last executing test programs: 13m40.191892003s ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x10) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000380)='mounts\x00') r2 = epoll_create(0x10000) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x9000000d}) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x8001, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(0x0, 0xa) 13m40.062330996s ago: executing program 3 (id=5): r0 = mq_open(&(0x7f0000000000)='!selinu\xff\x7f\x00\x00inux\x00T\x8b\xb5\xf3\xcb\xdd\xe3\xbf2\x86\x01\x84\xdd\x8a\x8f_l\xa1L\xb1\xef\xb2\xc9\xf7+C\xb2\x8e9\xb8\xec\x1a\xe5\xaeq\x8fZ\xff\xbcY+\xaf0<\xa3\xb8\"Zm\x1c\x18\x11\x93\xb5z \xc2\x8b\xa9\xc5\x9es\t\xfe\x002\xa0-\xaf\xcdP\x9f\xe5Iv\xce*\xa8\xa3\x14i\x05\x8f\x9b\x1eB\x9f\x9d#E\x19\xdc\xfe\xc7\xeb\xb5\xcd\xc8\xe2U\xce\x00\x00', 0x6e93ebbbcc0884f2, 0x6c, &(0x7f0000000300)={0x0, 0x1, 0x3, 0x3ccb7696}) mq_timedsend(r0, 0x0, 0x0, 0x0, 0x0) mq_timedsend(r0, 0x0, 0x0, 0xa, 0x0) mq_timedreceive(r0, &(0x7f0000000340)=""/200, 0xc8, 0x0, 0x0) 13m38.445104286s ago: executing program 3 (id=11): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x4, &(0x7f0000002380)=@framed={{0x18, 0x2, 0x0, 0x0, 0xffffffbf, 0x0, 0x0, 0x0, 0x200d}, [@call={0x85, 0x0, 0x0, 0x97}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf8000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x2f, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa5bc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 13m38.279444612s ago: executing program 32 (id=11): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x4, &(0x7f0000002380)=@framed={{0x18, 0x2, 0x0, 0x0, 0xffffffbf, 0x0, 0x0, 0x0, 0x200d}, [@call={0x85, 0x0, 0x0, 0x97}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf8000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x2f, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa5bc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2m6.254880865s ago: executing program 1 (id=2463): socket$inet6(0xa, 0x2, 0x0) fanotify_init(0x4, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$panthor(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0xfffffffffffffffc, 0xd0, 0x7d, 0x0, 0x8000, 0x4}, 0x0, &(0x7f0000000100)={0x3ff, 0x6, 0x8000, 0x100009, 0x75, 0xa, 0x9, 0x400}, 0x0, 0x0) 2m5.012609237s ago: executing program 1 (id=2469): mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) write(r0, &(0x7f0000000000)='7', 0x1) pipe2(0x0, 0x800) 2m4.587378244s ago: executing program 1 (id=2470): r0 = syz_open_procfs(0x0, &(0x7f00000009c0)='net/tcp6\x00') r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r1, 0x2) syz_emit_ethernet(0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000003240)={0x2020}, 0x2020) 2m4.298745973s ago: executing program 1 (id=2471): socket$inet6(0xa, 0x2, 0x0) fanotify_init(0x4, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r2 = openat$panthor(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r3, 0x4001af84, &(0x7f0000000000)) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) close(r0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0xfffffffffffffffc, 0xd0, 0x7d, 0x0, 0x8000, 0x4}, 0x0, &(0x7f0000000100)={0x3ff, 0x6, 0x8000, 0x100009, 0x75, 0xa, 0x9, 0x400}, 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r2, 0xc0c0583b, &(0x7f0000000500)=ANY=[@ANYBLOB="000000000000000003000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000ac00000000000000000800000000000001040000000000000700000000000000000000000000000000000000000000000000000000000000f7ffffffff0f000009000000000000008a1312120000000008000000000000000100"/384]) close(0x3) r4 = fanotify_init(0x1a, 0x800) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0xa8) fanotify_mark(r4, 0x441, 0x4800001a, r5, 0x0) fanotify_mark(r4, 0x1, 0x20, r5, 0x0) r6 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TCSETSF2(r6, 0x402c542d, &(0x7f0000000080)={0x1, 0x4, 0x4, 0x8007, 0x7, "ea710000000000f9000000024200000200", 0x4000000, 0x8000400}) 2m1.752156964s ago: executing program 1 (id=2476): mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) pipe2(0x0, 0x800) 2m1.658865127s ago: executing program 1 (id=2477): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) sendmsg$NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000810}, 0x4040) r1 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe) r2 = add_key$user(0x0, 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000100)={r1, r2, r2}, 0x0, 0x0, &(0x7f0000000180)={0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(r3, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) write(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/sched/preempt\x00', 0x2, 0x0) write(r6, &(0x7f0000000200)='lazy', 0x4) 1m46.297457314s ago: executing program 33 (id=2477): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) sendmsg$NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000810}, 0x4040) r1 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe) r2 = add_key$user(0x0, 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000100)={r1, r2, r2}, 0x0, 0x0, &(0x7f0000000180)={0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(r3, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) write(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/sched/preempt\x00', 0x2, 0x0) write(r6, &(0x7f0000000200)='lazy', 0x4) 5.742264376s ago: executing program 2 (id=2964): setns(0xc9, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair(0x21, 0x4, 0x52, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) r2 = socket(0x1a, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x2fa801, 0x115) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r0, &(0x7f0000000600)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000500)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB="595d25bd7000fcdbdf250b"], 0x14}, 0x1, 0x0, 0x0, 0x20020810}, 0x74248b129e2a72de) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = gettid() prlimit64(r3, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000d40)={0x14, 0x88, 0xfa00, {r5, 0x10, 0x0, @ib={0x1b, 0x7a, 0x889, {}, 0x1119dff, 0xffffffff80000002, 0xcd41}}}, 0x90) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01080000000000000000050000000500010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001708000642ffffff0008000640ffffff00480000000c0a0101000000070000000900020073797a30000000000900010073797a30000000001c00d300180000800c00054000000000000000080400028004000180140000001000010000000000000000000084000a00000000009b8a8e281dcc2b746efdc54873e399c241a245039b4e0c8c25ba70ca7effda4f677be8f652e560967cba8db1a17b6bc4886406432cb67a8cc2dd784b2c8a2b23d2317cb1070bb8cfe4c3da6c75"], 0xdc}}, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r7 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r7, 0xc0045002, &(0x7f0000000040)=0x200) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r9 = dup(r8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r9, 0x0) sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000240)={&(0x7f0000000640)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x200000c0}, 0x4011) 4.474313017s ago: executing program 0 (id=2976): mkdir(&(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r0 = openat$snapshot(0xffffff9c, &(0x7f0000000080), 0x101501, 0x0) ioctl$SNAPSHOT_ATOMIC_RESTORE(r0, 0x3304) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/kernel/osrelease\x00', 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)) mknodat$loop(r1, &(0x7f00000000c0)='./file0\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) setns(0xc9, 0x0) r3 = socket(0x8, 0x5, 0x5) write$cgroup_subtree(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="2d63707561636374202d4070757365f4202b6e65745f7072696f20"], 0x1b) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000000)=ANY=[@ANYRES8, @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESOCT=r3]) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000ffd000/0x3000)=nil) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000000500)={r5, 0x1, {0x0, 0x0, 0x0, 0x7fb265e2, 0x8000000000000001, 0x0, 0x12, 0x18, 0x1d, "70f61ab0ee3db8adb954d1c39057973598784ce0d17bfa56aff38b11a98e4e8f29bc406048eb87c236fc4e735c940e25288d4d11001fe7afbd697603a6ff38bf", "85568ffcadc3095ee41cdef576e8543cdf912d0d934366cbd1194c1b3c4449a8d5c079b18633d5de72edf7f3e105159221250ac379d987acaaa0feae4e7c2777", "b836ec2ae98ce7a0dc5cfa4d2fd0432936e12c53d17ec0bcfce318708810a879", [0xfffffffffffffffe, 0x9]}}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) dup3(r4, r2, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r7 = syz_ublk_setup_io_uring(0x22, &(0x7f0000000740)={0x0, 0x20000000, 0x100, 0x2, 0x1db}, &(0x7f0000000000), &(0x7f0000000300), &(0x7f00000004c0)) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x8) io_uring_register$IORING_REGISTER_NAPI(r7, 0x1b, 0x0, 0x1) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000002c0)={'batadv_slave_1\x00', 0x800}) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x8848}, 0x80) sendmsg$nl_route_sched(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001f00)=@getqdisc={0x2c, 0x26, 0x800, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0xf, 0x4}, {0x5, 0xffe0}, {0xffe0, 0xb}}, [{0x4}, {0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc000000}, 0x4041080) 4.391508787s ago: executing program 0 (id=2979): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f00000004c0)='\n', 0x1) (fail_nth: 1) 4.308485434s ago: executing program 2 (id=2980): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_MSG_GETTABLE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="20000000010a01040000000000000000010073797a3000"/32], 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g1/configs/c.1/ecm.usb0/file0\x00', 0x1ff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a00000005000100060000001100030048686173683a69"], 0x60}, 0x1, 0x0, 0x0, 0x8001}, 0x0) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)={0x14, 0x3, 0x6, 0x3, 0x0, 0x0, {0x1, 0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x800) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xc, 0x10, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2ffff}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x15}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r2}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x3, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={r3, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76ea090000000000009ba56a88ca", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x7f) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/dev_mcast\x00') r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r7, 0x4038ae7a, &(0x7f0000000180)={0x1, 0xaa4, 0x0, &(0x7f0000000340)}) ioctl$KVM_SET_CLOCK(r7, 0x4188aec6, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x20000000000003, 0x1004}) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000029000/0x18000)=nil, &(0x7f0000000680)=[@text16={0x10, &(0x7f0000000080)="66b9800000c00f326635010000000f3064660f38828e4258660f08676ac744240012e93bf96766c744240201000000f20f78ecf5543e660f3829544e66b9800000c00f326635002000000f300f01df66b805000000f3a5baf80c66b80e5ca48f66efbafc0cec0f01310f019c09000f01c2", 0x71}], 0x1, 0x7d, 0x0, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r7, 0x4068aea3, &(0x7f0000000100)={0xbc, 0x0, 0x4}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) pread64(r5, &(0x7f0000003b00)=""/195, 0xc3, 0x591f) write(r4, &(0x7f00000004c0)='\n', 0x1) 4.212273887s ago: executing program 0 (id=2981): r0 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) mq_notify(r0, &(0x7f0000001440)={0x0, 0x33, 0x0, @thr={0x0, 0x0}}) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@bridge_dellink={0x34, 0x13, 0x101, 0x0, 0x25dfdbfb, {0x7, 0x0, 0x0, r2, 0x4334c, 0x8208}, [@IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x4, 0x0, 0x1, {0xc, 0xa, 0x0, 0x1, [{0x8, 0x9, 0x0, 0x0, 0x90}]}}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x80) syz_open_dev$evdev(&(0x7f0000000340), 0x3, 0x101083) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000240)='.\x00', 0x0, 0x2290034, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x2f00, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{0x1}, &(0x7f0000000000), &(0x7f0000000040)}, 0x1c) 3.840921102s ago: executing program 0 (id=2983): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) 3.742274653s ago: executing program 0 (id=2984): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(r0, &(0x7f00000003c0)={0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="000b02000000"], 0x0}, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r1, 0x5b02, 0x0) 2.81569016s ago: executing program 2 (id=2989): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x278, 0x0, 0x168, 0x9, 0x144, 0xb, 0x22c, 0x250, 0x250, 0x22c, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [0x0, 0xff], [], 'geneve0\x00', 'sit0\x00', {}, {}, 0x6c}, 0x6000000, 0xa4, 0xec, 0x0, {0x0, 0x28e}}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0xa4, 0xc4}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x2d4) read$msr(0xffffffffffffffff, 0x0, 0x0) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, 0x0) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="a663707520"], 0x5) setreuid(0xee00, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) r4 = mq_open(0x0, 0x42, 0x0, 0x0) mq_timedreceive(r4, 0x0, 0x0, 0xf0, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000000000400000000000000008500000030000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b70300000000000085000000720000009500"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, 0x0, &(0x7f0000000180)={0x0, 0x1, 0x1, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffe, 0x200, 0x2000, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x8, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x800, 0x1, 0x0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x1, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x81000fff, 0x0, {}, 0x1f, 0x0, '\x00', {0xfffd, 0x4, 0x0, 0x0}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="14"], 0x7c}}, 0x0) 2.815167945s ago: executing program 2 (id=2990): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4102}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f00000080"], 0x0}, 0x0) r4 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r4, 0xc018480b, &(0x7f0000000200)={0x3, 0x200, 0x3b7c, 0x4, 0x400004, 0x8}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r11, {0x0, 0x5}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x2}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40040e0}, 0x0) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x11, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200e61114120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1, 0x0, 0x0, 0x1000000}, 0x0) 2.814846473s ago: executing program 5 (id=2991): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='vegas', 0x5) write$binfmt_script(r0, &(0x7f0000000200), 0xfffffd9d) 2.804871389s ago: executing program 5 (id=2992): ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000001c0)={0x73622a85, 0x18a, 0x4}) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_GET_THP_DISABLE(0x2a) syz_emit_ethernet(0x55, &(0x7f0000000200)={@broadcast, @empty, @void, {@ipv4={0x800, @generic={{0x6, 0x4, 0x2, 0x1f, 0x47, 0x66, 0x0, 0x8, 0x88, 0x0, @loopback, @rand_addr=0x64010101, {[@noop]}}, "9e77056b35552d82101b4f988f2b6f2b308c2ee840e3c1c4605e869be0a192697cff2b89c1d3238c6d68ea15fe1628"}}}}, 0x0) syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="043e1f0a"], 0x22) syz_emit_vhci(&(0x7f00000013c0)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x3, 0x59}, @l2cap_cid_signaling={{0x55}, [@l2cap_conf_req={{0x4, 0x5, 0x21}, {0x1, 0x7, [@l2cap_conf_flushto={0x2, 0x2, 0x8001}, @l2cap_conf_fcs={0x5, 0x1}, @l2cap_conf_rfc={0x4, 0x9, {0x2, 0x8, 0x0, 0x6, 0x2, 0x7}}, @l2cap_conf_fcs={0x5, 0x1, 0x1}, @l2cap_conf_mtu={0x1, 0x2, 0xe0}, @l2cap_conf_flushto={0x2, 0x2, 0x778}]}}, @l2cap_conn_req={{0x2, 0x25, 0x4}, {0x973, 0xd}}, @l2cap_create_chan_req={{0xc, 0x8, 0x5}, {0x67, 0x701a, 0x6}}, @l2cap_info_req={{0xa, 0x9, 0x2}, {0x4}}, @l2cap_conf_rsp={{0x5, 0x7, 0x6}, {0x7fff, 0x4, 0x1}}, @l2cap_create_chan_req={{0xc, 0xf, 0x5}, {0x7, 0x43, 0x4}}, @l2cap_info_req={{0xa, 0x6, 0x2}, {0x2}}]}}, 0x5e) syz_emit_vhci(&(0x7f0000001040)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x91}, "927980c3d136f947e8411cb5b20da6d00e2a4e511bd9dbb5b547b6398ef9aebb73b6118221e3e34ae8642864b8263f55b24c1605af949967b998d1c95259ef892fb7b149c96e32b4c078f985dbc68b20cbe3d0898cc8c46c8ddca856ee0e1d0076c2f935c3cbab516280c5f924bf94cd9bdaa7eefdda6b2589e2e588907d33ff321004a51da7eb1786d4b47b7739e83246"}, 0x95) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) io_uring_setup(0x178e, &(0x7f00000001c0)={0x0, 0x52c1, 0x80, 0xfffffffb, 0xc}) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r0, &(0x7f0000001280), 0x0, 0xfffffc01, 0x81, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5ed000) lstat64(0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x7b36}, 0x30, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) landlock_restrict_self(r2, 0xe) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001140)={r1, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x1f, &(0x7f0000001180)=@raw=[@printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}, @alu={0x7, 0x1, 0x6, 0x0, 0xa, 0xfffffffffffffff0, 0xfffffffffffffffc}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}, @alu={0x4, 0x0, 0x1, 0xf, 0x2, 0x100, 0x7ffffffffffffff3}, @map_fd={0x18, 0x4, 0x1, 0x0, r1}, @jmp={0x5, 0x0, 0x0, 0x0, 0x7, 0x100, 0xfffffffffffffff0}, @alu={0x7, 0x0, 0xf, 0x0, 0x7, 0xc, 0xffffffffffffffff}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}], &(0x7f0000000240)='GPL\x00', 0x1, 0xd3, &(0x7f0000001440)=""/211, 0x0, 0x4f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000580)=ANY=[@ANYBLOB="380000001800dd8d008d1aaf97000000020000000000000600000000060015000400000014001680100008800d"], 0x38}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0xe, {"a2e3ad21ed0d52f90b9b39096df70e06d038e7ff7fc6e5539b324b298b089b0732376d090890e0878f0e1ac6e7049b334a959bfc9a240d2567f3988f7ef319520100ffe8d1780700523c921b1b9b31070d315d0936cd3b78130daa61f94b61404d64aec1b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c088215ec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6f44ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d208001349b41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2a15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee53259289d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c1980778efa5ea567b7b7430acc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a0700d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8440daaa69bf5c8f4350aeae9ca1207e76061b28f27da19acc7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211c7847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7beddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e781171e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b906ce2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf3f2aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11ee9afb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e75c40e42e07b34449e15e065cc7348663a52190202c7ae288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289d8523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c78e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e7c7b2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df06720ba2b26bbfcc807c8aabb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db38b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) sendmsg$NLBL_UNLABEL_C_LIST(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x20040001) sendmsg$NL802154_CMD_SET_TX_POWER(r5, 0x0, 0x10) fcntl$notify(0xffffffffffffffff, 0x402, 0x8000001c) 2.022193254s ago: executing program 0 (id=2993): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000080)="00012c615bc20000") syz_usb_control_io(r0, 0x0, &(0x7f0000000740)={0x84, &(0x7f00000001c0)=ANY=[@ANYBLOB="030701"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, 0x0, 0x5d) 1.157980966s ago: executing program 4 (id=2998): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x278, 0x0, 0x168, 0x9, 0x144, 0xb, 0x22c, 0x250, 0x250, 0x22c, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [0x0, 0xff], [], 'geneve0\x00', 'sit0\x00', {}, {}, 0x6c}, 0x6000000, 0xa4, 0xec, 0x0, {0x0, 0x28e}}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0xa4, 0xc4}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x2d4) read$msr(0xffffffffffffffff, 0x0, 0x0) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, 0x0) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="a663707520"], 0x5) setreuid(0xee00, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) r4 = mq_open(0x0, 0x42, 0x0, 0x0) mq_timedreceive(r4, 0x0, 0x0, 0xf0, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000000000400000000000000008500000030000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b70300000000000085000000720000009500"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, 0x0, &(0x7f0000000180)={0x0, 0x1, 0x1, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffe, 0x200, 0x2000, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x8, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x800, 0x1, 0x0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x1, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x81000fff, 0x0, {}, 0x1f, 0x0, '\x00', {0xfffd, 0x4, 0x0, 0x0}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="14"], 0x7c}}, 0x0) 1.062675086s ago: executing program 4 (id=2999): munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socket$kcm(0x11, 0x200000000000002, 0x300) prctl$PR_MCE_KILL(0x4e, 0x1, 0x2) prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000) 932.29819ms ago: executing program 4 (id=3000): r0 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) mq_notify(r0, &(0x7f0000001440)={0x0, 0x33, 0x0, @thr={0x0, 0x0}}) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@bridge_dellink={0x34, 0x13, 0x101, 0x0, 0x25dfdbfb, {0x7, 0x0, 0x0, r2, 0x4334c, 0x8208}, [@IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x4, 0x0, 0x1, {0xc, 0xa, 0x0, 0x1, [{0x8, 0x9, 0x0, 0x0, 0x90}]}}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x80) syz_open_dev$evdev(&(0x7f0000000340), 0x3, 0x101083) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mount(0x0, &(0x7f0000000240)='.\x00', 0x0, 0x2290034, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000000000ff000000000000100085000000530000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000080)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x2f00, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{0x1}, &(0x7f0000000000), &(0x7f0000000040)=r4}, 0x1c) 832.501957ms ago: executing program 4 (id=3001): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(0xffffffffffffffff, &(0x7f00000003c0)={0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="000b02000000"], 0x0}, 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r0, 0x5b02, 0x0) 474.829938ms ago: executing program 2 (id=3002): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0xa0a00) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)=[0x0], &(0x7f0000000340), 0x0, 0x1, 0x0, 0x0, r2}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r0, 0xc01064ab, &(0x7f0000000700)={0x3, r3, r2}) 455.173073ms ago: executing program 2 (id=3003): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r0, 0x5b02, 0x0) 440.746561ms ago: executing program 5 (id=3004): munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socket$kcm(0x11, 0x200000000000002, 0x300) prctl$PR_MCE_KILL(0x4e, 0x1, 0x2) prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000) 211.131939ms ago: executing program 4 (id=3005): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x278, 0x0, 0x168, 0x9, 0x144, 0xb, 0x22c, 0x250, 0x250, 0x22c, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [0x0, 0xff], [], 'geneve0\x00', 'sit0\x00', {}, {}, 0x6c}, 0x6000000, 0xa4, 0xec, 0x0, {0x0, 0x28e}}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0xa4, 0xc4}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x2d4) read$msr(0xffffffffffffffff, 0x0, 0x0) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, 0x0) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="a663707520"], 0x5) setreuid(0xee00, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) mq_timedreceive(0xffffffffffffffff, 0x0, 0x0, 0xf0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000000000400000000000000008500000030000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b70300000000000085000000720000009500"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 210.627488ms ago: executing program 4 (id=3006): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl(r1, 0x4048aecb, &(0x7f0000000200)="0100") r3 = syz_io_uring_setup(0x1060, &(0x7f00000003c0)={0x0, 0x50b6, 0x2, 0x3, 0x167}, &(0x7f0000000500), &(0x7f0000000040), &(0x7f0000000000)) io_uring_enter(r3, 0xfffffdff, 0xe875, 0x27, 0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r4) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x28, r5, 0x60b, 0x70bd2d, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x39}]}, 0x28}}, 0x40) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) r7 = signalfd(0xffffffffffffffff, &(0x7f00000000c0)={[0x431]}, 0x8) r8 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) dup2(r8, r7) syz_open_dev$tty20(0xc, 0x4, 0x0) connect$unix(r7, &(0x7f0000006680)=@abs={0x0, 0x0, 0x4e21}, 0x6e) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r6, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000080)) ioctl(r2, 0xc048aeca, &(0x7f0000000300)="0100") 72.087593ms ago: executing program 5 (id=3007): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x278, 0x0, 0x168, 0x9, 0x144, 0xb, 0x22c, 0x250, 0x250, 0x22c, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [0x0, 0xff], [], 'geneve0\x00', 'sit0\x00', {}, {}, 0x6c}, 0x6000000, 0xa4, 0xec, 0x0, {0x0, 0x28e}}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0xa4, 0xc4}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x2d4) read$msr(0xffffffffffffffff, 0x0, 0x0) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, 0x0) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="a663707520"], 0x5) setreuid(0xee00, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) r4 = mq_open(0x0, 0x42, 0x0, 0x0) mq_timedreceive(r4, 0x0, 0x0, 0xf0, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000000000400000000000000008500000030000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b70300000000000085000000720000009500"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, 0x0, &(0x7f0000000180)={0x0, 0x1, 0x1, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffe, 0x200, 0x2000, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x8, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x800, 0x1, 0x0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x1, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x81000fff, 0x0, {}, 0x1f, 0x0, '\x00', {0xfffd, 0x4, 0x0, 0x0}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="14"], 0x7c}}, 0x0) 218.546µs ago: executing program 5 (id=3008): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/net/ipv6/conf/all/keep_addr_on_down\x00', 0x1, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'lo\x00'}) (fail_nth: 1) 0s ago: executing program 5 (id=3009): r0 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) mq_notify(r0, &(0x7f0000001440)={0x0, 0x33, 0x0, @thr={0x0, 0x0}}) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@bridge_dellink={0x34, 0x13, 0x101, 0x0, 0x25dfdbfb, {0x7, 0x0, 0x0, r2, 0x4334c, 0x8208}, [@IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x4, 0x0, 0x1, {0xc, 0xa, 0x0, 0x1, [{0x8, 0x9, 0x0, 0x0, 0x90}]}}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x80) syz_open_dev$evdev(&(0x7f0000000340), 0x3, 0x101083) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mount(0x0, &(0x7f0000000240)='.\x00', 0x0, 0x2290034, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000000000ff000000000000100085000000530000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000080)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x2f00, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{0x1}, &(0x7f0000000000), &(0x7f0000000040)=r4}, 0x1c) kernel console output (not intermixed with test programs): 804.516175][T11323] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 804.516234][T11323] usb 5-1: Product: syz [ 804.516265][T11323] usb 5-1: Manufacturer: syz [ 804.516297][T11323] usb 5-1: SerialNumber: syz [ 804.546075][T15041] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 805.077784][T11323] usblp 5-1:1.0: usblp0: USB Bidirectional printer dev 73 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 805.086798][T11323] usb 5-1: USB disconnect, device number 73 [ 805.134127][T15058] tipc: Started in network mode [ 805.134217][T15058] tipc: Node identity 2000004, cluster identity 4711 [ 805.134262][T15058] tipc: Node number set to 33554436 [ 805.172133][T11323] usblp0: removed [ 805.325055][T15067] 9pnet_virtio: no channels available for device syz [ 805.325713][T15067] FAULT_INJECTION: forcing a failure. [ 805.325713][T15067] name failslab, interval 1, probability 0, space 0, times 0 [ 805.325744][T15067] CPU: 2 UID: 0 PID: 15067 Comm: syz.5.2622 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 805.325770][T15067] Tainted: [L]=SOFTLOCKUP [ 805.325777][T15067] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 805.325789][T15067] Call Trace: [ 805.325797][T15067] [ 805.325806][T15067] dump_stack_lvl+0x100/0x190 [ 805.325835][T15067] should_fail_ex.cold+0x5/0xa [ 805.325861][T15067] should_failslab+0xc2/0x120 [ 805.325886][T15067] kmem_cache_alloc_noprof+0x92/0x6a0 [ 805.325908][T15067] ? do_getname+0x35/0x390 [ 805.325937][T15067] do_getname+0x35/0x390 [ 805.325965][T15067] __ia32_sys_rmdir+0x35/0x60 [ 805.325988][T15067] __do_fast_syscall_32+0x13a/0x8b0 [ 805.326013][T15067] ? lockdep_hardirqs_on+0x7d/0x110 [ 805.326039][T15067] do_fast_syscall_32+0x32/0x70 [ 805.326064][T15067] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 805.326088][T15067] RIP: 0023:0xf701efec [ 805.326127][T15067] Code: Unable to access opcode bytes at 0xf701efc2. [ 805.326137][T15067] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000028 [ 805.326157][T15067] RAX: ffffffffffffffda RBX: 0000000080000040 RCX: 0000000000000000 [ 805.326169][T15067] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 805.326181][T15067] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 805.326193][T15067] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 805.326205][T15067] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 805.326230][T15067] [ 805.880793][T15073] FAULT_INJECTION: forcing a failure. [ 805.880793][T15073] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 805.880868][T15073] CPU: 2 UID: 0 PID: 15073 Comm: syz.2.2625 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 805.880908][T15073] Tainted: [L]=SOFTLOCKUP [ 805.880915][T15073] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 805.880927][T15073] Call Trace: [ 805.880957][T15073] [ 805.880966][T15073] dump_stack_lvl+0x100/0x190 [ 805.880993][T15073] should_fail_ex.cold+0x5/0xa [ 805.881015][T15073] _copy_from_user+0x2e/0xd0 [ 805.881036][T15073] get_compat_msghdr+0xb3/0x480 [ 805.881061][T15073] ? __pfx_get_compat_msghdr+0x10/0x10 [ 805.881090][T15073] ___sys_sendmsg+0x1b6/0x1e0 [ 805.881118][T15073] ? __pfx____sys_sendmsg+0x10/0x10 [ 805.881151][T15073] ? find_held_lock+0x2b/0x80 [ 805.881184][T15073] __sys_sendmsg+0x160/0x210 [ 805.881204][T15073] ? __pfx___sys_sendmsg+0x10/0x10 [ 805.881228][T15073] ? __pfx_ksys_write+0x10/0x10 [ 805.881250][T15073] __do_fast_syscall_32+0x13a/0x8b0 [ 805.881275][T15073] ? lockdep_hardirqs_on+0x7d/0x110 [ 805.881299][T15073] do_fast_syscall_32+0x32/0x70 [ 805.881325][T15073] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 805.881350][T15073] RIP: 0023:0xf7f14fec [ 805.881373][T15073] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 805.881382][T15073] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 805.881402][T15073] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 805.881414][T15073] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 805.881424][T15073] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 805.881434][T15073] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 805.881445][T15073] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 805.881470][T15073] [ 807.442180][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 807.791533][T15089] Cannot find add_set index 2 as target [ 808.122870][T15118] FAULT_INJECTION: forcing a failure. [ 808.122870][T15118] name failslab, interval 1, probability 0, space 0, times 0 [ 808.123007][T15118] CPU: 0 UID: 0 PID: 15118 Comm: syz.4.2632 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 808.123064][T15118] Tainted: [L]=SOFTLOCKUP [ 808.123075][T15118] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 808.123092][T15118] Call Trace: [ 808.123110][T15118] [ 808.123122][T15118] dump_stack_lvl+0x100/0x190 [ 808.123162][T15118] should_fail_ex.cold+0x5/0xa [ 808.123197][T15118] should_failslab+0xc2/0x120 [ 808.123253][T15118] kmem_cache_alloc_noprof+0x92/0x6a0 [ 808.123284][T15118] ? do_getname+0x35/0x390 [ 808.123327][T15118] do_getname+0x35/0x390 [ 808.123365][T15118] do_sys_openat2+0xc7/0x1e0 [ 808.123401][T15118] ? __pfx_do_sys_openat2+0x10/0x10 [ 808.123441][T15118] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 808.123505][T15118] __ia32_compat_sys_openat+0x12d/0x210 [ 808.123545][T15118] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 808.123580][T15118] ? fput+0x7c/0x100 [ 808.123609][T15118] ? ksys_write+0x1ac/0x250 [ 808.123634][T15118] ? __pfx_ksys_write+0x10/0x10 [ 808.123666][T15118] __do_fast_syscall_32+0x13a/0x8b0 [ 808.123702][T15118] ? lockdep_hardirqs_on+0x7d/0x110 [ 808.123737][T15118] do_fast_syscall_32+0x32/0x70 [ 808.123773][T15118] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 808.123806][T15118] RIP: 0023:0xf70aefec [ 808.123834][T15118] Code: Unable to access opcode bytes at 0xf70aefc2. [ 808.123847][T15118] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 808.123874][T15118] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000300 [ 808.123890][T15118] RDX: 00000000000c4042 RSI: 00000000000001ff RDI: 0000000000000000 [ 808.123906][T15118] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 808.123923][T15118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 808.123937][T15118] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 808.123970][T15118] [ 808.160993][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.161045][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.355225][T15118] Mount JFS Failure: -22 [ 808.355245][T15118] jfs_mount failed w/return code = -22 [ 808.944361][ T5840] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 808.945514][T15123] Mount JFS Failure: -22 [ 808.945532][T15123] jfs_mount failed w/return code = -22 [ 809.190281][ T5840] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03 [ 809.191014][ T5840] usb 5-1: Dual-Role OTG device on HNP port [ 809.191392][ T5840] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 809.218037][ T5840] gspca_main: spca501-2.14.0 probing 0000:0000 [ 809.218469][ T5840] gspca_spca501: reg write: error -32 [ 809.218479][ T5840] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 809.218527][ T5840] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 809.262615][T15132] Mount JFS Failure: -22 [ 809.262634][T15132] jfs_mount failed w/return code = -22 [ 809.915392][T15144] i2c i2c-1: dtv_property_process_set: SET cmd 0x6172676f undefined [ 810.524289][ T43] kauditd_printk_skb: 448 callbacks suppressed [ 810.524360][ T43] audit: type=1326 audit(2000000130.939:562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15152 comm="syz.0.2640" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd8fec code=0x7ffc0000 [ 810.524422][ T43] audit: type=1326 audit(2000000130.939:563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15152 comm="syz.0.2640" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd8fec code=0x7ffc0000 [ 810.525775][ T43] audit: type=1326 audit(2000000130.939:564): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15153 comm="syz.5.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 810.525990][ T43] audit: type=1326 audit(2000000130.939:565): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15153 comm="syz.5.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 810.542910][ T43] audit: type=1326 audit(2000000130.959:566): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15152 comm="syz.0.2640" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7fd8fec code=0x7ffc0000 [ 810.559867][ T43] audit: type=1326 audit(2000000130.979:567): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15153 comm="syz.5.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf701efec code=0x7ffc0000 [ 810.570333][ T43] audit: type=1326 audit(2000000130.989:568): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15153 comm="syz.5.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 810.571113][ T43] audit: type=1326 audit(2000000130.989:569): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15153 comm="syz.5.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=146 compat=1 ip=0xf701efec code=0x7ffc0000 [ 810.571363][ T43] audit: type=1326 audit(2000000130.989:570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15153 comm="syz.5.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 810.571714][ T43] audit: type=1326 audit(2000000130.989:571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15153 comm="syz.5.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71575ab code=0x7ffc0000 [ 811.312484][T15166] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2644'. [ 811.607899][T15172] xt_ipcomp: unknown flags 1D [ 811.787069][T15174] FAULT_INJECTION: forcing a failure. [ 811.787069][T15174] name failslab, interval 1, probability 0, space 0, times 0 [ 811.868751][T15174] CPU: 0 UID: 0 PID: 15174 Comm: syz.0.2646 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 811.868806][T15174] Tainted: [L]=SOFTLOCKUP [ 811.868814][T15174] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 811.868826][T15174] Call Trace: [ 811.868836][T15174] [ 811.868845][T15174] dump_stack_lvl+0x100/0x190 [ 811.868877][T15174] should_fail_ex.cold+0x5/0xa [ 811.868902][T15174] should_failslab+0xc2/0x120 [ 811.868955][T15174] __kmalloc_noprof+0xfc/0x840 [ 811.868977][T15174] ? kernfs_fop_write_iter+0x26a/0x5f0 [ 811.869009][T15174] kernfs_fop_write_iter+0x26a/0x5f0 [ 811.869038][T15174] vfs_write+0x6af/0x1050 [ 811.869058][T15174] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 811.869086][T15174] ? __pfx_vfs_write+0x10/0x10 [ 811.869103][T15174] ? find_held_lock+0x2b/0x80 [ 811.869156][T15174] ksys_write+0x12a/0x250 [ 811.869174][T15174] ? __pfx_ksys_write+0x10/0x10 [ 811.869190][T15174] ? ksys_write+0x1ac/0x250 [ 811.869207][T15174] ? __pfx_ksys_write+0x10/0x10 [ 811.869230][T15174] __do_fast_syscall_32+0x13a/0x8b0 [ 811.869255][T15174] ? lockdep_hardirqs_on+0x7d/0x110 [ 811.869280][T15174] do_fast_syscall_32+0x32/0x70 [ 811.869304][T15174] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 811.869328][T15174] RIP: 0023:0xf7fd8fec [ 811.869352][T15174] Code: Unable to access opcode bytes at 0xf7fd8fc2. [ 811.869361][T15174] RSP: 002b:00000000f545450c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 811.869381][T15174] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000300 [ 811.869393][T15174] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000000 [ 811.869405][T15174] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 811.869416][T15174] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 811.869427][T15174] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 811.869452][T15174] [ 812.628871][T15191] xt_ipcomp: unknown flags 1D [ 813.142072][T15200] xt_ipcomp: unknown flags 1D [ 815.874790][T15211] warning: `syz.0.2652' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 815.978830][T15223] FAULT_INJECTION: forcing a failure. [ 815.978830][T15223] name failslab, interval 1, probability 0, space 0, times 0 [ 815.978935][T15223] CPU: 2 UID: 0 PID: 15223 Comm: syz.0.2657 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 815.978964][T15223] Tainted: [L]=SOFTLOCKUP [ 815.978970][T15223] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 815.978978][T15223] Call Trace: [ 815.978983][T15223] [ 815.978988][T15223] dump_stack_lvl+0x100/0x190 [ 815.979018][T15223] should_fail_ex.cold+0x5/0xa [ 815.979036][T15223] should_failslab+0xc2/0x120 [ 815.979051][T15223] kmem_cache_alloc_noprof+0x92/0x6a0 [ 815.979065][T15223] ? do_getname+0x35/0x390 [ 815.979082][T15223] do_getname+0x35/0x390 [ 815.979099][T15223] do_sys_openat2+0xc7/0x1e0 [ 815.979114][T15223] ? __pfx_do_sys_openat2+0x10/0x10 [ 815.979130][T15223] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 815.979146][T15223] ? __fget_files+0x21f/0x3d0 [ 815.979163][T15223] __ia32_sys_creat+0xcb/0x120 [ 815.979186][T15223] ? __pfx___ia32_sys_creat+0x10/0x10 [ 815.979211][T15223] ? __pfx_ksys_write+0x10/0x10 [ 815.979230][T15223] ? __do_fast_syscall_32+0xb3/0x8b0 [ 815.979255][T15223] __do_fast_syscall_32+0x13a/0x8b0 [ 815.979278][T15223] ? lockdep_hardirqs_on+0x7d/0x110 [ 815.979301][T15223] do_fast_syscall_32+0x32/0x70 [ 815.979322][T15223] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 815.979337][T15223] RIP: 0023:0xf7fd8fec [ 815.979351][T15223] Code: Unable to access opcode bytes at 0xf7fd8fc2. [ 815.979357][T15223] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000008 [ 815.979369][T15223] RAX: ffffffffffffffda RBX: 00000000800000c0 RCX: 0000000000000000 [ 815.979376][T15223] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 815.979383][T15223] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 815.979390][T15223] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 815.979397][T15223] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 815.979411][T15223] [ 815.988214][T15223] loop9: detected capacity change from 0 to 524287998 [ 815.993248][T15219] bond1: entered allmulticast mode [ 815.994446][T15219] 8021q: adding VLAN 0 to HW filter on device bond1 [ 816.276010][T15236] netlink: 'syz.2.2662': attribute type 1 has an invalid length. [ 816.276088][T15236] netlink: 174516 bytes leftover after parsing attributes in process `syz.2.2662'. [ 816.276133][T15236] netlink: 'syz.2.2662': attribute type 1 has an invalid length. [ 816.276162][T15236] netlink: 2016 bytes leftover after parsing attributes in process `syz.2.2662'. [ 816.320117][ T9] usb 9-1: new high-speed USB device number 69 using dummy_hcd [ 816.343502][T15240] FAULT_INJECTION: forcing a failure. [ 816.343502][T15240] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 816.343565][T15240] CPU: 2 UID: 0 PID: 15240 Comm: syz.0.2663 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 816.343596][T15240] Tainted: [L]=SOFTLOCKUP [ 816.343602][T15240] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 816.343623][T15240] Call Trace: [ 816.343628][T15240] [ 816.343634][T15240] dump_stack_lvl+0x100/0x190 [ 816.343656][T15240] should_fail_ex.cold+0x5/0xa [ 816.343672][T15240] _copy_to_user+0x32/0xd0 [ 816.343687][T15240] __do_sys_newuname+0x11c/0x260 [ 816.343704][T15240] ? __pfx___do_sys_newuname+0x10/0x10 [ 816.343744][T15240] __do_fast_syscall_32+0x13a/0x8b0 [ 816.343762][T15240] ? lockdep_hardirqs_on+0x7d/0x110 [ 816.343779][T15240] do_fast_syscall_32+0x32/0x70 [ 816.343796][T15240] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 816.343812][T15240] RIP: 0023:0xf7fd8fec [ 816.343823][T15240] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 816.343836][T15240] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 000000000000007a [ 816.343849][T15240] RAX: ffffffffffffffda RBX: 0000000080000300 RCX: 0000000000000000 [ 816.343857][T15240] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 816.343865][T15240] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 816.343872][T15240] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 816.343880][T15240] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 816.343895][T15240] [ 816.470312][ T9] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 816.474628][ T9] usb 9-1: config 0 has no interfaces? [ 816.481861][T15247] FAULT_INJECTION: forcing a failure. [ 816.481861][T15247] name failslab, interval 1, probability 0, space 0, times 0 [ 816.481913][T15247] CPU: 3 UID: 0 PID: 15247 Comm: syz.2.2667 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 816.481948][T15247] Tainted: [L]=SOFTLOCKUP [ 816.481954][T15247] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 816.481963][T15247] Call Trace: [ 816.481969][T15247] [ 816.481975][T15247] dump_stack_lvl+0x100/0x190 [ 816.482002][T15247] should_fail_ex.cold+0x5/0xa [ 816.482024][T15247] should_failslab+0xc2/0x120 [ 816.482046][T15247] __kmalloc_noprof+0xfc/0x840 [ 816.482064][T15247] ? rcu_is_watching+0x13/0xc0 [ 816.482075][T15247] ? tomoyo_realpath_from_path+0xb6/0x690 [ 816.482097][T15247] tomoyo_realpath_from_path+0xb6/0x690 [ 816.482117][T15247] tomoyo_path_number_perm+0x23c/0x580 [ 816.482131][T15247] ? tomoyo_path_number_perm+0x22e/0x580 [ 816.482147][T15247] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 816.482162][T15247] ? get_pid_task+0x106/0x250 [ 816.482177][T15247] ? __lock_acquire+0x4c5/0x1ec0 [ 816.482198][T15247] ? __fget_files+0x34/0x3d0 [ 816.482210][T15247] ? find_held_lock+0x2b/0x80 [ 816.482221][T15247] ? __fget_files+0x215/0x3d0 [ 816.482231][T15247] ? hook_file_ioctl_common+0x140/0x440 [ 816.482246][T15247] ? __fget_files+0x215/0x3d0 [ 816.482260][T15247] ? __fget_files+0x21f/0x3d0 [ 816.482274][T15247] security_file_ioctl_compat+0xd3/0x230 [ 816.482289][T15247] __ia32_compat_sys_ioctl+0xc2/0x360 [ 816.482309][T15247] __do_fast_syscall_32+0x13a/0x8b0 [ 816.482327][T15247] ? lockdep_hardirqs_on+0x7d/0x110 [ 816.482349][T15247] do_fast_syscall_32+0x32/0x70 [ 816.482370][T15247] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 816.482392][T15247] RIP: 0023:0xf7f14fec [ 816.482410][T15247] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 816.482418][T15247] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 816.482438][T15247] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000004090ae82 [ 816.482449][T15247] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 816.482460][T15247] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 816.482469][T15247] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 816.482476][T15247] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 816.482496][T15247] [ 816.482534][T15247] ERROR: Out of memory at tomoyo_realpath_from_path. [ 816.510914][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 816.510937][ T9] usb 9-1: Product: syz [ 816.510948][ T9] usb 9-1: Manufacturer: syz [ 816.510957][ T9] usb 9-1: SerialNumber: syz [ 816.550588][ T9] usb 9-1: config 0 descriptor?? [ 816.744604][T15254] overlayfs: failed lookup in lower (newroot/66, name='bus', err=-40): overlapping layers [ 816.815236][T15256] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2670'. [ 816.932219][T15228] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 816.932733][T15228] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 817.211718][T15266] netlink: 2 bytes leftover after parsing attributes in process `syz.2.2674'. [ 817.594133][T15270] netlink: 'syz.0.2675': attribute type 4 has an invalid length. [ 818.436928][T15276] 8021q: VLANs not supported on sit0 [ 818.885864][T15279] FAULT_INJECTION: forcing a failure. [ 818.885864][T15279] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 818.885993][T15279] CPU: 2 UID: 0 PID: 15279 Comm: syz.5.2679 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 818.886035][T15279] Tainted: [L]=SOFTLOCKUP [ 818.886044][T15279] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 818.886055][T15279] Call Trace: [ 818.886063][T15279] [ 818.886071][T15279] dump_stack_lvl+0x100/0x190 [ 818.886114][T15279] should_fail_ex.cold+0x5/0xa [ 818.886140][T15279] _copy_from_user+0x2e/0xd0 [ 818.886163][T15279] __sys_bpf+0x2f5/0x4a30 [ 818.886189][T15279] ? __pfx___sys_bpf+0x10/0x10 [ 818.886206][T15279] ? lock_acquire+0x1d1/0x380 [ 818.886231][T15279] ? get_pid_task+0x2a/0x250 [ 818.886251][T15279] ? find_held_lock+0x2b/0x80 [ 818.886269][T15279] ? get_pid_task+0xfc/0x250 [ 818.886287][T15279] ? get_pid_task+0xfc/0x250 [ 818.886312][T15279] ? proc_fail_nth_write+0x9f/0x220 [ 818.886332][T15279] ? find_held_lock+0x2b/0x80 [ 818.886356][T15279] ? rcu_read_lock_any_held+0x6a/0x90 [ 818.886377][T15279] ? find_held_lock+0x2b/0x80 [ 818.886396][T15279] ? ksys_write+0x190/0x250 [ 818.886414][T15279] ? ksys_write+0x190/0x250 [ 818.886432][T15279] ? lock_acquire+0x1d1/0x380 [ 818.886472][T15279] ? fput+0x7c/0x100 [ 818.886504][T15279] ? __ia32_sys_bpf+0xcc/0x170 [ 818.886521][T15279] __ia32_sys_bpf+0xcc/0x170 [ 818.886541][T15279] ? __do_fast_syscall_32+0xb3/0x8b0 [ 818.886569][T15279] __do_fast_syscall_32+0x13a/0x8b0 [ 818.886593][T15279] ? lockdep_hardirqs_on+0x7d/0x110 [ 818.886619][T15279] do_fast_syscall_32+0x32/0x70 [ 818.886643][T15279] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 818.886668][T15279] RIP: 0023:0xf701efec [ 818.886691][T15279] Code: Unable to access opcode bytes at 0xf701efc2. [ 818.886700][T15279] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 818.886719][T15279] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 818.886731][T15279] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 818.886742][T15279] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 818.886752][T15279] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 818.886762][T15279] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 818.886786][T15279] [ 818.931578][ T6073] usb 9-1: USB disconnect, device number 69 [ 819.133692][T15287] macvlan1: entered promiscuous mode [ 819.133875][T15287] macvlan1: entered allmulticast mode [ 819.133884][T15287] veth1_vlan: entered allmulticast mode [ 819.244817][T15297] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2681'. [ 820.511727][T15336] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 820.511945][T15336] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 820.721967][T15336] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 820.722378][T15336] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 821.409254][T11998] usb 10-1: new low-speed USB device number 4 using dummy_hcd [ 821.580744][T11998] usb 10-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 821.582067][T11998] usb 10-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 821.582127][T11998] usb 10-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 821.583555][T11998] usb 10-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 821.583595][T11998] usb 10-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 821.584901][T11998] usb 10-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 821.584940][T11998] usb 10-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 821.588375][T11998] usb 10-1: string descriptor 0 read error: -22 [ 821.588497][T11998] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 821.801476][T15357] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2693'. [ 822.178315][T15350] tipc: Enabling of bearer rejected, failed to enable media [ 822.187945][T15064] usb 10-1: USB disconnect, device number 4 [ 822.238995][T15363] Invalid argument reading file caps for ./file0 [ 822.326230][T15367] xt_ipcomp: unknown flags 1D [ 822.433806][ T30] kernel read not supported for file /video9 (pid: 30 comm: kworker/1:0) [ 822.500665][T15376] netlink: zone id is out of range [ 822.500841][T15376] netlink: zone id is out of range [ 822.501226][T15376] netlink: zone id is out of range [ 822.501489][T15376] netlink: zone id is out of range [ 822.501824][T15376] netlink: zone id is out of range [ 822.501991][T15376] netlink: zone id is out of range [ 822.502059][T15376] netlink: zone id is out of range [ 822.502536][T15376] netlink: zone id is out of range [ 822.502698][T15376] netlink: zone id is out of range [ 822.502893][T15376] netlink: zone id is out of range [ 822.795444][T15383] Illegal XDP return value 458 on prog (id 132) dev N/A, expect packet loss! [ 823.335275][T15402] FAULT_INJECTION: forcing a failure. [ 823.335275][T15402] name failslab, interval 1, probability 0, space 0, times 0 [ 823.335355][T15402] CPU: 2 UID: 0 PID: 15402 Comm: syz.0.2707 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 823.335403][T15402] Tainted: [L]=SOFTLOCKUP [ 823.335412][T15402] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 823.335426][T15402] Call Trace: [ 823.335439][T15402] [ 823.335449][T15402] dump_stack_lvl+0x100/0x190 [ 823.335483][T15402] should_fail_ex.cold+0x5/0xa [ 823.335512][T15402] should_failslab+0xc2/0x120 [ 823.335540][T15402] __kmalloc_noprof+0xfc/0x840 [ 823.335562][T15402] ? rcu_is_watching+0x13/0xc0 [ 823.335583][T15402] ? tomoyo_realpath_from_path+0xb6/0x690 [ 823.335624][T15402] tomoyo_realpath_from_path+0xb6/0x690 [ 823.335663][T15402] tomoyo_path_number_perm+0x23c/0x580 [ 823.335691][T15402] ? tomoyo_path_number_perm+0x22e/0x580 [ 823.335721][T15402] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 823.335746][T15402] ? rcu_is_watching+0x13/0xc0 [ 823.335765][T15402] ? irqentry_exit+0x24d/0xa10 [ 823.335801][T15402] ? __lock_acquire+0x4c5/0x1ec0 [ 823.335844][T15402] ? __fget_files+0x34/0x3d0 [ 823.335868][T15402] ? find_held_lock+0x2b/0x80 [ 823.335889][T15402] ? __fget_files+0x215/0x3d0 [ 823.335909][T15402] ? hook_file_ioctl_common+0x140/0x440 [ 823.335937][T15402] ? __fget_files+0x215/0x3d0 [ 823.335964][T15402] ? __fget_files+0x21f/0x3d0 [ 823.335991][T15402] security_file_ioctl_compat+0xd3/0x230 [ 823.336023][T15402] __ia32_compat_sys_ioctl+0xc2/0x360 [ 823.336061][T15402] __do_fast_syscall_32+0x13a/0x8b0 [ 823.336090][T15402] ? lockdep_hardirqs_on+0x7d/0x110 [ 823.336119][T15402] do_fast_syscall_32+0x32/0x70 [ 823.336149][T15402] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 823.336176][T15402] RIP: 0023:0xf7fd8fec [ 823.336199][T15402] Code: Unable to access opcode bytes at 0xf7fd8fc2. [ 823.336210][T15402] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 823.336232][T15402] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040085618 [ 823.336247][T15402] RDX: 00000000800000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 823.336261][T15402] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 823.336274][T15402] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 823.336287][T15402] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 823.336317][T15402] [ 823.336383][T15402] ERROR: Out of memory at tomoyo_realpath_from_path. [ 823.623286][T15409] FAULT_INJECTION: forcing a failure. [ 823.623286][T15409] name failslab, interval 1, probability 0, space 0, times 0 [ 823.623358][T15409] CPU: 3 UID: 0 PID: 15409 Comm: syz.2.2709 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 823.623401][T15409] Tainted: [L]=SOFTLOCKUP [ 823.623410][T15409] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 823.623422][T15409] Call Trace: [ 823.623431][T15409] [ 823.623440][T15409] dump_stack_lvl+0x100/0x190 [ 823.623470][T15409] should_fail_ex.cold+0x5/0xa [ 823.623494][T15409] should_failslab+0xc2/0x120 [ 823.623519][T15409] __kmalloc_noprof+0xfc/0x840 [ 823.623539][T15409] ? rcu_is_watching+0x13/0xc0 [ 823.623566][T15409] ? tomoyo_realpath_from_path+0xb6/0x690 [ 823.623599][T15409] tomoyo_realpath_from_path+0xb6/0x690 [ 823.623634][T15409] tomoyo_path_number_perm+0x23c/0x580 [ 823.623659][T15409] ? tomoyo_path_number_perm+0x22e/0x580 [ 823.623687][T15409] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 823.623712][T15409] ? get_pid_task+0x106/0x250 [ 823.623741][T15409] ? __lock_acquire+0x4c5/0x1ec0 [ 823.623779][T15409] ? __fget_files+0x34/0x3d0 [ 823.623801][T15409] ? find_held_lock+0x2b/0x80 [ 823.623820][T15409] ? __fget_files+0x215/0x3d0 [ 823.623839][T15409] ? hook_file_ioctl_common+0x140/0x440 [ 823.623866][T15409] ? __fget_files+0x215/0x3d0 [ 823.623890][T15409] ? __fget_files+0x21f/0x3d0 [ 823.623915][T15409] security_file_ioctl_compat+0xd3/0x230 [ 823.623943][T15409] __ia32_compat_sys_ioctl+0xc2/0x360 [ 823.623976][T15409] __do_fast_syscall_32+0x13a/0x8b0 [ 823.624002][T15409] ? lockdep_hardirqs_on+0x7d/0x110 [ 823.624029][T15409] do_fast_syscall_32+0x32/0x70 [ 823.624055][T15409] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 823.624078][T15409] RIP: 0023:0xf7f14fec [ 823.624102][T15409] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 823.624112][T15409] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 823.624133][T15409] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000008030ae7c [ 823.624146][T15409] RDX: 00000000800000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 823.624159][T15409] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 823.624173][T15409] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 823.624185][T15409] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 823.624211][T15409] [ 823.624266][T15409] ERROR: Out of memory at tomoyo_realpath_from_path. [ 823.780654][ T30] logitech-hidpp-device 0005:046D:B012.0002: unknown main item tag 0x0 [ 823.780757][ T30] logitech-hidpp-device 0005:046D:B012.0002: unknown main item tag 0x0 [ 823.780838][ T30] logitech-hidpp-device 0005:046D:B012.0002: unknown main item tag 0x0 [ 823.780885][ T30] logitech-hidpp-device 0005:046D:B012.0002: unknown main item tag 0x0 [ 823.780942][ T30] logitech-hidpp-device 0005:046D:B012.0002: unknown main item tag 0x0 [ 823.780965][ T30] logitech-hidpp-device 0005:046D:B012.0002: unknown main item tag 0x0 [ 823.780987][ T30] logitech-hidpp-device 0005:046D:B012.0002: unknown main item tag 0x0 [ 823.781008][ T30] logitech-hidpp-device 0005:046D:B012.0002: unknown main item tag 0x0 [ 823.781031][ T30] logitech-hidpp-device 0005:046D:B012.0002: unknown main item tag 0x0 [ 823.781055][ T30] logitech-hidpp-device 0005:046D:B012.0002: unknown main item tag 0x0 [ 823.792061][ T30] logitech-hidpp-device 0005:046D:B012.0002: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 823.961122][T15421] 9p: Bad value for 'wfdno' [ 823.974908][T15415] fido_id[15415]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 824.086838][T15425] FAULT_INJECTION: forcing a failure. [ 824.086838][T15425] name failslab, interval 1, probability 0, space 0, times 0 [ 824.086920][T15425] CPU: 3 UID: 0 PID: 15425 Comm: syz.4.2715 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 824.086957][T15425] Tainted: [L]=SOFTLOCKUP [ 824.086964][T15425] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 824.086973][T15425] Call Trace: [ 824.086979][T15425] [ 824.086986][T15425] dump_stack_lvl+0x100/0x190 [ 824.087012][T15425] should_fail_ex.cold+0x5/0xa [ 824.087032][T15425] should_failslab+0xc2/0x120 [ 824.087052][T15425] __kmalloc_noprof+0xfc/0x840 [ 824.087073][T15425] ? kernfs_fop_write_iter+0x26a/0x5f0 [ 824.087098][T15425] kernfs_fop_write_iter+0x26a/0x5f0 [ 824.087121][T15425] vfs_write+0x6af/0x1050 [ 824.087135][T15425] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 824.087157][T15425] ? __pfx_vfs_write+0x10/0x10 [ 824.087170][T15425] ? find_held_lock+0x2b/0x80 [ 824.087197][T15425] ksys_write+0x12a/0x250 [ 824.087216][T15425] ? __pfx_ksys_write+0x10/0x10 [ 824.087232][T15425] ? ksys_write+0x1ac/0x250 [ 824.087252][T15425] ? __pfx_ksys_write+0x10/0x10 [ 824.087274][T15425] __do_fast_syscall_32+0x13a/0x8b0 [ 824.087299][T15425] ? lockdep_hardirqs_on+0x7d/0x110 [ 824.087325][T15425] do_fast_syscall_32+0x32/0x70 [ 824.087351][T15425] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 824.087374][T15425] RIP: 0023:0xf70aefec [ 824.087396][T15425] Code: Unable to access opcode bytes at 0xf70aefc2. [ 824.087405][T15425] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 824.087424][T15425] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 824.087450][T15425] RDX: 000000000000001f RSI: 0000000000000000 RDI: 0000000000000000 [ 824.087464][T15425] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 824.087475][T15425] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 824.087487][T15425] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 824.087510][T15425] [ 824.159309][ T5883] usb 7-1: new high-speed USB device number 84 using dummy_hcd [ 824.309345][ T5883] usb 7-1: Using ep0 maxpacket: 16 [ 824.311001][ T5883] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 824.314153][ T5883] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 824.314179][ T5883] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 824.314211][ T5883] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 824.318655][ T5883] usb 7-1: config 0 descriptor?? [ 824.338916][T15433] trusted_key: encrypted_key: key user:syz not found [ 824.570354][T15445] capability: warning: `syz.4.2722' uses deprecated v2 capabilities in a way that may be insecure [ 824.611257][T15449] FAULT_INJECTION: forcing a failure. [ 824.611257][T15449] name failslab, interval 1, probability 0, space 0, times 0 [ 824.620377][T15449] CPU: 1 UID: 0 PID: 15449 Comm: syz.4.2723 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 824.620443][T15449] Tainted: [L]=SOFTLOCKUP [ 824.620454][T15449] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 824.620468][T15449] Call Trace: [ 824.620479][T15449] [ 824.620490][T15449] dump_stack_lvl+0x100/0x190 [ 824.620531][T15449] should_fail_ex.cold+0x5/0xa [ 824.620566][T15449] should_failslab+0xc2/0x120 [ 824.620599][T15449] __kmalloc_noprof+0xfc/0x840 [ 824.620626][T15449] ? rcu_is_watching+0x13/0xc0 [ 824.620653][T15449] ? tomoyo_realpath_from_path+0xb6/0x690 [ 824.620697][T15449] tomoyo_realpath_from_path+0xb6/0x690 [ 824.620738][T15449] tomoyo_path_number_perm+0x23c/0x580 [ 824.620770][T15449] ? tomoyo_path_number_perm+0x22e/0x580 [ 824.620806][T15449] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 824.620843][T15449] ? get_pid_task+0x106/0x250 [ 824.620907][T15449] ? __lock_acquire+0x4c5/0x1ec0 [ 824.620957][T15449] ? __fget_files+0x34/0x3d0 [ 824.620986][T15449] ? find_held_lock+0x2b/0x80 [ 824.621014][T15449] ? __fget_files+0x215/0x3d0 [ 824.621039][T15449] ? hook_file_ioctl_common+0x140/0x440 [ 824.621072][T15449] ? __fget_files+0x215/0x3d0 [ 824.621103][T15449] ? __fget_files+0x21f/0x3d0 [ 824.621134][T15449] security_file_ioctl_compat+0xd3/0x230 [ 824.621169][T15449] __ia32_compat_sys_ioctl+0xc2/0x360 [ 824.621212][T15449] __do_fast_syscall_32+0x13a/0x8b0 [ 824.621249][T15449] ? lockdep_hardirqs_on+0x7d/0x110 [ 824.621283][T15449] do_fast_syscall_32+0x32/0x70 [ 824.621317][T15449] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 824.621346][T15449] RIP: 0023:0xf70aefec [ 824.621375][T15449] Code: Unable to access opcode bytes at 0xf70aefc2. [ 824.621389][T15449] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 824.621415][T15449] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000000089e0 [ 824.621441][T15449] RDX: 0000000080000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 824.621456][T15449] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 824.621472][T15449] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 824.621486][T15449] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 824.621516][T15449] [ 824.621592][T15449] ERROR: Out of memory at tomoyo_realpath_from_path. [ 824.728127][T15450] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 824.728594][T15450] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 824.897195][T15457] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2726'. [ 825.120786][T15457] team0: Port device team_slave_1 removed [ 825.194118][ T5883] usbhid 7-1:0.0: can't add hid device: -71 [ 825.195201][ T5883] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 825.241127][ T5883] usb 7-1: USB disconnect, device number 84 [ 825.535214][ T5739] Bluetooth: hci0: command 0x0405 tx timeout [ 825.566224][T15468] netlink: 'syz.5.2731': attribute type 2 has an invalid length. [ 825.803741][T15473] netlink: 'syz.5.2733': attribute type 1 has an invalid length. [ 826.036039][T15473] Invalid option length (1048307) for dns_resolver key [ 827.104219][T11998] usb 10-1: new low-speed USB device number 5 using dummy_hcd [ 827.158589][T15514] FAULT_INJECTION: forcing a failure. [ 827.158589][T15514] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 827.158656][T15514] CPU: 1 UID: 0 PID: 15514 Comm: syz.2.2750 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 827.158684][T15514] Tainted: [L]=SOFTLOCKUP [ 827.158690][T15514] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 827.158697][T15514] Call Trace: [ 827.158701][T15514] [ 827.158706][T15514] dump_stack_lvl+0x100/0x190 [ 827.158725][T15514] should_fail_ex.cold+0x5/0xa [ 827.158742][T15514] _copy_from_user+0x2e/0xd0 [ 827.158755][T15514] get_compat_msghdr+0xb3/0x480 [ 827.158771][T15514] ? __pfx_get_compat_msghdr+0x10/0x10 [ 827.158792][T15514] ___sys_sendmsg+0x1b6/0x1e0 [ 827.158810][T15514] ? __pfx____sys_sendmsg+0x10/0x10 [ 827.158833][T15514] ? find_held_lock+0x2b/0x80 [ 827.158855][T15514] __sys_sendmsg+0x160/0x210 [ 827.158871][T15514] ? __pfx___sys_sendmsg+0x10/0x10 [ 827.158903][T15514] ? __pfx_ksys_write+0x10/0x10 [ 827.158924][T15514] __do_fast_syscall_32+0x13a/0x8b0 [ 827.158947][T15514] ? lockdep_hardirqs_on+0x7d/0x110 [ 827.158968][T15514] do_fast_syscall_32+0x32/0x70 [ 827.158990][T15514] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 827.159012][T15514] RIP: 0023:0xf7f14fec [ 827.159031][T15514] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 827.159039][T15514] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 827.159057][T15514] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 827.159069][T15514] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 827.159080][T15514] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 827.159090][T15514] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 827.159101][T15514] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 827.159138][T15514] [ 827.270771][T11998] usb 10-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 827.275805][T11998] usb 10-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 827.275858][T11998] usb 10-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 827.284274][T11998] usb 10-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 827.284309][T11998] usb 10-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 827.293811][T11998] usb 10-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 827.293853][T11998] usb 10-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 827.304980][T11998] usb 10-1: string descriptor 0 read error: -22 [ 827.305109][T11998] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 827.310198][T15530] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2756'. [ 827.330577][T15532] FAULT_INJECTION: forcing a failure. [ 827.330577][T15532] name failslab, interval 1, probability 0, space 0, times 0 [ 827.330653][T15532] CPU: 3 UID: 0 PID: 15532 Comm: syz.2.2757 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 827.330687][T15532] Tainted: [L]=SOFTLOCKUP [ 827.330694][T15532] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 827.330702][T15532] Call Trace: [ 827.330708][T15532] [ 827.330714][T15532] dump_stack_lvl+0x100/0x190 [ 827.330737][T15532] should_fail_ex.cold+0x5/0xa [ 827.330756][T15532] should_failslab+0xc2/0x120 [ 827.330773][T15532] kmem_cache_alloc_noprof+0x92/0x6a0 [ 827.330787][T15532] ? __pfx_map_id_range_down+0x10/0x10 [ 827.330805][T15532] ? security_inode_alloc+0x3b/0x2c0 [ 827.330825][T15532] security_inode_alloc+0x3b/0x2c0 [ 827.330842][T15532] inode_init_always_gfp+0xc6f/0xfb0 [ 827.330859][T15532] alloc_inode+0x8e/0x250 [ 827.330878][T15532] new_inode+0x22/0x1c0 [ 827.330898][T15532] proc_pid_make_inode+0x22/0x160 [ 827.330915][T15532] proc_pident_instantiate+0x85/0x310 [ 827.330933][T15532] proc_pident_lookup+0x1e3/0x270 [ 827.330951][T15532] ? __pfx_proc_tid_base_lookup+0x10/0x10 [ 827.330968][T15532] lookup_open+0xa79/0x1990 [ 827.330994][T15532] path_openat+0xa2c/0x2440 [ 827.331013][T15532] ? __pfx_path_openat+0x10/0x10 [ 827.331033][T15532] do_file_open+0x20e/0x430 [ 827.331049][T15532] ? __pfx_do_file_open+0x10/0x10 [ 827.331071][T15532] ? __pfx_kfree_link+0x10/0x10 [ 827.331098][T15532] ? _raw_spin_unlock+0x28/0x50 [ 827.331113][T15532] ? alloc_fd+0x471/0x7a0 [ 827.331132][T15532] do_sys_openat2+0x10f/0x1e0 [ 827.331150][T15532] ? __pfx_do_sys_openat2+0x10/0x10 [ 827.331170][T15532] ? trace_event_raw_event_msr_trace_class+0x1a1/0x270 [ 827.331188][T15532] ? __pfx_trace_event_raw_event_msr_trace_class+0x10/0x10 [ 827.331207][T15532] __ia32_compat_sys_openat+0x12d/0x210 [ 827.331227][T15532] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 827.331253][T15532] do_int80_emulation+0x166/0x650 [ 827.331273][T15532] asm_int80_emulation+0x1a/0x20 [ 827.331287][T15532] RIP: 0023:0xf71175ab [ 827.331299][T15532] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 827.331312][T15532] RSP: 002b:00000000f53d64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 827.331326][T15532] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f71e1b2e [ 827.331335][T15532] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 827.331343][T15532] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 827.331351][T15532] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 827.331359][T15532] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 827.331376][T15532] [ 827.376952][T15534] FAULT_INJECTION: forcing a failure. [ 827.376952][T15534] name failslab, interval 1, probability 0, space 0, times 0 [ 827.376978][T15534] CPU: 2 UID: 0 PID: 15534 Comm: syz.2.2758 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 827.376998][T15534] Tainted: [L]=SOFTLOCKUP [ 827.377002][T15534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 827.377010][T15534] Call Trace: [ 827.377015][T15534] [ 827.377020][T15534] dump_stack_lvl+0x100/0x190 [ 827.377056][T15534] should_fail_ex.cold+0x5/0xa [ 827.377076][T15534] should_failslab+0xc2/0x120 [ 827.377098][T15534] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 827.377113][T15534] ? proc_alloc_inode+0x25/0x200 [ 827.377131][T15534] ? __pfx_proc_alloc_inode+0x10/0x10 [ 827.377149][T15534] proc_alloc_inode+0x25/0x200 [ 827.377164][T15534] alloc_inode+0x68/0x250 [ 827.377181][T15534] new_inode+0x22/0x1c0 [ 827.377200][T15534] proc_pid_make_inode+0x22/0x160 [ 827.377216][T15534] proc_pident_instantiate+0x85/0x310 [ 827.377232][T15534] proc_pident_lookup+0x1e3/0x270 [ 827.377249][T15534] ? __pfx_proc_tid_base_lookup+0x10/0x10 [ 827.377265][T15534] lookup_open+0xa79/0x1990 [ 827.377290][T15534] path_openat+0xa2c/0x2440 [ 827.377305][T15534] ? __pfx_path_openat+0x10/0x10 [ 827.377324][T15534] do_file_open+0x20e/0x430 [ 827.377338][T15534] ? __pfx_do_file_open+0x10/0x10 [ 827.377358][T15534] ? __pfx_kfree_link+0x10/0x10 [ 827.377380][T15534] ? _raw_spin_unlock+0x28/0x50 [ 827.377393][T15534] ? alloc_fd+0x471/0x7a0 [ 827.377411][T15534] do_sys_openat2+0x10f/0x1e0 [ 827.377427][T15534] ? __pfx_do_sys_openat2+0x10/0x10 [ 827.377445][T15534] ? trace_event_raw_event_msr_trace_class+0x1a1/0x270 [ 827.377464][T15534] ? __pfx_trace_event_raw_event_msr_trace_class+0x10/0x10 [ 827.377482][T15534] __ia32_compat_sys_openat+0x12d/0x210 [ 827.377500][T15534] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 827.377525][T15534] do_int80_emulation+0x166/0x650 [ 827.377545][T15534] asm_int80_emulation+0x1a/0x20 [ 827.377558][T15534] RIP: 0023:0xf71175ab [ 827.377569][T15534] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 827.377584][T15534] RSP: 002b:00000000f53d63cc EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 827.377599][T15534] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f53d6490 [ 827.377608][T15534] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 827.377615][T15534] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 827.377622][T15534] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 827.377630][T15534] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 827.377647][T15534] [ 827.499784][T15540] FAULT_INJECTION: forcing a failure. [ 827.499784][T15540] name failslab, interval 1, probability 0, space 0, times 0 [ 827.499828][T15540] CPU: 1 UID: 0 PID: 15540 Comm: syz.2.2760 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 827.499856][T15540] Tainted: [L]=SOFTLOCKUP [ 827.499865][T15540] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 827.499881][T15540] Call Trace: [ 827.499890][T15540] [ 827.499900][T15540] dump_stack_lvl+0x100/0x190 [ 827.499935][T15540] should_fail_ex.cold+0x5/0xa [ 827.499967][T15540] should_failslab+0xc2/0x120 [ 827.499993][T15540] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 827.500019][T15540] ? __d_alloc+0x35/0xa50 [ 827.500048][T15540] __d_alloc+0x35/0xa50 [ 827.500074][T15540] d_alloc+0x4a/0x1e0 [ 827.500100][T15540] lookup_one_qstr_excl+0x171/0x250 [ 827.500129][T15540] start_dirop+0x59/0xb0 [ 827.500150][T15540] simple_start_creating+0xf9/0x110 [ 827.500186][T15540] ? __pfx_simple_start_creating+0x10/0x10 [ 827.500214][T15540] ? mntput+0x70/0xa0 [ 827.500240][T15540] ? simple_pin_fs+0xa3/0x190 [ 827.500264][T15540] debugfs_start_creating.part.0+0x9f/0x180 [ 827.500289][T15540] __debugfs_create_file+0x86/0x4d0 [ 827.500315][T15540] debugfs_create_file_full+0x41/0x60 [ 827.500341][T15540] kvm_dev_ioctl+0x1560/0x1b50 [ 827.500370][T15540] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 827.500400][T15540] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 827.500420][T15540] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 827.500454][T15540] __do_fast_syscall_32+0x13a/0x8b0 [ 827.500484][T15540] do_fast_syscall_32+0x32/0x70 [ 827.500517][T15540] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 827.500543][T15540] RIP: 0023:0xf7f14fec [ 827.500567][T15540] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 827.500577][T15540] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 827.500598][T15540] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000000ae01 [ 827.500612][T15540] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 827.500627][T15540] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 827.500642][T15540] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 827.500656][T15540] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 827.500680][T15540] [ 827.528754][T15493] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2736'. [ 827.532648][T13842] usb 10-1: USB disconnect, device number 5 [ 827.828055][T15545] FAULT_INJECTION: forcing a failure. [ 827.828055][T15545] name failslab, interval 1, probability 0, space 0, times 0 [ 827.828180][T15545] CPU: 2 UID: 0 PID: 15545 Comm: syz.2.2762 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 827.828208][T15545] Tainted: [L]=SOFTLOCKUP [ 827.828217][T15545] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 827.828229][T15545] Call Trace: [ 827.828236][T15545] [ 827.828244][T15545] dump_stack_lvl+0x100/0x190 [ 827.828271][T15545] should_fail_ex.cold+0x5/0xa [ 827.828306][T15545] should_failslab+0xc2/0x120 [ 827.828329][T15545] __kmalloc_noprof+0xfc/0x840 [ 827.828350][T15545] ? rcu_is_watching+0x13/0xc0 [ 827.828371][T15545] ? tomoyo_realpath_from_path+0xb6/0x690 [ 827.828403][T15545] tomoyo_realpath_from_path+0xb6/0x690 [ 827.828435][T15545] tomoyo_path_number_perm+0x23c/0x580 [ 827.828456][T15545] ? tomoyo_path_number_perm+0x22e/0x580 [ 827.828479][T15545] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 827.828503][T15545] ? get_pid_task+0x106/0x250 [ 827.828531][T15545] ? __lock_acquire+0x4c5/0x1ec0 [ 827.828570][T15545] ? __fget_files+0x34/0x3d0 [ 827.828590][T15545] ? find_held_lock+0x2b/0x80 [ 827.828609][T15545] ? __fget_files+0x215/0x3d0 [ 827.828626][T15545] ? hook_file_ioctl_common+0x140/0x440 [ 827.828650][T15545] ? __fget_files+0x215/0x3d0 [ 827.828673][T15545] ? __fget_files+0x21f/0x3d0 [ 827.828698][T15545] security_file_ioctl_compat+0xd3/0x230 [ 827.828726][T15545] __ia32_compat_sys_ioctl+0xc2/0x360 [ 827.828758][T15545] __do_fast_syscall_32+0x13a/0x8b0 [ 827.828782][T15545] ? lockdep_hardirqs_on+0x7d/0x110 [ 827.828804][T15545] do_fast_syscall_32+0x32/0x70 [ 827.828826][T15545] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 827.828872][T15545] RIP: 0023:0xf7f14fec [ 827.828896][T15545] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 827.828905][T15545] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 827.828923][T15545] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000000ae01 [ 827.828934][T15545] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 827.828944][T15545] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 827.828960][T15545] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 827.828970][T15545] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 827.828993][T15545] [ 827.829040][T15545] ERROR: Out of memory at tomoyo_realpath_from_path. [ 828.003466][T15553] FAULT_INJECTION: forcing a failure. [ 828.003466][T15553] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 828.003546][T15553] CPU: 1 UID: 0 PID: 15553 Comm: syz.0.2767 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 828.003583][T15553] Tainted: [L]=SOFTLOCKUP [ 828.003590][T15553] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 828.003600][T15553] Call Trace: [ 828.003607][T15553] [ 828.003616][T15553] dump_stack_lvl+0x100/0x190 [ 828.003645][T15553] should_fail_ex.cold+0x5/0xa [ 828.003670][T15553] _copy_from_user+0x2e/0xd0 [ 828.003692][T15553] __sys_bpf+0x2f5/0x4a30 [ 828.003717][T15553] ? __pfx___sys_bpf+0x10/0x10 [ 828.003734][T15553] ? lock_acquire+0x1d1/0x380 [ 828.003755][T15553] ? get_pid_task+0x2a/0x250 [ 828.003767][T15553] ? find_held_lock+0x2b/0x80 [ 828.003779][T15553] ? get_pid_task+0xfc/0x250 [ 828.003789][T15553] ? get_pid_task+0xfc/0x250 [ 828.003804][T15553] ? proc_fail_nth_write+0x9f/0x220 [ 828.003816][T15553] ? find_held_lock+0x2b/0x80 [ 828.003831][T15553] ? rcu_read_lock_any_held+0x6a/0x90 [ 828.003843][T15553] ? find_held_lock+0x2b/0x80 [ 828.003854][T15553] ? ksys_write+0x190/0x250 [ 828.003864][T15553] ? ksys_write+0x190/0x250 [ 828.003874][T15553] ? lock_acquire+0x1d1/0x380 [ 828.003898][T15553] ? fput+0x7c/0x100 [ 828.003912][T15553] ? __ia32_sys_bpf+0xcc/0x170 [ 828.003923][T15553] __ia32_sys_bpf+0xcc/0x170 [ 828.003936][T15553] ? __do_fast_syscall_32+0xb3/0x8b0 [ 828.003952][T15553] __do_fast_syscall_32+0x13a/0x8b0 [ 828.003967][T15553] ? lockdep_hardirqs_on+0x7d/0x110 [ 828.003982][T15553] do_fast_syscall_32+0x32/0x70 [ 828.003997][T15553] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 828.004012][T15553] RIP: 0023:0xf7fd8fec [ 828.004026][T15553] Code: Unable to access opcode bytes at 0xf7fd8fc2. [ 828.004033][T15553] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 828.004046][T15553] RAX: ffffffffffffffda RBX: 000000000000001c RCX: 0000000080000480 [ 828.004053][T15553] RDX: 0000000000000020 RSI: 0000000000000000 RDI: 0000000000000000 [ 828.004060][T15553] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 828.004066][T15553] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 828.004072][T15553] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 828.004087][T15553] [ 828.177754][T15562] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2768'. [ 828.344164][T15575] xt_ipcomp: unknown flags 1D [ 828.674797][T15558] Console: switching to colour dummy device 80x25 [ 828.753862][T15573] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 828.772451][T15573] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 828.772677][T15573] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 828.772979][T15573] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 828.773452][T15573] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 828.793488][T15573] pci 0000:00:01.0: Adding to iommu group 1 [ 828.799484][T15573] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 828.799524][T15573] pci 0000:00:01.0: vgaarb: bridge control possible [ 828.799542][T15573] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 828.816704][T15573] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 828.816962][T15573] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 828.819007][T15573] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 828.830453][T15573] [drm] Found bochs VGA, ID 0xb0c5. [ 828.830520][T15573] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 828.858683][T15573] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 829.048318][T15573] Console: switching to colour frame buffer device 160x50 [ 829.084409][T15573] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 829.736164][T15584] FAULT_INJECTION: forcing a failure. [ 829.736164][T15584] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 829.736765][T15584] CPU: 0 UID: 0 PID: 15584 Comm: syz.2.2775 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 829.736800][T15584] Tainted: [L]=SOFTLOCKUP [ 829.736808][T15584] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 829.736819][T15584] Call Trace: [ 829.736851][T15584] [ 829.736859][T15584] dump_stack_lvl+0x100/0x190 [ 829.736944][T15584] should_fail_ex.cold+0x5/0xa [ 829.736984][T15584] _copy_from_user+0x2e/0xd0 [ 829.737026][T15584] get_compat_msghdr+0xb3/0x480 [ 829.737075][T15584] ? __pfx_get_compat_msghdr+0x10/0x10 [ 829.737106][T15584] ___sys_sendmsg+0x1b6/0x1e0 [ 829.737133][T15584] ? __pfx____sys_sendmsg+0x10/0x10 [ 829.737169][T15584] ? find_held_lock+0x2b/0x80 [ 829.737201][T15584] __sys_sendmsg+0x160/0x210 [ 829.737222][T15584] ? __pfx___sys_sendmsg+0x10/0x10 [ 829.737246][T15584] ? __pfx_ksys_write+0x10/0x10 [ 829.737267][T15584] __do_fast_syscall_32+0x13a/0x8b0 [ 829.737312][T15584] ? lockdep_hardirqs_on+0x7d/0x110 [ 829.737334][T15584] do_fast_syscall_32+0x32/0x70 [ 829.737356][T15584] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 829.737377][T15584] RIP: 0023:0xf7f14fec [ 829.737396][T15584] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 829.737404][T15584] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 829.737422][T15584] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000780 [ 829.737433][T15584] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 829.737444][T15584] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 829.737454][T15584] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 829.737465][T15584] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 829.737487][T15584] [ 829.873205][T11323] kernel read not supported for file /video9 (pid: 11323 comm: kworker/3:4) [ 829.892252][T15594] misc userio: Begin command sent, but we're already running [ 829.892445][T15594] misc userio: Begin command sent, but we're already running [ 829.892684][T15594] misc userio: Begin command sent, but we're already running [ 829.892710][T15594] misc userio: Begin command sent, but we're already running [ 829.892726][T15594] misc userio: Begin command sent, but we're already running [ 829.892741][T15594] misc userio: Begin command sent, but we're already running [ 829.892757][T15594] misc userio: Begin command sent, but we're already running [ 829.892772][T15594] misc userio: Begin command sent, but we're already running [ 829.892788][T15594] misc userio: Begin command sent, but we're already running [ 829.892804][T15594] misc userio: Begin command sent, but we're already running [ 829.892844][T15594] misc userio: Begin command sent, but we're already running [ 829.892864][T15594] misc userio: Begin command sent, but we're already running [ 829.892880][T15594] misc userio: Begin command sent, but we're already running [ 829.892897][T15594] misc userio: Begin command sent, but we're already running [ 829.892915][T15594] misc userio: Begin command sent, but we're already running [ 829.892931][T15594] misc userio: Begin command sent, but we're already running [ 829.892947][T15594] misc userio: Begin command sent, but we're already running [ 829.892963][T15594] misc userio: Begin command sent, but we're already running [ 829.892978][T15594] misc userio: Begin command sent, but we're already running [ 829.892995][T15594] misc userio: Begin command sent, but we're already running [ 829.893012][T15594] misc userio: Begin command sent, but we're already running [ 829.893028][T15594] misc userio: Begin command sent, but we're already running [ 829.893043][T15594] misc userio: Begin command sent, but we're already running [ 829.893058][T15594] misc userio: Begin command sent, but we're already running [ 829.893073][T15594] misc userio: Begin command sent, but we're already running [ 829.893089][T15594] misc userio: Begin command sent, but we're already running [ 829.893104][T15594] misc userio: Begin command sent, but we're already running [ 829.893120][T15594] misc userio: Begin command sent, but we're already running [ 829.893135][T15594] misc userio: Begin command sent, but we're already running [ 829.893152][T15594] misc userio: Begin command sent, but we're already running [ 829.893166][T15594] misc userio: Begin command sent, but we're already running [ 829.893180][T15594] misc userio: Begin command sent, but we're already running [ 829.893196][T15594] misc userio: Begin command sent, but we're already running [ 829.893212][T15594] misc userio: Begin command sent, but we're already running [ 829.893228][T15594] misc userio: Begin command sent, but we're already running [ 829.893244][T15594] misc userio: Begin command sent, but we're already running [ 829.893261][T15594] misc userio: Begin command sent, but we're already running [ 829.893276][T15594] misc userio: Begin command sent, but we're already running [ 829.893293][T15594] misc userio: Begin command sent, but we're already running [ 829.893309][T15594] misc userio: Begin command sent, but we're already running [ 829.893326][T15594] misc userio: Begin command sent, but we're already running [ 829.893344][T15594] misc userio: Begin command sent, but we're already running [ 829.893359][T15594] misc userio: Begin command sent, but we're already running [ 829.893372][T15594] misc userio: Begin command sent, but we're already running [ 829.893385][T15594] misc userio: Begin command sent, but we're already running [ 829.893398][T15594] misc userio: Begin command sent, but we're already running [ 829.893412][T15594] misc userio: Begin command sent, but we're already running [ 829.893428][T15594] misc userio: Begin command sent, but we're already running [ 829.893443][T15594] misc userio: Begin command sent, but we're already running [ 829.893460][T15594] misc userio: Begin command sent, but we're already running [ 829.893474][T15594] misc userio: Begin command sent, but we're already running [ 829.893491][T15594] misc userio: Begin command sent, but we're already running [ 829.893506][T15594] misc userio: Begin command sent, but we're already running [ 829.893523][T15594] misc userio: Begin command sent, but we're already running [ 829.893540][T15594] misc userio: Begin command sent, but we're already running [ 829.893555][T15594] misc userio: Begin command sent, but we're already running [ 829.893571][T15594] misc userio: Begin command sent, but we're already running [ 829.893585][T15594] misc userio: Begin command sent, but we're already running [ 829.893602][T15594] misc userio: Begin command sent, but we're already running [ 829.893618][T15594] misc userio: Begin command sent, but we're already running [ 829.893634][T15594] misc userio: Begin command sent, but we're already running [ 829.893648][T15594] misc userio: Begin command sent, but we're already running [ 829.893662][T15594] misc userio: Begin command sent, but we're already running [ 829.893691][T15594] misc userio: Begin command sent, but we're already running [ 830.307219][T15611] program syz.4.2783 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 830.330680][T15611] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2783'. [ 830.330771][T15611] net_ratelimit: 9 callbacks suppressed [ 830.330826][T15611] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 830.341265][T15611] batadv_slave_0: entered promiscuous mode [ 830.341960][T15611] batadv_slave_0: left promiscuous mode [ 830.406878][T15612] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 830.406976][T15612] overlayfs: failed to set xattr on upper [ 830.407004][T15612] overlayfs: ...falling back to redirect_dir=nofollow. [ 830.407024][T15612] overlayfs: ...falling back to metacopy=off. [ 830.407030][T15612] overlayfs: ...falling back to index=off. [ 830.407034][T15612] overlayfs: ...falling back to uuid=null. [ 830.889724][T15622] binder: BINDER_SET_CONTEXT_MGR already set [ 830.890249][T15622] binder: 15619:15622 ioctl 4018620d 80000240 returned -16 [ 831.907175][T15642] FAULT_INJECTION: forcing a failure. [ 831.907175][T15642] name failslab, interval 1, probability 0, space 0, times 0 [ 831.907279][T15642] CPU: 3 UID: 0 PID: 15642 Comm: syz.5.2794 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 831.907328][T15642] Tainted: [L]=SOFTLOCKUP [ 831.907336][T15642] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 831.907345][T15642] Call Trace: [ 831.907352][T15642] [ 831.907359][T15642] dump_stack_lvl+0x100/0x190 [ 831.907382][T15642] should_fail_ex.cold+0x5/0xa [ 831.907402][T15642] should_failslab+0xc2/0x120 [ 831.907427][T15642] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 831.907444][T15642] ? __d_alloc+0x35/0xa50 [ 831.907464][T15642] __d_alloc+0x35/0xa50 [ 831.907481][T15642] ? __lock_acquire+0x4c5/0x1ec0 [ 831.907504][T15642] d_alloc_parallel+0x105/0x14c0 [ 831.907531][T15642] ? lock_acquire+0x1d1/0x380 [ 831.907549][T15642] ? lookup_slow+0x42/0x70 [ 831.907568][T15642] ? __pfx_d_alloc_parallel+0x10/0x10 [ 831.907589][T15642] ? __pfx___might_resched+0x10/0x10 [ 831.907606][T15642] ? find_held_lock+0x2b/0x80 [ 831.907619][T15642] ? __d_lookup+0x25c/0x4a0 [ 831.907640][T15642] ? down_read+0x13b/0x4c0 [ 831.907659][T15642] ? __pfx_down_read+0x10/0x10 [ 831.907679][T15642] __lookup_slow+0x98/0x320 [ 831.907699][T15642] lookup_slow+0x50/0x70 [ 831.907718][T15642] lookup_noperm_positive_unlocked+0xd5/0x110 [ 831.907735][T15642] debugfs_lookup+0xc7/0x150 [ 831.907751][T15642] kvm_dev_ioctl+0xfdc/0x1b50 [ 831.907771][T15642] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 831.907792][T15642] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 831.907805][T15642] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 831.907828][T15642] __do_fast_syscall_32+0x13a/0x8b0 [ 831.907965][T15642] do_fast_syscall_32+0x32/0x70 [ 831.907992][T15642] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 831.908011][T15642] RIP: 0023:0xf701efec [ 831.908030][T15642] Code: Unable to access opcode bytes at 0xf701efc2. [ 831.908036][T15642] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 831.908050][T15642] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae01 [ 831.908059][T15642] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 831.908067][T15642] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 831.908075][T15642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 831.908083][T15642] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 831.908097][T15642] [ 831.957414][T15642] overlayfs: failed to resolve '/IE [ 831.957414][T15642] |+ZosϾf7r=DֵJUA': -2 [ 832.127229][T15651] random: crng reseeded on system resumption [ 832.138492][T15651] binder: 15650:15651 ioctl c0306201 0 returned -14 [ 832.270598][ T5093] Bluetooth: hci3: unexpected event 0x03 length: 1 < 11 [ 832.557290][ T5093] Bluetooth: hci3: unexpected event 0x03 length: 1 < 11 [ 832.566421][T15662] FAULT_INJECTION: forcing a failure. [ 832.566421][T15662] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 832.566478][T15662] CPU: 0 UID: 0 PID: 15662 Comm: syz.0.2801 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 832.566507][T15662] Tainted: [L]=SOFTLOCKUP [ 832.566513][T15662] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 832.566520][T15662] Call Trace: [ 832.566524][T15662] [ 832.566531][T15662] dump_stack_lvl+0x100/0x190 [ 832.566553][T15662] should_fail_ex.cold+0x5/0xa [ 832.566571][T15662] _copy_to_user+0x32/0xd0 [ 832.566587][T15662] simple_read_from_buffer+0xcb/0x170 [ 832.566601][T15662] proc_fail_nth_read+0x1af/0x230 [ 832.566620][T15662] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 832.566641][T15662] ? rw_verify_area+0xce/0x6d0 [ 832.566658][T15662] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 832.566675][T15662] vfs_read+0x1e4/0xb40 [ 832.566686][T15662] ? lock_acquire+0x1d1/0x380 [ 832.566706][T15662] ? __fget_files+0x34/0x3d0 [ 832.566720][T15662] ? __pfx_vfs_read+0x10/0x10 [ 832.566729][T15662] ? find_held_lock+0x2b/0x80 [ 832.566741][T15662] ? __fget_files+0x215/0x3d0 [ 832.566754][T15662] ? __fget_files+0x21f/0x3d0 [ 832.566770][T15662] ksys_read+0x12a/0x250 [ 832.566780][T15662] ? __pfx_ksys_read+0x10/0x10 [ 832.566794][T15662] do_int80_emulation+0x166/0x650 [ 832.566812][T15662] asm_int80_emulation+0x1a/0x20 [ 832.566823][T15662] RIP: 0023:0xf71d75ab [ 832.566833][T15662] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 832.566845][T15662] RSP: 002b:00000000f54964bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 832.566857][T15662] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f54965d0 [ 832.566864][T15662] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 832.566871][T15662] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 832.566877][T15662] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 832.566886][T15662] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 832.566913][T15662] [ 832.711146][T15664] netlink: 'syz.0.2802': attribute type 1 has an invalid length. [ 832.711200][T15664] netlink: 232 bytes leftover after parsing attributes in process `syz.0.2802'. [ 832.711215][T15664] netlink: 'syz.0.2802': attribute type 1 has an invalid length. [ 833.049039][T15668] netlink: 'syz.0.2802': attribute type 1 has an invalid length. [ 833.049096][T15668] netlink: 232 bytes leftover after parsing attributes in process `syz.0.2802'. [ 833.049196][T15668] netlink: 'syz.0.2802': attribute type 1 has an invalid length. [ 833.184465][T15677] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2803'. [ 833.840962][T15684] FAULT_INJECTION: forcing a failure. [ 833.840962][T15684] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 833.841025][T15684] CPU: 0 UID: 0 PID: 15684 Comm: syz.0.2805 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 833.841065][T15684] Tainted: [L]=SOFTLOCKUP [ 833.841074][T15684] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 833.841085][T15684] Call Trace: [ 833.841093][T15684] [ 833.841102][T15684] dump_stack_lvl+0x100/0x190 [ 833.841131][T15684] should_fail_ex.cold+0x5/0xa [ 833.841156][T15684] _copy_from_user+0x2e/0xd0 [ 833.841177][T15684] get_compat_msghdr+0xb3/0x480 [ 833.841205][T15684] ? __pfx_get_compat_msghdr+0x10/0x10 [ 833.841240][T15684] ___sys_sendmsg+0x1b6/0x1e0 [ 833.841288][T15684] ? __pfx____sys_sendmsg+0x10/0x10 [ 833.841328][T15684] ? find_held_lock+0x2b/0x80 [ 833.841362][T15684] __sys_sendmsg+0x160/0x210 [ 833.841385][T15684] ? __pfx___sys_sendmsg+0x10/0x10 [ 833.841413][T15684] ? __pfx_ksys_write+0x10/0x10 [ 833.841436][T15684] __do_fast_syscall_32+0x13a/0x8b0 [ 833.841461][T15684] ? lockdep_hardirqs_on+0x7d/0x110 [ 833.841486][T15684] do_fast_syscall_32+0x32/0x70 [ 833.841510][T15684] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 833.841534][T15684] RIP: 0023:0xf7fd8fec [ 833.841554][T15684] Code: Unable to access opcode bytes at 0xf7fd8fc2. [ 833.841563][T15684] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 833.841582][T15684] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000000 [ 833.841595][T15684] RDX: 0000000002000800 RSI: 0000000000000000 RDI: 0000000000000000 [ 833.841607][T15684] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 833.841618][T15684] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 833.841630][T15684] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 833.841654][T15684] [ 834.189304][ T5883] usb 9-1: new high-speed USB device number 70 using dummy_hcd [ 834.216048][T15702] FAULT_INJECTION: forcing a failure. [ 834.216048][T15702] name failslab, interval 1, probability 0, space 0, times 0 [ 834.216151][T15702] CPU: 2 UID: 0 PID: 15702 Comm: syz.2.2813 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 834.216170][T15702] Tainted: [L]=SOFTLOCKUP [ 834.216175][T15702] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 834.216184][T15702] Call Trace: [ 834.216188][T15702] [ 834.216194][T15702] dump_stack_lvl+0x100/0x190 [ 834.216212][T15702] should_fail_ex.cold+0x5/0xa [ 834.216229][T15702] should_failslab+0xc2/0x120 [ 834.216245][T15702] __kmalloc_cache_noprof+0x91/0x6d0 [ 834.216277][T15702] ? __mmu_notifier_register+0x4a3/0x780 [ 834.216294][T15702] __mmu_notifier_register+0x4a3/0x780 [ 834.216308][T15702] mmu_notifier_register+0x74/0x1c0 [ 834.216322][T15702] kvm_dev_ioctl+0xe9f/0x1b50 [ 834.216338][T15702] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 834.216351][T15702] ? __fget_files+0x21f/0x3d0 [ 834.216366][T15702] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 834.216378][T15702] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 834.216397][T15702] __do_fast_syscall_32+0x13a/0x8b0 [ 834.216417][T15702] do_fast_syscall_32+0x32/0x70 [ 834.216437][T15702] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 834.216452][T15702] RIP: 0023:0xf7f14fec [ 834.216466][T15702] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 834.216471][T15702] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 834.216484][T15702] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae01 [ 834.216493][T15702] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 834.216500][T15702] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 834.216508][T15702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 834.216515][T15702] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 834.216530][T15702] [ 834.340366][ T5883] usb 9-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 834.354152][ T5883] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 834.354271][ T5883] usb 9-1: Product: syz [ 834.354286][ T5883] usb 9-1: Manufacturer: syz [ 834.354298][ T5883] usb 9-1: SerialNumber: syz [ 834.367467][ T5883] usb 9-1: config 0 descriptor?? [ 834.399091][T15704] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2814'. [ 834.590475][ T5883] usb 9-1: USB disconnect, device number 70 [ 834.713067][T15063] udevd[15063]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/sound/card5/controlC5/../uevent} for writing: No such file or directory [ 834.736522][T15706] sch_tbf: burst 19872 is lower than device lo mtu (65499) ! [ 835.482527][ T43] kauditd_printk_skb: 92 callbacks suppressed [ 835.482588][ T43] audit: type=1800 audit(2000000155.899:664): pid=15724 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2818" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 837.338756][T15737] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 837.341973][T15737] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 837.515726][T15737] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 838.442024][T15756] netlink: 'syz.5.2830': attribute type 4 has an invalid length. [ 838.454021][T15756] netlink: 'syz.5.2830': attribute type 4 has an invalid length. [ 838.743308][T15763] netlink: 'syz.4.2833': attribute type 1 has an invalid length. [ 838.743355][T15763] netlink: 174516 bytes leftover after parsing attributes in process `syz.4.2833'. [ 838.743392][T15763] netlink: 'syz.4.2833': attribute type 1 has an invalid length. [ 838.743400][T15763] netlink: 2016 bytes leftover after parsing attributes in process `syz.4.2833'. [ 838.866183][ T9] libceph: connect (1)[c::]:6789 error -101 [ 838.866550][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 838.873889][ T9] libceph: connect (1)[c::]:6789 error -101 [ 838.874036][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 838.905038][ T30] libceph: connect (1)[c::]:6789 error -101 [ 838.905198][ T30] libceph: mon0 (1)[c::]:6789 connect error [ 839.029582][ T5739] Bluetooth: hci3: command 0x0c1a tx timeout [ 839.131527][ T9] libceph: connect (1)[c::]:6789 error -101 [ 839.131713][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 839.159632][ T30] libceph: connect (1)[c::]:6789 error -101 [ 839.159763][ T30] libceph: mon0 (1)[c::]:6789 connect error [ 839.582010][T15775] fuse: Bad value for 'fd' [ 839.583882][T15775] batadv_slave_1: entered promiscuous mode [ 839.640571][ T9] libceph: connect (1)[c::]:6789 error -101 [ 839.640750][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 839.670230][ T5739] Bluetooth: hci2: command 0x2016 tx timeout [ 839.674691][ T30] libceph: connect (1)[c::]:6789 error -101 [ 839.674868][ T30] libceph: mon0 (1)[c::]:6789 connect error [ 839.675413][T15767] ceph: No mds server is up or the cluster is laggy [ 839.675644][T15770] ceph: No mds server is up or the cluster is laggy [ 839.704027][T15737] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 839.704090][T15737] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 839.735004][T15737] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 839.773493][T15737] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 839.773618][T15737] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 839.785017][T15737] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 839.861738][T15737] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 839.861835][T15737] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 839.872099][T15737] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 839.917244][T15743] block device autoloading is deprecated and will be removed. [ 839.942031][T15773] batadv_slave_1: left promiscuous mode [ 840.139530][T15782] binder: 15781:15782 ioctl c0306201 80000040 returned -22 [ 840.198413][T15796] jffs2: notice: (15796) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 840.365455][T15807] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2840'. [ 840.378618][T15809] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2846'. [ 840.883737][T15821] netlink: 'syz.5.2850': attribute type 1 has an invalid length. [ 840.883849][T15821] netlink: 174516 bytes leftover after parsing attributes in process `syz.5.2850'. [ 840.883892][T15821] netlink: 'syz.5.2850': attribute type 1 has an invalid length. [ 840.883905][T15821] netlink: 2016 bytes leftover after parsing attributes in process `syz.5.2850'. [ 841.010442][T15823] 9p: Bad value for 'rfdno' [ 841.109522][ T5739] Bluetooth: hci3: command 0x0c1a tx timeout [ 841.184426][T15826] lo speed is unknown, defaulting to 1000 [ 841.184493][T15826] lo speed is unknown, defaulting to 1000 [ 841.192488][T15826] lo speed is unknown, defaulting to 1000 [ 841.198365][T15826] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 841.198432][T15826] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 841.198476][T15826] smbdirect: ib_dev[syz_device_name_32_chars_1234567]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 841.204707][T15826] infiniband syz_device_name_32_chars_1234567: RDMA CMA: cma_listen_on_dev, error -22 [ 841.312395][T15826] lo speed is unknown, defaulting to 1000 [ 841.314836][T15826] lo speed is unknown, defaulting to 1000 [ 841.317967][T15826] lo speed is unknown, defaulting to 1000 [ 841.319498][T15826] lo speed is unknown, defaulting to 1000 [ 841.321472][T15826] lo speed is unknown, defaulting to 1000 [ 841.323604][T15826] lo speed is unknown, defaulting to 1000 [ 841.328013][T15826] lo speed is unknown, defaulting to 1000 [ 841.386385][T15840] overlay: filesystem on ./bus not supported as upperdir [ 841.400181][T15836] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 841.749312][ T5739] Bluetooth: hci2: command 0x2016 tx timeout [ 841.830395][ T5739] Bluetooth: hci1: command 0x0c1a tx timeout [ 841.909800][ T5739] Bluetooth: hci0: command 0x0405 tx timeout [ 841.981361][ T30] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 842.049515][ T6073] usb 7-1: new high-speed USB device number 85 using dummy_hcd [ 842.135870][T15878] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 842.135906][T15878] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 842.136013][T15878] vhci_hcd vhci_hcd.0: Device attached [ 842.137491][T15879] vhci_hcd: cannot find a urb of seqnum 0 max seqnum 0 [ 842.137851][ T5810] vhci_hcd vhci_hcd.4: stop threads [ 842.137866][ T5810] vhci_hcd vhci_hcd.4: release socket [ 842.137884][ T5810] vhci_hcd vhci_hcd.4: disconnect device [ 842.156715][ T30] usb 10-1: Using ep0 maxpacket: 8 [ 842.159289][ T30] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 842.160491][ T30] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 842.160532][ T30] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 842.160550][ T30] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 842.160569][ T30] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 842.160585][ T30] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 842.160616][ T30] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 842.199358][ T6073] usb 7-1: Using ep0 maxpacket: 8 [ 842.201068][ T6073] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 842.202283][ T6073] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 842.202322][ T6073] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 842.202340][ T6073] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 842.202359][ T6073] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 842.202377][ T6073] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 842.202415][ T6073] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 842.290833][ T43] audit: type=1800 audit(2000000162.709:665): pid=15884 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2863" name="name" dev="configfs" ino=60290 res=0 errno=0 [ 842.302713][T15884] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(9) [ 842.302749][T15884] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 842.302916][T15884] vhci_hcd vhci_hcd.0: Device attached [ 842.309975][T15884] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 842.310662][T15884] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 842.314111][T15884] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2863'. [ 842.325966][T15885] vhci_hcd: connection closed [ 842.326457][ T5810] vhci_hcd vhci_hcd.0: stop threads [ 842.326540][ T5810] vhci_hcd vhci_hcd.0: release socket [ 842.326639][ T5810] vhci_hcd vhci_hcd.0: disconnect device [ 842.370964][ T30] usb 10-1: usb_control_msg returned -32 [ 842.371058][ T30] usbtmc 10-1:16.0: can't read capabilities [ 842.411104][ T6073] usb 7-1: usb_control_msg returned -32 [ 842.411163][ T6073] usbtmc 7-1:16.0: can't read capabilities [ 842.994742][T15900] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 843.012317][T15903] binder: 15902:15903 ioctl c0306201 0 returned -14 [ 843.122401][T15909] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 843.122677][T15909] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 843.150942][T15911] netlink: 'syz.4.2872': attribute type 1 has an invalid length. [ 843.151023][T15911] netlink: 193500 bytes leftover after parsing attributes in process `syz.4.2872'. [ 843.151073][T15911] netlink: 'syz.4.2872': attribute type 1 has an invalid length. [ 843.151090][T15911] netlink: 2016 bytes leftover after parsing attributes in process `syz.4.2872'. [ 843.176617][T15912] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2871'. [ 843.189344][ T5739] Bluetooth: hci3: command 0x0c1a tx timeout [ 843.242651][T15916] random: crng reseeded on system resumption [ 843.829232][ T5739] Bluetooth: hci2: command 0x2016 tx timeout [ 843.910340][ T5739] Bluetooth: hci1: command 0x0c1a tx timeout [ 843.991650][ T5093] Bluetooth: hci0: command 0x0405 tx timeout [ 844.071342][T15929] FAULT_INJECTION: forcing a failure. [ 844.071342][T15929] name failslab, interval 1, probability 0, space 0, times 0 [ 844.071396][T15929] CPU: 1 UID: 0 PID: 15929 Comm: syz.4.2879 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 844.071431][T15929] Tainted: [L]=SOFTLOCKUP [ 844.071436][T15929] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 844.071443][T15929] Call Trace: [ 844.071448][T15929] [ 844.071453][T15929] dump_stack_lvl+0x100/0x190 [ 844.071472][T15929] should_fail_ex.cold+0x5/0xa [ 844.071487][T15929] should_failslab+0xc2/0x120 [ 844.071502][T15929] __kmalloc_noprof+0xfc/0x840 [ 844.071513][T15929] ? rcu_is_watching+0x13/0xc0 [ 844.071524][T15929] ? tomoyo_realpath_from_path+0xb6/0x690 [ 844.071545][T15929] tomoyo_realpath_from_path+0xb6/0x690 [ 844.071565][T15929] tomoyo_path_number_perm+0x23c/0x580 [ 844.071580][T15929] ? tomoyo_path_number_perm+0x22e/0x580 [ 844.071595][T15929] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 844.071610][T15929] ? get_pid_task+0x106/0x250 [ 844.071626][T15929] ? __lock_acquire+0x4c5/0x1ec0 [ 844.071647][T15929] ? __fget_files+0x34/0x3d0 [ 844.071659][T15929] ? find_held_lock+0x2b/0x80 [ 844.071671][T15929] ? __fget_files+0x215/0x3d0 [ 844.071681][T15929] ? hook_file_ioctl_common+0x140/0x440 [ 844.071696][T15929] ? __fget_files+0x215/0x3d0 [ 844.071709][T15929] ? __fget_files+0x21f/0x3d0 [ 844.071723][T15929] security_file_ioctl_compat+0xd3/0x230 [ 844.071740][T15929] __ia32_compat_sys_ioctl+0xc2/0x360 [ 844.071758][T15929] __do_fast_syscall_32+0x13a/0x8b0 [ 844.071774][T15929] ? lockdep_hardirqs_on+0x7d/0x110 [ 844.071789][T15929] do_fast_syscall_32+0x32/0x70 [ 844.071804][T15929] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 844.071819][T15929] RIP: 0023:0xf70aefec [ 844.071832][T15929] Code: Unable to access opcode bytes at 0xf70aefc2. [ 844.071838][T15929] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 844.071849][T15929] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c010640c [ 844.071856][T15929] RDX: 0000000080000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 844.071863][T15929] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 844.071872][T15929] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 844.071879][T15929] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 844.071893][T15929] [ 844.071898][T15929] ERROR: Out of memory at tomoyo_realpath_from_path. [ 844.542574][T15945] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 844.702296][T15950] 9p: Bad value for 'rfdno' [ 845.039323][ T9] usb 9-1: new low-speed USB device number 71 using dummy_hcd [ 845.189827][ T9] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 845.190791][ T9] usb 9-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 845.190804][ T9] usb 9-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 845.191644][ T9] usb 9-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 845.191657][ T9] usb 9-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 845.192550][ T9] usb 9-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 845.192567][ T9] usb 9-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 845.195204][ T9] usb 9-1: string descriptor 0 read error: -22 [ 845.195261][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 845.460835][T15955] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2886'. [ 845.909474][ T5093] Bluetooth: hci2: command 0x2016 tx timeout [ 845.989332][ T5093] Bluetooth: hci1: command 0x0c1a tx timeout [ 846.069401][ T5093] Bluetooth: hci0: command 0x0405 tx timeout [ 847.749555][T15889] usbtmc 10-1:16.0: usb_control_msg returned -110 [ 847.761337][T15064] usb 9-1: USB disconnect, device number 71 [ 847.765747][ T1346] usb 7-1: USB disconnect, device number 85 [ 847.770097][ T9] usb 10-1: USB disconnect, device number 6 [ 847.880730][T15966] FAULT_INJECTION: forcing a failure. [ 847.880730][T15966] name failslab, interval 1, probability 0, space 0, times 0 [ 847.880826][T15966] CPU: 3 UID: 0 PID: 15966 Comm: syz.5.2888 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 847.880850][T15966] Tainted: [L]=SOFTLOCKUP [ 847.880855][T15966] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 847.880865][T15966] Call Trace: [ 847.880871][T15966] [ 847.880877][T15966] dump_stack_lvl+0x100/0x190 [ 847.880902][T15966] should_fail_ex.cold+0x5/0xa [ 847.880922][T15966] should_failslab+0xc2/0x120 [ 847.880941][T15966] __kmalloc_noprof+0xfc/0x840 [ 847.880955][T15966] ? rcu_is_watching+0x13/0xc0 [ 847.880970][T15966] ? tomoyo_realpath_from_path+0xb6/0x690 [ 847.880998][T15966] tomoyo_realpath_from_path+0xb6/0x690 [ 847.881023][T15966] tomoyo_path_number_perm+0x23c/0x580 [ 847.881042][T15966] ? tomoyo_path_number_perm+0x22e/0x580 [ 847.881063][T15966] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 847.881088][T15966] ? get_pid_task+0x106/0x250 [ 847.881110][T15966] ? __lock_acquire+0x4c5/0x1ec0 [ 847.881142][T15966] ? __fget_files+0x34/0x3d0 [ 847.881159][T15966] ? find_held_lock+0x2b/0x80 [ 847.881177][T15966] ? __fget_files+0x215/0x3d0 [ 847.881191][T15966] ? hook_file_ioctl_common+0x140/0x440 [ 847.881211][T15966] ? __fget_files+0x215/0x3d0 [ 847.881231][T15966] ? __fget_files+0x21f/0x3d0 [ 847.881251][T15966] security_file_ioctl_compat+0xd3/0x230 [ 847.881274][T15966] __ia32_compat_sys_ioctl+0xc2/0x360 [ 847.881301][T15966] __do_fast_syscall_32+0x13a/0x8b0 [ 847.881323][T15966] ? lockdep_hardirqs_on+0x7d/0x110 [ 847.881344][T15966] do_fast_syscall_32+0x32/0x70 [ 847.881384][T15966] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 847.881407][T15966] RIP: 0023:0xf701efec [ 847.881428][T15966] Code: Unable to access opcode bytes at 0xf701efc2. [ 847.881436][T15966] RSP: 002b:00000000f53ec50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 847.881453][T15966] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000040a0ae49 [ 847.881464][T15966] RDX: 0000000080000180 RSI: 0000000000000000 RDI: 0000000000000000 [ 847.881473][T15966] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 847.881482][T15966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 847.881491][T15966] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 847.881512][T15966] [ 847.882460][T15966] ERROR: Out of memory at tomoyo_realpath_from_path. [ 848.097835][T15976] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 848.238015][T15988] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 848.238492][T15988] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 848.247768][T15988] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2898'. [ 848.571567][T16001] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 848.638201][T16007] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 849.001560][T16008] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2903'. [ 849.204700][T16024] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 849.767483][T16034] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 849.953746][T16044] Console: switching to colour dummy device 80x25 [ 850.104512][T16048] bridge0: port 2(bridge_slave_1) entered disabled state [ 850.105754][T16048] bridge0: port 1(bridge_slave_0) entered disabled state [ 850.165676][T16051] syzkaller0: entered promiscuous mode [ 850.165741][T16051] syzkaller0: entered allmulticast mode [ 850.172020][T16051] FAULT_INJECTION: forcing a failure. [ 850.172020][T16051] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 850.172073][T16051] CPU: 2 UID: 0 PID: 16051 Comm: syz.0.2914 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 850.172101][T16051] Tainted: [L]=SOFTLOCKUP [ 850.172106][T16051] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 850.172113][T16051] Call Trace: [ 850.172118][T16051] [ 850.172123][T16051] dump_stack_lvl+0x100/0x190 [ 850.172141][T16051] should_fail_ex.cold+0x5/0xa [ 850.172156][T16051] _copy_from_user+0x2e/0xd0 [ 850.172169][T16051] get_compat_msghdr+0xb3/0x480 [ 850.172186][T16051] ? __pfx_get_compat_msghdr+0x10/0x10 [ 850.172207][T16051] ___sys_sendmsg+0x1b6/0x1e0 [ 850.172226][T16051] ? __pfx____sys_sendmsg+0x10/0x10 [ 850.172266][T16051] ? find_held_lock+0x2b/0x80 [ 850.172287][T16051] __sys_sendmsg+0x160/0x210 [ 850.172300][T16051] ? __pfx___sys_sendmsg+0x10/0x10 [ 850.172317][T16051] ? __pfx_ksys_write+0x10/0x10 [ 850.172331][T16051] __do_fast_syscall_32+0x13a/0x8b0 [ 850.172346][T16051] ? lockdep_hardirqs_on+0x7d/0x110 [ 850.172361][T16051] do_fast_syscall_32+0x32/0x70 [ 850.172385][T16051] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 850.172400][T16051] RIP: 0023:0xf7fd8fec [ 850.172414][T16051] Code: Unable to access opcode bytes at 0xf7fd8fc2. [ 850.172419][T16051] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 850.172431][T16051] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800000c0 [ 850.172438][T16051] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 850.172445][T16051] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 850.172451][T16051] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 850.172458][T16051] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 850.172472][T16051] [ 850.329338][T16046] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 850.344881][T16046] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 850.349221][T16046] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 850.349668][T16046] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 850.352315][T16046] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 850.431111][T16057] FAULT_INJECTION: forcing a failure. [ 850.431111][T16057] name failslab, interval 1, probability 0, space 0, times 0 [ 850.431160][T16057] CPU: 3 UID: 0 PID: 16057 Comm: syz.4.2916 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 850.431189][T16057] Tainted: [L]=SOFTLOCKUP [ 850.431195][T16057] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 850.431203][T16057] Call Trace: [ 850.431231][T16057] [ 850.431237][T16057] dump_stack_lvl+0x100/0x190 [ 850.431291][T16057] should_fail_ex.cold+0x5/0xa [ 850.431307][T16057] should_failslab+0xc2/0x120 [ 850.431347][T16057] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 850.431366][T16057] ? start_dirop+0x79/0xb0 [ 850.431383][T16057] ? alloc_inode+0x68/0x250 [ 850.431409][T16057] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 850.431429][T16057] alloc_inode+0x68/0x250 [ 850.431455][T16057] new_inode+0x22/0x1c0 [ 850.431476][T16057] debugfs_create_dir+0x9d/0x420 [ 850.431490][T16057] kvm_dev_ioctl+0x1286/0x1b50 [ 850.431507][T16057] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 850.431524][T16057] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 850.431536][T16057] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 850.431556][T16057] __do_fast_syscall_32+0x13a/0x8b0 [ 850.431595][T16057] do_fast_syscall_32+0x32/0x70 [ 850.431612][T16057] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 850.431627][T16057] RIP: 0023:0xf70aefec [ 850.431641][T16057] Code: Unable to access opcode bytes at 0xf70aefc2. [ 850.431665][T16057] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 850.431677][T16057] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae01 [ 850.431684][T16057] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 850.431691][T16057] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 850.431698][T16057] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 850.431705][T16057] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 850.431720][T16057] [ 850.431747][T16057] debugfs: out of free dentries, can not create directory '16057-6' [ 850.563034][T16046] pci 0000:00:01.0: Adding to iommu group 1 [ 850.579095][T16046] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 850.579142][T16046] pci 0000:00:01.0: vgaarb: bridge control possible [ 850.579159][T16046] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 850.603938][T16046] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 850.604212][T16046] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 850.621188][T16046] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 850.738296][T16046] [drm] Found bochs VGA, ID 0xb0c5. [ 850.738472][T16046] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 850.783567][T16069] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2917'. [ 851.014552][T16071] pim6reg: entered allmulticast mode [ 851.017972][T16046] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 851.727181][T16082] pim6reg: left allmulticast mode [ 851.831102][T16046] Console: switching to colour frame buffer device 160x50 [ 851.896429][T16046] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 852.318946][T16090] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 852.611628][T16090] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 853.211346][T16104] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 853.362180][T16107] netlink: 'syz.5.2929': attribute type 1 has an invalid length. [ 853.362218][T16107] netlink: 174516 bytes leftover after parsing attributes in process `syz.5.2929'. [ 853.362248][T16107] netlink: 'syz.5.2929': attribute type 1 has an invalid length. [ 853.362314][T16107] netlink: 2016 bytes leftover after parsing attributes in process `syz.5.2929'. [ 853.393799][T16108] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 853.663985][T16123] futex_wake_op: syz.0.2934 tries to shift op by -1; fix this program [ 854.611651][T16139] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2941'. [ 854.648826][T16139] binder: 16138:16139 ioctl 40186f04 800000c0 returned -22 [ 854.705993][T16148] FAULT_INJECTION: forcing a failure. [ 854.705993][T16148] name failslab, interval 1, probability 0, space 0, times 0 [ 854.706068][T16148] CPU: 1 UID: 0 PID: 16148 Comm: syz.4.2944 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 854.706117][T16148] Tainted: [L]=SOFTLOCKUP [ 854.706126][T16148] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 854.706141][T16148] Call Trace: [ 854.706149][T16148] [ 854.706159][T16148] dump_stack_lvl+0x100/0x190 [ 854.706271][T16148] should_fail_ex.cold+0x5/0xa [ 854.706302][T16148] should_failslab+0xc2/0x120 [ 854.706356][T16148] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 854.706383][T16148] ? __d_alloc+0x35/0xa50 [ 854.706412][T16148] __d_alloc+0x35/0xa50 [ 854.706437][T16148] ? __lock_acquire+0x4c5/0x1ec0 [ 854.706469][T16148] d_alloc_parallel+0x105/0x14c0 [ 854.706506][T16148] ? lock_acquire+0x1d1/0x380 [ 854.706529][T16148] ? lookup_slow+0x42/0x70 [ 854.706558][T16148] ? __pfx_d_alloc_parallel+0x10/0x10 [ 854.706590][T16148] ? __pfx___might_resched+0x10/0x10 [ 854.706617][T16148] ? find_held_lock+0x2b/0x80 [ 854.706639][T16148] ? __d_lookup+0x25c/0x4a0 [ 854.706672][T16148] ? down_read+0x13b/0x4c0 [ 854.706733][T16148] ? __pfx_down_read+0x10/0x10 [ 854.706765][T16148] __lookup_slow+0x98/0x320 [ 854.706802][T16148] lookup_slow+0x50/0x70 [ 854.706831][T16148] lookup_noperm_positive_unlocked+0xd5/0x110 [ 854.706859][T16148] debugfs_lookup+0xc7/0x150 [ 854.706885][T16148] kvm_dev_ioctl+0xfdc/0x1b50 [ 854.706917][T16148] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 854.706952][T16148] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 854.706975][T16148] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 854.707014][T16148] __do_fast_syscall_32+0x13a/0x8b0 [ 854.707049][T16148] do_fast_syscall_32+0x32/0x70 [ 854.707080][T16148] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 854.707109][T16148] RIP: 0023:0xf70aefec [ 854.707134][T16148] Code: Unable to access opcode bytes at 0xf70aefc2. [ 854.707144][T16148] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 854.707166][T16148] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae01 [ 854.707181][T16148] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 854.707195][T16148] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 854.707209][T16148] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 854.707222][T16148] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 854.707261][T16148] [ 854.823119][T16150] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 854.930700][T16166] FAULT_INJECTION: forcing a failure. [ 854.930700][T16166] name failslab, interval 1, probability 0, space 0, times 0 [ 854.930781][T16166] CPU: 3 UID: 0 PID: 16166 Comm: syz.0.2948 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 854.930817][T16166] Tainted: [L]=SOFTLOCKUP [ 854.930825][T16166] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 854.930835][T16166] Call Trace: [ 854.930841][T16166] [ 854.930848][T16166] dump_stack_lvl+0x100/0x190 [ 854.930882][T16166] should_fail_ex.cold+0x5/0xa [ 854.930904][T16166] should_failslab+0xc2/0x120 [ 854.930925][T16166] __kmalloc_noprof+0xfc/0x840 [ 854.930939][T16166] ? rcu_is_watching+0x13/0xc0 [ 854.930955][T16166] ? tomoyo_realpath_from_path+0xb6/0x690 [ 854.930984][T16166] tomoyo_realpath_from_path+0xb6/0x690 [ 854.931012][T16166] tomoyo_get_exe+0x63/0xa0 [ 854.931031][T16166] tomoyo_write_control+0x69e/0x13a0 [ 854.931055][T16166] ? lock_acquire+0x1d1/0x380 [ 854.931076][T16166] ? ksys_write+0x12a/0x250 [ 854.931091][T16166] ? __pfx_tomoyo_write_control+0x10/0x10 [ 854.931114][T16166] vfs_write+0x2aa/0x1050 [ 854.931128][T16166] ? __pfx_tomoyo_write+0x10/0x10 [ 854.931148][T16166] ? lock_acquire+0x1d1/0x380 [ 854.931166][T16166] ? __fget_files+0x34/0x3d0 [ 854.931184][T16166] ? __pfx_vfs_write+0x10/0x10 [ 854.931211][T16166] ? find_held_lock+0x2b/0x80 [ 854.931227][T16166] ? __fget_files+0x215/0x3d0 [ 854.931245][T16166] ? __fget_files+0x21f/0x3d0 [ 854.931265][T16166] ksys_write+0x12a/0x250 [ 854.931278][T16166] ? __pfx_ksys_write+0x10/0x10 [ 854.931291][T16166] ? ksys_write+0x1ac/0x250 [ 854.931304][T16166] ? __pfx_ksys_write+0x10/0x10 [ 854.931322][T16166] __do_fast_syscall_32+0x13a/0x8b0 [ 854.931341][T16166] ? lockdep_hardirqs_on+0x7d/0x110 [ 854.931361][T16166] do_fast_syscall_32+0x32/0x70 [ 854.931381][T16166] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 854.931400][T16166] RIP: 0023:0xf7fd8fec [ 854.931418][T16166] Code: Unable to access opcode bytes at 0xf7fd8fc2. [ 854.931425][T16166] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 854.931440][T16166] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 854.931450][T16166] RDX: 000000000000004c RSI: 0000000000000000 RDI: 0000000000000000 [ 854.931458][T16166] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 854.931467][T16166] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 854.931476][T16166] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 854.931497][T16166] [ 854.934328][T16166] ERROR: Out of memory at tomoyo_realpath_from_path. [ 854.960771][ T5818] kernel read not supported for file /video9 (pid: 5818 comm: kworker/1:4) [ 855.124295][T16176] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 855.388041][T16193] FAULT_INJECTION: forcing a failure. [ 855.388041][T16193] name failslab, interval 1, probability 0, space 0, times 0 [ 855.388123][T16193] CPU: 0 UID: 0 PID: 16193 Comm: syz.5.2959 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 855.388152][T16193] Tainted: [L]=SOFTLOCKUP [ 855.388160][T16193] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 855.388173][T16193] Call Trace: [ 855.388180][T16193] [ 855.388188][T16193] dump_stack_lvl+0x100/0x190 [ 855.388219][T16193] should_fail_ex.cold+0x5/0xa [ 855.388246][T16193] should_failslab+0xc2/0x120 [ 855.388271][T16193] __kmalloc_noprof+0xfc/0x840 [ 855.388291][T16193] ? rcu_is_watching+0x13/0xc0 [ 855.388310][T16193] ? tomoyo_realpath_from_path+0xb6/0x690 [ 855.388346][T16193] tomoyo_realpath_from_path+0xb6/0x690 [ 855.388381][T16193] tomoyo_path2_perm+0x29f/0x700 [ 855.388406][T16193] ? tomoyo_path2_perm+0x291/0x700 [ 855.388433][T16193] ? __pfx_tomoyo_path2_perm+0x10/0x10 [ 855.388459][T16193] ? __pfx_stack_trace_save+0x10/0x10 [ 855.388485][T16193] ? stack_depot_save_flags+0x27/0x9f0 [ 855.388514][T16193] ? kasan_save_stack+0x3f/0x50 [ 855.388535][T16193] ? kasan_save_stack+0x30/0x50 [ 855.388555][T16193] ? kasan_save_track+0x14/0x30 [ 855.388576][T16193] ? kasan_save_free_info+0x3b/0x70 [ 855.388617][T16193] ? hook_sb_pivotroot+0x1e2/0x320 [ 855.388648][T16193] ? apparmor_capable+0x1d7/0x4d0 [ 855.388677][T16193] security_sb_pivotroot+0xc4/0x210 [ 855.388730][T16193] path_pivot_root+0x14f/0x1320 [ 855.388785][T16193] ? kasan_quarantine_put+0x104/0x240 [ 855.388806][T16193] ? lockdep_hardirqs_on+0x7d/0x110 [ 855.388839][T16193] ? __pfx_path_pivot_root+0x10/0x10 [ 855.388866][T16193] ? putname+0xb1/0x110 [ 855.388891][T16193] ? kmem_cache_free+0x127/0x6c0 [ 855.388933][T16193] __ia32_sys_pivot_root+0x199/0x1c0 [ 855.388961][T16193] ? __pfx___ia32_sys_pivot_root+0x10/0x10 [ 855.388998][T16193] __do_fast_syscall_32+0x13a/0x8b0 [ 855.389029][T16193] do_fast_syscall_32+0x32/0x70 [ 855.389055][T16193] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 855.389081][T16193] RIP: 0023:0xf701efec [ 855.389102][T16193] Code: Unable to access opcode bytes at 0xf701efc2. [ 855.389111][T16193] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 00000000000000d9 [ 855.389156][T16193] RAX: ffffffffffffffda RBX: 0000000080000040 RCX: 0000000080000180 [ 855.389174][T16193] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 855.389187][T16193] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 855.389198][T16193] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 855.389210][T16193] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 855.389237][T16193] [ 855.393548][T16193] ERROR: Out of memory at tomoyo_realpath_from_path. [ 855.592151][T16195] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 855.798514][ T5093] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 855.798936][ T5093] Bluetooth: hci0: SCO packet for unknown connection handle 200 [ 855.963751][T16201] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 855.963947][T16201] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 855.964059][T16201] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 855.969658][T16201] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 855.969717][T16201] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 856.008957][T16201] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2962'. [ 856.669563][T16223] FAULT_INJECTION: forcing a failure. [ 856.669563][T16223] name failslab, interval 1, probability 0, space 0, times 0 [ 856.669611][T16223] CPU: 1 UID: 0 PID: 16223 Comm: syz.0.2969 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 856.669639][T16223] Tainted: [L]=SOFTLOCKUP [ 856.669645][T16223] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 856.669652][T16223] Call Trace: [ 856.669657][T16223] [ 856.669662][T16223] dump_stack_lvl+0x100/0x190 [ 856.669684][T16223] should_fail_ex.cold+0x5/0xa [ 856.669699][T16223] should_failslab+0xc2/0x120 [ 856.669713][T16223] __kmalloc_cache_noprof+0x91/0x6d0 [ 856.669731][T16223] ? proc_thread_self_get_link+0x1a6/0x210 [ 856.669747][T16223] proc_thread_self_get_link+0x1a6/0x210 [ 856.669761][T16223] pick_link+0xac2/0x13c0 [ 856.669778][T16223] ? __pfx_proc_thread_self_get_link+0x10/0x10 [ 856.669793][T16223] step_into_slowpath+0x9ba/0xf90 [ 856.669826][T16223] ? __pfx_step_into_slowpath+0x10/0x10 [ 856.669846][T16223] ? lookup_fast+0x2da/0x600 [ 856.669862][T16223] ? inode_permission+0x374/0x620 [ 856.669879][T16223] link_path_walk+0xf28/0x1cc0 [ 856.669902][T16223] path_openat+0x1ac/0x2440 [ 856.669916][T16223] ? __pfx_path_openat+0x10/0x10 [ 856.669933][T16223] do_file_open+0x20e/0x430 [ 856.669950][T16223] ? __pfx_do_file_open+0x10/0x10 [ 856.669973][T16223] ? _raw_spin_unlock+0x28/0x50 [ 856.669986][T16223] ? alloc_fd+0x471/0x7a0 [ 856.670003][T16223] do_sys_openat2+0x10f/0x1e0 [ 856.670018][T16223] ? __pfx_do_sys_openat2+0x10/0x10 [ 856.670035][T16223] ? trace_event_raw_event_msr_trace_class+0x1a1/0x270 [ 856.670050][T16223] ? __pfx_trace_event_raw_event_msr_trace_class+0x10/0x10 [ 856.670066][T16223] __ia32_compat_sys_openat+0x12d/0x210 [ 856.670083][T16223] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 856.670105][T16223] do_int80_emulation+0x166/0x650 [ 856.670122][T16223] asm_int80_emulation+0x1a/0x20 [ 856.670133][T16223] RIP: 0023:0xf71d75ab [ 856.670143][T16223] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 856.670154][T16223] RSP: 002b:00000000f54964bc EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 856.670166][T16223] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f72a1b2e [ 856.670173][T16223] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 856.670180][T16223] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 856.670187][T16223] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 856.670193][T16223] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 856.670207][T16223] [ 856.670480][T16223] FAULT_INJECTION: forcing a failure. [ 856.670480][T16223] name failslab, interval 1, probability 0, space 0, times 0 [ 856.670495][T16223] CPU: 1 UID: 0 PID: 16223 Comm: syz.0.2969 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 856.670510][T16223] Tainted: [L]=SOFTLOCKUP [ 856.670513][T16223] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 856.670520][T16223] Call Trace: [ 856.670524][T16223] [ 856.670529][T16223] dump_stack_lvl+0x100/0x190 [ 856.670544][T16223] should_fail_ex.cold+0x5/0xa [ 856.670557][T16223] should_failslab+0xc2/0x120 [ 856.670571][T16223] kmem_cache_alloc_noprof+0x92/0x6a0 [ 856.670583][T16223] ? do_getname+0x35/0x390 [ 856.670600][T16223] do_getname+0x35/0x390 [ 856.670616][T16223] user_path_at+0x26/0x60 [ 856.670627][T16223] __ia32_sys_pivot_root+0xe2/0x1c0 [ 856.670643][T16223] ? __pfx___ia32_sys_pivot_root+0x10/0x10 [ 856.670659][T16223] ? ksys_write+0x1ac/0x250 [ 856.670673][T16223] __do_fast_syscall_32+0x13a/0x8b0 [ 856.670687][T16223] ? lockdep_hardirqs_on+0x7d/0x110 [ 856.670702][T16223] do_fast_syscall_32+0x32/0x70 [ 856.670717][T16223] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 856.670731][T16223] RIP: 0023:0xf7fd8fec [ 856.670743][T16223] Code: Unable to access opcode bytes at 0xf7fd8fc2. [ 856.670748][T16223] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 00000000000000d9 [ 856.670759][T16223] RAX: ffffffffffffffda RBX: 0000000080000040 RCX: 0000000080000180 [ 856.670765][T16223] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 856.670772][T16223] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 856.670778][T16223] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 856.670785][T16223] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 856.670799][T16223] [ 857.070558][T16230] FAULT_INJECTION: forcing a failure. [ 857.070558][T16230] name failslab, interval 1, probability 0, space 0, times 0 [ 857.070627][T16230] CPU: 0 UID: 0 PID: 16230 Comm: syz.0.2972 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 857.070656][T16230] Tainted: [L]=SOFTLOCKUP [ 857.070662][T16230] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 857.070670][T16230] Call Trace: [ 857.070675][T16230] [ 857.070680][T16230] dump_stack_lvl+0x100/0x190 [ 857.070702][T16230] should_fail_ex.cold+0x5/0xa [ 857.070719][T16230] should_failslab+0xc2/0x120 [ 857.070736][T16230] __kmalloc_noprof+0xfc/0x840 [ 857.070749][T16230] ? rcu_is_watching+0x13/0xc0 [ 857.070761][T16230] ? tomoyo_realpath_from_path+0xb6/0x690 [ 857.070797][T16230] tomoyo_realpath_from_path+0xb6/0x690 [ 857.070817][T16230] tomoyo_path_number_perm+0x23c/0x580 [ 857.070832][T16230] ? tomoyo_path_number_perm+0x22e/0x580 [ 857.070848][T16230] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 857.070864][T16230] ? get_pid_task+0x106/0x250 [ 857.070880][T16230] ? __lock_acquire+0x4c5/0x1ec0 [ 857.070902][T16230] ? __fget_files+0x34/0x3d0 [ 857.070914][T16230] ? find_held_lock+0x2b/0x80 [ 857.070926][T16230] ? __fget_files+0x215/0x3d0 [ 857.070937][T16230] ? hook_file_ioctl_common+0x140/0x440 [ 857.070952][T16230] ? __fget_files+0x215/0x3d0 [ 857.070966][T16230] ? __fget_files+0x21f/0x3d0 [ 857.070980][T16230] security_file_ioctl_compat+0xd3/0x230 [ 857.070997][T16230] __ia32_compat_sys_ioctl+0xc2/0x360 [ 857.071017][T16230] __do_fast_syscall_32+0x13a/0x8b0 [ 857.071034][T16230] ? lockdep_hardirqs_on+0x7d/0x110 [ 857.071052][T16230] do_fast_syscall_32+0x32/0x70 [ 857.071067][T16230] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 857.071083][T16230] RIP: 0023:0xf7fd8fec [ 857.071099][T16230] Code: Unable to access opcode bytes at 0xf7fd8fc2. [ 857.071105][T16230] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 857.071117][T16230] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0cc5616 [ 857.071124][T16230] RDX: 0000000080000500 RSI: 0000000000000000 RDI: 0000000000000000 [ 857.071131][T16230] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 857.071137][T16230] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 857.071144][T16230] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 857.071159][T16230] [ 857.071247][T16230] ERROR: Out of memory at tomoyo_realpath_from_path. [ 857.144489][T11998] kernel read not supported for file /video9 (pid: 11998 comm: kworker/0:1) [ 857.259935][T16241] netlink: 'syz.0.2975': attribute type 1 has an invalid length. [ 857.260023][T16241] netlink: 174516 bytes leftover after parsing attributes in process `syz.0.2975'. [ 857.260066][T16241] netlink: 'syz.0.2975': attribute type 1 has an invalid length. [ 857.260095][T16241] netlink: 2016 bytes leftover after parsing attributes in process `syz.0.2975'. [ 857.346950][T16244] random: crng reseeded on system resumption [ 857.367223][T16244] binder: 16243:16244 ioctl c0306201 0 returned -14 [ 857.487828][T16252] FAULT_INJECTION: forcing a failure. [ 857.487828][T16252] name failslab, interval 1, probability 0, space 0, times 0 [ 857.487957][T16252] CPU: 2 UID: 0 PID: 16252 Comm: syz.0.2979 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 857.487998][T16252] Tainted: [L]=SOFTLOCKUP [ 857.488007][T16252] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 857.488019][T16252] Call Trace: [ 857.488027][T16252] [ 857.488051][T16252] dump_stack_lvl+0x100/0x190 [ 857.488081][T16252] should_fail_ex.cold+0x5/0xa [ 857.488107][T16252] should_failslab+0xc2/0x120 [ 857.488130][T16252] __kmalloc_cache_noprof+0x91/0x6d0 [ 857.488156][T16252] ? configfs_write_iter+0x388/0x4e0 [ 857.488185][T16252] configfs_write_iter+0x388/0x4e0 [ 857.488212][T16252] vfs_write+0x6af/0x1050 [ 857.488232][T16252] ? __pfx_configfs_write_iter+0x10/0x10 [ 857.488258][T16252] ? __pfx_vfs_write+0x10/0x10 [ 857.488273][T16252] ? find_held_lock+0x2b/0x80 [ 857.488307][T16252] ksys_write+0x12a/0x250 [ 857.488328][T16252] ? __pfx_ksys_write+0x10/0x10 [ 857.488346][T16252] ? ksys_write+0x1ac/0x250 [ 857.488363][T16252] ? __pfx_ksys_write+0x10/0x10 [ 857.488386][T16252] __do_fast_syscall_32+0x13a/0x8b0 [ 857.488411][T16252] ? lockdep_hardirqs_on+0x7d/0x110 [ 857.488432][T16252] do_fast_syscall_32+0x32/0x70 [ 857.488452][T16252] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 857.488471][T16252] RIP: 0023:0xf7fd8fec [ 857.488488][T16252] Code: Unable to access opcode bytes at 0xf7fd8fc2. [ 857.488495][T16252] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 857.488510][T16252] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800004c0 [ 857.488520][T16252] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 857.488528][T16252] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 857.488537][T16252] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 857.488546][T16252] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 857.488565][T16252] [ 857.538657][T16254] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2980'. [ 857.714026][T11998] usb 5-1: USB disconnect, device number 74 [ 857.714875][T16259] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 857.919380][ T5093] Bluetooth: hci3: command 0x0c1a tx timeout [ 857.989562][ T5093] Bluetooth: hci1: command 0x0c1a tx timeout [ 857.989654][ T5093] Bluetooth: hci2: command 0x2016 tx timeout [ 857.999512][T16206] Bluetooth: hci0: command 0x0405 tx timeout [ 858.024374][ T5818] lo speed is unknown, defaulting to 1000 [ 858.074646][T16272] netlink: 'syz.5.2985': attribute type 1 has an invalid length. [ 858.074714][T16272] netlink: 174516 bytes leftover after parsing attributes in process `syz.5.2985'. [ 858.074773][T16272] netlink: 'syz.5.2985': attribute type 1 has an invalid length. [ 858.074787][T16272] netlink: 2016 bytes leftover after parsing attributes in process `syz.5.2985'. [ 858.129910][ T5818] kernel read not supported for file /video9 (pid: 5818 comm: kworker/1:4) [ 858.309383][ T30] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 858.459376][ T30] usb 5-1: Using ep0 maxpacket: 8 [ 858.460911][ T30] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 858.462282][ T30] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 858.462334][ T30] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 858.462359][ T30] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 858.462383][ T30] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 858.462410][ T30] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 858.462457][ T30] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 858.849346][ T5818] usb 7-1: new high-speed USB device number 86 using dummy_hcd [ 859.000723][ T5818] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 859.002589][ T5818] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 859.002607][ T5818] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 859.002618][ T5818] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 859.002639][ T5818] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 859.003889][ T5818] usb 7-1: config 0 descriptor?? [ 859.022268][ T5093] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 859.023490][ T5093] Bluetooth: hci0: SCO packet for unknown connection handle 200 [ 859.185850][T16289] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 859.186117][T16289] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 859.186265][T16289] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 859.223724][T16292] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 859.226460][T11323] usb 5-1: USB disconnect, device number 75 [ 859.419709][ T5818] hid_parser_main: 29 callbacks suppressed [ 859.419799][ T5818] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x3 [ 859.419840][ T5818] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 859.419878][ T5818] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 859.419913][ T5818] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 859.419950][ T5818] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 859.419985][ T5818] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 859.420022][ T5818] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 859.420059][ T5818] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 859.420096][ T5818] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 859.420133][ T5818] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 859.474537][ T5818] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 859.726040][T16294] netlink: 'syz.2.2990': attribute type 13 has an invalid length. [ 859.802536][T16294] syzkaller0: entered promiscuous mode [ 859.802642][T16294] syzkaller0: entered allmulticast mode [ 861.109357][ T5093] Bluetooth: hci3: command 0x0c1a tx timeout [ 861.189305][ T5093] Bluetooth: hci1: command 0x0c1a tx timeout [ 861.189352][ T5739] Bluetooth: hci2: command 0x2016 tx timeout [ 861.269705][ T5739] Bluetooth: hci0: command 0x0405 tx timeout [ 861.277974][T16289] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 861.282037][T16289] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2992'. [ 861.513030][ T1346] usb 7-1: USB disconnect, device number 86 [ 861.540451][ T9] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 861.693720][ T9] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 861.699247][ T9] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 861.699275][ T9] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 861.699293][ T9] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 861.699331][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 861.699355][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 861.705992][ T9] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 861.706016][ T9] usb 5-1: Product: syz [ 861.706032][ T9] usb 5-1: Manufacturer: syz [ 861.720350][ T9] cdc_wdm 5-1:1.0: skipping garbage [ 861.720370][ T9] cdc_wdm 5-1:1.0: skipping garbage [ 861.721794][ T9] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 861.721811][ T9] cdc_wdm 5-1:1.0: Unknown control protocol [ 861.793141][T16339] FAULT_INJECTION: forcing a failure. [ 861.793141][T16339] name failslab, interval 1, probability 0, space 0, times 0 [ 861.793209][T16339] CPU: 2 UID: 0 PID: 16339 Comm: syz.5.3008 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 861.793237][T16339] Tainted: [L]=SOFTLOCKUP [ 861.793243][T16339] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 861.793251][T16339] Call Trace: [ 861.793260][T16339] [ 861.793265][T16339] dump_stack_lvl+0x100/0x190 [ 861.793284][T16339] should_fail_ex.cold+0x5/0xa [ 861.793300][T16339] should_failslab+0xc2/0x120 [ 861.793315][T16339] __kmalloc_noprof+0xfc/0x840 [ 861.793327][T16339] ? rcu_is_watching+0x13/0xc0 [ 861.793339][T16339] ? tomoyo_realpath_from_path+0xb6/0x690 [ 861.793361][T16339] tomoyo_realpath_from_path+0xb6/0x690 [ 861.793381][T16339] tomoyo_path_number_perm+0x23c/0x580 [ 861.793396][T16339] ? tomoyo_path_number_perm+0x22e/0x580 [ 861.793412][T16339] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 861.793428][T16339] ? get_pid_task+0x106/0x250 [ 861.793444][T16339] ? __lock_acquire+0x4c5/0x1ec0 [ 861.793466][T16339] ? __fget_files+0x34/0x3d0 [ 861.793478][T16339] ? find_held_lock+0x2b/0x80 [ 861.793490][T16339] ? __fget_files+0x215/0x3d0 [ 861.793501][T16339] ? hook_file_ioctl_common+0x140/0x440 [ 861.793516][T16339] ? __fget_files+0x215/0x3d0 [ 861.793530][T16339] ? __fget_files+0x21f/0x3d0 [ 861.793544][T16339] security_file_ioctl_compat+0xd3/0x230 [ 861.793561][T16339] __ia32_compat_sys_ioctl+0xc2/0x360 [ 861.793581][T16339] __do_fast_syscall_32+0x13a/0x8b0 [ 861.793597][T16339] ? lockdep_hardirqs_on+0x7d/0x110 [ 861.793612][T16339] do_fast_syscall_32+0x32/0x70 [ 861.793628][T16339] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 861.793643][T16339] RIP: 0023:0xf701efec [ 861.793656][T16339] Code: Unable to access opcode bytes at 0xf701efc2. [ 861.793662][T16339] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 861.793674][T16339] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000008914 [ 861.793681][T16339] RDX: 0000000080000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 861.793688][T16339] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 861.793695][T16339] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 861.793702][T16339] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 861.793716][T16339] [ 861.793756][T16339] ERROR: Out of memory at tomoyo_realpath_from_path. [ 861.932981][T16296] ================================================================== [ 861.933004][T16296] BUG: KASAN: slab-use-after-free in dummy_queue+0x937/0xb00 [ 861.933055][T16296] Read of size 1 at addr ffff8880797b54e8 by task syz.0.2993/16296 [ 861.933066][T16296] [ 861.933075][T16296] CPU: 2 UID: 0 PID: 16296 Comm: syz.0.2993 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 861.933094][T16296] Tainted: [L]=SOFTLOCKUP [ 861.933098][T16296] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 861.933106][T16296] Call Trace: [ 861.933110][T16296] [ 861.933116][T16296] dump_stack_lvl+0x100/0x190 [ 861.933132][T16296] print_report+0x13d/0x4b0 [ 861.933150][T16296] ? __virt_addr_valid+0x239/0x430 [ 861.933168][T16296] ? dummy_queue+0x937/0xb00 [ 861.933178][T16296] kasan_report+0xdf/0x1c0 [ 861.933193][T16296] ? dummy_queue+0x937/0xb00 [ 861.933205][T16296] dummy_queue+0x937/0xb00 [ 861.933220][T16296] usb_ep_queue+0xfa/0x3c0 [ 861.933237][T16296] raw_process_ep_io+0x64d/0xc40 [ 861.933257][T16296] ? __pfx_raw_process_ep_io+0x10/0x10 [ 861.933278][T16296] ? memdup_user+0x82/0xe0 [ 861.933297][T16296] raw_ioctl+0x25a/0x2b80 [ 861.933309][T16296] ? __pfx_raw_ioctl+0x10/0x10 [ 861.933321][T16296] ? __pfx_raw_ioctl+0x10/0x10 [ 861.933334][T16296] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 861.933371][T16296] __do_fast_syscall_32+0x13a/0x8b0 [ 861.933400][T16296] ? lockdep_hardirqs_on+0x7d/0x110 [ 861.933426][T16296] do_fast_syscall_32+0x32/0x70 [ 861.933453][T16296] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 861.933481][T16296] RIP: 0023:0xf7fd8fec [ 861.933503][T16296] Code: Unable to access opcode bytes at 0xf7fd8fc2. [ 861.933513][T16296] RSP: 002b:00000000f54954b4 EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 861.933535][T16296] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040085507 [ 861.933545][T16296] RDX: 00000000f54954f8 RSI: 00000000f7467ff4 RDI: 00000000f5495504 [ 861.933553][T16296] RBP: 00000000f5496518 R08: 0000000000000000 R09: 0000000000000000 [ 861.933561][T16296] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 861.933568][T16296] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 861.933579][T16296] [ 861.933584][T16296] [ 861.933587][T16296] Allocated by task 16307: [ 861.933593][T16296] kasan_save_stack+0x30/0x50 [ 861.933607][T16296] kasan_save_track+0x14/0x30 [ 861.933619][T16296] __kasan_kmalloc+0xaa/0xb0 [ 861.933630][T16296] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 861.933647][T16296] alloc_bprm+0x86/0x9e0 [ 861.933664][T16296] kernel_execve+0x8f/0x3a0 [ 861.933672][T16296] call_usermodehelper_exec_async+0x239/0x4b0 [ 861.933688][T16296] ret_from_fork+0x730/0xd60 [ 861.933705][T16296] ret_from_fork_asm+0x1a/0x30 [ 861.933715][T16296] [ 861.933718][T16296] Freed by task 16307: [ 861.933723][T16296] kasan_save_stack+0x30/0x50 [ 861.933735][T16296] kasan_save_track+0x14/0x30 [ 861.933747][T16296] kasan_save_free_info+0x3b/0x70 [ 861.933764][T16296] __kasan_slab_free+0x5f/0x80 [ 861.933776][T16296] kfree+0x22b/0x6d0 [ 861.933791][T16296] kernel_execve+0x1ae/0x3a0 [ 861.933800][T16296] call_usermodehelper_exec_async+0x239/0x4b0 [ 861.933815][T16296] ret_from_fork+0x730/0xd60 [ 861.933831][T16296] ret_from_fork_asm+0x1a/0x30 [ 861.933840][T16296] [ 861.933843][T16296] The buggy address belongs to the object at ffff8880797b5400 [ 861.933843][T16296] which belongs to the cache kmalloc-512 of size 512 [ 861.933855][T16296] The buggy address is located 232 bytes inside of [ 861.933855][T16296] freed 512-byte region [ffff8880797b5400, ffff8880797b5600) [ 861.933866][T16296] [ 861.933870][T16296] The buggy address belongs to the physical page: [ 861.933875][T16296] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880797b6800 pfn:0x797b4 [ 861.933887][T16296] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 861.933896][T16296] flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff) [ 861.933908][T16296] page_type: f5(slab) [ 861.933918][T16296] raw: 04fff00000000240 ffff88801c042c80 ffffea0001655310 ffffea0001575d10 [ 861.933930][T16296] raw: ffff8880797b6800 0000000000100009 00000000f5000000 0000000000000000 [ 861.933942][T16296] head: 04fff00000000240 ffff88801c042c80 ffffea0001655310 ffffea0001575d10 [ 861.933952][T16296] head: ffff8880797b6800 0000000000100009 00000000f5000000 0000000000000000 [ 861.933963][T16296] head: 04fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 861.933974][T16296] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 861.933982][T16296] page dumped because: kasan: bad access detected [ 861.933987][T16296] page_owner tracks the page as allocated [ 861.933992][T16296] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 15116, tgid 15115 (syz.5.2631), ts 808664157740 [ 861.934035][T16296] post_alloc_hook+0xfd/0x120 [ 861.934054][T16296] get_page_from_freelist+0x110d/0x35d0 [ 861.934072][T16296] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 861.934090][T16296] new_slab+0xa9/0x6e0 [ 861.934107][T16296] refill_objects+0xe3/0x410 [ 861.934124][T16296] __pcs_replace_empty_main+0x35e/0x650 [ 861.934140][T16296] __kmalloc_cache_noprof+0x4f4/0x6d0 [ 861.934157][T16296] snd_mixer_oss_build_test+0x7a/0x380 [ 861.934170][T16296] snd_mixer_oss_build_test_all+0x3c0/0x6e0 [ 861.934183][T16296] snd_mixer_oss_build_input+0x139/0xd50 [ 861.934196][T16296] snd_mixer_oss_notify_handler+0x48d/0x990 [ 861.934210][T16296] snd_card_register+0x2af/0x760 [ 861.934226][T16296] f_midi2_bind+0x1198/0x2770 [ 861.934240][T16296] usb_add_function+0x219/0x890 [ 861.934255][T16296] configfs_composite_bind+0xd83/0x1960 [ 861.934271][T16296] gadget_bind_driver+0x28c/0xbf0 [ 861.934283][T16296] page last free pid 15103 tgid 15103 ts 807959256054 stack trace: [ 861.934291][T16296] __free_frozen_pages+0x79f/0x10f0 [ 861.934306][T16296] io_ring_exit_work+0xceb/0xd59 [ 861.934322][T16296] process_one_work+0xac7/0x1b10 [ 861.934335][T16296] worker_thread+0x5ef/0xe50 [ 861.934355][T16296] kthread+0x373/0x450 [ 861.934368][T16296] ret_from_fork+0x730/0xd60 [ 861.934388][T16296] ret_from_fork_asm+0x1a/0x30 [ 861.934400][T16296] [ 861.934403][T16296] Memory state around the buggy address: [ 861.934409][T16296] ffff8880797b5380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 861.934418][T16296] ffff8880797b5400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 861.934426][T16296] >ffff8880797b5480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 861.934432][T16296] ^ [ 861.934439][T16296] ffff8880797b5500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 861.934446][T16296] ffff8880797b5580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 861.934453][T16296] ================================================================== [ 861.934460][T16296] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 862.182339][T16296] CPU: 2 UID: 0 PID: 16296 Comm: syz.0.2993 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 862.185706][T16296] Tainted: [L]=SOFTLOCKUP [ 862.187085][T16296] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 862.190810][T16296] Call Trace: [ 862.192101][T16296] [ 862.193150][T16296] dump_stack_lvl+0x100/0x190 [ 862.194811][T16296] vpanic+0x553/0x970 [ 862.196257][T16296] ? __pfx_vpanic+0x10/0x10 [ 862.198189][T16296] ? __pfx_vprintk_emit+0x10/0x10 [ 862.200549][T16296] ? dummy_queue+0x937/0xb00 [ 862.202686][T16296] panic+0xd1/0xe0 [ 862.204476][T16296] ? __pfx_panic+0x10/0x10 [ 862.206830][T16296] ? end_report.part.0+0x23/0x90 [ 862.209300][T16296] ? rcu_is_watching+0x13/0xc0 [ 862.210917][T16296] ? end_report.part.0+0x23/0x90 [ 862.212600][T16296] check_panic_on_warn.cold+0x19/0x34 [ 862.214302][T16296] end_report.part.0+0x3a/0x90 [ 862.215832][T16296] kasan_report.cold+0xe/0x18 [ 862.217340][T16296] ? dummy_queue+0x937/0xb00 [ 862.218941][T16296] dummy_queue+0x937/0xb00 [ 862.220414][T16296] usb_ep_queue+0xfa/0x3c0 [ 862.221893][T16296] raw_process_ep_io+0x64d/0xc40 [ 862.223765][T16296] ? __pfx_raw_process_ep_io+0x10/0x10 [ 862.226151][T16296] ? memdup_user+0x82/0xe0 [ 862.227971][T16296] raw_ioctl+0x25a/0x2b80 [ 862.229864][T16296] ? __pfx_raw_ioctl+0x10/0x10 [ 862.231720][T16296] ? __pfx_raw_ioctl+0x10/0x10 [ 862.233392][T16296] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 862.235180][T16296] __do_fast_syscall_32+0x13a/0x8b0 [ 862.236822][T16296] ? lockdep_hardirqs_on+0x7d/0x110 [ 862.238997][T16296] do_fast_syscall_32+0x32/0x70 [ 862.241034][T16296] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 862.243570][T16296] RIP: 0023:0xf7fd8fec [ 862.245293][T16296] Code: Unable to access opcode bytes at 0xf7fd8fc2. [ 862.247672][T16296] RSP: 002b:00000000f54954b4 EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 862.250797][T16296] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040085507 [ 862.253346][T16296] RDX: 00000000f54954f8 RSI: 00000000f7467ff4 RDI: 00000000f5495504 [ 862.255837][T16296] RBP: 00000000f5496518 R08: 0000000000000000 R09: 0000000000000000 [ 862.258368][T16296] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 862.260832][T16296] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 862.263283][T16296] [ 862.265166][T16296] Kernel Offset: disabled [ 862.266611][T16296] Rebooting in 86400 seconds.. VM DIAGNOSIS: 13:43:34 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000007 RBX=ffff88802a03b158 RCX=0000000000000200 RDX=af2856df48a2c036 RSI=00000000abc7a814 RDI=000000006299d4f6 RBP=0000000000000007 RSP=ffffc9000301f1b8 R8 =00000000ff74ed18 R9 =0000000000000007 R10=0000000000000001 R11=0000000000000001 R12=ffff88802a03a580 R13=0000000000000001 R14=0000000000000005 R15=af2856df48a2c036 RIP=ffffffff81e6713d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007fba4f73d880 ffffffff 00c00000 GS =0000 ffff888096968000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f7268c10 CR3=000000004ee98000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000104080 Opmask01=0000000000010410 Opmask02=00000000ffffffff Opmask03=0000000020400004 Opmask04=00000000ffffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc2b7bd2a8 00007ffc2b7bd2a8 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc2b7bd480 0000003000000010 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005637d43de960 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005637d43dbff0 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fba4f1f1b20 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000ff00 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 797469726765746e 692f35706f6f6c2f 6b636f6c622f6c61 75747269762f7365 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000007974 69726765746e692f 35706f6f6c2f6b63 6f6c622f6c617574 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 752f302e6463685f 796d6d75642f6d72 6f6674616c702f73 6563697665642f73 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005637d43e34e0 00005637d43ddae0 0000000000000031 0000003177617264 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005637d44062a0 ffffa9c82bbf293c 0000298d9b4b9d1a 000029cbff449b08 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005637d454e6f3 ffffa9cebfbffbfe 00007fbfff7bbffb fffffffffffffffc ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 30322f31302f3430 64623a322d332e36 312e312d6e616962 65642d332e36312e ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005632b7403f00 0000000000000040 0000000000000020 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005632b7403f00 0000000000000021 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000001 RBX=0000000000000001 RCX=ffffffff851eb373 RDX=0000000000000001 RSI=0000000000000008 RDI=ffffffff91452858 RBP=ffff88805af1c800 RSP=ffffc90005627b68 R8 =0000000000000000 R9 =fffffbfff228a50b R10=ffffffff9145285f R11=0000000000000000 R12=dffffc0000000000 R13=0000000000000000 R14=ffffc90005627c60 R15=1ffff92000ac4f75 RIP=ffffffff851eb37b RFL=00000247 [---Z-PC] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096a68000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f53ebff4 CR3=000000005aec9000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=00000000000f000e DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000036 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85ae0315 RDI=ffffffff9bc4f1e0 RBP=ffffffff9bc4f1a0 RSP=ffffc900044ef398 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=000000000007fffc R12=0000000000000000 R13=0000000000000036 R14=000000000000000c R15=ffffc900044ef6b0 RIP=ffffffff85ae033f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096b68000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f7fd9000 CR3=000000004eb15000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000020b01da85e2 RBX=ffff88802b523d80 RCX=00000000000006e0 RDX=000000000000020b RSI=ffffffff81fade05 RDI=ffff888024374b00 RBP=000000c8a968db15 RSP=ffffc90006f5f9c0 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=1ffff92000debf42 R13=0000000000000001 R14=0000000000000001 R15=ffff88802b523dc0 RIP=ffffffff81fade18 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096c68000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f7f4a190 CR3=000000005aec9000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=00000000000f000e DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000