defaulting to 1000 [ 315.773917][T11598] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 315.778826][T11598] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 315.789482][T11598] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 315.799237][T11598] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 315.830029][T11598] lo speed is unknown, defaulting to 1000 [ 315.837158][T11598] lo speed is unknown, defaulting to 1000 [ 315.842015][T11598] lo speed is unknown, defaulting to 1000 [ 315.845151][T11598] lo speed is unknown, defaulting to 1000 [ 316.070081][ T5101] Bluetooth: hci1: command 0x0406 tx timeout [ 316.079892][ T24] usb 7-1: new high-speed USB device number 45 using dummy_hcd [ 316.191970][ T5851] usbhid 9-1:0.0: can't add hid device: -71 [ 316.194073][ T5851] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 316.198049][ T5851] usb 9-1: USB disconnect, device number 43 [ 316.229855][ T24] usb 7-1: Using ep0 maxpacket: 16 [ 316.237049][ T24] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 316.250164][ T24] usb 7-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 316.253794][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.257319][ T24] usb 7-1: Product: syz [ 316.259068][ T24] usb 7-1: Manufacturer: syz [ 316.261680][ T24] usb 7-1: SerialNumber: syz [ 316.266271][ T24] usb 7-1: config 0 descriptor?? [ 316.274831][ T24] hub 7-1:0.0: bad descriptor, ignoring hub [ 316.281490][ T24] hub 7-1:0.0: probe with driver hub failed with error -5 [ 316.291050][ T24] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 316.293031][T11604] netlink: 'syz.4.1878': attribute type 1 has an invalid length. [ 316.331218][T11604] 8021q: adding VLAN 0 to HW filter on device bond11 [ 316.353393][T11592] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 316.356550][T11592] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 316.367101][T11592] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 316.369681][T11592] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 316.373386][T11604] macvlan3: entered promiscuous mode [ 316.373401][T11604] macvlan3: entered allmulticast mode [ 316.384897][T11592] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 316.386753][T11592] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 316.393229][T11592] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 316.395410][T11592] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 316.476814][T11608] netlink: 'syz.4.1879': attribute type 1 has an invalid length. [ 316.480262][T11608] netlink: 'syz.4.1879': attribute type 4 has an invalid length. [ 316.483009][T11608] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.1879'. [ 316.550786][ T29] usb 7-1: USB disconnect, device number 45 [ 316.641868][ T1442] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.709906][T11618] netlink: 177 bytes leftover after parsing attributes in process `syz.1.1883'. [ 316.716271][T11614] syzkaller1: entered promiscuous mode [ 316.728475][T11614] syzkaller1: entered allmulticast mode [ 316.873561][T11627] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 316.875666][T11627] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 316.878488][T11627] vhci_hcd vhci_hcd.0: Device attached [ 316.885012][T11627] netlink: 'syz.3.1880': attribute type 5 has an invalid length. [ 316.887582][T11627] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1880'. [ 317.020737][ T24] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 317.149804][ T60] usb 44-1: SetAddress Request (6) to port 0 [ 317.151816][ T60] usb 44-1: new SuperSpeed USB device number 6 using vhci_hcd [ 317.172287][ T24] usb 6-1: config index 0 descriptor too short (expected 45, got 36) [ 317.179925][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 317.185618][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 317.199800][ T24] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 317.204037][ T24] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 317.207040][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.217921][ T24] usb 6-1: config 0 descriptor?? [ 317.347513][T11628] vhci_hcd: connection reset by peer [ 317.349609][T10402] vhci_hcd vhci_hcd.3: stop threads [ 317.351556][T10402] vhci_hcd vhci_hcd.3: release socket [ 317.353339][T10402] vhci_hcd vhci_hcd.3: disconnect device [ 317.606258][T11640] netlink: 'syz.4.1888': attribute type 1 has an invalid length. [ 317.609882][ T61] usb 7-1: new low-speed USB device number 46 using dummy_hcd [ 317.627203][T11640] 8021q: adding VLAN 0 to HW filter on device bond12 [ 317.653259][T11640] macvlan4: entered promiscuous mode [ 317.655112][T11640] macvlan4: entered allmulticast mode [ 317.781354][ T61] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 317.788367][ T61] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 317.794272][ T61] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 317.809390][ T61] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 317.814038][ T24] usbhid 6-1:0.0: can't add hid device: -71 [ 317.816131][ T24] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 317.818625][ T61] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 317.827635][ T61] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 317.830682][ T24] usb 6-1: USB disconnect, device number 32 [ 317.834925][ T61] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 317.844276][ T61] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 317.848644][ T61] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 317.854491][ T61] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 317.858878][ T61] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 317.861456][ T61] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 317.864909][ T61] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 317.868546][ T61] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 317.872901][ T61] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 317.878789][ T61] usb 7-1: string descriptor 0 read error: -22 [ 317.881150][ T61] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 317.883978][ T61] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.895991][ T61] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 318.017389][T11647] netlink: 'syz.3.1890': attribute type 1 has an invalid length. [ 318.020440][T11647] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1890'. [ 318.119650][ T41] usb 7-1: USB disconnect, device number 46 [ 318.173288][T11653] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 318.847656][T11665] syzkaller1: entered promiscuous mode [ 318.849484][T11665] syzkaller1: entered allmulticast mode [ 318.856336][T11667] trusted_key: encrypted_key: keylen parameter is missing [ 318.926440][T11670] netlink: 'syz.4.1899': attribute type 1 has an invalid length. [ 318.931671][T11670] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1899'. [ 319.288010][T11673] syzkaller0: entered promiscuous mode [ 319.290357][T11673] syzkaller0: entered allmulticast mode [ 320.627826][T11694] trusted_key: encrypted_key: keylen parameter is missing [ 320.662214][T11696] netlink: 'syz.2.1907': attribute type 1 has an invalid length. [ 320.723812][T11696] 8021q: adding VLAN 0 to HW filter on device bond12 [ 320.737353][T11696] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1907'. [ 320.826522][T11708] smpboot: CPU 1 is now offline [ 320.829066][T11711] xt_hashlimit: max too large, truncated to 1048576 [ 320.836785][T11711] xt_hashlimit: max too large, truncated to 1048576 [ 320.855663][T11711] xt_hashlimit: max too large, truncated to 1048576 [ 320.866080][T11711] xt_hashlimit: max too large, truncated to 1048576 [ 320.882628][T11711] xt_hashlimit: max too large, truncated to 1048576 [ 320.893572][T11711] xt_hashlimit: max too large, truncated to 1048576 [ 320.915297][T11711] xt_hashlimit: max too large, truncated to 1048576 [ 320.936769][T11711] xt_hashlimit: max too large, truncated to 1048576 [ 320.945617][T11711] xt_hashlimit: max too large, truncated to 1048576 [ 320.951424][T11711] xt_hashlimit: max too large, truncated to 1048576 [ 320.964835][T11714] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 321.010491][ T10] usb 8-1: new full-speed USB device number 49 using dummy_hcd [ 321.054676][T11720] syzkaller1: entered promiscuous mode [ 321.057867][T11720] syzkaller1: entered allmulticast mode [ 321.182772][ T10] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 321.187478][ T10] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 321.194021][ T10] usb 8-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 321.197601][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.200731][ T10] usb 8-1: Product: syz [ 321.202258][ T10] usb 8-1: Manufacturer: syz [ 321.204116][ T10] usb 8-1: SerialNumber: syz [ 321.207388][ T10] usb 8-1: config 0 descriptor?? [ 321.213938][ T10] hub 8-1:0.0: bad descriptor, ignoring hub [ 321.216077][ T10] hub 8-1:0.0: probe with driver hub failed with error -5 [ 321.221043][ T10] input: syz syz as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/input/input29 [ 321.540627][ T10] usb 8-1: USB disconnect, device number 49 [ 321.757026][T11751] tipc: Enabling of bearer rejected, failed to enable media [ 321.928630][T11757] binder: BINDER_SET_CONTEXT_MGR already set [ 321.934936][T11757] binder: 11756:11757 ioctl 4018620d 80004a80 returned -16 [ 322.104600][T11761] netlink: 'syz.3.1916': attribute type 10 has an invalid length. [ 322.640387][ T60] usb 44-1: device descriptor read/8, error -110 [ 322.649098][T11761] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 322.656959][T11761] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 322.668860][T11762] FAULT_INJECTION: forcing a failure. [ 322.668860][T11762] name failslab, interval 1, probability 0, space 0, times 0 [ 322.674588][T11762] CPU: 3 UID: 0 PID: 11762 Comm: syz.3.1916 Tainted: G L syzkaller #0 PREEMPT(full) [ 322.674607][T11762] Tainted: [L]=SOFTLOCKUP [ 322.674611][T11762] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 322.674619][T11762] Call Trace: [ 322.674624][T11762] [ 322.674628][T11762] dump_stack_lvl+0x100/0x190 [ 322.674645][T11762] should_fail_ex.cold+0x5/0xa [ 322.674658][T11762] should_failslab+0xc2/0x120 [ 322.674675][T11762] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 322.674691][T11762] ? __alloc_skb+0x140/0x710 [ 322.674708][T11762] __alloc_skb+0x140/0x710 [ 322.674722][T11762] ? __alloc_skb+0x5b7/0x710 [ 322.674741][T11762] ? __pfx___alloc_skb+0x10/0x10 [ 322.674757][T11762] ? __fib6_drop_pcpu_from.part.0+0x1e4/0x480 [ 322.674785][T11762] inet6_rt_notify+0x1d2/0x4c0 [ 322.674798][T11762] fib6_del+0xf7a/0x1790 [ 322.674815][T11762] ? __pfx_fib6_del+0x10/0x10 [ 322.674828][T11762] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 322.674846][T11762] ? fib6_ifdown+0xcd/0x7e0 [ 322.674865][T11762] fib6_clean_node+0x424/0x5d0 [ 322.674880][T11762] ? __pfx_fib6_clean_node+0x10/0x10 [ 322.674898][T11762] fib6_walk_continue+0x451/0x8d0 [ 322.674912][T11762] fib6_walk+0x182/0x370 [ 322.674924][T11762] fib6_clean_tree+0xdc/0x120 [ 322.674935][T11762] ? __pfx_fib6_ifdown+0x10/0x10 [ 322.674952][T11762] ? __pfx_fib6_clean_tree+0x10/0x10 [ 322.674966][T11762] ? __pfx_fib6_clean_node+0x10/0x10 [ 322.674979][T11762] ? __pfx_fib6_ifdown+0x10/0x10 [ 322.674999][T11762] ? __pfx_fib6_ifdown+0x10/0x10 [ 322.675016][T11762] __fib6_clean_all+0x107/0x2d0 [ 322.675031][T11762] rt6_disable_ip+0x2a6/0x980 [ 322.675052][T11762] ? __pfx_rt6_disable_ip+0x10/0x10 [ 322.675073][T11762] addrconf_ifdown.isra.0+0x11d/0x1b70 [ 322.675087][T11762] ? trace_contention_end+0x126/0x160 [ 322.675099][T11762] ? __mutex_lock+0x26d/0x1bd0 [ 322.675114][T11762] ? tee_netdev_event+0x8a/0x3d0 [ 322.675124][T11762] ? find_held_lock+0x2b/0x80 [ 322.675137][T11762] ? tee_netdev_event+0x300/0x3d0 [ 322.675148][T11762] ? __pfx_addrconf_ifdown.isra.0+0x10/0x10 [ 322.675167][T11762] addrconf_notify+0x4a3/0x1ba0 [ 322.675185][T11762] ? __pfx_tls_dev_event+0x10/0x10 [ 322.675209][T11762] ? __pfx_addrconf_notify+0x10/0x10 [ 322.675225][T11762] ? ip6mr_device_event+0x1c4/0x230 [ 322.675252][T11762] notifier_call_chain+0x99/0x3f0 [ 322.675270][T11762] call_netdevice_notifiers_info+0xbe/0x110 [ 322.675283][T11762] netif_close_many+0x319/0x630 [ 322.675295][T11762] ? mark_held_locks+0x40/0x70 [ 322.675312][T11762] ? __pfx_netif_close_many+0x10/0x10 [ 322.675324][T11762] ? netif_close_many_and_unlock+0x1af/0x270 [ 322.675338][T11762] unregister_netdevice_many_notify+0x840/0x2140 [ 322.675359][T11762] ? __pfx___nla_validate_parse+0x10/0x10 [ 322.675374][T11762] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 322.675392][T11762] ? unregister_netdevice_queue+0x22e/0x3c0 [ 322.675409][T11762] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 322.675446][T11762] rtnl_dellink+0x472/0xb40 [ 322.675463][T11762] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 322.675480][T11762] ? kasan_save_track+0x14/0x30 [ 322.675493][T11762] ? kasan_save_free_info+0x3b/0x70 [ 322.675521][T11762] ? __kasan_slab_free+0x5f/0x80 [ 322.675538][T11762] ? __pfx_rtnl_dellink+0x10/0x10 [ 322.675555][T11762] ? nlmon_xmit+0xa5/0xe0 [ 322.675587][T11762] ? dev_hard_start_xmit+0x121/0x760 [ 322.675607][T11762] ? __dev_queue_xmit+0x1bbf/0x4970 [ 322.675628][T11762] ? netlink_sendmsg+0x8b0/0xda0 [ 322.675649][T11762] ? ____sys_sendmsg+0xa4d/0xbe0 [ 322.675709][T11762] ? __lock_acquire+0x49f/0x1a40 [ 322.675729][T11762] ? find_held_lock+0x2b/0x80 [ 322.675752][T11762] ? find_held_lock+0x2b/0x80 [ 322.675764][T11762] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 322.675781][T11762] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 322.675799][T11762] ? __pfx_rtnl_dellink+0x10/0x10 [ 322.675815][T11762] rtnetlink_rcv_msg+0x95e/0xe90 [ 322.675833][T11762] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 322.675853][T11762] ? ref_tracker_free+0x37e/0x6c0 [ 322.675866][T11762] netlink_rcv_skb+0x159/0x420 [ 322.675879][T11762] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 322.675897][T11762] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 322.675914][T11762] ? netlink_deliver_tap+0x1ae/0xcc0 [ 322.675928][T11762] netlink_unicast+0x585/0x850 [ 322.675943][T11762] ? __pfx_netlink_unicast+0x10/0x10 [ 322.675959][T11762] netlink_sendmsg+0x8b0/0xda0 [ 322.675973][T11762] ? __pfx_netlink_sendmsg+0x10/0x10 [ 322.675988][T11762] ? apparmor_socket_sendmsg+0x15b/0x270 [ 322.676003][T11762] ____sys_sendmsg+0xa4d/0xbe0 [ 322.676013][T11762] ? __pfx_netlink_sendmsg+0x10/0x10 [ 322.676027][T11762] ? __pfx_____sys_sendmsg+0x10/0x10 [ 322.676044][T11762] ___sys_sendmsg+0x190/0x1e0 [ 322.676057][T11762] ? __pfx____sys_sendmsg+0x10/0x10 [ 322.676076][T11762] ? find_held_lock+0x2b/0x80 [ 322.676098][T11762] __sys_sendmsg+0x160/0x210 [ 322.676115][T11762] ? __pfx___sys_sendmsg+0x10/0x10 [ 322.676134][T11762] ? __pfx_ksys_write+0x10/0x10 [ 322.676148][T11762] __do_fast_syscall_32+0xe7/0x970 [ 322.676164][T11762] ? lockdep_hardirqs_on+0x78/0x100 [ 322.676179][T11762] do_fast_syscall_32+0x32/0x70 [ 322.676195][T11762] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 322.676209][T11762] RIP: 0023:0xf7f84fec [ 322.676224][T11762] Code: Unable to access opcode bytes at 0xf7f84fc2. [ 322.676229][T11762] RSP: 002b:00000000f542550c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 322.676243][T11762] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080000080 [ 322.676250][T11762] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 322.676256][T11762] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 322.676262][T11762] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 322.676268][T11762] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 322.676281][T11762] [ 322.931920][T11762] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 322.941979][T11766] netlink: 'syz.1.1918': attribute type 1 has an invalid length. [ 322.945165][T11762] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 322.961262][T11762] bond0 (unregistering): (slave veth0_to_bond): Releasing backup interface [ 322.965846][T11762] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 322.979326][T11762] bond0 (unregistering): Released all slaves [ 323.034798][T11766] 8021q: adding VLAN 0 to HW filter on device bond11 [ 323.049063][T11766] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1918'. [ 323.092788][ T60] usb usb44-port1: attempt power cycle [ 323.187660][ T38] Bluetooth: hci4: Frame reassembly failed (-84) [ 324.239591][ T60] usb usb44-port1: unable to enumerate USB device [ 325.194527][ T5101] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 325.973307][T11810] netlink: 'syz.2.1930': attribute type 1 has an invalid length. [ 325.986625][T11810] 8021q: adding VLAN 0 to HW filter on device bond13 [ 326.045666][T11815] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1930'. [ 328.208174][T11845] trusted_key: encrypted_key: keylen parameter is missing [ 328.402931][T11855] netlink: 'syz.3.1941': attribute type 1 has an invalid length. [ 328.421186][T11855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 328.481407][T11858] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1941'. [ 328.539965][ T61] usb 9-1: new full-speed USB device number 44 using dummy_hcd [ 328.712893][ T61] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 328.722646][ T61] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 328.738526][ T61] usb 9-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 328.748853][ T61] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 328.757121][ T61] usb 9-1: Product: syz [ 328.758621][ T61] usb 9-1: Manufacturer: syz [ 328.760387][ T61] usb 9-1: SerialNumber: syz [ 328.771893][ T61] usb 9-1: config 0 descriptor?? [ 328.774964][ T61] hub 9-1:0.0: bad descriptor, ignoring hub [ 328.776949][ T61] hub 9-1:0.0: probe with driver hub failed with error -5 [ 328.786228][ T61] input: syz syz as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/input/input30 [ 329.534050][T11874] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1946'. [ 329.916450][T11880] trusted_key: encrypted_key: keylen parameter is missing [ 330.065545][T11886] FAULT_INJECTION: forcing a failure. [ 330.065545][T11886] name failslab, interval 1, probability 0, space 0, times 0 [ 330.071369][T11886] CPU: 2 UID: 0 PID: 11886 Comm: syz.4.1950 Tainted: G L syzkaller #0 PREEMPT(full) [ 330.071399][T11886] Tainted: [L]=SOFTLOCKUP [ 330.071405][T11886] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 330.071414][T11886] Call Trace: [ 330.071421][T11886] [ 330.071427][T11886] dump_stack_lvl+0x100/0x190 [ 330.071454][T11886] should_fail_ex.cold+0x5/0xa [ 330.071508][T11886] should_failslab+0xc2/0x120 [ 330.071533][T11886] __kmalloc_noprof+0xfc/0x820 [ 330.071553][T11886] ? tomoyo_encode2+0xfb/0x3c0 [ 330.071583][T11886] tomoyo_encode2+0xfb/0x3c0 [ 330.071612][T11886] tomoyo_encode+0x29/0x50 [ 330.071636][T11886] tomoyo_realpath_from_path+0x18c/0x690 [ 330.071666][T11886] tomoyo_check_open_permission+0x2af/0x3c0 [ 330.071690][T11886] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 330.071717][T11886] ? hook_file_open+0x24f/0x8f0 [ 330.071753][T11886] ? path_get+0x61/0x80 [ 330.071773][T11886] tomoyo_file_open+0x6b/0x90 [ 330.071790][T11886] security_file_open+0xb5/0x1e0 [ 330.071816][T11886] do_dentry_open+0x588/0x14d0 [ 330.071840][T11886] vfs_open+0x82/0x3f0 [ 330.071866][T11886] path_openat+0x2873/0x4280 [ 330.071896][T11886] ? __pfx_path_openat+0x10/0x10 [ 330.071922][T11886] do_file_open+0x20e/0x430 [ 330.071939][T11886] ? __lock_acquire+0x49f/0x1a40 [ 330.071968][T11886] ? __pfx_do_file_open+0x10/0x10 [ 330.072004][T11886] ? _raw_spin_unlock+0x28/0x50 [ 330.072025][T11886] ? alloc_fd+0x471/0x7a0 [ 330.072051][T11886] do_sys_openat2+0x10f/0x1e0 [ 330.072074][T11886] ? __pfx_do_sys_openat2+0x10/0x10 [ 330.072099][T11886] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 330.072140][T11886] ? __fget_files+0x21f/0x3d0 [ 330.072164][T11886] __ia32_compat_sys_openat+0x12d/0x210 [ 330.072191][T11886] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 330.072215][T11886] ? ksys_write+0x1ac/0x250 [ 330.072241][T11886] do_int80_emulation+0x14b/0x720 [ 330.072269][T11886] asm_int80_emulation+0x1a/0x20 [ 330.072293][T11886] RIP: 0023:0xf71c73eb [ 330.072309][T11886] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 330.072327][T11886] RSP: 002b:00000000f548603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 330.072345][T11886] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f5486100 [ 330.072356][T11886] RDX: 0000000000002082 RSI: 0000000000000000 RDI: 0000000000000000 [ 330.072367][T11886] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 330.072377][T11886] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 330.072387][T11886] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 330.072411][T11886] [ 330.072464][T11886] ERROR: Out of memory at tomoyo_realpath_from_path. [ 330.109894][ T5948] usb 8-1: new full-speed USB device number 50 using dummy_hcd [ 330.341730][ T5948] usb 8-1: config 0 has an invalid interface number: 205 but max is 0 [ 330.345241][ T5948] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 330.349605][ T5948] usb 8-1: config 0 has no interface number 0 [ 330.353352][ T5948] usb 8-1: config 0 interface 205 has no altsetting 0 [ 330.358749][ T5948] usb 8-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 330.363115][ T5948] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.366579][ T5948] usb 8-1: Product: syz [ 330.368347][ T5948] usb 8-1: Manufacturer: syz [ 330.371867][ T5948] usb 8-1: SerialNumber: syz [ 330.386961][ T5948] usb 8-1: config 0 descriptor?? [ 330.392800][ T5948] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 330.396402][ T5948] dvb-usb: bulk message failed: -22 (3/0) [ 330.401282][T11892] netlink: 'syz.4.1953': attribute type 1 has an invalid length. [ 330.425483][ T5948] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 330.426775][T11892] 8021q: adding VLAN 0 to HW filter on device bond13 [ 330.430087][ T5948] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 330.443420][ T5948] usb 8-1: media controller created [ 330.450683][ T5948] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 330.457303][T11892] macvlan5: entered promiscuous mode [ 330.464427][T11892] macvlan5: entered allmulticast mode [ 330.478504][ T5948] dvb-usb: bulk message failed: -22 (6/0) [ 330.481485][ T5948] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 330.486801][ T5948] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb8/8-1/input/input31 [ 330.493069][ T5948] dvb-usb: schedule remote query interval to 150 msecs. [ 330.495860][ T5948] dvb-usb: bulk message failed: -22 (3/0) [ 330.509808][ T5948] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 330.609112][ T5948] usb 8-1: USB disconnect, device number 50 [ 330.620392][ T5948] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 331.639986][ T5948] usb 8-1: new low-speed USB device number 51 using dummy_hcd [ 331.649862][ T61] usb 7-1: new full-speed USB device number 47 using dummy_hcd [ 331.731903][T11912] trusted_key: encrypted_key: keylen parameter is missing [ 331.793111][ T5948] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 331.795930][ T5948] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 331.799186][ T5948] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 331.803955][ T5948] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 331.808869][ T5948] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 331.812294][ T61] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 331.814085][ T5948] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 331.817184][ T61] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 331.819591][ T5948] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 331.827253][ T5948] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 331.828157][ T61] usb 7-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 331.833429][ T5948] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 331.834983][T11914] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1959'. [ 331.835879][ T61] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 331.840600][ T5948] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 331.843835][ T61] usb 7-1: Product: syz [ 331.843853][ T61] usb 7-1: Manufacturer: syz [ 331.843866][ T61] usb 7-1: SerialNumber: syz [ 331.847683][ T61] usb 7-1: config 0 descriptor?? [ 331.855806][ T5948] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 331.859042][ T61] hub 7-1:0.0: bad descriptor, ignoring hub [ 331.865457][ T61] hub 7-1:0.0: probe with driver hub failed with error -5 [ 331.867948][ T5948] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 331.872426][ T5948] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 331.876226][ T61] input: syz syz as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/input/input32 [ 331.877253][ T5948] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 331.884675][ T5948] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 331.892783][ T5948] usb 8-1: string descriptor 0 read error: -22 [ 331.894838][ T5948] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 331.897693][ T5948] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 331.930172][ T5948] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 331.944527][T11918] fuse: Unknown parameter 'ÿ' [ 332.030854][T11920] netlink: 'syz.4.1962': attribute type 1 has an invalid length. [ 332.043664][T11920] 8021q: adding VLAN 0 to HW filter on device bond14 [ 332.066136][T11920] macvlan6: entered promiscuous mode [ 332.068012][T11920] macvlan6: entered allmulticast mode [ 332.553160][ T3263] usb 9-1: USB disconnect, device number 44 [ 332.770458][ T61] usb 7-1: USB disconnect, device number 47 [ 333.709916][ T61] usb 7-1: new high-speed USB device number 48 using dummy_hcd [ 333.870314][ T61] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 333.875560][ T61] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 333.880173][ T61] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 333.888147][ T61] usb 7-1: config 0 interface 0 has no altsetting 0 [ 333.893857][ T61] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 333.898305][ T61] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 333.906865][ T61] usb 7-1: config 0 interface 0 has no altsetting 0 [ 333.912645][ T61] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 333.916969][ T61] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 333.925475][ T61] usb 7-1: config 0 interface 0 has no altsetting 0 [ 333.928613][ T61] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 333.931362][ T61] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 333.934656][ T61] usb 7-1: config 0 interface 0 has no altsetting 0 [ 333.937571][ T61] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 333.940441][ T61] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 333.944160][ T61] usb 7-1: config 0 interface 0 has no altsetting 0 [ 333.948057][ T61] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 333.951416][ T61] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 333.954891][ T61] usb 7-1: config 0 interface 0 has no altsetting 0 [ 333.957863][ T61] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 333.960631][ T61] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 333.964834][ T61] usb 7-1: config 0 interface 0 has no altsetting 0 [ 333.968850][ T61] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 333.972605][ T61] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 333.977091][ T61] usb 7-1: config 0 interface 0 has no altsetting 0 [ 333.982587][ T61] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 333.986417][ T61] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 333.990119][ T61] usb 7-1: Product: syz [ 333.991887][ T61] usb 7-1: Manufacturer: syz [ 333.993861][ T61] usb 7-1: SerialNumber: syz [ 333.998520][ T61] usb 7-1: config 0 descriptor?? [ 334.005832][ T61] yurex 7-1:0.0: USB YUREX device now attached to Yurex #1 [ 334.191076][ T10] usb 8-1: USB disconnect, device number 51 [ 334.208977][ T3263] usb 7-1: USB disconnect, device number 48 [ 334.229466][ T3263] yurex 7-1:0.0: USB YUREX #1 now disconnected [ 334.306944][T11952] netlink: 'syz.1.1971': attribute type 1 has an invalid length. [ 334.328096][T11952] 8021q: adding VLAN 0 to HW filter on device bond12 [ 334.347353][T11952] macvlan5: entered promiscuous mode [ 334.349981][T11952] macvlan5: entered allmulticast mode [ 334.752556][T11970] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 334.755673][T11970] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 334.758751][T11970] ================================================================== [ 334.761655][T11970] BUG: KASAN: slab-out-of-bounds in dummy_free_request+0x8a/0x90 [ 334.764307][T11970] Read of size 8 at addr ffff88802a59e1f0 by task syz.2.1969/11970 [ 334.768356][T11970] [ 334.769996][T11970] CPU: 3 UID: 0 PID: 11970 Comm: syz.2.1969 Tainted: G L syzkaller #0 PREEMPT(full) [ 334.770029][T11970] Tainted: [L]=SOFTLOCKUP [ 334.770037][T11970] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 334.770051][T11970] Call Trace: [ 334.770060][T11970] [ 334.770069][T11970] dump_stack_lvl+0x100/0x190 [ 334.770096][T11970] print_report+0x13d/0x4b0 [ 334.770128][T11970] ? __virt_addr_valid+0x239/0x430 [ 334.770152][T11970] ? dummy_free_request+0x8a/0x90 [ 334.770172][T11970] kasan_report+0xdf/0x1c0 [ 334.770200][T11970] ? dummy_free_request+0x8a/0x90 [ 334.770222][T11970] dummy_free_request+0x8a/0x90 [ 334.770242][T11970] uvc_function_bind+0x181a/0x1939 [ 334.770267][T11970] ? __pfx_uvc_function_bind+0x10/0x10 [ 334.770286][T11970] usb_add_function+0x219/0x890 [ 334.770314][T11970] configfs_composite_bind+0xd83/0x1960 [ 334.770341][T11970] ? kernfs_create_link+0x1bd/0x240 [ 334.770386][T11970] gadget_bind_driver+0x28c/0xbf0 [ 334.770409][T11970] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 334.770439][T11970] ? __pfx_gadget_bind_driver+0x10/0x10 [ 334.770459][T11970] really_probe+0x241/0xa60 [ 334.770495][T11970] __driver_probe_device+0x20e/0x450 [ 334.770520][T11970] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 334.770552][T11970] driver_probe_device+0x4a/0x140 [ 334.770578][T11970] __driver_attach+0x21f/0x5b0 [ 334.770602][T11970] ? __pfx___driver_attach+0x10/0x10 [ 334.770626][T11970] bus_for_each_dev+0x13e/0x1d0 [ 334.770644][T11970] ? __pfx_bus_for_each_dev+0x10/0x10 [ 334.770663][T11970] ? bus_add_driver+0x2b5/0x5b0 [ 334.770682][T11970] bus_add_driver+0x305/0x5b0 [ 334.770696][T11970] driver_register+0x1e2/0x360 [ 334.770713][T11970] usb_gadget_register_driver_owner+0x132/0x210 [ 334.770727][T11970] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 334.770746][T11970] configfs_write_iter+0x302/0x4e0 [ 334.770765][T11970] vfs_write+0x6ac/0x1050 [ 334.770784][T11970] ? __pfx_configfs_write_iter+0x10/0x10 [ 334.770802][T11970] ? __pfx_vfs_write+0x10/0x10 [ 334.770821][T11970] ? find_held_lock+0x2b/0x80 [ 334.770862][T11970] ksys_write+0x12a/0x250 [ 334.770880][T11970] ? __pfx_ksys_write+0x10/0x10 [ 334.770904][T11970] __do_fast_syscall_32+0xe7/0x970 [ 334.770938][T11970] do_fast_syscall_32+0x32/0x70 [ 334.770954][T11970] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 334.770970][T11970] RIP: 0023:0xf6fcefec [ 334.770986][T11970] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 334.770992][T11970] RSP: 002b:00000000f537b50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 334.771005][T11970] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000280 [ 334.771014][T11970] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 334.771021][T11970] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 334.771027][T11970] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 334.771034][T11970] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 334.771043][T11970] [ 334.771047][T11970] [ 334.877524][T11970] Allocated by task 11318: [ 334.879368][T11970] kasan_save_stack+0x30/0x50 [ 334.880879][T11970] kasan_save_track+0x14/0x30 [ 334.882353][T11970] __kasan_kmalloc+0xaa/0xb0 [ 334.884150][T11970] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 334.886234][T11970] kernfs_fop_open+0x9fa/0xd50 [ 334.887768][T11970] do_dentry_open+0x6ab/0x14d0 [ 334.889320][T11970] vfs_open+0x82/0x3f0 [ 334.890602][T11970] path_openat+0x2873/0x4280 [ 334.892059][T11970] do_file_open+0x20e/0x430 [ 334.893597][T11970] do_sys_openat2+0x10f/0x1e0 [ 334.895225][T11970] __x64_sys_openat+0x12d/0x210 [ 334.896756][T11970] do_syscall_64+0x115/0x840 [ 334.898278][T11970] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.900122][T11970] [ 334.900885][T11970] Freed by task 5152: [ 334.902128][T11970] kasan_save_stack+0x30/0x50 [ 334.903869][T11970] kasan_save_track+0x14/0x30 [ 334.905476][T11970] kasan_save_free_info+0x3b/0x70 [ 334.907080][T11970] __kasan_slab_free+0x5f/0x80 [ 334.908648][T11970] __rcu_free_sheaf_prepare+0x5d/0x2f0 [ 334.910344][T11970] rcu_free_sheaf+0x1a/0xe0 [ 334.911767][T11970] rcu_core+0x5a2/0x10d0 [ 334.913182][T11970] handle_softirqs+0x1ea/0x9b0 [ 334.914674][T11970] __irq_exit_rcu+0x162/0x210 [ 334.916328][T11970] irq_exit_rcu+0x9/0x30 [ 334.917662][T11970] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 334.919485][T11970] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 334.921351][T11970] [ 334.922113][T11970] The buggy address belongs to the object at ffff88802a59e100 [ 334.922113][T11970] which belongs to the cache kmalloc-128 of size 128 [ 334.927434][T11970] The buggy address is located 112 bytes to the right of [ 334.927434][T11970] allocated 128-byte region [ffff88802a59e100, ffff88802a59e180) [ 334.932733][T11970] [ 334.933744][T11970] The buggy address belongs to the physical page: [ 334.936393][T11970] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802a59ed00 pfn:0x2a59e [ 334.940527][T11970] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 334.943820][T11970] page_type: f5(slab) [ 334.945499][T11970] raw: 00fff00000000200 ffff88801bc42a00 ffffea0000a7e9d0 ffffea0000940110 [ 334.948878][T11970] raw: ffff88802a59ed00 000000080010000c 00000000f5000000 0000000000000000 [ 334.952315][T11970] page dumped because: kasan: bad access detected [ 334.954949][T11970] page_owner tracks the page as allocated [ 334.957320][T11970] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5740, tgid 5740 (syz-executor), ts 50446841016, free_ts 50081105305 [ 334.965484][T11970] post_alloc_hook+0xfd/0x120 [ 334.967478][T11970] get_page_from_freelist+0xf48/0x3530 [ 334.969745][T11970] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 334.972175][T11970] new_slab+0xa2/0x640 [ 334.973729][T11970] refill_objects+0xe3/0x410 [ 334.975280][T11970] __pcs_replace_empty_main+0x376/0x680 [ 334.977067][T11970] __kmalloc_cache_noprof+0x479/0x6c0 [ 334.978772][T11970] __hw_addr_create+0x57/0x220 [ 334.980299][T11970] __hw_addr_add_ex+0x32b/0x650 [ 334.981826][T11970] dev_mc_add+0xb6/0x110 [ 334.983409][T11970] igmp_group_added+0x83a/0x9a0 [ 334.985424][T11970] ____ip_mc_inc_group+0x7e3/0x10d0 [ 334.987413][T11970] ip_mc_up+0x154/0x390 [ 334.988860][T11970] inetdev_event+0x6c3/0x17f0 [ 334.990309][T11970] notifier_call_chain+0x99/0x3f0 [ 334.991919][T11970] call_netdevice_notifiers_info+0xbe/0x110 [ 334.994120][T11970] page last free pid 23 tgid 23 stack trace: [ 334.996074][T11970] __free_frozen_pages+0x79f/0x1090 [ 334.997749][T11970] tlb_remove_table_rcu+0x2cf/0x380 [ 334.999471][T11970] rcu_core+0x5a2/0x10d0 [ 335.000826][T11970] handle_softirqs+0x1ea/0x9b0 [ 335.002322][T11970] run_ksoftirqd+0x38/0x60 [ 335.003896][T11970] smpboot_thread_fn+0x3d3/0xaa0 [ 335.005455][T11970] kthread+0x370/0x450 [ 335.006678][T11970] ret_from_fork+0x72b/0xd50 [ 335.008178][T11970] ret_from_fork_asm+0x1a/0x30 [ 335.009764][T11970] [ 335.010494][T11970] Memory state around the buggy address: [ 335.012212][T11970] ffff88802a59e080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 335.015195][T11970] ffff88802a59e100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 335.017816][T11970] >ffff88802a59e180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 335.020282][T11970] ^ [ 335.022658][T11970] ffff88802a59e200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 335.025276][T11970] ffff88802a59e280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 335.027794][T11970] ================================================================== [ 335.329670][T11972] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 335.357620][T11956] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 335.360885][ T10] usb 8-1: new high-speed USB device number 52 using dummy_hcd [ 335.371796][T11956] e1000e 0000:00:02.0 eth1: left promiscuous mode [ 335.404941][T11970] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 335.407199][T11970] CPU: 0 UID: 0 PID: 11970 Comm: syz.2.1969 Tainted: G L syzkaller #0 PREEMPT(full) [ 335.410679][T11970] Tainted: [L]=SOFTLOCKUP [ 335.412064][T11970] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 335.415060][T11970] Call Trace: [ 335.416142][T11970] [ 335.417099][T11970] dump_stack_lvl+0x100/0x190 [ 335.418638][T11970] vpanic+0x552/0x970 [ 335.419924][T11970] ? __pfx_vpanic+0x10/0x10 [ 335.421377][T11970] ? mark_held_locks+0x40/0x70 [ 335.422905][T11970] ? dummy_free_request+0x8a/0x90 [ 335.424514][T11970] panic+0xd1/0xe0 [ 335.425715][T11970] ? __pfx_panic+0x10/0x10 [ 335.427138][T11970] ? dummy_free_request+0x8a/0x90 [ 335.428767][T11970] ? preempt_schedule_common+0x42/0xc0 [ 335.430496][T11970] check_panic_on_warn.cold+0x19/0x34 [ 335.432202][T11970] end_report.part.0+0x3a/0x90 [ 335.433735][T11970] kasan_report.cold+0xe/0x18 [ 335.435238][T11970] ? dummy_free_request+0x8a/0x90 [ 335.436867][T11970] dummy_free_request+0x8a/0x90 [ 335.438432][T11970] uvc_function_bind+0x181a/0x1939 [ 335.440067][T11970] ? __pfx_uvc_function_bind+0x10/0x10 [ 335.441796][T11970] usb_add_function+0x219/0x890 [ 335.443353][T11970] configfs_composite_bind+0xd83/0x1960 [ 335.445050][T11970] ? kernfs_create_link+0x1bd/0x240 [ 335.446657][T11970] gadget_bind_driver+0x28c/0xbf0 [ 335.448275][T11970] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 335.450051][T11970] ? __pfx_gadget_bind_driver+0x10/0x10 [ 335.451806][T11970] really_probe+0x241/0xa60 [ 335.453266][T11970] __driver_probe_device+0x20e/0x450 [ 335.454942][T11970] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 335.456826][T11970] driver_probe_device+0x4a/0x140 [ 335.458450][T11970] __driver_attach+0x21f/0x5b0 [ 335.459980][T11970] ? __pfx___driver_attach+0x10/0x10 [ 335.461653][T11970] bus_for_each_dev+0x13e/0x1d0 [ 335.463193][T11970] ? __pfx_bus_for_each_dev+0x10/0x10 [ 335.464908][T11970] ? bus_add_driver+0x2b5/0x5b0 [ 335.466458][T11970] bus_add_driver+0x305/0x5b0 [ 335.467970][T11970] driver_register+0x1e2/0x360 [ 335.469459][T11970] usb_gadget_register_driver_owner+0x132/0x210 [ 335.471426][T11970] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 335.473205][T11970] configfs_write_iter+0x302/0x4e0 [ 335.474753][T11970] vfs_write+0x6ac/0x1050 [ 335.476046][T11970] ? __pfx_configfs_write_iter+0x10/0x10 [ 335.477696][T11970] ? __pfx_vfs_write+0x10/0x10 [ 335.479248][T11970] ? find_held_lock+0x2b/0x80 [ 335.480769][T11970] ksys_write+0x12a/0x250 [ 335.482153][T11970] ? __pfx_ksys_write+0x10/0x10 [ 335.483719][T11970] __do_fast_syscall_32+0xe7/0x970 [ 335.485355][T11970] do_fast_syscall_32+0x32/0x70 [ 335.486911][T11970] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 335.488930][T11970] RIP: 0023:0xf6fcefec [ 335.490235][T11970] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 335.492339][T11970] RSP: 002b:00000000f537b50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 335.494949][T11970] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000280 [ 335.497432][T11970] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 335.499936][T11970] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 335.502381][T11970] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 335.504703][T11970] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 335.507180][T11970] [ 335.508830][T11970] Kernel Offset: disabled [ 335.510201][T11970] Rebooting in 86400 seconds.. VM DIAGNOSIS: 10:12:36 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000000 RBX=ffffc900035cfb60 RCX=0000000000000000 RDX=0000000000000000 RSI=ffffffff8551f4c4 RDI=ffffc900035cfb60 RBP=ffffffff8551f4b0 RSP=ffffc90000007f58 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=ffffc90000007ff8 R12=0000000000000000 R13=dffffc0000000000 R14=0000000000000000 R15=ffffc900035cfb28 RIP=ffffffff8551f4ed RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096bdf000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f5332ff4 CR3=0000000072061000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000001 RBX=ffffffff8bbc056a RCX=1ffffffff36e70c0 RDX=0000000000000001 RSI=ffffffff8c400a00 RDI=ffffffff8bbc056a RBP=dffffc0000000000 RSP=ffffc900035cf9d8 R8 =0000000000000000 R9 =fffffbfff224561a R10=ffffffff9122b0d7 R11=0000000000000000 R12=ffffc900035cfb80 R13=0000000000000002 R14=ffffc900035cfb88 R15=0000000000000000 RIP=ffffffff81d52052 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096cdf000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000000080021000 CR3=0000000072061000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000007400000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=00000000ffffffff RBX=ffff88801c770c68 RCX=0000000000000000 RDX=ffff88801c770b78 RSI=ffff88801c770c40 RDI=0000000000000000 RBP=ffff88801c770000 RSP=ffffc9000052f7e8 R8 =0000000000000000 R9 =0000000000000001 R10=0000000000000000 R11=0000000000000005 R12=0000000000000007 R13=0000000000000005 R14=0000000000000000 R15=0000000000020000 RIP=ffffffff81e548c7 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096ddf000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000080001000 CR3=000000005bfd2000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2323232323232323 2323232323232323 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffff00 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000039 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85a131f5 RDI=ffffffff9b9f71a0 RBP=ffffffff9b9f7160 RSP=ffffc90003687298 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3230383838666666 R12=0000000000000000 R13=0000000000000039 R14=ffffffff9b6f71f2 R15=ffffffff85a13190 RIP=ffffffff85a1321f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096edf000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000033b18ff8 CR3=0000000072d3a000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000