last executing test programs: 5m11.035581289s ago: executing program 0 (id=319): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) rseq(0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x9840) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000180)={0x53, 0xfffffffc, 0x6, 0x1, @buffer={0x300, 0x0, 0x0}, &(0x7f0000000500)="55a1a0995a02", 0x0, 0x0, 0x14, 0x0, 0x0}) shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000000540)=""/32) r2 = add_key(&(0x7f00000005c0)='id_resolver\x00', &(0x7f00000006c0)={'syz', 0x3}, &(0x7f0000000740)="f8", 0x1, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f0000000780)={0xffffffffffffffff}, 0x80) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=@getnexthop={0x20, 0x76, 0xb0d, 0x4000, 0x0, {0x3, 0x0, 0x0, 0x0, 0x4000000}, [@NHA_MASTER={0x5, 0xa, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x4044) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r3, 0xc3) pipe2$watch_queue(&(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r5, 0xe6) r6 = socket$inet(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f00000008c0)={0x2, 0x1144, @loopback}, 0x10) listen(r6, 0xa) r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000900), 0x2, 0x0) write(r7, &(0x7f0000000940)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=t', 0x31) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x66) migrate_pages(0x0, 0xcb, 0x0, &(0x7f00000009c0)=0x2) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r3, 0xffffffffffffffff) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@deltfilter={0x24, 0x2d, 0x800, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xffe0}, {0xe, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x10000}, 0x28) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000580)={0x0, 0x3}, 0x8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x7191, &(0x7f0000000640)={0x0, 0xd360, 0x40, 0x0, 0xe9}) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000700)=0xe, 0x4) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) dup(r8) 5m9.698288889s ago: executing program 0 (id=323): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x8005}, 0x4) r2 = socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$nl_rdma(0x10, 0x3, 0x14) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000880), r4) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r4, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)={0x24, r5, 0x1, 0x70bd2c, 0x0, {}, [@ETHTOOL_A_PRIVFLAGS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, 0x8}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x4}]}, 0x24}}, 0x0) r6 = openat$kvm(0xffffff9c, &(0x7f0000000680), 0x800, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000006c0)={0x1, &(0x7f0000000700)=[{0x6, 0xf, 0xf, 0x7fff8001}]}) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000780)={[0x12e8, 0x4, 0x88fd, 0xffffffffffffffff, 0x2, 0x8000003fe, 0x4002004c2, 0x1000, 0x4, 0x97, 0x3, 0x4, 0x9, 0x2, 0x200000000000001, 0x2000000000008], 0x1ffc, 0x514}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000840)={0x0, 0x1, 0xe000, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x20, 0x1405, 0x1, 0x70bd29, 0x25dfdbfc, "", [{{0x8}, {0x8, 0x3, 0x3}}]}, 0x20}, 0x1, 0x0, 0x0, 0x48000}, 0x1050) r9 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000500)={0x1, [0x0]}, &(0x7f0000000540)=0x8) sendmsg$inet_sctp(r9, &(0x7f0000000640)={&(0x7f0000000400)=@in={0x2, 0x4e21, @rand_addr=0x64010102}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000440)="151ae5d5ec39b54f4f35336170bb47493ff8c56b29f70c381ba864dbe9584542f37e668aa799536ff07ba4f5bfbb277f411d8469e3e6369347eb12bd6e5d3050d3f06c4e", 0x44}], 0x1, &(0x7f0000000580)=[@init={0x14, 0x84, 0x0, {0x3, 0x58da, 0x9, 0x6}}, @authinfo={0x10, 0x84, 0x6, {0x5}}, @dstaddrv4={0x10, 0x84, 0x7, @rand_addr=0x64010100}, @authinfo={0x10, 0x84, 0x6, {0x88}}, @prinfo={0x14, 0x84, 0x5, {0x20, 0x2}}, @prinfo={0x14, 0x84, 0x5, {0x30, 0xf35}}, @prinfo={0x14, 0x84, 0x5, {0x10, 0x3}}, @sndrcv={0x2c, 0x84, 0x1, {0x2, 0x4, 0x2, 0x46d0, 0x9, 0x8, 0x6f10, 0x4, r10}}], 0xac, 0x20000000}, 0x4030) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, &(0x7f0000000340)={'\x00', 0xb7, 0x5, 0x57bf, 0x80000000, 0x40, 0x0}) prlimit64(r11, 0xa, &(0x7f0000000380)={0x200}, &(0x7f00000003c0)) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) r12 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/sda\x00', 0x2, 0x0) ioctl$IOC_PR_RESERVE(r12, 0x401070c9, &(0x7f0000000300)={0x3c1842d, 0x1000, 0x3}) bind$l2tp6(r2, &(0x7f0000000140)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) bind$l2tp6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x20) close_range(r0, 0xffffffffffffffff, 0x0) 5m7.813855345s ago: executing program 0 (id=326): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0xa5, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffff3f54aaaaaaaaaa08004f04009700680000ff069078e000000100000000940a9b40f51983638a38890f746401010200000000ac1414aa", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="e10a0008907800801e10230c0400000000000000800000000402fe06e2d4c3d9fe06e2d4c3d90104020000003b2378b45fa666a7dcdf1525d366fb4b78fd6292b710a7a11bf055cd998f3f582303ca"], 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) munmap(&(0x7f0000583000/0x4000)=nil, 0x4000) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2a) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000680)=ANY=[@ANYBLOB="7400000040000901feffffff00000000017c0000040042800c00018006000600800a0000500002804c000380", @ANYBLOB="72b0538bfe1235"], 0x74}, 0x1, 0x0, 0x0, 0x48805}, 0x4800) r10 = syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x0, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x2, 0x268, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bd9a}}}, &(0x7f00000001c0)) syz_open_dev$ublk_chdev(&(0x7f0000002000), r10, 0x2) r11 = syz_open_dev$dri(&(0x7f0000000300), 0x1, 0x0) r12 = syz_open_dev$dri(&(0x7f0000000340), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r12, 0xc04064a0, &(0x7f0000000380)={0x0, &(0x7f0000000480)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_DIRTYFB(r11, 0xc01864b1, 0x0) 5m3.747885232s ago: executing program 0 (id=331): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) rseq(0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x9840) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000180)={0x53, 0xfffffffc, 0x6, 0x1, @buffer={0x300, 0x0, 0x0}, &(0x7f0000000500)="55a1a0995a02", 0x0, 0x0, 0x14, 0x0, 0x0}) shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000000540)=""/32) r2 = add_key(&(0x7f00000005c0)='id_resolver\x00', &(0x7f00000006c0)={'syz', 0x3}, &(0x7f0000000740)="f8", 0x1, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f0000000780)={0xffffffffffffffff}, 0x80) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=@getnexthop={0x20, 0x76, 0xb0d, 0x4000, 0x0, {0x3, 0x0, 0x0, 0x0, 0x4000000}, [@NHA_MASTER={0x5, 0xa, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x4044) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r3, 0xc3) pipe2$watch_queue(&(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r5, 0xe6) r6 = socket$inet(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f00000008c0)={0x2, 0x1144, @loopback}, 0x10) listen(r6, 0xa) r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000900), 0x2, 0x0) write(r7, &(0x7f0000000940)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=t', 0x31) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x66) migrate_pages(0x0, 0xcb, 0x0, &(0x7f00000009c0)=0x2) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r3, 0xffffffffffffffff) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@deltfilter={0x24, 0x2d, 0x800, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xffe0}, {0xe, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x10000}, 0x28) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000580)={0x0, 0x3}, 0x8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x7191, &(0x7f0000000640)={0x0, 0xd360, 0x40, 0x0, 0xe9}) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000700)=0xe, 0x4) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) dup(r8) 4m56.899518492s ago: executing program 0 (id=341): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/wireless\x00') read$FUSE(r2, &(0x7f0000006840)={0x2020}, 0x2020) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2) socket$netlink(0x10, 0x3, 0x4) mount(0x0, 0x0, &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) mq_open(&(0x7f0000000500)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a\x9e@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\x8a\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e*\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|L\xca%;5w?R', 0x2, 0x4, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r4) sendmsg$NL80211_CMD_RELOAD_REGDB(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r5, 0x501, 0x70bd2c, 0x25dfdbf8}, 0x14}, 0x1, 0x0, 0x0, 0x20008001}, 0x40) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4041) preadv(r2, &(0x7f0000000800)=[{&(0x7f00000000c0)=""/184, 0xb8}], 0x1, 0xfffffffe, 0x3) read$FUSE(r2, &(0x7f0000008880)={0x2020}, 0x2020) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000040)=@arm64) ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4104aec6, &(0x7f0000000d80)={0x1, [{0x1, 0x10, 0x101, &(0x7f0000000080)="29e3"}, {0x1, 0x10, 0xff, &(0x7f0000000180)="0ee0"}, {0x0, 0x0, 0xfffffff8, 0x0}, {0x2, 0x0, 0x7, 0x0}, {0x1, 0x0, 0x1, 0x0}, {0x2, 0x0, 0x80000001, 0x0}, {0x1, 0x0, 0x6f5, 0x0}, {0x2, 0x0, 0x2, 0x0}, {0x6, 0x0, 0xc6c2, 0x0}, {0xb7d4904c39f7106e, 0x0, 0x1, 0x0}, {0x2, 0x0, 0x6aa, 0x0}, {0x0, 0x0, 0x7, 0x0}, {0x49b7499af3df3cdb, 0x0, 0x7, 0x0}, {0x2, 0x0, 0x0, 0x0}, {0x2, 0x0, 0x1000000, 0x0}, {0x3, 0x0, 0x22f, 0x0}]}) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) r8 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000500)='crush_location\x00', &(0x7f0000000600)='rack:foo\x00', 0x0) close_range(r7, 0xffffffffffffffff, 0x0) 4m56.289325009s ago: executing program 0 (id=342): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000193c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000019400)={0x0, 0x0, &(0x7f0000019440)={&(0x7f0000019480)=ANY=[@ANYBLOB="480000001c00110c0000006a00000f0007000000", @ANYRES32=r4, @ANYBLOB="800202000a000200577f0000aabb000020000e"], 0x48}}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) open(&(0x7f00000194c0)='.\x00', 0x0, 0x0) sendmsg$kcm(r5, &(0x7f0000019500)={0x0, 0xfffffffffffffd2a, &(0x7f0000019540), 0x3}, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) write$nci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x102) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) ioctl$UFFDIO_MOVE(0xffffffffffffffff, 0xc028aa05, &(0x7f0000000000)={&(0x7f00009c3000/0x2000)=nil, &(0x7f000097a000/0x3000)=nil, 0x2000, 0x1}) mmap$KVM_VCPU(&(0x7f0000ffa000/0x3000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f0000019140)={0x0, 0x0, &(0x7f0000019180)={&(0x7f00000191c0)={0x50, 0x9, 0x6, 0x201, 0x0, 0x0, {0x3, 0x0, 0x8}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}, @IPSET_ATTR_IP2_TO={0xc, 0x16, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010101}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778625d52}, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000019240)='./cgroup.cpu/test\x00', 0x777) openat(0xffffffffffffff9c, &(0x7f0000019280)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f00000192c0)='10', 0x2) write(0xffffffffffffffff, &(0x7f0000000040)="9d6b1d0c2ed4496b5ab12234", 0xc) ioctl$BTRFS_IOC_SCRUB_CANCEL(r5, 0x941c, 0x0) 4m40.788048084s ago: executing program 32 (id=342): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000193c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000019400)={0x0, 0x0, &(0x7f0000019440)={&(0x7f0000019480)=ANY=[@ANYBLOB="480000001c00110c0000006a00000f0007000000", @ANYRES32=r4, @ANYBLOB="800202000a000200577f0000aabb000020000e"], 0x48}}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) open(&(0x7f00000194c0)='.\x00', 0x0, 0x0) sendmsg$kcm(r5, &(0x7f0000019500)={0x0, 0xfffffffffffffd2a, &(0x7f0000019540), 0x3}, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) write$nci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x102) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) ioctl$UFFDIO_MOVE(0xffffffffffffffff, 0xc028aa05, &(0x7f0000000000)={&(0x7f00009c3000/0x2000)=nil, &(0x7f000097a000/0x3000)=nil, 0x2000, 0x1}) mmap$KVM_VCPU(&(0x7f0000ffa000/0x3000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f0000019140)={0x0, 0x0, &(0x7f0000019180)={&(0x7f00000191c0)={0x50, 0x9, 0x6, 0x201, 0x0, 0x0, {0x3, 0x0, 0x8}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}, @IPSET_ATTR_IP2_TO={0xc, 0x16, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010101}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778625d52}, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000019240)='./cgroup.cpu/test\x00', 0x777) openat(0xffffffffffffff9c, &(0x7f0000019280)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f00000192c0)='10', 0x2) write(0xffffffffffffffff, &(0x7f0000000040)="9d6b1d0c2ed4496b5ab12234", 0xc) ioctl$BTRFS_IOC_SCRUB_CANCEL(r5, 0x941c, 0x0) 4.661122993s ago: executing program 4 (id=1520): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000004c0)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x16, 0x11, &(0x7f00000005c0)=ANY=[@ANYBLOB="18050000080000000000000000000000850000007b000000b7080000000000007b8af8ff00000000b7080000010400007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000000000085000000a500000095"], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000006c0)={r1, 0xfffff000, 0xe, 0x0, &(0x7f0000000740)="882f1242b009007d39f301003c60", 0x0, 0x990d, 0x7000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 4.538418669s ago: executing program 2 (id=1522): r0 = io_uring_setup(0x2a8d, &(0x7f0000000240)={0x0, 0x86a1, 0x2, 0x3, 0x1fb}) setns(0xc9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 4.537955092s ago: executing program 4 (id=1524): mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./sec\x00', &(0x7f0000000a80)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000ac0)='./sec/tomoyo/profile\x00', 0x1, 0x0) write(r0, &(0x7f0000000b00)="3c5c2a3ecd45036a2762bb626c65640a", 0x10) 3.698079085s ago: executing program 2 (id=1527): mknodat(0xffffffffffffff9c, &(0x7f0000000880)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f00000008c0)='./file2\x00', 0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000900)='./file7\x00', 0x2000, 0x103) mknodat(0xffffffffffffff9c, &(0x7f0000000940)='./file0\x00', 0x208c, 0x103) 3.463620969s ago: executing program 4 (id=1528): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./mnt\x00', 0x1ff) syz_usb_connect(0x0, 0x2d, &(0x7f0000000400)=ANY=[@ANYBLOB="12014000f273a440cd061501c3d90102030109021b0001000000000904"], 0x0) mount(0x0, &(0x7f0000000480)='mnt\x00', &(0x7f0000000840)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000880)='mnt/ttyUSB0\x00', 0x2, 0x0) 3.46321851s ago: executing program 2 (id=1531): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x41, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000440)={0x0, 0x0, 0xfffffff9, 0x6, 0x16, "0062007d8200f7ffffff00"}) ioctl$TIOCGPTPEER(r0, 0x5441, 0x10000) ioctl$TIOCGPTPEER(r0, 0x5441, 0x4fa5) 2.622643861s ago: executing program 4 (id=1533): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000ffdbdf253b00000008000300", @ANYRES32=r1, @ANYBLOB="2e003300d0000000ffffffffffff080211000000505050505050"], 0x4c}, 0x1, 0x0, 0x0, 0x20028805}, 0x24000846) 2.622510507s ago: executing program 2 (id=1534): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000500)={'wg2\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@newtfilter={0x4c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x5, 0xfff1}, {0x0, 0xfff3}, {0x9, 0xf}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x86dd}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x11}, @TCA_FLOWER_KEY_TCP_DST={0x6}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20041891}, 0x24000010) 2.181576308s ago: executing program 2 (id=1535): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x401, 0xfffffffc, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TCSETS(r2, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400004, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$TCSETS(r2, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, &(0x7f0000000140)={0x1}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="50000000030601080000000000006b000000000a050001000700000005000100070000000900299d73797a32000000001500097d169100000900020073797a31000000000900020073797a31000000009e83aab211cf97310576cb08cd8894d7f7044fc9b099434be750ab4476"], 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x8004) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x0, 0x1}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) bind$tipc(r4, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x3b, r6, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {}, {0x14, 0x19, {0x4, 0x1, 0xfffffffc, 0x2000000}}}}, 0xfd10}, 0x1, 0x0, 0x0, 0x4080}, 0x20001000) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0) inotify_init() 1.374983786s ago: executing program 4 (id=1536): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000001700)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000001740)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) syz_emit_ethernet(0x7a, &(0x7f0000001780)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv6={0x86dd, @gre_packet={0x1, 0x6, "f6ff01", 0x44, 0x2f, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88a8}, {}, {0xdd86, 0x88be, 0x3, {{0xc, 0x1, 0x8, 0x1, 0x1, 0x0, 0x4, 0x10}, 0x1, {0x7b43}}}, {0x8, 0x22eb, 0x2, {{0x3, 0x2, 0x2, 0x3, 0x0, 0x0, 0x1, 0x9}, 0x2, {0x5, 0xeb, 0x0, 0xd, 0x1, 0x1, 0x1, 0x1, 0x1}}}}}}}}}, 0x0) 770.335442ms ago: executing program 3 (id=1541): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/class/thermal/cooling_device0/cur_state\x00', 0x1, 0x0) write(r0, &(0x7f0000000080)='-', 0x1) 758.905831ms ago: executing program 3 (id=1543): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000000c0)={0x8, 0x1, 0xd8f9}) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x100000) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) 608.27209ms ago: executing program 4 (id=1545): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000040)=0x400007f) write$FUSE_DIRENT(r0, &(0x7f0000000340)=ANY=[], 0x128) read(r0, &(0x7f0000000280)=""/1, 0x1) 580.29572ms ago: executing program 2 (id=1546): r0 = syz_open_dev$usbfs(&(0x7f0000000180), 0x75, 0x109301) ioctl$USBDEVFS_SUBMITURB(r0, 0x802c550a, &(0x7f0000000280)=@urb_type_control={0x2, {0x0, 0x1}, 0x6, 0x80, &(0x7f00000002c0)={0x80, 0x14, 0xf801, 0x200}, 0x8, 0x8001, 0x0, 0x0, 0x1676ab34, 0xdffffff9, 0x0}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000300)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x0) 431.458674ms ago: executing program 3 (id=1548): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xc}, 0x40004) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0b040000000000000000020000000900010073797a30000000000900020073797a3200000000140000001100", @ANYRES8], 0x54}, 0x1, 0x0, 0x0, 0x2402c055}, 0x8010) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000030a01010000000000000000020000000900010073797a300000000038000000060a17d50000000000000000020000000900020073797a32000000000900010073797a30000000000c0003400000000000000002"], 0xcdc}, 0x1, 0x0, 0x0, 0x8000}, 0x20040010) 362.726858ms ago: executing program 1 (id=1550): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1f7) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000001600)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) lseek(r0, 0xb, 0x3) 351.306502ms ago: executing program 1 (id=1551): keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xd05}, 0x2a, 0x0) r0 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0x5ba8, 0xfffffffffffffffd) keyctl$read(0xb, r0, &(0x7f0000000240)=""/112, 0x349b7f55) 282.586108ms ago: executing program 3 (id=1552): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./mydev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./mydev/v4l-touch0\x00', 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000019680)={0x1, @vbi={0xe7, 0x9, 0x2, 0x3132564e, [0x80, 0x800], [0x80, 0x80000001], 0x2}}) 268.748568ms ago: executing program 1 (id=1553): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="2400000070000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="0c0002"], 0x24}}, 0x0) 236.329582ms ago: executing program 3 (id=1554): openat$comedi(0xffffff9c, &(0x7f00000002c0)='/dev/comedi4\x00', 0x20ac80, 0x0) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000300), 0x60442, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000380)='.\x00', &(0x7f00000003c0), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 180.399499ms ago: executing program 1 (id=1555): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x401, 0xfffffffc, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TCSETS(r2, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400004, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$TCSETS(r2, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, &(0x7f0000000140)={0x1}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="50000000030601080000000000006b000000000a050001000700000005000100070000000900299d73797a32000000001500097d169100000900020073797a31000000000900020073797a31000000009e83aab211cf97310576cb08cd8894d7f7044fc9b099434be750ab4476"], 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x8004) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x0, 0x1}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) bind$tipc(r4, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x3b, r6, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {}, {0x14, 0x19, {0x4, 0x1, 0xfffffffc, 0x2000000}}}}, 0xfd10}, 0x1, 0x0, 0x0, 0x4080}, 0x20001000) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0) inotify_init() 133.421695ms ago: executing program 1 (id=1556): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/acpi/devices/LNXCPU:01/eject\x00', 0x1, 0x0) write(r0, &(0x7f0000000800)='1', 0x1) 69.831655ms ago: executing program 3 (id=1557): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='huge=alwa']) chdir(&(0x7f0000000240)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000340)={'#! ', './file0'}, 0xb) ioctl$BTRFS_IOC_SNAP_CREATE(0xffffffffffffffff, 0x50009401, &(0x7f0000000380)={{}, "afe1658d587e93ab4b5fca380cdddd71e95c81000bac90d9689507b96ace5d2f9f55fddb8b36c7cac9209681a5fa01cd3874b06f2fcadd0d6c3b2543560ad96ffb3b3bb528250d54c3849e85a72f9805820433eaf86b855cc6bb316351ebf38753b22f619e6525c21a5050c57297595293366a0ed2ad9b308f845f1d9af97cf6384f5ec26ca2afea4eb950f209116b1d8b58fe396fcfb8ae0b8898f212b216cbb7d1bbd57a726d194a29a4e15e035b8162b139c67404e6a503db799c06078f56258de59c08f1812611aff6d4485a01f3413b9b4a11412629c2a4810db413d940af170b313dcf9a1e08e0156a7784c413ffa69bfb6b135b6093ad19c7f8bc70e5f9a0bcf07eb164c44642489845d93c25064c768ff253b3faf52378653b61ed2f3460a2221e6d9b2c04e99cd9fe74c005a330a08f558771a77771a1d1eb8b110912dbc327e07869f73b857cb841b5a47296a81d956c030dee87fda743cf9e56d08856a82ee26a390ac2569a31ca9beccda0251f28b124ee1e8ea6babc1b1e2d81fc795de9620301d65ded5865c5a9f6ce7422536d40694c2aa987542364f7f0bb75bdb0182d10b18a64045c7dadc0c82a47eab7e735fe240f27bb5da305cd08c86314a4a5fef8487c96bc1ea97409d73e1cc6ceba35f74eea39f2bf881833298b1e1a201eb9ea9c0754d41ef9a91b4deefcaeff08ee35a1f31b2d780b3934d5913626ef4a0f31c8e057e43ff14fc6fbf5e4a86b906b1ba320f3c52b629974a1324d97067935df1e4340b071130ee953bababf9dc0229e4a2f29cf1ae2713ffe85a5a9bd374c928ed416e1bd2516657bd4d3a9ac114ed279fcd89645245df7c55454fc367513ffae594d5236b320ad103f2d0956b3da7344a29fc910040027ca8b239d00ab5e79eeb83e25275fb61ceb65f6ace88cb43f106e128330ae709e19f209afd87b934dbd0faf470dfb52fdfd73bfa9a7a983b36d78469568ae69a0481cdc764c554d5ac03e607781cf3a5e209bffce2276529929d800f6d9b8a2f100108d7b883b5ce5e19da38ae5c99a8351b4e41c538fee7299a890edc630abbfe604c0b8847a7b5b4eec1dc00ed60e95b5374270ec634ff6d6ccbcd08145f9df1c2082c9447482ed42b4d0ea9a73bc9a68e36ee9e118bb5c08e1e7c2bd2627e82902d2c6f0da90bdbc52103f3992663653fd2b41a4294aa8f222812fa8b5e1864b75748f992bc2b396c03e202e8bfe9a1ccca1cb8b28c9c6faa47cc6b871140ddc45a0d02c752175a0498c3ba30e79c12d6ebbc32d5533d0216529e0f713eac725fe41bad4c9051d364bf38e3b72641510b09b2645447ea13b440d568adc9aa9ce85c967d78a14bdbd2fcfe0c7324a556ee841fc9ffd7a3c784fe41a349ced68e01c145db8847a547086c5595b9f6299bf7432e0e9c9a4a9108a24f7ad49c18a3ec771953480a0a0fdfeaded6b74f174ea2def77a0b9799f6b75a77a6314a4165e194be616eb5c98726d88da79f54fd01d39e751837a6bd0d77ca79073b3a7e62686fd8e089b0258645db505bb674174d626b1d1cfdf0f32b0d880884b73c63bc78a231a8cb45a12884907c021f87cdd7b2f1de020044666d38a866983c8ffa0cc6963a745c108e80a3b54eedac65b68c897043d914f146ba4ca18a61e144e7746d31879fa7ae7c2a43747e6060d79669bf9a8edcc229b7f1a0fe239b398692a6a65acd19c58442dfa8997430aab89aae8fb8f201bb1fd58605cf9dfe5c85a15e0928542a8fd7768f4b7750c7aeab8d9ced7c9fdea6cc38bc38209f608cc3d7c8bc9240b5b7d1661b8bfd231f30047befefd70183fb8330d184394159cd4153990c6a43ccded133adecced28499e73c4b25ee86e5d68848670736362931be74fe0aab5708ce05f4d6d7a068c590d36f99a0ba3501df60d9c01f54a7c366727287996de354c4a3a5e1ece988e5f59087c730afa107edbab31de441a88061ad799fefef86254a2f2891aa47420dd3f6267833a5345bf001d10c9f1fd121401ae846a9a5df517210cd0beb50a5139854aa1747115bca24522dae42667ef9ce893c4db108941198ed5323f582f11c4b13385f60b3038fa661f3ed276504fb51fb966ef88cbbb953c269ea2ed989ced5e8988839c55b398dbce98ce1e976c2065b2ded80f929dc6ef8afad6b61145686ce14e2d26f0694fda1e52a6c5155c0d8ea91544c76548a25376f13de7245b48e7298421d2c2433a472a8c89c3e621c5370654e1c7bba0f3d8bdf40c36cdbf02f6b5a7c4138b9e3931896fd89272b4d61a9875c00ba0d8d1bd960b9aaee3b6f127db1155680d7eefc5eaa6d4c648fca303706796bef110fbdb731d9e671f937e55ebf5d2e64f7cdcc073c905c134e8d3852689ed81c95be0c259816e7ff7b979557684aa1b6c2dd42754bda93e3e55c5ffc1122c988ca171fd57ab24ebe789e819c60ff3f9f1a9465ff4a9bdc5c2b2d9c351ffef5ab375f9024e297a26642b15108781fdf3c55d0aa9a8cb68ba93b7b13cd6d05b9b16502d7f9d72d015059e7999cc4ed880fd5ebf626ea409b9f0c4ded2974bb3daf88cc1930818dc3e09200897389211d3e780faa0acd64e37c60924a3fd0a16a7146a41b1b01e43fecf610c7d11d42baac5a60db7638077162cd58b3f734070e81ee71c5092422eaac366b41dd996723124df9005cbae4e2ec47f8a06616bd7faa5da6c0200c872c2ef929a16c823c57f2d4f798061e49102cab3af65a5cc9f8856dc5d3c0de1440c4d8df50a7ec09491d2e651ee5f5a76b8fc2d20a07def1a8951b9770f85728b42cd9dafce7c341c26a90b7d1c2e36f03f74eda3bfb2c40eec5c454c38e90f4d31e6a0f23b2ad53a429f73761713181b7839792cc494f21c5be9dd7f167a6681720ccd3cfcdd4b427058b995505a82993805a1860d5ea75e61c216ec9594adfd39cab47511578d57e312f2f3e0d2da8f2d8dbe3fc1fd281bdd8e7dbd203e4ec3e7d3b468ad2b81a76c5bac460f497e3cdb6bf0c6be5ceae4bd488b9597b13a37885b95426d8ea06760516ec13aa339084407d1f45e331e5dd77ac73306f70996728a0d67b48a833e9a3ddf22968e898b59e4b4c9a16aa9ea8120202737746e1a5ec2cca9640d69df2b27900de7abe573b7c023a88d7f3fcc3469a3a4e7f9f9095a6fed55fbb1d3582807407e62b55a38d33e70a0203513f30d37a4e6f03acd9d0fd2f3438eb485aa5e693806c002efd0811ab92518c41856039d7f36cf9981981231b3cea3493f0e8988bd05d3d424a5bfc8d1cdfd0e09e3ce12cab6edfb7f6d80c1edbb4d1d51a1500b0876e13e5173bfeba378c71046e70b590cf542094d01f458a3cec642fb1ce13a992765eca608579e85f03e7d871dbdbd882ce4821a944179e48a920d346ae21b08ee043cbbf3284c3a67d9b9417a5fed1202ca537f7711650f692df044f145587467dfdd45405d7caeb064bfa12b52057e90d2b5d2885bbaf032db769654af272dd78bb8ec8446344d0c1ca57d51fe1243e0a02ada90371e75418223f171f014f9a970964828cdd9faf3b66789cefd0374437f2a271c2765d9876943fb93205cb12448d4cccf68c28259e85a540e013ac77414a147fb1e0f0fc4a4d859a928eaef6e952a103a944052534c9264c85f4200cc8b465f66725c779f49312a308dda8fe7e423ebbee16e64ad6e112b3efd95584160f08c83595fdddfa39c4b89867fcf23085a24c53a6d846863b95f5605beb9b0a1cc6d191524da81ce89c0f7767652d887661b5299e300f2e83a6c962cf9089d82b139f4bedcc14bbf6611258d52e1f3d5a5e3ac05cfa4d066550b2180c31695a52da12c1412e55cdbe6660d86fe4c8eda51f2adf34b81af8ec55b549c3bbcc588c5f074e0dc76bb9bbd0cdea26dd47d84d9321f970912d374a081c9ebb74700a0792dbbb2da41ae7e3aa5230bdd260bd208b68100dc2f7bf2132d7cb34084e999b6ee2b91356ce766523a80359147af20fa15febc42b89d43e4a48d13cb8ed6678f346aa981954e0520ea8cd0a0c16281e57f33a5e3fd97d55d24386832c17f22b1c1fb91d5b1f362f3bc8aa8369c18444fc10e9d1285f6a3bcf24e2606b69fbd89f337f7ee3c27b1a2c7e8dec2c38c84c6712de1e7f1d790d86d8e0a402c40d406d39c13879f4d103adcbca13570eadcd424f8e06155885b054e1d7f994723fd22a6d704a89e6b126271ec5c19ea7b814c36f9ca9a0223da630324ca0f2a3010f4e53426d8d514bcc3303e6fa429c00244b918c01a444f74dd376bccb5709ed103514484a67240c4b992c722601e27dee6ba8b37608ba66e2065f8298a6df8c0a491113bf10e0bf18867dda3e1170fa1853b355fdf41898de4a339927872e8d9fb8a4d1c31833ac1355695a20c75ff6dafb70244a3754cb58feee89045e3408da902a7987e6a66dad0f044951a560954ee812abe142e9a4db701bdc46fabb0b98b4be01dadd629cffc661a3816744bcacdc38777494289ba156b272ade8f4ed3e32ce48958863b09bb09fb6999281164c0c5b50a77350d5f3c78d951fa76d1db68587e58bd40f824a68fd59c4ebd4f7e22e8e1458911012472b876ab15ca8c48ef664b1da41bd1ad9a5b799a1de8b2962c477f1726cbbe4f285a5c387842ac723b3877f5826503b68602c4bdaea94544b4b056142876d995d0db128a38f5c4547f12cf9d1cbc678cd42eebf67519484ab251855dbda09dd04ddc031860a69fd592fa1c12d59adc4699c246a666f6f6c20c1a21562f05f8db43ff424cea0d16789a6a69dc8552f4865bb3fac5b650b549432a0383c8f95c79084ca4841903f0c04319135f2bfc94ec8837374f0c1eccaacf8a0722d54b1a0e748a79e6c7ecdcdbfe376d080d9747a9a5a13cc7eb4111345216d1c787f05c992df3712d2a194ac325bb568abc6a97011bc62110ee12ba209d76f690ddb4e4b417f5b5db52ee7ad97159dfcf82b1c2a4eb5a97396fa24e52ba1c47330f7caca91b2965bac75dbcb86ac85a07b774dbf82be5fc92a8621e80973418d94a0bc10905a3815e04d1a668ea8cb5ffb293893b06bd372c75b477118b78dd69a04097ca8ff8f8fb21a5293d2fe6785e33d15d61008c4ca84121a8e48fabba3656250fba7e058ffc1705c7fa13509fc7c96fc9b16d0b21a26b11ebfc3325a2ca682bc014ec54dc8433af105ada5566f491d3ebe5e1e5f0859b28a576fb7978f2a1b4897890c1c9b0c1f4f8c7351ca738a6100c4f64092d865bc65a8b92007b117e5a4dd7988d3281aa2ccebb36f9af5032eeca2c8a72888c84346d3945507a6bb956b84f03d88a90bb9ecc466c7d94a3670783e11b312ecb4f9eb8489df8d129110b6bd710138476c8be75327e9ea6a0b94b8567b31692fee2d9c17d7e20d3d23cc4d317710537f608793e87d9158cd61a43306898da40d01b544fc951ccd13f11b4b8fbf47d694df601fd6677d796818571ee3125089316e3d33c5684affe9f29f12186bb5dc4c5eaee94e41d07a03c9c59db95bc42c23da55c497caa6a64c73ea3059a8c80955a9730666a0e02c3bf87cfb79542d84a529d7bf9c3ac60b323952fa439c2e5fd512c3bfe3770178b4e8d7efa223bd76830a6b8b604e15773d63d9fec504ea6561793723ff4f6fbdd016372e1a98a9252e8d1607512e5397c78498f68d3792ef7a28f74f4b15358afa5674d4340863a2897af87499bd073a06aef8215f76c9418f5b82b79b77f0a01dfc059b510794cda70b7daf2c74950652e"}) syz_emit_vhci(&(0x7f0000001380)=ANY=[@ANYBLOB="043e1f"], 0x22) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000013c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0xc048aeca, &(0x7f00000018c0)={0x4, 0x0, [{0xbcc, 0x0, 0x7}, {0x8b5, 0x0, 0x800000000004}, {0xb91, 0x0, 0x80000000}, {0xdc4, 0x0, 0x1}]}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000001440), 0x400, 0x0) r4 = landlock_create_ruleset(&(0x7f0000001480)={0x7b36}, 0x30, 0x0) landlock_restrict_self(r4, 0xe) mount$cgroup(0x0, &(0x7f0000001800)='./file0\x00', &(0x7f0000001840), 0x1000, &(0x7f0000001880)={[{@none}, {@none}], [{@smackfshat={'smackfshat', 0x3d, '\x00'}}, {@seclabel}]}) socket$inet6(0xa, 0x3, 0x8000000003c) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f00000014c0)=@HCI_VENDOR_PKT, 0x2) sendmsg$NFT_BATCH(r5, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001580)={&(0x7f00000015c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a010400000000000000000200000708000240000000020900010073797a31000000004c000000030a01040000000000000000020000070900010073797a31000000000900030073797a320000000014000480080001000000000308000200000000000b00070066696c746572000084000000060a01040000000000000000020000070900010073797a31000000000900020073797a320000000058000480540001800a0001006d61746368000000440002800b0001006e6661636374000008000200000000002c00030073797a3000000000000000000000000000000000000000000000000000000000000000000000000014000000110001000000000000000000"], 0x120}}, 0x0) r6 = add_key$keyring(&(0x7f0000001700), 0x0, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, &(0x7f0000001780)='asymmetric\x00', &(0x7f00000017c0)=@keyring) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) r7 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000001000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40}, 0x94) r8 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt(r8, 0x0, 0xc, 0x0, 0x0) getpid() 0s ago: executing program 1 (id=1558): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000000c0)={0x8, 0x1, 0xd8f9}) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x100000) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) kernel console output (not intermixed with test programs): yscall_32+0x14b/0x8c0 [ 284.231983][ T8207] do_fast_syscall_32+0x32/0x70 [ 284.231997][ T8207] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 284.232011][ T8207] RIP: 0023:0xf73defbc [ 284.232021][ T8207] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 284.232032][ T8207] RSP: 002b:00000000f53f64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000078 [ 284.232042][ T8207] RAX: ffffffffffffffda RBX: 0000000000000011 RCX: 0000000000000000 [ 284.232049][ T8207] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 284.232055][ T8207] RBP: 00000000f53f65ec R08: 0000000000000000 R09: 0000000000000000 [ 284.232060][ T8207] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 284.232066][ T8207] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 284.232080][ T8207] [ 284.912991][ T8200] team0 (unregistering): Port device team_slave_0 removed [ 284.953716][ T8200] team0 (unregistering): Port device team_slave_1 removed [ 286.656699][ T8225] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 286.661333][ T8225] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 286.661639][ T8225] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 286.661956][ T8225] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 286.663066][ T8225] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 286.671091][ T8225] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 286.671621][ T8225] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 286.691961][ T8225] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 286.692711][ T8225] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 286.703183][ T8225] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 286.707253][ T8224] )fl: renamed from lo (while UP) [ 288.640005][ T8261] ptp ptp0: guarantee physical clock free running [ 288.679224][ T5795] Bluetooth: hci0: Opcode 0x0401 failed: -110 [ 288.697720][ T5795] Bluetooth: hci0: command 0x2016 tx timeout [ 288.953768][ T8263] input: syz0 as /devices/virtual/input/input13 [ 290.687836][ T8272] netlink: 20 bytes leftover after parsing attributes in process `syz.4.434'. [ 291.418771][ T8286] i2c i2c-1: Frontend requested software zigzag, but didn't set the frequency step size [ 291.595596][ T42] audit: type=1800 audit(1793187457.579:2191): pid=8284 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.439" name="file1" dev="sda1" ino=2038 res=0 errno=-22 [ 292.668683][ T8294] fuse: Unknown parameter 'fd0x0000000000000003' [ 300.254496][ T8317] )fl: renamed from lo (while UP) [ 302.077201][ T8335] ip6erspan0: entered allmulticast mode [ 303.373186][ T8339] netlink: 16 bytes leftover after parsing attributes in process `syz.1.452'. [ 303.405759][ T8339] netlink: 4 bytes leftover after parsing attributes in process `syz.1.452'. [ 303.466824][ T8339] netdevsim netdevsim1 netdevsim0: IPsec offload requires 128 bit authentication [ 303.600622][ T8346] netlink: 8 bytes leftover after parsing attributes in process `syz.2.450'. [ 304.040905][ T8351] tipc: Started in network mode [ 304.040926][ T8351] tipc: Node identity 4, cluster identity 4711 [ 304.040939][ T8351] tipc: Node number set to 4 [ 304.280149][ T12] tipc: Subscription rejected, illegal request [ 304.656925][ T8365] fuse: Unknown parameter '0x0000000000000003' [ 305.464264][ T42] audit: type=1326 audit(1793187471.439:2192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.3.453" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 305.467444][ T42] audit: type=1326 audit(1793187471.449:2193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.3.453" exe="/syz-executor" sig=0 arch=40000003 syscall=172 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 305.467572][ T42] audit: type=1326 audit(1793187471.449:2194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.3.453" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 305.467995][ T42] audit: type=1326 audit(1793187471.449:2195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.3.453" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 305.564898][ T42] audit: type=1326 audit(1793187471.539:2196): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.3.453" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 305.590648][ T42] audit: type=1326 audit(1793187471.569:2197): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.3.453" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 305.605432][ T42] audit: type=1326 audit(1793187471.589:2198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.3.453" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 305.622012][ T42] audit: type=1326 audit(1793187471.589:2199): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.3.453" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 305.720811][ T42] audit: type=1326 audit(1793187471.699:2200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.3.453" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 305.744074][ T42] audit: type=1326 audit(1793187471.719:2201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.3.453" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 307.088413][ T5907] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 307.247315][ T5907] usb 7-1: New USB device found: idVendor=0711, idProduct=0550, bcdDevice=0.00 [ 307.274677][ T5907] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.274700][ T5907] usb 7-1: Product: syz [ 307.274782][ T5907] usb 7-1: Manufacturer: syz [ 307.274794][ T5907] usb 7-1: SerialNumber: syz [ 307.324720][ T5907] usb 7-1: USB2VGA dongle found at address 4 [ 307.339458][ T5907] usb 7-1: Allocated 8 output buffers [ 308.850063][ T5907] usb 7-1: Failed to early initialize device [ 308.856550][ T5907] usb 7-1: USB disconnect, device number 4 [ 312.213801][ T8430] netlink: 64 bytes leftover after parsing attributes in process `syz.1.465'. [ 312.749994][ T8436] tipc: Started in network mode [ 312.750049][ T8436] tipc: Node identity 4, cluster identity 4711 [ 312.750060][ T8436] tipc: Node number set to 4 [ 312.958640][ T12] tipc: Subscription rejected, illegal request [ 315.088876][ T42] kauditd_printk_skb: 129 callbacks suppressed [ 315.088928][ T42] audit: type=1800 audit(1793187480.559:2331): pid=8459 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.469" name="file0" dev="overlay" ino=155 res=0 errno=-22 [ 316.271086][ T8468] netlink: 'syz.4.471': attribute type 10 has an invalid length. [ 316.689306][ T8478] )fl: renamed from lo (while UP) [ 316.817355][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.817468][ T1443] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.149553][ T8468] nvme_tcp: queue 0: failed to receive icresp, error -104 [ 317.287571][ T8475] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 317.366931][ T8475] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 317.410842][ T8475] bond0 (unregistering): (slave netdevsim1): Releasing backup interface [ 317.462746][ T8475] bond0 (unregistering): Released all slaves [ 317.651059][ T5785] svc: failed to register nfsdv3 RPC service (errno 5). [ 317.651074][ T5785] failed to unregister tcp with rpcbind [ 318.054014][ T8493] netlink: 4 bytes leftover after parsing attributes in process `syz.3.475'. [ 318.060677][ T8492] netlink: 4 bytes leftover after parsing attributes in process `syz.3.475'. [ 318.067312][ T8492] netlink: 4 bytes leftover after parsing attributes in process `syz.3.475'. [ 319.066900][ T8504] usbcore.quirks: string doesn't fit in 127 chars. [ 321.440244][ T8531] netlink: 'syz.2.480': attribute type 2 has an invalid length. [ 321.477520][ T8533] netlink: 'syz.4.482': attribute type 10 has an invalid length. [ 321.679298][ T8535] netlink: 48 bytes leftover after parsing attributes in process `syz.2.480'. [ 321.846119][ T8523] FAULT_INJECTION: forcing a failure. [ 321.846119][ T8523] name fail_futex, interval 1, probability 0, space 0, times 1 [ 321.846151][ T8523] CPU: 1 UID: 0 PID: 8523 Comm: syz.1.481 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 321.846177][ T8523] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 321.846184][ T8523] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 321.846194][ T8523] Call Trace: [ 321.846201][ T8523] [ 321.846222][ T8523] dump_stack_lvl+0x100/0x190 [ 321.846255][ T8523] should_fail_ex.cold+0x5/0xa [ 321.846280][ T8523] get_futex_key+0xf5d/0x13e0 [ 321.846306][ T8523] ? __pfx_get_futex_key+0x10/0x10 [ 321.846326][ T8523] ? __mutex_unlock_slowpath+0x35d/0x930 [ 321.846353][ T8523] futex_wake+0xf4/0x5e0 [ 321.846373][ T8523] ? __pfx_futex_wake+0x10/0x10 [ 321.846395][ T8523] ? detach_task_ctx_data+0x83/0x490 [ 321.846418][ T8523] do_futex+0x2b2/0x440 [ 321.846443][ T8523] ? __pfx_do_futex+0x10/0x10 [ 321.846465][ T8523] ? __might_fault+0xc5/0x140 [ 321.846492][ T8523] mm_exit_exec_release+0x256/0x2f0 [ 321.846512][ T8523] do_exit+0x6d8/0x2a00 [ 321.846538][ T8523] ? __pfx_do_exit+0x10/0x10 [ 321.846558][ T8523] ? do_raw_spin_lock+0x128/0x260 [ 321.846579][ T8523] ? find_held_lock+0x2b/0x80 [ 321.846601][ T8523] ? get_signal+0x7db/0x21d0 [ 321.846621][ T8523] do_group_exit+0xd5/0x2a0 [ 321.846645][ T8523] get_signal+0x1ebd/0x21d0 [ 321.846665][ T8523] ? find_held_lock+0x2b/0x80 [ 321.846687][ T8523] ? inet_stream_connect+0x79/0xa0 [ 321.846713][ T8523] ? __pfx_get_signal+0x10/0x10 [ 321.846730][ T8523] ? __local_bh_enable_ip+0xa5/0x120 [ 321.846747][ T8523] ? inet_stream_connect+0x79/0xa0 [ 321.846773][ T8523] arch_do_signal_or_restart+0x91/0x7a0 [ 321.846801][ T8523] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 321.846830][ T8523] ? __pfx___sys_connect+0x10/0x10 [ 321.846865][ T8523] exit_to_user_mode_loop+0x139/0x700 [ 321.846887][ T8523] ? rcu_is_watching+0x13/0xc0 [ 321.846913][ T8523] __do_fast_syscall_32+0x5b0/0x8c0 [ 321.846938][ T8523] do_fast_syscall_32+0x32/0x70 [ 321.846959][ T8523] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 321.846980][ T8523] RIP: 0023:0xf747efbc [ 321.846994][ T8523] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 321.847012][ T8523] RSP: 002b:00000000f547550c EFLAGS: 00000292 ORIG_RAX: 000000000000016a [ 321.847030][ T8523] RAX: fffffffffffffe00 RBX: 0000000000000009 RCX: 0000000080000300 [ 321.847041][ T8523] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 321.847051][ T8523] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 321.847061][ T8523] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 321.847071][ T8523] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 321.847094][ T8523] [ 322.381316][ T8533] nvme_tcp: queue 0: failed to receive icresp, error -104 [ 322.527988][ T8548] netlink: 'syz.2.484': attribute type 10 has an invalid length. [ 322.741320][ T8555] netlink: 8 bytes leftover after parsing attributes in process `syz.3.492'. [ 322.784686][ T29] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 322.934680][ T29] usb 9-1: Using ep0 maxpacket: 8 [ 322.938055][ T29] usb 9-1: New USB device found: idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 322.940338][ T29] usb 9-1: config 2 has an invalid interface number: 31 but max is 0 [ 322.940352][ T29] usb 9-1: config 2 has no interface number 0 [ 322.940371][ T29] usb 9-1: config 2 interface 31 has no altsetting 0 [ 322.943470][ T29] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.943482][ T29] usb 9-1: Product: syz [ 322.943489][ T29] usb 9-1: Manufacturer: syz [ 322.943496][ T29] usb 9-1: SerialNumber: syz [ 323.295247][ T857] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 323.402098][ T8548] nvme nvme0: failed to connect socket: -512 [ 323.455160][ T857] usb 8-1: Using ep0 maxpacket: 32 [ 323.457060][ T857] usb 8-1: New USB device found: idVendor=0525, idProduct=a4a1, bcdDevice=0.40 [ 323.462241][ T857] usb 8-1: config 1 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 323.462299][ T857] usb 8-1: config 1 interface 0 altsetting 254 bulk endpoint 0x82 has invalid maxpacket 608 [ 323.462404][ T857] usb 8-1: config 1 interface 0 altsetting 254 endpoint 0x3 has invalid wMaxPacketSize 0 [ 323.462535][ T857] usb 8-1: config 1 interface 0 altsetting 254 bulk endpoint 0x3 has invalid maxpacket 0 [ 323.462699][ T857] usb 8-1: config 1 interface 0 altsetting 254 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 323.462765][ T857] usb 8-1: config 1 interface 0 has no altsetting 0 [ 323.495043][ T857] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 323.495099][ T857] usb 8-1: SerialNumber: syz [ 323.528264][ T8559] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 323.545998][ T857] cdc_acm 8-1:1.0: probe with driver cdc_acm failed with error -12 [ 323.888200][ T5873] usb 8-1: USB disconnect, device number 8 [ 324.072913][ T8563] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input14 [ 324.447857][ T29] ch9200 9-1:2.31: probe with driver ch9200 failed with error -32 [ 327.543224][ T1607] usb 9-1: USB disconnect, device number 2 [ 328.045139][ T8592] netlink: 24 bytes leftover after parsing attributes in process `syz.2.490'. [ 329.120384][ T42] audit: type=1800 audit(1793187494.939:2332): pid=8600 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.491" name="file0" dev="overlay" ino=201 res=0 errno=-22 [ 331.470405][ T8606] netlink: 'syz.3.495': attribute type 10 has an invalid length. [ 331.505487][ T8609] netlink: 8 bytes leftover after parsing attributes in process `syz.2.496'. [ 332.239097][ T8617] ip6erspan0: entered allmulticast mode [ 332.677338][ T8606] nvme_tcp: queue 0: failed to receive icresp, error -104 [ 333.806400][ T8619] syzkaller1: entered promiscuous mode [ 333.806429][ T8619] syzkaller1: entered allmulticast mode [ 333.894945][ T5796] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 333.895004][ T5796] CPU: 0 UID: 0 PID: 5796 Comm: kworker/u34:4 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 333.895038][ T5796] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 333.895046][ T5796] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 333.895060][ T5796] Workqueue: hci4 hci_rx_work [ 333.895101][ T5796] Call Trace: [ 333.895108][ T5796] [ 333.895116][ T5796] dump_stack_lvl+0x100/0x190 [ 333.895169][ T5796] sysfs_warn_dup.cold+0x1c/0x28 [ 333.895224][ T5796] sysfs_create_dir_ns+0x24b/0x2b0 [ 333.895263][ T5796] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 333.895287][ T5796] ? find_held_lock+0x2b/0x80 [ 333.895329][ T5796] ? kobject_add_internal+0x25f/0x930 [ 333.895370][ T5796] ? kobject_add_internal+0x25f/0x930 [ 333.895400][ T5796] ? do_raw_spin_unlock+0x145/0x1e0 [ 333.895439][ T5796] kobject_add_internal+0x2c8/0x930 [ 333.895484][ T5796] kobject_add+0x16a/0x1e0 [ 333.895514][ T5796] ? __pfx_kobject_add+0x10/0x10 [ 333.895553][ T5796] ? class_to_subsys+0x10f/0x150 [ 333.895581][ T5796] ? kobject_put+0xb9/0x640 [ 333.895616][ T5796] ? _raw_spin_unlock+0x28/0x50 [ 333.895643][ T5796] device_add+0x294/0x1970 [ 333.895672][ T5796] ? __pfx_dev_set_name+0x10/0x10 [ 333.895696][ T5796] ? __pfx_device_add+0x10/0x10 [ 333.895725][ T5796] ? mgmt_send_event_skb+0x2fb/0x460 [ 333.895764][ T5796] hci_conn_add_sysfs+0x1a3/0x260 [ 333.895806][ T5796] le_conn_complete_evt+0x12f9/0x2200 [ 333.895854][ T5796] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 333.895887][ T5796] ? hci_event_packet+0x186/0xcd0 [ 333.895929][ T5796] hci_le_conn_complete_evt+0x23c/0x3a0 [ 333.895956][ T5796] ? skb_pull_data+0x15f/0x1e0 [ 333.895982][ T5796] hci_le_meta_evt+0x34a/0x5f0 [ 333.896017][ T5796] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 333.896059][ T5796] hci_event_packet+0x51c/0xcd0 [ 333.896084][ T5796] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 333.896122][ T5796] ? __pfx_hci_event_packet+0x10/0x10 [ 333.896154][ T5796] ? __sanitizer_cov_trace_pc+0x5b/0x70 [ 333.896196][ T5796] hci_rx_work+0x6ea/0x10c0 [ 333.896225][ T5796] process_one_work+0xac7/0x1b10 [ 333.896278][ T5796] ? __pfx_process_one_work+0x10/0x10 [ 333.896320][ T5796] ? lock_acquire+0x1d1/0x380 [ 333.896349][ T5796] ? __pfx_hci_rx_work+0x10/0x10 [ 333.896384][ T5796] worker_thread+0x5ef/0xe50 [ 333.896423][ T5796] ? kthread+0x13a/0x450 [ 333.896458][ T5796] ? __pfx_worker_thread+0x10/0x10 [ 333.896495][ T5796] kthread+0x373/0x450 [ 333.896521][ T5796] ? __pfx_kthread+0x10/0x10 [ 333.896560][ T5796] ret_from_fork+0x730/0xd60 [ 333.896585][ T5796] ? __pfx_ret_from_fork+0x10/0x10 [ 333.896629][ T5796] ? __switch_to+0x800/0x10e0 [ 333.896661][ T5796] ? __pfx_kthread+0x10/0x10 [ 333.896702][ T5796] ret_from_fork_asm+0x1a/0x30 [ 333.896741][ T5796] [ 333.897488][ T5796] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 333.897525][ T5796] Bluetooth: hci4: failed to register connection device [ 334.896773][ T8630] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 334.917172][ T8630] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 334.942332][ T8630] bond0 (unregistering): Released all slaves [ 335.499896][ T8638] FAULT_INJECTION: forcing a failure. [ 335.499896][ T8638] name failslab, interval 1, probability 0, space 0, times 0 [ 335.500061][ T8638] CPU: 2 UID: 0 PID: 8638 Comm: syz.3.501 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 335.500093][ T8638] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 335.500097][ T8638] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 335.500103][ T8638] Call Trace: [ 335.500108][ T8638] [ 335.500113][ T8638] dump_stack_lvl+0x100/0x190 [ 335.500143][ T8638] should_fail_ex.cold+0x5/0xa [ 335.500169][ T8638] should_failslab+0xc2/0x120 [ 335.500189][ T8638] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 335.500210][ T8638] ? nfs_get_tree+0x76c/0x1440 [ 335.500226][ T8638] kmemdup_nul+0x49/0xd0 [ 335.500238][ T8638] nfs_get_tree+0x76c/0x1440 [ 335.500253][ T8638] vfs_get_tree+0x92/0x320 [ 335.500267][ T8638] vfs_cmd_create+0xd7/0x2a0 [ 335.500283][ T8638] __do_sys_fsconfig+0x55a/0xcb0 [ 335.500306][ T8638] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 335.500344][ T8638] __do_fast_syscall_32+0x14b/0x8c0 [ 335.500370][ T8638] do_fast_syscall_32+0x32/0x70 [ 335.500384][ T8638] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 335.500397][ T8638] RIP: 0023:0xf73cefbc [ 335.500406][ T8638] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 335.500416][ T8638] RSP: 002b:00000000f53c550c EFLAGS: 00000292 ORIG_RAX: 00000000000001af [ 335.500427][ T8638] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000006 [ 335.500433][ T8638] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 335.500439][ T8638] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 335.500445][ T8638] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 335.500451][ T8638] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 335.500465][ T8638] [ 335.519441][ T5796] Bluetooth: hci0: Invalid handle: 0x70bc > 0x0eff [ 336.157252][ T8638] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 336.157532][ T8638] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 336.157713][ T8638] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 336.172546][ T8638] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 336.172974][ T8638] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 336.198460][ T8638] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 336.252303][ T8638] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 336.287907][ T5796] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 336.288345][ T8637] xt_nfacct: accounting object `syz0' does not exist [ 337.325247][ T5907] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 337.476015][ T5907] usb 7-1: New USB device found: idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 337.477197][ T5907] usb 7-1: config 0 has no interfaces? [ 337.479050][ T5907] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.479069][ T5907] usb 7-1: Product: syz [ 337.479081][ T5907] usb 7-1: Manufacturer: syz [ 337.479094][ T5907] usb 7-1: SerialNumber: syz [ 337.483503][ T5907] usb 7-1: config 0 descriptor?? [ 337.505852][ T8680] netlink: 8 bytes leftover after parsing attributes in process `syz.4.506'. [ 337.554860][ T5784] svc: failed to register nfsdv3 RPC service (errno 5). [ 337.554880][ T5784] failed to unregister tcp with rpcbind [ 337.755527][ T5907] usb 7-1: USB disconnect, device number 5 [ 338.124909][ T8692] netlink: 12 bytes leftover after parsing attributes in process `syz.4.509'. [ 338.194714][ T5796] Bluetooth: hci1: command 0x0c1a tx timeout [ 338.194753][ T5796] Bluetooth: hci2: command 0x0c1a tx timeout [ 338.197402][ T5795] Bluetooth: hci0: command 0x2016 tx timeout [ 338.307970][ T5795] Bluetooth: hci4: command 0x0c1a tx timeout [ 338.553702][ T42] audit: type=1800 audit(1793187504.529:2333): pid=8700 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.510" name="file0" dev="overlay" ino=803 res=0 errno=-22 [ 340.373093][ T5795] Bluetooth: hci4: command 0x0c1a tx timeout [ 340.682105][ T8721] netlink: 8 bytes leftover after parsing attributes in process `syz.2.512'. [ 340.808239][ T8725] syzkaller0: entered promiscuous mode [ 340.808259][ T8725] syzkaller0: entered allmulticast mode [ 340.896397][ T8725] tipc: Started in network mode [ 340.896426][ T8725] tipc: Node identity 7eafba255475, cluster identity 4711 [ 340.896648][ T8725] tipc: Enabled bearer , priority 0 [ 340.911665][ T8722] tipc: Resetting bearer [ 340.914176][ T8727] overlayfs: metacopy with no lower data found - abort lookup (/file1) [ 340.937584][ T8722] tipc: Disabling bearer [ 340.953913][ T8727] bridge0: port 1(bridge_slave_0) entered disabled state [ 342.436445][ T5796] Bluetooth: hci4: command 0x0c1a tx timeout [ 344.516935][ T5796] Bluetooth: hci4: command 0x0c1a tx timeout [ 345.655057][ T8745] netlink: 8 bytes leftover after parsing attributes in process `syz.2.516'. [ 348.244994][ T8765] fuse: Unknown parameter 'fd0x000000000000000300000000000000000000' [ 349.016159][ T8769] netlink: 'syz.1.523': attribute type 10 has an invalid length. [ 349.759982][ T8769] nvme nvme0: failed to connect socket: -512 [ 350.228042][ T8782] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 350.228068][ T8782] CPU: 1 UID: 0 PID: 8782 Comm: syz.4.525 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 350.228096][ T8782] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 350.228120][ T8782] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 350.228130][ T8782] Call Trace: [ 350.228137][ T8782] [ 350.228144][ T8782] dump_stack_lvl+0x100/0x190 [ 350.228175][ T8782] sysfs_warn_dup.cold+0x1c/0x28 [ 350.228201][ T8782] sysfs_create_dir_ns+0x24b/0x2b0 [ 350.228222][ T8782] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 350.228240][ T8782] ? find_held_lock+0x2b/0x80 [ 350.228264][ T8782] ? kobject_add_internal+0x25f/0x930 [ 350.228290][ T8782] ? kobject_add_internal+0x25f/0x930 [ 350.228319][ T8782] ? class_dir_child_ns_type+0xd/0x60 [ 350.228342][ T8782] kobject_add_internal+0x2c8/0x930 [ 350.228373][ T8782] kobject_add+0x16a/0x1e0 [ 350.228397][ T8782] ? __pfx_kobject_add+0x10/0x10 [ 350.228421][ T8782] ? get_device_parent+0x1b3/0x4c0 [ 350.228445][ T8782] ? kobject_put+0xb9/0x640 [ 350.228475][ T8782] device_add+0x294/0x1970 [ 350.228493][ T8782] ? lockdep_init_map_type+0x5c/0x250 [ 350.228513][ T8782] ? __pfx_device_add+0x10/0x10 [ 350.228530][ T8782] ? lockdep_init_map_type+0x5c/0x250 [ 350.228551][ T8782] ? __init_waitqueue_head+0xca/0x150 [ 350.228578][ T8782] tty_register_device_attr+0x388/0x810 [ 350.228600][ T8782] ? lockdep_init_map_type+0x5c/0x250 [ 350.228617][ T8782] ? __pfx_tty_register_device_attr+0x10/0x10 [ 350.228642][ T8782] ? tty_port_init+0x156/0x1c0 [ 350.228665][ T8782] gsm_activate_mux+0x155/0x2a0 [ 350.228688][ T8782] gsmld_ioctl+0xbbc/0x15c0 [ 350.228719][ T8782] ? __pfx_gsmld_ioctl+0x10/0x10 [ 350.228764][ T8782] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 350.228792][ T8782] ? __pfx_gsmld_ioctl+0x10/0x10 [ 350.228822][ T8782] tty_compat_ioctl+0x396/0x420 [ 350.228844][ T8782] ? __pfx_tty_compat_ioctl+0x10/0x10 [ 350.228865][ T8782] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 350.228896][ T8782] __do_fast_syscall_32+0x14b/0x8c0 [ 350.228922][ T8782] do_fast_syscall_32+0x32/0x70 [ 350.228945][ T8782] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 350.228967][ T8782] RIP: 0023:0xf73defbc [ 350.228981][ T8782] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 350.228997][ T8782] RSP: 002b:00000000f53d550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 350.229014][ T8782] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000404c4701 [ 350.229024][ T8782] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 350.229034][ T8782] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 350.229043][ T8782] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 350.229052][ T8782] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 350.229074][ T8782] [ 350.229156][ T8782] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 350.319676][ T8782] netlink: 8 bytes leftover after parsing attributes in process `syz.4.525'. [ 350.411655][ T8786] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 352.517411][ T8807] netlink: 'syz.1.529': attribute type 10 has an invalid length. [ 353.345313][ T8807] nvme nvme0: failed to connect socket: -512 [ 353.935375][ T103] nvmet: connect request for invalid subsystem testsubsys! [ 353.936217][ T8815] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 355.195637][ T8837] ip6erspan0: entered allmulticast mode [ 357.749128][ T8850] netlink: 24 bytes leftover after parsing attributes in process `syz.4.536'. [ 358.238111][ T8857] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 358.514894][ T8855] netlink: 'syz.3.534': attribute type 10 has an invalid length. [ 358.847638][ T8855] nvme_tcp: queue 0: failed to receive icresp, error -104 [ 358.874186][ T42] audit: type=1800 audit(1793187525.851:2334): pid=8867 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.544" name="file0" dev="overlay" ino=858 res=0 errno=-22 [ 359.183265][ T8874] pim6reg: entered allmulticast mode [ 359.318946][ T8857] md: array md0 already initialised! [ 359.356323][ T8875] netlink: 4 bytes leftover after parsing attributes in process `syz.3.545'. [ 359.843636][ T8875] hsr_slave_1 (unregistering): left promiscuous mode [ 360.731013][ T8877] netlink: 'syz.4.540': attribute type 10 has an invalid length. [ 361.060106][ T8878] nvme_tcp: queue 0: failed to receive icresp, error -104 [ 361.679128][ T8897] [U]  [ 361.773817][ T8897] netlink: 4 bytes leftover after parsing attributes in process `syz.1.542'. [ 361.994694][ T29] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 362.041265][ T8905] netlink: 'syz.1.547': attribute type 2 has an invalid length. [ 362.144743][ T29] usb 8-1: Using ep0 maxpacket: 8 [ 362.145628][ T29] usb 8-1: New USB device found: idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 362.146510][ T29] usb 8-1: config 2 has an invalid interface number: 31 but max is 0 [ 362.146522][ T29] usb 8-1: config 2 has no interface number 0 [ 362.146578][ T29] usb 8-1: config 2 interface 31 has no altsetting 0 [ 362.153442][ T29] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.153456][ T29] usb 8-1: Product: syz [ 362.153463][ T29] usb 8-1: Manufacturer: syz [ 362.153471][ T29] usb 8-1: SerialNumber: syz [ 362.163742][ T8908] netlink: 48 bytes leftover after parsing attributes in process `syz.1.547'. [ 362.241213][ T8912] netlink: 'syz.4.548': attribute type 10 has an invalid length. [ 363.088734][ T8912] nvme_tcp: queue 0: failed to receive icresp, error -104 [ 363.100628][ T8920] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 363.247944][ T29] ch9200 8-1:2.31: probe with driver ch9200 failed with error -71 [ 363.252726][ T29] usb 8-1: USB disconnect, device number 9 [ 365.158399][ T67] Bluetooth: hci2: command 0x0c1a tx timeout [ 365.158434][ T5795] Bluetooth: hci1: command 0x0c1a tx timeout [ 365.160367][ T8920] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 365.160512][ T8920] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 365.160751][ T8920] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 365.165920][ T8920] xt_nfacct: accounting object `syz0' does not exist [ 365.515279][ T8940] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 366.285225][ T8935] nvme_tcp: queue 0: failed to receive icresp, error -104 [ 367.236049][ T5796] Bluetooth: hci4: command 0x0c1a tx timeout [ 367.236281][ T5796] Bluetooth: hci0: command 0x2016 tx timeout [ 367.236478][ T5796] Bluetooth: hci1: command 0x0c1a tx timeout [ 367.517710][ T8950] syzkaller0: entered promiscuous mode [ 367.517724][ T8950] syzkaller0: entered allmulticast mode [ 367.545701][ T8950] netlink: 'syz.4.556': attribute type 16 has an invalid length. [ 367.545715][ T8950] netlink: 'syz.4.556': attribute type 3 has an invalid length. [ 367.545721][ T8950] netlink: 132 bytes leftover after parsing attributes in process `syz.4.556'. [ 368.216492][ T8960] overlayfs: metacopy with no lower data found - abort lookup (/file1) [ 368.336072][ T8960] bridge0: port 1(bridge_slave_0) entered disabled state [ 368.724779][ T8956] nvme nvme0: failed to connect socket: -512 [ 369.308170][ T8968] syzkaller0: entered promiscuous mode [ 369.308192][ T8968] syzkaller0: entered allmulticast mode [ 369.434314][ T8973] tipc: Enabled bearer , priority 0 [ 369.464654][ T5884] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 369.478190][ T8964] tipc: Resetting bearer [ 369.586049][ T42] audit: type=1326 audit(1793187536.571:2335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8974 comm="syz.3.561" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 369.586179][ T42] audit: type=1326 audit(1793187536.571:2336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8974 comm="syz.3.561" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 369.587751][ T42] audit: type=1326 audit(1793187536.571:2337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8974 comm="syz.3.561" exe="/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 369.587978][ T42] audit: type=1326 audit(1793187536.571:2338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8974 comm="syz.3.561" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 369.588145][ T42] audit: type=1326 audit(1793187536.571:2339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8974 comm="syz.3.561" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 369.588863][ T42] audit: type=1326 audit(1793187536.571:2340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8974 comm="syz.3.561" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 369.614705][ T5884] usb 6-1: Using ep0 maxpacket: 8 [ 369.615350][ T5884] usb 6-1: New USB device found: idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 369.616633][ T5884] usb 6-1: config 2 has an invalid interface number: 31 but max is 0 [ 369.616701][ T5884] usb 6-1: config 2 has no interface number 0 [ 369.616728][ T5884] usb 6-1: config 2 interface 31 has no altsetting 0 [ 369.618875][ T5884] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 369.618886][ T5884] usb 6-1: Product: syz [ 369.618893][ T5884] usb 6-1: Manufacturer: syz [ 369.618900][ T5884] usb 6-1: SerialNumber: syz [ 369.645567][ T42] audit: type=1326 audit(1793187536.631:2341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8974 comm="syz.3.561" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 369.645614][ T42] audit: type=1326 audit(1793187536.631:2342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8974 comm="syz.3.561" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 369.651719][ T42] audit: type=1326 audit(1793187536.631:2343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8974 comm="syz.3.561" exe="/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 369.651760][ T42] audit: type=1326 audit(1793187536.631:2344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8974 comm="syz.3.561" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 369.851496][ T8980] netlink: 16 bytes leftover after parsing attributes in process `syz.2.563'. [ 370.033014][ T8964] tipc: Disabling bearer [ 371.229109][ T5884] ch9200 6-1:2.31: probe with driver ch9200 failed with error -32 [ 371.573977][ T8989] netlink: 'syz.3.573': attribute type 10 has an invalid length. [ 371.965109][ T8988] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 371.965372][ T8988] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 371.965812][ T8988] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 372.375922][ T8989] nvme_tcp: queue 0: failed to receive icresp, error -104 [ 374.036959][ T5150] Bluetooth: hci1: command 0x0c1a tx timeout [ 374.037183][ T5150] Bluetooth: hci2: command 0x0c1a tx timeout [ 374.037841][ T5796] Bluetooth: hci0: command 0x2016 tx timeout [ 374.038712][ T8988] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 374.039050][ T67] Bluetooth: hci4: command 0x0c1a tx timeout [ 374.048747][ T8986] xt_nfacct: accounting object `syz0' does not exist [ 374.052983][ T5902] usb 6-1: USB disconnect, device number 6 [ 375.509090][ T9006] netlink: 'syz.2.568': attribute type 21 has an invalid length. [ 375.770144][ T1607] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 375.975544][ T1607] usb 8-1: Using ep0 maxpacket: 32 [ 375.976888][ T1607] usb 8-1: New USB device found: idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 376.008083][ T1607] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 376.008139][ T1607] usb 8-1: config 0 has no interface number 0 [ 376.028108][ T1607] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.028162][ T1607] usb 8-1: Product: syz [ 376.028170][ T1607] usb 8-1: Manufacturer: syz [ 376.028236][ T1607] usb 8-1: SerialNumber: syz [ 376.144843][ T8997] Bluetooth: hci4: command 0x0c1a tx timeout [ 376.421887][ T9006] 8021q: adding VLAN 0 to HW filter on device eth0 [ 376.436619][ T12] netdevsim netdevsim12 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 376.436656][ T12] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 376.436735][ T12] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 376.436763][ T12] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 376.436790][ T12] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 376.483132][ T857] )fl speed is unknown, defaulting to 1000 [ 376.493714][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 376.494247][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 376.675432][ T9004] ip6erspan0: entered allmulticast mode [ 376.685187][ T1607] usb 8-1: config 0 descriptor?? [ 376.719139][ T1607] usb 8-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 376.719193][ T1607] usb 8-1: selecting invalid altsetting 1 [ 376.719202][ T1607] usb 8-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 376.885310][ T9030] overlayfs: metacopy with no lower data found - abort lookup (/file1) [ 376.891371][ T9030] bridge0: port 1(bridge_slave_0) entered disabled state [ 376.966367][ T9031] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 377.213041][ T9034] ublk6: read batch cmd buffer failed [ 377.214196][ T9034] ublk6: read batch cmd buffer failed [ 377.294639][ T9034] ublk6: read batch cmd buffer failed [ 377.294991][ T9034] ublk6: read batch cmd buffer failed [ 378.020950][ T1607] usb 8-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 378.022880][ T1607] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 378.023047][ T1607] usb 8-1: media controller created [ 378.088649][ T1607] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 378.173325][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.173521][ T1443] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.386283][ T9044] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 378.386813][ T9044] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 378.387686][ T9044] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 378.388624][ T9044] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 378.388695][ T9044] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 378.527988][ T9044] xt_nfacct: accounting object `syz0' does not exist [ 378.819465][ T1607] usb 8-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 378.819663][ T1607] zl10353_read_register: readreg error (reg=127, ret==-71) [ 378.835654][ T1607] usb 8-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 378.903301][ T9049] mmap: syz.2.577 (9049): VmData 37445632 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 380.436987][ T5791] Bluetooth: hci1: command 0x0c1a tx timeout [ 380.444403][ T9069] kAFS: unable to lookup cell '/,cL' [ 380.514761][ T5791] Bluetooth: hci4: command 0x0c1a tx timeout [ 380.642948][ T5791] Bluetooth: hci0: command 0x2016 tx timeout [ 381.096487][ T1607] usb 8-1: USB disconnect, device number 10 [ 381.242500][ T9074] netlink: 'syz.1.581': attribute type 10 has an invalid length. [ 381.728062][ T9081] netlink: 'syz.3.582': attribute type 10 has an invalid length. [ 381.728690][ T9081] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 381.729671][ T9081] team0: Port device netdevsim1 added [ 382.274677][ T9059] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 382.274728][ T5791] Bluetooth: hci2: command 0x0c1a tx timeout [ 382.385929][ T9059] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 382.386110][ T9059] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 382.386248][ T9059] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 382.505157][ T197] IPVS: starting estimator thread 0... [ 382.563225][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state [ 382.563281][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 382.604788][ T9095] IPVS: using max 31 ests per chain, 74400 per kthread [ 382.667340][ T9099] netlink: 'syz.1.587': attribute type 10 has an invalid length. [ 382.774956][ T9100] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 383.503491][ T9099] nvme nvme0: failed to connect socket: -512 [ 383.514374][ T9107] key id 00000001 not found [ 383.516541][ T5796] Bluetooth: hci4: Unable to find connection for big 0x00 [ 383.562176][ T42] kauditd_printk_skb: 4 callbacks suppressed [ 383.562191][ T42] audit: type=1800 audit(1793187550.541:2349): pid=9114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.588" name="file0" dev="overlay" ino=945 res=0 errno=-22 [ 384.354713][ T5796] Bluetooth: hci1: command 0x0c1a tx timeout [ 384.434690][ T5796] Bluetooth: hci4: command 0x0c1a tx timeout [ 384.434729][ T5796] Bluetooth: hci0: command 0x2016 tx timeout [ 384.826614][ T9118] null_blk: disk nullb1 created [ 385.727401][ T9136] ubi0: attaching mtd0 [ 385.774529][ T9136] ubi0: scanning is finished [ 385.774765][ T9136] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 386.087925][ T9136] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 386.857757][ T9146] netlink: 'syz.3.596': attribute type 10 has an invalid length. [ 387.213502][ T9151] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 387.222246][ T9151] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 387.616438][ T9146] nvme_tcp: queue 0: failed to receive icresp, error -104 [ 387.653168][ T9151] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 387.654413][ T9151] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 387.654771][ T9151] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 388.012859][ T9151] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 388.042024][ T9151] xt_nfacct: accounting object `syz0' does not exist [ 388.427404][ T9167] pim6reg: entered allmulticast mode [ 388.482549][ T9163] netlink: 24 bytes leftover after parsing attributes in process `syz.3.599'. [ 388.629086][ T9167] pim6reg: left allmulticast mode [ 388.756740][ T9168] netlink: 4 bytes leftover after parsing attributes in process `syz.4.600'. [ 388.866197][ T9170] device-mapper: ioctl: dm_ctl_ioctl: unknown command 0xc138fd12 [ 388.995084][ T42] audit: type=1326 audit(1793187555.981:2350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9173 comm="syz.3.602" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 388.995258][ T42] audit: type=1326 audit(1793187555.981:2351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9173 comm="syz.3.602" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 388.996415][ T42] audit: type=1326 audit(1793187555.981:2352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9173 comm="syz.3.602" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 388.996560][ T42] audit: type=1326 audit(1793187555.981:2353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9173 comm="syz.3.602" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 388.996701][ T42] audit: type=1326 audit(1793187555.981:2354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9173 comm="syz.3.602" exe="/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 388.997158][ T42] audit: type=1326 audit(1793187555.981:2355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9173 comm="syz.3.602" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 388.997180][ T42] audit: type=1326 audit(1793187555.981:2356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9173 comm="syz.3.602" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 388.997498][ T42] audit: type=1326 audit(1793187555.981:2357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9173 comm="syz.3.602" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 388.997915][ T42] audit: type=1326 audit(1793187555.981:2358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9173 comm="syz.3.602" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 388.997937][ T42] audit: type=1326 audit(1793187555.981:2359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9173 comm="syz.3.602" exe="/syz-executor" sig=0 arch=40000003 syscall=135 compat=1 ip=0xf73cefbc code=0x7ffc0000 [ 389.169688][ T9168] hsr_slave_1 (unregistering): left promiscuous mode [ 389.255836][ T5791] Bluetooth: hci2: command 0x0c1a tx timeout [ 389.693881][ T9175] Console: switching to colour dummy device 80x25 [ 389.716627][ T5791] Bluetooth: hci1: command 0x0c1a tx timeout [ 389.717581][ T5791] Bluetooth: hci0: command 0x2016 tx timeout [ 390.036193][ T67] Bluetooth: hci4: command 0x0c1a tx timeout [ 391.315021][ T67] Bluetooth: hci2: command 0x0c1a tx timeout [ 391.807421][ T67] Bluetooth: hci0: command 0x2016 tx timeout [ 392.115855][ T9181] jffs2: notice: (9181) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. [ 392.867576][ T9194] netlink: 16 bytes leftover after parsing attributes in process `syz.3.606'. [ 394.151796][ T42] kauditd_printk_skb: 1166 callbacks suppressed [ 394.151956][ T42] audit: type=1800 audit(1793187561.131:3526): pid=9191 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.605" name="file1" dev="sda1" ino=2038 res=0 errno=-22 [ 394.612336][ T9199] netlink: 16 bytes leftover after parsing attributes in process `syz.4.616'. [ 395.381505][ T9200] bridge0: port 3(netdevsim0) entered disabled state [ 395.382194][ T9200] bridge0: port 2(bridge_slave_1) entered disabled state [ 395.383046][ T9200] bridge0: port 1(bridge_slave_0) entered disabled state [ 395.636320][ T58] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 395.790235][ T58] usb 7-1: Using ep0 maxpacket: 8 [ 395.807666][ T58] usb 7-1: New USB device found: idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 395.830050][ T58] usb 7-1: config 2 has an invalid interface number: 31 but max is 0 [ 395.830105][ T58] usb 7-1: config 2 has no interface number 0 [ 395.830247][ T58] usb 7-1: config 2 interface 31 has no altsetting 0 [ 395.852952][ T58] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.853064][ T58] usb 7-1: Product: syz [ 395.853151][ T58] usb 7-1: Manufacturer: syz [ 395.853281][ T58] usb 7-1: SerialNumber: syz [ 396.669618][ T9200] bridge1: left promiscuous mode [ 396.669718][ T9200] bridge1: left allmulticast mode [ 396.732898][ T9200] ip6erspan0: left allmulticast mode [ 396.774763][ T12] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 396.774806][ T12] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 396.774835][ T12] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 396.774863][ T12] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.127418][ T9229] fuse: Unknown parameter 'fd0x000000000000000300000000000000000000' [ 397.188456][ T58] ch9200 7-1:2.31: probe with driver ch9200 failed with error -71 [ 397.298002][ T58] usb 7-1: USB disconnect, device number 6 [ 398.159500][ T9240] netlink: 48 bytes leftover after parsing attributes in process `syz.2.613'. [ 398.357283][ T9238] jffs2: notice: (9238) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 398.364271][ T9246] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 398.566008][ T9252] netlink: 'syz.2.617': attribute type 4 has an invalid length. [ 398.566028][ T9252] netlink: 17 bytes leftover after parsing attributes in process `syz.2.617'. [ 399.552456][ T9265] smbdirect: ib_dev[s`z1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 399.552480][ T9265] smbdirect: ib_dev[s`z1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 399.552503][ T9265] smbdirect: ib_dev[s`z1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 399.695450][ T9271] smbdirect: ib_dev[rxe0] renamed to [sys] [ 399.908986][ T9284] tipc: Enabling of bearer rejected, failed to enable media [ 400.035319][ T1350] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 400.060097][ T9292] key id 00000001 not found [ 400.061313][ T67] Bluetooth: hci0: Unable to find connection for big 0x00 [ 400.190674][ T1350] usb 7-1: New USB device found: idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 400.192150][ T1350] usb 7-1: config 0 has an invalid interface number: 41 but max is 0 [ 400.192171][ T1350] usb 7-1: config 0 has no interface number 0 [ 400.192203][ T1350] usb 7-1: config 0 interface 41 has no altsetting 0 [ 400.198496][ T1350] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.198522][ T1350] usb 7-1: Product: syz [ 400.198536][ T1350] usb 7-1: Manufacturer: syz [ 400.198549][ T1350] usb 7-1: SerialNumber: syz [ 400.205598][ T1350] usb 7-1: config 0 descriptor?? [ 400.272811][ T9294] device-mapper: table: 248:3: flakey: Total (up + down) interval is zero (-EINVAL) [ 400.272885][ T9294] device-mapper: ioctl: error adding target to table [ 400.993081][ T9275] )fl: entered promiscuous mode [ 401.114883][ T5884] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 401.276597][ T5884] usb 8-1: New USB device found: idVendor=06cd, idProduct=0135, bcdDevice=1.00 [ 401.278078][ T5884] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 401.278115][ T5884] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.287953][ T9309] netlink: 'syz.4.624': attribute type 21 has an invalid length. [ 401.308877][ T5884] keyspan 8-1:1.0: Keyspan 2 port adapter converter detected [ 401.309255][ T5884] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 81 [ 401.309370][ T5884] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 1 [ 401.332912][ T5884] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 84 [ 401.332998][ T5884] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 2 [ 401.361627][ T5884] usb 8-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 401.371873][ T5884] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 88 [ 401.372000][ T5884] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 6 [ 401.387834][ T5884] usb 8-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 401.431651][ T9275] tunl0: entered promiscuous mode [ 401.432500][ T9275] gre0: entered promiscuous mode [ 401.443645][ T9275] gretap0: entered promiscuous mode [ 401.450487][ T9275] erspan0: entered promiscuous mode [ 401.451546][ T9275] ip_vti0: entered promiscuous mode [ 401.452297][ T9275] ip6_vti0: entered promiscuous mode [ 401.457148][ T9275] sit0: entered promiscuous mode [ 401.465202][ T9275] ip6tnl0: entered promiscuous mode [ 401.470674][ T9275] ip6gre0: entered promiscuous mode [ 401.485350][ T9275] syz_tun: entered promiscuous mode [ 401.493840][ T9275] ip6gretap0: entered promiscuous mode [ 401.505262][ T9275] bridge0: port 2(bridge_slave_1) entered disabled state [ 401.505550][ T9275] bridge0: port 1(bridge_slave_0) entered disabled state [ 401.508326][ T9275] bridge0: entered promiscuous mode [ 401.518956][ T9275] bond0: entered promiscuous mode [ 401.519037][ T9275] bond_slave_0: entered promiscuous mode [ 401.519260][ T9275] bond_slave_1: entered promiscuous mode [ 401.524528][ T9275] team0: entered promiscuous mode [ 401.525947][ T9275] team_slave_0: entered promiscuous mode [ 401.526282][ T9275] team_slave_1: entered promiscuous mode [ 401.530619][ T9275] dummy0: entered promiscuous mode [ 401.547683][ T9275] nlmon0: entered promiscuous mode [ 401.562361][ T9275] batadv0: entered promiscuous mode [ 401.580617][ T9275] vxcan0: entered promiscuous mode [ 401.587854][ T9275] vxcan1: entered promiscuous mode [ 401.592638][ T9275] veth0: entered promiscuous mode [ 401.597395][ T9275] veth1: entered promiscuous mode [ 401.600820][ T9275] wg0: entered promiscuous mode [ 401.627531][ T9275] wg1: entered promiscuous mode [ 401.637940][ T9275] wg2: entered promiscuous mode [ 401.640386][ T9275] veth0_to_bridge: entered promiscuous mode [ 401.653080][ T9275] veth1_to_bridge: entered promiscuous mode [ 401.662179][ T9275] veth0_to_bond: entered promiscuous mode [ 401.669035][ T9275] veth1_to_bond: entered promiscuous mode [ 401.673080][ T9275] veth0_to_team: entered promiscuous mode [ 401.684227][ T9275] veth1_to_team: entered promiscuous mode [ 401.695885][ T9275] veth0_to_batadv: entered promiscuous mode [ 401.698782][ T9275] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 401.753448][ T9275] batadv_slave_0: entered promiscuous mode [ 401.759552][ T9275] veth1_to_batadv: entered promiscuous mode [ 401.765707][ T9275] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 401.765750][ T9275] batadv_slave_1: entered promiscuous mode [ 401.768869][ T9275] xfrm0: entered promiscuous mode [ 401.777070][ T9275] veth0_to_hsr: entered promiscuous mode [ 401.814513][ T9275] veth1_to_hsr: entered promiscuous mode [ 401.866555][ T9275] hsr0: entered promiscuous mode [ 401.878344][ T9330] IPv6: addrconf: prefix option has invalid lifetime [ 401.880513][ T9275] veth1_virt_wifi: entered promiscuous mode [ 401.898634][ T9275] veth0_virt_wifi: entered promiscuous mode [ 401.953231][ T9275] virt_wifi0: entered promiscuous mode [ 402.013649][ T9275] vlan0: entered promiscuous mode [ 402.028201][ T9275] vlan1: entered promiscuous mode [ 402.075202][ T9275] macvlan0: entered promiscuous mode [ 402.108066][ T9275] macvlan1: entered promiscuous mode [ 402.153351][ T9275] ipvlan0: entered promiscuous mode [ 402.176499][ T9275] ipvlan1: entered promiscuous mode [ 402.390721][ T9275] macvtap0: entered promiscuous mode [ 402.394336][ T9275] macsec0: entered promiscuous mode [ 402.399312][ T9275] geneve0: entered promiscuous mode [ 402.402155][ T9275] geneve1: entered promiscuous mode [ 402.405557][ T9275] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 402.433942][ T9275] netdevsim netdevsim2 netdevsim1: entered promiscuous mode [ 402.443029][ T9275] netdevsim netdevsim2 netdevsim2: entered promiscuous mode [ 402.453862][ T9275] netdevsim netdevsim2 netdevsim3: entered promiscuous mode [ 402.468694][ T9275] mac80211_hwsim hwsim3 ..c: entered promiscuous mode [ 402.472663][ T9275] erspan0.1: entered promiscuous mode [ 402.480847][ T9275] netdevsim netdevsim12 eth0: entered promiscuous mode [ 402.497329][ T9275] syzkaller0: entered promiscuous mode [ 402.522934][ T9275] ip6erspan0: entered promiscuous mode [ 402.536812][ T9275] vxlan0: entered promiscuous mode [ 402.582859][ T9223] )fl speed is unknown, defaulting to 1000 [ 402.582920][ T9223] syz2: Port: 1 Link DOWN [ 402.604947][ T13] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 402.604985][ T13] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 402.605012][ T13] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 402.605103][ T13] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 402.605132][ T13] netdevsim netdevsim12 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 402.605153][ T13] netdevsim netdevsim12 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.605180][ T13] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 402.605201][ T13] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.605290][ T13] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 402.605312][ T13] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.605337][ T13] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 402.605357][ T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.605383][ T13] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 402.605466][ T13] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.698459][ T1350] CoreChips 7-1:0.41 (unnamed net_device) (uninitialized): set LINK LED failed : -71 [ 402.698634][ T1350] CoreChips 7-1:0.41: probe with driver CoreChips failed with error -71 [ 402.701714][ T1350] usb 7-1: USB disconnect, device number 7 [ 402.726066][ T9318] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 403.252563][ T9342] netlink: 28 bytes leftover after parsing attributes in process `syz.2.629'. [ 403.295013][ T9344] )fl: entered promiscuous mode [ 403.301298][ T9344] tunl0: entered promiscuous mode [ 403.302115][ T9344] gre0: entered promiscuous mode [ 403.308686][ T9344] gretap0: entered promiscuous mode [ 403.320729][ T9344] erspan0: entered promiscuous mode [ 403.322935][ T9344] ip_vti0: entered promiscuous mode [ 403.323542][ T9344] ip6_vti0: entered promiscuous mode [ 403.324085][ T9344] sit0: entered promiscuous mode [ 403.343547][ T9344] ip6tnl0: entered promiscuous mode [ 403.348367][ T9344] ip6gre0: entered promiscuous mode [ 403.555179][ T9344] syz_tun: entered promiscuous mode [ 403.640539][ T9344] ip6gretap0: entered promiscuous mode [ 403.714569][ T9344] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.715153][ T9344] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.720914][ T9344] bridge0: entered promiscuous mode [ 403.730735][ T9344] vcan0: entered promiscuous mode [ 403.748188][ T9344] bond0: entered promiscuous mode [ 403.748272][ T9344] bond_slave_0: entered promiscuous mode [ 403.748489][ T9344] bond_slave_1: entered promiscuous mode [ 403.755284][ T9344] team0: entered promiscuous mode [ 403.755301][ T9344] team_slave_0: entered promiscuous mode [ 403.755581][ T9344] team_slave_1: entered promiscuous mode [ 403.771028][ T9344] dummy0: entered promiscuous mode [ 403.780358][ T9344] nlmon0: entered promiscuous mode [ 403.785606][ T9344] batadv0: entered promiscuous mode [ 403.793631][ T9344] vxcan0: entered promiscuous mode [ 403.801073][ T9344] vxcan1: entered promiscuous mode [ 403.808432][ T9344] veth0: entered promiscuous mode [ 403.818991][ T9344] veth1: entered promiscuous mode [ 403.831220][ T9344] wg0: entered promiscuous mode [ 403.872491][ T9344] wg1: entered promiscuous mode [ 403.880894][ T9344] wg2: entered promiscuous mode [ 403.889066][ T9344] veth0_to_bridge: entered promiscuous mode [ 403.902423][ T9344] veth1_to_bridge: entered promiscuous mode [ 403.923349][ T9344] veth0_to_bond: entered promiscuous mode [ 403.943854][ T9344] veth1_to_bond: entered promiscuous mode [ 403.954948][ T9344] veth0_to_team: entered promiscuous mode [ 403.970829][ T9344] veth1_to_team: entered promiscuous mode [ 403.981503][ T9344] veth0_to_batadv: entered promiscuous mode [ 403.987356][ T9320] usb 8-1: USB disconnect, device number 11 [ 403.991189][ T9344] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 403.991234][ T9344] batadv_slave_0: entered promiscuous mode [ 404.002444][ T9320] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 404.007913][ T9344] veth1_to_batadv: entered promiscuous mode [ 404.011183][ T9320] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 404.013622][ T9344] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 404.017051][ T9320] keyspan 8-1:1.0: device disconnected [ 404.029455][ T9344] batadv_slave_1: entered promiscuous mode [ 404.037430][ T9344] xfrm0: entered promiscuous mode [ 404.039197][ T9344] veth0_to_hsr: entered promiscuous mode [ 404.053841][ T9344] hsr0: entered promiscuous mode [ 404.058971][ T9344] veth1_virt_wifi: entered promiscuous mode [ 404.071059][ T9344] veth0_virt_wifi: entered promiscuous mode [ 404.082673][ T9344] virt_wifi0: entered promiscuous mode [ 404.104240][ T9344] vlan0: entered promiscuous mode [ 404.121881][ T9344] vlan1: entered promiscuous mode [ 404.130900][ T9344] macvlan0: entered promiscuous mode [ 404.297228][ T9344] macvlan1: entered promiscuous mode [ 404.300579][ T9344] ipvlan0: entered promiscuous mode [ 404.309483][ T9344] ipvlan1: entered promiscuous mode [ 404.339258][ T9344] macvtap0: entered promiscuous mode [ 404.355056][ T9344] macsec0: entered promiscuous mode [ 404.359572][ T9344] geneve0: entered promiscuous mode [ 404.362023][ T9344] geneve1: entered promiscuous mode [ 404.392051][ T9344] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 404.401635][ T9344] netdevsim netdevsim4 netdevsim1: entered promiscuous mode [ 404.414917][ T9344] netdevsim netdevsim4 netdevsim2: entered promiscuous mode [ 404.421232][ T9344] netdevsim netdevsim4 netdevsim3: entered promiscuous mode [ 404.443992][ T9344] mac80211_hwsim hwsim11 ..c: entered promiscuous mode [ 404.451772][ T9344] ip6erspan0: entered promiscuous mode [ 404.453401][ T9344] erspan0.1: entered promiscuous mode [ 404.461536][ T9344] vxlan0: entered promiscuous mode [ 404.494922][ T13] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 404.494955][ T13] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 404.495062][ T13] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 404.495088][ T13] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 404.495115][ T13] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 404.495141][ T13] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 404.495245][ T13] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 404.495268][ T13] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 404.678526][ T9351] jffs2: notice: (9351) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 404.754739][ T5796] Bluetooth: hci2: command 0x0c1a tx timeout [ 404.754783][ T5791] Bluetooth: hci1: command 0x0c1a tx timeout [ 405.250916][ T9318] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 405.251002][ T9318] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 405.251107][ T9318] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 405.469517][ T9359] netlink: 16 bytes leftover after parsing attributes in process `syz.3.631'. [ 406.849689][ T5791] Bluetooth: hci0: unexpected event for opcode 0x0809 [ 407.096364][ T9389] jffs2: notice: (9389) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 407.253151][ T5791] Bluetooth: hci2: unexpected cc 0x203d length: 85 > 1 [ 407.253242][ T5791] Bluetooth: hci2: unexpected event for opcode 0x203d [ 407.314642][ T67] Bluetooth: hci1: command 0x0c1a tx timeout [ 407.314679][ T5791] Bluetooth: hci4: command 0x0c1a tx timeout [ 409.484625][ T5791] Bluetooth: hci0: command 0x2016 tx timeout [ 411.091332][ T9401] netlink: 'syz.4.646': attribute type 10 has an invalid length. [ 411.091369][ T9401] netdevsim netdevsim4 netdevsim1: left promiscuous mode [ 411.092552][ T9401] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 411.093191][ T9401] netdevsim netdevsim4 netdevsim1: entered promiscuous mode [ 411.093897][ T9401] team0: Port device netdevsim1 added [ 411.230218][ T9397] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 411.230345][ T9397] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 411.296524][ T9397] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 411.296652][ T9397] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 411.602138][ T5796] Bluetooth: hci2: unexpected event for opcode 0x2040 [ 411.778552][ T9412] rxe_eth0 speed is unknown, defaulting to 1000 [ 411.953309][ T9412] )fl speed is unknown, defaulting to 1000 [ 412.100639][ T9427] SQUASHFS error: Failed to read block 0x0: -5 [ 412.100873][ T9427] unable to read squashfs_super_block [ 412.605232][ T9440] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 412.605573][ T9440] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 413.241329][ T9449] overlayfs: failed to clone upperpath [ 413.325505][ T5796] Bluetooth: hci4: command 0x0c1a tx timeout [ 413.428860][ T9451] pim6reg: entered allmulticast mode [ 413.524918][ T9448] pim6reg: left allmulticast mode [ 413.646306][ T9454] netlink: 4 bytes leftover after parsing attributes in process `syz.1.661'. [ 413.846606][ T9454] hsr_slave_1 (unregistering): left promiscuous mode [ 414.004760][ T9457] netlink: 8 bytes leftover after parsing attributes in process `syz.2.665'. [ 414.594777][ T5796] Bluetooth: hci2: command 0x0c1a tx timeout [ 414.675393][ T5796] Bluetooth: hci0: command 0x2016 tx timeout [ 414.675429][ T5796] Bluetooth: hci1: command 0x0c1a tx timeout [ 414.678141][ T9440] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 414.678287][ T9440] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 414.914704][ T9321] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 414.964723][ T9439] xt_nfacct: accounting object `syz0' does not exist [ 415.064620][ T9321] usb 7-1: Using ep0 maxpacket: 32 [ 415.069169][ T9321] usb 7-1: New USB device found: idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 415.132201][ T9321] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 415.132224][ T9321] usb 7-1: config 0 has no interface number 0 [ 415.212550][ T9321] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.212695][ T9321] usb 7-1: Product: syz [ 415.212763][ T9321] usb 7-1: Manufacturer: syz [ 415.212880][ T9321] usb 7-1: SerialNumber: syz [ 415.232585][ T9321] usb 7-1: config 0 descriptor?? [ 415.241710][ T9321] usb 7-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 415.241731][ T9321] usb 7-1: selecting invalid altsetting 1 [ 415.241900][ T9321] usb 7-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 415.277803][ T9321] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 415.278773][ T9321] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 415.278912][ T9321] usb 7-1: media controller created [ 415.293105][ T9321] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 416.055994][ T9486] netlink: 8 bytes leftover after parsing attributes in process `syz.3.675'. [ 416.356776][ T9321] usb 7-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 416.356818][ T9321] zl10353_read_register: readreg error (reg=127, ret==-110) [ 416.482058][ T9506] key id 00000001 not found [ 416.482993][ T5796] Bluetooth: hci1: Unable to find connection for big 0x00 [ 416.665562][ T9508] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 416.694397][ T9508] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 416.754951][ T67] Bluetooth: hci4: command 0x0c1a tx timeout [ 417.337118][ T9514] netlink: 16 bytes leftover after parsing attributes in process `syz.1.687'. [ 417.375961][ T9225] usb 7-1: USB disconnect, device number 8 [ 418.307779][ T9518] tmpfs: Bad value for 'mpol' [ 418.483403][ T9526] netlink: 8 bytes leftover after parsing attributes in process `syz.1.692'. [ 418.684847][ T67] Bluetooth: hci2: command 0x0c1a tx timeout [ 418.754681][ T67] Bluetooth: hci1: command 0x0c1a tx timeout [ 418.754709][ T67] Bluetooth: hci0: command 0x2016 tx timeout [ 418.760806][ T9508] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 418.761620][ T9508] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 418.813142][ T9508] xt_nfacct: accounting object `syz0' does not exist [ 419.195531][ T9542] dummy0: left promiscuous mode [ 419.332872][ T9544] jffs2: notice: (9544) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 419.486689][ T9549] xt_nfacct: accounting object `syz0' does not exist [ 420.834632][ T5796] Bluetooth: hci4: command 0x0c1a tx timeout [ 420.839246][ T5796] Bluetooth: hci0: command 0x2016 tx timeout [ 421.048405][ T9563] netlink: 8 bytes leftover after parsing attributes in process `syz.1.702'. [ 421.137805][ T9564] netlink: 16 bytes leftover after parsing attributes in process `syz.2.699'. [ 421.931644][ T5791] Bluetooth: hci0: Unable to find connection with handle 0x00c8 [ 421.969397][ T42] audit: type=1326 audit(1793187589.955:3527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9581 comm="syz.1.706" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 421.969618][ T42] audit: type=1326 audit(1793187589.955:3528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9581 comm="syz.1.706" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 421.970378][ T42] audit: type=1326 audit(1793187589.955:3529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9581 comm="syz.1.706" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 421.970496][ T42] audit: type=1326 audit(1793187589.955:3530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9581 comm="syz.1.706" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 421.970641][ T42] audit: type=1326 audit(1793187589.955:3531): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9581 comm="syz.1.706" exe="/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 421.970817][ T42] audit: type=1326 audit(1793187589.955:3532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9581 comm="syz.1.706" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 421.971240][ T42] audit: type=1326 audit(1793187589.955:3533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9581 comm="syz.1.706" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 421.971263][ T42] audit: type=1326 audit(1793187589.955:3534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9581 comm="syz.1.706" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 421.971282][ T42] audit: type=1326 audit(1793187589.955:3535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9581 comm="syz.1.706" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 421.971374][ T42] audit: type=1326 audit(1793187589.955:3536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9581 comm="syz.1.706" exe="/syz-executor" sig=0 arch=40000003 syscall=135 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 422.927814][ T67] Bluetooth: hci0: command 0x2016 tx timeout [ 422.928013][ T67] Bluetooth: hci4: command 0x0c1a tx timeout [ 423.172370][ T5791] Bluetooth: hci4: Unable to find connection for dst 00:00:00:00:00:00 sid 0x00 [ 423.601594][ T9588] jffs2: notice: (9588) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 424.545485][ T9608] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 424.546104][ T9608] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 424.552481][ T9608] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 424.552896][ T9608] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 424.625769][ T9608] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 424.642716][ T9607] xt_nfacct: accounting object `syz0' does not exist [ 424.879165][ T5796] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 425.673131][ T9623] netlink: 'syz.3.721': attribute type 1 has an invalid length. [ 426.333654][ T9634] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 426.333678][ T9634] CPU: 1 UID: 0 PID: 9634 Comm: syz.2.723 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 426.333707][ T9634] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 426.333715][ T9634] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 426.333726][ T9634] Call Trace: [ 426.333734][ T9634] [ 426.333756][ T9634] dump_stack_lvl+0x100/0x190 [ 426.333791][ T9634] sysfs_warn_dup.cold+0x1c/0x28 [ 426.333822][ T9634] sysfs_create_dir_ns+0x24b/0x2b0 [ 426.333847][ T9634] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 426.333868][ T9634] ? find_held_lock+0x2b/0x80 [ 426.333892][ T9634] ? kobject_add_internal+0x25f/0x930 [ 426.333919][ T9634] ? kobject_add_internal+0x25f/0x930 [ 426.333949][ T9634] ? class_dir_child_ns_type+0xd/0x60 [ 426.333970][ T9634] kobject_add_internal+0x2c8/0x930 [ 426.334001][ T9634] kobject_add+0x16a/0x1e0 [ 426.334028][ T9634] ? __pfx_kobject_add+0x10/0x10 [ 426.334057][ T9634] ? get_device_parent+0x1b3/0x4c0 [ 426.334084][ T9634] ? kobject_put+0xb9/0x640 [ 426.334133][ T9634] device_add+0x294/0x1970 [ 426.334152][ T9634] ? lockdep_init_map_type+0x5c/0x250 [ 426.334173][ T9634] ? __pfx_device_add+0x10/0x10 [ 426.334191][ T9634] ? lockdep_init_map_type+0x5c/0x250 [ 426.334212][ T9634] ? __init_waitqueue_head+0xca/0x150 [ 426.334241][ T9634] tty_register_device_attr+0x388/0x810 [ 426.334265][ T9634] ? lockdep_init_map_type+0x5c/0x250 [ 426.334286][ T9634] ? __pfx_tty_register_device_attr+0x10/0x10 [ 426.334330][ T9634] ? tty_port_init+0x156/0x1c0 [ 426.334356][ T9634] gsm_activate_mux+0x155/0x2a0 [ 426.334387][ T9634] gsmld_ioctl+0xbbc/0x15c0 [ 426.334422][ T9634] ? __pfx_gsmld_ioctl+0x10/0x10 [ 426.334468][ T9634] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 426.334496][ T9634] ? __pfx_gsmld_ioctl+0x10/0x10 [ 426.334521][ T9634] tty_compat_ioctl+0x396/0x420 [ 426.334544][ T9634] ? __pfx_tty_compat_ioctl+0x10/0x10 [ 426.334567][ T9634] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 426.334600][ T9634] __do_fast_syscall_32+0x14b/0x8c0 [ 426.334626][ T9634] do_fast_syscall_32+0x32/0x70 [ 426.334648][ T9634] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 426.334671][ T9634] RIP: 0023:0xf73fefbc [ 426.334686][ T9634] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 426.334704][ T9634] RSP: 002b:00000000f53f550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 426.334724][ T9634] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000404c4701 [ 426.334735][ T9634] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 426.334747][ T9634] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 426.334757][ T9634] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 426.334766][ T9634] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 426.334822][ T9634] [ 426.380793][ T9634] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 426.488119][ T9634] netlink: 8 bytes leftover after parsing attributes in process `syz.2.723'. [ 426.594817][ T5796] Bluetooth: hci1: command 0x0c1a tx timeout [ 426.674722][ T5796] Bluetooth: hci4: command 0x0c1a tx timeout [ 426.929768][ T5796] Bluetooth: hci0: command 0x2016 tx timeout [ 428.108948][ T9645] netlink: 16 bytes leftover after parsing attributes in process `syz.4.718'. [ 428.354967][ T42] kauditd_printk_skb: 332 callbacks suppressed [ 428.356985][ T42] audit: type=1800 audit(1793187596.275:3869): pid=9647 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.726" name="file1" dev="sda1" ino=2038 res=0 errno=-22 [ 429.005321][ T5796] Bluetooth: hci0: command 0x2016 tx timeout [ 429.350964][ T9662] tmpfs: Bad value for 'huge' [ 429.360095][ T9662] xt_nfacct: accounting object `syz0' does not exist [ 429.924523][ T9687] netlink: 28 bytes leftover after parsing attributes in process `syz.3.734'. [ 431.083214][ T67] Bluetooth: hci0: command 0x2016 tx timeout [ 431.133593][ T9704] netlink: 8 bytes leftover after parsing attributes in process `syz.4.735'. [ 431.394783][ T5796] Bluetooth: hci4: command 0x0c1a tx timeout [ 432.251576][ T9751] ovs-dp0: entered promiscuous mode [ 432.511913][ T9761] netlink: 8 bytes leftover after parsing attributes in process `syz.1.756'. [ 433.207350][ T9764] jffs2: notice: (9764) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 433.502938][ T5791] Bluetooth: hci4: command 0x0c1a tx timeout [ 433.665620][ T9770] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 433.666127][ T9770] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 433.666175][ T9770] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 433.667829][ T9770] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 433.667937][ T9770] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 433.672238][ T9770] xt_nfacct: accounting object `syz0' does not exist [ 433.888223][ T9795] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 433.888249][ T9795] CPU: 1 UID: 0 PID: 9795 Comm: syz.2.766 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 433.888278][ T9795] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 433.888286][ T9795] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 433.888295][ T9795] Call Trace: [ 433.888301][ T9795] [ 433.888308][ T9795] dump_stack_lvl+0x100/0x190 [ 433.888358][ T9795] sysfs_warn_dup.cold+0x1c/0x28 [ 433.888386][ T9795] sysfs_create_dir_ns+0x24b/0x2b0 [ 433.888410][ T9795] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 433.888430][ T9795] ? find_held_lock+0x2b/0x80 [ 433.888455][ T9795] ? kobject_add_internal+0x25f/0x930 [ 433.888482][ T9795] ? kobject_add_internal+0x25f/0x930 [ 433.888512][ T9795] ? class_dir_child_ns_type+0xd/0x60 [ 433.888533][ T9795] kobject_add_internal+0x2c8/0x930 [ 433.888566][ T9795] kobject_add+0x16a/0x1e0 [ 433.888593][ T9795] ? __pfx_kobject_add+0x10/0x10 [ 433.888622][ T9795] ? get_device_parent+0x1b3/0x4c0 [ 433.888648][ T9795] ? kobject_put+0xb9/0x640 [ 433.888681][ T9795] device_add+0x294/0x1970 [ 433.888699][ T9795] ? lockdep_init_map_type+0x5c/0x250 [ 433.888719][ T9795] ? __pfx_device_add+0x10/0x10 [ 433.888736][ T9795] ? lockdep_init_map_type+0x5c/0x250 [ 433.888755][ T9795] ? __init_waitqueue_head+0xca/0x150 [ 433.888783][ T9795] tty_register_device_attr+0x388/0x810 [ 433.888815][ T9795] ? lockdep_init_map_type+0x5c/0x250 [ 433.888833][ T9795] ? __pfx_tty_register_device_attr+0x10/0x10 [ 433.888859][ T9795] ? tty_port_init+0x156/0x1c0 [ 433.888880][ T9795] gsm_activate_mux+0x155/0x2a0 [ 433.888902][ T9795] gsmld_ioctl+0xbbc/0x15c0 [ 433.888931][ T9795] ? __pfx_gsmld_ioctl+0x10/0x10 [ 433.888970][ T9795] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 433.888995][ T9795] ? __pfx_gsmld_ioctl+0x10/0x10 [ 433.889014][ T9795] tty_compat_ioctl+0x396/0x420 [ 433.889033][ T9795] ? __pfx_tty_compat_ioctl+0x10/0x10 [ 433.889053][ T9795] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 433.889080][ T9795] __do_fast_syscall_32+0x14b/0x8c0 [ 433.889104][ T9795] do_fast_syscall_32+0x32/0x70 [ 433.889123][ T9795] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 433.889144][ T9795] RIP: 0023:0xf73fefbc [ 433.889159][ T9795] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 433.889176][ T9795] RSP: 002b:00000000f53f550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 433.889197][ T9795] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000404c4701 [ 433.889209][ T9795] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 433.889220][ T9795] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 433.889231][ T9795] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 433.889243][ T9795] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 433.889268][ T9795] [ 433.889367][ T9795] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 433.892833][ T9795] netlink: 8 bytes leftover after parsing attributes in process `syz.2.766'. [ 435.499379][ T9811] openvswitch: netlink: IPv6 tunnel dst address is zero [ 435.717042][ T67] Bluetooth: hci4: command 0x0c1a tx timeout [ 435.717106][ T5791] Bluetooth: hci1: command 0x0c1a tx timeout [ 435.717140][ T5791] Bluetooth: hci2: command 0x0c1a tx timeout [ 435.717220][ T5796] Bluetooth: hci0: command 0x2016 tx timeout [ 436.562413][ T9828] jffs2: notice: (9828) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 436.612532][ T9826] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 436.751459][ T9836] netlink: 28 bytes leftover after parsing attributes in process `syz.4.774'. [ 438.674632][ T5796] Bluetooth: hci1: command 0x0c1a tx timeout [ 438.674675][ T8997] Bluetooth: hci2: command 0x0c1a tx timeout [ 438.680392][ T9826] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 438.680658][ T9826] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 438.680853][ T9826] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 438.698506][ T9826] xt_nfacct: accounting object `syz0' does not exist [ 439.091454][ T9321] usb 8-1: new full-speed USB device number 12 using dummy_hcd [ 439.576169][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.576495][ T1443] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.702021][ T9321] usb 8-1: New USB device found: idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 439.724319][ T9857] netlink: 8 bytes leftover after parsing attributes in process `syz.4.788'. [ 439.725893][ T9321] usb 8-1: config 0 has an invalid interface number: 41 but max is 0 [ 439.725913][ T9321] usb 8-1: config 0 has no interface number 0 [ 439.725941][ T9321] usb 8-1: config 0 interface 41 has no altsetting 0 [ 439.728636][ T9321] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.728656][ T9321] usb 8-1: Product: syz [ 439.728668][ T9321] usb 8-1: Manufacturer: syz [ 439.728679][ T9321] usb 8-1: SerialNumber: syz [ 439.731544][ T9321] usb 8-1: config 0 descriptor?? [ 440.162354][ T9838] )fl: entered promiscuous mode [ 440.239939][ T9838] tunl0: entered promiscuous mode [ 440.240462][ T9838] gre0: entered promiscuous mode [ 440.244026][ T9838] gretap0: entered promiscuous mode [ 440.247387][ T9838] erspan0: entered promiscuous mode [ 440.248234][ T9838] ip_vti0: entered promiscuous mode [ 440.249224][ T9838] ip6_vti0: entered promiscuous mode [ 440.249991][ T9838] sit0: entered promiscuous mode [ 440.251173][ T9878] netlink: 40 bytes leftover after parsing attributes in process `syz.4.796'. [ 440.256640][ T9838] ip6tnl0: entered promiscuous mode [ 440.260893][ T9838] ip6gre0: entered promiscuous mode [ 440.266020][ T9838] syz_tun: entered promiscuous mode [ 440.273291][ T9838] ip6gretap0: entered promiscuous mode [ 440.280917][ T9838] bridge0: port 3(netdevsim0) entered disabled state [ 440.281083][ T9838] bridge0: port 2(bridge_slave_1) entered disabled state [ 440.281466][ T9838] bridge0: entered promiscuous mode [ 440.285934][ T9838] vcan0: entered promiscuous mode [ 440.287452][ T9838] team0: entered promiscuous mode [ 440.287468][ T9838] team_slave_0: entered promiscuous mode [ 440.287669][ T9838] team_slave_1: entered promiscuous mode [ 440.287962][ T9838] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 440.291743][ T9838] dummy0: entered promiscuous mode [ 440.302182][ T9838] nlmon0: entered promiscuous mode [ 440.306290][ T9838] batadv0: entered promiscuous mode [ 440.310222][ T9838] vxcan0: entered promiscuous mode [ 440.311537][ T9838] vxcan1: entered promiscuous mode [ 440.312942][ T9838] veth0: entered promiscuous mode [ 440.317649][ T9838] veth1: entered promiscuous mode [ 440.325056][ T9838] wg0: entered promiscuous mode [ 440.328258][ T9838] wg1: entered promiscuous mode [ 440.331198][ T9838] wg2: entered promiscuous mode [ 440.334419][ T9838] veth0_to_bridge: entered promiscuous mode [ 440.340582][ T9838] veth1_to_bridge: entered promiscuous mode [ 440.347190][ T9838] veth0_to_bond: entered promiscuous mode [ 440.349269][ T9838] bond_slave_0: entered promiscuous mode [ 440.350172][ T9838] veth1_to_bond: entered promiscuous mode [ 440.350632][ T9882] openvswitch: netlink: nsh attribute has 100 unknown bytes. [ 440.353743][ T9838] bond_slave_1: entered promiscuous mode [ 440.354089][ T9838] veth0_to_team: entered promiscuous mode [ 440.377688][ T9838] veth1_to_team: entered promiscuous mode [ 440.384089][ T9838] veth0_to_batadv: entered promiscuous mode [ 440.388535][ T9838] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 440.388627][ T9838] batadv_slave_0: entered promiscuous mode [ 440.392002][ T9838] veth1_to_batadv: entered promiscuous mode [ 440.396189][ T9838] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 440.396228][ T9838] batadv_slave_1: entered promiscuous mode [ 440.399849][ T9838] xfrm0: entered promiscuous mode [ 440.402674][ T9838] veth0_to_hsr: entered promiscuous mode [ 440.409486][ T9838] hsr0: entered promiscuous mode [ 440.412871][ T9838] veth1_virt_wifi: entered promiscuous mode [ 440.416894][ T9838] veth0_virt_wifi: entered promiscuous mode [ 440.419962][ T9838] virt_wifi0: entered promiscuous mode [ 440.428001][ T9838] vlan0: entered promiscuous mode [ 440.431849][ T9838] vlan1: entered promiscuous mode [ 440.454424][ T9838] macvlan0: entered promiscuous mode [ 440.470096][ T9838] macvlan1: entered promiscuous mode [ 440.473730][ T9838] ipvlan0: entered promiscuous mode [ 440.474036][ T9838] ipvlan1: entered promiscuous mode [ 440.488870][ T9838] macvtap0: entered promiscuous mode [ 440.491682][ T9838] macsec0: entered promiscuous mode [ 440.493694][ T9838] geneve0: entered promiscuous mode [ 440.500790][ T9838] geneve1: entered promiscuous mode [ 440.541503][ T9838] netdevsim netdevsim3 netdevsim2: entered promiscuous mode [ 440.552769][ T9838] netdevsim netdevsim3 netdevsim3: entered promiscuous mode [ 440.571958][ T9838] mac80211_hwsim hwsim5 ..c: entered promiscuous mode [ 440.573559][ T9838] team_slave_0.1: entered promiscuous mode [ 440.573824][ T9838] ip6erspan0: entered promiscuous mode [ 440.573976][ T9838] pim6reg: entered promiscuous mode [ 440.574475][ T9838] vxlan0: entered promiscuous mode [ 440.591514][ T9323] s`z1: Port: 1 Link DOWN [ 440.606358][ T13] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.606592][ T13] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.606754][ T13] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.606915][ T13] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.755136][ T67] Bluetooth: hci1: command 0x0c1a tx timeout [ 440.755176][ T67] Bluetooth: hci0: command 0x2016 tx timeout [ 440.755397][ T5796] Bluetooth: hci4: command 0x0c1a tx timeout [ 440.759078][ T9321] CoreChips 8-1:0.41 (unnamed net_device) (uninitialized): set LINK LED failed : -71 [ 440.759214][ T9321] CoreChips 8-1:0.41: probe with driver CoreChips failed with error -71 [ 440.768250][ T9321] usb 8-1: USB disconnect, device number 12 [ 441.183979][ T9912] netlink: 32 bytes leftover after parsing attributes in process `syz.4.812'. [ 442.042473][ T9935] netlink: 'syz.3.823': attribute type 10 has an invalid length. [ 442.042488][ T9935] netlink: 40 bytes leftover after parsing attributes in process `syz.3.823'. [ 442.042553][ T9935] batadv0: entered allmulticast mode [ 442.043892][ T9935] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 442.044131][ T9935] bridge0: port 4(batadv0) entered blocking state [ 442.044206][ T9935] bridge0: port 4(batadv0) entered disabled state [ 442.055833][ T9932] netlink: 8 bytes leftover after parsing attributes in process `syz.1.820'. [ 442.459475][ T9944] bond1: entered promiscuous mode [ 442.467215][ T13] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 442.467230][ T13] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 442.884824][ T5796] Bluetooth: hci1: command 0x0c1a tx timeout [ 444.454259][ T9978] netlink: 8 bytes leftover after parsing attributes in process `syz.2.838'. [ 444.566856][ T9983] netlink: 56 bytes leftover after parsing attributes in process `syz.2.840'. [ 444.642790][ T9990] netlink: 32 bytes leftover after parsing attributes in process `syz.2.843'. [ 444.802000][T10000] netlink: 8 bytes leftover after parsing attributes in process `syz.2.849'. [ 444.905327][T10006] Invalid source name [ 444.905423][T10006] UBIFS error (pid: 10006): cannot open "./file0", error -22 [ 445.904236][T10023] netlink: 8 bytes leftover after parsing attributes in process `syz.1.859'. [ 446.827454][T10044] program syz.1.868 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 446.888465][T10046] tmpfs: Bad value for 'huge' [ 446.901784][T10048] netlink: 12 bytes leftover after parsing attributes in process `syz.1.871'. [ 446.912820][T10046] xt_nfacct: accounting object `syz0' does not exist [ 447.853516][T10065] netlink: 28 bytes leftover after parsing attributes in process `syz.2.875'. [ 448.133007][T10069] program syz.2.877 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 448.553326][ T5796] Bluetooth: hci4: unexpected event for opcode 0x0428 [ 449.256200][T10150] openvswitch: netlink: Message has 628 unknown bytes. [ 449.508790][T10168] netlink: 1030 bytes leftover after parsing attributes in process `syz.4.922'. [ 449.514859][ T9320] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 449.675182][ T9320] usb 6-1: New USB device found: idVendor=06cd, idProduct=0135, bcdDevice=1.00 [ 449.676939][ T9320] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 449.676977][ T9320] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.681689][ T9320] keyspan 6-1:1.0: Keyspan 2 port adapter converter detected [ 449.681788][ T9320] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 81 [ 449.681867][ T9320] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 1 [ 449.682608][ T9320] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 84 [ 449.682642][ T9320] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 2 [ 449.688103][ T9320] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 449.689664][ T9320] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 88 [ 449.689744][ T9320] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 6 [ 449.695975][ T9320] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 449.705365][T10176] netlink: 8 bytes leftover after parsing attributes in process `syz.4.926'. [ 449.802426][T10180] netdevsim netdevsim4 : renamed from netdevsim0 [ 449.953431][T10186] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 450.192076][ T64] IPVS: starting estimator thread 0... [ 450.287701][T10191] IPVS: using max 42 ests per chain, 100800 per kthread [ 450.587449][ T5796] Bluetooth: hci2: unexpected event for opcode 0x2003 [ 450.994831][ T5796] Bluetooth: hci4: command 0x0c1a tx timeout [ 452.521451][ T9320] usb 6-1: USB disconnect, device number 7 [ 452.794613][ T9320] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 452.945361][ T9320] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 452.945767][ T9320] keyspan 6-1:1.0: device disconnected [ 453.000356][T10242] device-mapper: ioctl: The device has no table. [ 453.302583][T10254] netdevsim netdevsim3: Firmware load for './file0/file0/..' refused, path contains '..' component [ 453.356224][T10256] xt_nfacct: accounting object `syz0' does not exist [ 455.411833][T10272] netlink: 32 bytes leftover after parsing attributes in process `syz.1.965'. [ 455.634866][ T67] Bluetooth: hci4: command 0x0c1a tx timeout [ 455.919268][T10287] device-mapper: table: 248:3: verity: Invalid number of feature args (-EINVAL) [ 455.919283][T10287] device-mapper: ioctl: error adding target to table [ 456.158150][T10299] netlink: 16 bytes leftover after parsing attributes in process `syz.1.976'. [ 456.250737][T10303] No source specified [ 456.754011][T10321] bridge_slave_0: default FDB implementation only supports local addresses [ 457.714715][ T67] Bluetooth: hci4: command 0x0c1a tx timeout [ 457.885466][ T9320] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 458.046100][ T9320] usb 8-1: New USB device found: idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 458.048153][ T9320] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 458.048170][ T9320] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 458.048181][ T9320] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 458.048193][ T9320] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 458.051703][ T9320] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 458.051715][ T9320] usb 8-1: Product: syz [ 458.051722][ T9320] usb 8-1: Manufacturer: syz [ 458.051729][ T9320] usb 8-1: SerialNumber: syz [ 458.054984][ T9320] usb 8-1: config 0 descriptor?? [ 458.154820][ T9312] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 458.270441][ T9320] adutux 8-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 458.304663][ T9312] usb 6-1: Using ep0 maxpacket: 8 [ 458.305180][ T9312] usb 6-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 458.307616][ T9312] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 458.307629][ T9312] usb 6-1: config 0 has no interface number 0 [ 458.307645][ T9312] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 458.307656][ T9312] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 458.307668][ T9312] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 458.307680][ T9312] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 458.307690][ T9312] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 458.307708][ T9312] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 458.309385][ T9312] usb 6-1: config 0 descriptor?? [ 458.320961][ T9312] ldusb 6-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 458.469929][ T9320] usb 8-1: USB disconnect, device number 13 [ 458.517372][ T9321] usb 6-1: USB disconnect, device number 8 [ 458.519744][ T9321] ldusb 6-1:0.55: LD USB Device #1 now disconnected [ 459.012088][T10371] xt_l2tp: missing protocol rule (udp|l2tpip) [ 460.478693][T10392] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 461.172524][T10421] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1025'. [ 461.223403][T10424] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1026'. [ 461.265372][T10426] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1027'. [ 461.414085][T10401] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 461.530047][T10433] Bluetooth: MGMT ver 1.23 [ 461.899482][T10443] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 462.116834][T10422] Set syz1 is full, maxelem 6117 reached [ 463.554807][ T5796] Bluetooth: hci1: Opcode 0x0c24 failed: -110 [ 463.556656][ T5796] Bluetooth: hci1: command 0x0c1a tx timeout [ 466.260931][T10500] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 466.262944][T10500] device-mapper: table: 248:4: raid: Inappropriate argument: stripe_cache (-EINVAL) [ 466.263101][T10500] device-mapper: ioctl: error adding target to table [ 466.555181][ T67] Bluetooth: hci4: unexpected event for opcode 0x2043 [ 466.993310][T10516] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1062'. [ 466.994022][T10516] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1062'. [ 467.033600][T10519] jffs2: notice: (10519) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 467.374187][T10539] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1073'. [ 467.777675][T10556] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1077'. [ 467.897641][T10554] Set syz1 is full, maxelem 6117 reached [ 468.119754][T10571] device-mapper: table: 248:1: thin-pool: target type may not be included in a read-only table (-EINVAL) [ 468.119776][T10571] device-mapper: ioctl: error adding target to table [ 468.253966][T10575] device-mapper: multipath queue-length: repeat_count > 1 is deprecated, using 1 instead [ 468.254150][T10575] device-mapper: table: table load rejected: including non-request-stackable devices [ 468.254159][T10575] device-mapper: table: unable to determine table type [ 468.532380][T10592] tmpfs: Bad value for 'huge' [ 468.636370][T10592] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 469.591763][T10615] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1103'. [ 469.769389][ T67] Bluetooth: hci4: unknown advertising packet type: 0xff [ 469.769452][ T67] Bluetooth: hci4: unknown advertising packet type: 0xfa [ 469.769461][ T67] Bluetooth: hci4: unknown advertising packet type: 0x09 [ 469.769469][ T67] Bluetooth: hci4: unknown advertising packet type: 0x05 [ 469.769477][ T67] Bluetooth: hci4: unknown advertising packet type: 0xff [ 469.769485][ T67] Bluetooth: hci4: unknown advertising packet type: 0x09 [ 469.769502][ T67] Bluetooth: hci4: Malformed LE Event: 0x02 [ 470.528683][T10640] tmpfs: Bad value for 'huge' [ 470.553158][T10640] xt_nfacct: accounting object `syz0' does not exist [ 470.605655][ T67] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 470.605765][ T67] Bluetooth: hci4: Injecting HCI hardware error event [ 470.674863][ T67] Bluetooth: hci2: command 0x0c1a tx timeout [ 470.684923][ T5796] Bluetooth: hci1: command 0x0c1a tx timeout [ 470.688266][T10592] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 470.696326][T10592] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 470.696526][T10592] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 470.713080][ T8997] Bluetooth: hci4: hardware error 0x00 [ 470.722297][T10592] xt_nfacct: accounting object `syz0' does not exist [ 470.944737][ T9225] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 470.945883][T10648] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1117'. [ 470.946714][T10648] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1117'. [ 471.096258][ T9225] usb 7-1: Using ep0 maxpacket: 8 [ 471.098264][ T9225] usb 7-1: unable to get BOS descriptor or descriptor too short [ 471.098303][ T9225] usb 7-1: New USB device found: idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 471.099336][ T9225] usb 7-1: config 4 interface 0 has no altsetting 0 [ 471.102212][ T9225] usb 7-1: string descriptor 0 read error: -22 [ 471.102280][ T9225] usb 7-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 471.111611][ T9225] usb 7-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 471.128956][ T9225] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 471.129201][ T9225] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 471.129237][ T9225] usb 7-1: media controller created [ 471.143105][ T9225] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 471.322702][ T9225] zl10353_read_register: readreg error (reg=127, ret==0) [ 471.352363][ T9225] usb 7-1: USB disconnect, device number 9 [ 471.966531][T10694] tmpfs: Bad value for 'huge' [ 472.156735][T10694] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 472.156772][T10694] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 472.312774][T10694] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 472.329610][T10694] xt_nfacct: accounting object `syz0' does not exist [ 472.389847][T10713] tmpfs: Bad value for 'huge' [ 472.393255][T10713] xt_nfacct: accounting object `syz0' does not exist [ 472.463573][ T42] audit: type=1326 audit(1793187640.445:3870): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10717 comm="syz.1.1147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 472.466732][ T42] audit: type=1326 audit(1793187640.445:3871): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10717 comm="syz.1.1147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 472.467328][ T42] audit: type=1326 audit(1793187640.455:3872): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10717 comm="syz.1.1147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 472.467560][ T42] audit: type=1326 audit(1793187640.455:3873): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10717 comm="syz.1.1147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 472.467758][ T42] audit: type=1326 audit(1793187640.455:3874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10717 comm="syz.1.1147" exe="/syz-executor" sig=0 arch=40000003 syscall=377 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 472.468051][ T42] audit: type=1326 audit(1793187640.455:3875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10717 comm="syz.1.1147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 472.468210][ T42] audit: type=1326 audit(1793187640.455:3876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10717 comm="syz.1.1147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 472.468830][ T42] audit: type=1326 audit(1793187640.455:3877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10717 comm="syz.1.1147" exe="/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 472.470309][ T42] audit: type=1326 audit(1793187640.455:3878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10717 comm="syz.1.1147" exe="/syz-executor" sig=0 arch=40000003 syscall=252 compat=1 ip=0xf747efbc code=0x7ffc0000 [ 472.564681][ T9225] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 472.714719][ T9225] usb 8-1: Using ep0 maxpacket: 8 [ 472.716091][ T9225] usb 8-1: New USB device found: idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 472.718034][ T9225] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 472.718057][ T9225] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 472.718077][ T9225] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 472.727038][ T9225] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.727056][ T9225] usb 8-1: Product: syz [ 472.727067][ T9225] usb 8-1: Manufacturer: syz [ 472.727078][ T9225] usb 8-1: SerialNumber: syz [ 472.728983][ T9225] usb 8-1: config 0 descriptor?? [ 472.731093][T10707] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 472.754795][ T8997] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 472.785703][ T9225] rc_core: IR keymap rc-streamzap not found [ 472.785719][ T9225] Registered IR keymap rc-empty [ 472.786747][ T9225] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0 [ 472.788179][ T9225] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0/input19 [ 472.919823][T10732] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 472.919946][T10732] CPU: 0 UID: 0 PID: 10732 Comm: syz.1.1152 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 472.919974][T10732] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 472.919981][T10732] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 472.919993][T10732] Call Trace: [ 472.920000][T10732] [ 472.920008][T10732] dump_stack_lvl+0x100/0x190 [ 472.920040][T10732] sysfs_warn_dup.cold+0x1c/0x28 [ 472.920096][T10732] sysfs_create_dir_ns+0x24b/0x2b0 [ 472.920119][T10732] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 472.920140][T10732] ? find_held_lock+0x2b/0x80 [ 472.920163][T10732] ? kobject_add_internal+0x25f/0x930 [ 472.920189][T10732] ? kobject_add_internal+0x25f/0x930 [ 472.920213][T10732] ? class_dir_child_ns_type+0xd/0x60 [ 472.920233][T10732] kobject_add_internal+0x2c8/0x930 [ 472.920263][T10732] kobject_add+0x16a/0x1e0 [ 472.920287][T10732] ? __pfx_kobject_add+0x10/0x10 [ 472.920315][T10732] ? get_device_parent+0x1b3/0x4c0 [ 472.920338][T10732] ? kobject_put+0xb9/0x640 [ 472.920369][T10732] device_add+0x294/0x1970 [ 472.920387][T10732] ? lockdep_init_map_type+0x5c/0x250 [ 472.920407][T10732] ? __pfx_device_add+0x10/0x10 [ 472.920423][T10732] ? lockdep_init_map_type+0x5c/0x250 [ 472.920442][T10732] ? __init_waitqueue_head+0xca/0x150 [ 472.920468][T10732] tty_register_device_attr+0x388/0x810 [ 472.920492][T10732] ? lockdep_init_map_type+0x5c/0x250 [ 472.920511][T10732] ? __pfx_tty_register_device_attr+0x10/0x10 [ 472.920540][T10732] ? tty_port_init+0x156/0x1c0 [ 472.920565][T10732] gsm_activate_mux+0x155/0x2a0 [ 472.920585][T10732] gsmld_ioctl+0xbbc/0x15c0 [ 472.920617][T10732] ? __pfx_gsmld_ioctl+0x10/0x10 [ 472.920667][T10732] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 472.920693][T10732] ? __pfx_gsmld_ioctl+0x10/0x10 [ 472.920718][T10732] tty_compat_ioctl+0x396/0x420 [ 472.920741][T10732] ? __pfx_tty_compat_ioctl+0x10/0x10 [ 472.920763][T10732] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 472.920795][T10732] __do_fast_syscall_32+0x14b/0x8c0 [ 472.920820][T10732] do_fast_syscall_32+0x32/0x70 [ 472.920840][T10732] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 472.920861][T10732] RIP: 0023:0xf747efbc [ 472.920877][T10732] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 472.920893][T10732] RSP: 002b:00000000f547550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 472.920911][T10732] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000404c4701 [ 472.920923][T10732] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 472.920932][T10732] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 472.920941][T10732] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 472.920951][T10732] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 472.920975][T10732] [ 472.921352][T10732] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 472.932849][T10732] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1152'. [ 473.016428][ T9321] usb 8-1: USB disconnect, device number 14 [ 473.826086][T10750] tmpfs: Bad value for 'huge' [ 473.935905][T10758] tmpfs: Bad value for 'huge' [ 473.945159][T10750] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 473.951951][T10758] xt_nfacct: accounting object `syz0' does not exist [ 474.181014][T10768] Bluetooth: hci0: load_link_keys: expected 3 bytes, got 28 bytes [ 475.954741][ T8997] Bluetooth: hci1: command 0x0c1a tx timeout [ 475.954969][ T8997] Bluetooth: hci2: command 0x0c1a tx timeout [ 476.006331][T10750] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 476.104414][T10750] xt_nfacct: accounting object `syz0' does not exist [ 476.839831][T10822] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1185'. [ 476.839962][T10822] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1185'. [ 478.035049][ T5796] Bluetooth: hci1: command 0x0c1a tx timeout [ 478.035278][ T8997] Bluetooth: hci2: command 0x0c1a tx timeout [ 478.404897][T10851] tmpfs: Bad value for 'huge' [ 478.408630][T10851] xt_nfacct: accounting object `syz0' does not exist [ 479.154691][T10857] tmpfs: Bad value for 'huge' [ 479.179698][T10857] xt_nfacct: accounting object `syz0' does not exist [ 479.347024][T10864] netlink: 'syz.1.1206': attribute type 10 has an invalid length. [ 479.349642][T10864] netlink: 'syz.1.1206': attribute type 10 has an invalid length. [ 479.573380][T10868] device-mapper: table: 248:6: multipath: unknown path selector type (-EINVAL) [ 479.573404][T10868] device-mapper: ioctl: error adding target to table [ 479.659075][T10880] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1211'. [ 479.808712][T10872] device-mapper: ioctl: can't change device type (old=2 vs new=1) after initial table load. [ 480.114733][ T5796] Bluetooth: hci1: command 0x0c1a tx timeout [ 481.080805][T10904] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1220'. [ 481.123621][T10906] tmpfs: Bad value for 'huge' [ 481.130955][T10906] xt_nfacct: accounting object `syz0' does not exist [ 482.541078][T10919] tipc: Enabling of bearer rejected, failed to enable media [ 482.687885][T10827] Set syz0 is full, maxelem 65536 reached [ 484.019280][T10941] device-mapper: table: 248:7: ram7 too small for target: start=8191, len=4104, dev_size=8192 [ 484.019299][T10941] device-mapper: core: Cannot calculate initial queue limits [ 484.019304][T10941] device-mapper: ioctl: unable to set up device queue for new table. [ 485.055473][T10978] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1245'. [ 485.055586][T10978] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1245'. [ 486.030158][T11001] program syz.3.1255 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 486.974897][ T9312] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 487.124708][ T9312] usb 8-1: Using ep0 maxpacket: 8 [ 487.125917][ T9312] usb 8-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 487.127236][ T9312] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 487.127276][ T9312] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 487.127294][ T9312] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 487.127311][ T9312] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 487.127324][ T9312] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 487.127344][ T9312] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.341886][ T9312] usb 8-1: GET_CAPABILITIES returned 0 [ 487.341912][ T9312] usbtmc 8-1:16.0: can't read capabilities [ 487.553223][ T9312] usb 8-1: USB disconnect, device number 15 [ 487.654437][T11062] tmpfs: Bad value for 'huge' [ 487.660644][T11062] xt_nfacct: accounting object `syz0' does not exist [ 489.162284][ T9320] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 489.223977][T11105] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1299'. [ 489.226338][T11105] netlink: 'syz.4.1299': attribute type 12 has an invalid length. [ 489.315396][ T9320] usb 7-1: New USB device found: idVendor=0451, idProduct=505f, bcdDevice=1.00 [ 489.316502][ T9320] usb 7-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 489.316581][ T9320] usb 7-1: config 2 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 489.316596][ T9320] usb 7-1: config 2 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 489.316609][ T9320] usb 7-1: config 2 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 489.319040][ T9320] usb 7-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 489.319072][ T9320] usb 7-1: config 2 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 489.319086][ T9320] usb 7-1: config 2 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 489.319100][ T9320] usb 7-1: config 2 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 489.320745][ T9320] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.320757][ T9320] usb 7-1: Product: syz [ 489.320764][ T9320] usb 7-1: Manufacturer: syz [ 489.320771][ T9320] usb 7-1: SerialNumber: syz [ 489.331563][ T9320] ti_usb_3410_5052 7-1:2.0: TI USB 5052 2 port adapter converter detected [ 489.338370][ T9320] usb 7-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 489.343317][ T9320] usb 7-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 489.452250][ T42] audit: type=1400 audit(1793187657.435:3879): apparmor="STATUS" info="unsupported interface version" error=-93 profile="unconfined" pid=11116 comm="syz.1.1296" offset=16 [ 489.553908][T11087] ti_usb_3410_5052_2 ttyUSB0: ti_open - no interrupt urb [ 489.568423][ T9312] usb 7-1: USB disconnect, device number 10 [ 489.590561][ T9312] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 489.605420][ T9312] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 489.607910][ T9312] ti_usb_3410_5052 7-1:2.0: device disconnected [ 490.793064][T11137] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1309'. [ 491.165859][T11154] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 491.216384][ T12] rtrs_client L1784: : Resolving route failed, err: -ENODEV [ 491.259632][T11154] rtrs_client L2654: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 491.382668][T11163] synth uevent: /devices/pci0000:00/0000:00:02.0: unknown uevent action string [ 491.382722][T11163] e1000e 0000:00:02.0: uevent: failed to send synthetic uevent: -22 [ 491.437528][T11166] input: syz1 as /devices/virtual/input/input20 [ 492.337231][T11182] loop8: detected capacity change from 0 to 1 [ 492.383057][T11184] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 492.520113][T11182] Dev loop8: unable to read RDB block 1 [ 492.520137][T11182] loop8: unable to read partition table [ 492.520292][T11182] loop8: partition table beyond EOD, truncated [ 492.520313][T11182] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 492.735140][T11196] smbdirect: ib_dev[sys] renamed to [syz1] [ 493.516497][T11212] jffs2: notice: (11212) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 495.090527][T11132] Set syz0 is full, maxelem 65536 reached [ 495.197907][T11239] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1346'. [ 495.389477][T11251] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1351'. [ 496.135637][T11268] jffs2: notice: (11268) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 496.854751][ T9312] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 497.005100][ T9312] usb 6-1: New USB device found: idVendor=256c, idProduct=006d, bcdDevice=0.00 [ 497.005534][ T9312] usb 6-1: config 0 has no interfaces? [ 497.007629][ T9312] usb 6-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 497.007645][ T9312] usb 6-1: Manufacturer: syz [ 497.009004][ T9312] usb 6-1: config 0 descriptor?? [ 497.222492][ T9312] usb 6-1: USB disconnect, device number 9 [ 497.388941][T11293] sd 0:0:0:0: PR command failed: 1026 [ 497.389398][T11293] sd 0:0:0:0: Sense Key : Illegal Request [current] [ 497.389789][T11293] sd 0:0:0:0: Add. Sense: Invalid command operation code [ 497.950904][T11329] ieee802154 phy0 wpan0: encryption failed: -22 [ 498.435351][ T857] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 498.700816][ T857] usb 8-1: Using ep0 maxpacket: 8 [ 498.706093][ T857] usb 8-1: New USB device found: idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 498.716018][ T857] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 498.716180][ T857] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 498.716410][ T857] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 498.716509][ T857] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 498.716608][ T857] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 498.716706][ T857] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 498.716803][ T857] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 498.716902][ T857] usb 8-1: config 168 interface 0 has no altsetting 0 [ 498.723358][ T857] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 498.723488][ T857] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 498.723751][ T857] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 498.723849][ T857] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 498.723947][ T857] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 498.724028][ T857] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 498.724072][ T857] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 498.724086][ T857] usb 8-1: config 168 interface 0 has no altsetting 0 [ 498.729325][ T857] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 498.729453][ T857] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 498.729555][ T857] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 498.729606][ T857] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 498.729620][ T857] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 498.729782][ T857] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 498.729880][ T857] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 498.729977][ T857] usb 8-1: config 168 interface 0 has no altsetting 0 [ 498.860693][ T857] usb 8-1: string descriptor 0 read error: -22 [ 498.861317][ T857] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.953886][ T857] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 499.176685][ T5898] usb 8-1: USB disconnect, device number 16 [ 499.750725][T11355] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1393'. [ 500.400736][T11266] Set syz0 is full, maxelem 65536 reached [ 501.007383][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.007487][ T1443] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.096831][T11379] rnbd_client L127: Can't parse path ip:027.0.0.1*3;*\L 3c8Q;.fO3XFi]H2oWأ5+@: -22 [ 501.474730][ T9312] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 501.625199][ T9312] usb 6-1: New USB device found: idVendor=0451, idProduct=505f, bcdDevice=1.00 [ 501.626098][ T9312] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 501.626887][ T9312] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 501.628439][ T9312] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.628451][ T9312] usb 6-1: Product: syz [ 501.628458][ T9312] usb 6-1: Manufacturer: syz [ 501.628465][ T9312] usb 6-1: SerialNumber: syz [ 501.632724][ T9312] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 501.664681][ T9312] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 501.667694][ T9312] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 501.771614][T11389] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1406'. [ 501.874081][T11394] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1408'. [ 502.564056][ T42] audit: type=1400 audit(1793187670.545:3880): apparmor="STATUS" info="failed to unpack profile flags" error=-71 profile="unconfined" name="foo" pid=11408 comm="syz.2.1415" name="foo" offset=55 [ 502.917857][T11377] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set config on port 0, -110 [ 502.919296][T11377] ti_usb_3410_5052_2 ttyUSB0: ti_write_byte - failed, -32 [ 502.919366][T11377] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set modem control on port 0, -32 [ 502.920128][T11377] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot send open command, -32 [ 502.972092][ T857] usb 6-1: USB disconnect, device number 10 [ 503.117192][ T857] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 503.143142][ T857] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 503.154322][ T857] ti_usb_3410_5052 6-1:2.0: device disconnected [ 503.248246][T11431] Bluetooth: hci3: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 503.957600][T11448] nvme_fcloop: unknown parameter or missing value 'ww' [ 505.316203][ T8997] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 506.651381][T11492] tmpfs: Bad value for 'huge' [ 506.678886][T11492] xt_nfacct: accounting object `syz0' does not exist [ 507.426030][ T9312] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 507.574673][ T9312] usb 8-1: Using ep0 maxpacket: 32 [ 507.575337][ T9312] usb 8-1: New USB device found: idVendor=1fd2, idProduct=6007, bcdDevice=0.00 [ 507.576314][ T9312] usb 8-1: too many endpoints for config 0 interface 0 altsetting 5: 146, using maximum allowed: 30 [ 507.576342][ T9312] usb 8-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 507.576368][ T9312] usb 8-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 146 [ 507.576387][ T9312] usb 8-1: config 0 interface 0 has no altsetting 0 [ 507.576418][ T9312] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 507.580184][ T9312] usb 8-1: config 0 descriptor?? [ 508.067614][ T9312] hid-multitouch 0003:1FD2:6007.0002: hiddev0,hidraw1: USB HID v0.00 Device [HID 1fd2:6007] on usb-dummy_hcd.3-1/input0 [ 508.152571][ T34] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 508.251507][T11527] input: PS/2 BYD TouchPad as /devices/platform/i8042/serio1/input/input21 [ 508.303043][ T9324] usb 8-1: USB disconnect, device number 17 [ 508.306459][ T34] usb 6-1: Using ep0 maxpacket: 8 [ 508.394474][ T34] usb 6-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 508.398340][ T34] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 508.398508][ T34] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 508.398558][ T34] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 508.398570][ T34] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 508.398640][ T34] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 508.398697][ T34] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.768107][ T34] usb 6-1: GET_CAPABILITIES returned 0 [ 508.768468][ T34] usbtmc 6-1:16.0: can't read capabilities [ 508.947251][ T34] usb 6-1: USB disconnect, device number 11 [ 509.329346][T11559] tun0: tun_chr_ioctl cmd 1074025675 [ 509.329365][T11559] tun0: persist disabled [ 509.570859][ T1169] Bluetooth: hci3: Frame reassembly failed (-84) [ 509.571432][ T1169] Bluetooth: hci3: Frame reassembly failed (-84) [ 509.571655][ T1169] Bluetooth: hci3: Frame reassembly failed (-84) [ 509.592936][ T103] Bluetooth: hci3: Frame reassembly failed (-84) [ 509.690727][T11563] batman_adv: batadv0: Adding interface: macsec1 [ 509.690744][T11563] batman_adv: batadv0: The MTU of interface macsec1 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 509.690894][T11563] batman_adv: batadv0: Interface activated: macsec1 [ 510.886215][ T42] audit: type=1400 audit(1793187678.875:3881): apparmor="STATUS" info="failed to unpack profile flags" error=-71 profile="unconfined" name="p" pid=11599 comm="syz.2.1491" name="p" offset=53 [ 511.639065][ T8997] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 511.642791][ T5796] Bluetooth: hci3: command 0x1003 tx timeout [ 512.352541][T11616] tmpfs: Bad value for 'huge' [ 512.706528][T11616] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 512.706835][T11616] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 512.711396][T11616] xt_nfacct: accounting object `syz0' does not exist [ 513.437362][T11653] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 514.754711][ T5796] Bluetooth: hci2: command 0x0c1a tx timeout [ 514.754761][ T8997] Bluetooth: hci1: command 0x0c1a tx timeout [ 515.328459][T11700] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1535'. [ 517.959825][T11723] faux_driver vgem: [drm] Unknown color mode 55545; guessing buffer size. [ 518.041676][T11727] netlink: 'syz.1.1544': attribute type 2 has an invalid length. [ 518.462180][ T9324] kernel read not supported for file /comedi4 (pid: 9324 comm: kworker/1:8) [ 518.472381][T11748] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1555'. [ 518.555659][T11752] tmpfs: Bad value for 'huge' [ 518.709045][ T12] smpboot: CPU 1 is now offline [ 518.853165][ T12] [ 518.854364][ T12] ====================================================== [ 518.857461][ T12] WARNING: possible circular locking dependency detected [ 518.860468][ T12] syzkaller #0 Tainted: G L Y [ 518.862957][ T12] ------------------------------------------------------ [ 518.865960][ T12] kworker/u32:0/12 is trying to acquire lock: [ 518.868622][ T12] ffff88801eb2ef08 (kn->active#5){++++}-{0:0}, at: __kernfs_remove+0x34c/0xbc0 [ 518.872394][ T12] [ 518.872394][ T12] but task is already holding lock: [ 518.875799][ T12] ffffffff8fe7a5b0 (cpu_hotplug_lock){++++}-{0:0}, at: acpi_processor_post_eject+0x146/0x390 [ 518.880365][ T12] [ 518.880365][ T12] which lock already depends on the new lock. [ 518.880365][ T12] [ 518.884933][ T12] [ 518.884933][ T12] the existing dependency chain (in reverse order) is: [ 518.888719][ T12] [ 518.888719][ T12] -> #3 (cpu_hotplug_lock){++++}-{0:0}: [ 518.892103][ T12] lock_acquire+0x1d1/0x380 [ 518.894373][ T12] percpu_down_write+0x4e/0x3d0 [ 518.896347][ T12] _cpu_up+0x68/0x960 [ 518.898362][ T12] cpu_up+0x1ba/0x230 [ 518.900150][ T12] cpuhp_bringup_mask+0xf8/0x180 [ 518.902511][ T12] bringup_nonboot_cpus+0xd9/0x1b0 [ 518.904867][ T12] smp_init+0x32/0x150 [ 518.906833][ T12] kernel_init_freeable+0x44b/0x7b0 [ 518.909259][ T12] kernel_init+0x21/0x1e0 [ 518.911343][ T12] ret_from_fork+0x730/0xd60 [ 518.913539][ T12] ret_from_fork_asm+0x1a/0x30 [ 518.915819][ T12] [ 518.915819][ T12] -> #2 (cpu_add_remove_lock){+.+.}-{4:4}: [ 518.919065][ T12] lock_acquire+0x1d1/0x380 [ 518.921254][ T12] __mutex_lock+0x19f/0x1c10 [ 518.923437][ T12] cpu_device_down+0x46/0xc0 [ 518.925573][ T12] device_offline+0x2f4/0x400 [ 518.927845][ T12] acpi_bus_offline+0x3c7/0x550 [ 518.930114][ T12] acpi_device_hotplug+0x627/0xbe0 [ 518.932437][ T12] acpi_hotplug_work_fn+0x5e/0x90 [ 518.934760][ T12] process_one_work+0xac7/0x1b10 [ 518.937037][ T12] worker_thread+0x5ef/0xe50 [ 518.939217][ T12] kthread+0x373/0x450 [ 518.941187][ T12] ret_from_fork+0x730/0xd60 [ 518.943337][ T12] ret_from_fork_asm+0x1a/0x30 [ 518.945597][ T12] [ 518.945597][ T12] -> #1 (&device->physical_node_lock){+.+.}-{4:4}: [ 518.949219][ T12] lock_acquire+0x1d1/0x380 [ 518.951348][ T12] __mutex_lock+0x19f/0x1c10 [ 518.953480][ T12] acpi_companion_match+0xc0/0x180 [ 518.955891][ T12] acpi_device_uevent_modalias+0x19/0x30 [ 518.958570][ T12] platform_uevent+0x51/0xc0 [ 518.960797][ T12] dev_uevent+0x1de/0x870 [ 518.962867][ T12] kobject_uevent_env+0x6eb/0x18b0 [ 518.965294][ T12] kobject_synth_uevent+0x679/0x7d0 [ 518.967669][ T12] uevent_store+0x24/0x50 [ 518.969757][ T12] dev_attr_store+0x58/0x80 [ 518.971981][ T12] sysfs_kf_write+0xf2/0x150 [ 518.973926][ T12] kernfs_fop_write_iter+0x3e0/0x5f0 [ 518.976372][ T12] vfs_write+0x6af/0x1050 [ 518.978383][ T12] ksys_write+0x12a/0x250 [ 518.980546][ T12] do_syscall_64+0x121/0x770 [ 518.982852][ T12] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.985691][ T12] [ 518.985691][ T12] -> #0 (kn->active#5){++++}-{0:0}: [ 518.988547][ T12] check_prev_add+0xeb/0xe60 [ 518.990555][ T12] __lock_acquire+0x1528/0x1f40 [ 518.992941][ T12] lock_acquire+0x1d1/0x380 [ 518.995221][ T12] kernfs_drain+0x4eb/0x600 [ 518.997457][ T12] __kernfs_remove+0x34c/0xbc0 [ 518.999824][ T12] kernfs_remove_by_name_ns+0x7c/0x120 [ 519.002286][ T12] device_del+0x361/0x9b0 [ 519.004460][ T12] device_unregister+0x1d/0xe0 [ 519.006809][ T12] unregister_cpu+0xa0/0x140 [ 519.009092][ T12] acpi_processor_post_eject+0x16f/0x390 [ 519.011824][ T12] acpi_device_hotplug+0x9df/0xbe0 [ 519.014327][ T12] acpi_hotplug_work_fn+0x5e/0x90 [ 519.016808][ T12] process_one_work+0xac7/0x1b10 [ 519.019278][ T12] worker_thread+0x5ef/0xe50 [ 519.021528][ T12] kthread+0x373/0x450 [ 519.023623][ T12] ret_from_fork+0x730/0xd60 [ 519.025894][ T12] ret_from_fork_asm+0x1a/0x30 [ 519.028255][ T12] [ 519.028255][ T12] other info that might help us debug this: [ 519.028255][ T12] [ 519.032628][ T12] Chain exists of: [ 519.032628][ T12] kn->active#5 --> cpu_add_remove_lock --> cpu_hotplug_lock [ 519.032628][ T12] [ 519.037828][ T12] Possible unsafe locking scenario: [ 519.037828][ T12] [ 519.041135][ T12] CPU0 CPU1 [ 519.043419][ T12] ---- ---- [ 519.045797][ T12] lock(cpu_hotplug_lock); [ 519.047831][ T12] lock(cpu_add_remove_lock); [ 519.051025][ T12] lock(cpu_hotplug_lock); [ 519.054145][ T12] lock(kn->active#5); [ 519.056024][ T12] [ 519.056024][ T12] *** DEADLOCK *** [ 519.056024][ T12] [ 519.059571][ T12] locks held by kworker/u32:0/12: 6, last CPU#0: [ 519.062449][ T12] #0: ffff888021fff148 ((wq_completion)kacpi_hotplug){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 [ 519.067275][ T12] #1: ffffc900001e7d08 ((work_completion)(&hpw->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 519.072142][ T12] #2: ffffffff9104a520 (device_hotplug_lock){+.+.}-{4:4}, at: acpi_device_hotplug+0x7e/0xbe0 [ 519.076122][ T12] #3: ffffffff90d19080 (acpi_scan_lock){+.+.}-{4:4}, at: acpi_device_hotplug+0x8c/0xbe0 [ 519.080426][ T12] #4: ffffffff8fe7a660 (cpu_add_remove_lock){+.+.}-{4:4}, at: acpi_processor_post_eject+0x141/0x390 [ 519.085159][ T12] #5: ffffffff8fe7a5b0 (cpu_hotplug_lock){++++}-{0:0}, at: acpi_processor_post_eject+0x146/0x390 [ 519.089788][ T12] [ 519.089788][ T12] stack backtrace: [ 519.092412][ T12] CPU: 0 UID: 0 PID: 12 Comm: kworker/u32:0 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 519.097085][ T12] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 519.099634][ T12] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 519.103998][ T12] Workqueue: kacpi_hotplug acpi_hotplug_work_fn [ 519.106761][ T12] Call Trace: [ 519.108261][ T12] [ 519.109637][ T12] dump_stack_lvl+0x100/0x190 [ 519.111738][ T12] print_circular_bug.cold+0x178/0x1be [ 519.114210][ T12] check_noncircular+0x146/0x160 [ 519.116428][ T12] check_prev_add+0xeb/0xe60 [ 519.118489][ T12] __lock_acquire+0x1528/0x1f40 [ 519.120673][ T12] lock_acquire+0x1d1/0x380 [ 519.122705][ T12] ? __kernfs_remove+0x34c/0xbc0 [ 519.124899][ T12] ? kernfs_drain+0x4c2/0x600 [ 519.126998][ T12] kernfs_drain+0x4eb/0x600 [ 519.129021][ T12] ? __kernfs_remove+0x34c/0xbc0 [ 519.131248][ T12] ? __pfx_kernfs_drain+0x10/0x10 [ 519.133478][ T12] ? find_held_lock+0x2b/0x80 [ 519.135557][ T12] ? __kernfs_remove+0x224/0xbc0 [ 519.137660][ T12] ? __kernfs_remove+0x224/0xbc0 [ 519.139804][ T12] ? up_write+0x2dc/0x5b0 [ 519.141654][ T12] __kernfs_remove+0x34c/0xbc0 [ 519.143704][ T12] ? __pfx_acpi_processor_post_eject+0x10/0x10 [ 519.146370][ T12] kernfs_remove_by_name_ns+0x7c/0x120 [ 519.148786][ T12] device_del+0x361/0x9b0 [ 519.150699][ T12] ? __pfx_device_del+0x10/0x10 [ 519.152763][ T12] ? __pfx_acpi_processor_post_eject+0x10/0x10 [ 519.155105][ T12] ? kernfs_remove_by_name_ns+0xbb/0x120 [ 519.157468][ T12] ? __pfx_acpi_processor_post_eject+0x10/0x10 [ 519.160211][ T12] device_unregister+0x1d/0xe0 [ 519.162336][ T12] unregister_cpu+0xa0/0x140 [ 519.164423][ T12] acpi_processor_post_eject+0x16f/0x390 [ 519.166907][ T12] acpi_device_hotplug+0x9df/0xbe0 [ 519.169199][ T12] ? __pfx_acpi_device_hotplug+0x10/0x10 [ 519.171692][ T12] acpi_hotplug_work_fn+0x5e/0x90 [ 519.173887][ T12] process_one_work+0xac7/0x1b10 [ 519.176101][ T12] ? __pfx_process_one_work+0x10/0x10 [ 519.178479][ T12] ? lock_acquire+0x1d1/0x380 [ 519.180599][ T12] ? __pfx_acpi_hotplug_work_fn+0x10/0x10 [ 519.183117][ T12] worker_thread+0x5ef/0xe50 [ 519.185184][ T12] ? kthread+0x13a/0x450 [ 519.187100][ T12] ? __pfx_worker_thread+0x10/0x10 [ 519.189373][ T12] kthread+0x373/0x450 [ 519.191237][ T12] ? __pfx_kthread+0x10/0x10 [ 519.193216][ T12] ret_from_fork+0x730/0xd60 [ 519.195201][ T12] ? __pfx_ret_from_fork+0x10/0x10 [ 519.197477][ T12] ? __switch_to+0x800/0x10e0 [ 519.199589][ T12] ? __pfx_kthread+0x10/0x10 [ 519.201648][ T12] ret_from_fork_asm+0x1a/0x30 [ 519.203792][ T12] [ 519.211715][T11752] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 519.211853][T11752] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 519.239344][T11752] xt_nfacct: accounting object `syz0' does not exist [ 521.234819][ T5796] Bluetooth: hci1: command 0x0c1a tx timeout [ 521.234854][ T5796] Bluetooth: hci2: command 0x0c1a tx timeout