last executing test programs: 3m59.370542685s ago: executing program 2 (id=746): r0 = getpgrp(0x0) r1 = syz_pidfd_open(r0, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) openat$pmem0(0xffffff9c, &(0x7f00000000c0), 0x2400, 0x0) write$RDMA_USER_CM_CMD_BIND(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY(r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008}, 0x4000000) syz_genetlink_get_family_id$gtp(&(0x7f0000000080), r3) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r4, 0xc4c85512, &(0x7f0000000280)={{0xc, 0x0, 0x0, 0x0, '\x00', 0xffffffff}, 0x0, [0x40000000, 0x0, 0x4, 0x3, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x2, 0x3, 0x4, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5, 0x4829d, 0x0, 0xe, 0x0, 0x0, 0x1000008000, 0x0, 0x0, 0xfffffffffffffffc, 0x1000000, 0xffffffffffffffff, 0xfffffffffffffffc, 0x0, 0xc, 0x2, 0xfffffffffffffffc, 0x4, 0x0, 0x10000, 0x4, 0xfdfffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x1, 0x20040000000, 0x0, 0x8, 0x80000000, 0xc20, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x4, 0x0, 0xfffffffffffffffd, 0x7, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffffffffffc, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x1075, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x7, 0x7, 0x20, 0x4, 0xffffffff80000001, 0x2000000000002, 0x4, 0xfffffffffffffffc, 0x4, 0x0, 0x3]}) r5 = io_uring_setup(0x2a90, &(0x7f0000000240)={0x0, 0x86a1, 0x2, 0x3, 0x277}) ioctl$int_in(r3, 0x5452, &(0x7f0000000040)=0xffffffffffff7fff) r6 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r6) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r7, 0xc028660f, &(0x7f00000001c0)={0x0, r5, 0x5d09, 0x8000000000000000, 0x8, 0x2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r8 = creat(&(0x7f0000000240)='./file1\x00', 0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r0, 0x10, &(0x7f0000000040)={0x7}) copy_file_range(r1, 0x0, r8, 0x0, 0x89, 0x0) 3m57.802913072s ago: executing program 2 (id=753): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) keyctl$join(0x1, &(0x7f00000000c0)={'syz', 0x0}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f0000000080)=@newtaction={0x48, 0x30, 0x9, 0x0, 0x0, {}, [{0x34, 0x1, [@m_skbedit={0x30, 0x3fff, 0x0, 0x0, {{0xc}, {0x4}, {0x4}, {0xc, 0xa, {0x0, 0x1}}, {0xc, 0x9}}}]}]}, 0x48}}, 0x0) io_uring_setup(0x1b7b, &(0x7f0000000180)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, 0x0, 0x0, 0x404c0c6, &(0x7f0000000180)={0x2, 0x4e21, @remote}, 0x10) close_range(r2, 0xffffffffffffffff, 0x0) r4 = getpid() sched_setattr(r4, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x7ffd, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x118f}, 0x0) r5 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x1}, 0x0, 0x0, r5) syz_open_dev$video(0x0, 0x1d24, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)={{0x14}, [@NFT_MSG_NEWSET={0xdc, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_EXPRESSIONS={0xa4, 0x12, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @range={{0xa}, @void}}, {0x2c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x13}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0xf}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0xb}]}}}, {0x10, 0x1, 0x0, 0x1, @last={{0x9}, @void}}, {0x44, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x78}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x58}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x94}, @NFTA_EXTHDR_FLAGS={0x8}]}}}, {0x10, 0x1, 0x0, 0x1, @reject={{0xb}, @void}}]}, @NFTA_SET_USERDATA={0x19, 0xd, 0x1, 0x0, "e1d50a270c061771654121869f0b1289034157d98f"}]}], {0x14}}, 0x104}, 0x1, 0x0, 0x0, 0x890}, 0x0) r7 = syz_open_dev$vim2m(&(0x7f0000000180), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f0000000000)={0x9, 0x2, 0x1}) close(r7) r8 = syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socket$xdp(0x2c, 0x3, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r8, 0x40045612, &(0x7f00000012c0)=0x2) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) mremap(&(0x7f00007ff000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000580000/0x4000)=nil) 3m56.714615147s ago: executing program 2 (id=760): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000884) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r5) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x20040055}, 0x40) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d1de0000080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2c0000000d0a01030048cdf227000000000000000a0000010900020073797a310000008f0900303cc812f4d13ced7e01"], 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) recvmsg(r7, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x40000100) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r9 = dup(r8) mmap(&(0x7f00005fe000/0x2000)=nil, 0x2000, 0x2, 0x28011, r9, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$BLKZEROOUT(r8, 0x127f, &(0x7f00000000c0)={0x600, 0x80600}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x2}) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r4, 0xc0845657, &(0x7f0000000180)={0x0, @bt={0xf, 0x10, 0x1, 0x2, 0x8, 0x9, 0xffffffd9, 0x2004, 0x9, 0x8, 0x80000000, 0x3, 0x401, 0x3, 0xf89023455665fd34, 0x2, {0xf, 0x2}, 0xe, 0x3}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r10, 0x1, &(0x7f00000003c0), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) syz_open_dev$sndpcmc(&(0x7f0000004240), 0x0, 0x0) 3m56.429866965s ago: executing program 2 (id=762): r0 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setgroups(0x1, &(0x7f0000000000)=[r1]) r2 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x557003, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000040)='/', &(0x7f0000000080)='./file0\x00', 0x0, 0x197841, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x803, 0x4, 0x7}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r5, 0x400448e3, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0xc) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x100000001, 0x2, 0x3, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x4000000000000000, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0x5, 0x4], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 3m56.420838779s ago: executing program 2 (id=763): r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000000)={0x9, 0xfffffffe, 0x0, 0x2}, 0x10) write(r1, &(0x7f00000000c0)="240000001e005f0214fffffffffffff80700000001000000000000000500080002000000", 0x24) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x2000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x80, 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x86022, &(0x7f0000000040)=ANY=[@ANYBLOB='nr_inodas=5,nr_blocks=2,\x00']) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) mount(0x0, 0x0, 0x0, 0x44021, 0x0) madvise(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x10) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES16], 0x48) r3 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r3, 0x0, 0x81, &(0x7f0000000500)={'nat\x00', 0x0, 0x4, 0x97, [0x0, 0x7, 0x2, 0x0, 0x6, 0x5], 0x0, &(0x7f00000002c0), &(0x7f0000000400)=""/151}, &(0x7f0000000580)=0x50) 3m55.703737458s ago: executing program 2 (id=764): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r1, &(0x7f00000028c0)={0x2020}, 0x2020) syz_open_dev$usbfs(&(0x7f0000000080), 0x1ff, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) syz_open_dev$dvb_demux(0x0, 0x0, 0x2000) sendmsg$inet(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002d40)=ANY=[@ANYBLOB], &(0x7f0000000140)='GPL\x00'}, 0x94) socketpair$unix(0x1, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) 3m55.628030093s ago: executing program 32 (id=764): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r1, &(0x7f00000028c0)={0x2020}, 0x2020) syz_open_dev$usbfs(&(0x7f0000000080), 0x1ff, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) syz_open_dev$dvb_demux(0x0, 0x0, 0x2000) sendmsg$inet(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002d40)=ANY=[@ANYBLOB], &(0x7f0000000140)='GPL\x00'}, 0x94) socketpair$unix(0x1, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) 5.895350971s ago: executing program 0 (id=1786): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) write$tun(r0, &(0x7f0000000440)={@val={0x1c, 0x9}, @val={0x1, 0x1, 0x0, 0x0, 0x3d}, @mpls={[{0x5}, {0x2}, {0x4}], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x40, 0x0, 0x3, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0xfffe, 0x41424344, 0x41424344, 0x0, 0x7, 0xb, 0x0, 0xc, 0x0, 0x18, {[@window={0xe, 0x3}, @timestamp={0x5, 0xa}, @generic={0x0, 0x8, "d588dc050391"}]}}}}}}, 0x5a) syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000004c0)='smaps_rollup\x00') close_range(r1, r1, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) shutdown(r2, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) mknodat$null(0xffffffffffffff9c, 0x0, 0x400, 0x103) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000000)={'dummy0\x00', @broadcast}) read$FUSE(0xffffffffffffffff, &(0x7f0000003480)={0x2020}, 0x2020) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=@gettclass={0x24, 0x2a, 0x400, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x4, 0xfff3}, {0x7, 0xfff3}, {0x2, 0xffff}}, ["", ""]}, 0x24}}, 0x40050) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000000080)) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f0000000040)=0xdfe5) writev(r3, &(0x7f0000003400)=[{0x0}, {&(0x7f00000020c0)="2890d1b12fb7c5b4948a84bcd5a8b830d9080624d863f59c3b96f5ce6e82cee8bdd5a507bab894f9f234c59bc9c790ad6ab7ff835cf35c5637db6427708bfa97c858251d3e85e5c4", 0x48}, {&(0x7f0000002180)}, {0x0}, {&(0x7f00000022c0)="c4fb61065846fa5e86108623fcbefc58837947b08a6d9c271eb46df940792614911f9294ad7a3c8d20d64bc738aa9006ba9f8cbadf563195ce00e70372f42bce34462e2e19e1129d95ce325aa152b601421ce30195e5035308f28790207150e682c46cd62d14b06879d45a7244b4217045e99c13996e9d33c7bce2947537d606629fb1cf0b6deace99820f1cde572e121ccebec47814f25b2777e406fc8ff300f616454204e406d8255b6ec456aec6c5f535327e4a8d3ead9b43948f4c3a11ff91649a535aae2bf45b35f7e67aaea11dbfd8aa196b73436fe75d7d88380e166ef35f812dec422bad30568d93e05bb660a6f3435e77b15f8ee6b2054d44575d895814adbf1cb3d77f019ed2951a1762442e078e398032eb3ddf585efed635d84ab548880f4e0d59b7dc4013f245331da65618ad50ccf447cfdee719cbf3e1e846b5218e9fa61a51ac4c03ef330ca97178fa61b5954de609a3a76a20c02265d9dba01b54e0b20678945f190f12b05480d5ef0e9f7f87f4162fee27270a974589de4b4f3cf32c955ac8f73ce344950f31ef22684163138b00e7dd7c6459b463f85a7ea03dd885ad055ed133e57eef6135d15b56b9da411d6d8e50ef024887a472995370aa186b603f5f9a0375222b1510e4270b3c849c9efbc8b12d8635fbcda2df0ad221074512072fcf328465c2082b24ae108b023e282cf026253db98cbd9316ee1e8417072b5a6e5cda3478ce967e0b242812688ebad73012c0a8f53ca00ee2ca2a357d982b17c6ac5fb6d1a2c2408e2615536794bf6c12985dbd32c5a5d56ae10d00f57e1ee0b48052dd5384ca8524bdf6ba7aa01a745daa6261fa90b24236745c680edc47458fb42e8d1c7e1fbd5d54e7cbdf4e4e2d9649cc12508bd76911f581a24cf9c381370539ee60b5284b447dd80a1c4a5e2a28c9de405639c0dd653651975a45252995b510d706ac6a653a7661a2d2bd88010d5158c306f03f48b895c72ce7eef286e662ab6147fda914b882f08343860994071c7c98eb59011b7284d9da47f1876c944ac04a658d2adfbfaec996991c376e2ea7b33980f5b509223bf4538fe64400514b95ea94675283884b219ccea545d8f6b2f16a81b3df950f6fbe7c6d17baaf33650aa723a4debdcdba7443a0f1dc9aff242ae8efdfb83133eda7433fa9bf6d9d6825f19d8d7c067b5e246b77a6ddacc76686a021abe254dd386ab6d72d779975fb7cf77b11f3f7703d0296e940c78525e8122c6452566973a6ddf619eca7060ad75cbf5883a97dc029a2d26f404192601f1f05e2419e6e00650c78b0369c0b762cb9124cffaa39d8c7ece7e4414fc9d100d6d0fa6b86450556cb4154d8361d6027616a745b701537c63447b3db0522740e89b5f88c87876007bfe4b0d9e1d18b4300c12dfa8af13edbc53ceed3f16e4a11af1afec885845d60eba11b4721963f618c3228e22a876478f5ce95ac54d250404dde7139daecd7f9f639082ee4a572fa28139596c3c4bd1bab42180b12826060ec40a3f046bec89fdb7c88b3f80c6932a88faaf70adddf4479aa8167d6af94c2a6de7d5b2092f49ae33c73a3004c09a19bff6eb72aed78064bd3449104a8ac36a472341b20d5c19a72802e14588e32849ee3ce2692e58f88f9458bd959ba9e67958e85fd58135ece2a98508d21f612b3fc738aacc6c32cf7208619cbabf9b5d98db4a2ff41e0ad352ffac32c87de7d008ef34f1929e39aed21aa8fa306cd662d3ab1f64bc5820ab9698141765d3c28aefde96b20d7cb053912dc2f0f04099b6a8356faedd8f0288f72208213fd87245be8b6c7692dc0fbbe02bd5fa4482fe797259322682ae31c2ca5dcbd87323b35fba294dc1b4d926ec77c3ac011c3ebc1ef92136d97b1364996f6f3349f78a7cd20ab52cdcdcf056c91367598c02227b31d6b298460012c18d4980990c66727fb29ad3a46d0dea9de1536b1e1b97bf7fefb0c1cb24e4c3a5d3782b8eaff41370eb7ddc81613d9ed8f35dd13720baf57b25c6c8dc28758c6d237cb38ee4a47f622c459321c0203d472833aa23e2e3ae95c98531d1f6d01a4fb97adf7b3916520f532d109c696f6b21eb0cb183b8bb1acc68f2cf245a5829c8978e43b9737a910a4c2ed92359fc985abad8bd8c28309be5b47b4df2a098fd83111b1c313cb1a7a36547cd056a427b1b714765762d1dcce88fa2be3224daf3316c600569695c1a956490299ee937d62a9517458b8c2aaa749beb19b2064a2ae992eac2d13a1e34e2ec2b0bf0ef888f0110ed3e4c7260dc3b87c3ba91a52512d66573352bdb95661894050940bafe766a50ea22db5e598b86848081f7420bcb5a2d44f3ee0c55eeef1260fa1b276130a5509799ac3fc81a198fbf781b95dd1a28d6bb266c66a17198a5beb1785cd64380b4ce14d9fc4fadbb9c9a3d78d3c95f86e55bfad453f7a448af797c2d4495b7aaa466af289b83a115799a40525e66cb74d9130fa2d9319e4316573fb19d78b122583bd6f15f0f24778395172908eb32854d545dc66e3791b7157bb3f8bf0ccbbcf5298cb8ebec4cf54c4081fcf9885d4e6e70e3a83e9b059ce16ed7afc4b314920387190f99c6228d790fbf9e5b315881b13d2b6cf15ffd25646a71cbbf830a7e7ab0adb3c17ab7eb9b219abade6e9b07f842f56f7c4ad321e", 0x768}], 0x5) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) pipe2$watch_queue(0x0, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x5e) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x894, &(0x7f0000000000)={0xa, 0x4e02, 0x3, @private1, 0x8}, 0x1c) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x33, &(0x7f0000000580), 0x4) syz_emit_ethernet(0x82, &(0x7f0000000180)=ANY=[@ANYBLOB="ffffffffffff1704b45adbde1700450000740000000000019078ac1efc01ac1414aa05009078e00000e046000000000000000011000000000000000000"], 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r4 = syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f0000000240)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0}, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040)="91229708a14b87145f8ad1bbc325c294040c37", 0x13, 0x4040000, &(0x7f00000000c0)={0xa, 0x4e24, 0xfffffe00, @mcast2, 0x2}, 0x1c) 4.185775101s ago: executing program 3 (id=1792): mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) personality(0x87bf5ac905ea0f7f) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x8001}, 0x4) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000040)={0x0, 0x0, "d607f8f9951e76c13f64323723e7eecdf40c363423eb3d259266ec9c37865c6c1a4640ce1b22bb3327ef4f001d34c09f39c3539e4f8d3ee0878ae95bc7f52363c468b257ff3e24852548deb01efd54f11ed2c41d078b9cf1fc8f72566153c97e4af37017ea6b16b694bb4a6e4606c3fb19d1d2bd3c8c4e97da2213f9d5c3b90400000000000000c279f03558083906666827d61dcc3a633bffff250b5a293e3877adc1660edbc9a0307a25720a170e7f5670e419dc44febf7ddc73fd4a5a0b6c28665f7f46c7084e17c809268103a2584ab40a68e528329d97afc3612e325c1eb4a3ab2e156a97444800", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3ecd3e6fb756ef8880debeef3636afd981d8af4ab119928448f90351aec113335eacf52a18c87738d9679d3acc032a16fbefc64776f363610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6760c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b6ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8f7db58c8086751320d22ee8582e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141ea4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb69c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0684084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835e1fcfff1da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ac0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a73e0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8528b72e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc574444f4b5025ec9827bafc55341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd55347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aedd4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928736b96c72fa3406a95adfe6b374ffa27001d37d3bbe725e75c257834572026c511f57dce67153a4008f9e75e07ed9237f600005800ee667c137fc78bc4fd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b62ee8a5d0fd65b739ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014e3ad280944eae6fbf8d5f85237257bb5b8e5ec3e52dc06f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b41738b7f1a57c867d5b2ee5d72465657593339506fd0c3807cd6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c04f1035a96c6cfbe6f6c2b754581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c30dff786093a21477431fea0458023953700"}) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x808006}, 0x8) getsockopt$bt_hci(r1, 0x84, 0x7f, 0x0, &(0x7f0000000000)) mount(&(0x7f0000000140)=@nullb, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='ntfs3\x00', 0x400088, &(0x7f00000001c0)='discard') r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), r2) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000", @ANYBLOB="07cf28bd7000fbdbdf2508"], 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x45080) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x89f1, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f0000000040)=@ethtool_pauseparam={0x13, 0x2, 0x4a, 0xc}}) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f00000001c0)={'filter\x00', 0x5, 0x4, 0x3f0, 0x308, 0x0, 0x308, 0x220, 0x308, 0x308, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @private, @empty}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @local, @private}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002300)={0xffffffffffffffff, 0x0, 0x35, 0xc4, &(0x7f0000000000)="216dab7f33f4adfc87f73f500de946517338944c2a86cd984d2b4a78f7e8352bfa1e13f262d6927a379718097fdf8e4386e6d9d662", &(0x7f0000001100)=""/196, 0x5, 0x0, 0x1000, 0xee, &(0x7f0000001200)="d7af436d19066a2054e469feb79bf3f08edbc675962d7191a0fcdc743650584674122c3124e9c86e069985c40d253b2ac146cf40b0b8319c85b4482bb55283d796d7f43089d765e26ab31599150f3591ca6d98214b92498bd22707fe66f22c55683b09a4d69e6b11fa2a0c71ef90e2333d528f5614da5ad47999c541a3f8ef97ed301e0deb5c21423a5569e6d75cd91b75500016c4a81870b50463da072221733eea38a6998cf21d207441dabcd0c72e6cafdcc75b1c5d601061210cb8c891700f414f443e8a8684928b3e8fef63a497008ee08ce68cfb1e7467d59ed0b4df96240e02f588b74a9322bd6c89154b18fba5158a62e0fcf305f41aa64af308b18087e1317c2e9a4c0c1a221d2ea487d13d30ea6a70ca861c6f203cf1c4b5b644d4dd3d513fd5f40d3eaa5ab2cf20abb4277e64e0c183543d062f8a28a186a30e7e979a295320300aa5167a2eb110ad91dda0c2ed5f94262616af224ee6bf4089c83e57c43cce766414dbe8743ebcd4160c9415811118223a2e9f70464924d810550d58ea99cf0945745e7cc29c19096ec26c2e42e300000069bb95624841492fe01642c5c622e24a9a8191822eaadb541b14c270824e03494090a250058302c534eff19fcce7f77870ec0589555932376a171c8473b16a22d595746d42e64b77667b21fa51a6b45df61e21f628ca67ffe7cb69a612080978fd738a867d28f5229f874faad7a2c53212dbe10b11f16f43f9309461fb0a9095ef710bc51de92cdc075f9d95e9a4be3319f6187c42d29ffd964716d19d6a5cc1a58bd6a52bc609e0df219c78d2245ae7b83dc6a23120653151057d7400b5b82bce08a569c3aff316698ce42f0666ff467bfa19200582b23117a404cd5a6a3f080511b75cab8f151b8b1fc046a5fbe19140c82535536f5f03d19cdd989b5101a6cb29a7a877ee9ce0059a605eccbb65e26a1cd02e775776dbfa4dae6310586b6e1dc1888fe920d731bc571d664620ba15446a9c134095663602867e47b4a742ccf209b2462d4d49ca249b352a6fcfd3ad5d2bff5b449fbf66ecb67b38bffabe2512fa82fbfe4becdb3ed2030f409efa279871b564424eef238f4e641706f300254273fdedc3da83df523a80d8a0869114287bb09bb4808ec3dc953f2a7b769fdca880ccb64cf6b23521a44a0c5a54b4f0e463f75fba76de0585f5abfe58cf1760dcd3e311963ad2e6b93336faa29a01c446f026d40d4a81314653f654fa8d826f67b8ecded6bcc6870e54f544a34f777db35fc4877d56433c99efff82cafa39e7c0caf0c6bcf77ddd9b6cc530b9cb5ca6bd465858b825807981c887c0f3f2e27b928d6bb7edb8e13f195211eb3287bd80490536c74bbd37e4c6d1d82f7e695be8b5b4b0e63719a6bb445a701816beedb62a6fcb4f6037bc0b3652de192a70cf3c68f28d479d8ece9f7d2e7c415aa14558a6a37db0a5da9f07ef0042865e43e73ab73ac2bae84513231380ee31fefd6c701248fd5247f611eef76ebff4890ba867a99de8f281fff8f43efe8f91d02fd395fbca77f480b4f69a018a4b5c1463ccb2636fe97587af997d8dd5a083a11d012a3bbddef503057dcb164d953204322ff03651b544bd3a278890e4e8e0f9b9c19c657f342fb075b95cce252693afff111d098904ef4d8737235d3568d2a624e2f124876d22e62128cfe318e0c6e572f72aaf62af1b08ab3be90665f78e26f3395e76abad7039a0e9f8e31e1f6c56728fc2910161e15661d8c20386177e2a5ffa9cb1daea0455971c775721f30c691864b8e0d217433dfc17c1a696b1abd590523a593920059f1469c9ec2c928d9ac60f621a2f3266d07c0b5b5f0c6689a718592ba4544e02504f7c16aa92c7a3d841ca5f7ac58f2ba090c1368a2d992ec35cb80692a9f92d914066e4abb9364f8c8f55e5907ec575406c8f356c059a8bfa0e8b652319d42cc477d328ccf1eda677a143439e39aba2d087e5cf06972635b89547586be6ed6ac44cfd031ed00e64579896691c3235802662abdb01183180e864eff68101e8bf662b8cbc190934c0a1be85bec50899045cb808e20319138361e7363d1bd537bd6589dd823dfdbaf21ba962a0166389832d0027f84dd863c3bbcef042225588df389a9e72b20309e2786347ba67a2a0a6fbd375b7e41d52add8c5be21ff382ad068bd7699892d57a59eb70ce4c7c4f00ebd8053831bfe17c4145746596850f67e240761d22d373be5f302010ee0553a861cf60ac0711baade61c5f8f5cf4614ef625c9cf8896946c39e939920f820f096bb60e0e41328fb91f0d2e8fc890d2e6b50df747e36af8cf9cfe24842a0e5d4bd72d79be7a8bb22eca4e412558c9b8bf299e176dc3ec68baf4161fdf1f554d96e69bc413c02ad61df942b2e92339327b6351dfcac664d7445e4b51653656b76706fffa91a92b98dd6dea2e8c17ca3fd9c0ada841f30984c17b690d76d8fd11af4f78c126d6626ddb3abdc45c71f4b9239f9e75df61d746c12c2ccebf9cc2645d5666fbdfca81ad5af065a556b42d5c487c824a258d0c4e3381fcff06d84af53327ca3a77cfe81bc7d98d716829075352aafa67936a23b6a6e37a41ad75aca324ddffdca645945b56645ed9fb2e8cb59901d386e62e2642714f6c67ed8c7e78951eb791e428e3b141c53f1cdf25a19268faa2529cd10a6b595570035022bbb73ffe85c3bd38b9d383311280eed96eee8240ceeed4579705efb2d6f438c1a1bc62c835a18000ad7f44f0cf9688f9aee826aafd0a1edf638fdee6ee911be10f9096723c45268b201d96f546f1a396d39973ae74227750b7f60047721e686fa2745cd24f0aa8bb656ce05adfde843537c3bde41f590303d758a354c414661fa55ccb89ba4c35f0e4ef55476b2c26dfab5e5ab01f32cd706dcdb766e8c191a73dbd92140d007a672e348441f560d0b43bb6cb9bc5926e579b973d726fa772de619f9632bd79fc70f05fe263c27e63c2de3a96be77d6f7c6862272eca8ca806548971556393f0527f3412ffdab5e87e10f1b7f10f6113a770e6e1b2d45fd695b74a28e310fda845cb286bc9ed9d599d5321399807492e680bc7822b361337ef42d174041a16af5f61234fc0c1256412d32f0a29881f52a269509b93e2a51a60b08b843eca8fb4b515f1caedc056e59acb3f645947984388183efaa8519cb2bb1f41f60a128329d0302e6b05e88a777222861adeaf9acde95142061066aaefde982ceba59b823293de9f551e607bd47af4210c01d598512aac8394d9098d0627d8712555aaaa0dbf9193b3ba19564d95be7178e3fbc5ef373fbefbfed5f7c39ddc5eb06446cec68d0b576d1fb46cc297797852f34a88cdbc3b7b18c1f22820b36372b810daa57917973d122e891ff8eadb19113a7906ecc017636c32cfca236d2d64243495b7de12292c637989eae2660bec74d78a8a344a813696a26e0775b467866f1895d1ad87aec12ec819d5c520ba9b61923c887991c38838468740fe2bf95c81f6a3a662e1de7d6def84af98747ad61b2e63f45dc55bca8721eef65910553f3e4cb5826bcf2650710cd15f8948a9076502f800c8a3418f2a99742c16928ee9b29d39c89bd7c146911209ce3a8acc1a979a753d6f28cbdb8dc3077139e474fd892fc62801032b86f2e84924c6736070ab0d97d220193ef2972adc00dc47bc043e9cd4a650a68e0dc3a8fcbe3b171a183cf15ad7ff0403968db961fbcdbded4531ee970ee8dc0b30d08f74b5951b68491dba03077d80f473b480baa23a6cc6b43a510b80ac5ea45fa88c88ddd66729991ee18dbb9d58cb9d038a740117c87f044f9fae29514450805cd2c95443a39710f15796054e16e9d6eff854c1db1aa92cf0c5262ddbf8c6d68812fb6fbe0f1cb14e9058b64ed2c7bf30414e5a454fbfa2ba2b2c0c3a28edc69474bf4793ad328fd84595e3eb7796a87ca81f084fcb1a1e0b8019a85f29c6904febbed83eeac198123abd8b6a05285cd973b8242fea155059622a2af3841a96c84e1aed0b0523d856d0c709b11942252e4485fbdfe6b5577abe90c1a25047aaf77fb55373ffcdd7e3ed37a18fa2e8941d2a53eb9cd34405bdd8748c6adda358b4ed343575c2def9470787e9389560a00ad91c7adc6e8c8d9ec86410c60e13a82dced60737f9dd3e983616fbb8eb1d9f5d7d834c7bb2c5d9fe65b05449a8b038bdb8f637999041d2f79a287ce68cbf69414ffbea07a7165020ccfd101de654fc0478184cacb733ba666acc12edf25b320858dc1fddeb7341e5e34837c878ff2b39ba2b31c1503c347944b56057bc5f8469027c35fbfa33a2a76e17436b9938c470957ee42809677bb14809923923b2fed6d72bbc043846428fb5e1206d4983954b5e235199a9c1307fbc5687f04e4fa1b7b74474fe614561250c5333d9d76ab432ffa40f4488ed1a5a73be5964e3e072436cabcce601e87f751cb6d27850e979a727f98d7568eedba03316e3b436b8301cbc5f6e1ae9c068290d3088ec631b528953fde3ee3dde389a359a842a0500aad209cfb34ff3fd1bdb6cdc67a146f9e148593cbe6395ca02cb593caf584c3e3df21eb3c4f486d673c18fa81058f1bd90f8b50490056ff0340a24d37a901259087cbf1a53b9726c6e0c72ea7871915203be9035b28606859222739fe58f931503b5adbb43fa40558bd4286e07a5a73cbc573257c0d8930b25f93e73665a546f27bdc5575affd2355741d775e48bfff93a11d246eacc21e994d3e76b30f33508b3d69ab968a0584c7b5cabc991b0dd15e31677fed72131f01da7bbef3eab6f80e65c5107f3db5ea7f99b731b1d822b74305d0245eab6a79afaba33a820d7a0acc3ed604c29788ab9473ecb5e0968cecc817f36a96b733dc21738f117e1a22e8949970e4fdcc9a39559f62bf73cd572aff82a875d42b31dcbe009120e6c0a8ada170b9b45d992a89b88db3fe5a78dfba4f32b26542986d3801d7a4878e0a5b992c8691430e1ff92fd8efc6f359988a3ba86d753c7514c96b005a5236da2648e31af8142dcb0654ce083f7d2c8e88e40ccd2bbabe555d43c134d25fda4549465107d0b521d5f67eee32cf1f64f914cae5174a0d5120311328d9cc10de963d7e7320192edf223d53f62cf781c1e33a8f260416d02cc7ab9dc8dc6c0120c204d10627fe692acfad254d3988bbfff5ad8e334f17cda3630fc42da5842a4065541352a4b0789bf4923fcea29af9c5316695a35f82110b1e5d339bb380495534e58b7708438c3aba7ccb89fe7238c25f0b90ce2bb493b1e9365b6beefcdb4845b20b6e4f364d65344449b9c40fdbfe586bcf304823f0529ba4280843cbbf1239add452cc0af8b946e13463ba92baad16544c10c1b1b67f81f1fdeca98c496f45f9f894e8d90a607164549b28b72828b0ee95e6f7909be004046304eacdd33822035cc7ebef16f70d9dbaaafd4dcce0dfd4651f5093310e322cf5722ed50c471dfa3a5b6ce33ba28cb767da1990eac865bf529ebf192c8a0782a5ad285431801aec7bdf515ef2945c6bb0e6861ee2e19b2c88accb9b13e52858ddd7accd7ff2559af480bf1b6d3343502329a1b2fb88892553a703b1d4d738b6a0d91be111bcc464b720e0c93db79523e1fb418e4ce26042c6e9b86fb379bccd8bdd647a313cad06039f23f0d512ef9f10cb05963e8d2078794e641f6aac10aecde965773a5e0bd2669b6f1e28b2ea245fbc8c20719fb8c69aac7abf759f608abd55e749a438c7394ce0aa3296b43c1c2b437c0c3bbd3c9d24f81", &(0x7f0000002200)="e9ba331029bb9e80ee9599c3767b154f9792e9e2b829ebc2da0f1cd9c0a9e44598f6ac5bc82a1d55afb3b7d8195e1e64f2e2b5cde51f5d855efa835e2c8e21fb0c7461278246bc7c4feae926d96d336f7906c40adec9580b018fee9390b1c1d47e1a02ce5c8e5e9383ad17d908d80ccf9db97371096bc32690710701bdabc7c8d745688fce5c28191b5f79883c02290f7149cbcddc09da2f4e7438abb47c0e5f55322ecbe5742af1ee74148eed8218a7316d21ac566106a26ea3b3942a6e1943812b3ccc65f2fe6a3e133cb1e0edcbb5f4e406d60845f3c6bb4a185c61d802937101db0134cd575b675343d92e00", 0x2, 0x0, 0x1}, 0x4c) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) 3.991573113s ago: executing program 3 (id=1793): socket$packet(0x11, 0x3, 0x300) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="3000000041000701feffffff00000000018f0000040042801400018008000200", @ANYRES32=0x0, @ANYBLOB="08001400", @ANYRES32=0x0, @ANYBLOB="040002"], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000140)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0x3c}}, 0x10) sendmmsg$inet(r2, &(0x7f0000000c00)=[{{&(0x7f0000000080)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r2, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x0) 3.932682581s ago: executing program 3 (id=1794): futex(&(0x7f0000004000)=0x1, 0x5, 0x0, 0x0, &(0x7f0000004000)=0x300, 0xb0024000) 3.862602778s ago: executing program 3 (id=1795): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000480)='/dev/comedi2\x00', 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x6, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x14, r6, 0x9c3fa077fa966179, 0x12, 0x0, {{0x7e}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x8}, 0x4040800) r7 = socket$inet_icmp(0x2, 0x2, 0x1) sendmmsg$inet(r7, &(0x7f0000000c40)=[{{&(0x7f0000000200)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000080)="2a0000f128000000", 0x8}], 0x1}}], 0x1, 0x20000054) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) fanotify_init(0x200, 0x0) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000e40), 0x40080, 0x0) ioctl$TIOCPKT(r9, 0x5420, &(0x7f00000000c0)=0x1) splice(r9, 0x0, r8, 0x0, 0x7ffff000, 0x1) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) 2.742568481s ago: executing program 0 (id=1796): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) rt_tgsigqueueinfo(r0, r0, 0x3, &(0x7f0000000340)={0x25, 0x9, 0x9}) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(0x0, &(0x7f0000000300)='./file0/file0\x00') r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') read$FUSE(r3, &(0x7f0000001180)={0x2020}, 0x2020) rename(&(0x7f0000000580)='./file0\x00', 0x0) symlinkat(&(0x7f0000001040)='./file0/file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') r4 = accept4(r2, 0x0, 0x0, 0x80000) sendmmsg$alg(r4, &(0x7f0000000c00)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000040}], 0x1, 0x8040) socket$inet_mptcp(0x2, 0x1, 0x106) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x7313}, [@call={0x85, 0x0, 0x0, 0x11}, @printk={@lld, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb0}}]}, &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 2.090368542s ago: executing program 4 (id=1797): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000340)={'pcl818\x00', [0x100, 0x5, 0x13600, 0x6, 0x2, 0x10005, 0x79, 0x3, 0x80008, 0x5, 0x2, 0x1, 0x7, 0x800, 0x6, 0xfd, 0x300, 0x80000000, 0x3, 0x7fffffff, 0xb740, 0xca9e, 0x9, 0x20001e58, 0x8, 0xf39e, 0x7, 0x1539b804, 0x9, 0x1, 0x2]}) 1.992419393s ago: executing program 4 (id=1798): r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000200)={0x1c, 0x78, 0x601, 0x0, 0x0, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\a\x00\x00'}, @generic="136d"]}, 0x1c}], 0x1, 0x0, 0x0, 0x24008081}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x200, 0x0) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x20a, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x8}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x400dc}, 0x24000080) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket(0x400000000010, 0x3, 0x0) sendto$packet(r0, &(0x7f00000002c0)="05031400d3fc1c0000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.830373427s ago: executing program 0 (id=1799): prctl$PR_SET_SECUREBITS(0x1c, 0x15) r0 = getpid() openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x501001) r1 = syz_io_uring_setup(0x42dd, &(0x7f0000000640)={0x0, 0xe4f1, 0x400, 0x2, 0x40052}, &(0x7f0000000600)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) io_uring_enter(r1, 0xfffffd, 0xfffffffd, 0x45, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x2) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x4}]}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) 1.772641596s ago: executing program 4 (id=1800): recvmmsg(0xffffffffffffffff, &(0x7f0000002300)=[{{&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000240)=""/206, 0xce}], 0x1, &(0x7f0000000380)=""/8, 0x8}, 0x4}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000003c0)=""/173, 0xad}], 0x1}, 0x4}, {{&(0x7f00000004c0)=@pppoe={0x18, 0x0, {0x0, @multicast}}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000540)=""/52, 0x34}, {&(0x7f0000000580)=""/224, 0xe0}, {&(0x7f0000000680)=""/129, 0x81}, {&(0x7f0000000740)=""/57, 0x39}, {&(0x7f0000000780)=""/146, 0x92}], 0x5, &(0x7f0000000880)=""/118, 0x76}, 0x4}, {{&(0x7f0000000900)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000980)=""/255, 0xff}], 0x1, &(0x7f0000000ac0)=""/51, 0x33}, 0xc}, {{&(0x7f0000000b00)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @multicast2}}}, 0x80, &(0x7f0000002180)=[{&(0x7f0000000b80)=""/125, 0x7d}, {&(0x7f0000000c00)=""/221, 0xdd}, {&(0x7f0000000d00)=""/32, 0x20}, {&(0x7f0000000d40)=""/4096, 0x1000}, {&(0x7f0000001d40)=""/221, 0xdd}, {&(0x7f0000001e40)=""/237, 0xed}, {&(0x7f0000001f40)=""/44, 0x2c}, {&(0x7f0000001f80)=""/172, 0xac}, {&(0x7f0000002040)=""/47, 0x2f}, {&(0x7f0000002080)=""/196, 0xc4}], 0xa, &(0x7f0000002200)=""/227, 0xe3}, 0x8}], 0x5, 0x40000102, &(0x7f00000023c0)={0x77359400}) r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') pread64(r2, &(0x7f0000000000)=""/165, 0xa5, 0x7f) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000002400)={'vxcan1\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r0, r4, 0x25, 0x1d, @void}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000001200)={@local, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x2, 0x0, 0x2, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x1}}}}}}}, 0x0) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f0000000140), 0x4) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x10001, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7}) 1.753702854s ago: executing program 4 (id=1801): pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000780)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) openat$vicodec1(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x800, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) chdir(&(0x7f0000000000)='./cgroup\x00') r4 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) lseek(r4, 0x1, 0x0) getdents(r4, 0x0, 0x58) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r5, 0x8982, &(0x7f0000000180)) shutdown(r5, 0x0) recvmmsg(r5, &(0x7f00000055c0), 0x0, 0x12360, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e20, 0x204, @empty, 0x4}, 0x1c) connect$netlink(r6, &(0x7f00000000c0)=@unspec, 0xc) syz_emit_ethernet(0x46, &(0x7f0000000240)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa86dd6a00000000101100fc7019c45e2b0b1b5000000040000001ff02000000000000000000109078e201000000000000"], 0x0) r7 = accept4(r2, 0x0, 0x0, 0x800) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r8, &(0x7f0000000300)=[{&(0x7f0000000040)=""/3, 0x3}, {0x0, 0x3}], 0x2, 0x0, 0x0) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000800)=ANY=[], 0x138c}, 0x1, 0x0, 0x0, 0x48000}, 0x8000) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x1, @rand_addr=' \x01\x00', 0x5}, 0x1c) splice(r7, 0x0, r1, 0x0, 0x16a, 0x1200000000000000) 1.002356449s ago: executing program 1 (id=1804): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/vlan/vlan0\x00') lseek(r1, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x6, 0xc, &(0x7f00000008c0)=ANY=[@ANYBLOB="180200000400000000000000000000008500000041000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xe, 0x0, &(0x7f00000006c0)="5fd63edbfd8a4a9a0df68a30323c", 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r4, 0x4038ae7a, &(0x7f0000000000)={0x2, 0x0, 0x0, 0x0}) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, &(0x7f0000000000)={@local, @private=0x9, 0x0, "c2d62f8cef15ea224cdd571c343ca8e0c1a113a336750adb51a2d2e4b8d71968", 0x3, 0x6, 0xffff, 0x8}, 0x3c) sendmsg$NFT_MSG_GETCHAIN(r1, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xb4, 0x4, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4a22}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HOOK={0x70, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x373a3ecd}, @NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_DEV={0x14, 0x3, 'bond_slave_1\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'syzkaller1\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x5d88048d}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000005}, 0x20004001) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=ANY=[@ANYBLOB="5000000002060108000000000000000001000100070000000900020073797a3000000000050004000000000016000300686173683a6e65742c706f72742c6e6574000000050005000100000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x4020045}, 0x0) r5 = syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x0, 0x26405) fcntl$F_SET_FILE_RW_HINT(r5, 0x40e, &(0x7f0000000100)=0x2) 921.520601ms ago: executing program 0 (id=1805): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x94, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x6c, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x34, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x37}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x108}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x39) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x6a0, 0x0, 0xffffffffffff8000}]}) 921.064008ms ago: executing program 3 (id=1806): syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x20000000) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x7d4165cc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0x7d4165c9) listen(r2, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r4, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000780)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xc}}, 0x0, 0x0, 0x20, 0x0, "9c0fe2154aa786d10084ecfbe8e86f7d312fcc8fde38d5823d22fbbb55a7837e5f2329f4d662f2185f18fae43e09d661d12a01669d6eef2e4733c2c29a3c3d16ef45c7c1c8ecfcc76b47d9ab9a573f11"}, 0xd8) listen(r5, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000680)={@in6={{0xa, 0x4e23, 0x2, @remote, 0xe3}}, 0x0, 0x0, 0x3f, 0x0, "2b20a1a47cddc63b223be606d7303a4d4d11e10450d766feb63b382d54bab577021cad5de4fe7630a33b6deca160b1267ff02123bc27830000000000ffff40000000000000b5b29049cb65f00300"}, 0xd8) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000540)=[{&(0x7f0000000180)="580000001400192340834b80040d8c560a066f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0effeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) 802.423051ms ago: executing program 3 (id=1807): ioprio_set$pid(0x2, 0x0, 0x2000) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) r0 = socket$inet6(0xa, 0x805, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'veth0\x00', &(0x7f0000000080)=@ethtool_cmd={0x4e, 0x40, 0x3, 0x2, 0x6, 0x4c, 0x4, 0xb, 0x6, 0x0, 0x9, 0x10001, 0xaff0, 0xa8, 0xa8, 0x5, [0xb, 0x8]}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000003, 0x50032, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$kcm(0x2, 0x4, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x58}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYINDEX(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000040)={r3, r2}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_procs(r6, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) preadv(r7, &(0x7f0000002880)=[{&(0x7f0000000340)=""/91, 0x5b}], 0x1, 0xa2e1, 0xc) r8 = openat$cgroup_procs(r6, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) preadv(r8, &(0x7f00000039c0)=[{&(0x7f0000000140)=""/142, 0x8e}], 0x1, 0x4, 0x3) setsockopt$sock_attach_bpf(r3, 0x1, 0x7, &(0x7f0000000000), 0x4) r9 = syz_open_procfs(0x0, &(0x7f0000000240)='net/wireless\x00') pread64(r9, &(0x7f00000000c0)=""/144, 0x90, 0x2f) syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100"/215], 0x119) 802.164543ms ago: executing program 0 (id=1808): r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000200)={0x1c, 0x78, 0x601, 0x0, 0x0, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\a\x00\x00'}, @generic="136d"]}, 0x1c}], 0x1, 0x0, 0x0, 0x24008081}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x200, 0x0) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x20a, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x8}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x400dc}, 0x24000080) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket(0x400000000010, 0x3, 0x0) sendto$packet(r0, &(0x7f00000002c0)="05031400d3fc1c0000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) 528.993028ms ago: executing program 4 (id=1809): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0xd00, &(0x7f0000000400)={&(0x7f0000000440)={0x18, 0x2f, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x12, 0x0, 0x0, @binary}]}, 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x10) 408.441669ms ago: executing program 4 (id=1810): r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x24, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000001540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002280)={0x44, &(0x7f0000001e00)=ANY=[@ANYBLOB="601400000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x1f, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f00000000c0)={0x1d, 0x4, 0x32}) r3 = syz_open_dev$sg(&(0x7f00000002c0), 0xe6, 0x2602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x380000f, 0x12, r3, 0x0) mbind(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x800004000000053, 0x3) 337.968904ms ago: executing program 1 (id=1811): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000007900)={&(0x7f00000001c0)=@getqdisc={0x30, 0x26, 0x1, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xe, 0xf}, {0xd, 0xfff1}, {0x2, 0xf}}, [{0x4}, {0x4}, {0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000001}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c00000400c2800c00018006000600655800000c000280080011"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)=ANY=[@ANYRESOCT=0x0, @ANYRESOCT=0x0]) 337.722298ms ago: executing program 1 (id=1812): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000a80), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000280)={0x24, r1, 0x8150411fa2c8b889, 0x70bd2d, 0x25dfdbfb, {{}, {}, {0x8, 0x2, 0x10001}}}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() setrlimit(0x0, &(0x7f0000000100)={0xb, 0x3}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x4894}, 0x20000001) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000628000/0x1000)=nil, 0x1000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xcc214000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000005c0)={'ip_vti0\x00', 0x0}) ioctl$DVB_DVR_DMX_QBUF(r5, 0xc0186f3f, &(0x7f00000000c0)={0x10000, 0x8, 0x6, 0x4}) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x60000000}, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) 251.494263ms ago: executing program 0 (id=1813): prctl$PR_SET_SECUREBITS(0x1c, 0x15) r0 = getpid() openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x501001) r1 = syz_io_uring_setup(0x42dd, &(0x7f0000000640)={0x0, 0xe4f1, 0x400, 0x2, 0x40052}, &(0x7f0000000600)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) io_uring_enter(r1, 0xfffffd, 0xfffffffd, 0x45, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x2) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x4}]}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) 240.83767ms ago: executing program 1 (id=1814): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x18, 0x2f, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x12, 0x0, 0x0, @binary}]}, 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x10) (fail_nth: 14) 754.521µs ago: executing program 1 (id=1815): socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x20000000) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x7d4165cc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0x7d4165c9) listen(r2, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r4, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000780)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xc}}, 0x0, 0x0, 0x20, 0x0, "9c0fe2154aa786d10084ecfbe8e86f7d312fcc8fde38d5823d22fbbb55a7837e5f2329f4d662f2185f18fae43e09d661d12a01669d6eef2e4733c2c29a3c3d16ef45c7c1c8ecfcc76b47d9ab9a573f11"}, 0xd8) listen(r5, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000680)={@in6={{0xa, 0x4e23, 0x2, @remote, 0xe3}}, 0x0, 0x0, 0x3f, 0x0, "2b20a1a47cddc63b223be606d7303a4d4d11e10450d766feb63b382d54bab577021cad5de4fe7630a33b6deca160b1267ff02123bc27830000000000ffff40000000000000b5b29049cb65f00300"}, 0xd8) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000540)=[{&(0x7f0000000180)="580000001400192340834b80040d8c560a066f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0effeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) 0s ago: executing program 1 (id=1816): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000480)='/dev/comedi2\x00', 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x6, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x14, r6, 0x9c3fa077fa966179, 0x12, 0x0, {{0x7e}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x8}, 0x4040800) r7 = socket$inet_icmp(0x2, 0x2, 0x1) sendmmsg$inet(r7, &(0x7f0000000c40)=[{{&(0x7f0000000200)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000080)="2a0000f128000000", 0x8}], 0x1}}], 0x1, 0x20000054) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) fanotify_init(0x200, 0x0) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000e40), 0x40080, 0x0) ioctl$TIOCPKT(r8, 0x5420, &(0x7f00000000c0)=0x1) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'das16m1\x00', [0x140, 0x9, 0x7, 0x2, 0x10000007, 0x7, 0x8002, 0x8000, 0x7, 0xc72d, 0x0, 0x7, 0x3, 0xa, 0x29, 0x72ef, 0x101, 0x6, 0x6, 0x9, 0x4, 0x6, 0xa2d8, 0x9, 0x1000, 0x8, 0x471, 0xffffff7f, 0x383, 0x8001, 0x4]}) kernel console output (not intermixed with test programs): nts for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 344.701427][ T56] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 344.705158][ T56] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 344.708365][ T56] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 344.713244][ T56] usb 9-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 344.716610][ T56] usb 9-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 344.719873][ T56] usb 9-1: Manufacturer: syz [ 344.724041][ T56] usb 9-1: config 0 descriptor?? [ 344.843835][ T9950] netlink: zone id is out of range [ 344.846718][ T9950] netlink: del zone limit has 4 unknown bytes [ 344.966905][ T9954] macvlan0: mtu less than device minimum [ 345.136177][ T56] appleir 0003:05AC:8243.0017: unknown main item tag 0x0 [ 345.199839][ T56] appleir 0003:05AC:8243.0017: hiddev0,hidraw1: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 345.265806][ T24] usb 6-1: new full-speed USB device number 60 using dummy_hcd [ 345.433335][ T24] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 345.444797][ T24] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 345.459062][ T24] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 345.468728][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 345.483391][ T9963] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1225'. [ 345.512400][ T9967] syz.3.1226: attempt to access beyond end of device [ 345.512400][ T9967] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 345.518486][ T9967] gfs2: error -5 reading superblock [ 345.995039][ T56] usb 9-1: USB disconnect, device number 35 [ 346.084321][ T9973] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 346.221587][ T42] audit: type=1326 audit(1784310713.026:178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9976 comm="syz.3.1229" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 346.415606][ T5824] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 346.575633][ T5824] usb 5-1: Using ep0 maxpacket: 32 [ 346.579396][ T5824] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 346.582881][ T5824] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 346.586654][ T5824] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 346.589962][ T5824] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 346.595704][ T5824] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 346.598602][ T5824] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 346.601120][ T5824] usb 5-1: Product: syz [ 346.602707][ T5824] usb 5-1: Manufacturer: syz [ 346.604238][ T5824] usb 5-1: SerialNumber: syz [ 346.610070][ C1] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 346.624564][ T5824] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:155.0/input/input19 [ 346.771560][ T9983] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1231'. [ 346.825630][ T5824] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 346.828378][ T5824] (id 0x00) [ 346.869804][ T9986] block nbd4: not configured, cannot reconfigure [ 346.875595][ T5824] rc_core: IR keymap rc-imon-pad not found [ 346.878060][ T5824] Registered IR keymap rc-empty [ 346.879890][ T5824] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 346.883049][ T5824] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 346.914176][ T9988] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1233'. [ 347.013014][ T5824] imon:send_packet: packet tx failed (-71) [ 347.013550][ T24] usb 6-1: usb_control_msg returned -71 [ 347.018164][ T24] usbtmc 6-1:16.0: can't read capabilities [ 347.032459][ T24] usb 6-1: USB disconnect, device number 60 [ 347.037317][ T5824] imon 5-1:155.0: remote input dev register failed [ 347.039577][ T5824] imon 5-1:155.0: imon_init_intf0: rc device setup failed [ 347.101081][ T5824] imon 5-1:155.0: unable to initialize intf0, err 0 [ 347.114164][ T5824] imon:imon_probe: failed to initialize context! [ 347.122129][ T5824] imon 5-1:155.0: unable to register, err -19 [ 347.134509][ T5824] usb 5-1: USB disconnect, device number 74 [ 347.285191][T10002] syz.4.1238: attempt to access beyond end of device [ 347.285191][T10002] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 347.292402][T10002] gfs2: error -5 reading superblock [ 347.455381][T10007] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1237'. [ 347.459544][T10007] overlay: Unknown parameter 'measure' [ 347.825706][ T5852] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 347.986969][ T5852] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 347.994743][ T5852] usb 5-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 348.002743][ T5852] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 348.009361][ T5852] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 348.021051][ T5852] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 348.025844][ T5852] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 348.035609][ T5852] usb 5-1: Product: syz [ 348.037414][ T5852] usb 5-1: Manufacturer: syz [ 348.297389][ T5852] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 348.311557][ T5852] usb 5-1: USB disconnect, device number 75 [ 349.755628][ T24] usb 8-1: new high-speed USB device number 71 using dummy_hcd [ 349.797117][ T42] audit: type=1800 audit(1784310716.596:179): pid=10036 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1244" name="bus" dev="ramfs" ino=33360 res=0 errno=0 [ 349.851280][T10031] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(11) [ 349.853381][T10031] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 349.864634][T10031] vhci_hcd vhci_hcd.0: Device attached [ 349.883644][T10065] syz.1.1249: attempt to access beyond end of device [ 349.883644][T10065] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 349.888436][T10065] gfs2: error -5 reading superblock [ 349.917290][ T24] usb 8-1: Using ep0 maxpacket: 8 [ 349.922004][ T24] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 349.926837][ T24] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 349.931086][ T24] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 349.935164][ T24] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 349.940391][ T24] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 349.943867][ T24] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 350.167082][ T5854] usb 46-1: SetAddress Request (6) to port 0 [ 350.173528][ T5854] usb 46-1: new SuperSpeed USB device number 6 using vhci_hcd [ 350.199579][ T24] usb 8-1: GET_CAPABILITIES returned 0 [ 350.213222][ T24] usbtmc 8-1:16.0: can't read capabilities [ 350.273883][T10078] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1252'. [ 350.309706][T10061] vhci_hcd: connection reset by peer [ 350.314859][T10078] FAULT_INJECTION: forcing a failure. [ 350.314859][T10078] name failslab, interval 1, probability 0, space 0, times 0 [ 350.319750][ T5853] vhci_hcd vhci_hcd.4: stop threads [ 350.319783][ T5853] vhci_hcd vhci_hcd.4: release socket [ 350.319859][ T5853] vhci_hcd vhci_hcd.4: disconnect device [ 350.340130][T10078] CPU: 2 UID: 0 PID: 10078 Comm: syz.1.1252 Tainted: G L syzkaller #0 PREEMPT(full) [ 350.340152][T10078] Tainted: [L]=SOFTLOCKUP [ 350.340156][T10078] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 350.340163][T10078] Call Trace: [ 350.340168][T10078] [ 350.340174][T10078] dump_stack_lvl+0x100/0x190 [ 350.340208][T10078] should_fail_ex.cold+0x5/0xa [ 350.340222][T10078] should_failslab+0xc2/0x120 [ 350.340238][T10078] __kmalloc_node_track_caller_noprof+0xf9/0x830 [ 350.340253][T10078] ? __kasan_kmalloc+0xaa/0xb0 [ 350.340267][T10078] ? __request_module+0x2d5/0x6a0 [ 350.340282][T10078] kstrdup+0x51/0xe0 [ 350.340296][T10078] __request_module+0x2d5/0x6a0 [ 350.340308][T10078] ? __pfx___request_module+0x10/0x10 [ 350.340321][T10078] ? rcu_is_watching+0x12/0xc0 [ 350.340337][T10078] ? crypto_alg_lookup+0x10c/0x1e0 [ 350.340382][T10078] ? crypto_alg_lookup+0x10c/0x1e0 [ 350.340399][T10078] ? crypto_alg_mod_lookup+0x269/0x5d0 [ 350.340416][T10078] crypto_alg_mod_lookup+0x413/0x5d0 [ 350.340434][T10078] crypto_alloc_tfm_node+0xd3/0x260 [ 350.340452][T10078] esp_init_aead.constprop.0+0x109/0x3b0 [ 350.340489][T10078] ? __pfx_esp_init_aead.constprop.0+0x10/0x10 [ 350.340510][T10078] ? find_held_lock+0x2b/0x80 [ 350.340525][T10078] esp6_init_state+0x86/0x500 [ 350.340539][T10078] __xfrm_init_state+0x842/0x1d00 [ 350.340578][T10078] xfrm_add_sa+0x2725/0x5cb0 [ 350.340602][T10078] ? __pfx_xfrm_add_sa+0x10/0x10 [ 350.340621][T10078] ? __nla_parse+0x40/0x60 [ 350.340635][T10078] ? __pfx_xfrm_add_sa+0x10/0x10 [ 350.340654][T10078] xfrm_user_rcv_msg+0x411/0xd00 [ 350.340674][T10078] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 350.340691][T10078] ? stack_trace_save+0x8e/0xc0 [ 350.340706][T10078] ? __pfx_stack_trace_save+0x10/0x10 [ 350.340720][T10078] ? stack_depot_save_flags+0x27/0x9d0 [ 350.340774][T10078] ? rcu_is_watching+0x12/0xc0 [ 350.340787][T10078] ? trace_contention_end+0x126/0x160 [ 350.340806][T10078] ? __mutex_lock+0x26d/0x1bd0 [ 350.340821][T10078] netlink_rcv_skb+0x159/0x420 [ 350.340840][T10078] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 350.340858][T10078] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 350.340886][T10078] xfrm_netlink_rcv+0x71/0x90 [ 350.340902][T10078] netlink_unicast+0x585/0x850 [ 350.340938][T10078] ? __pfx_netlink_unicast+0x10/0x10 [ 350.340963][T10078] netlink_sendmsg+0x8b0/0xda0 [ 350.340983][T10078] ? __pfx_netlink_sendmsg+0x10/0x10 [ 350.341003][T10078] ? apparmor_socket_sendmsg+0x15b/0x270 [ 350.341025][T10078] ____sys_sendmsg+0xa4d/0xbe0 [ 350.341043][T10078] ? __pfx_netlink_sendmsg+0x10/0x10 [ 350.341061][T10078] ? __pfx_____sys_sendmsg+0x10/0x10 [ 350.341085][T10078] ___sys_sendmsg+0x190/0x1e0 [ 350.341107][T10078] ? __pfx____sys_sendmsg+0x10/0x10 [ 350.341132][T10078] ? find_held_lock+0x2b/0x80 [ 350.341154][T10078] __sys_sendmsg+0x160/0x210 [ 350.341169][T10078] ? __pfx___sys_sendmsg+0x10/0x10 [ 350.341186][T10078] ? __pfx_ksys_write+0x10/0x10 [ 350.341207][T10078] __do_fast_syscall_32+0xe7/0x970 [ 350.341220][T10078] ? lockdep_hardirqs_on+0x78/0x100 [ 350.341239][T10078] do_fast_syscall_32+0x32/0x70 [ 350.341251][T10078] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 350.341267][T10078] RIP: 0023:0xf6fcefec [ 350.341283][T10078] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 350.341289][T10078] RSP: 002b:00000000f539c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 350.341300][T10078] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 350.341307][T10078] RDX: 0000000000002014 RSI: 0000000000000000 RDI: 0000000000000000 [ 350.341314][T10078] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 350.341320][T10078] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 350.341327][T10078] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 350.341343][T10078] [ 350.466758][ C2] hpet: Lost 6 RTC interrupts [ 350.610436][T10048] befs: Unknown parameter 'aN%vP\Ucl%' [ 350.677221][ T5824] usb 8-1: USB disconnect, device number 71 [ 351.273773][T10098] bridge0: port 2(bridge_slave_1) entered disabled state [ 351.303343][T10104] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 351.313397][T10104] netlink: 'syz.3.1257': attribute type 21 has an invalid length. [ 351.317582][T10104] netlink: 'syz.3.1257': attribute type 6 has an invalid length. [ 351.321154][T10104] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1257'. [ 351.697802][T10116] netlink: 'syz.4.1263': attribute type 1 has an invalid length. [ 351.793884][T10117] netlink: 'syz.1.1261': attribute type 21 has an invalid length. [ 351.808885][T10116] 8021q: adding VLAN 0 to HW filter on device bond1 [ 351.826800][T10118] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 351.847336][T10117] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1261'. [ 351.852501][T10112] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1261'. [ 351.885951][T10122] macvlan2: entered promiscuous mode [ 351.890303][T10116] random: crng reseeded on system resumption [ 351.892436][T10122] macvlan2: entered allmulticast mode [ 351.903253][T10122] bond1: entered promiscuous mode [ 351.904957][T10122] veth0_to_bond: entered promiscuous mode [ 351.918911][T10122] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 351.923999][T10122] bond1: left promiscuous mode [ 351.928099][T10122] veth0_to_bond: left promiscuous mode [ 353.627794][T10147] FAULT_INJECTION: forcing a failure. [ 353.627794][T10147] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 353.632201][T10147] CPU: 0 UID: 0 PID: 10147 Comm: syz.3.1268 Tainted: G L syzkaller #0 PREEMPT(full) [ 353.632220][T10147] Tainted: [L]=SOFTLOCKUP [ 353.632224][T10147] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 353.632243][T10147] Call Trace: [ 353.632249][T10147] [ 353.632255][T10147] dump_stack_lvl+0x100/0x190 [ 353.632276][T10147] should_fail_ex.cold+0x5/0xa [ 353.632292][T10147] _copy_to_iter+0x5a4/0x1720 [ 353.632313][T10147] ? __pfx__copy_to_iter+0x10/0x10 [ 353.632332][T10147] ? __skb_recv_datagram+0x1b2/0x220 [ 353.632349][T10147] simple_copy_to_iter+0x46/0x90 [ 353.632368][T10147] __skb_datagram_iter+0x129/0x900 [ 353.632385][T10147] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 353.632405][T10147] ? skb_recv_datagram+0x88/0xc0 [ 353.632417][T10147] skb_copy_datagram_iter+0xa1/0x250 [ 353.632437][T10147] netlink_recvmsg+0x27e/0xa90 [ 353.632456][T10147] ? __pfx_netlink_recvmsg+0x10/0x10 [ 353.632472][T10147] ? is_bpf_text_address+0x8a/0x1a0 [ 353.632552][T10147] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 353.632577][T10147] ? __pfx_netlink_recvmsg+0x10/0x10 [ 353.632607][T10147] sock_recvmsg+0x1d5/0x220 [ 353.632625][T10147] ____sys_recvmsg+0x21e/0x670 [ 353.632645][T10147] ? __pfx_____sys_recvmsg+0x10/0x10 [ 353.632667][T10147] ? __lock_acquire+0x49f/0x1a40 [ 353.632687][T10147] ___sys_recvmsg+0x16a/0x1a0 [ 353.632705][T10147] ? __pfx____sys_recvmsg+0x10/0x10 [ 353.632735][T10147] do_recvmmsg+0x54d/0x740 [ 353.632754][T10147] ? __pfx_do_recvmmsg+0x10/0x10 [ 353.632773][T10147] ? find_held_lock+0x2b/0x80 [ 353.632785][T10147] ? ksys_write+0x190/0x250 [ 353.632804][T10147] ? ksys_write+0x190/0x250 [ 353.632826][T10147] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 353.632843][T10147] __sys_recvmmsg+0x21f/0x270 [ 353.632858][T10147] ? __pfx___sys_recvmmsg+0x10/0x10 [ 353.632873][T10147] ? ksys_write+0x1ac/0x250 [ 353.632911][T10147] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 353.632930][T10147] ? __do_fast_syscall_32+0x98/0x970 [ 353.632942][T10147] ? lockdep_hardirqs_on+0x78/0x100 [ 353.632960][T10147] __do_fast_syscall_32+0xe7/0x970 [ 353.632971][T10147] ? lockdep_hardirqs_on+0x78/0x100 [ 353.632990][T10147] do_fast_syscall_32+0x32/0x70 [ 353.633002][T10147] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 353.633018][T10147] RIP: 0023:0xf706efec [ 353.633034][T10147] Code: Unable to access opcode bytes at 0xf706efc2. [ 353.633039][T10147] RSP: 002b:00000000f541b50c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 353.633052][T10147] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080001b40 [ 353.633059][T10147] RDX: 0000000000000007 RSI: 0000000000000000 RDI: 0000000000000000 [ 353.633065][T10147] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 353.633072][T10147] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 353.633078][T10147] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 353.633093][T10147] [ 355.138173][T10167] syz.1.1276: attempt to access beyond end of device [ 355.138173][T10167] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 355.143424][T10167] gfs2: error -5 reading superblock [ 355.269100][ T5854] usb 46-1: device descriptor read/8, error -110 [ 355.627547][ T5824] usb 8-1: new full-speed USB device number 72 using dummy_hcd [ 355.777813][ T5824] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 355.781695][ T5824] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 355.786450][ T5824] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 355.789310][ T5824] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 356.042962][T10185] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1283'. [ 356.214069][ T5854] usb usb46-port1: attempt power cycle [ 357.354418][ T5854] usb usb46-port1: unable to enumerate USB device [ 357.811671][T10188] syz.0.1284: attempt to access beyond end of device [ 357.811671][T10188] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 357.817521][T10188] gfs2: error -5 reading superblock [ 357.893951][ T5824] usb 8-1: usb_control_msg returned -71 [ 357.905823][ T5824] usbtmc 8-1:16.0: can't read capabilities [ 357.925975][ T5824] usb 8-1: USB disconnect, device number 72 [ 358.082024][T10200] Invalid option length (1040493) for dns_resolver key [ 358.465737][ T24] usb 6-1: new full-speed USB device number 61 using dummy_hcd [ 358.608190][T10222] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1298'. [ 358.637068][ T24] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 358.640558][ T24] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 358.644706][ T24] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 358.647673][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.845708][ T8974] usb 5-1: new full-speed USB device number 76 using dummy_hcd [ 359.905223][T10239] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1302'. [ 360.019661][ T8974] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 360.025061][ T8974] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 360.029667][ T8974] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 360.033030][ T8974] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 360.205662][ T846] usb 9-1: new high-speed USB device number 36 using dummy_hcd [ 360.356905][ T846] usb 9-1: too many configurations: 9, using maximum allowed: 8 [ 360.362724][ T846] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 360.367627][ T846] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 360.371822][ T846] usb 9-1: config 0 interface 0 has no altsetting 0 [ 360.376907][ T846] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 360.380873][ T846] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 360.386433][ T846] usb 9-1: config 0 interface 0 has no altsetting 0 [ 360.395222][ T846] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 360.399749][ T846] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 360.405973][ T846] usb 9-1: config 0 interface 0 has no altsetting 0 [ 360.412061][ T846] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 360.416300][ T846] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 360.421012][ T846] usb 9-1: config 0 interface 0 has no altsetting 0 [ 360.424947][ T846] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 360.428658][ T846] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 360.432685][ T846] usb 9-1: config 0 interface 0 has no altsetting 0 [ 360.435827][ T846] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 360.438860][ T846] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 360.443602][ T846] usb 9-1: config 0 interface 0 has no altsetting 0 [ 360.448112][ T846] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 360.452175][ T846] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 360.457881][ T846] usb 9-1: config 0 interface 0 has no altsetting 0 [ 360.463274][ T846] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 360.468347][ T846] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 360.473040][ T846] usb 9-1: config 0 interface 0 has no altsetting 0 [ 360.479861][ T846] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 360.483502][ T846] usb 9-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 360.486918][ T846] usb 9-1: Product: syz [ 360.488836][ T846] usb 9-1: Manufacturer: syz [ 360.490697][ T846] usb 9-1: SerialNumber: syz [ 360.494732][ T846] usb 9-1: config 0 descriptor?? [ 360.502675][ T846] yurex 9-1:0.0: USB YUREX device now attached to Yurex #0 [ 360.610612][ T24] usb 6-1: usb_control_msg returned -71 [ 360.612484][ T24] usbtmc 6-1:16.0: can't read capabilities [ 360.618526][ T24] usb 6-1: USB disconnect, device number 61 [ 360.756041][T10244] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 360.758938][T10244] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 360.910408][T10249] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1304'. [ 360.913224][T10249] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1304'. [ 361.338741][T10261] usb usb1: usbfs: process 10261 (syz.1.1310) did not claim interface 0 before use [ 361.455641][ T24] usb 8-1: new high-speed USB device number 73 using dummy_hcd [ 361.605736][ T24] usb 8-1: Using ep0 maxpacket: 32 [ 361.610318][ T24] usb 8-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 361.614053][ T24] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 361.620451][ T24] usb 8-1: config 0 descriptor?? [ 361.630495][ T24] as10x_usb: device has been detected [ 361.634697][ T24] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 361.644922][ T24] usb 8-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 361.652874][ T24] as10x_usb: error during firmware upload part1 [ 361.656553][ T24] Registered device nBox DVB-T Dongle [ 361.668831][ T8974] usb 5-1: usb_control_msg returned -71 [ 361.673966][ T8974] usbtmc 5-1:16.0: can't read capabilities [ 361.681627][ T8974] usb 5-1: USB disconnect, device number 76 [ 361.878781][ T5824] usb 8-1: USB disconnect, device number 73 [ 361.892272][ T5824] Unregistered device nBox DVB-T Dongle [ 362.091010][T10263] binder: 10253:10263 ioctl c028660f 800001c0 returned -22 [ 362.475664][ T846] usb 5-1: new full-speed USB device number 77 using dummy_hcd [ 362.647504][ T846] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 362.650836][ T846] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 362.655215][ T846] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 362.658193][ T846] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 362.754318][T10275] syzkaller0: entered promiscuous mode [ 362.757716][T10275] syzkaller0: entered allmulticast mode [ 362.769754][T10275] Cannot find add_set index 2 as target [ 362.779548][ C0] usb 9-1: yurex_control_callback - control failed: -2 [ 362.783057][ T5824] as10x_usb: device has been disconnected [ 362.800033][ T5854] usb 9-1: USB disconnect, device number 36 [ 362.839654][ T5854] yurex 9-1:0.0: USB YUREX #0 now disconnected [ 363.357730][ T5854] usb 6-1: new full-speed USB device number 62 using dummy_hcd [ 363.374316][T10286] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1319'. [ 363.433290][T10288] syzkaller0: entered promiscuous mode [ 363.435452][T10288] syzkaller0: entered allmulticast mode [ 363.567062][ T5854] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 363.585866][ T5854] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 363.594388][ T5854] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 363.605674][ T5854] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.609529][T10296] syzkaller0: entered promiscuous mode [ 363.611556][T10296] syzkaller0: entered allmulticast mode [ 363.616373][T10296] FAULT_INJECTION: forcing a failure. [ 363.616373][T10296] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 363.620548][T10296] CPU: 0 UID: 0 PID: 10296 Comm: syz.3.1323 Tainted: G L syzkaller #0 PREEMPT(full) [ 363.620566][T10296] Tainted: [L]=SOFTLOCKUP [ 363.620570][T10296] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 363.620577][T10296] Call Trace: [ 363.620582][T10296] [ 363.620587][T10296] dump_stack_lvl+0x100/0x190 [ 363.620606][T10296] should_fail_ex.cold+0x5/0xa [ 363.620622][T10296] _copy_from_user+0x2e/0xd0 [ 363.620657][T10296] move_addr_to_kernel+0x65/0x170 [ 363.620680][T10296] get_compat_msghdr+0x3c7/0x480 [ 363.620698][T10296] ? __pfx_get_compat_msghdr+0x10/0x10 [ 363.620718][T10296] ___sys_sendmsg+0x1b6/0x1e0 [ 363.620761][T10296] ? __pfx____sys_sendmsg+0x10/0x10 [ 363.620788][T10296] ? find_held_lock+0x2b/0x80 [ 363.620812][T10296] __sys_sendmsg+0x160/0x210 [ 363.620826][T10296] ? __pfx___sys_sendmsg+0x10/0x10 [ 363.620844][T10296] ? __pfx_ksys_write+0x10/0x10 [ 363.620867][T10296] __do_fast_syscall_32+0xe7/0x970 [ 363.620882][T10296] ? lockdep_hardirqs_on+0x78/0x100 [ 363.620901][T10296] do_fast_syscall_32+0x32/0x70 [ 363.620913][T10296] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 363.620929][T10296] RIP: 0023:0xf706efec [ 363.620944][T10296] Code: Unable to access opcode bytes at 0xf706efc2. [ 363.620949][T10296] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 363.620961][T10296] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800000c0 [ 363.620972][T10296] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 363.620978][T10296] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 363.620985][T10296] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 363.620995][T10296] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 363.621010][T10296] [ 363.782105][T10301] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1322'. [ 363.802733][T10297] efs: device does not support 512 byte blocks [ 363.805306][T10297] device does not support 512 byte blocks [ 363.805306][T10297] [ 364.204446][ T5854] usb 6-1: usb_control_msg returned -71 [ 364.206838][ T5854] usbtmc 6-1:16.0: can't read capabilities [ 364.234298][ T5854] usb 6-1: USB disconnect, device number 62 [ 364.281116][ T846] usb 5-1: usb_control_msg returned -71 [ 364.283035][ T846] usbtmc 5-1:16.0: can't read capabilities [ 364.288410][ T846] usb 5-1: USB disconnect, device number 77 [ 364.755642][ T846] usb 9-1: new high-speed USB device number 37 using dummy_hcd [ 364.850914][T10313] digital: digital_start_poll: Unknown protocol [ 364.905956][ T846] usb 9-1: Using ep0 maxpacket: 8 [ 364.910789][ T846] usb 9-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 364.915238][ T846] usb 9-1: config 1 interface 0 has no altsetting 0 [ 364.920132][ T846] usb 9-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.40 [ 364.924350][ T846] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.929004][ T846] usb 9-1: Product: syz [ 364.930761][ T846] usb 9-1: Manufacturer: syz [ 364.932485][ T846] usb 9-1: SerialNumber: syz [ 365.105765][ T8974] usb 8-1: new high-speed USB device number 74 using dummy_hcd [ 365.133319][T10320] syzkaller0: entered promiscuous mode [ 365.136004][T10320] syzkaller0: entered allmulticast mode [ 365.144014][T10307] tmpfs: Bad value for 'mpol' [ 365.192149][ T846] usbhid 9-1:1.0: can't add hid device: -71 [ 365.194469][ T846] usbhid 9-1:1.0: probe with driver usbhid failed with error -71 [ 365.199181][ T846] usb 9-1: USB disconnect, device number 37 [ 365.255714][ T8974] usb 8-1: Using ep0 maxpacket: 32 [ 365.259743][ T8974] usb 8-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 365.263492][ T8974] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 365.287601][ T8974] usb 8-1: config 0 descriptor?? [ 365.303213][ T8974] as10x_usb: device has been detected [ 365.306581][ T8974] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 365.324102][ T8974] usb 8-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 365.330723][ T8974] as10x_usb: error during firmware upload part1 [ 365.332994][ T8974] Registered device nBox DVB-T Dongle [ 365.369940][T10324] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 365.495415][ T34] usb 8-1: USB disconnect, device number 74 [ 365.614432][ T34] Unregistered device nBox DVB-T Dongle [ 365.627937][ T34] as10x_usb: device has been disconnected [ 365.714346][T10311] binder: 10308:10311 ioctl c028660f 800001c0 returned -22 [ 365.919455][T10362] netlink: 'syz.1.1340': attribute type 11 has an invalid length. [ 365.975397][T10362] mac80211_hwsim hwsim7 wlan0: entered promiscuous mode [ 365.980253][T10362] mac80211_hwsim hwsim7 wlan0: entered allmulticast mode [ 366.016027][ T8974] usb 9-1: new high-speed USB device number 38 using dummy_hcd [ 366.165633][ T8974] usb 9-1: Using ep0 maxpacket: 16 [ 366.169937][ T8974] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 366.173981][ T8974] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 366.178641][ T8974] usb 9-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 366.181736][ T8974] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 366.186095][ T8974] usb 9-1: config 0 descriptor?? [ 366.295718][ T50] usb 6-1: new full-speed USB device number 63 using dummy_hcd [ 366.414107][T10352] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 366.418818][T10352] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 366.441942][T10377] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 366.449290][ T50] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 366.465615][ T50] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 366.472140][ T50] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 366.479252][ T50] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 366.627856][ T8974] usbhid 9-1:0.0: can't add hid device: -71 [ 366.630414][ T8974] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 366.636028][ T8974] usb 9-1: USB disconnect, device number 38 [ 367.625897][ T8974] usb 8-1: new high-speed USB device number 75 using dummy_hcd [ 367.775684][ T8974] usb 8-1: Using ep0 maxpacket: 8 [ 367.782272][ T8974] usb 8-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 367.786561][ T8974] usb 8-1: config 1 interface 0 has no altsetting 0 [ 367.814710][ T8974] usb 8-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.40 [ 367.817607][ T8974] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.820556][ T8974] usb 8-1: Product: syz [ 367.822313][ T8974] usb 8-1: Manufacturer: syz [ 367.824922][ T8974] usb 8-1: SerialNumber: syz [ 368.033004][T10388] tmpfs: Bad value for 'mpol' [ 368.041335][ T50] usb 6-1: usb_control_msg returned -71 [ 368.043106][ T50] usbtmc 6-1:16.0: can't read capabilities [ 368.054170][ T50] usb 6-1: USB disconnect, device number 63 [ 368.154243][ T8974] usbhid 8-1:1.0: can't add hid device: -71 [ 368.157423][ T8974] usbhid 8-1:1.0: probe with driver usbhid failed with error -71 [ 368.168335][ T8974] usb 8-1: USB disconnect, device number 75 [ 368.620729][T10402] IPVS: persistence engine module ip_vs_pe_sir not found [ 368.826496][ T50] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 368.995696][ T50] usb 6-1: Using ep0 maxpacket: 32 [ 369.001338][ T50] usb 6-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 369.004943][ T50] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.010538][ T50] usb 6-1: config 0 descriptor?? [ 369.017761][ T50] as10x_usb: device has been detected [ 369.020702][ T50] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 369.028419][ T50] usb 6-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 369.033851][ T50] as10x_usb: error during firmware upload part1 [ 369.036408][ T50] Registered device nBox DVB-T Dongle [ 369.221538][ T846] usb 6-1: USB disconnect, device number 64 [ 369.256494][ T846] Unregistered device nBox DVB-T Dongle [ 369.261051][ T846] as10x_usb: device has been disconnected [ 369.276218][ T42] audit: type=1326 audit(1784310736.086:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10420 comm="syz.4.1355" exe="/syz-executor" sig=31 arch=40000003 syscall=20 compat=1 ip=0xf702efec code=0x0 [ 370.002900][T10428] syz.1.1358 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 370.102514][ T24] usb 8-1: new low-speed USB device number 76 using dummy_hcd [ 370.244980][T10437] syz.1.1362: attempt to access beyond end of device [ 370.244980][T10437] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 370.256744][T10437] gfs2: error -5 reading superblock [ 370.268122][ T24] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 370.273849][ T24] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 370.281071][ T24] usb 8-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 370.297670][ T24] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 370.300880][ T24] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 370.306311][ T24] usb 8-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 370.312969][ T24] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 370.316430][ T24] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 370.320857][ T24] usb 8-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 370.330304][ T24] usb 8-1: string descriptor 0 read error: -22 [ 370.333504][ T24] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 370.337537][ T24] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 370.347764][ T24] adutux 8-1:168.0: interrupt endpoints not found [ 370.574295][T10447] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 370.752554][ T9] kernel read not supported for file /sequencer (pid: 9 comm: kworker/0:0) [ 370.853372][T10457] loop5: detected capacity change from 0 to 7 [ 370.888129][ C0] invalid error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 370.892570][ C0] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 371.884025][T10475] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 372.451597][T10492] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 372.645959][T10498] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1385'. [ 372.651271][ T5824] usb 8-1: USB disconnect, device number 76 [ 372.786154][T10500] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 372.913538][T10509] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1390'. [ 373.105702][ T5824] usb 8-1: new high-speed USB device number 77 using dummy_hcd [ 373.111715][T10517] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1394'. [ 373.236380][ T9] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 373.255644][ T5824] usb 8-1: Using ep0 maxpacket: 8 [ 373.261080][ T5824] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 373.264539][ T5824] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 373.268855][ T5824] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 373.279857][ T5824] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 373.286095][ T5824] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 373.292269][ T5824] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 373.296929][ T5824] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.337312][T10520] loop6: detected capacity change from 0 to 2640 [ 373.384538][ T5745] Buffer I/O error on dev loop6, logical block 0, async page read [ 373.385705][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 373.392050][ T9] usb 6-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 373.392812][ T5745] Buffer I/O error on dev loop6, logical block 0, async page read [ 373.397041][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.400125][ T5745] Buffer I/O error on dev loop6, logical block 0, async page read [ 373.407318][ T9] usb 6-1: config 0 descriptor?? [ 373.411703][ T5745] Buffer I/O error on dev loop6, logical block 0, async page read [ 373.420563][ T5745] Buffer I/O error on dev loop6, logical block 0, async page read [ 373.425360][ T9] as10x_usb: device has been detected [ 373.429900][ T9] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 373.444103][ T9] usb 6-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 373.451931][ T9] as10x_usb: error during firmware upload part1 [ 373.456892][ T9] Registered device nBox DVB-T Dongle [ 373.617552][ T9] usb 6-1: USB disconnect, device number 65 [ 373.639605][ T9] Unregistered device nBox DVB-T Dongle [ 373.641932][ T9] as10x_usb: device has been disconnected [ 374.159135][T10526] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 374.466041][T10535] No source specified [ 374.728915][T10542] syz.1.1402: attempt to access beyond end of device [ 374.728915][T10542] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 374.733425][T10542] gfs2: error -5 reading superblock [ 375.304291][T10554] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1404'. [ 375.969744][ T5824] usb 8-1: USB disconnect, device number 77 [ 376.108270][T10559] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1406'. [ 376.118397][T10559] FAULT_INJECTION: forcing a failure. [ 376.118397][T10559] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 376.122832][T10559] CPU: 0 UID: 0 PID: 10559 Comm: syz.3.1406 Tainted: G L syzkaller #0 PREEMPT(full) [ 376.122854][T10559] Tainted: [L]=SOFTLOCKUP [ 376.122858][T10559] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 376.122866][T10559] Call Trace: [ 376.122872][T10559] [ 376.122878][T10559] dump_stack_lvl+0x100/0x190 [ 376.122899][T10559] should_fail_ex.cold+0x5/0xa [ 376.122914][T10559] _copy_from_user+0x2e/0xd0 [ 376.122931][T10559] get_compat_msghdr+0xb3/0x480 [ 376.122959][T10559] ? __pfx_get_compat_msghdr+0x10/0x10 [ 376.122976][T10559] ? rcu_is_watching+0x12/0xc0 [ 376.122990][T10559] ? ___sys_sendmsg+0x19d/0x1e0 [ 376.123008][T10559] ? kfree+0x1e5/0x6c0 [ 376.123027][T10559] ? __pfx__kstrtoull+0x10/0x10 [ 376.123040][T10559] ___sys_sendmsg+0x1b6/0x1e0 [ 376.123058][T10559] ? __pfx____sys_sendmsg+0x10/0x10 [ 376.123075][T10559] ? __lock_acquire+0x49f/0x1a40 [ 376.123105][T10559] ? __pfx___might_resched+0x10/0x10 [ 376.123127][T10559] __sys_sendmmsg+0x309/0x440 [ 376.123143][T10559] ? __pfx___sys_sendmmsg+0x10/0x10 [ 376.123156][T10559] ? find_held_lock+0x2b/0x80 [ 376.123179][T10559] ? __mutex_unlock_slowpath+0x35d/0x930 [ 376.123214][T10559] ? fput+0x79/0x100 [ 376.123232][T10559] ? ksys_write+0x1ac/0x250 [ 376.123259][T10559] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 376.123275][T10559] ? lockdep_hardirqs_on+0x78/0x100 [ 376.123294][T10559] __do_fast_syscall_32+0xe7/0x970 [ 376.123306][T10559] ? lockdep_hardirqs_on+0x78/0x100 [ 376.123324][T10559] do_fast_syscall_32+0x32/0x70 [ 376.123336][T10559] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 376.123352][T10559] RIP: 0023:0xf706efec [ 376.123367][T10559] Code: Unable to access opcode bytes at 0xf706efc2. [ 376.123373][T10559] RSP: 002b:00000000f543c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 376.123384][T10559] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080004d00 [ 376.123392][T10559] RDX: 0000000000000300 RSI: 0000000000000f1c RDI: 0000000000000000 [ 376.123398][T10559] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 376.123405][T10559] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 376.123412][T10559] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 376.123427][T10559] [ 376.400545][T10561] FAULT_INJECTION: forcing a failure. [ 376.400545][T10561] name failslab, interval 1, probability 0, space 0, times 0 [ 376.405044][T10561] CPU: 0 UID: 0 PID: 10561 Comm: syz.0.1407 Tainted: G L syzkaller #0 PREEMPT(full) [ 376.405071][T10561] Tainted: [L]=SOFTLOCKUP [ 376.405078][T10561] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 376.405088][T10561] Call Trace: [ 376.405095][T10561] [ 376.405102][T10561] dump_stack_lvl+0x100/0x190 [ 376.405127][T10561] should_fail_ex.cold+0x5/0xa [ 376.405140][T10561] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 376.405163][T10561] should_failslab+0xc2/0x120 [ 376.405180][T10561] kmem_cache_alloc_noprof+0x91/0x6a0 [ 376.405200][T10561] ? skb_clone+0x190/0x400 [ 376.405217][T10561] skb_clone+0x190/0x400 [ 376.405232][T10561] netlink_deliver_tap+0xaed/0xcc0 [ 376.405256][T10561] netlink_unicast+0x6a5/0x850 [ 376.405276][T10561] ? __pfx_netlink_unicast+0x10/0x10 [ 376.405298][T10561] netlink_ack+0x655/0xb80 [ 376.405319][T10561] netlink_rcv_skb+0x333/0x420 [ 376.405337][T10561] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 376.405354][T10561] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 376.405378][T10561] ? ns_capable+0xd2/0xf0 [ 376.405393][T10561] nfnetlink_rcv+0x1b3/0x440 [ 376.405407][T10561] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 376.405419][T10561] ? rcu_is_watching+0x12/0xc0 [ 376.405436][T10561] netlink_unicast+0x585/0x850 [ 376.405456][T10561] ? __pfx_netlink_unicast+0x10/0x10 [ 376.405477][T10561] netlink_sendmsg+0x8b0/0xda0 [ 376.405498][T10561] ? __pfx_netlink_sendmsg+0x10/0x10 [ 376.405530][T10561] ? apparmor_socket_sendmsg+0x15b/0x270 [ 376.405553][T10561] ____sys_sendmsg+0xa4d/0xbe0 [ 376.405570][T10561] ? __pfx_netlink_sendmsg+0x10/0x10 [ 376.405588][T10561] ? __pfx_____sys_sendmsg+0x10/0x10 [ 376.405608][T10561] ? __lock_acquire+0x49f/0x1a40 [ 376.405628][T10561] ___sys_sendmsg+0x190/0x1e0 [ 376.405647][T10561] ? __pfx____sys_sendmsg+0x10/0x10 [ 376.405664][T10561] ? find_held_lock+0x2b/0x80 [ 376.405683][T10561] ? find_held_lock+0x2b/0x80 [ 376.405705][T10561] __sys_sendmsg+0x160/0x210 [ 376.405720][T10561] ? __pfx___sys_sendmsg+0x10/0x10 [ 376.405741][T10561] __do_fast_syscall_32+0xe7/0x970 [ 376.405754][T10561] ? lockdep_hardirqs_on+0x78/0x100 [ 376.405773][T10561] do_fast_syscall_32+0x32/0x70 [ 376.405785][T10561] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 376.405801][T10561] RIP: 0023:0xf706efec [ 376.405816][T10561] Code: Unable to access opcode bytes at 0xf706efc2. [ 376.405822][T10561] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 376.405833][T10561] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000340 [ 376.405840][T10561] RDX: 0000000024000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 376.405848][T10561] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 376.405854][T10561] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 376.405861][T10561] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 376.405876][T10561] [ 377.956892][T10585] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 377.959815][T10585] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 378.036342][T10588] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1414'. [ 378.228392][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.231718][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.325716][ T5824] kernel read not supported for file /sequencer (pid: 5824 comm: kworker/1:3) [ 378.328733][T10597] FAULT_INJECTION: forcing a failure. [ 378.328733][T10597] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 378.336201][T10597] CPU: 1 UID: 0 PID: 10597 Comm: syz.4.1416 Tainted: G L syzkaller #0 PREEMPT(full) [ 378.336221][T10597] Tainted: [L]=SOFTLOCKUP [ 378.336226][T10597] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 378.336233][T10597] Call Trace: [ 378.336238][T10597] [ 378.336243][T10597] dump_stack_lvl+0x100/0x190 [ 378.336263][T10597] should_fail_ex.cold+0x5/0xa [ 378.336277][T10597] _copy_from_user+0x2e/0xd0 [ 378.336295][T10597] snd_seq_oss_write+0x3d5/0x8b0 [ 378.336352][T10597] ? __pfx_snd_seq_oss_write+0x10/0x10 [ 378.336373][T10597] ? apparmor_file_permission+0x13f/0x1c0 [ 378.336389][T10597] ? bpf_lsm_file_permission+0x9/0x10 [ 378.336411][T10597] odev_write+0x51/0xa0 [ 378.336427][T10597] vfs_write+0x2aa/0x1050 [ 378.336446][T10597] ? __pfx_odev_write+0x10/0x10 [ 378.336462][T10597] ? __pfx_vfs_write+0x10/0x10 [ 378.336477][T10597] ? find_held_lock+0x2b/0x80 [ 378.336491][T10597] ? __fget_files+0x215/0x3d0 [ 378.336508][T10597] ? __fget_files+0x215/0x3d0 [ 378.336548][T10597] ? __fget_files+0x21f/0x3d0 [ 378.336570][T10597] ksys_write+0x12a/0x250 [ 378.336586][T10597] ? __pfx_ksys_write+0x10/0x10 [ 378.336602][T10597] ? ksys_write+0x1ac/0x250 [ 378.336618][T10597] ? __pfx_ksys_write+0x10/0x10 [ 378.336638][T10597] __do_fast_syscall_32+0xe7/0x970 [ 378.336651][T10597] ? lockdep_hardirqs_on+0x78/0x100 [ 378.336670][T10597] do_fast_syscall_32+0x32/0x70 [ 378.336682][T10597] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 378.336698][T10597] RIP: 0023:0xf702efec [ 378.336714][T10597] Code: Unable to access opcode bytes at 0xf702efc2. [ 378.336719][T10597] RSP: 002b:00000000f53fc50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 378.336731][T10597] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000500 [ 378.336738][T10597] RDX: 0000000000000052 RSI: 0000000000000000 RDI: 0000000000000000 [ 378.336744][T10597] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 378.336751][T10597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 378.336757][T10597] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 378.336772][T10597] [ 378.543953][T10600] x_tables: duplicate underflow at hook 1 [ 378.565491][T10600] (syz.4.1417,10600,1):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 378.569777][T10600] (syz.4.1417,10600,1):ocfs2_fill_super:1177 ERROR: status = -22 [ 378.613156][T10603] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1418'. [ 378.623055][T10603] ipvlan2: entered allmulticast mode [ 378.624857][T10603] dummy0: entered allmulticast mode [ 378.948901][T10610] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1420'. [ 379.589871][T10620] mac80211_hwsim hwsim7 syzkaller0: left promiscuous mode [ 379.594361][T10620] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode [ 379.806845][T10625] ip6t_REJECT: ECHOREPLY is not supported [ 379.840178][T10625] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 380.202369][T10638] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 380.208028][T10638] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 380.217915][T10638] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 380.231893][T10638] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 380.246156][T10638] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 380.295297][T10641] syz.0.1430: attempt to access beyond end of device [ 380.295297][T10641] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 380.301096][T10641] gfs2: error -5 reading superblock [ 380.677711][T10639] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 380.707500][T10647] bridge1: entered promiscuous mode [ 381.392089][T10662] 9pnet: p9_errstr2errno: server reported unknown error p [ 381.717062][ T8974] usb 8-1: new high-speed USB device number 78 using dummy_hcd [ 381.865945][ T8974] usb 8-1: Using ep0 maxpacket: 8 [ 381.870742][ T8974] usb 8-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 381.875851][ T8974] usb 8-1: config 1 interface 0 has no altsetting 0 [ 381.881152][T10677] FAULT_INJECTION: forcing a failure. [ 381.881152][T10677] name failslab, interval 1, probability 0, space 0, times 0 [ 381.888565][T10677] CPU: 2 UID: 0 PID: 10677 Comm: syz.0.1439 Tainted: G L syzkaller #0 PREEMPT(full) [ 381.888585][T10677] Tainted: [L]=SOFTLOCKUP [ 381.888590][T10677] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 381.888597][T10677] Call Trace: [ 381.888602][T10677] [ 381.888606][T10677] dump_stack_lvl+0x100/0x190 [ 381.888642][T10677] should_fail_ex.cold+0x5/0xa [ 381.888656][T10677] should_failslab+0xc2/0x120 [ 381.888672][T10677] __kmalloc_cache_noprof+0x91/0x6c0 [ 381.888691][T10677] ? copy_mount_options+0x55/0x190 [ 381.888710][T10677] copy_mount_options+0x55/0x190 [ 381.888726][T10677] __ia32_sys_mount+0x1ab/0x310 [ 381.888739][T10677] ? __pfx___ia32_sys_mount+0x10/0x10 [ 381.888751][T10677] ? ksys_write+0x1ac/0x250 [ 381.888770][T10677] ? __pfx_ksys_write+0x10/0x10 [ 381.888789][T10677] __do_fast_syscall_32+0xe7/0x970 [ 381.888803][T10677] ? lockdep_hardirqs_on+0x78/0x100 [ 381.888822][T10677] do_fast_syscall_32+0x32/0x70 [ 381.888834][T10677] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 381.888850][T10677] RIP: 0023:0xf706efec [ 381.888864][T10677] Code: Unable to access opcode bytes at 0xf706efc2. [ 381.888870][T10677] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 381.888882][T10677] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000800000c0 [ 381.888890][T10677] RDX: 0000000080004500 RSI: 0000000000000000 RDI: 0000000080000100 [ 381.888897][T10677] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 381.888903][T10677] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 381.888910][T10677] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 381.888924][T10677] [ 381.894128][ T8974] usb 8-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.40 [ 381.982483][ T8974] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.987525][ T8974] usb 8-1: Product: syz [ 381.988827][ T8974] usb 8-1: Manufacturer: syz [ 381.992823][ T8974] usb 8-1: SerialNumber: syz [ 382.220500][T10669] tmpfs: Bad value for 'mpol' [ 382.315037][ T8974] usbhid 8-1:1.0: can't add hid device: -71 [ 382.317768][ T8974] usbhid 8-1:1.0: probe with driver usbhid failed with error -71 [ 382.323079][ T8974] usb 8-1: USB disconnect, device number 78 [ 382.352540][T10692] fuse: blksize only supported for fuseblk [ 382.560346][T10699] fuse: root generation should be zero [ 382.664943][T10706] FAULT_INJECTION: forcing a failure. [ 382.664943][T10706] name failslab, interval 1, probability 0, space 0, times 0 [ 382.670368][T10706] CPU: 1 UID: 0 PID: 10706 Comm: syz.0.1449 Tainted: G L syzkaller #0 PREEMPT(full) [ 382.670399][T10706] Tainted: [L]=SOFTLOCKUP [ 382.670408][T10706] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 382.670421][T10706] Call Trace: [ 382.670430][T10706] [ 382.670438][T10706] dump_stack_lvl+0x100/0x190 [ 382.670470][T10706] should_fail_ex.cold+0x5/0xa [ 382.670496][T10706] should_failslab+0xc2/0x120 [ 382.670524][T10706] __kmalloc_noprof+0xfc/0x820 [ 382.670549][T10706] ? rfkill_alloc+0xb1/0x300 [ 382.670584][T10706] rfkill_alloc+0xb1/0x300 [ 382.670616][T10706] wiphy_new_nm+0x136a/0x21a0 [ 382.670682][T10706] ? __pfx_ieee80211_emulate_remove_chanctx+0x10/0x10 [ 382.670730][T10706] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 382.670750][T10706] ? __pfx_mac80211_hwsim_link_info_changed+0x10/0x10 [ 382.670781][T10706] ieee80211_alloc_hw_nm+0x1afc/0x22e0 [ 382.670802][T10706] ? __local_bh_enable_ip+0x9e/0x120 [ 382.670830][T10706] mac80211_hwsim_new_radio+0x1de/0x64c0 [ 382.670858][T10706] ? __nla_parse+0x40/0x60 [ 382.670883][T10706] ? parse_pmsr_capa+0x128/0x700 [ 382.670902][T10706] ? parse_pmsr_capa+0x383/0x700 [ 382.670921][T10706] ? __pfx_parse_pmsr_capa+0x10/0x10 [ 382.670938][T10706] ? kasan_save_track+0x14/0x30 [ 382.670964][T10706] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 382.670991][T10706] ? hwsim_new_radio_nl+0xbcf/0x13f0 [ 382.671019][T10706] hwsim_new_radio_nl+0xc6b/0x13f0 [ 382.671045][T10706] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 382.671076][T10706] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 382.671099][T10706] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 382.671127][T10706] genl_family_rcv_msg_doit+0x214/0x300 [ 382.671157][T10706] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 382.671178][T10706] ? genl_get_cmd+0x3e7/0x760 [ 382.671204][T10706] ? bpf_lsm_capable+0x9/0x10 [ 382.671224][T10706] ? security_capable+0x80/0x260 [ 382.671258][T10706] ? ns_capable+0xd2/0xf0 [ 382.671280][T10706] genl_rcv_msg+0x560/0x800 [ 382.671303][T10706] ? __pfx_genl_rcv_msg+0x10/0x10 [ 382.671324][T10706] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 382.671358][T10706] netlink_rcv_skb+0x159/0x420 [ 382.671387][T10706] ? __pfx_genl_rcv_msg+0x10/0x10 [ 382.671410][T10706] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 382.671449][T10706] ? netlink_deliver_tap+0x1ae/0xcc0 [ 382.671481][T10706] genl_rcv+0x28/0x40 [ 382.671500][T10706] netlink_unicast+0x585/0x850 [ 382.671533][T10706] ? __pfx_netlink_unicast+0x10/0x10 [ 382.671569][T10706] netlink_sendmsg+0x8b0/0xda0 [ 382.671602][T10706] ? __pfx_netlink_sendmsg+0x10/0x10 [ 382.671635][T10706] ? apparmor_socket_sendmsg+0x15b/0x270 [ 382.671670][T10706] ____sys_sendmsg+0xa4d/0xbe0 [ 382.671698][T10706] ? __pfx_netlink_sendmsg+0x10/0x10 [ 382.671729][T10706] ? __pfx_____sys_sendmsg+0x10/0x10 [ 382.671770][T10706] ___sys_sendmsg+0x190/0x1e0 [ 382.671800][T10706] ? __pfx____sys_sendmsg+0x10/0x10 [ 382.671842][T10706] ? find_held_lock+0x2b/0x80 [ 382.671883][T10706] __sys_sendmsg+0x160/0x210 [ 382.671907][T10706] ? __pfx___sys_sendmsg+0x10/0x10 [ 382.671938][T10706] ? __pfx_ksys_write+0x10/0x10 [ 382.671972][T10706] __do_fast_syscall_32+0xe7/0x970 [ 382.671994][T10706] ? lockdep_hardirqs_on+0x78/0x100 [ 382.672026][T10706] do_fast_syscall_32+0x32/0x70 [ 382.672046][T10706] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 382.672071][T10706] RIP: 0023:0xf706efec [ 382.672096][T10706] Code: Unable to access opcode bytes at 0xf706efc2. [ 382.672105][T10706] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 382.672126][T10706] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 382.672143][T10706] RDX: 0000000000000084 RSI: 0000000000000000 RDI: 0000000000000000 [ 382.672155][T10706] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 382.672166][T10706] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 382.672177][T10706] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 382.672203][T10706] [ 382.810416][ T5824] usb 6-1: new full-speed USB device number 66 using dummy_hcd [ 382.852071][T10708] FAULT_INJECTION: forcing a failure. [ 382.852071][T10708] name failslab, interval 1, probability 0, space 0, times 0 [ 382.857633][T10708] CPU: 2 UID: 0 PID: 10708 Comm: syz.3.1450 Tainted: G L syzkaller #0 PREEMPT(full) [ 382.857661][T10708] Tainted: [L]=SOFTLOCKUP [ 382.857668][T10708] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 382.857678][T10708] Call Trace: [ 382.857684][T10708] [ 382.857691][T10708] dump_stack_lvl+0x100/0x190 [ 382.857722][T10708] should_fail_ex.cold+0x5/0xa [ 382.857747][T10708] should_failslab+0xc2/0x120 [ 382.857770][T10708] __kmalloc_noprof+0xfc/0x820 [ 382.857788][T10708] ? rcu_is_watching+0x12/0xc0 [ 382.857807][T10708] ? tomoyo_realpath_from_path+0xb6/0x690 [ 382.857852][T10708] tomoyo_realpath_from_path+0xb6/0x690 [ 382.857885][T10708] tomoyo_path_number_perm+0x23c/0x580 [ 382.857908][T10708] ? tomoyo_path_number_perm+0x22e/0x580 [ 382.857928][T10708] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 382.857947][T10708] ? get_pid_task+0x106/0x250 [ 382.857989][T10708] ? find_held_lock+0x2b/0x80 [ 382.858008][T10708] ? __fget_files+0x215/0x3d0 [ 382.858034][T10708] ? hook_file_ioctl_common+0x140/0x440 [ 382.858058][T10708] ? __fget_files+0x215/0x3d0 [ 382.858085][T10708] ? __fget_files+0x21f/0x3d0 [ 382.858112][T10708] security_file_ioctl_compat+0xd3/0x230 [ 382.858132][T10708] __ia32_compat_sys_ioctl+0xc2/0x360 [ 382.858157][T10708] __do_fast_syscall_32+0xe7/0x970 [ 382.858178][T10708] ? lockdep_hardirqs_on+0x78/0x100 [ 382.858210][T10708] do_fast_syscall_32+0x32/0x70 [ 382.858227][T10708] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 382.858248][T10708] RIP: 0023:0xf706efec [ 382.858268][T10708] Code: Unable to access opcode bytes at 0xf706efc2. [ 382.858275][T10708] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 382.858292][T10708] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c008561c [ 382.858303][T10708] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 382.858314][T10708] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 382.858324][T10708] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 382.858335][T10708] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 382.858362][T10708] [ 382.859015][T10708] ERROR: Out of memory at tomoyo_realpath_from_path. [ 382.987178][ T5824] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 382.990409][ T5824] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 382.994345][ T5824] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 382.997421][ T5824] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 383.099220][T10713] loop6: detected capacity change from 0 to 2640 [ 383.176357][ T5926] Buffer I/O error on dev loop6, logical block 0, async page read [ 383.196405][ T846] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 383.207850][ T5926] Buffer I/O error on dev loop6, logical block 0, async page read [ 383.222630][ T5926] Buffer I/O error on dev loop6, logical block 0, async page read [ 383.227970][ T5926] Buffer I/O error on dev loop6, logical block 0, async page read [ 383.235472][ T5926] Buffer I/O error on dev loop6, logical block 0, async page read [ 383.357446][ T846] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 383.362092][ T846] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 383.366411][ T846] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 383.372070][ T846] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 383.376111][ T846] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 383.382778][ T846] usb 5-1: config 0 descriptor?? [ 383.392709][T10722] RDS: rds_bind could not find a transport for fe80::28, load rds_tcp or rds_rdma? [ 383.819168][ T846] plantronics 0003:047F:FFFF.0018: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 384.397813][T10751] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1461'. [ 384.412053][ T5824] usb 6-1: usb_control_msg returned -71 [ 384.413771][ T5824] usbtmc 6-1:16.0: can't read capabilities [ 384.424645][ T5824] usb 6-1: USB disconnect, device number 66 [ 384.611210][T10753] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1462'. [ 384.841314][T10757] random: crng reseeded on system resumption [ 384.958964][T10760] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1465'. [ 385.677024][T10772] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1469'. [ 385.870762][ T42] audit: type=1326 audit(1784310752.676:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10773 comm="syz.1.1471" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fcefec code=0x0 [ 385.963968][ T5824] usb 5-1: USB disconnect, device number 78 [ 386.145125][T10781] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 386.291335][ T42] audit: type=1326 audit(1784310753.096:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10774 comm="syz.4.1470" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x0 [ 386.359812][T10778] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1470'. [ 386.375108][T10785] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1474'. [ 386.943901][T10796] usb usb8: usbfs: interface 0 claimed by hub while 'syz.4.1478' sets config #0 [ 387.058122][T10800] digital: digital_start_poll: Unknown protocol [ 387.479861][T10813] netlink: 'syz.1.1483': attribute type 2 has an invalid length. [ 387.802520][T10822] netlink: 79 bytes leftover after parsing attributes in process `syz.0.1487'. [ 387.917672][T10822] kvm: user requested TSC rate below hardware speed [ 388.504633][T10831] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1491'. [ 388.752762][T10838] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1494'. [ 389.225905][T10849] uprobe: syz.0.1496:10849 failed to unregister, leaking uprobe [ 389.673036][T10857] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 389.754572][T10864] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1501'. [ 389.762282][T10864] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1501'. [ 389.786833][T10866] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1502'. [ 391.115238][T10897] netlink: 'syz.0.1513': attribute type 1 has an invalid length. [ 391.451799][T10919] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1516'. [ 392.582054][ T34] libceph: connect (1)[c::]:6789 error -101 [ 392.601836][ T34] libceph: mon0 (1)[c::]:6789 connect error [ 392.665341][T10943] overlay: filesystem on ./bus not supported [ 392.745237][T10947] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1529'. [ 392.859429][ T5854] libceph: connect (1)[c::]:6789 error -101 [ 392.862645][ T5854] libceph: mon0 (1)[c::]:6789 connect error [ 393.160837][T10938] ceph: No mds server is up or the cluster is laggy [ 394.438484][T10969] netlink: 188 bytes leftover after parsing attributes in process `syz.0.1534'. [ 395.556004][T10983] syz.1.1539: attempt to access beyond end of device [ 395.556004][T10983] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 395.561639][T10983] gfs2: error -5 reading superblock [ 395.928667][T10984] syzkaller0: entered promiscuous mode [ 395.931443][T10984] syzkaller0: entered allmulticast mode [ 395.949378][T10992] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1542'. [ 396.826042][ T42] audit: type=1326 audit(1784310763.636:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11003 comm="syz.1.1546" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x0 [ 397.355680][ T5852] usb 8-1: new high-speed USB device number 79 using dummy_hcd [ 397.505713][ T5852] usb 8-1: Using ep0 maxpacket: 8 [ 397.511035][ T5852] usb 8-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 397.517453][ T5852] usb 8-1: config 1 interface 0 has no altsetting 0 [ 397.524662][ T5852] usb 8-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.40 [ 397.530978][ T5852] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.534723][ T5852] usb 8-1: Product: syz [ 397.536122][ T5852] usb 8-1: Manufacturer: syz [ 397.537586][ T5852] usb 8-1: SerialNumber: syz [ 397.625386][T11017] syz_tun: entered allmulticast mode [ 397.633182][T11016] syz_tun: left allmulticast mode [ 397.650619][T11019] input: syz0 as /devices/virtual/input/input22 [ 397.763192][T11015] tmpfs: Bad value for 'mpol' [ 397.765660][T11024] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 397.808851][T11026] openvswitch: netlink: Unexpected mask (mask=10000010, allowed=10058) [ 397.836419][T11028] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 397.914200][ T5852] usbhid 8-1:1.0: can't add hid device: -71 [ 397.916305][ T5852] usbhid 8-1:1.0: probe with driver usbhid failed with error -71 [ 397.925779][ T24] usb 5-1: new full-speed USB device number 79 using dummy_hcd [ 397.943725][ T5852] usb 8-1: USB disconnect, device number 79 [ 398.081339][ T24] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 398.095607][ T24] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 398.100549][ T24] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 398.103376][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 398.391306][T11044] tipc: Started in network mode [ 398.393046][T11044] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 398.398283][T11044] tipc: Enabled bearer , priority 30 [ 398.785672][ T34] IPVS: starting estimator thread 0... [ 398.895668][T11053] IPVS: using max 43 ests per chain, 103200 per kthread [ 399.283108][T11058] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 399.391419][ T56] tipc: Node number set to 10005162 [ 399.829696][T11063] FAULT_INJECTION: forcing a failure. [ 399.829696][T11063] name failslab, interval 1, probability 0, space 0, times 0 [ 399.840590][T11063] CPU: 1 UID: 0 PID: 11063 Comm: syz.3.1563 Tainted: G L syzkaller #0 PREEMPT(full) [ 399.840611][T11063] Tainted: [L]=SOFTLOCKUP [ 399.840616][T11063] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 399.840622][T11063] Call Trace: [ 399.840627][T11063] [ 399.840632][T11063] dump_stack_lvl+0x100/0x190 [ 399.840652][T11063] should_fail_ex.cold+0x5/0xa [ 399.840666][T11063] should_failslab+0xc2/0x120 [ 399.840682][T11063] __kvmalloc_node_noprof+0x116/0x970 [ 399.840696][T11063] ? lockdep_init_map_type+0x5c/0x250 [ 399.840715][T11063] ? alloc_netdev_mqs+0xb4e/0x15c0 [ 399.840733][T11063] ? __pfx_xfrmi_dev_setup+0x10/0x10 [ 399.840750][T11063] alloc_netdev_mqs+0xb4e/0x15c0 [ 399.840767][T11063] rtnl_create_link+0xc13/0xf80 [ 399.840785][T11063] rtnl_newlink+0x13bd/0x2380 [ 399.840805][T11063] ? __pfx_rtnl_newlink+0x10/0x10 [ 399.840818][T11063] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 399.840836][T11063] ? __kernel_text_address+0xd/0x30 [ 399.840853][T11063] ? unwind_get_return_address+0x59/0xa0 [ 399.840882][T11063] ? __pfx_stack_trace_save+0x10/0x10 [ 399.840902][T11063] ? find_held_lock+0x2b/0x80 [ 399.840919][T11063] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 399.840934][T11063] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 399.840950][T11063] ? __pfx_rtnl_newlink+0x10/0x10 [ 399.840966][T11063] rtnetlink_rcv_msg+0x95e/0xe90 [ 399.840982][T11063] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 399.841001][T11063] ? __lock_acquire+0x49f/0x1a40 [ 399.841021][T11063] netlink_rcv_skb+0x159/0x420 [ 399.841042][T11063] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 399.841058][T11063] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 399.841082][T11063] ? netlink_deliver_tap+0x1ae/0xcc0 [ 399.841114][T11063] netlink_unicast+0x585/0x850 [ 399.841137][T11063] ? __pfx_netlink_unicast+0x10/0x10 [ 399.841159][T11063] netlink_sendmsg+0x8b0/0xda0 [ 399.841180][T11063] ? __pfx_netlink_sendmsg+0x10/0x10 [ 399.841201][T11063] ? apparmor_socket_sendmsg+0x15b/0x270 [ 399.841224][T11063] ____sys_sendmsg+0xa4d/0xbe0 [ 399.841241][T11063] ? __pfx_netlink_sendmsg+0x10/0x10 [ 399.841271][T11063] ? __pfx_____sys_sendmsg+0x10/0x10 [ 399.841295][T11063] ? rcu_is_watching+0x12/0xc0 [ 399.841310][T11063] ___sys_sendmsg+0x190/0x1e0 [ 399.841330][T11063] ? __pfx____sys_sendmsg+0x10/0x10 [ 399.841348][T11063] ? find_held_lock+0x2b/0x80 [ 399.841367][T11063] ? find_held_lock+0x2b/0x80 [ 399.841390][T11063] __sys_sendmsg+0x160/0x210 [ 399.841405][T11063] ? __pfx___sys_sendmsg+0x10/0x10 [ 399.841424][T11063] ? exit_to_user_mode_loop+0x166/0x6f0 [ 399.841443][T11063] ? rcu_is_watching+0x12/0xc0 [ 399.841458][T11063] __do_fast_syscall_32+0xe7/0x970 [ 399.841472][T11063] ? lockdep_hardirqs_on+0x78/0x100 [ 399.841491][T11063] do_fast_syscall_32+0x32/0x70 [ 399.841503][T11063] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 399.841518][T11063] RIP: 0023:0xf706efec [ 399.841534][T11063] Code: Unable to access opcode bytes at 0xf706efc2. [ 399.841540][T11063] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 399.841552][T11063] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 399.841559][T11063] RDX: 000000000000c080 RSI: 0000000000000000 RDI: 0000000000000000 [ 399.841566][T11063] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 399.841572][T11063] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 399.841579][T11063] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 399.841593][T11063] [ 399.973503][ T24] usb 5-1: usb_control_msg returned -71 [ 399.975434][ T24] usbtmc 5-1:16.0: can't read capabilities [ 399.980100][ T24] usb 5-1: USB disconnect, device number 79 [ 400.397452][T11068] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1565'. [ 400.870511][T11078] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1568'. [ 400.966907][ T846] usb 9-1: new high-speed USB device number 39 using dummy_hcd [ 401.128483][ T846] usb 9-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 401.134651][ T846] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.139689][ T846] usb 9-1: Product: syz [ 401.141086][ T846] usb 9-1: Manufacturer: syz [ 401.145806][ T846] usb 9-1: SerialNumber: syz [ 401.152146][ T846] usb 9-1: config 0 descriptor?? [ 401.298409][T11095] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 401.390911][T11075] syzkaller1: entered promiscuous mode [ 401.393448][T11075] syzkaller1: entered allmulticast mode [ 401.400818][T11075] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 401.405336][T11075] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 401.755083][ T846] usb 9-1: USB disconnect, device number 39 [ 401.823225][T11109] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 402.601668][T11123] openvswitch: netlink: Message has 5 unknown bytes. [ 402.605173][T11123] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 402.665792][T11123] loop8: detected capacity change from 0 to 7 [ 402.704358][T11123] Dev loop8: unable to read RDB block 7 [ 402.712798][T11123] loop8: AHDI p1 p2 [ 402.715977][T11123] loop8: partition table partially beyond EOD, truncated [ 402.719351][T11123] loop8: p1 start 1702000233 is beyond EOD, truncated [ 402.752514][T11127] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 402.788636][T11129] syz.1.1584: attempt to access beyond end of device [ 402.788636][T11129] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 402.793190][T11129] gfs2: error -5 reading superblock [ 404.068291][T11170] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 404.107150][ T24] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 404.255767][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 404.266398][ T24] usb 6-1: unable to get BOS descriptor or descriptor too short [ 404.274457][ T24] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 404.283294][ T24] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 404.289488][ T24] usb 6-1: config 14 has no interface number 0 [ 404.294685][ T24] usb 6-1: config 14 has no interface number 1 [ 404.302583][ T24] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 404.312741][ T24] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 404.323170][ T24] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 404.333090][ T24] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 404.343849][ T24] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 404.355639][ T24] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 404.366906][ T24] usb 6-1: config 14 interface 57 has no altsetting 0 [ 404.374639][ T24] usb 6-1: config 14 interface 228 has no altsetting 0 [ 404.383294][ T24] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 404.392314][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 404.397385][ T24] usb 6-1: Product: syz [ 404.401062][ T24] usb 6-1: Manufacturer: syz [ 404.404857][ T24] usb 6-1: SerialNumber: syz [ 404.832920][ T24] legousbtower 6-1:14.57: interrupt endpoints not found [ 405.210014][T11192] syz.4.1599: attempt to access beyond end of device [ 405.210014][T11192] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 405.214213][T11192] gfs2: error -5 reading superblock [ 405.224124][T11193] vxcan1: tx drop: invalid sa for name 0x0000000000000002 [ 405.278684][ T24] legousbtower 6-1:14.228: get version request failed: -71 [ 405.285628][ T24] legousbtower 6-1:14.228: probe with driver legousbtower failed with error -71 [ 405.299119][ T24] usb 6-1: USB disconnect, device number 67 [ 405.393761][T11198] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1600'. [ 405.955241][T11206] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 406.206057][ T5824] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 406.296642][T11213] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 406.356172][ T5824] usb 6-1: Using ep0 maxpacket: 8 [ 406.360301][ T5824] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 406.363763][ T5824] usb 6-1: config 179 has no interface number 0 [ 406.366641][ T5824] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 406.370922][ T5824] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 406.375637][ T5824] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 406.380209][ T5824] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 406.384948][ T5824] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 406.390766][ T5824] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 406.394631][ T5824] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 406.402578][T11208] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 406.545729][ T8974] usb 9-1: new high-speed USB device number 40 using dummy_hcd [ 406.675629][ T8974] usb 9-1: device descriptor read/64, error -71 [ 406.834752][T11208] syzkaller1: entered promiscuous mode [ 406.837540][T11208] syzkaller1: entered allmulticast mode [ 406.915598][ T8974] usb 9-1: new high-speed USB device number 41 using dummy_hcd [ 407.045638][ T8974] usb 9-1: device descriptor read/64, error -71 [ 407.156260][ T8974] usb usb9-port1: attempt power cycle [ 407.386878][ C1] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 407.389647][ C1] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 407.392916][ T5824] usb 6-1: USB disconnect, device number 68 [ 407.475980][ T5854] usb 5-1: new full-speed USB device number 80 using dummy_hcd [ 407.495664][ T8974] usb 9-1: new high-speed USB device number 42 using dummy_hcd [ 407.516121][ T8974] usb 9-1: device descriptor read/8, error -71 [ 407.640250][ T5854] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 407.656187][ T5854] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 407.660634][ T5854] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 407.667155][ T5854] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 407.680970][T11240] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 407.755743][ T8974] usb 9-1: new high-speed USB device number 43 using dummy_hcd [ 407.776301][ T8974] usb 9-1: device descriptor read/8, error -71 [ 407.836080][T11242] tipc: Enabled bearer , priority 0 [ 407.843874][T11242] syzkaller0: entered promiscuous mode [ 407.846302][T11242] syzkaller0: entered allmulticast mode [ 407.879180][T11242] tipc: Resetting bearer [ 407.886145][ T8974] usb usb9-port1: unable to enumerate USB device [ 407.894243][T11241] tipc: Resetting bearer [ 407.917650][T11241] tipc: Disabling bearer [ 408.115592][T11250] binder: 11247:11250 ioctl c0046209 0 returned -22 [ 408.146398][T11250] binder: 11247:11250 ioctl c0046209 0 returned -22 [ 408.815005][T11259] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1619'. [ 409.392343][T11269] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1622'. [ 409.403223][ T5854] usb 5-1: usb_control_msg returned -71 [ 409.405320][ T5854] usbtmc 5-1:16.0: can't read capabilities [ 409.617169][ T5854] usb 5-1: USB disconnect, device number 80 [ 409.695676][ T5824] usb 9-1: new high-speed USB device number 44 using dummy_hcd [ 409.855826][ T5824] usb 9-1: Using ep0 maxpacket: 8 [ 409.859754][ T5824] usb 9-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 409.864762][ T5824] usb 9-1: config 1 interface 0 has no altsetting 0 [ 409.869909][ T5824] usb 9-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.40 [ 409.873677][ T5824] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.876960][ T5824] usb 9-1: Product: syz [ 409.878642][ T5824] usb 9-1: Manufacturer: syz [ 409.880566][ T5824] usb 9-1: SerialNumber: syz [ 409.976350][T11275] netlink: 'syz.0.1625': attribute type 6 has an invalid length. [ 410.095919][T11271] tmpfs: Bad value for 'mpol' [ 410.137812][ T5824] usbhid 9-1:1.0: can't add hid device: -71 [ 410.139873][ T5824] usbhid 9-1:1.0: probe with driver usbhid failed with error -71 [ 410.153574][ T5824] usb 9-1: USB disconnect, device number 44 [ 410.749153][T11287] netlink: 'syz.4.1629': attribute type 1 has an invalid length. [ 410.755250][T11287] netlink: 'syz.4.1629': attribute type 2 has an invalid length. [ 410.788540][T11287] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1629'. [ 410.791693][T11287] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1629'. [ 411.085773][ T846] usb 9-1: new high-speed USB device number 45 using dummy_hcd [ 411.095746][T11297] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 411.098190][T11297] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 411.235669][ T846] usb 9-1: Using ep0 maxpacket: 32 [ 411.238139][ T846] usb 9-1: no configurations [ 411.239676][ T846] usb 9-1: can't read configurations, error -22 [ 411.367484][ T846] usb 9-1: new high-speed USB device number 46 using dummy_hcd [ 411.374508][T11308] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1635'. [ 411.385769][ T5852] usb 6-1: new full-speed USB device number 69 using dummy_hcd [ 411.565763][ T846] usb 9-1: Using ep0 maxpacket: 32 [ 411.598891][ T846] usb 9-1: no configurations [ 411.617062][ T846] usb 9-1: can't read configurations, error -22 [ 411.623142][ T846] usb usb9-port1: attempt power cycle [ 411.679867][ T5852] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 411.685017][ T5852] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 411.697528][ T5852] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 411.704183][ T5852] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.985690][ T846] usb 9-1: new high-speed USB device number 47 using dummy_hcd [ 412.018966][ T846] usb 9-1: Using ep0 maxpacket: 32 [ 412.022802][ T846] usb 9-1: no configurations [ 412.025071][ T846] usb 9-1: can't read configurations, error -22 [ 412.167289][ T846] usb 9-1: new high-speed USB device number 48 using dummy_hcd [ 412.206400][ T846] usb 9-1: Using ep0 maxpacket: 32 [ 412.208702][ T846] usb 9-1: no configurations [ 412.210212][ T846] usb 9-1: can't read configurations, error -22 [ 412.216278][ T846] usb usb9-port1: unable to enumerate USB device [ 412.518251][ T846] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 412.706276][T11022] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 412.955715][ T846] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 413.119746][T11322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.125246][T11322] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.142545][ T846] usb 5-1: unable to get BOS descriptor or descriptor too short [ 413.596164][ T50] usb 8-1: new high-speed USB device number 80 using dummy_hcd [ 413.710569][ T5852] usb 6-1: usb_control_msg returned -71 [ 413.745894][ T50] usb 8-1: Using ep0 maxpacket: 32 [ 413.763829][ T50] usb 8-1: config index 0 descriptor too short (expected 8219, got 27) [ 413.775060][ T50] usb 8-1: config 32 has an invalid descriptor of length 32, skipping remainder of the config [ 413.787760][ T50] usb 8-1: config 32 has 0 interfaces, different from the descriptor's value: 32 [ 413.807296][ T50] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 413.817762][ T50] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 413.826945][ T50] usb 8-1: Product: syz [ 413.831796][ T50] usb 8-1: Manufacturer: syz [ 413.836981][ T50] usb 8-1: SerialNumber: syz [ 413.999918][ T846] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 414.254949][ T5852] usbtmc 6-1:16.0: can't read capabilities [ 414.354518][T11340] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1644'. [ 414.489238][ T846] usb 5-1: can't read configurations, error -71 [ 415.101844][ T5852] usb 6-1: USB disconnect, device number 69 [ 415.194918][ T50] usb 8-1: USB disconnect, device number 80 [ 415.271235][T11354] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1648'. [ 415.277381][T11354] syz_tun: entered allmulticast mode [ 415.404641][T11363] sit0: entered promiscuous mode [ 415.411533][T11363] netlink: 'syz.4.1652': attribute type 1 has an invalid length. [ 415.416607][T11363] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1652'. [ 415.736163][ T5854] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 415.906096][ T5854] usb 6-1: Using ep0 maxpacket: 32 [ 415.917075][ T5854] usb 6-1: no configurations [ 415.918859][ T5854] usb 6-1: can't read configurations, error -22 [ 415.942492][T11375] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1656'. [ 415.956986][T11377] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1654'. [ 416.091409][ T5854] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 416.164076][ T42] audit: type=1326 audit(1784310782.966:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11382 comm="syz.0.1659" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 416.171462][T11383] FAULT_INJECTION: forcing a failure. [ 416.171462][T11383] name failslab, interval 1, probability 0, space 0, times 0 [ 416.175358][T11383] CPU: 1 UID: 0 PID: 11383 Comm: syz.0.1659 Tainted: G L syzkaller #0 PREEMPT(full) [ 416.175377][T11383] Tainted: [L]=SOFTLOCKUP [ 416.175382][T11383] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 416.175389][T11383] Call Trace: [ 416.175394][T11383] [ 416.175399][T11383] dump_stack_lvl+0x100/0x190 [ 416.175418][T11383] should_fail_ex.cold+0x5/0xa [ 416.175433][T11383] should_failslab+0xc2/0x120 [ 416.175449][T11383] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 416.175463][T11383] ? __alloc_skb+0x5b7/0x710 [ 416.175477][T11383] ? __alloc_skb+0x140/0x710 [ 416.175491][T11383] __alloc_skb+0x140/0x710 [ 416.175514][T11383] ? __alloc_skb+0x5b7/0x710 [ 416.175528][T11383] ? __pfx___alloc_skb+0x10/0x10 [ 416.175541][T11383] ? lockdep_init_map_type+0x5c/0x250 [ 416.175563][T11383] audit_log_start+0x350/0x930 [ 416.175579][T11383] ? __pfx_audit_log_start+0x10/0x10 [ 416.175594][T11383] ? find_held_lock+0x2b/0x80 [ 416.175606][T11383] ? __might_fault+0xc5/0x140 [ 416.175617][T11383] ? __might_fault+0xc5/0x140 [ 416.175630][T11383] audit_seccomp+0x60/0x190 [ 416.175644][T11383] __seccomp_filter+0x896/0x1140 [ 416.175658][T11383] ? __pfx___seccomp_filter+0x10/0x10 [ 416.175672][T11383] ? ksys_write+0x1ac/0x250 [ 416.175694][T11383] __secure_computing+0x204/0x2c0 [ 416.175707][T11383] do_int80_emulation+0x40f/0x720 [ 416.175722][T11383] asm_int80_emulation+0x1a/0x20 [ 416.175735][T11383] RIP: 0023:0xf71a72eb [ 416.175746][T11383] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 416.175758][T11383] RSP: 002b:00000000f545d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 416.175772][T11383] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f545d5d0 [ 416.175791][T11383] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 416.175799][T11383] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 416.175805][T11383] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 416.175812][T11383] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 416.175827][T11383] [ 416.241692][ T42] audit: type=1326 audit(1784310782.966:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11382 comm="syz.0.1659" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 416.248702][ T42] audit: type=1326 audit(1784310782.976:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11382 comm="syz.0.1659" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71a72eb code=0x7ffc0000 [ 416.256122][ T42] audit: type=1326 audit(1784310782.976:187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11382 comm="syz.0.1659" exe="/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf71a72eb code=0x7ffc0000 [ 416.256630][ T5854] usb 6-1: Using ep0 maxpacket: 32 [ 416.263145][ T42] audit: type=1326 audit(1784310782.976:188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11382 comm="syz.0.1659" exe="/syz-executor" sig=0 arch=40000003 syscall=459 compat=1 ip=0xf706efec code=0x7ffc0000 [ 416.267603][T11383] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 416.275335][T11383] audit: out of memory in audit_log_start [ 416.277327][ T42] audit: type=1326 audit(1784310783.086:189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11382 comm="syz.0.1659" exe="/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf71a72eb code=0x7ffc0000 [ 416.283304][ T5854] usb 6-1: no configurations [ 416.284278][ T42] audit: type=1326 audit(1784310783.086:190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11382 comm="syz.0.1659" exe="/syz-executor" sig=0 arch=40000003 syscall=6 compat=1 ip=0xf71a72eb code=0x7ffc0000 [ 416.287074][ T5854] usb 6-1: can't read configurations, error -22 [ 416.293679][ T42] audit: type=1326 audit(1784310783.096:191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11382 comm="syz.0.1659" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 416.307188][ T5854] usb usb6-port1: attempt power cycle [ 416.557031][T11400] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1665'. [ 416.694457][ T5854] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 416.780311][ T5854] usb 6-1: Using ep0 maxpacket: 32 [ 416.790435][ T5854] usb 6-1: no configurations [ 416.792599][ T5854] usb 6-1: can't read configurations, error -22 [ 416.809765][T11410] can0: slcan on ttyS3. [ 416.956041][T11420] CUSE: unknown device info "" [ 416.957619][T11420] CUSE: unknown device info "" [ 416.959182][T11420] CUSE: unknown device info "" [ 416.960722][T11420] CUSE: unknown device info "" [ 416.965886][T11420] CUSE: unknown device info "" [ 416.967566][T11420] CUSE: unknown device info "" [ 416.973626][T11420] CUSE: unknown device info "" [ 416.975155][T11420] CUSE: unknown device info "" [ 416.982608][T11420] CUSE: unknown device info "" [ 416.985711][T11420] CUSE: unknown device info "" [ 416.990627][T11420] CUSE: unknown device info "" [ 416.992187][T11420] CUSE: unknown device info "r" [ 416.995763][T11420] CUSE: unknown device info "#" [ 416.997534][T11420] CUSE: unknown device info "" [ 417.002724][T11420] CUSE: unknown device info "" [ 417.004300][T11420] CUSE: unknown device info "" [ 417.007078][T11420] CUSE: DEVNAME unspecified [ 417.052025][ T5854] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 417.162660][ T5854] usb 6-1: Using ep0 maxpacket: 32 [ 417.173288][ T5854] usb 6-1: no configurations [ 417.174946][ T5854] usb 6-1: can't read configurations, error -22 [ 417.183698][ T5854] usb usb6-port1: unable to enumerate USB device [ 417.317351][T11411] can0 (unregistered): slcan off ttyS3. [ 418.257289][T11450] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1675'. [ 418.495708][ T8974] usb 5-1: new full-speed USB device number 83 using dummy_hcd [ 418.647649][ T8974] usb 5-1: unable to get BOS descriptor or descriptor too short [ 418.650642][ T8974] usb 5-1: not running at top speed; connect to a high speed hub [ 418.654070][ T8974] usb 5-1: config 1 interface 0 altsetting 129 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 418.658157][ T8974] usb 5-1: config 1 interface 0 has no altsetting 0 [ 418.662978][ T8974] usb 5-1: string descriptor 0 read error: -22 [ 418.665011][ T8974] usb 5-1: New USB device found, idVendor=1b96, idProduct=0009, bcdDevice= 0.40 [ 418.667904][ T8974] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.676224][T11452] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 418.920713][T11452] tmpfs: Unknown parameter ' FIKpF֦U' [ 418.934762][T11452] netlink: 'syz.0.1676': attribute type 29 has an invalid length. [ 418.947768][T11452] netlink: 'syz.0.1676': attribute type 3 has an invalid length. [ 418.950496][T11452] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1676'. [ 418.977961][ T8974] usbhid 5-1:1.0: can't add hid device: -71 [ 418.979875][ T8974] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 418.995713][ T8974] usb 5-1: USB disconnect, device number 83 [ 419.056586][T11465] pim6reg: entered allmulticast mode [ 419.107793][T11465] team0: entered allmulticast mode [ 419.109656][T11465] team_slave_0: entered allmulticast mode [ 419.111476][T11465] team_slave_1: entered allmulticast mode [ 419.113307][T11465] geneve1: entered allmulticast mode [ 419.116651][T11465] team0: left allmulticast mode [ 419.118832][T11465] team_slave_0: left allmulticast mode [ 419.120532][T11465] team_slave_1: left allmulticast mode [ 419.122202][T11465] geneve1: left allmulticast mode [ 419.124258][T11465] pim6reg: left allmulticast mode [ 419.610212][T11480] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1684'. [ 419.619803][T11480] syz_tun: entered allmulticast mode [ 420.917320][T11496] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1689'. [ 420.970890][T11496] netlink: 220 bytes leftover after parsing attributes in process `syz.4.1689'. [ 421.347879][T11508] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1690'. [ 421.365286][ T5457] veth0_vlan: left promiscuous mode [ 421.392364][ T56] veth0_vlan: entered promiscuous mode [ 422.218857][T11531] netlink: 'syz.4.1693': attribute type 10 has an invalid length. [ 422.241257][T11531] 8021q: adding VLAN 0 to HW filter on device bond0 [ 422.250631][T11531] team0: Port device bond0 added [ 422.882904][ T42] kauditd_printk_skb: 3 callbacks suppressed [ 422.882927][ T42] audit: type=1326 audit(1784310789.656:195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11542 comm="syz.4.1699" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x0 [ 423.329767][T11558] pim6reg: entered allmulticast mode [ 423.331645][T11558] pim6reg: left allmulticast mode [ 423.705078][T11565] input: syz0 as /devices/virtual/input/input23 [ 423.874167][T11577] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1706'. [ 424.089816][T11574] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 424.802748][ T42] audit: type=1326 audit(1784310791.606:196): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11597 comm="syz.1.1712" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x0 [ 425.246577][ T5854] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 425.396234][ T5854] usb 5-1: Using ep0 maxpacket: 32 [ 425.406980][ T5854] usb 5-1: unable to get BOS descriptor or descriptor too short [ 425.418808][ T5854] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 425.428445][ T5854] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 425.431296][ T5854] usb 5-1: config 14 has no interface number 0 [ 425.441844][ T5854] usb 5-1: config 14 has no interface number 1 [ 425.447647][ T5854] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 425.455840][ T5854] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 425.465043][ T5854] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 425.475430][ T5854] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 425.485951][ T5854] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 425.495653][ T5854] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 425.505846][ T5854] usb 5-1: config 14 interface 57 has no altsetting 0 [ 425.508229][ T5854] usb 5-1: config 14 interface 228 has no altsetting 0 [ 425.524458][ T5854] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 425.536183][ T5854] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.539071][ T5854] usb 5-1: Product: syz [ 425.540646][ T5854] usb 5-1: Manufacturer: syz [ 425.542275][ T5854] usb 5-1: SerialNumber: syz [ 425.875648][ T56] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 426.002294][ T5854] legousbtower 5-1:14.57: interrupt endpoints not found [ 426.027176][ T56] usb 6-1: config 0 has no interfaces? [ 426.033258][ T56] usb 6-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 426.037214][ T56] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.040586][ T56] usb 6-1: Product: syz [ 426.042268][ T56] usb 6-1: Manufacturer: syz [ 426.044245][ T56] usb 6-1: SerialNumber: syz [ 426.048871][ T56] usb 6-1: config 0 descriptor?? [ 426.301160][ T5854] legousbtower 5-1:14.228: get version request failed: -71 [ 426.304487][ T5854] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -71 [ 426.326477][T11607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 426.329505][T11607] 8021q: adding VLAN 0 to HW filter on device team0 [ 426.334340][ T5854] usb 5-1: USB disconnect, device number 84 [ 426.342140][T11607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 426.380021][T11607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 426.388108][T11607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 426.396331][T11607] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 426.401314][T11607] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 426.412535][T11607] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 426.420905][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 426.423190][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 426.429112][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 426.430679][ T56] usb 6-1: USB disconnect, device number 74 [ 426.431417][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 426.980569][T11623] mac80211_hwsim hwsim8 .: renamed from wlan1 [ 427.073773][T11621] syz.0.1719: attempt to access beyond end of device [ 427.073773][T11621] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 427.078331][T11621] gfs2: error -5 reading superblock [ 429.013833][T11656] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1728'. [ 430.083384][T11679] FAULT_INJECTION: forcing a failure. [ 430.083384][T11679] name failslab, interval 1, probability 0, space 0, times 0 [ 430.088873][T11679] CPU: 0 UID: 0 PID: 11679 Comm: syz.4.1732 Tainted: G L syzkaller #0 PREEMPT(full) [ 430.088902][T11679] Tainted: [L]=SOFTLOCKUP [ 430.088910][T11679] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 430.088921][T11679] Call Trace: [ 430.088928][T11679] [ 430.088936][T11679] dump_stack_lvl+0x100/0x190 [ 430.088965][T11679] should_fail_ex.cold+0x5/0xa [ 430.088987][T11679] should_failslab+0xc2/0x120 [ 430.089011][T11679] kmem_cache_alloc_noprof+0x91/0x6a0 [ 430.089034][T11679] ? do_getname_kernel+0x5d/0x250 [ 430.089059][T11679] do_getname_kernel+0x5d/0x250 [ 430.089081][T11679] kern_path+0x1f/0x50 [ 430.089105][T11679] path_mount+0xec6/0x23d0 [ 430.089130][T11679] ? __pfx_path_mount+0x10/0x10 [ 430.089148][T11679] ? lockdep_hardirqs_on+0x78/0x100 [ 430.089181][T11679] ? putname+0xb1/0x110 [ 430.089197][T11679] ? kmem_cache_free+0x127/0x6b0 [ 430.089233][T11679] ? __ia32_sys_mount+0x292/0x310 [ 430.089253][T11679] __ia32_sys_mount+0x292/0x310 [ 430.089272][T11679] ? __pfx___ia32_sys_mount+0x10/0x10 [ 430.089290][T11679] ? ksys_write+0x1ac/0x250 [ 430.089317][T11679] ? __pfx_ksys_write+0x10/0x10 [ 430.089348][T11679] __do_fast_syscall_32+0xe7/0x970 [ 430.089366][T11679] ? lockdep_hardirqs_on+0x78/0x100 [ 430.089396][T11679] do_fast_syscall_32+0x32/0x70 [ 430.089416][T11679] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 430.089439][T11679] RIP: 0023:0xf702efec [ 430.089459][T11679] Code: Unable to access opcode bytes at 0xf702efc2. [ 430.089469][T11679] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 430.089489][T11679] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000080000040 [ 430.089500][T11679] RDX: 0000000000000000 RSI: 0000000000001001 RDI: 0000000000000000 [ 430.089510][T11679] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 430.089520][T11679] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 430.089531][T11679] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 430.089556][T11679] [ 430.419094][T11692] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1735'. [ 430.639302][T11696] netlink: 'syz.4.1737': attribute type 1 has an invalid length. [ 430.669764][T11699] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1738'. [ 430.730929][T11700] netlink: 23 bytes leftover after parsing attributes in process `syz.1.1738'. [ 430.856725][T11702] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1739'. [ 431.143983][ T42] audit: type=1326 audit(1784310797.946:197): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11703 comm="syz.4.1740" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf702efec code=0x0 [ 431.855650][ T56] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 432.005677][ T56] usb 6-1: Using ep0 maxpacket: 32 [ 432.009779][ T56] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 432.014685][ T56] usb 6-1: config 0 has no interfaces? [ 432.017306][ T56] usb 6-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 432.021086][ T56] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.028698][ T56] usb 6-1: config 0 descriptor?? [ 432.244784][ T34] usb 6-1: USB disconnect, device number 75 [ 432.285665][ T846] usb 9-1: new high-speed USB device number 49 using dummy_hcd [ 432.425913][ T846] usb 9-1: device descriptor read/64, error -71 [ 432.665813][ T846] usb 9-1: new high-speed USB device number 50 using dummy_hcd [ 432.795620][ T846] usb 9-1: device descriptor read/64, error -71 [ 432.906068][ T846] usb usb9-port1: attempt power cycle [ 433.255951][ T846] usb 9-1: new high-speed USB device number 51 using dummy_hcd [ 433.288118][ T846] usb 9-1: device descriptor read/8, error -71 [ 433.401802][T11722] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 433.496674][T11730] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 433.499501][T11730] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 433.503659][T11730] vhci_hcd vhci_hcd.0: Device attached [ 433.536233][ T846] usb 9-1: new high-speed USB device number 52 using dummy_hcd [ 433.566663][ T846] usb 9-1: device descriptor read/8, error -71 [ 433.681623][ T846] usb usb9-port1: unable to enumerate USB device [ 433.795672][ T50] usb 38-1: SetAddress Request (2) to port 0 [ 433.798417][ T50] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 433.800862][T11739] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1750'. [ 433.906626][ T56] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 434.065623][ T56] usb 6-1: Using ep0 maxpacket: 32 [ 434.068193][T11731] vhci_hcd: connection reset by peer [ 434.070553][ T5853] vhci_hcd vhci_hcd.0: stop threads [ 434.072422][ T5853] vhci_hcd vhci_hcd.0: release socket [ 434.075439][ T5853] vhci_hcd vhci_hcd.0: disconnect device [ 434.078094][ T56] usb 6-1: unable to get BOS descriptor or descriptor too short [ 434.081782][ T56] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 434.084933][ T56] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 434.087900][ T56] usb 6-1: config 14 has no interface number 0 [ 434.089902][ T56] usb 6-1: config 14 has no interface number 1 [ 434.092697][ T56] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 434.097171][ T56] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 434.100987][ T56] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 434.104558][ T56] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 434.109000][ T56] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 434.112582][ T56] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 434.116776][ T56] usb 6-1: config 14 interface 57 has no altsetting 0 [ 434.118880][ T56] usb 6-1: config 14 interface 228 has no altsetting 0 [ 434.123414][ T56] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 434.126307][ T56] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.128809][ T56] usb 6-1: Product: syz [ 434.131133][ T56] usb 6-1: Manufacturer: syz [ 434.132689][ T56] usb 6-1: SerialNumber: syz [ 434.167908][ T42] audit: type=1326 audit(1784310800.976:198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11742 comm="syz.3.1752" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 434.549359][ T56] legousbtower 6-1:14.57: interrupt endpoints not found [ 434.949552][ T56] legousbtower 6-1:14.228: get version request failed: -32 [ 434.952714][ T56] legousbtower 6-1:14.228: probe with driver legousbtower failed with error -32 [ 436.776766][ T5824] usb 6-1: USB disconnect, device number 76 [ 438.000655][T11784] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 438.046991][T11788] 9p: Could not find request transport: unHWG [ 438.295811][ T5824] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 438.445682][ T5824] usb 6-1: Using ep0 maxpacket: 16 [ 438.449907][ T5824] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 438.453905][ T5824] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 438.458285][ T5824] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x89 has invalid wMaxPacketSize 0 [ 438.462982][ T5824] usb 6-1: config 0 interface 0 has no altsetting 0 [ 438.470827][ T5824] usb 6-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 438.475377][ T5824] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.479110][ T5824] usb 6-1: Product: syz [ 438.480915][ T5824] usb 6-1: Manufacturer: syz [ 438.482916][ T5824] usb 6-1: SerialNumber: syz [ 438.487209][ T5824] usb 6-1: config 0 descriptor?? [ 438.698451][ T5824] input: syz syz as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.0/input/input24 [ 438.703211][ T5140] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 438.716052][ T5140] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 438.727375][ T5140] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 438.757281][ T5140] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 438.800110][ T5745] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 438.811232][ T5140] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 438.838539][ T5140] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 438.842693][ T5140] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 438.855813][ T50] usb 38-1: device descriptor read/8, error -110 [ 438.944999][ T42] audit: type=1800 audit(1784310805.746:199): pid=11798 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1765" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 438.982864][T11799] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 438.995890][T11798] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 439.008895][T11791] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 439.038992][ T56] usb 6-1: USB disconnect, device number 77 [ 439.657184][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.794681][ T50] usb usb38-port1: attempt power cycle [ 439.798028][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.858092][ T56] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 440.892346][ T50] usb usb38-port1: unable to enumerate USB device [ 441.035660][ T56] usb 5-1: Using ep0 maxpacket: 32 [ 441.463524][ T56] usb 5-1: unable to get BOS descriptor or descriptor too short qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. [ 442.342813][ T56] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 442.346351][ T56] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 442.349803][ T56] usb 5-1: config 14 has no interface number 0 [ 442.352381][ T56] usb 5-1: config 14 has no interface number 1 [ 442.354915][ T56] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 442.360051][ T56] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 442.364789][ T56] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 442.369541][ T56] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 442.374525][ T56] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 442.379594][ T56] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 442.384912][ T56] usb 5-1: config 14 interface 57 has no altsetting 0 [ 442.388772][ T56] usb 5-1: config 14 interface 228 has no altsetting 0 [ 442.393932][ T56] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 442.398860][ T56] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.402295][ T56] usb 5-1: Product: syz [ 442.404520][ T56] usb 5-1: Manufacturer: syz [ 442.406933][ T56] usb 5-1: SerialNumber: syz [ 442.524105][T11829] syzkaller0: entered promiscuous mode [ 442.525897][T11829] syzkaller0: entered allmulticast mode [ 442.821561][ T56] legousbtower 5-1:14.57: interrupt endpoints not found [ 443.225342][ T56] legousbtower 5-1:14.228: get version request failed: -32 [ 443.231242][ T56] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -32 [ 444.241213][ T42] audit: type=1326 audit(1784310811.046:200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11836 comm="syz.3.1775" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 444.318440][T11841] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1776'. [ 444.324042][T11841] mac80211_hwsim hwsim7 syzkaller0: left promiscuous mode [ 444.327152][T11841] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode [ 444.401708][T11843] netlink: 'syz.3.1777': attribute type 10 has an invalid length. [ 444.427427][T11843] syz_tun: entered promiscuous mode [ 444.481463][T11845] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1779'. [ 444.795666][ T56] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 444.856877][ T846] usb 5-1: USB disconnect, device number 85 [ 444.877414][ T9] usb 8-1: new full-speed USB device number 81 using dummy_hcd [ 444.945663][ T56] usb 6-1: Using ep0 maxpacket: 32 [ 444.949047][ T56] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 444.953265][ T56] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 444.956322][ T56] usb 6-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 444.959246][ T56] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.963482][ T56] usb 6-1: config 0 descriptor?? [ 445.027855][ T9] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 0, changing to 4 [ 445.032213][ T9] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 15380, setting to 1023 [ 445.038299][ T9] usb 8-1: config 0 interface 0 has no altsetting 0 [ 445.043537][ T9] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 445.046684][ T9] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 445.049370][ T9] usb 8-1: Product: syz [ 445.050723][ T9] usb 8-1: Manufacturer: syz [ 445.052225][ T9] usb 8-1: SerialNumber: syz [ 445.057825][ T9] usb 8-1: config 0 descriptor?? [ 445.065494][ T9] usb 8-1: selecting invalid altsetting 0 [ 445.170939][ T56] usb 6-1: USB disconnect, device number 78 [ 445.384624][T11849] usb 8-1: cannot submit urb 0, error -2: endpoint not enabled [ 445.402346][ T50] usb 8-1: USB disconnect, device number 81 [ 446.125051][T11863] syz.3.1783: attempt to access beyond end of device [ 446.125051][T11863] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 446.136379][T11863] gfs2: error -5 reading superblock [ 446.545911][ T42] audit: type=1326 audit(1784310813.346:201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11866 comm="syz.3.1785" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 446.871186][ T5824] usb 5-1: new full-speed USB device number 86 using dummy_hcd [ 446.875317][T11864] netlink: 'syz.1.1784': attribute type 1 has an invalid length. [ 446.878392][T11864] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1784'. [ 446.891163][T11864] overlayfs: failed to resolve './file1': -2 [ 447.045039][ T5824] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 447.055924][ T5824] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 447.061060][ T5824] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 447.069068][ T5824] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 447.100590][T11875] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1788'. [ 447.485639][ T56] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 447.935641][ T56] usb 6-1: Using ep0 maxpacket: 32 [ 447.939073][ T56] usb 6-1: unable to get BOS descriptor or descriptor too short [ 447.942463][ T56] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 447.945043][ T56] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 447.948040][ T56] usb 6-1: config 14 has no interface number 0 [ 447.950588][ T56] usb 6-1: config 14 has no interface number 1 [ 447.953747][ T56] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 447.957219][ T56] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 447.960796][ T56] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 447.964412][ T56] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 447.968457][ T56] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 447.971876][ T56] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 447.976045][ T56] usb 6-1: config 14 interface 57 has no altsetting 0 [ 447.978069][ T56] usb 6-1: config 14 interface 228 has no altsetting 0 [ 447.982370][ T56] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 447.985474][ T56] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.988096][ T56] usb 6-1: Product: syz [ 447.989413][ T56] usb 6-1: Manufacturer: syz [ 447.990899][ T56] usb 6-1: SerialNumber: syz [ 448.400410][ T56] legousbtower 6-1:14.57: interrupt endpoints not found [ 448.490928][T11893] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 448.552214][T11895] futex_wake_op: syz.3.1794 tries to shift op by 36; fix this program [ 448.800569][ T56] legousbtower 6-1:14.228: get version request failed: -32 [ 448.802957][ T56] legousbtower 6-1:14.228: probe with driver legousbtower failed with error -32 [ 449.184853][ T5824] usb 5-1: usb_control_msg returned -71 [ 449.187386][ T5824] usbtmc 5-1:16.0: can't read capabilities [ 449.195728][ T5824] usb 5-1: USB disconnect, device number 86 [ 450.489526][T11910] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1798'. [ 450.714553][ T42] audit: type=1326 audit(1784310817.516:202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11911 comm="syz.0.1799" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 451.248252][ T50] usb 6-1: USB disconnect, device number 79 [ 451.399352][T11922] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 451.403324][T11922] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 451.416364][T11922] tipc: Enabled bearer , priority 0 [ 451.662961][T11924] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1804'. [ 451.806725][T11932] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1808'. [ 452.131624][T11944] openvswitch: netlink: Actions may not be safe on all matching packets [ 452.135414][T11944] tmpfs: Unknown parameter '0000000000000000000000000000000000000000000000' [ 452.267256][ T42] audit: type=1326 audit(1784310818.078:203): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11947 comm="syz.0.1813" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 452.289086][T11950] FAULT_INJECTION: forcing a failure. [ 452.289086][T11950] name failslab, interval 1, probability 0, space 0, times 0 [ 452.293003][T11950] CPU: 1 UID: 0 PID: 11950 Comm: syz.1.1814 Tainted: G L syzkaller #0 PREEMPT(full) [ 452.293023][T11950] Tainted: [L]=SOFTLOCKUP [ 452.293027][T11950] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 452.293035][T11950] Call Trace: [ 452.293039][T11950] [ 452.293044][T11950] dump_stack_lvl+0x100/0x190 [ 452.293065][T11950] should_fail_ex.cold+0x5/0xa [ 452.293082][T11950] should_failslab+0xc2/0x120 [ 452.293099][T11950] __kmalloc_node_track_caller_noprof+0xf9/0x830 [ 452.293118][T11950] ? kasprintf+0xc7/0x100 [ 452.293138][T11950] kvasprintf+0xbc/0x150 [ 452.293154][T11950] ? __pfx_kvasprintf+0x10/0x10 [ 452.293171][T11950] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 452.293192][T11950] ? lockdep_hardirqs_on+0x78/0x100 [ 452.293211][T11950] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 452.293230][T11950] kasprintf+0xc7/0x100 [ 452.293245][T11950] ? __pfx_kasprintf+0x10/0x10 [ 452.293265][T11950] ? lockdep_init_map_type+0x5c/0x250 [ 452.293288][T11950] ieee80211_alloc_led_names+0x1b0/0x420 [ 452.293331][T11950] ieee80211_alloc_hw_nm+0x1969/0x22e0 [ 452.293348][T11950] mac80211_hwsim_new_radio+0x1de/0x64c0 [ 452.293370][T11950] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 452.293388][T11950] ? __nla_validate_parse+0x1e7/0x28b0 [ 452.293401][T11950] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 452.293420][T11950] hwsim_new_radio_nl+0xc6b/0x13f0 [ 452.293435][T11950] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 452.293453][T11950] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 452.293467][T11950] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 452.293483][T11950] genl_family_rcv_msg_doit+0x214/0x300 [ 452.293497][T11950] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 452.293509][T11950] ? genl_get_cmd+0x3e7/0x760 [ 452.293523][T11950] ? bpf_lsm_capable+0x9/0x10 [ 452.293535][T11950] ? security_capable+0x80/0x260 [ 452.293556][T11950] ? ns_capable+0xd2/0xf0 [ 452.293570][T11950] genl_rcv_msg+0x560/0x800 [ 452.293583][T11950] ? __pfx_genl_rcv_msg+0x10/0x10 [ 452.293595][T11950] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 452.293618][T11950] netlink_rcv_skb+0x159/0x420 [ 452.293636][T11950] ? __pfx_genl_rcv_msg+0x10/0x10 [ 452.293648][T11950] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 452.293672][T11950] ? netlink_deliver_tap+0x1ae/0xcc0 [ 452.293691][T11950] genl_rcv+0x28/0x40 [ 452.293701][T11950] netlink_unicast+0x585/0x850 [ 452.293721][T11950] ? __pfx_netlink_unicast+0x10/0x10 [ 452.293743][T11950] netlink_sendmsg+0x8b0/0xda0 [ 452.293763][T11950] ? __pfx_netlink_sendmsg+0x10/0x10 [ 452.293783][T11950] ? apparmor_socket_sendmsg+0x15b/0x270 [ 452.293804][T11950] ____sys_sendmsg+0xa4d/0xbe0 [ 452.293821][T11950] ? __pfx_netlink_sendmsg+0x10/0x10 [ 452.293840][T11950] ? __pfx_____sys_sendmsg+0x10/0x10 [ 452.293863][T11950] ___sys_sendmsg+0x190/0x1e0 [ 452.293882][T11950] ? __pfx____sys_sendmsg+0x10/0x10 [ 452.293907][T11950] ? find_held_lock+0x2b/0x80 [ 452.293929][T11950] __sys_sendmsg+0x160/0x210 [ 452.293943][T11950] ? __pfx___sys_sendmsg+0x10/0x10 [ 452.293961][T11950] ? __pfx_ksys_write+0x10/0x10 [ 452.293981][T11950] __do_fast_syscall_32+0xe7/0x970 [ 452.293993][T11950] ? lockdep_hardirqs_on+0x78/0x100 [ 452.294012][T11950] do_fast_syscall_32+0x32/0x70 [ 452.294024][T11950] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 452.294040][T11950] RIP: 0023:0xf6fcefec [ 452.294056][T11950] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 452.294061][T11950] RSP: 002b:00000000f53bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 452.294072][T11950] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 452.294080][T11950] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 452.294086][T11950] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 452.294093][T11950] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 452.294100][T11950] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 452.294117][T11950] [ 452.335682][ T9] usb 9-1: new high-speed USB device number 53 using dummy_hcd [ 452.505644][ T9] usb 9-1: Using ep0 maxpacket: 32 [ 452.509478][ T9] usb 9-1: unable to get BOS descriptor or descriptor too short [ 452.514185][ T9] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 452.518171][ T9] usb 9-1: config 14 has an invalid interface number: 228 but max is 1 [ 452.521758][ T9] usb 9-1: config 14 has no interface number 0 [ 452.524502][ T9] usb 9-1: config 14 has no interface number 1 [ 452.527094][ T9] usb 9-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 452.530969][ T9] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 452.536401][ T9] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 452.541265][ T9] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 452.547068][ T9] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 452.551824][ T9] usb 9-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 452.557743][ T9] usb 9-1: config 14 interface 57 has no altsetting 0 [ 452.560688][ T9] usb 9-1: config 14 interface 228 has no altsetting 0 [ 452.567035][ T9] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 452.571024][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.574392][ T9] usb 9-1: Product: syz [ 452.577064][ T9] usb 9-1: Manufacturer: syz [ 452.579003][ T9] usb 9-1: SerialNumber: syz [ 453.055981][ T1164] ------------[ cut here ]------------ [ 453.059581][ T1164] time_after(jiffies, timeout) [ 453.059595][ T1164] WARNING: io_uring/io_uring.c:2365 at io_ring_exit_work+0x479/0xd7a, CPU#1: kworker/u33:9/1164 [ 453.064406][ T1164] Modules linked in: [ 453.067202][ T1164] CPU: 1 UID: 0 PID: 1164 Comm: kworker/u33:9 Tainted: G L syzkaller #0 PREEMPT(full) [ 453.070691][ T1164] Tainted: [L]=SOFTLOCKUP [ 453.072045][ T1164] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 453.076066][ T1164] Workqueue: iou_exit io_ring_exit_work [ 453.078305][ T1164] RIP: 0010:io_ring_exit_work+0x479/0xd7a [ 453.080608][ T1164] Code: 8e e8 db 59 43 01 48 8b 05 f4 a3 4b 0d 4c 8b 7c 24 38 31 ff 49 29 c7 4c 89 fe e8 c2 d4 d3 00 4d 85 ff 79 12 e8 18 da d3 00 90 <0f> 0b 90 48 c7 44 24 20 70 17 00 00 e8 06 da d3 00 48 8b 74 24 20 [ 453.088147][ T1164] RSP: 0000:ffffc90006bc7aa0 EFLAGS: 00010293 [ 453.090592][ T1164] RAX: 0000000000000000 RBX: ffff88806d298710 RCX: ffffffff81354e9e [ 453.093766][ T1164] RDX: ffff888029954a80 RSI: ffffffff81354ea8 RDI: ffff888029954a80 [ 453.096962][ T1164] RBP: ffffc90006bc7c38 R08: 0000000000000007 R09: 0000000000000000 [ 453.099861][ T1164] R10: ffffffffffffffff R11: 0000000000000000 R12: ffff88806d298000 [ 453.102967][ T1164] R13: dffffc0000000000 R14: 000000006d298700 R15: ffffffffffffffff [ 453.106304][ T1164] FS: 0000000000000000(0000) GS:ffff888096cf1000(0000) knlGS:0000000000000000 [ 453.109955][ T1164] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 453.112695][ T1164] CR2: 00000000800011c0 CR3: 000000004df66000 CR4: 0000000000352ef0 [ 453.115957][ T1164] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 453.119082][ T1164] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 453.121636][ T1164] Call Trace: [ 453.122968][ T1164] [ 453.124172][ T1164] ? do_raw_spin_lock+0x128/0x260 [ 453.126263][ T1164] ? __pfx_io_ring_exit_work+0x10/0x10 [ 453.128247][ T1164] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 453.130116][ T1164] ? debug_object_deactivate+0x2e4/0x3b0 [ 453.131907][ T1164] ? rcu_is_watching+0x12/0xc0 [ 453.133484][ T1164] process_one_work+0xa23/0x1940 [ 453.135069][ T1164] ? __pfx_process_one_work+0x10/0x10 [ 453.136834][ T1164] ? __pfx_io_ring_exit_work+0x10/0x10 [ 453.138589][ T1164] worker_thread+0x5ef/0xe50 [ 453.140321][ T1164] ? __pfx_worker_thread+0x10/0x10 [ 453.142496][ T1164] ? kthread+0x13a/0x450 [ 453.144331][ T1164] ? __pfx_worker_thread+0x10/0x10 [ 453.146631][ T1164] kthread+0x370/0x450 [ 453.148374][ T1164] ? __pfx_kthread+0x10/0x10 [ 453.150272][ T1164] ret_from_fork+0x72b/0xd50 [ 453.152137][ T1164] ? __pfx_ret_from_fork+0x10/0x10 [ 453.153786][ T1164] ? __switch_to+0x800/0x10f0 [ 453.155283][ T1164] ? __pfx_kthread+0x10/0x10 [ 453.156807][ T1164] ret_from_fork_asm+0x1a/0x30 [ 453.158310][ T1164] [ 453.159288][ T1164] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 453.161542][ T1164] CPU: 1 UID: 0 PID: 1164 Comm: kworker/u33:9 Tainted: G L syzkaller #0 PREEMPT(full) [ 453.165104][ T1164] Tainted: [L]=SOFTLOCKUP [ 453.166377][ T1164] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 453.169503][ T1164] Workqueue: iou_exit io_ring_exit_work [ 453.171247][ T1164] Call Trace: [ 453.172331][ T1164] [ 453.173508][ T1164] dump_stack_lvl+0x100/0x190 [ 453.175012][ T1164] vpanic+0x552/0x970 [ 453.176319][ T1164] ? __pfx_vpanic+0x10/0x10 [ 453.177758][ T1164] panic+0xd1/0xe0 [ 453.178948][ T1164] ? __pfx_panic+0x10/0x10 [ 453.180373][ T1164] ? check_panic_on_warn+0x1f/0x90 [ 453.181978][ T1164] check_panic_on_warn.cold+0x19/0x34 [ 453.183695][ T1164] ? io_ring_exit_work+0x479/0xd7a [ 453.185338][ T1164] __warn.cold+0x191/0x318 [ 453.186753][ T1164] __report_bug+0x30f/0x440 [ 453.188194][ T1164] ? io_ring_exit_work+0x479/0xd7a [ 453.189843][ T1164] ? __pfx___report_bug+0x10/0x10 [ 453.191423][ T1164] ? lockdep_hardirqs_on+0x78/0x100 [ 453.193249][ T1164] ? irqentry_exit+0x24d/0xa00 [ 453.194791][ T1164] ? io_ring_exit_work+0x479/0xd7a [ 453.196413][ T1164] ? io_ring_exit_work+0x479/0xd7a [ 453.198026][ T1164] report_bug+0xb2/0x220 [ 453.199393][ T1164] ? io_ring_exit_work+0x479/0xd7a [ 453.201061][ T1164] handle_bug+0x16a/0x2a0 [ 453.202455][ T1164] exc_invalid_op+0x17/0x50 [ 453.204410][ T1164] asm_exc_invalid_op+0x1a/0x20 [ 453.206083][ T1164] RIP: 0010:io_ring_exit_work+0x479/0xd7a [ 453.207903][ T1164] Code: 8e e8 db 59 43 01 48 8b 05 f4 a3 4b 0d 4c 8b 7c 24 38 31 ff 49 29 c7 4c 89 fe e8 c2 d4 d3 00 4d 85 ff 79 12 e8 18 da d3 00 90 <0f> 0b 90 48 c7 44 24 20 70 17 00 00 e8 06 da d3 00 48 8b 74 24 20 [ 453.214384][ T1164] RSP: 0000:ffffc90006bc7aa0 EFLAGS: 00010293 [ 453.216875][ T1164] RAX: 0000000000000000 RBX: ffff88806d298710 RCX: ffffffff81354e9e [ 453.219325][ T1164] RDX: ffff888029954a80 RSI: ffffffff81354ea8 RDI: ffff888029954a80 [ 453.221796][ T1164] RBP: ffffc90006bc7c38 R08: 0000000000000007 R09: 0000000000000000 [ 453.224281][ T1164] R10: ffffffffffffffff R11: 0000000000000000 R12: ffff88806d298000 [ 453.226731][ T1164] R13: dffffc0000000000 R14: 000000006d298700 R15: ffffffffffffffff [ 453.229233][ T1164] ? io_ring_exit_work+0x46e/0xd7a [ 453.230849][ T1164] ? io_ring_exit_work+0x478/0xd7a [ 453.232569][ T1164] ? do_raw_spin_lock+0x128/0x260 [ 453.234176][ T1164] ? __pfx_io_ring_exit_work+0x10/0x10 [ 453.235922][ T1164] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 453.237757][ T1164] ? debug_object_deactivate+0x2e4/0x3b0 [ 453.239544][ T1164] ? rcu_is_watching+0x12/0xc0 [ 453.241181][ T1164] process_one_work+0xa23/0x1940 [ 453.242850][ T1164] ? __pfx_process_one_work+0x10/0x10 [ 453.244571][ T1164] ? __pfx_io_ring_exit_work+0x10/0x10 [ 453.246284][ T1164] worker_thread+0x5ef/0xe50 [ 453.247796][ T1164] ? __pfx_worker_thread+0x10/0x10 [ 453.249430][ T1164] ? kthread+0x13a/0x450 [ 453.250770][ T1164] ? __pfx_worker_thread+0x10/0x10 [ 453.252419][ T1164] kthread+0x370/0x450 [ 453.253792][ T1164] ? __pfx_kthread+0x10/0x10 [ 453.255345][ T1164] ret_from_fork+0x72b/0xd50 [ 453.256839][ T1164] ? __pfx_ret_from_fork+0x10/0x10 [ 453.258483][ T1164] ? __switch_to+0x800/0x10f0 [ 453.260024][ T1164] ? __pfx_kthread+0x10/0x10 [ 453.261495][ T1164] ret_from_fork_asm+0x1a/0x30 [ 453.263070][ T1164] [ 453.264801][ T1164] Kernel Offset: disabled [ 453.266164][ T1164] Rebooting in 86400 seconds..