last executing test programs: 6.916479724s ago: executing program 1 (id=2720): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x20, 0x3f, 0x107, 0x70bd2b, 0x0, {0x1, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @pid}]}]}, 0x20}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) 6.916070172s ago: executing program 1 (id=2721): mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x100000f) r0 = syz_open_dev$evdev(&(0x7f000001fa80), 0x0, 0x3f) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0xd2}, 0x9c) bind$inet6(r1, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000380)={0x0, 0x1, 0x8001, 0x4}, 0x10) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) r3 = eventfd2(0xff, 0x80801) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f00000000c0)={0x0, r3}) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000080)=0x200000000) r5 = dup2(r3, r4) ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, &(0x7f0000000040)=0x1) ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, &(0x7f0000000000)=0x5) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000001200), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x3c, r7, 0x1, 0x70bd2d, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r5}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x38, 0x0, 0x1, 0x70bd26, 0x5dfdbfe, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x2, 0x79}}}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2800000010000108feffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="000000001010000008001b0000000002"], 0x28}}, 0x0) close(0x3) ioctl$EVIOCSCLOCKID(r0, 0x40084504, &(0x7f0000ffcffc)) openat$urandom(0xffffffffffffff9c, &(0x7f0000000340), 0x8202, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) 6.810441617s ago: executing program 1 (id=2722): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x441c2, 0x0) ftruncate(r0, 0x6) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x3c00, 0x1) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f0000000080)=""/224) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r2, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000002fc0)="a6", 0x5dc}], 0x1}}], 0x5, 0x4040000) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080fa0904"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000001000)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000180)={{0x2, 0x4e23, @private=0xa010102}, {0x6, @random="18d9e3fab909"}, 0x66, {0x2, 0x4e22, @multicast2}, 'ip6erspan0\x00'}) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x2001005, 0x3ffffffe, 0xffffffff, 0x4}, 0x10) write(r4, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0) write(r5, &(0x7f0000000a00)='stm32g0-typec 0x3', 0x11) syz_usb_control_io(r3, 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x8000) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00') r7 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000400)) syz_usb_control_io(r3, 0x0, 0x0) 3.741982689s ago: executing program 1 (id=2746): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x104) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$binfmt_format(0xffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) write$binfmt_format(r2, &(0x7f0000000100)='-1\x00', 0x2) close_range(r2, 0xffffffffffffffff, 0x0) write$P9_RVERSION(r0, &(0x7f0000000c80)=ANY=[], 0x13) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$TUNSETTXFILTER(r3, 0x400454d1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r5, 0x29, 0x1a, &(0x7f0000000000)=0x6, 0x4) r6 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newlink={0x40, 0x10, 0x403, 0x1ffffe, 0x0, {0x0, 0x0, 0x0, 0x0, 0x12080, 0x42}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_FD1={0x8, 0x2, @udp6=r5}, @IFLA_GTP_FD0={0x8, 0x1, @udp=r6}]}}}]}, 0x40}, 0x1, 0xba01}, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={0xffffffffffffffff, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)=[0x5], &(0x7f0000000180)=[0x2], 0x0, 0x1, 0x1}}, 0x40) 3.504865095s ago: executing program 3 (id=2748): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b00000000000600010007"], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x820) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000280)={0x28, r5, 0x1, 0x2, 0x0, {0x7}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'bridge0\x00'}]}, 0x28}}, 0x0) (fail_nth: 8) 3.427342401s ago: executing program 1 (id=2749): bind$alg(0xffffffffffffffff, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000000940)=0x1000008, 0x4) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_INIT(r1, 0x29, 0xc8, &(0x7f0000000340), 0x4) setsockopt$MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000040)={0x1, 0x1, 0x40}, 0xc) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, {0xa, 0x0, 0x0, @empty}, 0x0, {[0x0, 0x0, 0x0, 0x0, 0x0, 0x1e9]}}, 0x5c) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd4, &(0x7f0000000080)=0x6, 0x4) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x48000) r2 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_raw(r2, &(0x7f0000000000)={0x1d, r3}, 0x10) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, &(0x7f0000000180), 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bind$can_raw(r2, &(0x7f0000000080), 0x10) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x30300, 0x0) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0) write$uinput_user_dev(r5, &(0x7f0000001b40)={'syz0\x00', {0x0, 0x0, 0x0, 0x4}, 0x0, [0x39, 0x3, 0x4000401, 0x208, 0xe, 0x0, 0xffffffff, 0x0, 0x3, 0x0, 0x0, 0x2, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2a, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xfffffffd, 0x10000000, 0x99, 0x20000000, 0x0, 0x0, 0xfffffffd, 0xc05c, 0x7fffffff, 0x0, 0x5, 0xfffffff6, 0x0, 0x8, 0x800000, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x101], [0x3, 0xfffff41a, 0x0, 0x0, 0x4, 0x20000, 0x2000000, 0xedc0, 0x0, 0x5ee, 0x5, 0x3, 0xe, 0xfffffffe, 0x0, 0x0, 0xfffffffd, 0xa0000000, 0x0, 0x8, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1, 0x0, 0xfffffff8, 0x2, 0x0, 0x2, 0x10000, 0x0, 0xcc, 0x8, 0x40000, 0x0, 0xc0800000, 0x100, 0x0, 0xfffffffd, 0x4, 0x0, 0x0, 0x0, 0x0, 0x25, 0x4, 0x0, 0x2, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, 0xfffffffe, 0xfffff982], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x2, 0xfffffffc, 0x0, 0x0, 0xfffffffd, 0x2, 0x200, 0x1, 0x0, 0x0, 0x20, 0x0, 0x2, 0x4000, 0x6, 0x0, 0x0, 0x200, 0x4, 0x6, 0x80000000, 0xfffffffe, 0x47fff, 0x0, 0x0, 0x0, 0x3, 0x0, 0xf, 0x3, 0xfffffffd, 0x0, 0xfffffffd, 0x0, 0x4, 0xfffffffc, 0x46, 0xf88], [0xfffffffe, 0x0, 0x4, 0x0, 0xfffeffee, 0x0, 0xfffffffe, 0x4, 0xfffffffc, 0x0, 0x0, 0x3, 0xfffffffc, 0x4, 0x803, 0x6, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x10, 0x5, 0xfffffffe, 0xfff, 0x8, 0x8, 0x1ff, 0x80, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xea, 0x6, 0x0, 0x0, 0x8000000, 0x4, 0xffffffff, 0x0, 0x0, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x5) ioctl$UI_SET_SWBIT(r5, 0x4004556d, 0x3) ioctl$UI_DEV_CREATE(r5, 0x5501) r6 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a310000000014000780050015000c00000008001240000000000500050002000000050004000000000010000300686173683a69"], 0x5c}, 0x1, 0x0, 0x0, 0x20000090}, 0x8084) ioctl$MEDIA_IOC_REQUEST_ALLOC(r6, 0x80047c05, &(0x7f0000000080)) 3.350291968s ago: executing program 3 (id=2750): setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000300)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="1d003300d00009"], 0x44}}, 0x0) 3.273483395s ago: executing program 3 (id=2752): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101901, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x971}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001140)) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) syz_extract_tcp_res(0x0, 0x6, 0x5) syz_emit_ethernet(0x30f, 0x0, &(0x7f0000000640)={0x0, 0x2, [0x4a1, 0xc34, 0x211, 0x4b]}) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x1b}, &(0x7f0000000100), &(0x7f0000000680), 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = io_uring_setup(0x68f7, &(0x7f00000002c0)={0x0, 0x48c7, 0x80, 0x0, 0x8100016b}) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = dup(r5) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x10006, @loopback, 0x3}], 0x1c) sendmsg$inet6(r5, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) r7 = dup(r5) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000000)='bond_slave_1\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x8, 0xff}, 0x9c) sendmsg$inet(r7, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000001fc0)=[{&(0x7f00000008c0)='G', 0x1}], 0x1}, 0x8000) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000a40)={0x0, @in6={{0xa, 0x4e24, 0x5, @loopback, 0x1}}, 0x4, 0x1, 0xf06, 0x0, 0xac, 0x7d, 0x5}, 0x9c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, 0x0, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000140)=@newtaction={0x14, 0x30, 0x1, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x2000c800}, 0x2400c800) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty, 0x3}}, 0x1000000, 0x31, 0xffff1896, 0x3, 0x6, 0x8, 0x1b}, 0x9c) close_range(r4, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) 3.031832992s ago: executing program 1 (id=2754): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x441c2, 0x0) ftruncate(r0, 0x6) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x3c00, 0x1) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f0000000080)=""/224) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r2, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000002fc0)="a6", 0x5dc}], 0x1}}], 0x5, 0x4040000) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080fa0904"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000001000)={0x44, &(0x7f0000001100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000180)={{0x2, 0x4e23, @private=0xa010102}, {0x6, @random="18d9e3fab909"}, 0x66, {0x2, 0x4e22, @multicast2}, 'ip6erspan0\x00'}) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x2001005, 0x3ffffffe, 0xffffffff, 0x4}, 0x10) write(r4, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0) write(r5, &(0x7f0000000a00)='stm32g0-typec 0x3', 0x11) syz_usb_control_io(r3, 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x8000) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00') r7 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000400)) syz_usb_control_io(r3, 0x0, 0x0) 2.949264123s ago: executing program 3 (id=2756): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) r1 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0x16, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000fcffffff1801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000018010000696c6c2500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000001000000850000000600000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r2, 0x0, 0x10, 0x38, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) listen(r1, 0x9) r3 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r3, &(0x7f00000000c0)="ab", 0xfffd, 0xc1, &(0x7f0000000280)={0x2, 0x4e22, @loopback}, 0x10) recvmmsg(r1, &(0x7f0000003a40)=[{{&(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private1}}}, 0x80, &(0x7f0000002680)=[{&(0x7f0000000100)=""/113, 0x71}, {&(0x7f00000013c0)=""/4096, 0x1000}, {&(0x7f00000023c0)=""/142, 0x8e}, {&(0x7f0000002480)=""/129, 0x81}, {&(0x7f0000002540)=""/45, 0x2d}, {&(0x7f0000002580)=""/194, 0xc2}], 0x6, &(0x7f00000026c0)=""/30, 0x1e}, 0x80000001}, {{&(0x7f0000002700)=@ax25={{0x3, @netrom}, [@rose, @default, @remote, @bcast, @netrom, @default, @null, @null]}, 0x80, &(0x7f0000002a00)=[{&(0x7f0000002780)=""/144, 0x90}, {&(0x7f0000002840)=""/73, 0x49}, {&(0x7f00000028c0)=""/243, 0xf3}, {&(0x7f00000029c0)}], 0x4, &(0x7f0000002a40)=""/4096, 0x1000}, 0x80}], 0x2, 0x100, &(0x7f0000003a80)={0x77359400}) readv(r0, &(0x7f0000000b40)=[{&(0x7f0000000cc0)=""/154, 0xfdef}, {0x0}, {0x0}], 0x3) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000140011f225bd7000fddbcf250284", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0x40) 2.711286575s ago: executing program 3 (id=2758): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0xffffffffffffff39) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x7b19, 0xc000, 0x0, 0x38}) io_uring_enter(r0, 0x0, 0x2980, 0x12, 0x0, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r1, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$binfmt_misc(r2, &(0x7f00000006c0)="29868d4e677f2a8a1e28fb2290a442eb90f88c65c3cc86c4ad3942994e16ad55046dd48590ec32fdc1c6df78dd773d91e20221650f9d1ce31db2731fccd779e8b30e7f8a8a15d2ec806523f70ff26881e6718af1b8629dd9562f05d0830d56bd05663b295ae292abbe1a4ff8aa4a104fa1f0657e019d42defc2ddedcf75307c167bac129bb389c870051aa34d0e2efc6a8455b08b57e4a16738e916a639096bec4bc913e9b9cdf78f475c352060bf4062eb62c1fa1504ae2295172fc354620e65c2389f36447d56a8c6e020bea1cb876a45f215b015df7a43a3c157ceb16dab1206211ebaf60b922112f4765b2964ddbb3295a1fed41087b7208e30997ef581c07b23ffbfcfbc03097baf7d81d6b4d86f3fa65e2792ee6d561e40bdf1eaf4bd36c42aef8b189bce1b7cc02a0be8214f4c194f6179c779175ab4cd6af7dd824d8e2d1df3243a81ba33fa132a798d96320eaf8f2a6f7e21beb124bdbfa3c68aa72b091f56fe1bccfe26043a97f9447bba1f02a3971687cc1bcd4e8e841bcffc57cef0a2a0bcbb79999d20421bd3e3ea1416a72d9eeaa346d9c94cea5b82ca21ffb406321769d0abeede5f98b2ec5bfdb77abea11d92a7ad0977e2d83df94e8f330cad0c31221d6733c3cc711c1420091eb007e2ac3a219422f00bc4e90567b24473dba8a0be3a968c782f64dac819739b809052a73a2fdac6d364da68b21074408d4f78a99b73ff8ead5c9131725ac342927081222f6a0e718d9002aee963245e344804b8feaf67fd443850d0780d95ef37be1f5c7eb81986c6c298c21bb224d39663de9ff0d98c28780d05b04c35fc54ad686f80bbe2d93887c6116d3819ae58ca778465926216d39130d6d6c9e7e543b6b3cf6b83b67807c1ba3dcf795419dbf0ec4b0ca5d9a7a8383b460c6b8fa90a77e106f39a8e79ab64b4624ed95b726554fe9fc63047c21ee02b8c5b4ab9523066ccb55dad83be4151deaca0e3b1b7ce0dee6136bbbbd258fb2ce262e2aa43795202f4ec4b063b570691ba309144ac2f8a6c1a7e6fc3fa04380aaf01f724642cd8c98c33f8a2ebfdb551361b13c1756fe749a44c50f8276a0e3f9a0ad96160d72bf01172cea0222213b47c6485e4692914db1fc776acb0b7486dc0b140a4ea8e94266db4dede29bba115902f91e5b8b7e558dcda427a5a3aa9cb38f3eb808fd0062c05dd6411614359063daf3f31c7bcdfd1682f4067f5e2b43743a333fcf21d8870c5ac0870cf6ce1e1fed8c1bea52c07d1934a842f84838491e449b79aa365e5405dc4c42ee1025cf5963dd9edcd272795d42b3e2c48ad9587eeebcc7f9d8114d418ff34620673339ddb3011c5507d497613a3696a81d4458c66a5e56f7bd6d0b18577be87d7af9779a0fe32df021269f4b3a197c4afc88758bd8e248b68b2c6a7fb0521b69db351126631dc192418230ae0e604a491ba5d4e1412670178f01e886746f3fe01af4cd67d834958a46d743821338025e3e5ee84d090849ef31920f78759f90adfa0b30d56c62902f96e5a4cc72bff655aa1eb05e058390581494847f0070a2d312d9f8423eb045fd10d2f8ec5a14153900e9ffa37affa02845a3d60f397895ee98372b6d62d16684b26559d39c45b706e03a542b276e657adecda272e12029da64b462d540ffbdc7e49d9b3d05eae5057690f62b5d273c6427a9f9716801e1754d073b6f526f57ac857f89949bb615b3597b41a7495280719072108e1a769d172539e835bd00a0f3b7cb32bbe2b5166200fdadd760c8ddbd979f360f85e201160048ce99786e996f0bdb1667e3b4cf3c58ddedd7db0eb2e598ad4d8688e79c2e5e38909ef07d42edf86ee8fbf22f2c656fccc2f39503d9cd1f67079247c39bb8cfa8798c561d530ce7d754b75e71de31f07bb620f5dfa8d2fc237e670cfcedb631ff31110f429be756892fc8450ff21874f5d398f0d5c75370cfd30f184416375a3c30c5ecd84632b99354d287a343a0621f1337826d200e6df5cb34208a2853c0f193562446caf0f9335b6f1708c5cc850068f114f807bbc7465df8134601f93a06f3d01f5144b83124bf7c656e8040a0907b75a2913e78850d8ce35422c20b81789b2f33653cd2310e8c45365c6ee64f6e572cd037abd7520bd10f0825a42687d05711b5fea5b03010fd79c367a78bf059c7bd5540677280591da65b29d4377091bba0d9f864bab92f0e88bc1f8fba73b7fefbfd4675ff5b03864077daada75fe667d2d7c3f3faf4bfb341acc30d98404434526e9fd4de395257040a7adbba6601a11a3eb671e9552dd18dc85745095c06e07338805a2ae83f0fa33785ef0c0d415caccd85600d2bb352e7471ba3559643893ace36c877c5c90bc97118503eac92f58099139db6f412c13df416e0d271715099d9b59ede847db35bdfb9dcd7a67d43a7a25af5188dbf33b80d297f02e239a96ed0bf798a5c0734f9f4fa5c1978ccfdde470915f1dedee029290b29a346d5a4c29d99df1aa0d3816d655f37d39ab244972b8efe8f74ed49d7f9ed2a1ab67efcb539f263cc592a82667aa4dcf4922bc8192dadecedf209edb85c70dd2eb2b23904f25969f52dc9be29ff5a36b5f35becbcfb9d3a2ccb8dbe69f58d3cada40dbec79ab4818b9a2ace3824add90ee00fdeacc0080ee0ba4fb93ab8d9b6339853d97c28f09c0a96a3b35a756486a342eca5d1f07b6d5298d13a01d364ea5fd8d035f2afa7538075324599aae3d372fe10d0e0572142b04f1981693b504940ba62b3ea6041e59ad97379ce3ae1cd11d2a2835fdb749cf567b446f86bd1d150cd7915337c69ad65e861cf4cfd2361da3e13ff964716f1331db1dabc9c389bbf388c03804b671883e6aa1300b3525eea94da2cc8096789d84efb4298762b2cbcd403a35890334ac6d6d2e65d1dfae66420aa4e1b067dab94f119a6e8d4fbe57d840ea16baa6c2571fa7eed41db1f7c5fa64ee16d692f2c9a04b90ff4856e4085234b88bdf4a7758c389d9cc78e9ab3c47efc1e74c63f64b19c97a492a0cb39ca67a8cc33ed287a8e39d7f615648d1027c553f4b2758dab553aa52c7079051ff95b41e7a217657bc8551f11b2db800b494540a20cb5a3a1473f2873f25cb87b14b732623e7f2cff7c02a71e8be3160baf425c7cf1a1d12b3bc7ab0142267feb2a17b216bcdf359f853477577e7d5bdede922a25e3b9dc77d8193a481667a079f71ec74dcdcc108eb7fd287b4bd4ed7747522d0c9c93e81d0c96a8e807179324cf5ce473067ea7450e56015722515203d23917aa45b2854cd886098af3869dfdc99eca191fda8007089c26129be331155d4982ece974c05d0450dba8174d04c2c3354a117e06494acd6e85267553bc41db3868e3b44cf336e97a817496b4b8b46a427ab25766290cbedb1efe1f377cbfcbf630c1f9e1d9156c98268f528541bbc3daff58e60cde82d81ff8ce2bcaafba125547fee340529247561488073f182eb05604073dc0372e3c720e61979f36c65c2395df23478e0cb9ccbce2d7659a4aa3021bd9a5e23ddcc1de7b0576a7ac232d16bd8406374d8838576f782ae268bab7afc71dd58a0c5cec0a5ed4f3fa3b127808eea7a5ee0fc0ded07f92b69c1d2d32aa05186dde7982f780107722e9e5a5f672df444f7b1b9cadc29cfac2f423a3d04c4f4b26af60eb343955568717e8783bdc9e616135ccb424b976e2afd37ef14de94c0237508c4343ae63dc5b69abef579d61131ae6902199c9b11e9ca0807916dedbc073e896ba0dbb61df92909b1dd5159195b9d512befed88206d31b1cfa43d9989b6c65074b0feb86686a7202a06211bb6cc216397886912eec54990a35dd5edd05f38ab5dfcae4f2db17a1f3ddacad7578ce7d25e8cbd416a00163d8002e04efc9cc4bc21c4691c2d1466475c20ff7f6ce4e328e9216670aec7e7bc6a57e6ffe5f9c6cb316de58682154aaeeb200f751d4d3782b549c157e5030ab764fcaaa6b2d27d2ee8bc385ef0a76cda7cc708e27f7b93f09b44aa281529da1d40fbda9889b24851aa0d024191b781dd20235fb713204032638046f826bbd2790e097022a6b2d71c483b14c34c2b69c4bc5437bf6e995206e99daeb966af4ef8d7b4b3c116791c12c9e779b20d370efa352b22e882173f9346f4017465466308d64bca02fb07039dc1a5a24eb1de904307943c5c581102cc30b9beb939db56f34c5d5ad233a730b6106e70cb8a34010dbe56d45419251e6c19f594c598890d0565e20265fcddff889e3c4e9d236d77e22a4f75ec6e9aaa6602eb56c2015578820389c0f4fddda2cb566b10e3635b62e35d9fbc66de1a0eefefa6cf3e170606dd89e0904ff8e940aa768c6aa7615f06772d2735f8a8e75b5dea8588068c67011184bcf8c67ccdaf61bcb92c6a7f8fa49c502267a2d8fd3720d53f73f9d43fee0d889b1fd1946bc1160124363437665f93a09e886aad05a3d32a35430dfeb5ed4ca7d70489363c70fa3651aea62b953d99484ee2b8060e2ac5ed9601495e3c79393749e0279aed1d3e469a9956dcd6c4ea9c9415a0190e63ded00d3d0069af068f67e6290c8fdd19c7006bafec7ef06615e8b6237c03d20032cfacf982a5544c089f2c44906b47ae8a0ce5bbb2beb192bee2b73b2bc18a2f1b787bb47f0a551f378667e8ffa324fb1f1701a3bd58b875a29824a587b11f414a53bf8dffb8acfc1641337d9cb606c56cdc9df5fcff811544b854c7e7dce0cb9f3723ddd4b7779c968a0d7632857da37d224391a52af2ae5d32843c65ab6ff688831329db32673c0ee437124d9c9fc8789ebab6061f2eeec93d88103d1ecbfe865fc28c1b37421dc4904b353b3d2a248c9f529433b55b906a13b0b97404ca2d1c3ee089b3c005a28e9512e77c6a5e5fd4d2ffe7a300e019a96c97010347db2f70ce8d82c002bf4fd2e40cc6bc62f02abc09f4d0892bd373c2e39f9587a5d1d40364af25169bbdf94ddaac7739e52ff4da1a495f06b9a45e7133c204c6b7aaeae58e0e6a10f911ca78faacca2622d517e0b11aca764daaa816dbc2c44100a5e12bc8d5baed98bfabb1fff306d92ee1c551a8c48b1833b9aaba7d159796b1d472df5271538e85fc868b26babab4c5cc6959db85c0f1322f59c6d5fff9e4cd2fd3b6688915a2fa9374a1e703792a435e2b4ce393f68d26955a99aea09df067ab8fb81f6de8cd0c25fc78b9cdc809266f666512ca79ed7a4dc93aebc633ee2298880f02175910aab66d15270c773631a42bd9c55b4af9436491f2a0fcb5b069a17f350456f9bbe2eefd92447c68957f18f120a4f4b1ca266252f0616c6773b206c344e15cf2cf4f19202b99e828dbc426cc0a65034550abc957319cbd548d481ff5e2602b92bd3332ed85cb23e99fb3c4d92170175536e7be0c570d005cd33496a3f7fdfe2b3415542a0ffcf4cf441e2a7cf19778b239de0ec59478236f0aab3f24950e9247207c7fc249d6b1b602ee506e7fc51e24124028ab693261d68c3ef4d7d1d59ff4db564166d02ebeff9d09c84efac80c466e5b60461cd68c8b2a4984988f0c7193af3a22bb9bdd2c3d53f72d086c46055ad85e216aa4cd71b594e9e20e9d88e09f216506d4434861f8c95bd605aa5293bc74034913af9953622296282cbefcff368d607f738639c34a5250221a1defca5d08dac1b82b2a54a987516d9f40f3210ff90c3426e33ba6a7a49dd69352a77590b81adf8333dc535c2d95e1330afaeec715565e47fc547429cedba7e4c8d257ce93ad4cec4a1ccc27317ad33597bf02d767f", 0x1000) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e23, 0x3, @ipv4={'\x00', '\xff\xff', @local}, 0x2}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000280)={[0x8000]}, 0x8, 0x800) fcntl$setownex(r3, 0xf, 0x0) recvfrom$inet6(r1, &(0x7f0000000140)=""/178, 0xb2, 0x100, &(0x7f0000000200)={0xa, 0x4e22, 0x100, @private0={0xfc, 0x0, '\x00', 0x1}, 0xa89}, 0x1c) 1.609290612s ago: executing program 3 (id=2766): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x441c2, 0x0) ftruncate(r0, 0x6) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x3c00, 0x1) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f0000000080)=""/224) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r2, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000002fc0)="a6", 0x5dc}], 0x1}}], 0x5, 0x4040000) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080fa09"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000001100)=ANY=[@ANYBLOB="40c628de7089"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000180)={{0x2, 0x4e23, @private=0xa010102}, {0x6, @random="18d9e3fab909"}, 0x66, {0x2, 0x4e22, @multicast2}, 'ip6erspan0\x00'}) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x2001005, 0x3ffffffe, 0xffffffff, 0x4}, 0x10) write(r4, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0) write(r5, &(0x7f0000000a00)='stm32g0-typec 0x3', 0x11) syz_usb_control_io(r3, 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x8000) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00') r7 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000400)) syz_usb_control_io(r3, 0x0, 0x0) 1.387255084s ago: executing program 0 (id=2768): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1b, &(0x7f0000000080)=0x1, 0x4) ioctl$FIONCLEX(0xffffffffffffffff, 0x5450) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mincore(&(0x7f00001a5000/0x3000)=nil, 0x3000, &(0x7f0000000340)=""/4096) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x42032, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x2c}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000240)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000, 0x1, 0x1000000}) 1.320255306s ago: executing program 0 (id=2769): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='configfs\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mount(&(0x7f0000000400)=@filename='sysfs\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000200)='0x1234\n', 0xfffffffffffffc7e) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='0x5678\n', 0x7) rseq(&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x3}, 0x20, 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) r2 = openat(r0, &(0x7f0000000600)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_chmask\x00', 0x0, 0x128) write(r2, &(0x7f0000000700)='0\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r3, &(0x7f0000000900)='3\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g_uac2/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g_uac2/configs/c.1/uac2.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000001500)='./config/usb_gadget/g_uac2/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000001600)='usbip-vudc.0', 0xc) close(r4) writev(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f00000005c0)="c800b66cf7e6a5", 0xff57}, {&(0x7f0000000140)="e2b5de1b04c03054271995b320812ed7ded5ec71d0c57c5f11366f435a79a10e509bdfc4425719a03d2647f06c09e0a6dfc63acef45296e824c5c25945387c1840340d7203c4bc7f6228a7b0388ba698f8e8bb15ee5762f41d1f8953e00ef286a2426181912541e43bb71a016fd7cffaccd2cf79da80b0c67a87e82dfa52ac31dac584f37ebe1a25c62d9b55b678598cf69428a806b8fc096bb97053e0099600d4bc78e717b612c96807e519cb7300"/188, 0xbc}, {&(0x7f0000000300)="1c7e6b9e688e6270cf440480946456f950e37af773e53874c663dd2a336df10d2d1187d48719ed7fd17ca09b6bdaa49710183eb991f93aef84adb0a2dad9bb05b690e65758d5c66e64d6fdd07ce5771e98a47f7756a093c6e8b0fbf8cb95f4f6df7f227ef95f7f5f56b2e239c2e17453daf057527e74136084dba4b9572f8e4f383e8bc24757e5b7c0f1c45fcf0308bc40cb43c41a47e18b7b4bc100a4ebe7d2bfd31fc526da97e4b202fe79ddce36ec2f00627d3b86c3fa66bcbf6ec036aef16e0c4f39b441abda436dd5e85adfdd0720a51c91106b737750335c2697", 0xdd}], 0x3) readv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000001980)=""/4089, 0x4000}], 0x59) getsockopt(0xffffffffffffffff, 0x1000, 0x7, &(0x7f0000000040)=""/2, &(0x7f0000000080)=0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./sys/class/udc/usbip-vudc.0/soft_connect\x00', 0x1, 0x0) write(r5, &(0x7f0000001800)='disconnect\n', 0xb) close(r5) nanosleep(&(0x7f0000001900)={0x0, 0x5f5e100}, 0x0) 1.190413336s ago: executing program 0 (id=2770): r0 = syz_open_dev$dri(&(0x7f0000000040), 0x3ffffffd, 0x240) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x89, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000780)={r3, 0xfffffffd, 0x1, 0x0, 0x2, [0x0, 0x0, 0x0], [0x0, 0x200000, 0x400, 0x5], [0x0, 0x6, 0xfffffffc], [0x0, 0x0, 0x2000000007]}) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x4e04, 0x3, @dev={0xfe, 0x80, '\x00', 0x25}, 0x23}, 0x1c) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000c00)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="90010000000101010000000000000000050000024ce30e8008000140000000010800034000000000080001400000000e08000340000000020800024000000002080002400000000008000140000000080800024000000000080001400000000806001240000200007000068008000200ac1414213c000380060001004e220000060002004e220000060001004e240000060002004e230000060002004e240000060002004e630000060002004e220000140005000000000000000000000000000000000014000500fe8000000000000000000000000000aa54001080080002400000000008000140000100010800014000000008080003400000000308000240000000030800014000000001080001400000000608000340000080000800014000000000080009000000000f280004802400018005000300430000000500020007000000060005000b0900000600020c0017000000000100000008180004801400038008000240000000070500010003000000100005800900010073797a3000000000"], 0x190}, 0x1, 0x0, 0x0, 0x4008000}, 0x800) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x3a, 0x0, &(0x7f0000000200)="e460cdfbef2408002900119386dd6a000000000711eb3014cd3ec8a755c1e1380081ffad000400e8d50000000100000bb500000500242c100806", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setgroups(0x0, 0x0) setsockopt$inet_mreqn(r7, 0x0, 0x27, &(0x7f0000000180)={@multicast2, @loopback}, 0xc) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0xc41, 0x0, 0x0, 0x1000, 0x7, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r9, 0x8914, &(0x7f0000000200)={'lo\x00', 0x2000}) setsockopt$inet_msfilter(r7, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e00000027f0007000000000002"], 0x18) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0xffffffd3}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r10, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r1, 0xe0, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYRES8=0x0, @ANYRESDEC=r5], &(0x7f00000007c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41000, 0x46, '\x00', r11}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="180000007c000000000000000000"], &(0x7f0000000500)='syzkaller\x00', 0x6, 0x0, 0x0, 0x40f00, 0x0, '\x00', r11, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x19, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x55}, 0x94) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000100)={r4}) 1.159442507s ago: executing program 0 (id=2771): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[], 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x5, 0xe, 0x0, &(0x7f0000000140)="259a00f271a76d1708fff74588a8", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0}, 0x50) mount$9p_virtio(&(0x7f0000000080), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1b, 0x0, 0x0, 0x8004, 0x0, r0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xd, &(0x7f00000004c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) fcntl$lock(r0, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r0, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x9, 0x9}) unshare(0xbd7a02a7dcac7ab6) r3 = socket$kcm(0x23, 0x5, 0x0) listen(r3, 0x800) listen(r3, 0x10000) fcntl$lock(r0, 0x7, &(0x7f0000000140)={0x1, 0x1, 0x25, 0x5}) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, &(0x7f0000000180)) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) syz_emit_ethernet(0x8e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa1acd1f78800d86dd608a37f200087300fe8000000000000000000020000000bbfe8000"/51], 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000200)={0x1ff, 0xf1, 0x5}) 770.265026ms ago: executing program 2 (id=2772): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r2, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x1, 0x6, 0x8000, 0x3, 0x5, 0x5, 0xb762, 0x4, 0x40007, 0x8, 0xf, 0x2, 0x80000001, 0x400, 0x1007fc, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xffffe4f5, 0xd6, 0x4, 0xfffb, 0x7, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x85, 0x9, 0xc, 0x20001000, 0x4, 0x2, 0x7, 0x4, 0x99, 0x9, 0x5, 0x6, 0x7, 0xfffffff7, 0x6d, 0x4000002, 0x9, 0x4d05, 0x1000044, 0x8, 0x8, 0x1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x400, 0x8, 0xfffffa72, 0xcd, 0x4, 0x80000000, 0xc, 0x4, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x8, 0x8, 0x7, 0x11, 0x1, 0x1, 0x7, 0x40, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0x3, 0x7fffffff, 0xff, 0x9, 0xa7, 0xf, 0x1, 0xffffffff, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0xfffd, 0x2, 0x6, 0x3ff, 0xf04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x6, 0x9, 0x3, 0xfffffffb, 0x1, 0x0, 0x3, 0x2, 0x5, 0x8, 0x3, 0x0, 0x800, 0xf06, 0x8, 0x7ff, 0x0, 0x9, 0x6, 0x5, 0x400001, 0x4d15, 0x1ff, 0x7, 0x3, 0x469, 0x3, 0x0, 0x5, 0x10000009, 0x7, 0x2, 0x8, 0x42ba, 0x4, 0x9, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0x40fff, 0x1ff, 0x8000, 0x3, 0x200, 0x80, 0x6, 0x9a6, 0xe4cb, 0x402, 0x1, 0x1ff, 0x5, 0x9b4, 0x1, 0x8, 0x0, 0x8, 0x0, 0xc, 0x0, 0x4, 0x6, 0x901, 0x5, 0x2, 0x7b, 0xfffffeff, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x10000068, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x4, 0x80000000, 0x4, 0x0, 0x7, 0x196, 0x2, 0x6, 0x4, 0xc, 0x8, 0xc9cd, 0x2, 0x9, 0x0, 0x200, 0x3, 0x9, 0xd, 0x2, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x4, 0x9, 0x3, 0x9, 0x0, 0x401, 0x3, 0x6, 0x33, 0x6, 0x8, 0x8001, 0x4, 0x6, 0x7, 0x5, 0xd, 0x2, 0x7, 0x1, 0x0, 0x3, 0x81, 0x3, 0x1ff, 0xfffffff5, 0x2, 0x5, 0x65e1, 0x10001, 0xc, 0x8001, 0xffffb5cd, 0xe, 0x3, 0x97, 0x7, 0xb, 0xffff6f3c, 0x1, 0x7ff, 0xb4, 0xf, 0x1, 0x3, 0xff, 0x7, 0x0, 0xee3, 0x43, 0x9, 0x1, 0x3, 0x1, 0x3796, 0x8, 0x6, 0xbe, 0x3, 0x45, 0xdd1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x4, 0x9da, 0x2, 0x6, 0xea6, 0x3, 0x5, 0x10, 0x3, 0xffffffff, 0x3fd, 0x96, 0x7, 0x2, 0x6, 0x9, 0x5, 0x5, 0x3, 0xd7da, 0x82, 0x7f, 0x9, 0x4, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x9, 0x5, 0x1ff, 0x4, 0x4, 0x1, 0x7, 0x7ff, 0xfffffffe, 0x0, 0xb, 0xfffffff7, 0x8, 0x101, 0xc57, 0x5, 0x2, 0xbb, 0x8, 0x0, 0xf, 0x1982, 0x1, 0x80000000, 0x1, 0x9, 0x6, 0x7ffc, 0x2, 0x1, 0x2, 0x2, 0x9, 0x5, 0xffffff1c, 0x6, 0x5, 0x7, 0x692, 0x92, 0x4, 0x0, 0x2, 0x9, 0x1b8f, 0x14, 0x65, 0xc00, 0x9, 0x9, 0x3, 0x8, 0x10004, 0x295, 0x6, 0xcb1, 0x1, 0xb7e, 0x10001, 0x8000002, 0xa, 0x6, 0x1, 0x2, 0x3ff, 0xfb7, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d4, 0x2, 0x7ffe, 0xec, 0xd, 0x5, 0x84d3, 0xfffffeff, 0x2, 0x7ff, 0x7fffffff, 0x80, 0x2, 0x90, 0x2, 0x6, 0x3, 0x70, 0x0, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0xfffffffe, 0xa4a, 0x7, 0x400, 0xc, 0xfffffff9, 0x8001, 0xc, 0x1, 0x9, 0xfff, 0x421, 0x3ff, 0x2, 0xd, 0xfb6, 0xc, 0xfffffffd, 0xac, 0x0, 0xa, 0x0, 0x6, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x9c}, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r0, 0x8982, &(0x7f0000000040)={0x8, 'veth0_virt_wifi\x00', {'pimreg0\x00'}, 0x9}) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0xf) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x250602, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000100)={{0x10000, 0x100000, 0x0, 0x1}, {0x0, 0x2000, 0xf, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x3, 0x5}, {0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x62, 0x0, 0x3, 0x0, 0x4}, {0x1000, 0xffff1000, 0xf, 0x0, 0x0, 0x0, 0x0, 0xfc}, {0x0, 0xffff1000, 0xc, 0x9, 0x3, 0x10, 0x0, 0x0, 0x1, 0x0, 0x4}, {0x8000000, 0x10000, 0xa, 0x0, 0x0, 0xfd}, {0x309000, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xb, 0x3a, 0x2}, {0x0, 0x3000, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {0x0, 0x480}, {}, 0xfdf8ffd7, 0x0, 0x8080000, 0x100, 0x8, 0x8000, 0x8080000, [0x0, 0x0, 0x2]}) ioctl$KVM_TRANSLATE(r5, 0xc018ae85, &(0x7f0000001280)={0x8000000, 0xdddd0000, 0x2, 0x1, 0x50}) 669.958595ms ago: executing program 2 (id=2773): bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x10, 0x8, &(0x7f0000000000)=ANY=[], 0x0, 0x8341, 0x0, 0x0, 0x0, 0x69, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000002f00090027bd00903f0007000b000500"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x20040004) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x6, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r2, 0x5, 0xe, 0x0, &(0x7f00000000c0)="469dc2d342e2b7000091000000000bcf48f3ac4e19a56ceb0b42c0", 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x22) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGKBTYPE(r3, 0x4b48, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x41100, 0x63, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f00000004c0), 0x800, 0x0) r6 = syz_open_dev$sg(&(0x7f0000000100), 0x4, 0x18000) ioctl$SG_SET_FORCE_PACK_ID(r6, 0x227b, &(0x7f0000000340)) ioctl$VT_RESIZEX(r3, 0x560a, &(0x7f0000000000)={0x3, 0x7, 0x400, 0xfffa, 0x0, 0x1}) r7 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r7, 0x42, 0x1ff) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) truncate(&(0x7f0000000180)='./file0\x00', 0x8fff5) r9 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r8, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)=[0x2004], 0x0, 0x0, 0x1, 0x1}}, 0x40) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000100)={r9, r8, 0x4, r8}, 0x10) ioctl$EVIOCGPROP(r5, 0x40047438, &(0x7f0000000180)=""/246) 569.379636ms ago: executing program 2 (id=2774): r0 = socket$l2tp(0x2, 0x2, 0x73) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000015c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001840)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_OCB(r1, &(0x7f0000001900)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r2, 0x1, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x80) (fail_nth: 8) 568.916557ms ago: executing program 2 (id=2775): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x20000810) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) r4 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_GET_MSRS_cpu(r6, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0x400000f3, 0x0, 0x80000000}]}) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', &(0x7f00000001c0)='./file0\x00') rename(&(0x7f0000000580)='./file0\x00', &(0x7f0000003040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00') mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x200000b) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xd, 0x4, 0x4, 0x5, 0x0, r7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 239.738311ms ago: executing program 0 (id=2776): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x58, 0xc, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x2c, 0x3, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_EXPR={0x20, 0x7, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x80000001}]}}}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 136.896022ms ago: executing program 2 (id=2777): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) get_mempolicy(0x0, 0x0, 0x2, &(0x7f0000240000/0x1000)=nil, 0x3) io_uring_setup(0xf06, &(0x7f00000003c0)={0x0, 0xefa9, 0x800, 0x43, 0x161}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x601c2, 0x0) ftruncate(r0, 0x8800000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtaction={0xe78, 0x30, 0x25, 0x0, 0x0, {}, [{0xe64, 0x1, [@m_pedit={0xe60, 0x1, 0x0, 0x0, {{0xa}, {0xe34, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x10, 0x5, 0x0, 0x1, [{0xc, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0xffff}]}]}, @TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x2}, [{}, {}, {0x0, 0x5, 0x0, 0x0, 0x0, 0xffffffff}, {0x0, 0x4}, {0x0, 0x0, 0x7}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, {0x0, 0x800}, {}, {}, {0x0, 0x0, 0x0, 0x200}, {}, {}, {}, {0x82}, {}, {0x2, 0x0, 0x0, 0x0, 0x0, 0x40000}, {0x0, 0x0, 0x0, 0x8000}, {0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, {}, {0x0, 0x0, 0xf}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0xfffffffd}, {}, {}, {0x0, 0x0, 0x2}, {0x0, 0x0, 0x6}, {0x0, 0x0, 0x0, 0x0, 0x80000000}, {0xffffffff}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x101}, {}, {}, {}, {}, {0x10, 0x0, 0x0, 0x3}, {0x0, 0x3}, {0x3ff}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {0xfffffffc}, {}, {}, {}, {0x0, 0xffffffff}, {0x0, 0x0, 0x400000}, {0x5}, {}, {}, {0x0, 0x0, 0x9, 0xfffffffd}, {}, {0x0, 0xb}, {}, {0x0, 0x0, 0x7}, {0x0, 0x2000000, 0x0, 0x0, 0xfffffffe}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {0x0, 0xc16}, {}, {}, {0x0, 0x0, 0x20000000}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {0x0, 0x0, 0x0, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, {}, {0x0, 0x0, 0x0, 0x400000}, {0x100}, {0x0, 0xfffffffc}, {}, {0x0, 0x0, 0x4, 0x0, 0x0, 0x70}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffff8}, {}, {0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x0, 0x0, 0xfffffffe}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {0x0, 0x7}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {0x5, 0x0, 0x0, 0x0, 0x800}, {}, {0x0, 0x0, 0x0, 0x6, 0xffff}, {0x8}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x7}, {}, {0x0, 0x8}, {}, {}, {}, {0x0, 0x0, 0x0, 0x8a}], [{}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {0x5, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {0x0, 0x1}, {}, {}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe78}}, 0x0) syz_clone3(0x0, 0x0) read$FUSE(r0, &(0x7f0000002f40)={0x2020}, 0xfffffd24) (fail_nth: 8) socket$nl_route(0x10, 0x3, 0x0) 173.396µs ago: executing program 0 (id=2778): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000001b00), 0x109000, 0x0) read$dsp(r0, &(0x7f0000001d40)=""/1, 0xfffffffffffffe06) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000240), 0x1eec42) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) setsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, 0x0, 0x0) r3 = socket$kcm(0x21, 0x2, 0xa) modify_ldt$write(0x1, 0x0, 0x0) mount(&(0x7f0000000080)=@loop={'/dev/loop', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='omfs\x00', 0x200001, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYRES32=r1, @ANYRES32=0x0, @ANYRESHEX=r2, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000009167fa0c00"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000b00)=ANY=[@ANYRESDEC=r4], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000500)=@rxrpc=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e24, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000780)=ANY=[], 0x10}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = syz_io_uring_setup(0x7bce, &(0x7f0000000580)={0x0, 0x4000bbdd, 0x20000, 0x2, 0x17d, 0x0, r0}, &(0x7f0000000180), &(0x7f0000000080), &(0x7f0000000140)) r6 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x8000000080000000) ioctl$BTRFS_IOC_START_SYNC(r7, 0x80089418, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r5, 0x21, &(0x7f0000000440), 0x1f) sendmsg$NL80211_CMD_DISASSOCIATE(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20006084}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) 0s ago: executing program 2 (id=2779): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='configfs\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mount(&(0x7f0000000400)=@filename='sysfs\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000200)='0x1234\n', 0xfffffffffffffc7e) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='0x5678\n', 0x7) rseq(&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x3}, 0x20, 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) r2 = openat(r0, &(0x7f0000000600)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_chmask\x00', 0x0, 0x128) write(r2, &(0x7f0000000700)='0\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r3, &(0x7f0000000900)='3\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g_uac2/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g_uac2/configs/c.1/uac2.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000001500)='./config/usb_gadget/g_uac2/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000001600)='usbip-vudc.0', 0xc) close(r4) writev(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f00000005c0)="c800b66cf7e6a5", 0xff57}, {&(0x7f0000000140)="e2b5de1b04c03054271995b320812ed7ded5ec71d0c57c5f11366f435a79a10e509bdfc4425719a03d2647f06c09e0a6dfc63acef45296e824c5c25945387c1840340d7203c4bc7f6228a7b0388ba698f8e8bb15ee5762f41d1f8953e00ef286a2426181912541e43bb71a016fd7cffaccd2cf79da80b0c67a87e82dfa52ac31dac584f37ebe1a25c62d9b55b678598cf69428a806b8fc096bb97053e0099600d4bc78e717b612c96807e519cb7300"/188, 0xbc}, {&(0x7f0000000300)="1c7e6b9e688e6270cf440480946456f950e37af773e53874c663dd2a336df10d2d1187d48719ed7fd17ca09b6bdaa49710183eb991f93aef84adb0a2dad9bb05b690e65758d5c66e64d6fdd07ce5771e98a47f7756a093c6e8b0fbf8cb95f4f6df7f227ef95f7f5f56b2e239c2e17453daf057527e74136084dba4b9572f8e4f383e8bc24757e5b7c0f1c45fcf0308bc40cb43c41a47e18b7b4bc100a4ebe7d2bfd31fc526da97e4b202fe79ddce36ec2f00627d3b86c3fa66bcbf6ec036aef16e0c4f39b441abda436dd5e85adfdd0720a51c91106b737750335c2697", 0xdd}], 0x3) readv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000001980)=""/4089, 0x4000}], 0x59) getsockopt(0xffffffffffffffff, 0x1000, 0x7, &(0x7f0000000040)=""/2, &(0x7f0000000080)=0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./sys/class/udc/usbip-vudc.0/soft_connect\x00', 0x1, 0x0) write(r5, &(0x7f0000001800)='disconnect\n', 0xb) close(r5) nanosleep(&(0x7f0000001900)={0x0, 0x5f5e100}, 0x0) kernel console output (not intermixed with test programs): should_failslab+0xc2/0x120 [ 543.993044][T14638] kmem_cache_alloc_noprof+0x91/0x6a0 [ 543.993065][T14638] ? skb_clone+0x190/0x400 [ 543.993082][T14638] skb_clone+0x190/0x400 [ 543.993097][T14638] netlink_deliver_tap+0xaed/0xcc0 [ 543.993112][T14638] netlink_unicast+0x62b/0x850 [ 543.993126][T14638] ? __pfx_netlink_unicast+0x10/0x10 [ 543.993142][T14638] netlink_sendmsg+0x8b0/0xda0 [ 543.993156][T14638] ? __pfx_netlink_sendmsg+0x10/0x10 [ 543.993170][T14638] ? apparmor_socket_sendmsg+0x15b/0x270 [ 543.993184][T14638] ____sys_sendmsg+0xa4d/0xbe0 [ 543.993195][T14638] ? __pfx_netlink_sendmsg+0x10/0x10 [ 543.993208][T14638] ? __pfx_____sys_sendmsg+0x10/0x10 [ 543.993225][T14638] ___sys_sendmsg+0x190/0x1e0 [ 543.993238][T14638] ? __pfx____sys_sendmsg+0x10/0x10 [ 543.993256][T14638] ? find_held_lock+0x2b/0x80 [ 543.993279][T14638] __sys_sendmsg+0x160/0x210 [ 543.993294][T14638] ? __pfx___sys_sendmsg+0x10/0x10 [ 543.993313][T14638] ? __pfx_ksys_write+0x10/0x10 [ 543.993326][T14638] __do_fast_syscall_32+0xe7/0x970 [ 543.993340][T14638] ? lockdep_hardirqs_on+0x78/0x100 [ 543.993354][T14638] do_fast_syscall_32+0x32/0x70 [ 543.993368][T14638] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 543.993383][T14638] RIP: 0023:0xf705efec [ 543.993395][T14638] Code: Unable to access opcode bytes at 0xf705efc2. [ 543.993400][T14638] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 543.993411][T14638] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080009b40 [ 543.993418][T14638] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 543.993424][T14638] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 543.993431][T14638] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 543.993437][T14638] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 543.993450][T14638] [ 544.054094][ T50] usb 5-1: Using ep0 maxpacket: 8 [ 544.086902][ T50] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 544.091105][ T50] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 544.098433][ T50] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 544.102360][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 544.105790][ T50] usb 5-1: Product: syz [ 544.107613][ T50] usb 5-1: Manufacturer: syz [ 544.109552][ T50] usb 5-1: SerialNumber: syz [ 544.118673][ T50] usb 5-1: No union descriptors [ 544.122082][ T50] usbtest 5-1:1.0: couldn't get endpoints, -22 [ 544.125299][ T50] usbtest 5-1:1.0: probe with driver usbtest failed with error -22 [ 544.318329][T14628] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 544.322740][T14628] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 545.334047][ T50] usb 7-1: new high-speed USB device number 57 using dummy_hcd [ 545.486459][ T50] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 545.490553][ T50] usb 7-1: config 0 has no interfaces? [ 545.492932][ T50] usb 7-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 545.496749][ T50] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 545.504771][ T50] usb 7-1: config 0 descriptor?? [ 545.571775][ T29] usb 6-1: USB disconnect, device number 58 [ 545.737438][T14666] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 545.874178][ T5765] Bluetooth: hci3: command tx timeout [ 546.633472][T14676] FAULT_INJECTION: forcing a failure. [ 546.633472][T14676] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 546.638032][T14676] CPU: 1 UID: 0 PID: 14676 Comm: syz.1.2429 Tainted: G L syzkaller #0 PREEMPT(full) [ 546.638052][T14676] Tainted: [L]=SOFTLOCKUP [ 546.638056][T14676] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 546.638063][T14676] Call Trace: [ 546.638067][T14676] [ 546.638072][T14676] dump_stack_lvl+0x100/0x190 [ 546.638100][T14676] should_fail_ex.cold+0x5/0xa [ 546.638115][T14676] _copy_to_user+0x32/0xd0 [ 546.638133][T14676] bpf_prog_get_info_by_fd+0x1962/0x2ed0 [ 546.638157][T14676] ? __pfx_bpf_prog_get_info_by_fd+0x10/0x10 [ 546.638176][T14676] ? __lock_acquire+0x49f/0x1a40 [ 546.638202][T14676] ? __fget_files+0x21f/0x3d0 [ 546.638216][T14676] __sys_bpf+0x3d56/0x4e80 [ 546.638232][T14676] ? __pfx___sys_bpf+0x10/0x10 [ 546.638244][T14676] ? find_held_lock+0x2b/0x80 [ 546.638257][T14676] ? get_pid_task+0xfc/0x250 [ 546.638270][T14676] ? get_pid_task+0xfc/0x250 [ 546.638287][T14676] ? proc_fail_nth_write+0x9f/0x220 [ 546.638303][T14676] ? find_held_lock+0x2b/0x80 [ 546.638319][T14676] ? rcu_read_lock_any_held+0x6a/0xa0 [ 546.638333][T14676] ? find_held_lock+0x2b/0x80 [ 546.638345][T14676] ? ksys_write+0x190/0x250 [ 546.638355][T14676] ? ksys_write+0x190/0x250 [ 546.638375][T14676] ? fput+0x79/0x100 [ 546.638389][T14676] ? __ia32_sys_bpf+0xcc/0x170 [ 546.638400][T14676] __ia32_sys_bpf+0xcc/0x170 [ 546.638412][T14676] ? __do_fast_syscall_32+0x98/0x970 [ 546.638427][T14676] __do_fast_syscall_32+0xe7/0x970 [ 546.638441][T14676] ? lockdep_hardirqs_on+0x78/0x100 [ 546.638460][T14676] do_fast_syscall_32+0x32/0x70 [ 546.638474][T14676] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 546.638488][T14676] RIP: 0023:0xf7f02fec [ 546.638502][T14676] Code: Unable to access opcode bytes at 0xf7f02fc2. [ 546.638507][T14676] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 546.638518][T14676] RAX: ffffffffffffffda RBX: 000000000000000f RCX: 0000000080000280 [ 546.638525][T14676] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 546.638532][T14676] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 546.638538][T14676] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 546.638544][T14676] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 546.638558][T14676] [ 546.672748][ T34] usb 5-1: USB disconnect, device number 65 [ 546.735120][T14678] can0: slcan on ttyS3. [ 546.815301][T14678] can0 (unregistered): slcan off ttyS3. [ 546.821474][T14678] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2430'. [ 546.827395][T14678] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2430'. [ 546.851229][T14682] can0: slcan on ttyS3. [ 546.936843][T14678] can0 (unregistered): slcan off ttyS3. [ 547.083261][ T41] kauditd_printk_skb: 2 callbacks suppressed [ 547.083276][ T41] audit: type=1326 audit(2000000186.713:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14679 comm="syz.0.2431" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 547.115630][ T41] audit: type=1326 audit(2000000186.713:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14679 comm="syz.0.2431" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 547.125631][ T41] audit: type=1326 audit(2000000186.743:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14679 comm="syz.0.2431" exe="/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf709efec code=0x7ffc0000 [ 547.134971][ T41] audit: type=1326 audit(2000000186.743:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14679 comm="syz.0.2431" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 547.150290][ T41] audit: type=1326 audit(2000000186.743:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14679 comm="syz.0.2431" exe="/syz-executor" sig=0 arch=40000003 syscall=358 compat=1 ip=0xf709efec code=0x7ffc0000 [ 547.166424][ T41] audit: type=1326 audit(2000000186.743:123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14679 comm="syz.0.2431" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 547.167845][T14702] netlink: 'syz.3.2433': attribute type 1 has an invalid length. [ 547.178355][T14702] netlink: 756 bytes leftover after parsing attributes in process `syz.3.2433'. [ 547.180234][ T41] audit: type=1326 audit(2000000186.743:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14679 comm="syz.0.2431" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf709efec code=0x7ffc0000 [ 547.192012][ T41] audit: type=1326 audit(2000000186.743:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14679 comm="syz.0.2431" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 547.201703][ T41] audit: type=1326 audit(2000000186.783:126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14679 comm="syz.0.2431" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 547.213805][ T41] audit: type=1326 audit(2000000186.783:127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14679 comm="syz.0.2431" exe="/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf709efec code=0x7ffc0000 [ 547.351275][T14707] FAULT_INJECTION: forcing a failure. [ 547.351275][T14707] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 547.357544][T14707] CPU: 3 UID: 0 PID: 14707 Comm: syz.1.2434 Tainted: G L syzkaller #0 PREEMPT(full) [ 547.357571][T14707] Tainted: [L]=SOFTLOCKUP [ 547.357577][T14707] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 547.357588][T14707] Call Trace: [ 547.357595][T14707] [ 547.357602][T14707] dump_stack_lvl+0x100/0x190 [ 547.357627][T14707] should_fail_ex.cold+0x5/0xa [ 547.357648][T14707] _copy_to_user+0x32/0xd0 [ 547.357677][T14707] simple_read_from_buffer+0xcb/0x170 [ 547.357707][T14707] proc_fail_nth_read+0x1af/0x230 [ 547.357732][T14707] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 547.357757][T14707] ? rw_verify_area+0xce/0x6d0 [ 547.357783][T14707] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 547.357806][T14707] vfs_read+0x1e4/0xb40 [ 547.357825][T14707] ? __pfx_vfs_read+0x10/0x10 [ 547.357850][T14707] ? find_held_lock+0x2b/0x80 [ 547.357874][T14707] ? __fget_files+0x215/0x3d0 [ 547.357894][T14707] ? __fget_files+0x21f/0x3d0 [ 547.357916][T14707] ksys_read+0x12a/0x250 [ 547.357931][T14707] ? __pfx_ksys_read+0x10/0x10 [ 547.357955][T14707] do_int80_emulation+0x14b/0x720 [ 547.357981][T14707] asm_int80_emulation+0x1a/0x20 [ 547.357998][T14707] RIP: 0023:0xf71072eb [ 547.358012][T14707] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 547.358029][T14707] RSP: 002b:00000000f53a54bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 547.358046][T14707] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f53a55d0 [ 547.358057][T14707] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 547.358067][T14707] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 547.358077][T14707] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 547.358087][T14707] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 547.358111][T14707] [ 547.621635][T14711] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2436'. [ 547.831548][T14722] FAULT_INJECTION: forcing a failure. [ 547.831548][T14722] name failslab, interval 1, probability 0, space 0, times 0 [ 547.836562][T14722] CPU: 3 UID: 0 PID: 14722 Comm: syz.0.2440 Tainted: G L syzkaller #0 PREEMPT(full) [ 547.836581][T14722] Tainted: [L]=SOFTLOCKUP [ 547.836585][T14722] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 547.836592][T14722] Call Trace: [ 547.836597][T14722] [ 547.836601][T14722] dump_stack_lvl+0x100/0x190 [ 547.836617][T14722] should_fail_ex.cold+0x5/0xa [ 547.836630][T14722] should_failslab+0xc2/0x120 [ 547.836646][T14722] __kmalloc_noprof+0xfc/0x820 [ 547.836659][T14722] ? trace_kmalloc+0xeb/0x110 [ 547.836674][T14722] ? lsm_blob_alloc+0x68/0x90 [ 547.836693][T14722] lsm_blob_alloc+0x68/0x90 [ 547.836721][T14722] security_sk_alloc+0x2d/0x290 [ 547.836736][T14722] sk_prot_alloc+0x12a/0x2a0 [ 547.836748][T14722] sk_alloc+0x36/0xe80 [ 547.836762][T14722] bpf_prog_test_run_skb+0x4db/0x3540 [ 547.836778][T14722] ? find_held_lock+0x2b/0x80 [ 547.836793][T14722] ? __fget_files+0x171/0x3d0 [ 547.836807][T14722] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 547.836820][T14722] ? fput+0x79/0x100 [ 547.836834][T14722] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 547.836846][T14722] __sys_bpf+0x2a12/0x4e80 [ 547.836862][T14722] ? __pfx___sys_bpf+0x10/0x10 [ 547.836874][T14722] ? find_held_lock+0x2b/0x80 [ 547.836887][T14722] ? get_pid_task+0xfc/0x250 [ 547.836900][T14722] ? get_pid_task+0xfc/0x250 [ 547.836918][T14722] ? proc_fail_nth_write+0x9f/0x220 [ 547.836933][T14722] ? find_held_lock+0x2b/0x80 [ 547.836949][T14722] ? rcu_read_lock_any_held+0x6a/0xa0 [ 547.836963][T14722] ? find_held_lock+0x2b/0x80 [ 547.836976][T14722] ? ksys_write+0x190/0x250 [ 547.836986][T14722] ? ksys_write+0x190/0x250 [ 547.837006][T14722] ? fput+0x79/0x100 [ 547.837019][T14722] ? __ia32_sys_bpf+0xcc/0x170 [ 547.837030][T14722] __ia32_sys_bpf+0xcc/0x170 [ 547.837043][T14722] ? __do_fast_syscall_32+0x98/0x970 [ 547.837058][T14722] __do_fast_syscall_32+0xe7/0x970 [ 547.837072][T14722] ? lockdep_hardirqs_on+0x78/0x100 [ 547.837085][T14722] do_fast_syscall_32+0x32/0x70 [ 547.837100][T14722] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 547.837113][T14722] RIP: 0023:0xf709efec [ 547.837127][T14722] Code: Unable to access opcode bytes at 0xf709efc2. [ 547.837132][T14722] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 547.837143][T14722] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000000 [ 547.837150][T14722] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 547.837156][T14722] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 547.837162][T14722] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 547.837168][T14722] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 547.837182][T14722] [ 547.955282][ T5765] Bluetooth: hci3: command tx timeout [ 548.102337][ T9408] usb 7-1: USB disconnect, device number 57 [ 548.149752][T14729] udc usbip-vudc.0: UDC had already stopped [ 548.647328][T14741] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2446'. [ 548.692590][T14743] FAULT_INJECTION: forcing a failure. [ 548.692590][T14743] name failslab, interval 1, probability 0, space 0, times 0 [ 548.698516][T14743] CPU: 3 UID: 0 PID: 14743 Comm: syz.3.2447 Tainted: G L syzkaller #0 PREEMPT(full) [ 548.698544][T14743] Tainted: [L]=SOFTLOCKUP [ 548.698550][T14743] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 548.698559][T14743] Call Trace: [ 548.698565][T14743] [ 548.698572][T14743] dump_stack_lvl+0x100/0x190 [ 548.698597][T14743] should_fail_ex.cold+0x5/0xa [ 548.698614][T14743] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 548.698634][T14743] should_failslab+0xc2/0x120 [ 548.698658][T14743] kmem_cache_alloc_noprof+0x91/0x6a0 [ 548.698681][T14743] ? skb_clone+0x190/0x400 [ 548.698709][T14743] skb_clone+0x190/0x400 [ 548.698733][T14743] netlink_deliver_tap+0xaed/0xcc0 [ 548.698757][T14743] netlink_unicast+0x62b/0x850 [ 548.698779][T14743] ? __pfx_netlink_unicast+0x10/0x10 [ 548.698805][T14743] netlink_sendmsg+0x8b0/0xda0 [ 548.698828][T14743] ? __pfx_netlink_sendmsg+0x10/0x10 [ 548.698850][T14743] ? apparmor_socket_sendmsg+0x15b/0x270 [ 548.698875][T14743] ____sys_sendmsg+0xa4d/0xbe0 [ 548.698907][T14743] ? __pfx_netlink_sendmsg+0x10/0x10 [ 548.698927][T14743] ? __pfx_____sys_sendmsg+0x10/0x10 [ 548.698944][T14743] ___sys_sendmsg+0x190/0x1e0 [ 548.698957][T14743] ? __pfx____sys_sendmsg+0x10/0x10 [ 548.698976][T14743] ? find_held_lock+0x2b/0x80 [ 548.698998][T14743] __sys_sendmsg+0x160/0x210 [ 548.699014][T14743] ? __pfx___sys_sendmsg+0x10/0x10 [ 548.699032][T14743] ? __pfx_ksys_write+0x10/0x10 [ 548.699046][T14743] __do_fast_syscall_32+0xe7/0x970 [ 548.699061][T14743] ? lockdep_hardirqs_on+0x78/0x100 [ 548.699075][T14743] do_fast_syscall_32+0x32/0x70 [ 548.699089][T14743] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 548.699104][T14743] RIP: 0023:0xf7f47fec [ 548.699118][T14743] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 548.699123][T14743] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 548.699134][T14743] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800001c0 [ 548.699141][T14743] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 548.699147][T14743] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 548.699153][T14743] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 548.699160][T14743] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 548.699173][T14743] [ 548.699241][T14743] netlink: 'syz.3.2447': attribute type 1 has an invalid length. [ 549.083340][T14748] syzkaller1: entered promiscuous mode [ 549.089181][T14748] syzkaller1: entered allmulticast mode [ 549.143062][T14748] 9p: Bad value for 'rfdno' [ 549.216750][T14750] syzkaller1: entered promiscuous mode [ 549.219028][T14750] syzkaller1: entered allmulticast mode [ 549.233398][T14750] syzkaller0: entered promiscuous mode [ 549.234321][ T9408] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 549.235908][T14750] syzkaller0: entered allmulticast mode [ 549.384180][ T9408] usb 6-1: Using ep0 maxpacket: 32 [ 549.402688][ T9408] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 549.407940][ T9408] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 549.412384][ T9408] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 549.425971][ T9408] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 549.429814][ T9408] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 549.470115][ T9408] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 549.496669][ T9408] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 549.509932][ T9408] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 549.537448][ T9408] usb 6-1: config 0 descriptor?? [ 549.694055][ T5753] usb 8-1: new high-speed USB device number 37 using dummy_hcd [ 549.846151][ T5753] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 549.852358][ T5753] usb 8-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 549.856866][ T5753] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.860342][ T5753] usb 8-1: Product: syz [ 549.862213][ T5753] usb 8-1: Manufacturer: syz [ 549.864651][ T5753] usb 8-1: SerialNumber: syz [ 549.880461][ T5753] usb 8-1: config 0 descriptor?? [ 549.896628][ T9408] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 59 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 550.019990][T14764] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2455'. [ 550.144443][ T5753] usb 8-1: USB disconnect, device number 37 [ 550.617048][T14775] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2459'. [ 550.758045][T14780] lo speed is unknown, defaulting to 1000 [ 550.762493][ T9408] usb 6-1: USB disconnect, device number 59 [ 550.767640][ T9408] usblp0: removed [ 550.989730][T14787] FAULT_INJECTION: forcing a failure. [ 550.989730][T14787] name failslab, interval 1, probability 0, space 0, times 0 [ 550.996174][T14785] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2461'. [ 550.999269][T14787] CPU: 2 UID: 0 PID: 14787 Comm: syz.2.2462 Tainted: G L syzkaller #0 PREEMPT(full) [ 550.999295][T14787] Tainted: [L]=SOFTLOCKUP [ 550.999301][T14787] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 550.999311][T14787] Call Trace: [ 550.999318][T14787] [ 550.999326][T14787] dump_stack_lvl+0x100/0x190 [ 550.999350][T14787] should_fail_ex.cold+0x5/0xa [ 550.999370][T14787] should_failslab+0xc2/0x120 [ 550.999393][T14787] __kmalloc_cache_noprof+0x91/0x6c0 [ 550.999413][T14787] ? __request_region+0x5c/0xf0 [ 550.999447][T14787] __request_region+0x5c/0xf0 [ 550.999471][T14787] __comedi_check_request_region+0xfb/0x130 [ 550.999495][T14787] comedi_check_request_region+0x3c/0xc0 [ 550.999515][T14787] pcl812_attach+0xe0/0x2300 [ 550.999534][T14787] ? lockdep_init_map_type+0x5c/0x250 [ 550.999556][T14787] comedi_device_attach+0x40e/0x6b0 [ 550.999581][T14787] do_devconfig_ioctl+0x1b3/0x6d0 [ 550.999603][T14787] ? comedi_unlocked_ioctl+0x180/0x3310 [ 550.999629][T14787] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 550.999663][T14787] ? tomoyo_path_number_perm+0x46d/0x580 [ 550.999706][T14787] ? kasan_save_stack+0x3f/0x50 [ 550.999727][T14787] ? kasan_save_stack+0x30/0x50 [ 550.999760][T14787] ? kasan_save_track+0x14/0x30 [ 550.999780][T14787] ? kasan_save_free_info+0x3b/0x70 [ 550.999801][T14787] comedi_unlocked_ioctl+0x860/0x3310 [ 550.999833][T14787] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 550.999875][T14787] ? kasan_quarantine_put+0x104/0x240 [ 550.999895][T14787] ? lockdep_hardirqs_on+0x78/0x100 [ 550.999917][T14787] ? find_held_lock+0x2b/0x80 [ 550.999936][T14787] ? tomoyo_path_number_perm+0x28f/0x580 [ 550.999957][T14787] ? tomoyo_path_number_perm+0x28f/0x580 [ 550.999982][T14787] ? tomoyo_path_number_perm+0x188/0x580 [ 551.000008][T14787] comedi_compat_ioctl+0x438/0xe20 [ 551.000035][T14787] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 551.000061][T14787] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 551.000086][T14787] ? do_vfs_ioctl+0x226/0x13e0 [ 551.000109][T14787] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 551.000138][T14787] ? find_held_lock+0x2b/0x80 [ 551.000157][T14787] ? __fget_files+0x215/0x3d0 [ 551.000172][T14787] ? hook_file_ioctl_common+0x140/0x440 [ 551.000199][T14787] ? __fget_files+0x21f/0x3d0 [ 551.000219][T14787] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 551.000244][T14787] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 551.000270][T14787] __do_fast_syscall_32+0xe7/0x970 [ 551.000291][T14787] ? lockdep_hardirqs_on+0x78/0x100 [ 551.000314][T14787] do_fast_syscall_32+0x32/0x70 [ 551.000334][T14787] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 551.000354][T14787] RIP: 0023:0xf705efec [ 551.000375][T14787] Code: Unable to access opcode bytes at 0xf705efc2. [ 551.000382][T14787] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 551.000398][T14787] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040946400 [ 551.000409][T14787] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 551.000419][T14787] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 551.000428][T14787] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 551.000444][T14787] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 551.000466][T14787] [ 551.001372][T14787] comedi comedi2: pcl812: I/O port conflict (0x140,16) [ 551.400218][T14793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2465'. [ 551.420406][T14793] bridge0: port 2(bridge_slave_1) entered disabled state [ 551.426255][T14793] bridge0: port 1(bridge_slave_0) entered disabled state [ 551.505357][ T29] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 551.610063][T14812] openvswitch: netlink: Flow key attr not present in new flow. [ 551.674273][ T29] usb 5-1: Using ep0 maxpacket: 32 [ 551.678929][T14815] udc usbip-vudc.0: UDC had already stopped [ 551.701554][ T29] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 551.710271][ T29] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 551.719494][ T29] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 551.729783][ T29] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 551.739952][ T29] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 551.760915][ T29] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 551.787543][ T29] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 551.810072][ T29] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 551.854426][ T29] usb 5-1: config 0 descriptor?? [ 551.857169][T14819] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2475'. [ 552.125865][ T29] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 66 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 552.214228][ T34] usb 7-1: new high-speed USB device number 58 using dummy_hcd [ 552.364261][ T34] usb 7-1: Using ep0 maxpacket: 32 [ 552.371764][ T34] usb 7-1: config index 0 descriptor too short (expected 29220, got 36) [ 552.377511][ T34] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 552.381501][ T34] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 552.386598][ T34] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 552.390610][ T34] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 552.398454][ T34] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 552.403330][ T34] usb 7-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 552.416591][ T34] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 552.514356][ T34] usb 7-1: config 0 descriptor?? [ 552.795031][ T34] usblp 7-1:0.0: usblp1: USB Bidirectional printer dev 58 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 553.475688][T13125] usb 5-1: USB disconnect, device number 66 [ 553.480948][T13125] usblp0: removed [ 553.557845][ T50] usb 7-1: USB disconnect, device number 58 [ 553.563284][ T50] usblp1: removed [ 553.593887][T14829] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2477'. [ 553.676982][T14832] lo speed is unknown, defaulting to 1000 [ 553.853238][T14841] udc usbip-vudc.0: UDC had already stopped [ 553.855301][T14843] comedi comedi3: rti802: I/O base address not correctly aligned [ 554.193315][T14856] smpboot: CPU 1 is now offline [ 554.226582][T14860] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2486'. [ 554.264652][T14852] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2486'. [ 554.412294][T14870] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2491'. [ 554.482278][T14874] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2494'. [ 554.493781][T14874] netlink: 'syz.0.2494': attribute type 8 has an invalid length. [ 554.508254][T14874] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2494'. [ 554.884968][ T50] usb 7-1: new high-speed USB device number 59 using dummy_hcd [ 554.991295][T14850] syz.1.2484 (14850): drop_caches: 3 [ 555.094095][ T50] usb 7-1: Using ep0 maxpacket: 32 [ 555.150387][ T50] usb 7-1: config index 0 descriptor too short (expected 29220, got 36) [ 555.164726][T14881] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2497'. [ 555.177311][T14881] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2497'. [ 555.193538][ T50] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 555.226875][ T50] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 555.267763][ T50] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 555.308052][ T50] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 555.352552][ T50] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 555.404928][T13125] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 555.446218][ T50] usb 7-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 555.494993][ T50] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 555.555497][T13125] usb 6-1: device descriptor read/64, error -71 [ 555.579983][T14896] FAULT_INJECTION: forcing a failure. [ 555.579983][T14896] name failslab, interval 1, probability 0, space 0, times 0 [ 555.594214][T14896] CPU: 0 UID: 0 PID: 14896 Comm: syz.0.2496 Tainted: G L syzkaller #0 PREEMPT(full) [ 555.594235][T14896] Tainted: [L]=SOFTLOCKUP [ 555.594239][T14896] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 555.594247][T14896] Call Trace: [ 555.594251][T14896] [ 555.594256][T14896] dump_stack_lvl+0x100/0x190 [ 555.594273][T14896] should_fail_ex.cold+0x5/0xa [ 555.594286][T14896] should_failslab+0xc2/0x120 [ 555.594302][T14896] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 555.594316][T14896] ? register_lock_class+0x40/0x560 [ 555.594334][T14896] ? __d_alloc+0x35/0xa50 [ 555.594349][T14896] __d_alloc+0x35/0xa50 [ 555.594360][T14896] ? __lock_acquire+0x49f/0x1a40 [ 555.594378][T14896] d_alloc_parallel+0x105/0x14b0 [ 555.594399][T14896] ? __pfx_d_alloc_parallel+0x10/0x10 [ 555.594415][T14896] ? __d_lookup+0x25c/0x4a0 [ 555.594432][T14896] ? __d_lookup+0x266/0x4a0 [ 555.594450][T14896] path_openat+0x271c/0x4280 [ 555.594469][T14896] ? __pfx_path_openat+0x10/0x10 [ 555.594485][T14896] do_file_open+0x20e/0x430 [ 555.594495][T14896] ? __lock_acquire+0x49f/0x1a40 [ 555.594512][T14896] ? __pfx_do_file_open+0x10/0x10 [ 555.594534][T14896] ? _raw_spin_unlock+0x28/0x50 [ 555.594551][T14896] ? alloc_fd+0x471/0x7a0 [ 555.594566][T14896] do_sys_openat2+0x10f/0x1e0 [ 555.594580][T14896] ? __pfx_do_sys_openat2+0x10/0x10 [ 555.594599][T14896] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 555.594623][T14896] __ia32_compat_sys_openat+0x12d/0x210 [ 555.594646][T14896] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 555.594665][T14896] ? fput+0x79/0x100 [ 555.594677][T14896] ? ksys_write+0x1ac/0x250 [ 555.594687][T14896] ? __pfx_ksys_write+0x10/0x10 [ 555.594700][T14896] __do_fast_syscall_32+0xe7/0x970 [ 555.594714][T14896] ? lockdep_hardirqs_on+0x78/0x100 [ 555.594729][T14896] do_fast_syscall_32+0x32/0x70 [ 555.594743][T14896] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 555.594758][T14896] RIP: 0023:0xf709efec [ 555.594773][T14896] Code: Unable to access opcode bytes at 0xf709efc2. [ 555.594778][T14896] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 555.594789][T14896] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000080 [ 555.594796][T14896] RDX: 000000000000275a RSI: 0000000000000000 RDI: 0000000000000000 [ 555.594802][T14896] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 555.594809][T14896] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 555.594815][T14896] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 555.594828][T14896] [ 555.608771][ T50] usb 7-1: config 0 descriptor?? [ 555.792717][T14901] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2500'. [ 555.804012][T13125] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 555.934010][T13125] usb 6-1: device descriptor read/64, error -71 [ 556.044210][T13125] usb usb6-port1: attempt power cycle [ 556.249416][ T50] usblp 7-1:0.0: usblp0: USB Bidirectional printer dev 59 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 556.384023][T13125] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 556.414489][T13125] usb 6-1: device descriptor read/8, error -71 [ 556.441662][ T9408] usb 7-1: USB disconnect, device number 59 [ 556.453088][ T9408] usblp0: removed [ 556.662771][T14912] FAULT_INJECTION: forcing a failure. [ 556.662771][T14912] name failslab, interval 1, probability 0, space 0, times 0 [ 556.666941][T13125] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 556.669257][T14912] CPU: 0 UID: 0 PID: 14912 Comm: syz.0.2504 Tainted: G L syzkaller #0 PREEMPT(full) [ 556.669274][T14912] Tainted: [L]=SOFTLOCKUP [ 556.669277][T14912] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 556.669284][T14912] Call Trace: [ 556.669289][T14912] [ 556.669293][T14912] dump_stack_lvl+0x100/0x190 [ 556.669309][T14912] should_fail_ex.cold+0x5/0xa [ 556.669322][T14912] should_failslab+0xc2/0x120 [ 556.669337][T14912] __kmalloc_noprof+0xfc/0x820 [ 556.669351][T14912] ? rcu_is_watching+0x12/0xc0 [ 556.669364][T14912] ? tomoyo_realpath_from_path+0xb6/0x690 [ 556.669383][T14912] tomoyo_realpath_from_path+0xb6/0x690 [ 556.669403][T14912] tomoyo_path_number_perm+0x23c/0x580 [ 556.669417][T14912] ? tomoyo_path_number_perm+0x22e/0x580 [ 556.669432][T14912] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 556.669446][T14912] ? get_pid_task+0x106/0x250 [ 556.669477][T14912] ? find_held_lock+0x2b/0x80 [ 556.669490][T14912] ? __fget_files+0x215/0x3d0 [ 556.669500][T14912] ? hook_file_ioctl_common+0x140/0x440 [ 556.669514][T14912] ? __fget_files+0x215/0x3d0 [ 556.669526][T14912] ? __fget_files+0x21f/0x3d0 [ 556.669539][T14912] security_file_ioctl_compat+0xd3/0x230 [ 556.669554][T14912] __ia32_compat_sys_ioctl+0xc2/0x360 [ 556.669572][T14912] __do_fast_syscall_32+0xe7/0x970 [ 556.669598][T14912] ? lockdep_hardirqs_on+0x78/0x100 [ 556.669613][T14912] do_fast_syscall_32+0x32/0x70 [ 556.669627][T14912] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 556.669641][T14912] RIP: 0023:0xf709efec [ 556.669654][T14912] Code: Unable to access opcode bytes at 0xf709efc2. [ 556.669660][T14912] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 556.669671][T14912] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000403c6f2b [ 556.669677][T14912] RDX: 0000000080000280 RSI: 0000000000000000 RDI: 0000000000000000 [ 556.669684][T14912] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 556.669690][T14912] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 556.669697][T14912] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 556.669710][T14912] [ 556.669715][T14912] ERROR: Out of memory at tomoyo_realpath_from_path. [ 556.764514][T13125] usb 6-1: device descriptor read/8, error -71 [ 556.874625][T13125] usb usb6-port1: unable to enumerate USB device [ 557.135041][T14922] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2508'. [ 557.174029][ T34] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 557.291620][ T65] block nbd2: Receive control failed (result -107) [ 557.344621][ T34] usb 5-1: Using ep0 maxpacket: 8 [ 557.349204][ T34] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 557.352350][ T34] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 557.358499][ T34] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 557.361367][ T34] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 557.363828][ T34] usb 5-1: Product: syz [ 557.365332][ T34] usb 5-1: Manufacturer: syz [ 557.366934][ T34] usb 5-1: SerialNumber: syz [ 557.373696][ T34] usb 5-1: No union descriptors [ 557.376671][ T34] usbtest 5-1:1.0: couldn't get endpoints, -22 [ 557.378822][ T34] usbtest 5-1:1.0: probe with driver usbtest failed with error -22 [ 557.582253][T14920] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 557.587358][T14920] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.075612][T14924] block nbd2: shutting down sockets [ 558.495768][T14941] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 558.497704][T14941] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 558.500624][T14941] vhci_hcd vhci_hcd.0: Device attached [ 558.764049][ T34] usb 42-1: SetAddress Request (6) to port 0 [ 558.767540][ T34] usb 42-1: new SuperSpeed USB device number 6 using vhci_hcd [ 559.058976][ T9408] usb 5-1: USB disconnect, device number 67 [ 559.061820][T14942] vhci_hcd: connection reset by peer [ 559.076640][T14061] vhci_hcd vhci_hcd.2: stop threads [ 559.078775][T14061] vhci_hcd vhci_hcd.2: release socket [ 559.081442][T14061] vhci_hcd vhci_hcd.2: disconnect device [ 559.474054][ T5114] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 559.654006][ T5114] usb 6-1: Using ep0 maxpacket: 32 [ 559.683908][ T5114] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 559.711722][ T5114] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 559.742896][ T5114] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 559.760621][ T5114] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 559.778016][ T5114] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 559.812562][ T5114] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 559.831685][ T5114] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 559.847248][ T5114] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 560.115157][ T5114] usb 6-1: config 0 descriptor?? [ 560.266517][T14957] __nla_validate_parse: 1 callbacks suppressed [ 560.266534][T14957] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2519'. [ 560.273018][T14957] netlink: 'syz.0.2519': attribute type 8 has an invalid length. [ 560.275911][T14957] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2519'. [ 560.352512][ T5114] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 64 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 560.434037][ T5753] usb 7-1: new high-speed USB device number 60 using dummy_hcd [ 560.555540][ T5838] usb 6-1: USB disconnect, device number 64 [ 560.561177][ T5838] usblp0: removed [ 560.595407][ T5753] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 560.598902][ T5753] usb 7-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 560.601948][ T5753] usb 7-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 560.606383][ T5753] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.424213][ T5838] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 561.575839][ T5838] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 561.579495][ T5838] usb 6-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 561.583227][ T5838] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.734128][T13125] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 561.864667][T13125] usb 5-1: device descriptor read/64, error -71 [ 561.945744][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.104540][T13125] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 562.254060][T13125] usb 5-1: device descriptor read/64, error -71 [ 562.374588][T13125] usb usb5-port1: attempt power cycle [ 562.724047][T13125] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 562.748847][T13125] usb 5-1: device descriptor read/8, error -71 [ 562.874126][ T5114] usb 8-1: new high-speed USB device number 38 using dummy_hcd [ 562.994156][T13125] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 563.004079][ T5114] usb 8-1: device descriptor read/64, error -71 [ 563.024713][T13125] usb 5-1: device descriptor read/8, error -71 [ 563.134413][T13125] usb usb5-port1: unable to enumerate USB device [ 563.188141][ T9408] usb 7-1: USB disconnect, device number 60 [ 563.254205][ T5114] usb 8-1: new high-speed USB device number 39 using dummy_hcd [ 563.384462][ T5114] usb 8-1: device descriptor read/64, error -71 [ 563.506208][ T5114] usb usb8-port1: attempt power cycle [ 563.864084][ T34] usb 42-1: device descriptor read/8, error -110 [ 563.866855][ T5114] usb 8-1: new high-speed USB device number 40 using dummy_hcd [ 563.898052][ T5114] usb 8-1: device descriptor read/8, error -71 [ 564.144419][ T5114] usb 8-1: new high-speed USB device number 41 using dummy_hcd [ 564.167257][ T5114] usb 8-1: device descriptor read/8, error -71 [ 564.238000][ T5904] usb 6-1: USB disconnect, device number 65 [ 564.275967][ T5114] usb usb8-port1: unable to enumerate USB device [ 564.281747][ T34] usb usb42-port1: attempt power cycle [ 564.408086][T15007] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2537'. [ 564.856982][ T34] usb usb42-port1: unable to enumerate USB device [ 564.892090][T15012] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2538'. [ 564.984238][T15012] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2538'. [ 565.673763][T15028] syzkaller1: entered promiscuous mode [ 565.675507][ T5904] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 565.678688][T15028] syzkaller1: entered allmulticast mode [ 565.694081][ T5114] usb 5-1: new full-speed USB device number 72 using dummy_hcd [ 565.844020][ T5904] usb 6-1: Using ep0 maxpacket: 8 [ 565.845744][ T5114] usb 5-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 565.846944][ T5904] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 565.852462][ T5114] usb 5-1: config 0 interface 0 altsetting 255 endpoint 0x8F has invalid wMaxPacketSize 0 [ 565.852550][ T5904] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 565.858804][ T5114] usb 5-1: config 0 interface 0 has no altsetting 0 [ 565.860273][ T5904] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 565.867880][ T5904] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 565.869906][ T5114] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 565.872369][ T5904] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 565.877022][ T5114] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 565.882367][ T5114] usb 5-1: Product: syz [ 565.884223][ T5114] usb 5-1: Manufacturer: syz [ 565.886152][ T5114] usb 5-1: SerialNumber: syz [ 565.889374][ T5904] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 565.896385][ T5904] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 565.904043][ T5904] usb 6-1: config 168 interface 0 has no altsetting 0 [ 565.907092][ T5904] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 565.909517][ T5904] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 565.912947][ T5904] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 565.913369][ T5114] usb 5-1: config 0 descriptor?? [ 565.918906][ T5904] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 565.926724][ T5904] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 565.928278][ T5114] usb 5-1: selecting invalid altsetting 0 [ 565.930235][ T5904] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 565.936357][ T5904] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 565.940487][ T5904] usb 6-1: config 168 interface 0 has no altsetting 0 [ 565.943395][ T5904] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 565.945966][ T5904] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 565.949493][ T5904] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 565.953087][ T5904] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 565.957149][ T5904] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 565.961221][ T5904] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 565.976469][ T5904] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 565.986576][ T5904] usb 6-1: config 168 interface 0 has no altsetting 0 [ 565.996962][ T5904] usb 6-1: string descriptor 0 read error: -22 [ 565.999161][ T5904] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 566.013979][ T5904] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 566.028323][ T5904] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 566.127023][ T50] usb 5-1: USB disconnect, device number 72 [ 566.238488][T15021] FAULT_INJECTION: forcing a failure. [ 566.238488][T15021] name failslab, interval 1, probability 0, space 0, times 0 [ 566.245202][T15021] CPU: 3 UID: 0 PID: 15021 Comm: syz.1.2542 Tainted: G L syzkaller #0 PREEMPT(full) [ 566.245222][T15021] Tainted: [L]=SOFTLOCKUP [ 566.245226][T15021] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 566.245232][T15021] Call Trace: [ 566.245238][T15021] [ 566.245242][T15021] dump_stack_lvl+0x100/0x190 [ 566.245259][T15021] should_fail_ex.cold+0x5/0xa [ 566.245272][T15021] should_failslab+0xc2/0x120 [ 566.245288][T15021] __kmalloc_cache_noprof+0x91/0x6c0 [ 566.245299][T15021] ? lockdep_hardirqs_on+0x78/0x100 [ 566.245318][T15021] ? dummy_urb_enqueue+0xa3/0x880 [ 566.245333][T15021] dummy_urb_enqueue+0xa3/0x880 [ 566.245344][T15021] ? usb_hcd_map_urb_for_dma+0x28a/0x1190 [ 566.245361][T15021] ? __lock_acquire+0x49f/0x1a40 [ 566.245380][T15021] usb_hcd_submit_urb+0x268/0x2150 [ 566.245395][T15021] usb_submit_urb+0x827/0x19b0 [ 566.245410][T15021] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 566.245424][T15021] adu_read+0x99e/0x1960 [ 566.245441][T15021] ? __pfx_adu_read+0x10/0x10 [ 566.245455][T15021] ? __pfx_default_wake_function+0x10/0x10 [ 566.245468][T15021] ? bpf_lsm_file_permission+0x9/0x10 [ 566.245478][T15021] ? security_file_permission+0x76/0x210 [ 566.245495][T15021] ? rw_verify_area+0xce/0x6d0 [ 566.245510][T15021] ? __pfx_adu_read+0x10/0x10 [ 566.245523][T15021] vfs_read+0x1e4/0xb40 [ 566.245535][T15021] ? __pfx_vfs_read+0x10/0x10 [ 566.245550][T15021] ? find_held_lock+0x2b/0x80 [ 566.245563][T15021] ? __fget_files+0x215/0x3d0 [ 566.245573][T15021] ? __fget_files+0x215/0x3d0 [ 566.245585][T15021] ? __fget_files+0x21f/0x3d0 [ 566.245599][T15021] ksys_read+0x12a/0x250 [ 566.245609][T15021] ? __pfx_ksys_read+0x10/0x10 [ 566.245618][T15021] ? ksys_write+0x1ac/0x250 [ 566.245628][T15021] ? __pfx_ksys_write+0x10/0x10 [ 566.245641][T15021] __do_fast_syscall_32+0xe7/0x970 [ 566.245656][T15021] ? lockdep_hardirqs_on+0x78/0x100 [ 566.245669][T15021] do_fast_syscall_32+0x32/0x70 [ 566.245684][T15021] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 566.245699][T15021] RIP: 0023:0xf7f02fec [ 566.245713][T15021] Code: Unable to access opcode bytes at 0xf7f02fc2. [ 566.245718][T15021] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000003 [ 566.245730][T15021] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000a80 [ 566.245737][T15021] RDX: 00000000000000ba RSI: 0000000000000000 RDI: 0000000000000000 [ 566.245743][T15021] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 566.245749][T15021] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 566.245755][T15021] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 566.245769][T15021] [ 566.336100][ T5904] usb 6-1: USB disconnect, device number 66 [ 566.410650][T15038] udc usbip-vudc.0: UDC had already stopped [ 566.456491][T15040] netlink: 'syz.3.2549': attribute type 10 has an invalid length. [ 566.460823][T15040] bridge0: port 2(bridge_slave_1) entered blocking state [ 566.464017][T15040] bridge0: port 2(bridge_slave_1) entered listening state [ 566.468615][T15040] bridge0: port 1(bridge_slave_0) entered blocking state [ 566.471596][T15040] bridge0: port 1(bridge_slave_0) entered listening state [ 566.479173][T15040] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 566.683775][T15044] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2551'. [ 566.688205][T15044] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2551'. [ 566.756335][T15052] udc usbip-vudc.0: UDC had already stopped [ 566.774813][ T34] usb 8-1: new high-speed USB device number 42 using dummy_hcd [ 566.924151][ T34] usb 8-1: Using ep0 maxpacket: 8 [ 566.927361][ T34] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 566.930548][ T34] usb 8-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 566.940457][ T34] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 566.946355][ T34] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 566.950824][ T34] usb 8-1: Product: syz [ 566.952287][ T34] usb 8-1: Manufacturer: syz [ 566.953755][ T34] usb 8-1: SerialNumber: syz [ 566.960512][ T34] usb 8-1: No union descriptors [ 566.963025][ T34] usbtest 8-1:1.0: couldn't get endpoints, -22 [ 566.965095][ T34] usbtest 8-1:1.0: probe with driver usbtest failed with error -22 [ 566.969749][T15063] netlink: 'syz.2.2559': attribute type 10 has an invalid length. [ 566.972847][T15063] bridge0: port 2(bridge_slave_1) entered blocking state [ 566.975320][T15063] bridge0: port 2(bridge_slave_1) entered listening state [ 566.977729][T15063] bridge0: port 1(bridge_slave_0) entered blocking state [ 566.979896][T15063] bridge0: port 1(bridge_slave_0) entered listening state [ 566.983831][T15063] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 567.154295][ T5838] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 567.179735][T15075] netlink: 'syz.1.2562': attribute type 1 has an invalid length. [ 567.245828][T15080] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2562'. [ 567.253433][T15042] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 567.277573][T15042] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 567.298865][T15077] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2564'. [ 567.350418][T15082] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2564'. [ 567.364223][ T5838] usb 5-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 567.370191][ T5838] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 567.375477][ T5838] usb 5-1: Product: syz [ 567.377082][ T5838] usb 5-1: Manufacturer: syz [ 567.378730][ T5838] usb 5-1: SerialNumber: syz [ 567.382305][T15075] 8021q: adding VLAN 0 to HW filter on device bond3 [ 567.441895][ T5838] usb 5-1: config 0 descriptor?? [ 567.485648][ T5838] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 567.492716][ T5838] dvb-usb: bulk message failed: -22 (2/0) [ 567.548667][ T5838] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 567.553448][ T5838] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 567.575658][ T5838] usb 5-1: media controller created [ 567.643207][ T5838] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 567.814990][ T5765] Bluetooth: hci0: unexpected event 0x1c length: 82 > 5 [ 567.819312][T15061] cxusb: i2c wr: len=78 is too big! [ 567.819312][T15061] [ 567.850465][T15095] udc usbip-vudc.0: UDC had already stopped [ 567.939983][T15061] netlink: 'syz.0.2558': attribute type 1 has an invalid length. [ 567.969598][T15061] bond2: option mode: invalid value (12) [ 567.985727][T15061] bond2 (unregistering): Released all slaves [ 568.106523][T15102] netlink: 'syz.0.2558': attribute type 10 has an invalid length. [ 568.109072][T15102] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2558'. [ 568.113598][T15102] dummy0: entered promiscuous mode [ 568.129069][T15102] batman_adv: batadv0: Interface activated: dummy0 [ 568.131354][T15102] batman_adv: batadv0: Interface deactivated: dummy0 [ 568.133475][T15102] batman_adv: batadv0: Removing interface: dummy0 [ 568.278953][T15112] 9p: Bad value for 'rfdno' [ 568.517897][T15116] option changes via remount are deprecated (pid=15115 comm=syz.2.2572) [ 568.536348][ T5838] cxusb: set interface failed [ 568.537906][ T5838] dvb-usb: bulk message failed: -22 (1/0) [ 568.560902][ T5838] DVB: Unable to find symbol mt352_attach() [ 568.562869][ T5838] dvb-usb: bulk message failed: -22 (5/0) [ 568.566313][ T5838] zl10353_read_register: readreg error (reg=127, ret==-121) [ 568.568646][ T5838] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 568.624093][ T5838] rc_core: IR keymap rc-dvico-mce not found [ 568.625999][ T5838] Registered IR keymap rc-empty [ 568.628889][ T5838] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.0/usb5/5-1/rc/rc0 [ 568.632753][ T5838] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.0/usb5/5-1/rc/rc0/input23 [ 568.643311][ T5838] dvb-usb: schedule remote query interval to 100 msecs. [ 568.645613][ T5838] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 568.664678][ T5838] usb 5-1: USB disconnect, device number 73 [ 568.692017][ T5838] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 569.175543][T15125] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2574'. [ 569.179329][T15125] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2574'. [ 569.194034][T13125] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 569.345759][T13125] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 569.348977][T13125] usb 6-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 569.351851][T13125] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 569.561215][ T5838] usb 8-1: USB disconnect, device number 42 [ 569.927959][T15136] udc usbip-vudc.0: UDC had already stopped [ 570.310392][T15140] udc usbip-vudc.0: UDC had already stopped [ 571.478653][T15155] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2583'. [ 571.482144][T15155] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2583'. [ 571.806082][T15164] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2586'. [ 571.820940][T15164] syzkaller0: entered promiscuous mode [ 571.822728][T15164] syzkaller0: entered allmulticast mode [ 571.827324][T11639] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 571.830720][T11639] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 571.837318][T15164] tipc: Started in network mode [ 571.838942][T15164] tipc: Node identity bec66531afb1, cluster identity 4711 [ 571.841323][T15164] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 571.845506][T15164] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 571.848269][T15164] tipc: Enabled bearer , priority 0 [ 571.975913][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 572.114125][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 572.118231][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 572.196436][ T5838] usb 6-1: USB disconnect, device number 67 [ 572.264015][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 572.414006][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 572.416518][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 572.833432][T15163] tipc: Resetting bearer [ 572.861627][T15163] tipc: Disabling bearer [ 573.069367][T15177] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2592'. [ 573.072727][T15177] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2592'. [ 573.256837][T15185] FAULT_INJECTION: forcing a failure. [ 573.256837][T15185] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 573.260819][T15185] CPU: 2 UID: 0 PID: 15185 Comm: syz.3.2595 Tainted: G L syzkaller #0 PREEMPT(full) [ 573.260837][T15185] Tainted: [L]=SOFTLOCKUP [ 573.260841][T15185] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 573.260849][T15185] Call Trace: [ 573.260855][T15185] [ 573.260859][T15185] dump_stack_lvl+0x100/0x190 [ 573.260877][T15185] should_fail_ex.cold+0x5/0xa [ 573.260890][T15185] _copy_to_user+0x32/0xd0 [ 573.260908][T15185] simple_read_from_buffer+0xcb/0x170 [ 573.260927][T15185] proc_fail_nth_read+0x1af/0x230 [ 573.260947][T15185] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 573.260963][T15185] ? rw_verify_area+0xce/0x6d0 [ 573.260978][T15185] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 573.260993][T15185] vfs_read+0x1e4/0xb40 [ 573.261005][T15185] ? __pfx_vfs_read+0x10/0x10 [ 573.261021][T15185] ? find_held_lock+0x2b/0x80 [ 573.261035][T15185] ? __fget_files+0x215/0x3d0 [ 573.261048][T15185] ? __fget_files+0x21f/0x3d0 [ 573.261061][T15185] ksys_read+0x12a/0x250 [ 573.261071][T15185] ? __pfx_ksys_read+0x10/0x10 [ 573.261085][T15185] do_int80_emulation+0x14b/0x720 [ 573.261102][T15185] asm_int80_emulation+0x1a/0x20 [ 573.261113][T15185] RIP: 0023:0xf71472eb [ 573.261123][T15185] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 573.261133][T15185] RSP: 002b:00000000f54064bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 573.261144][T15185] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f54065d0 [ 573.261151][T15185] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 573.261157][T15185] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 573.261163][T15185] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 573.261169][T15185] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 573.261183][T15185] [ 573.467363][T15190] udc usbip-vudc.0: UDC had already stopped [ 573.714732][ T34] usb 7-1: new high-speed USB device number 61 using dummy_hcd [ 573.812652][T15201] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2601'. [ 573.816367][T15201] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2601'. [ 573.864124][ T34] usb 7-1: Using ep0 maxpacket: 8 [ 573.869341][ T34] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 573.874505][ T34] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 573.880950][ T34] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 573.884807][ T34] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 573.885031][T15206] vivid-000: ================= START STATUS ================= [ 573.887648][ T34] usb 7-1: Product: syz [ 573.891284][T15206] vivid-000: Test Pattern: 75% Colorbar [ 573.892492][ T34] usb 7-1: Manufacturer: syz [ 573.892503][ T34] usb 7-1: SerialNumber: syz [ 573.895546][T15206] vivid-000: Fill Percentage of Frame: 100 [ 573.903354][T15206] vivid-000: Horizontal Movement: No Movement [ 573.903425][ T34] usb 7-1: No union descriptors [ 573.906219][T15206] vivid-000: Vertical Movement: No Movement [ 573.908809][ T34] usbtest 7-1:1.0: couldn't get endpoints, -22 [ 573.911711][T15206] vivid-000: OSD Text Mode: All [ 573.912013][ T34] usbtest 7-1:1.0: probe with driver usbtest failed with error -22 [ 573.914473][T15206] vivid-000: Show Border: false [ 573.918939][T15206] vivid-000: Show Square: false [ 573.920974][T15206] vivid-000: Sensor Flipped Horizontally: false [ 573.923150][T15206] vivid-000: Sensor Flipped Vertically: false [ 573.925544][T15206] vivid-000: Insert SAV Code in Image: false [ 573.927629][T15206] vivid-000: Insert EAV Code in Image: false [ 573.932450][T15206] vivid-000: Insert Video Guard Band: false [ 573.934921][T15206] vivid-000: Reduced Framerate: false [ 573.939763][T15206] vivid-000: HDMI 000-0 Is Connected To: None [ 573.942175][T15206] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 573.944070][ T9408] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 573.945770][T15206] vivid-000: Enable Capture Cropping: true [ 573.948196][T15207] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2602'. [ 573.950487][T15206] vivid-000: Enable Capture Composing: true [ 573.956890][T15206] vivid-000: Enable Capture Scaler: false [ 573.961165][T15206] vivid-000: Timestamp Source: End of Frame [ 573.964021][T15206] vivid-000: Colorspace: sRGB [ 573.966363][T15206] vivid-000: Transfer Function: Default [ 573.968833][T15206] vivid-000: Y'CbCr Encoding: Default [ 573.971367][T15206] vivid-000: HSV Encoding: Hue 0-179 [ 573.973380][T15206] vivid-000: Quantization: Default [ 573.975603][T15206] vivid-000: Apply Alpha To Red Only: false [ 573.977866][T15206] vivid-000: Standard Aspect Ratio: 4x3 [ 573.979967][T15206] vivid-000: DV Timings Signal Mode: Current DV Timings inactive [ 573.983181][T15206] vivid-000: DV Timings: 640x480p59 inactive [ 573.985867][T15206] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 573.988939][T15206] vivid-000: Maximum EDID Blocks: 2 [ 573.991026][T15206] vivid-000: Limited RGB Range (16-235): false [ 573.993705][T15206] vivid-000: Rx RGB Quantization Range: Automatic [ 573.996693][T15206] vivid-000: Power Present: 0x00000000 [ 573.999051][T15206] tpg source WxH: 320x240 (Y'CbCr) [ 574.001157][T15206] tpg field: 1 [ 574.002540][T15206] tpg crop: (0,0)/320x240 [ 574.004602][T15206] tpg compose: (0,0)/320x240 [ 574.008530][T15206] tpg colorspace: 8 [ 574.010221][T15206] tpg transfer function: 0/0 [ 574.012149][T15206] tpg Y'CbCr encoding: 0/0 [ 574.014269][T15206] tpg quantization: 0/0 [ 574.016179][T15206] tpg RGB range: 0/2 [ 574.017821][T15206] vivid-000: ================== END STATUS ================== [ 574.107177][ T9408] usb 6-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 574.113189][T15189] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 574.116049][ T9408] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.120298][T15189] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 574.129479][ T9408] i2c-tiny-usb 6-1:1.0: version 1.00 found at bus 006 address 068 [ 574.542675][ T9408] (null): failure reading functionality [ 574.594234][ T9408] i2c i2c-2: failure reading functionality [ 574.606910][ T9408] i2c i2c-2: connected i2c-tiny-usb device [ 574.628416][T15216] overlayfs: failed to resolve 'xino=off': -2 [ 575.088034][T15220] udc usbip-vudc.0: UDC had already stopped [ 575.122451][T15223] binder: 15222:15223 ioctl c0306201 80000080 returned -14 [ 575.127859][T15223] binder: 15222:15223 ioctl 4068aea3 80000400 returned -22 [ 575.148456][T15223] binder: 15222:15223 ioctl 5000940c 0 returned -22 [ 575.384725][T13125] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 575.548121][T13125] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 575.552934][T13125] usb 5-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 575.556432][T13125] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 575.559286][T13125] usb 5-1: Product: syz [ 575.560950][T13125] usb 5-1: Manufacturer: syz [ 575.572920][T13125] usb_debug 5-1:1.0: debug converter detected [ 575.577161][T13125] usb 5-1: debug converter now attached to ttyUSB0 [ 575.768736][T13125] usb 5-1: USB disconnect, device number 74 [ 575.776317][T13125] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 575.782336][T13125] usb_debug 5-1:1.0: device disconnected [ 576.339140][T15233] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2609'. [ 576.470486][ T5904] usb 7-1: USB disconnect, device number 61 [ 576.517146][T15240] bridge0: port 3(netdevsim1) entered blocking state [ 576.520850][T15240] bridge0: port 3(netdevsim1) entered disabled state [ 576.523908][T15240] netdevsim netdevsim2 netdevsim1: entered allmulticast mode [ 576.532472][T15240] netdevsim netdevsim2 netdevsim1: entered promiscuous mode [ 576.537376][T15240] bridge0: port 3(netdevsim1) entered blocking state [ 576.540384][T15240] bridge0: port 3(netdevsim1) entered listening state [ 576.577223][T15238] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2610'. [ 576.580990][T15238] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2610'. [ 576.614505][T15240] smpboot: CPU 3 is now offline [ 576.718186][ T5753] usb 6-1: USB disconnect, device number 68 [ 576.820902][T15251] FAULT_INJECTION: forcing a failure. [ 576.820902][T15251] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 576.825197][T15251] CPU: 0 UID: 0 PID: 15251 Comm: syz.1.2615 Tainted: G L syzkaller #0 PREEMPT(full) [ 576.825215][T15251] Tainted: [L]=SOFTLOCKUP [ 576.825219][T15251] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 576.825227][T15251] Call Trace: [ 576.825231][T15251] [ 576.825236][T15251] dump_stack_lvl+0x100/0x190 [ 576.825252][T15251] should_fail_ex.cold+0x5/0xa [ 576.825265][T15251] _copy_to_user+0x32/0xd0 [ 576.825283][T15251] simple_read_from_buffer+0xcb/0x170 [ 576.825301][T15251] proc_fail_nth_read+0x1af/0x230 [ 576.825316][T15251] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 576.825332][T15251] ? rw_verify_area+0xce/0x6d0 [ 576.825348][T15251] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 576.825362][T15251] vfs_read+0x1e4/0xb40 [ 576.825374][T15251] ? __pfx_vfs_read+0x10/0x10 [ 576.825389][T15251] ? find_held_lock+0x2b/0x80 [ 576.825404][T15251] ? __fget_files+0x215/0x3d0 [ 576.825417][T15251] ? __fget_files+0x21f/0x3d0 [ 576.825430][T15251] ksys_read+0x12a/0x250 [ 576.825440][T15251] ? __pfx_ksys_read+0x10/0x10 [ 576.825454][T15251] do_int80_emulation+0x14b/0x720 [ 576.825470][T15251] asm_int80_emulation+0x1a/0x20 [ 576.825481][T15251] RIP: 0023:0xf71072eb [ 576.825491][T15251] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 576.825502][T15251] RSP: 002b:00000000f53c64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 576.825513][T15251] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f53c65d0 [ 576.825520][T15251] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 576.825527][T15251] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 576.825533][T15251] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 576.825539][T15251] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 576.825552][T15251] [ 576.894260][T15252] tmpfs: Unknown parameter 'mpol' [ 576.898522][T15252] random: crng reseeded on system resumption [ 577.078501][ T5752] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 577.086556][ T5752] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 577.091300][ T5752] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 577.099133][ T5752] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 577.110630][ T5752] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 577.413273][T15258] lo speed is unknown, defaulting to 1000 [ 577.442439][T15271] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2620'. [ 577.448232][T15271] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2620'. [ 577.525538][ T5590] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.551232][ T5590] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.581873][ T5590] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.601665][ T5590] netdevsim netdevsim1 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.614659][T11639] bridge_slave_1: left allmulticast mode [ 577.616542][T11639] bridge_slave_1: left promiscuous mode [ 577.620440][T11639] bridge0: port 2(bridge_slave_1) entered disabled state [ 577.628980][T11639] bridge_slave_0: left allmulticast mode [ 577.630804][T11639] bridge_slave_0: left promiscuous mode [ 577.635299][T11639] bridge0: port 1(bridge_slave_0) entered disabled state [ 577.642794][T11639] dvmrp0: left allmulticast mode [ 577.781030][T11639] gretap0 (unregistering): left promiscuous mode [ 577.801047][T11639] bond2 (unregistering): (slave gre1): Releasing backup interface [ 577.837467][T11639] bond0 (unregistering): left promiscuous mode [ 577.839483][T11639] bond_slave_0: left promiscuous mode [ 577.841252][T11639] bond_slave_1: left promiscuous mode [ 577.856143][T11639] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 577.859967][T11639] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 577.863155][T11639] bond0 (unregistering): Released all slaves [ 577.868557][T11639] bond1 (unregistering): Released all slaves [ 577.876521][T11639] bond2 (unregistering): Released all slaves [ 577.883772][T11639] bond3 (unregistering): Released all slaves [ 577.892508][ T5453] 8021q: adding VLAN 0 to HW filter on device eth1 [ 577.986460][T11639] tipc: Disabling bearer [ 577.988577][T11639] tipc: Left network mode [ 578.033292][T15297] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2624'. [ 578.076573][T15304] input: syz0 as /devices/virtual/input/input24 [ 578.247032][ T5453] 8021q: adding VLAN 0 to HW filter on device eth2 [ 578.253570][T15258] bridge0: port 1(bridge_slave_0) entered blocking state [ 578.267588][T15258] bridge0: port 1(bridge_slave_0) entered disabled state [ 578.274816][T15258] bridge_slave_0: entered allmulticast mode [ 578.281803][T15258] bridge_slave_0: entered promiscuous mode [ 578.288939][T15258] bridge0: port 2(bridge_slave_1) entered blocking state [ 578.292769][T15258] bridge0: port 2(bridge_slave_1) entered disabled state [ 578.299204][T15258] bridge_slave_1: entered allmulticast mode [ 578.303410][T15258] bridge_slave_1: entered promiscuous mode [ 578.426256][T15258] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 578.516774][T15258] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 578.522581][T15327] udc usbip-vudc.0: UDC had already stopped [ 578.556468][T15258] team0: Port device team_slave_0 added [ 578.567143][T15319] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2628'. [ 578.586408][T15258] team0: Port device team_slave_1 added [ 578.603683][T15319] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2628'. [ 578.637693][T15258] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 578.641520][T15258] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 578.663578][T15258] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 578.668069][T15258] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 578.670467][T15258] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 578.678401][T15258] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 578.682612][ T5453] 8021q: adding VLAN 0 to HW filter on device eth3 [ 578.722300][T15335] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2633'. [ 578.739824][T11639] hsr_slave_0: left promiscuous mode [ 578.745378][T11639] hsr_slave_1: left promiscuous mode [ 578.749572][T11639] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 578.913724][T11639] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 579.111500][T15346] binder: 15343:15346 ioctl c0306201 80000180 returned -14 [ 579.156099][ T5765] Bluetooth: hci1: command tx timeout [ 579.288973][T15258] hsr_slave_0: entered promiscuous mode [ 579.291335][T15258] hsr_slave_1: entered promiscuous mode [ 579.293606][T15258] debugfs: 'hsr0' already exists in 'hsr' [ 579.301765][T15258] Cannot create hsr debugfs directory [ 579.410068][T15258] netdevsim netdevsim1 eth4 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.656373][T15339] tipc: Started in network mode [ 579.658177][T15339] tipc: Node identity 4, cluster identity 4711 [ 579.660383][T15339] tipc: Node number set to 4 [ 579.821207][T15258] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.925814][T15352] netlink: 'syz.2.2637': attribute type 1 has an invalid length. [ 579.931413][T15352] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2637'. [ 580.030951][T15358] syzkaller0: entered promiscuous mode [ 580.034703][T15358] syzkaller0: entered allmulticast mode [ 580.071951][T15350] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 580.915300][T15258] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.993071][T11639] IPVS: stop unused estimator thread 0... [ 581.006072][T15367] udc usbip-vudc.0: UDC had already stopped [ 581.092836][T15258] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 581.234249][ T5765] Bluetooth: hci1: command tx timeout [ 581.282891][T15258] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 581.289808][T15258] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 581.292606][T15258] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 581.297082][T15258] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 581.299807][T15258] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 581.303785][T15258] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 581.307130][T15258] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 581.311061][T15258] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 581.380827][T15258] 8021q: adding VLAN 0 to HW filter on device bond0 [ 581.410512][T15258] 8021q: adding VLAN 0 to HW filter on device team0 [ 581.438833][ T392] bridge0: port 1(bridge_slave_0) entered blocking state [ 581.442699][ T392] bridge0: port 1(bridge_slave_0) entered forwarding state [ 581.466151][ T392] bridge0: port 2(bridge_slave_1) entered blocking state [ 581.468444][ T392] bridge0: port 2(bridge_slave_1) entered forwarding state [ 581.488786][ T41] kauditd_printk_skb: 7 callbacks suppressed [ 581.488803][ T41] audit: type=1326 audit(2000000221.123:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15389 comm="syz.2.2643" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 581.702925][T15391] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2642'. [ 581.706620][T15391] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2642'. [ 581.870960][T15411] FAULT_INJECTION: forcing a failure. [ 581.870960][T15411] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 581.878949][T15411] CPU: 2 UID: 0 PID: 15411 Comm: syz.0.2645 Tainted: G L syzkaller #0 PREEMPT(full) [ 581.878969][T15411] Tainted: [L]=SOFTLOCKUP [ 581.878973][T15411] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 581.878980][T15411] Call Trace: [ 581.878984][T15411] [ 581.878989][T15411] dump_stack_lvl+0x100/0x190 [ 581.879005][T15411] should_fail_ex.cold+0x5/0xa [ 581.879017][T15411] ? prepare_alloc_pages+0x16d/0x5f0 [ 581.879035][T15411] should_fail_alloc_page+0xeb/0x140 [ 581.879051][T15411] prepare_alloc_pages+0x1f0/0x5f0 [ 581.879069][T15411] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 581.879097][T15411] ? rcu_is_watching+0x12/0xc0 [ 581.879111][T15411] ? trace_mm_page_alloc+0x164/0x1c0 [ 581.879128][T15411] ? __alloc_frozen_pages_noprof+0x2d1/0x2dc0 [ 581.879143][T15411] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 581.879157][T15411] ? is_bpf_text_address+0x8a/0x1a0 [ 581.879173][T15411] ? bpf_ksym_find+0x124/0x1c0 [ 581.879185][T15411] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 581.879201][T15411] ? is_bpf_text_address+0x94/0x1a0 [ 581.879217][T15411] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 581.879229][T15411] ? __page_table_check_zero+0x27f/0x410 [ 581.879244][T15411] ? __kernel_text_address+0xd/0x30 [ 581.879270][T15411] alloc_pages_bulk_noprof+0x5de/0x13c0 [ 581.879285][T15411] ? policy_nodemask+0xed/0x4f0 [ 581.879302][T15411] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 581.879323][T15411] __kasan_populate_vmalloc+0xf0/0x210 [ 581.879338][T15411] alloc_vmap_area+0x95d/0x2bb0 [ 581.879357][T15411] ? kasan_save_track+0x14/0x30 [ 581.879371][T15411] ? __kasan_kmalloc+0xaa/0xb0 [ 581.879384][T15411] ? __pfx_alloc_vmap_area+0x10/0x10 [ 581.879399][T15411] ? __get_vm_area_node+0x101/0x330 [ 581.879416][T15411] __get_vm_area_node+0x1ca/0x330 [ 581.879434][T15411] __vmalloc_node_range_noprof+0x228/0x1630 [ 581.879451][T15411] ? bpf_check+0x1cc/0xb7d0 [ 581.879467][T15411] ? rcu_is_watching+0x12/0xc0 [ 581.879482][T15411] ? bpf_check+0x1cc/0xb7d0 [ 581.879497][T15411] ? rcu_read_unlock+0x17/0x60 [ 581.879513][T15411] ? rcu_read_unlock+0x17/0x60 [ 581.879550][T15411] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 581.879568][T15411] ? rcu_is_watching+0x12/0xc0 [ 581.879582][T15411] ? rcu_is_watching+0x12/0xc0 [ 581.879595][T15411] ? __kmalloc_large_node_noprof+0x5d/0x70 [ 581.879610][T15411] ? find_held_lock+0x2b/0x80 [ 581.879626][T15411] ? bpf_check+0x1cc/0xb7d0 [ 581.879640][T15411] __vmalloc_node_noprof+0xad/0xf0 [ 581.879657][T15411] ? bpf_check+0x1cc/0xb7d0 [ 581.879673][T15411] bpf_check+0x1cc/0xb7d0 [ 581.879687][T15411] ? trace_contention_end+0x126/0x160 [ 581.879704][T15411] ? __css_rstat_updated+0x1ce/0x5a0 [ 581.879722][T15411] ? __pfx___css_rstat_updated+0x10/0x10 [ 581.879743][T15411] ? __lock_acquire+0x49f/0x1a40 [ 581.879760][T15411] ? __mod_memcg_state+0x12b/0x500 [ 581.879773][T15411] ? __pfx_bpf_check+0x10/0x10 [ 581.879791][T15411] ? find_held_lock+0x2b/0x80 [ 581.879804][T15411] ? bpf_prog_load+0x1933/0x2fa0 [ 581.879817][T15411] ? __asan_memset+0x23/0x50 [ 581.879828][T15411] ? lsm_blob_alloc+0x2b/0x90 [ 581.879853][T15411] ? bpf_prog_load+0x244d/0x2fa0 [ 581.879864][T15411] bpf_prog_load+0x244d/0x2fa0 [ 581.879878][T15411] ? __pfx_bpf_prog_load+0x10/0x10 [ 581.879890][T15411] ? __lock_acquire+0x49f/0x1a40 [ 581.879918][T15411] __sys_bpf+0x18dc/0x4e80 [ 581.879934][T15411] ? __pfx___sys_bpf+0x10/0x10 [ 581.879946][T15411] ? find_held_lock+0x2b/0x80 [ 581.879959][T15411] ? get_pid_task+0xfc/0x250 [ 581.879972][T15411] ? get_pid_task+0xfc/0x250 [ 581.879989][T15411] ? proc_fail_nth_write+0x9f/0x220 [ 581.880004][T15411] ? find_held_lock+0x2b/0x80 [ 581.880020][T15411] ? rcu_read_lock_any_held+0x6a/0xa0 [ 581.880034][T15411] ? find_held_lock+0x2b/0x80 [ 581.880047][T15411] ? ksys_write+0x190/0x250 [ 581.880057][T15411] ? ksys_write+0x190/0x250 [ 581.880077][T15411] ? fput+0x79/0x100 [ 581.880090][T15411] ? __ia32_sys_bpf+0xcc/0x170 [ 581.880101][T15411] __ia32_sys_bpf+0xcc/0x170 [ 581.880114][T15411] ? __do_fast_syscall_32+0x98/0x970 [ 581.880130][T15411] __do_fast_syscall_32+0xe7/0x970 [ 581.880143][T15411] ? lockdep_hardirqs_on+0x78/0x100 [ 581.880157][T15411] do_fast_syscall_32+0x32/0x70 [ 581.880172][T15411] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 581.880186][T15411] RIP: 0023:0xf709efec [ 581.880200][T15411] Code: Unable to access opcode bytes at 0xf709efc2. [ 581.880205][T15411] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 581.880217][T15411] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000dc0 [ 581.880224][T15411] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 581.880230][T15411] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 581.880236][T15411] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 581.880243][T15411] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 581.880256][T15411] [ 581.880363][T15411] syz.0.2645: vmalloc error: size 816, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 582.038585][T15411] CPU: 2 UID: 0 PID: 15411 Comm: syz.0.2645 Tainted: G L syzkaller #0 PREEMPT(full) [ 582.038603][T15411] Tainted: [L]=SOFTLOCKUP [ 582.038607][T15411] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 582.038613][T15411] Call Trace: [ 582.038617][T15411] [ 582.038622][T15411] dump_stack_lvl+0x100/0x190 [ 582.038651][T15411] warn_alloc.cold+0x94/0xa8 [ 582.038664][T15411] ? __pfx_warn_alloc+0x10/0x10 [ 582.038676][T15411] ? lockdep_hardirqs_on+0x78/0x100 [ 582.038692][T15411] ? __get_vm_area_node+0x2cd/0x330 [ 582.038710][T15411] ? __get_vm_area_node+0x208/0x330 [ 582.038728][T15411] __vmalloc_node_range_noprof+0xccd/0x1630 [ 582.038747][T15411] ? rcu_is_watching+0x12/0xc0 [ 582.038762][T15411] ? bpf_check+0x1cc/0xb7d0 [ 582.038778][T15411] ? rcu_read_unlock+0x17/0x60 [ 582.038794][T15411] ? rcu_read_unlock+0x17/0x60 [ 582.038812][T15411] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 582.038828][T15411] ? rcu_is_watching+0x12/0xc0 [ 582.038845][T15411] ? rcu_is_watching+0x12/0xc0 [ 582.038858][T15411] ? __kmalloc_large_node_noprof+0x5d/0x70 [ 582.038874][T15411] ? find_held_lock+0x2b/0x80 [ 582.038889][T15411] ? bpf_check+0x1cc/0xb7d0 [ 582.038903][T15411] __vmalloc_node_noprof+0xad/0xf0 [ 582.038920][T15411] ? bpf_check+0x1cc/0xb7d0 [ 582.038935][T15411] bpf_check+0x1cc/0xb7d0 [ 582.038950][T15411] ? trace_contention_end+0x126/0x160 [ 582.038962][T15411] ? __css_rstat_updated+0x1ce/0x5a0 [ 582.038980][T15411] ? __pfx___css_rstat_updated+0x10/0x10 [ 582.039001][T15411] ? __lock_acquire+0x49f/0x1a40 [ 582.039017][T15411] ? __mod_memcg_state+0x12b/0x500 [ 582.039030][T15411] ? __pfx_bpf_check+0x10/0x10 [ 582.039049][T15411] ? find_held_lock+0x2b/0x80 [ 582.039062][T15411] ? bpf_prog_load+0x1933/0x2fa0 [ 582.039076][T15411] ? __asan_memset+0x23/0x50 [ 582.039087][T15411] ? lsm_blob_alloc+0x2b/0x90 [ 582.039106][T15411] ? bpf_prog_load+0x244d/0x2fa0 [ 582.039116][T15411] bpf_prog_load+0x244d/0x2fa0 [ 582.039131][T15411] ? __pfx_bpf_prog_load+0x10/0x10 [ 582.039142][T15411] ? __lock_acquire+0x49f/0x1a40 [ 582.039170][T15411] __sys_bpf+0x18dc/0x4e80 [ 582.039186][T15411] ? __pfx___sys_bpf+0x10/0x10 [ 582.039198][T15411] ? find_held_lock+0x2b/0x80 [ 582.039211][T15411] ? get_pid_task+0xfc/0x250 [ 582.039224][T15411] ? get_pid_task+0xfc/0x250 [ 582.039241][T15411] ? proc_fail_nth_write+0x9f/0x220 [ 582.039256][T15411] ? find_held_lock+0x2b/0x80 [ 582.039273][T15411] ? rcu_read_lock_any_held+0x6a/0xa0 [ 582.039287][T15411] ? find_held_lock+0x2b/0x80 [ 582.039300][T15411] ? ksys_write+0x190/0x250 [ 582.039310][T15411] ? ksys_write+0x190/0x250 [ 582.039329][T15411] ? fput+0x79/0x100 [ 582.039343][T15411] ? __ia32_sys_bpf+0xcc/0x170 [ 582.039354][T15411] __ia32_sys_bpf+0xcc/0x170 [ 582.039367][T15411] ? __do_fast_syscall_32+0x98/0x970 [ 582.039382][T15411] __do_fast_syscall_32+0xe7/0x970 [ 582.039395][T15411] ? lockdep_hardirqs_on+0x78/0x100 [ 582.039409][T15411] do_fast_syscall_32+0x32/0x70 [ 582.039423][T15411] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 582.039437][T15411] RIP: 0023:0xf709efec [ 582.039451][T15411] Code: Unable to access opcode bytes at 0xf709efc2. [ 582.039456][T15411] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 582.039467][T15411] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000dc0 [ 582.039473][T15411] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 582.039480][T15411] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 582.039486][T15411] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 582.039492][T15411] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 582.039506][T15411] [ 582.039860][T15411] Mem-Info: [ 582.143466][T15258] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 582.144682][T15411] active_anon:11179 inactive_anon:27660 isolated_anon:0 [ 582.144682][T15411] active_file:2962 inactive_file:12492 isolated_file:0 [ 582.144682][T15411] unevictable:768 dirty:177 writeback:0 [ 582.144682][T15411] slab_reclaimable:6447 slab_unreclaimable:60891 [ 582.144682][T15411] mapped:26599 shmem:34749 pagetables:1319 [ 582.144682][T15411] sec_pagetables:315 bounce:0 [ 582.144682][T15411] kernel_misc_reclaimable:0 [ 582.144682][T15411] free:41480 free_pcp:11645 free_cma:0 [ 582.173072][T15411] Node 0 active_anon:284kB inactive_anon:52kB active_file:0kB inactive_file:1640kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:2076kB dirty:8kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8544kB pagetables:1416kB sec_pagetables:1112kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 582.183438][T15411] Node 1 active_anon:38312kB inactive_anon:110588kB active_file:11848kB inactive_file:48328kB unevictable:1536kB isolated(anon):6120kB isolated(file):0kB mapped:102280kB dirty:700kB writeback:0kB shmem:137460kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5428kB pagetables:3860kB sec_pagetables:148kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 582.195067][T15411] Node 0 DMA free:2036kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:8kB inactive_anon:0kB active_file:0kB inactive_file:128kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:724kB local_pcp:436kB free_cma:0kB [ 582.203782][T15258] veth0_vlan: entered promiscuous mode [ 582.204683][T15411] lowmem_reserve[]: 0 280 280 280 280 [ 582.207858][T15411] Node 0 DMA32 free:17964kB boost:2048kB min:14820kB low:18012kB high:21204kB reserved_highatomic:0KB free_highatomic:0KB active_anon:276kB inactive_anon:52kB active_file:0kB inactive_file:1512kB unevictable:1536kB writepending:8kB zspages:596kB present:1032196kB managed:286952kB mlocked:0kB bounce:0kB free_pcp:6508kB local_pcp:3264kB free_cma:0kB [ 582.219689][T15411] lowmem_reserve[]: 0 0 0 0 0 [ 582.221237][T15411] Node 1 DMA32 free:144152kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:40284kB inactive_anon:110588kB active_file:11848kB inactive_file:48328kB unevictable:1536kB writepending:700kB zspages:2920kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:40580kB local_pcp:25956kB free_cma:0kB [ 582.231159][T15411] lowmem_reserve[]: 0 0 0 0 0 [ 582.232619][T15411] Node 0 DMA: 43*4kB (U) 17*8kB (U) 4*16kB (UM) 8*32kB (UM) 2*64kB (M) 0*128kB 1*256kB (M) 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 2036kB [ 582.237287][T15411] Node 0 DMA32: 497*4kB (UE) 207*8kB (UE) 105*16kB (UME) 105*32kB (UE) 25*64kB (UE) 14*128kB (UME) 3*256kB (ME) 4*512kB (U) 1*1024kB (U) 1*2048kB (U) 0*4096kB = 17964kB [ 582.242279][T15411] Node 1 DMA32: 57*4kB (UE) 153*8kB (UME) 153*16kB (U) 196*32kB (U) 138*64kB (UME) 101*128kB (UME) 56*256kB (UE) 37*512kB (UME) 19*1024kB (UM) 9*2048kB (M) 10*4096kB (UM) = 144060kB [ 582.248457][T15411] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 582.251310][T15411] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 582.254359][T15411] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 582.257254][T15411] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 582.260044][T15411] 50638 total pagecache pages [ 582.261446][T15411] 437 pages in swap cache [ 582.262740][T15411] Free swap = 115492kB [ 582.264312][T15411] Total swap = 124996kB [ 582.265725][T15411] 524155 pages RAM [ 582.266289][T15258] veth1_vlan: entered promiscuous mode [ 582.266920][T15411] 0 pages HighMem/MovableOnly [ 582.269937][T15411] 211524 pages reserved [ 582.271192][T15411] 0 pages cma reserved [ 582.306913][T15258] veth0_macvtap: entered promiscuous mode [ 582.322937][T15258] veth1_macvtap: entered promiscuous mode [ 582.371275][T15258] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 582.390981][T15258] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 582.446799][ T5590] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.450400][ T5590] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.458558][ T5590] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.476009][ T5590] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.598326][ T1164] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 582.600727][ T1164] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.617432][ T1164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 582.620342][ T1164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.711929][T15426] lo speed is unknown, defaulting to 1000 [ 583.180009][ T5752] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 583.200853][ T5752] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 583.204658][ T5752] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 583.208778][ T5752] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 583.211676][ T5752] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 583.305551][ T5752] Bluetooth: hci1: command tx timeout [ 583.436931][T15454] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2654'. [ 583.497941][T15454] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 584.387079][T15439] lo speed is unknown, defaulting to 1000 [ 584.447647][T15466] net_ratelimit: 5 callbacks suppressed [ 584.447659][T15466] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 584.451663][ T847] IPVS: starting estimator thread 0... [ 584.538914][T15468] IPVS: using max 43 ests per chain, 103200 per kthread [ 584.620826][T15439] bridge0: port 1(bridge_slave_0) entered blocking state [ 584.623164][T15439] bridge0: port 1(bridge_slave_0) entered disabled state [ 584.625782][T15439] bridge_slave_0: entered allmulticast mode [ 584.628484][T15439] bridge_slave_0: entered promiscuous mode [ 584.631952][T15439] bridge0: port 2(bridge_slave_1) entered blocking state [ 584.634408][T15439] bridge0: port 2(bridge_slave_1) entered disabled state [ 584.636639][T15439] bridge_slave_1: entered allmulticast mode [ 584.639286][T15439] bridge_slave_1: entered promiscuous mode [ 584.661860][T15439] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 584.668674][T15439] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 584.686115][T15439] team0: Port device team_slave_0 added [ 584.689244][T15439] team0: Port device team_slave_1 added [ 584.705520][T15439] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 584.707699][T15439] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 584.715111][T15439] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 584.719292][T15439] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 584.721350][T15439] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 584.728771][T15439] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 584.761781][T15439] hsr_slave_0: entered promiscuous mode [ 584.766817][T15439] hsr_slave_1: entered promiscuous mode [ 584.769611][T15439] debugfs: 'hsr0' already exists in 'hsr' [ 584.771761][T15439] Cannot create hsr debugfs directory [ 584.786312][T15486] udc usbip-vudc.0: UDC had already stopped [ 584.973638][T15492] udc usbip-vudc.0: UDC had already stopped [ 585.224784][ T5752] Bluetooth: hci2: command tx timeout [ 585.230893][T15506] udc usbip-vudc.0: UDC had already stopped [ 585.345743][T15505] FAULT_INJECTION: forcing a failure. [ 585.345743][T15505] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 585.350909][T15505] CPU: 2 UID: 0 PID: 15505 Comm: syz.2.2671 Tainted: G L syzkaller #0 PREEMPT(full) [ 585.350927][T15505] Tainted: [L]=SOFTLOCKUP [ 585.350931][T15505] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 585.350938][T15505] Call Trace: [ 585.350942][T15505] [ 585.350947][T15505] dump_stack_lvl+0x100/0x190 [ 585.350963][T15505] should_fail_ex.cold+0x5/0xa [ 585.350974][T15505] ? prepare_alloc_pages+0x16d/0x5f0 [ 585.350991][T15505] should_fail_alloc_page+0xeb/0x140 [ 585.351007][T15505] prepare_alloc_pages+0x1f0/0x5f0 [ 585.351025][T15505] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 585.351039][T15505] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 585.351055][T15505] ? is_bpf_text_address+0x94/0x1a0 [ 585.351072][T15505] ? __lock_acquire+0x49f/0x1a40 [ 585.351091][T15505] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 585.351107][T15505] ? do_raw_spin_lock+0x128/0x260 [ 585.351119][T15505] ? find_held_lock+0x2b/0x80 [ 585.351132][T15505] ? debug_check_no_obj_freed+0x31f/0x630 [ 585.351150][T15505] ? __asan_memcpy+0x3c/0x60 [ 585.351164][T15505] ? __pfx_interleave_nid+0x10/0x10 [ 585.351181][T15505] ? policy_nodemask+0xed/0x4f0 [ 585.351197][T15505] alloc_pages_mpol+0x1fb/0x540 [ 585.351213][T15505] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 585.351229][T15505] ? do_raw_spin_unlock+0x145/0x1e0 [ 585.351241][T15505] ? _raw_spin_unlock+0x28/0x50 [ 585.351254][T15505] folio_alloc_mpol_noprof+0x36/0x260 [ 585.351273][T15505] alloc_migration_target_by_mpol+0x2c1/0x650 [ 585.351297][T15505] ? __pfx_alloc_migration_target_by_mpol+0x10/0x10 [ 585.351316][T15505] ? __pfx___might_resched+0x10/0x10 [ 585.351333][T15505] ? move_to_new_folio+0x271/0x4e0 [ 585.351350][T15505] migrate_pages_batch+0x5dc/0x45c0 [ 585.351368][T15505] ? __pfx_alloc_migration_target_by_mpol+0x10/0x10 [ 585.351402][T15505] ? __pfx_migrate_pages_batch+0x10/0x10 [ 585.351431][T15505] migrate_pages_sync+0x4db/0x880 [ 585.351448][T15505] ? __pfx_alloc_migration_target_by_mpol+0x10/0x10 [ 585.351470][T15505] ? __pfx_migrate_pages_sync+0x10/0x10 [ 585.351486][T15505] ? __pfx_queue_pages_test_walk+0x10/0x10 [ 585.351595][T15505] migrate_pages+0x1a83/0x2850 [ 585.351616][T15505] ? __pfx_alloc_migration_target_by_mpol+0x10/0x10 [ 585.351638][T15505] ? __pfx_migrate_pages+0x10/0x10 [ 585.351657][T15505] ? do_mbind+0x555/0xfd0 [ 585.351672][T15505] do_mbind+0x5a4/0xfd0 [ 585.351687][T15505] ? __pfx_do_mbind+0x10/0x10 [ 585.351699][T15505] ? find_held_lock+0x2b/0x80 [ 585.351712][T15505] ? ksys_write+0x190/0x250 [ 585.351727][T15505] ? __pfx_get_nodes+0x10/0x10 [ 585.351741][T15505] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 585.351755][T15505] ? __fget_files+0x21f/0x3d0 [ 585.351767][T15505] kernel_mbind+0x1b7/0x200 [ 585.351779][T15505] ? __pfx_kernel_mbind+0x10/0x10 [ 585.351790][T15505] ? ksys_write+0x1ac/0x250 [ 585.351799][T15505] ? __pfx_ksys_write+0x10/0x10 [ 585.351812][T15505] __do_fast_syscall_32+0xe7/0x970 [ 585.351826][T15505] ? lockdep_hardirqs_on+0x78/0x100 [ 585.351840][T15505] do_fast_syscall_32+0x32/0x70 [ 585.351854][T15505] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 585.351870][T15505] RIP: 0023:0xf705efec [ 585.351884][T15505] Code: Unable to access opcode bytes at 0xf705efc2. [ 585.351889][T15505] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000112 [ 585.351900][T15505] RAX: ffffffffffffffda RBX: 00000000805b4000 RCX: 0000000000004000 [ 585.351907][T15505] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 585.351913][T15505] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 585.351919][T15505] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 585.351926][T15505] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 585.351939][T15505] [ 585.355543][T15439] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 585.444110][ T5752] Bluetooth: hci1: command tx timeout [ 585.483492][T15439] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 585.490137][T15439] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 585.511501][T15439] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 585.519378][T15439] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 585.524699][T15439] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 585.527804][T15439] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 585.531886][T15439] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 585.623027][T15439] 8021q: adding VLAN 0 to HW filter on device bond0 [ 585.643233][T15439] 8021q: adding VLAN 0 to HW filter on device team0 [ 585.660855][ T392] bridge0: port 1(bridge_slave_0) entered blocking state [ 585.663185][ T392] bridge0: port 1(bridge_slave_0) entered forwarding state [ 585.683334][ T392] bridge0: port 2(bridge_slave_1) entered blocking state [ 585.685602][ T392] bridge0: port 2(bridge_slave_1) entered forwarding state [ 585.746573][T15521] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2674'. [ 585.790099][T15525] FAULT_INJECTION: forcing a failure. [ 585.790099][T15525] name failslab, interval 1, probability 0, space 0, times 0 [ 585.795200][T15525] CPU: 0 UID: 0 PID: 15525 Comm: syz.2.2675 Tainted: G L syzkaller #0 PREEMPT(full) [ 585.795218][T15525] Tainted: [L]=SOFTLOCKUP [ 585.795223][T15525] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 585.795229][T15525] Call Trace: [ 585.795233][T15525] [ 585.795238][T15525] dump_stack_lvl+0x100/0x190 [ 585.795254][T15525] should_fail_ex.cold+0x5/0xa [ 585.795268][T15525] should_failslab+0xc2/0x120 [ 585.795283][T15525] __kmalloc_cache_noprof+0x91/0x6c0 [ 585.795295][T15525] ? snd_seq_create_port+0xcf/0x590 [ 585.795314][T15525] snd_seq_create_port+0xcf/0x590 [ 585.795331][T15525] snd_seq_ioctl_create_port+0x250/0x9e0 [ 585.795348][T15525] ? __pfx_snd_seq_ioctl_create_port+0x10/0x10 [ 585.795364][T15525] ? __pfx_sprintf+0x10/0x10 [ 585.795376][T15525] ? do_dentry_open+0x6ab/0x14d0 [ 585.795389][T15525] ? do_sys_openat2+0x10f/0x1e0 [ 585.795404][T15525] call_seq_client_ctl+0xa3/0x130 [ 585.795425][T15525] snd_seq_kernel_client_ctl+0x77/0xd0 [ 585.795442][T15525] create_port+0x19b/0x270 [ 585.795458][T15525] ? __pfx_create_port+0x10/0x10 [ 585.795477][T15525] ? __pfx_snd_seq_oss_event_input+0x10/0x10 [ 585.795488][T15525] ? __pfx_free_devinfo+0x10/0x10 [ 585.795530][T15525] ? find_held_lock+0x2b/0x80 [ 585.795547][T15525] ? mark_held_locks+0x40/0x70 [ 585.795565][T15525] snd_seq_oss_open+0x292/0xa10 [ 585.795578][T15525] odev_open+0x6f/0x90 [ 585.795593][T15525] ? __pfx_odev_open+0x10/0x10 [ 585.795608][T15525] soundcore_open+0x2e3/0x5a0 [ 585.795625][T15525] ? __pfx_soundcore_open+0x10/0x10 [ 585.795642][T15525] chrdev_open+0x234/0x6a0 [ 585.795653][T15525] ? __pfx_apparmor_file_open+0x10/0x10 [ 585.795666][T15525] ? __pfx_chrdev_open+0x10/0x10 [ 585.795678][T15525] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 585.795694][T15525] do_dentry_open+0x6ab/0x14d0 [ 585.795705][T15525] ? __pfx_chrdev_open+0x10/0x10 [ 585.795732][T15525] vfs_open+0x82/0x3f0 [ 585.795748][T15525] path_openat+0x2873/0x4280 [ 585.795765][T15525] ? __pfx_path_openat+0x10/0x10 [ 585.795780][T15525] do_file_open+0x20e/0x430 [ 585.795791][T15525] ? __lock_acquire+0x49f/0x1a40 [ 585.795808][T15525] ? __pfx_do_file_open+0x10/0x10 [ 585.795829][T15525] ? _raw_spin_unlock+0x28/0x50 [ 585.795840][T15525] ? alloc_fd+0x471/0x7a0 [ 585.795855][T15525] do_sys_openat2+0x10f/0x1e0 [ 585.795870][T15525] ? __pfx_do_sys_openat2+0x10/0x10 [ 585.795886][T15525] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 585.795903][T15525] __ia32_compat_sys_openat+0x12d/0x210 [ 585.795919][T15525] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 585.795934][T15525] ? fput+0x79/0x100 [ 585.795946][T15525] ? ksys_write+0x1ac/0x250 [ 585.795956][T15525] ? __pfx_ksys_write+0x10/0x10 [ 585.795969][T15525] __do_fast_syscall_32+0xe7/0x970 [ 585.795983][T15525] ? lockdep_hardirqs_on+0x78/0x100 [ 585.795997][T15525] do_fast_syscall_32+0x32/0x70 [ 585.796012][T15525] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 585.796026][T15525] RIP: 0023:0xf705efec [ 585.796040][T15525] Code: Unable to access opcode bytes at 0xf705efc2. [ 585.796045][T15525] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 585.796057][T15525] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000100 [ 585.796063][T15525] RDX: 000000000008ec02 RSI: 0000000000000000 RDI: 0000000000000000 [ 585.796070][T15525] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 585.796076][T15525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 585.796083][T15525] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 585.796097][T15525] [ 585.796160][T15525] ALSA: seq_oss: can't create port [ 585.969294][T15534] udc usbip-vudc.0: UDC had already stopped [ 585.983371][T15439] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 586.007435][T15439] veth0_vlan: entered promiscuous mode [ 586.012793][T15439] veth1_vlan: entered promiscuous mode [ 586.027613][T15439] veth0_macvtap: entered promiscuous mode [ 586.034816][T15439] veth1_macvtap: entered promiscuous mode [ 586.045596][T15439] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 586.054567][T15439] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 586.060889][T14057] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.063711][T14057] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.070385][T14057] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.073140][T14057] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.219216][ T163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 586.222900][ T163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 586.247327][ T1164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 586.255067][ T1164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 586.417997][T15552] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2682'. [ 586.450515][T15554] udc usbip-vudc.0: UDC had already stopped [ 586.490042][T15556] overlayfs: upper fs does not support file handles, falling back to index=off. [ 586.497562][T15556] overlayfs: failed to set uuid (165/file2, err=-1); falling back to uuid=null. [ 586.506663][T15547] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2651'. [ 586.510411][T15547] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2651'. [ 586.514764][T15547] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.517664][T15547] bridge0: port 1(bridge_slave_0) entered disabled state [ 586.576172][T15563] input: syz1 as /devices/virtual/input/input25 [ 586.917616][T15578] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2692'. [ 586.941726][T15582] udc usbip-vudc.0: UDC had already stopped [ 587.056456][T15594] udc usbip-vudc.0: UDC had already stopped [ 587.068907][T15593] FAULT_INJECTION: forcing a failure. [ 587.068907][T15593] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 587.072868][T15593] CPU: 2 UID: 0 PID: 15593 Comm: syz.0.2696 Tainted: G L syzkaller #0 PREEMPT(full) [ 587.072887][T15593] Tainted: [L]=SOFTLOCKUP [ 587.072891][T15593] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 587.072897][T15593] Call Trace: [ 587.072902][T15593] [ 587.072907][T15593] dump_stack_lvl+0x100/0x190 [ 587.072924][T15593] should_fail_ex.cold+0x5/0xa [ 587.072937][T15593] _copy_to_user+0x32/0xd0 [ 587.072955][T15593] __htab_map_lookup_and_delete_batch+0x1822/0x30a0 [ 587.072975][T15593] ? kernel_text_address+0x8d/0x100 [ 587.073000][T15593] ? __pfx___htab_map_lookup_and_delete_batch+0x10/0x10 [ 587.073021][T15593] ? __pfx_htab_lru_map_lookup_and_delete_batch+0x10/0x10 [ 587.073038][T15593] bpf_map_do_batch+0x2b2/0x6d0 [ 587.073055][T15593] __sys_bpf+0xeb8/0x4e80 [ 587.073071][T15593] ? __pfx___sys_bpf+0x10/0x10 [ 587.073083][T15593] ? find_held_lock+0x2b/0x80 [ 587.073097][T15593] ? get_pid_task+0xfc/0x250 [ 587.073110][T15593] ? get_pid_task+0xfc/0x250 [ 587.073126][T15593] ? proc_fail_nth_write+0x9f/0x220 [ 587.073141][T15593] ? find_held_lock+0x2b/0x80 [ 587.073157][T15593] ? rcu_read_lock_any_held+0x6a/0xa0 [ 587.073172][T15593] ? find_held_lock+0x2b/0x80 [ 587.073184][T15593] ? ksys_write+0x190/0x250 [ 587.073195][T15593] ? ksys_write+0x190/0x250 [ 587.073214][T15593] ? fput+0x79/0x100 [ 587.073228][T15593] ? __ia32_sys_bpf+0xcc/0x170 [ 587.073240][T15593] __ia32_sys_bpf+0xcc/0x170 [ 587.073252][T15593] ? __do_fast_syscall_32+0x98/0x970 [ 587.073267][T15593] __do_fast_syscall_32+0xe7/0x970 [ 587.073281][T15593] ? lockdep_hardirqs_on+0x78/0x100 [ 587.073295][T15593] do_fast_syscall_32+0x32/0x70 [ 587.073309][T15593] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 587.073323][T15593] RIP: 0023:0xf6fdefec [ 587.073338][T15593] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 587.073343][T15593] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 587.073354][T15593] RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 0000000080000280 [ 587.073361][T15593] RDX: 0000000000000038 RSI: 0000000000000000 RDI: 0000000000000000 [ 587.073368][T15593] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 587.073374][T15593] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 587.073380][T15593] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 587.073393][T15593] [ 587.298658][T15606] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2704'. [ 587.314892][ T5752] Bluetooth: hci2: command tx timeout [ 587.345485][T15609] udc usbip-vudc.0: UDC had already stopped [ 587.361247][T15612] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 587.476054][T15425] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 587.624692][T15425] usb 5-1: Using ep0 maxpacket: 8 [ 587.627785][T15425] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 587.631699][T15425] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 587.643083][T15425] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 587.646809][T15425] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 587.653387][T15425] usb 5-1: Product: syz [ 587.656512][T15425] usb 5-1: Manufacturer: syz [ 587.661402][T15425] usb 5-1: SerialNumber: syz [ 587.662861][T15629] udc usbip-vudc.0: UDC had already stopped [ 587.674852][T15425] usb 5-1: No union descriptors [ 587.678451][T15425] usbtest 5-1:1.0: couldn't get endpoints, -22 [ 587.682010][T15425] usbtest 5-1:1.0: probe with driver usbtest failed with error -22 [ 587.887457][T15601] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 587.899171][T15601] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 587.956990][T15638] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2714'. [ 588.264117][T15425] usb 8-1: new low-speed USB device number 43 using dummy_hcd [ 588.414148][T15425] usb 8-1: Invalid ep0 maxpacket: 64 [ 588.544192][T15425] usb 8-1: new low-speed USB device number 44 using dummy_hcd [ 588.600737][T15648] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2717'. [ 588.694082][T15425] usb 8-1: Invalid ep0 maxpacket: 64 [ 588.696085][T15425] usb usb8-port1: attempt power cycle [ 589.034073][T15425] usb 8-1: new low-speed USB device number 45 using dummy_hcd [ 589.054515][T15425] usb 8-1: Invalid ep0 maxpacket: 64 [ 589.185707][T15425] usb 8-1: new low-speed USB device number 46 using dummy_hcd [ 589.206835][T15425] usb 8-1: Invalid ep0 maxpacket: 64 [ 589.210108][T15425] usb usb8-port1: unable to enumerate USB device [ 589.384445][ T5752] Bluetooth: hci2: command tx timeout [ 589.500148][T15666] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2723'. [ 589.560486][T15670] FAT-fs (nullb0): bogus number of reserved sectors [ 589.562643][T15670] FAT-fs (nullb0): Can't find a valid FAT filesystem [ 589.614406][ T1045] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 590.247050][ T50] usb 5-1: USB disconnect, device number 75 [ 590.266476][ T1045] usb 6-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 590.419571][ T1045] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 590.430590][ T1045] i2c-tiny-usb 6-1:1.0: version 1.00 found at bus 006 address 069 [ 590.507098][T15685] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2732'. [ 590.823328][T15695] netlink: 'syz.2.2735': attribute type 2 has an invalid length. [ 590.836761][ T1045] (null): failure reading functionality [ 590.839242][ T1045] i2c i2c-2: failure reading functionality [ 590.846765][ T1045] i2c i2c-2: connected i2c-tiny-usb device [ 591.006272][T15702] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2737'. [ 591.026037][T15702] syzkaller0: entered promiscuous mode [ 591.027829][T15702] syzkaller0: entered allmulticast mode [ 591.030825][T11639] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 591.035193][T11639] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 591.053093][T15702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 591.057925][T15702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 591.067284][T15702] tipc: Enabled bearer , priority 0 [ 591.089184][T15705] bridge0: port 3(netdevsim1) entered blocking state [ 591.093075][T15705] bridge0: port 3(netdevsim1) entered disabled state [ 591.103696][T15705] netdevsim netdevsim3 netdevsim1: entered allmulticast mode [ 591.119325][T15705] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 591.129566][T15705] bridge0: port 3(netdevsim1) entered blocking state [ 591.131675][T15705] bridge0: port 3(netdevsim1) entered listening state [ 591.185261][ C2] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 591.454054][ C2] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 591.456480][ C2] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 591.464690][ T5752] Bluetooth: hci2: command tx timeout [ 591.488602][T15706] lo speed is unknown, defaulting to 1000 [ 591.515344][T15710] bond1: (slave ip6gretap1): making interface the new active one [ 591.524877][T15710] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 591.762195][T15710] netlink: 'syz.3.2739': attribute type 10 has an invalid length. [ 591.768422][T15710] bridge0: port 3(netdevsim1) entered disabled state [ 591.770630][T15710] bridge0: port 2(bridge_slave_1) entered disabled state [ 591.772891][T15710] bridge0: port 1(bridge_slave_0) entered disabled state [ 591.895728][T15700] tipc: Resetting bearer [ 591.921652][T15700] tipc: Disabling bearer [ 591.971350][T15715] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2741'. [ 592.111002][T15720] tmpfs: Unknown parameter 'mpol' [ 592.115714][T15720] random: crng reseeded on system resumption [ 592.159614][T15722] netlink: 'syz.2.2744': attribute type 3 has an invalid length. [ 592.162637][T15722] netlink: 'syz.2.2744': attribute type 3 has an invalid length. [ 592.166255][T15722] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2744'. [ 592.376403][T15725] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(7) [ 592.378456][T15725] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 592.384152][T15725] vhci_hcd vhci_hcd.0: Device attached [ 592.402617][ T50] usb 6-1: USB disconnect, device number 69 [ 592.439033][T15729] netlink: 'syz.3.2745': attribute type 2 has an invalid length. [ 592.674800][T13125] usb 42-1: SetAddress Request (10) to port 0 [ 592.683184][T13125] usb 42-1: new SuperSpeed USB device number 10 using vhci_hcd [ 592.690248][T15737] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2748'. [ 592.711548][T15737] FAULT_INJECTION: forcing a failure. [ 592.711548][T15737] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 592.724125][T15737] CPU: 2 UID: 0 PID: 15737 Comm: syz.3.2748 Tainted: G L syzkaller #0 PREEMPT(full) [ 592.724153][T15737] Tainted: [L]=SOFTLOCKUP [ 592.724160][T15737] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 592.724169][T15737] Call Trace: [ 592.724176][T15737] [ 592.724183][T15737] dump_stack_lvl+0x100/0x190 [ 592.724206][T15737] should_fail_ex.cold+0x5/0xa [ 592.724226][T15737] _copy_to_user+0x32/0xd0 [ 592.724251][T15737] simple_read_from_buffer+0xcb/0x170 [ 592.724295][T15737] proc_fail_nth_read+0x1af/0x230 [ 592.724319][T15737] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 592.724342][T15737] ? rw_verify_area+0xce/0x6d0 [ 592.724364][T15737] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 592.724387][T15737] vfs_read+0x1e4/0xb40 [ 592.724408][T15737] ? __pfx_vfs_read+0x10/0x10 [ 592.724430][T15737] ? find_held_lock+0x2b/0x80 [ 592.724452][T15737] ? __fget_files+0x215/0x3d0 [ 592.724472][T15737] ? __fget_files+0x21f/0x3d0 [ 592.724494][T15737] ksys_read+0x12a/0x250 [ 592.724510][T15737] ? __pfx_ksys_read+0x10/0x10 [ 592.724532][T15737] do_int80_emulation+0x14b/0x720 [ 592.724557][T15737] asm_int80_emulation+0x1a/0x20 [ 592.724574][T15737] RIP: 0023:0xf71472eb [ 592.724589][T15737] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 592.724605][T15737] RSP: 002b:00000000f54064bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 592.724622][T15737] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000f54065d0 [ 592.724633][T15737] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 592.724643][T15737] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 592.724651][T15737] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 592.724661][T15737] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 592.724684][T15737] [ 592.740999][T15739] pim6reg: entered allmulticast mode [ 592.820375][T15740] pim6reg: left allmulticast mode [ 592.834793][T15742] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2750'. [ 592.904924][T15739] input: syz0 as /devices/virtual/input/input26 [ 592.967423][T15747] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2751'. [ 593.007733][T15726] vhci_hcd: connection reset by peer [ 593.010975][T14057] vhci_hcd vhci_hcd.2: stop threads [ 593.013482][T14057] vhci_hcd vhci_hcd.2: release socket [ 593.022396][T14057] vhci_hcd vhci_hcd.2: disconnect device [ 593.217470][T15760] netlink: 'syz.0.2755': attribute type 2 has an invalid length. [ 593.414010][ T50] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 593.528324][T15782] FAT-fs (nullb0): bogus number of reserved sectors [ 593.534081][T15782] FAT-fs (nullb0): Can't find a valid FAT filesystem [ 593.570704][ T50] usb 6-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 593.574865][ T50] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 593.585536][ T50] i2c-tiny-usb 6-1:1.0: version 1.00 found at bus 006 address 070 [ 593.638956][T15788] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2760'. [ 594.012142][T15804] pim6reg: entered allmulticast mode [ 594.025022][ T50] (null): failure reading functionality [ 594.029496][T15804] pim6reg: left allmulticast mode [ 594.133447][T15804] input: syz0 as /devices/virtual/input/input27 [ 594.320029][T15812] FAULT_INJECTION: forcing a failure. [ 594.320029][T15812] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 594.324880][T15812] CPU: 0 UID: 0 PID: 15812 Comm: syz.2.2764 Tainted: G L syzkaller #0 PREEMPT(full) [ 594.324899][T15812] Tainted: [L]=SOFTLOCKUP [ 594.324904][T15812] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 594.324911][T15812] Call Trace: [ 594.324915][T15812] [ 594.324920][T15812] dump_stack_lvl+0x100/0x190 [ 594.324936][T15812] should_fail_ex.cold+0x5/0xa [ 594.324947][T15812] ? __pfx___might_resched+0x10/0x10 [ 594.324966][T15812] _copy_from_user+0x2e/0xd0 [ 594.324983][T15812] copy_folio_from_user+0x249/0x330 [ 594.324997][T15812] hugetlb_mfill_atomic_pte+0xbb6/0x16f0 [ 594.325020][T15812] ? __pfx_hugetlb_mfill_atomic_pte+0x10/0x10 [ 594.325040][T15812] ? huge_pte_alloc+0x4ce/0x730 [ 594.325052][T15812] mfill_atomic_copy+0xd96/0x16c0 [ 594.325076][T15812] ? __pfx_mfill_atomic_copy+0x10/0x10 [ 594.325094][T15812] ? find_held_lock+0x2b/0x80 [ 594.325114][T15812] userfaultfd_ioctl+0x2dee/0x5990 [ 594.325124][T15812] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 594.325139][T15812] ? get_pid_task+0x106/0x250 [ 594.325158][T15812] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 594.325169][T15812] ? do_vfs_ioctl+0x226/0x13e0 [ 594.325184][T15812] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 594.325204][T15812] ? find_held_lock+0x2b/0x80 [ 594.325217][T15812] ? __fget_files+0x215/0x3d0 [ 594.325227][T15812] ? hook_file_ioctl_common+0x140/0x440 [ 594.325244][T15812] ? __fget_files+0x21f/0x3d0 [ 594.325255][T15812] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 594.325266][T15812] ? compat_ptr_ioctl+0x6e/0xa0 [ 594.325280][T15812] compat_ptr_ioctl+0x6e/0xa0 [ 594.325294][T15812] ? __pfx_compat_ptr_ioctl+0x10/0x10 [ 594.325309][T15812] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 594.325326][T15812] __do_fast_syscall_32+0xe7/0x970 [ 594.325341][T15812] ? lockdep_hardirqs_on+0x78/0x100 [ 594.325355][T15812] do_fast_syscall_32+0x32/0x70 [ 594.325369][T15812] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 594.325384][T15812] RIP: 0023:0xf705efec [ 594.325399][T15812] Code: Unable to access opcode bytes at 0xf705efc2. [ 594.325404][T15812] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 594.325415][T15812] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c028aa03 [ 594.325422][T15812] RDX: 0000000080000240 RSI: 0000000000000000 RDI: 0000000000000000 [ 594.325428][T15812] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 594.325434][T15812] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 594.325440][T15812] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 594.325454][T15812] [ 594.489055][ T50] i2c i2c-2: failure reading functionality [ 594.526609][T15814] ehci-pci 0000:00:1d.7: remove, state 1 [ 594.540052][T15814] usb usb1: USB disconnect, device number 1 [ 594.553193][T15814] usb 1-1: USB disconnect, device number 2 [ 594.566496][ T50] i2c i2c-2: connected i2c-tiny-usb device [ 594.729014][T15814] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 594.894129][ T1045] usb 8-1: new high-speed USB device number 47 using dummy_hcd [ 594.935705][T15815] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 594.951456][T15815] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 594.959043][T15815] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 595.054289][T15815] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 595.068280][T15815] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 595.072693][ T1045] usb 8-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 595.072715][ T1045] usb 8-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 595.072727][ T1045] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 595.082825][T15815] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 595.085374][T15815] usb usb1: Product: EHCI Host Controller [ 595.087086][T15815] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 595.089017][T15815] usb usb1: SerialNumber: 0000:00:1d.7 qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x270000) [ 595.157796][T15815] hub 1-0:1.0: USB hub found [ 595.165955][T15815] hub 1-0:1.0: 6 ports detected [ 595.167958][ T1134] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 595.170052][ T1134] ata1: failed to read log page 10h (errno=-5) [ 595.172041][ T1134] ata1.00: NCQ disabled due to excessive errors [ 595.176027][ T1134] ata1.00: exception Emask 0x1 SAct 0x8000000 SErr 0x0 action 0x0 [ 595.179033][ T1134] ata1.00: irq_stat 0x41000000 [ 595.182724][ T1134] ata1.00: failed command: READ FPDMA QUEUED [ 595.186365][ T1134] ata1.00: cmd 60/80:d8:6e:32:01/13:00:00:00:00/40 tag 27 ncq dma 2555904 in [ 595.186365][ T1134] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 595.191856][ T1134] ata1.00: status: { DRDY } [ 595.193436][ T1134] ata1.00: error: { ABRT } [ 595.196073][ T1134] ata1.00: configured for UDMA/100 [ 595.198097][ T1134] sd 0:0:0:0: [sda] tag#27 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s [ 595.201180][ T1134] sd 0:0:0:0: [sda] tag#27 Sense Key : Aborted Command [current] [ 595.203726][ T1134] sd 0:0:0:0: [sda] tag#27 Add. Sense: No additional sense information [ 595.206678][ T1134] sd 0:0:0:0: [sda] tag#27 CDB: Read(10) 28 00 00 01 32 6e 00 13 80 00 [ 595.209393][ T1134] blk_print_req_error: 11 callbacks suppressed [ 595.209403][ T1134] I/O error, dev sda, sector 78446 op 0x0:(READ) flags 0x80700 phys_seg 86 prio class 2 [ 595.215279][ T1134] ata1: EH complete [ 595.235166][ T5752] Bluetooth: hci4: command 0x0406 tx timeout [ 595.247085][T15815] hub 3-0:1.0: USB hub found [ 595.251348][T15539] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 595.261342][T15815] hub 3-0:1.0: 2 ports detected [ 595.263577][T15539] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 595.330182][T15815] hub 4-0:1.0: USB hub found [ 595.333305][T15815] hub 4-0:1.0: 2 ports detected [ 595.446201][ T50] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 595.491116][T15836] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2773'. [ 595.631803][ T50] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 595.635639][ T50] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 595.638436][ T50] usb 1-1: Product: QEMU USB Tablet [ 595.640200][ T50] usb 1-1: Manufacturer: QEMU [ 595.641796][ T50] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 595.657154][T15840] rdma_rxe: rxe_newlink: failed to add lo [ 595.675636][ T50] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0003/input/input28 [ 595.700919][ T50] hid-generic 0003:0627:0001.0003: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 595.973759][T15845] FAULT_INJECTION: forcing a failure. [ 595.973759][T15845] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 595.978992][T15845] CPU: 2 UID: 0 PID: 15845 Comm: syz.2.2777 Tainted: G L syzkaller #0 PREEMPT(full) [ 595.979009][T15845] Tainted: [L]=SOFTLOCKUP [ 595.979013][T15845] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 595.979020][T15845] Call Trace: [ 595.979024][T15845] [ 595.979029][T15845] dump_stack_lvl+0x100/0x190 [ 595.979045][T15845] should_fail_ex.cold+0x5/0xa [ 595.979058][T15845] _copy_to_iter+0x1f3/0x1720 [ 595.979077][T15845] ? __pfx__copy_to_iter+0x10/0x10 [ 595.979092][T15845] ? shmem_get_folio_gfp+0x503/0x1910 [ 595.979108][T15845] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 595.979121][T15845] copy_page_to_iter+0x285/0x370 [ 595.979139][T15845] shmem_file_read_iter+0x78b/0xba0 [ 595.979156][T15845] ? __pfx_shmem_file_read_iter+0x10/0x10 [ 595.979169][T15845] ? rw_verify_area+0xce/0x6d0 [ 595.979185][T15845] ? __pfx_shmem_file_read_iter+0x10/0x10 [ 595.979202][T15845] vfs_read+0x82e/0xb40 [ 595.979214][T15845] ? __pfx_vfs_read+0x10/0x10 [ 595.979230][T15845] ? find_held_lock+0x2b/0x80 [ 595.979252][T15845] ksys_read+0x12a/0x250 [ 595.979261][T15845] ? __pfx_ksys_read+0x10/0x10 [ 595.979271][T15845] ? ksys_write+0x1ac/0x250 [ 595.979281][T15845] ? __pfx_ksys_write+0x10/0x10 [ 595.979293][T15845] __do_fast_syscall_32+0xe7/0x970 [ 595.979308][T15845] ? lockdep_hardirqs_on+0x78/0x100 [ 595.979322][T15845] do_fast_syscall_32+0x32/0x70 [ 595.979336][T15845] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 595.979350][T15845] RIP: 0023:0xf705efec [ 595.979376][T15845] Code: Unable to access opcode bytes at 0xf705efc2. [ 595.979382][T15845] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000003 [ 595.979393][T15845] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080002f40 [ 595.979400][T15845] RDX: 00000000fffffd24 RSI: 0000000000000000 RDI: 0000000000000000 [ 595.979406][T15845] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 595.979412][T15845] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 595.979419][T15845] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 595.979433][T15845] [ 596.177486][T15846] i2c i2c-2: failure reading status [ 596.179684][ T5904] usb 6-1: USB disconnect, device number 70 [ 596.187259][T15846] ucsi-stm32g0-i2c 2-0003: i2c read 03, 00 error: -5 [ 596.193047][T15846] ------------[ cut here ]------------ [ 596.195144][T15846] inode->i_nlink == 0 [ 596.195153][T15846] WARNING: fs/inode.c:408 at drop_nlink+0xb6/0xe0, CPU#2: syz.3.2766/15846 [ 596.199743][T15846] Modules linked in: [ 596.201119][T15846] CPU: 2 UID: 0 PID: 15846 Comm: syz.3.2766 Tainted: G L syzkaller #0 PREEMPT(full) [ 596.205214][T15846] Tainted: [L]=SOFTLOCKUP [ 596.207083][T15846] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 596.210014][T15846] RIP: 0010:drop_nlink+0xb6/0xe0 [ 596.211456][T15846] Code: 08 00 00 00 48 8d bb 98 07 00 00 e8 04 92 e3 ff f0 48 ff 83 98 07 00 00 e8 57 ff 73 ff 5b 5d e9 50 f4 25 09 e8 4b ff 73 ff 90 <0f> 0b 90 c7 45 48 ff ff ff ff e8 3b ff 73 ff 5b 5d c3 cc cc cc cc [ 596.217299][T15846] RSP: 0018:ffffc90000baf628 EFLAGS: 00010287 [ 596.219276][T15846] RAX: 00000000000040d2 RBX: 0000000000000000 RCX: ffffc90031157000 [ 596.221571][T15846] RDX: 0000000000080000 RSI: ffffffff8295ad15 RDI: ffff88801cf40000 [ 596.224183][T15846] RBP: ffff88804451db70 R08: 0000000000000005 R09: 0000000000000000 [ 596.227002][T15846] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88804451db70 [ 596.229645][T15846] R13: dffffc0000000000 R14: ffff888013e0fa70 R15: ffff8880506ec358 [ 596.232073][T15846] FS: 0000000000000000(0000) GS:ffff888096de3000(0063) knlGS:00000000f53c4b40 [ 596.234994][T15846] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 596.237029][T15846] CR2: 000000005720e1fc CR3: 000000002a78a000 CR4: 0000000000352ef0 [ 596.241113][T15846] Call Trace: [ 596.242142][T15846] [ 596.243038][T15846] __simple_recursive_removal+0x4c2/0x5c0 [ 596.245028][T15846] ? __pfx_remove_one+0x10/0x10 [ 596.246473][T15846] ? mntput+0x70/0xa0 SYZFAIL: failed to recv rpc [ 596.248250][T15846] debugfs_remove+0x5d/0x80 fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 596.250174][T15846] i2c_device_probe+0x6e2/0xd10 [ 596.251657][T15846] ? kernfs_put+0x3f/0x60 [ 596.252962][T15846] ? __pfx_i2c_device_probe+0x10/0x10 [ 596.255009][T15846] ? sysfs_create_link+0x68/0xc0 [ 596.256554][T15846] ? __pfx_i2c_device_probe+0x10/0x10 [ 596.258165][T15846] really_probe+0x241/0xa60 [ 596.259536][T15846] __driver_probe_device+0x20e/0x450 [ 596.261153][T15846] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 596.262916][T15846] driver_probe_device+0x4a/0x140 [ 596.264647][T15846] __device_attach_driver+0x1df/0x320 [ 596.266392][T15846] ? __pfx___device_attach_driver+0x10/0x10 [ 596.268215][T15846] bus_for_each_drv+0x159/0x1e0 [ 596.269745][T15846] ? __pfx_bus_for_each_drv+0x10/0x10 [ 596.271386][T15846] ? lockdep_hardirqs_on+0x78/0x100 [ 596.272978][T15846] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 596.274825][T15846] __device_attach+0x1e4/0x4d0 [ 596.276254][T15846] ? __pfx___device_attach+0x10/0x10 [ 596.277871][T15846] ? do_raw_spin_unlock+0x145/0x1e0 [ 596.279514][T15846] device_initial_probe+0xaf/0xd0 [ 596.281076][T15846] bus_probe_device+0x64/0x160 [ 596.282489][T15846] device_add+0x121d/0x1970 [ 596.283864][T15846] ? __pfx_device_add+0x10/0x10 [ 596.285415][T15846] ? lockdep_init_map_type+0x5c/0x250 [ 596.286986][T15846] ? __init_waitqueue_head+0xca/0x150 [ 596.288520][T15846] i2c_new_client_device+0x660/0xd30 [ 596.290120][T15846] new_device_store+0x20f/0x420 [ 596.291560][T15846] ? __lock_acquire+0x49f/0x1a40 [ 596.293088][T15846] ? __pfx_new_device_store+0x10/0x10 [ 596.294711][T15846] ? find_held_lock+0x2b/0x80 [ 596.296124][T15846] ? sysfs_file_kobj+0xe4/0x290 [ 596.297582][T15846] ? sysfs_file_kobj+0xe4/0x290 [ 596.299049][T15846] ? __pfx_new_device_store+0x10/0x10 [ 596.300692][T15846] dev_attr_store+0x58/0x80 [ 596.302047][T15846] ? __pfx_dev_attr_store+0x10/0x10 [ 596.303645][T15846] sysfs_kf_write+0xf2/0x150 [ 596.305134][T15846] kernfs_fop_write_iter+0x3e0/0x5f0 [ 596.307151][T15846] ? __pfx_sysfs_kf_write+0x10/0x10 [ 596.308776][T15846] vfs_write+0x6ac/0x1050 [ 596.310110][T15846] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 596.312152][T15846] ? __pfx_vfs_write+0x10/0x10 [ 596.313563][T15846] ? find_held_lock+0x2b/0x80 [ 596.315076][T15846] ksys_write+0x12a/0x250 [ 596.316368][T15846] ? __pfx_ksys_write+0x10/0x10 [ 596.317907][T15846] __do_fast_syscall_32+0xe7/0x970 [ 596.319511][T15846] do_fast_syscall_32+0x32/0x70 [ 596.321002][T15846] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 596.322876][T15846] RIP: 0023:0xf7f47fec [ 596.324158][T15846] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 596.326227][T15846] RSP: 002b:00000000f53c450c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 596.328749][T15846] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000080000a00 [ 596.331067][T15846] RDX: 0000000000000011 RSI: 0000000000000000 RDI: 0000000000000000 [ 596.333456][T15846] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 596.335881][T15846] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 596.338234][T15846] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 596.340627][T15846] [ 596.341578][T15846] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 596.343699][T15846] CPU: 2 UID: 0 PID: 15846 Comm: syz.3.2766 Tainted: G L syzkaller #0 PREEMPT(full) [ 596.346808][T15846] Tainted: [L]=SOFTLOCKUP [ 596.348152][T15846] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 596.351116][T15846] Call Trace: [ 596.352130][T15846] [ 596.353025][T15846] dump_stack_lvl+0x100/0x190 [ 596.354442][T15846] vpanic+0x552/0x970 [ 596.355643][T15846] ? __pfx_vpanic+0x10/0x10 [ 596.356981][T15846] panic+0xd1/0xe0 [ 596.358115][T15846] ? __pfx_panic+0x10/0x10 [ 596.359492][T15846] check_panic_on_warn.cold+0x19/0x34 [ 596.361064][T15846] ? drop_nlink+0xb6/0xe0 [ 596.362404][T15846] __warn.cold+0x191/0x318 [ 596.363763][T15846] __report_bug+0x30f/0x440 [ 596.365141][T15846] ? drop_nlink+0xb6/0xe0 [ 596.366429][T15846] ? __pfx___report_bug+0x10/0x10 [ 596.367936][T15846] ? lockdep_hardirqs_on+0x78/0x100 [ 596.369566][T15846] ? irqentry_exit+0x24d/0xa00 [ 596.371069][T15846] ? drop_nlink+0xb6/0xe0 [ 596.372375][T15846] ? drop_nlink+0xb6/0xe0 [ 596.373711][T15846] report_bug+0xb2/0x220 [ 596.374999][T15846] ? drop_nlink+0xb6/0xe0 [ 596.376293][T15846] handle_bug+0x16a/0x2a0 [ 596.377640][T15846] exc_invalid_op+0x17/0x50 [ 596.379069][T15846] asm_exc_invalid_op+0x1a/0x20 [ 596.380606][T15846] RIP: 0010:drop_nlink+0xb6/0xe0 [ 596.382093][T15846] Code: 08 00 00 00 48 8d bb 98 07 00 00 e8 04 92 e3 ff f0 48 ff 83 98 07 00 00 e8 57 ff 73 ff 5b 5d e9 50 f4 25 09 e8 4b ff 73 ff 90 <0f> 0b 90 c7 45 48 ff ff ff ff e8 3b ff 73 ff 5b 5d c3 cc cc cc cc [ 596.387819][T15846] RSP: 0018:ffffc90000baf628 EFLAGS: 00010287 [ 596.389728][T15846] RAX: 00000000000040d2 RBX: 0000000000000000 RCX: ffffc90031157000 [ 596.392089][T15846] RDX: 0000000000080000 RSI: ffffffff8295ad15 RDI: ffff88801cf40000 [ 596.394408][T15846] RBP: ffff88804451db70 R08: 0000000000000005 R09: 0000000000000000 [ 596.396790][T15846] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88804451db70 [ 596.399212][T15846] R13: dffffc0000000000 R14: ffff888013e0fa70 R15: ffff8880506ec358 [ 596.401707][T15846] ? drop_nlink+0xb5/0xe0 [ 596.403078][T15846] ? drop_nlink+0xb5/0xe0 [ 596.404469][T15846] __simple_recursive_removal+0x4c2/0x5c0 [ 596.406254][T15846] ? __pfx_remove_one+0x10/0x10 [ 596.407801][T15846] ? mntput+0x70/0xa0 [ 596.409010][T15846] debugfs_remove+0x5d/0x80 [ 596.410380][T15846] i2c_device_probe+0x6e2/0xd10 [ 596.411814][T15846] ? kernfs_put+0x3f/0x60 [ 596.413171][T15846] ? __pfx_i2c_device_probe+0x10/0x10 [ 596.414832][T15846] ? sysfs_create_link+0x68/0xc0 [ 596.416445][T15846] ? __pfx_i2c_device_probe+0x10/0x10 [ 596.418157][T15846] really_probe+0x241/0xa60 [ 596.419637][T15846] __driver_probe_device+0x20e/0x450 [ 596.421273][T15846] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 596.422983][T15846] driver_probe_device+0x4a/0x140 [ 596.424465][T15846] __device_attach_driver+0x1df/0x320 [ 596.426053][T15846] ? __pfx___device_attach_driver+0x10/0x10 [ 596.427836][T15846] bus_for_each_drv+0x159/0x1e0 [ 596.429300][T15846] ? __pfx_bus_for_each_drv+0x10/0x10 [ 596.430896][T15846] ? lockdep_hardirqs_on+0x78/0x100 [ 596.432524][T15846] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 596.434303][T15846] __device_attach+0x1e4/0x4d0 [ 596.435719][T15846] ? __pfx___device_attach+0x10/0x10 [ 596.437329][T15846] ? do_raw_spin_unlock+0x145/0x1e0 [ 596.438874][T15846] device_initial_probe+0xaf/0xd0 [ 596.440369][T15846] bus_probe_device+0x64/0x160 [ 596.441800][T15846] device_add+0x121d/0x1970 [ 596.443178][T15846] ? __pfx_device_add+0x10/0x10 [ 596.444644][T15846] ? lockdep_init_map_type+0x5c/0x250 [ 596.446293][T15846] ? __init_waitqueue_head+0xca/0x150 [ 596.448026][T15846] i2c_new_client_device+0x660/0xd30 [ 596.449694][T15846] new_device_store+0x20f/0x420 [ 596.451213][T15846] ? __lock_acquire+0x49f/0x1a40 [ 596.452756][T15846] ? __pfx_new_device_store+0x10/0x10 [ 596.454307][T15846] ? find_held_lock+0x2b/0x80 [ 596.455721][T15846] ? sysfs_file_kobj+0xe4/0x290 [ 596.457182][T15846] ? sysfs_file_kobj+0xe4/0x290 [ 596.458684][T15846] ? __pfx_new_device_store+0x10/0x10 [ 596.460273][T15846] dev_attr_store+0x58/0x80 [ 596.461688][T15846] ? __pfx_dev_attr_store+0x10/0x10 [ 596.463302][T15846] sysfs_kf_write+0xf2/0x150 [ 596.464731][T15846] kernfs_fop_write_iter+0x3e0/0x5f0 [ 596.466254][T15846] ? __pfx_sysfs_kf_write+0x10/0x10 [ 596.467826][T15846] vfs_write+0x6ac/0x1050 [ 596.469141][T15846] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 596.470931][T15846] ? __pfx_vfs_write+0x10/0x10 [ 596.472424][T15846] ? find_held_lock+0x2b/0x80 [ 596.473895][T15846] ksys_write+0x12a/0x250 [ 596.475227][T15846] ? __pfx_ksys_write+0x10/0x10 [ 596.476733][T15846] __do_fast_syscall_32+0xe7/0x970 [ 596.478312][T15846] do_fast_syscall_32+0x32/0x70 [ 596.479765][T15846] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 596.481591][T15846] RIP: 0023:0xf7f47fec [ 596.482812][T15846] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 596.484784][T15846] RSP: 002b:00000000f53c450c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 596.487224][T15846] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000080000a00 [ 596.489588][T15846] RDX: 0000000000000011 RSI: 0000000000000000 RDI: 0000000000000000 [ 596.491912][T15846] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 596.494186][T15846] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 596.496505][T15846] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 596.498881][T15846] [ 596.500359][T15846] Kernel Offset: disabled [ 596.501642][T15846] Rebooting in 86400 seconds..