last executing test programs: 9.371884996s ago: executing program 0 (id=517): r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, 0x0, 0x8000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x40}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000040)="ff02040000b5ffffffffffffffff2e2be82db1af00000000", 0x18) r4 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r4, &(0x7f0000000100)={0x0, 0x3f, &(0x7f0000000080)=[{&(0x7f0000000140)="1c0000005e007f029e3b470d649b72ab25399cd956c07dead6a93690", 0x1c}], 0x1}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, 0x0}, 0x40) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000040)=0x1) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000100)={0x0, 0x0, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000000)=0x4) 7.74808894s ago: executing program 0 (id=522): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={0xffffffffffffffff, 0x0, 0x10, 0x38, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r0 = gettid() setsockopt$MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000600)={{0xa, 0x0, 0x8, @local, 0xc}, {0xa, 0x4e24, 0x0, @empty}, 0x1}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000000)={{0xa, 0x4e24, 0x100, @local, 0x4}, {0xa, 0x4e23, 0x7, @empty, 0xd473}, 0x0, {[0x4, 0x7, 0x3, 0x8001, 0xe10, 0xe, 0x3]}}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1, {[0x400000, 0x101, 0x0, 0x0, 0x3, 0xe3, 0x949, 0x2]}}, 0xfffffffffffffec8) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$binfmt_format(r1, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x0, 0x0}) mkdir(0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) rmdir(0x0) close_range(r2, 0xffffffffffffffff, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, 0x0) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0186415, &(0x7f0000000200)={&(0x7f00001d5000/0x1000)=nil, 0x3, 0x0, 0x80}) sendmsg$NL80211_CMD_NEW_KEY(r1, 0x0, 0x44) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0042, 0x0) copy_file_range(r4, 0x0, r4, &(0x7f0000000140)=0x8, 0x2, 0x0) 7.270243501s ago: executing program 2 (id=523): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x4000000) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x1, @empty, 0x4000ca}, 0x1c) recvmmsg(r1, &(0x7f0000002e80), 0x4000071, 0x830b, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x10}}, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'lo\x00'}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') syz_open_dev$ttys(0xc, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) clock_gettime(0x0, &(0x7f0000000140)) 7.1682017s ago: executing program 1 (id=525): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat(0xffffffffffffff9c, 0x0, 0x320800d, 0x31) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00'}) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, 0x0, 0x0) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, 0x0, 0x0) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f00000000c0)={'pcl711\x00', [0x140, 0x1f, 0x9, 0x2, 0x10000007, 0x1, 0x7fff, 0x30000002, 0x7, 0xc72d, 0x0, 0x7, 0x3, 0x400008, 0x29, 0x72f0, 0x101, 0x6, 0x6, 0x401, 0x4, 0x484, 0xa2dc, 0x9, 0x1000, 0x80000001, 0xa, 0x0, 0x383, 0x8001, 0x4]}) writev(r4, &(0x7f0000001600)=[{&(0x7f0000000180)="29e3e5864ceda68155960e4b20eb0403a718", 0x12}, {&(0x7f0000000300)="ac3d900278bc4f67", 0x8}, {&(0x7f0000000340)="79baf7c80af72c6d074d7aa55d18c2b3f92fb55d09041ffa4b66a0ed18f71e54cc0a5bc1461a6d07e6d4f31058721987ab90040f06c98df9afdd7c6614915beee9a0bea8187c6315a4be760ebc06c000bbe9a766f3752ff9ed8b304d3378bfd1a88dfc510d611a8c13259173a7c957bdd73f4bc320391f6d862cfdd58f6c09abefc7302f22bf6795474455a958f56a17d1551e", 0x93}, {0x0}, {&(0x7f00000004c0)="a407d58cecfb1369d434cee2363e2e667262a9fda651de7eb280ec8ff5087e0036af2fef7939cac0a06e6169aa6caa951a4a9b35e608532fafaa74692296b26bf7525aefeadde445128254deda33cb8622aad1f5aa0ab3ba8a81949805", 0x5d}, {0x0}], 0x6) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r5, @ANYBLOB="0008000007500500580012800b00010062726964676500004800028005001900"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) r7 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r7, 0x29, 0x13, 0x0, 0x0) 6.459869438s ago: executing program 0 (id=527): bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0xfffffffffffffe42, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff, 0x2f, 0x0, @void}, 0x10) r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x41}, 0x10) sendmsg$tipc(r1, &(0x7f00000008c0)={&(0x7f0000000600)=@name, 0x10, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x80) r2 = dup3(r0, r1, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ptp0(0xffffff9c, 0x0, 0x40, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000080)=0x1, 0x12) creat(&(0x7f00000002c0)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="090000001400000008000000baab000042000000", @ANYRES32=0x1, @ANYBLOB='\x00\x00o\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000080), 0x208e24b) writev(r4, 0x0, 0x0) lseek(r4, 0x0, 0x4) setsockopt$TIPC_GROUP_LEAVE(r2, 0x10f, 0x88) 5.165192197s ago: executing program 3 (id=528): r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) listen(0xffffffffffffffff, 0x0) listen(0xffffffffffffffff, 0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) recvmmsg(r1, &(0x7f0000001e80), 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000002c000000030a010800000000000000000100000b0900030073797a32000000000900010073797a300000000060000000060a010400000000000000000100000008000b40000000000900010073797a300000000038000480340001800a0001006d61746368000000240002800c000300b07346e358c219250b0001006367726f75700000080002"], 0xd4}}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) io_uring_setup(0x549c, &(0x7f0000000000)={0x0, 0x70e6, 0x2, 0x2, 0xf2}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f0000000080)=ANY=[@ANYBLOB="f572c10000a88c43c226f0a6380778c72739a0", @ANYRESOCT=r1], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_procfs(0xffffffffffffffff, 0x0) mmap(&(0x7f00005f7000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) r4 = openat$pmem0(0xffffffffffffff9c, &(0x7f0000002340), 0x80d01, 0x0) pwrite64(r4, &(0x7f0000000000)="a5", 0xfffffe8c, 0x2) write$binfmt_format(0xffffffffffffffff, &(0x7f0000000040)='1\x00', 0x2) ioctl$BLKRRPART(r4, 0x125f, 0x1f) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x3c4, 0x10, 0x2, 0xa, 0x14000000, 0x1, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x1, 0x723, 0x400, 0x2, 0x3562bc0d, 0x100, 0xffffffa7, 0x5, 0x34d, 0x1, 0x3ff, 0x9, 0x200, 0xe2df, 0x4aa14, 0x1, 0x4, 0x0, 0x6, 0xf58, 0x1]}) ioctl$COMEDI_BUFCONFIG(r0, 0x8020640d, 0x0) 5.16487438s ago: executing program 1 (id=529): r0 = socket(0x2000000000000021, 0x2, 0x2) shutdown(r0, 0x2) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x88a40, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x1, @empty, 0x4000ca}, 0x1c) r3 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @local}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20002051, 0x0, 0xffffffffffffff04) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'lo\x00'}) syz_open_dev$ttys(0xc, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) clock_gettime(0x0, &(0x7f0000000140)) read(r1, &(0x7f0000000180)=""/4, 0x1) 4.449104129s ago: executing program 1 (id=530): r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, 0x0, 0x8000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x40}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000040)="ff02040000b5ffffffffffffffff2e2be82db1af00000000", 0x18) r4 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r4, &(0x7f0000000100)={0x0, 0x3f, &(0x7f0000000080)=[{&(0x7f0000000140)="1c0000005e007f029e3b470d649b72ab25399cd956c07dead6a93690", 0x1c}], 0x1}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, 0x0}, 0x40) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000040)=0x1) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000100)={0x0, 0x0, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000000)=0x4) 3.890458962s ago: executing program 0 (id=531): r0 = gettid() kcmp(r0, r0, 0x4, 0xffffffffffffffff, 0xffffffffffffffff) getpgrp(0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) sendmsg$IEEE802154_LIST_PHY(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x95}, 0x40000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0xc0686611, 0x0) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{0x0}], 0x1) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, &(0x7f0000000180)=0x6f) write$dsp(r2, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) openat$sequencer2(0xffffff9c, &(0x7f0000000000), 0x20940, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10040003}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000001c0)={&(0x7f0000000880)=@report={0x17c, 0x20, 0x100, 0x70bd2a, 0x25dfdbfc, {0x6c, {@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in6=@mcast2, 0x4e24, 0x0, 0x4e21, 0x22, 0xa, 0x20, 0x120, 0x6}}, [@algo_auth_trunc={0xd4, 0x14, {{'sha224-asm\x00'}, 0xfffffffffffffec5, 0xa0, "15240b32d2694d56b24c49aec0d3d8ae2d5f9680bdaa24f91956cef74f4ac5c9695675e79debb10634724a5adb5e01ee49ad6abff456c58189bd4df4246db4dfa434ad00f5de92420798907f045ac689695333f12284f9269a67129e7152d5176efc55085a4c683cb1a388958cf7424d99d79b9306348adce0e94c3a1b6c2a156e2b1b3343dd75bb"}}, @replay_esn_val={0x40, 0x17, {0x9, 0x70bd2d, 0x70bd2d, 0x70bd25, 0x70bd26, 0x5, [0x9764, 0x7, 0x7, 0x4, 0x1, 0x281, 0x6, 0x0, 0x9]}}, @encap={0x1c, 0x4, {0xfffffffffffffffe, 0x4e21, 0x4e20, @in6=@mcast2}}]}, 0x17c}}, 0x0) sendmsg$nl_xfrm(r3, &(0x7f00000005c0)={&(0x7f0000000000), 0xc, &(0x7f0000000600)={&(0x7f0000000640)=@newpolicy={0xf8, 0x13, 0x90d, 0x2, 0x0, {{@in=@local, @in6=@loopback, 0x1234, 0x1234, 0x0, 0x0, 0xa}, {0x39ee, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, {0x6}, 0x0, 0x0, 0x2}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x4d2, 0x33}, 0xa, @in6=@loopback, 0x0, 0x4}]}]}, 0xf8}}, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r4, 0x29, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="0000007f00000001"], 0x8) 3.778334286s ago: executing program 2 (id=532): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e4, 0x134, 0x168, 0x9, 0x134, 0xb, 0x21c, 0x250, 0x250, 0x21c, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0xec, 0x134, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x24}}, @inet=@rpfilter={{0x24}, {0xc}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@empty, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0xc8, 0xe8, 0x0, {}, [@common=@inet=@set2={{0x24}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x340) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x2012, r1, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={[], [], 0x2c}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) listns(&(0x7f0000000000)={0x20, 0x0, 0x2}, &(0x7f0000000040)=[0x0], 0xf4240, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) setsockopt$inet_int(r4, 0x0, 0x19, 0x0, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@multicast2, 0x0, 0x0, 0x4e24, 0x0, 0x2}, {0x200000010000, 0x3, 0x1, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x9}, {0x0, 0x8, 0xfffffffffffffff8, 0x8}, 0x0, 0x0, 0x1, 0x0, 0x1}, {{@in=@empty, 0x2, 0x6c}, 0x2, @in=@empty, 0x0, 0x5, 0x0, 0xb7}}, 0xe8) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x0) r5 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r5, 0x403c6f2b, &(0x7f0000000000)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0xf9, 0x5}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r5, 0x403c6f2b, &(0x7f0000000080)={0x6, {"7fb13911afb5ea7f027063aa876dd358", "cfe484e50900", "d9ca451d96249a1dee77476cc87f7d0a"}, 0x6}) sendmsg$netlink(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000780)=ANY=[@ANYBLOB="200000001100010000000000ffdbdf25100000000b00000056ccabd869c2030095bc9389dcab1b9e63580a69b2cde86e672248d3167c7925a9eb8e65a19b87275380e7680719e0805fb5f5bb959c6dbf8c4f6be6205026b18c1549fa651f0531573b4a5f40d05e72ee7463cad17852db834a8884ce357b6f582fc52d563132c5d75064eb0d440579f9df127bafc3be87dc162b8201e52b0826f9410a8220005adbab1f24f9e534014f457c93ef000ea0439401568d319dbaa1675b7df1ab906ac9486a4b0ae351e3b4df15"], 0x20}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) 3.504660007s ago: executing program 2 (id=533): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x20040055}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d1de0000080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2c0000000d0a01030048cdf227000000000000000a0000010900020073797a310000008f0900303cc812f4d13ced7e01"], 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) recvmsg(r2, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x40000100) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r5 = dup(r4) mmap(&(0x7f00005fe000/0x2000)=nil, 0x2000, 0x2, 0x28011, r5, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$BLKZEROOUT(r4, 0x127f, &(0x7f00000000c0)={0x600, 0x80600}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x2}) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, &(0x7f0000000180)={0x0, @bt={0xf, 0x10, 0x1, 0x2, 0x8, 0x9, 0xffffffd9, 0x7, 0x9, 0x8, 0x80000000, 0x3, 0x401, 0x1, 0x4, 0x2, {0xf, 0x2}, 0x8, 0x5}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r6, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) syz_open_dev$sndpcmc(&(0x7f0000004240), 0x0, 0x0) r7 = socket(0x40000000015, 0x5, 0x0) recvmmsg(r7, &(0x7f0000001740)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000008, 0x8031, 0xffffffffffffffff, 0x0) 3.504416556s ago: executing program 3 (id=534): setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x268}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x21800, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYRES32=r1, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000ac1414bb000000000000000000000000000000000000000009000000000000000600000002000000ffff0000000000001c250800000000000080000000000000f5ffffffffffffff0000000000000000060000000000000000000000000000001f00000004000000000000800000000002000000fcffffff090000002abd7000043500000a0001fd20000000"], 0xec}, 0x1, 0x0, 0x0, 0x8801}, 0x40810) syz_open_dev$hidraw(&(0x7f0000000280), 0x4, 0x90743) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc854}, 0x50) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder1\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x1c, r3, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008001}, 0x840) r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r4, 0x0, 0x4004) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0) write(r5, &(0x7f0000000140)='0000:00:02.0', 0xc) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/vfio-pci/bind\x00', 0x1, 0x0) write(r6, &(0x7f0000000140)='0000:00:02.0', 0xc) 3.398416109s ago: executing program 1 (id=535): ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(0xffffffffffffffff, 0xc0245720, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x3, &(0x7f0000000300)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x10000000}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x24c4436d5a174b6d, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x4004000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x4) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000540), r3) sendmsg$TIPC_CMD_SHOW_PORTS(r3, &(0x7f0000000680)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, r4, 0x300, 0x70bd26, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) r5 = socket$igmp(0x2, 0x3, 0x2) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0xc}, @hci_rp_le_read_supported_states={{0x3}, {0x40, "481a20001200"}}}}, 0xf) r6 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000200)) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TUNNEL_KEY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_TUNNEL_DREG={0x8, 0x2, 0x1, 0x0, 0x9}]}}}, {0x28, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0x17}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xec}}, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r5, 0x0, 0x60, &(0x7f00000008c0)={'filter\x00', 0x7, 0x4, 0x404, 0x0, 0x218, 0x10c, 0x324, 0x324, 0x324, 0x4, &(0x7f0000000280), {[{{@arp={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, 0xff000330, 0xffffffff, 0x4, 0x0, {@mac, {[0xff, 0x0, 0x0, 0x0, 0xff]}}, {@mac=@local, {[0xff, 0x0, 0xff, 0xff, 0xff, 0xff]}}, 0xfff2, 0x101, 0x79, 0x1, 0x7ff, 0x8, '\x00', 'vcan0\x00', {0xff}, {0xff}, 0x0, 0x4}, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local, @mac=@local, @local, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x8, 0x1}}}, {{@uncond, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@random="07aebe92cc85", @empty, @loopback, @broadcast, 0x8}}}, {{@uncond, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, 0x1, 0x1}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x450) openat$proc_mixer(0xffffff9c, &(0x7f0000000140)='/proc/asound/card3/oss_mixer\x00', 0x42, 0x0) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000000)=@usbdevfs_connect) 3.171206734s ago: executing program 3 (id=536): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) userfaultfd(0x801) socket(0x28, 0x5, 0x0) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x4, 0x6}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x1c}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r1, 0x3a, 0xca, 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0x6d1, 0x0, 0x0, 0x1000, 0x5}}}, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x0, 0x87da, 0x200, 0x2, 0x20000}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x40000, 0x0, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x40, 0x1, 0x6a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffe, 0x6080, 0x0, 0x400000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2253, 0x10, 0x3, 0x1}}], 0x1, &(0x7f00000003c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0xdbd, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) r3 = syz_open_dev$mouse(&(0x7f0000000040), 0x1, 0x100) setsockopt$inet_int(r3, 0x0, 0xa, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, 0x0, 0x0) r5 = socket(0x15, 0x5, 0x0) getsockopt(r5, 0x200000000114, 0x2710, &(0x7f0000032580)=""/102396, &(0x7f0000000000)=0x18ffc) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2800001, 0xc3072, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600a00, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) getpid() 2.974869077s ago: executing program 2 (id=537): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000100)={0x4}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0xa000, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'dvmrp1\x00', 0x2}) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r2 = getpgid(0x0) syz_init_net_socket$llc(0x1a, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = dup(r5) socket(0x2, 0x80805, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0xc41, 0x0, 0x0, 0x1000, 0x7, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, 0x0, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x53b2, 0x8, 0x1000000, 0x2033f, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x2000, 0x0, 0x146, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9b59, 0x2000, 0x100}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6d1f, 0x8000, 0x5, 0xdfffffff}}], 0x1, 0x0, 0x0) 2.864073171s ago: executing program 3 (id=538): r0 = socket(0x2000000000000021, 0x2, 0x2) shutdown(r0, 0x2) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x88a40, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x1, @empty, 0x4000ca}, 0x1c) r3 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @local}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20002051, 0x0, 0xffffffffffffff04) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') syz_open_dev$ttys(0xc, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) clock_gettime(0x0, &(0x7f0000000140)) read(r1, &(0x7f0000000180)=""/4, 0x1) 2.228578065s ago: executing program 1 (id=539): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x2c, r1, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xc4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24040000}, 0x804) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$sndpcmc(&(0x7f0000000a00), 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10}) io_uring_enter(0xffffffffffffffff, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) fcntl$lock(r5, 0x6, &(0x7f0000000040)={0x0, 0x2, 0xfffffffffffffffa, 0x5}) r6 = fsopen(&(0x7f0000000500)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x0, 0x0) fchdir(r7) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f00000001c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000140), 0x200800, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@volatile}]}) r8 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r8, 0x84, 0xa, 0x0, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r8, 0x84, 0xa, &(0x7f00000000c0)={0x2, 0x8, 0x1, 0x9, 0x8, 0x7, 0x6, 0x68}, 0x20) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @empty}], 0x10) sendmsg$inet_sctp(r8, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1}, 0x1) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) sendmsg$NL80211_CMD_SET_POWER_SAVE(r4, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000127bd7000fedbdf253d00000008000300", @ANYRES32=r3, @ANYBLOB="08005d000000000008005d000100000c60005d000100000008005d000100000008005d000100000008085d0001000000"], 0x4c}, 0x1, 0x0, 0x0, 0x20000050}, 0x24000001) 2.090578898s ago: executing program 1 (id=540): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x4000000) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x1, @empty, 0x4000ca}, 0x1c) recvmmsg(r1, &(0x7f0000002e80), 0x4000071, 0x830b, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x10}}, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'lo\x00'}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') syz_open_dev$ttys(0xc, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) clock_gettime(0x0, &(0x7f0000000140)) 2.019862299s ago: executing program 2 (id=541): r0 = mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf\"\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`\x1e\x91<~\xd8\xabs\xbd*e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2\x04\x00\x00\x00\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\x1e\xfc/fm\xa9`)\xfc7\x84\f+\xf7\x95\xab[J\xe7\x9d\xd8\xe3\x86\xdb\xfe|\xe91\n\xa0\xdf\v\\\xe4\x00'/941, 0x40, 0x170, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) add_key$user(&(0x7f00000000c0), 0x0, &(0x7f0000000380)="7ccd08", 0x3, 0xfffffffffffffffc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x200, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x0, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x1, 0x1003, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x8}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x4, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x20000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) r6 = fanotify_init(0x200, 0x0) fanotify_mark(r6, 0x1, 0x8000000, r1, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, 0x0) r7 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000001b40)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) r8 = syz_open_dev$loop(&(0x7f0000000040), 0x100013, 0xa4a82) ioctl$LOOP_SET_FD(r8, 0x4c00, r7) 1.776738035s ago: executing program 3 (id=542): bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0xfffffffffffffe42, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff, 0x2f, 0x0, @void}, 0x10) r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x41}, 0x10) sendmsg$tipc(r1, &(0x7f00000008c0)={&(0x7f0000000600)=@name, 0x10, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x80) r2 = dup3(r0, r1, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ptp0(0xffffff9c, 0x0, 0x40, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000080)=0x1, 0x12) creat(&(0x7f00000002c0)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="090000001400000008000000baab000042000000", @ANYRES32=0x1, @ANYBLOB='\x00\x00o\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000080), 0x208e24b) writev(r4, 0x0, 0x0) lseek(r4, 0x0, 0x4) setsockopt$TIPC_GROUP_LEAVE(r2, 0x10f, 0x88) 651.807988ms ago: executing program 0 (id=543): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e4, 0x134, 0x168, 0x9, 0x134, 0xb, 0x21c, 0x250, 0x250, 0x21c, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0xec, 0x134, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x24}}, @inet=@rpfilter={{0x24}, {0xc}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@empty, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0xc8, 0xe8, 0x0, {}, [@common=@inet=@set2={{0x24}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x340) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x2012, r1, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={[], [], 0x2c}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) listns(&(0x7f0000000000)={0x20, 0x0, 0x2}, &(0x7f0000000040)=[0x0], 0xf4240, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x19, 0x0, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@multicast2, 0x0, 0x0, 0x4e24, 0x0, 0x2}, {0x200000010000, 0x3, 0x1, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x9}, {0x0, 0x8, 0xfffffffffffffff8, 0x8}, 0x0, 0x0, 0x1, 0x0, 0x1}, {{@in=@empty, 0x2, 0x6c}, 0x2, @in=@empty, 0x0, 0x5, 0x0, 0xb7}}, 0xe8) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x0) r4 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000000000)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0xf9, 0x5}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000000080)={0x6, {"7fb13911afb5ea7f027063aa876dd358", "cfe484e50900", "d9ca451d96249a1dee77476cc87f7d0a"}, 0x6}) sendmsg$netlink(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000780)=ANY=[@ANYBLOB="200000001100010000000000ffdbdf25100000000b00000056ccabd869c2030095bc9389dcab1b9e63580a69b2cde86e672248d3167c7925a9eb8e65a19b87275380e7680719e0805fb5f5bb959c6dbf8c4f6be6205026b18c1549fa651f0531573b4a5f40d05e72ee7463cad17852db834a8884ce357b6f582fc52d563132c5d75064eb0d440579f9df127bafc3be87dc162b8201e52b0826f9410a8220005adbab1f24f9e534014f457c93ef000ea0439401568d319dbaa1675b7df1ab906ac9486a4b0ae351e3b4df15"], 0x20}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) 358.710546ms ago: executing program 3 (id=544): r0 = syz_open_procfs(0x0, &(0x7f00000193c0)='net/igmp6\x00') syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x4, 0xfffffe0000000001, 0xfa14, 0xffffffff}, 0x0) openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x2, 0x8, 0x0, 0x200003}, 0x0) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) r4 = socket$xdp(0x2c, 0x3, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x201}) setsockopt$XDP_TX_RING(r4, 0x11b, 0x3, &(0x7f0000000200)=0x100, 0x4) getsockopt$XDP_STATISTICS(r4, 0x11b, 0x7, 0x0, &(0x7f0000000280)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x66) ioctl$UFFDIO_REGISTER(r3, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r5 = gettid() tkill(r5, 0xb) pread64(r0, &(0x7f0000019400)=""/102344, 0xfffffcbb, 0x1c2a) pwritev2(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)}, {&(0x7f0000000100)}], 0x2, 0x3, 0xffff8000, 0x14) 61.920303ms ago: executing program 2 (id=545): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xc, 0xc, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000180000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000006d00000095"], &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000001100000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000114000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) sendmsg$NFT_MSG_GETOBJ(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000280)={0x20, 0x13, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0xc085}, 0x40000c0) r2 = openat$autofs(0xffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r2, 0xc018937a, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0, {0x80000000}}, './file0\x00'}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000180)="0000000000000000000000000005", 0x0, 0x7fe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = memfd_create(&(0x7f0000000780)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\nh<\x99\xaa\xe1\xf3\xb8Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev<\x97\x1a2_\x82\xfa\x15h$\x01\xdd\xe5\xceC\x19\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xb2\xf5\x1e5.\xc1\xa1\x05\x92\x82d\x0e\xf5PMjIt\xc5u~Tw\xbeNg\xb5\xeeP\x9c\xce\xfaS\xa7\xec0\xf4\xd2\xc2+@\x12=\xaa\b\xd2&\x19k6\xc7\xa6+\x04V\xc3\xe1\xd3\fZZ\x1cJo\xa5(& \r\xf1\xa4\xb8\xc23\x16\xc3\xaejA/', 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, 0xffffffffffffffff, 0x0) ftruncate(0xffffffffffffffff, 0xc17a) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x9a, &(0x7f00000000c0)=ANY=[@ANYBLOB="ffffffffffbfaaaaaaaaaabb86dd600107000064110000000000000000000000ffff64010102ff02000000000000000010c4b415e8b98fe50b0000000000014e220e2200309078020000000200000004000000bb577147f8c63bab95cc025f2c123662d48c6e01d8630bf2addfd0edf624317d8ab859c3d9fe9a2f9edb8e36339e135d1f142a168a75d3"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) write$binfmt_elf32(r3, &(0x7f0000000f00)=ANY=[@ANYBLOB="7f454c466000002ed8e4f97765ce27b90300060000000000000000b738000000000035f4c38422a3bc82200005"], 0x66) execveat(r3, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 0s ago: executing program 0 (id=546): r0 = socket$pppoe(0x18, 0x1, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r2 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x1b}, &(0x7f0000000100), &(0x7f00000000c0), &(0x7f0000000000)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r1, 0x0, 0x0}, 0x10) creat(&(0x7f0000000080)='./bus\x00', 0x0) mount(&(0x7f0000000240)=@filename='./bus\x00', &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x0, &(0x7f0000000100)='trans=rdma,') bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x20000011) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x4000011) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc01100, 0x0, 0x0, 0x0, 0x2) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x40050) sendmsg$RDMA_NLDEV_CMD_DELLINK(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000015c0)=ANY=[@ANYBLOB="18000000041401002dbd7000fedbdf250800010000000000ba30b28e994c1a08786eb807e0000000000000000000009fe70ba83a7a66e67a0bae5cfaccbbb81e28d7b568", @ANYRESHEX, @ANYRESOCT], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) io_uring_register$IORING_REGISTER_RING_FDS(r2, 0x14, &(0x7f0000008580)=[{0x4, 0x0, 0x0}, {0x2, 0x0, 0x0}, {0x2, 0x0, 0x0}, {0x3, 0x0, 0x0}, {0x5, 0x1, 0x0}, {0x2, 0x0, 0x0}, {0x4, 0x0, 0x0}, {0x8, 0x0, 0x0}, {0x9, 0x1, 0x0}], 0x9) sendmsg$SOCK_DIAG_BY_FAMILY(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001400050126bc70006bdbdf2511000d000100c80e4501a254722eaea6d93916f8d66cffe8ef8d00000000"], 0x24}, 0x1, 0x0, 0x0, 0x2}, 0x54840) connect$pppoe(r0, &(0x7f0000000100)={0x18, 0x0, {0x4, @local, 'ip_vti0\x00'}}, 0x1e) kernel console output (not intermixed with test programs): ze=2048kB [ 114.836774][ T5917] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 114.839723][ T5917] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 114.842569][ T5917] 56337 total pagecache pages [ 114.844847][ T5917] 40 pages in swap cache [ 114.846601][ T5917] Free swap = 119284kB [ 114.848021][ T5917] Total swap = 124996kB [ 114.849375][ T5917] 524155 pages RAM [ 114.851542][ T5917] 0 pages HighMem/MovableOnly [ 114.853092][ T5917] 211536 pages reserved [ 114.865670][ T5917] 0 pages cma reserved [ 114.965598][ T848] usb 5-1: Using ep0 maxpacket: 16 [ 114.968445][ T5917] mmap: syz.1.2 (5917) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 114.969584][ T848] usb 5-1: config 128 has an invalid descriptor of length 128, skipping remainder of the config [ 114.969605][ T848] usb 5-1: config 128 has 0 interfaces, different from the descriptor's value: 1 [ 114.971751][ T848] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 114.971774][ T848] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 114.971790][ T848] usb 5-1: Product: syz [ 114.971801][ T848] usb 5-1: Manufacturer: syz [ 114.971813][ T848] usb 5-1: SerialNumber: syz [ 115.221240][ T5907] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.230351][ T5907] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.266405][ T848] usb 5-1: USB disconnect, device number 2 [ 115.901927][ T5937] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6'. [ 116.045752][ T5753] Bluetooth: hci0: command tx timeout [ 116.127881][ T5753] Bluetooth: hci1: command tx timeout [ 116.127953][ T5756] Bluetooth: hci3: command tx timeout [ 116.129322][ T5764] Bluetooth: hci2: command tx timeout [ 118.022220][ T5990] netlink: 16 bytes leftover after parsing attributes in process `syz.2.11'. [ 118.125943][ T5756] Bluetooth: hci0: command tx timeout [ 118.208080][ T5756] Bluetooth: hci3: command 0x0419 tx timeout [ 118.208190][ T5753] Bluetooth: hci2: command tx timeout [ 118.216300][ T5753] Bluetooth: hci1: command tx timeout [ 118.521612][ T5754] IPVS: starting estimator thread 0... [ 118.635953][ T5993] IPVS: using max 44 ests per chain, 105600 per kthread [ 119.256456][ T6008] ======================================================= [ 119.256456][ T6008] WARNING: The mand mount option has been deprecated and [ 119.256456][ T6008] and is ignored by this kernel. Remove the mand [ 119.256456][ T6008] option from the mount to silence this warning. [ 119.256456][ T6008] ======================================================= [ 119.459179][ T6004] random: crng reseeded on system resumption [ 120.104389][ T6025] Zero length message leads to an empty skb [ 120.107069][ T6023] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 120.109224][ T6023] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 120.119153][ T6023] vhci_hcd vhci_hcd.0: Device attached [ 120.285592][ T5753] Bluetooth: hci3: command 0x0419 tx timeout [ 120.336584][ T6023] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 120.476057][ T4258] usb 42-1: SetAddress Request (2) to port 0 [ 120.479487][ T4258] usb 42-1: new SuperSpeed USB device number 2 using vhci_hcd [ 121.005554][ T6026] vhci_hcd: connection reset by peer [ 121.011952][ T13] vhci_hcd vhci_hcd.2: stop threads [ 121.014497][ T13] vhci_hcd vhci_hcd.2: release socket [ 121.017568][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 121.888074][ T42] audit: type=1804 audit(1785495999.181:2): pid=6045 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.25" name="bus" dev="ramfs" ino=10908 res=1 errno=0 [ 121.896317][ T42] audit: type=1804 audit(1785495999.181:3): pid=6045 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.25" name="bus" dev="ramfs" ino=10908 res=1 errno=0 [ 124.189692][ T6079] netlink: 4 bytes leftover after parsing attributes in process `syz.3.31'. [ 124.342158][ T6079] netlink: 4 bytes leftover after parsing attributes in process `syz.3.31'. [ 125.486376][ T6092] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 125.565735][ T4258] usb 42-1: device descriptor read/8, error -110 [ 125.966622][ T4258] usb usb42-port1: attempt power cycle [ 126.531689][ T4258] usb usb42-port1: unable to enumerate USB device [ 129.034671][ T6132] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.44'. [ 129.040401][ T6132] openvswitch: netlink: Message has 512 unknown bytes. [ 129.758683][ T6138] x_tables: duplicate underflow at hook 3 [ 129.808185][ T6138] ./bus: Can't lookup blockdev [ 130.399538][ T6142] netlink: 'syz.0.46': attribute type 1 has an invalid length. [ 130.690518][ T6144] evm: overlay not supported [ 130.719290][ T6144] overlayfs: metacopy with no lower data found - abort lookup (/file1) [ 130.938597][ T6146] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 131.586132][ T6163] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 131.588233][ T6163] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 131.789157][ T6163] vhci_hcd vhci_hcd.0: Device attached [ 131.962583][ T6163] macvlan2: entered promiscuous mode [ 131.964438][ T6163] bridge0: entered promiscuous mode [ 132.076074][ T4258] usb 42-1: SetAddress Request (6) to port 0 [ 132.078322][ T4258] usb 42-1: new SuperSpeed USB device number 6 using vhci_hcd [ 132.395057][ T6164] vhci_hcd: connection reset by peer [ 132.403091][ T5801] vhci_hcd vhci_hcd.2: stop threads [ 132.405221][ T5801] vhci_hcd vhci_hcd.2: release socket [ 132.424227][ T5801] vhci_hcd vhci_hcd.2: disconnect device [ 133.028949][ T6180] xt_CT: You must specify a L4 protocol and not use inversions on it [ 133.084212][ T6180] XFS (nullb0): Invalid superblock magic number [ 133.341509][ T6148] Set syz1 is full, maxelem 65536 reached [ 133.476042][ T42] audit: type=1326 audit(1785496010.761:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6191 comm="syz.2.56" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f73fec code=0x7ffc0000 [ 133.492796][ T42] audit: type=1326 audit(1785496010.771:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6191 comm="syz.2.56" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f73fec code=0x7ffc0000 [ 133.500035][ T42] audit: type=1326 audit(1785496010.771:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6191 comm="syz.2.56" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f73fec code=0x7ffc0000 [ 133.508863][ T42] audit: type=1326 audit(1785496010.771:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6191 comm="syz.2.56" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f73fec code=0x7ffc0000 [ 133.525479][ T42] audit: type=1326 audit(1785496010.771:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6191 comm="syz.2.56" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f73fec code=0x7ffc0000 [ 133.532124][ T42] audit: type=1326 audit(1785496010.771:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6191 comm="syz.2.56" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f73fec code=0x7ffc0000 [ 133.545519][ T42] audit: type=1326 audit(1785496010.771:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6191 comm="syz.2.56" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f73fec code=0x7ffc0000 [ 133.554372][ T42] audit: type=1326 audit(1785496010.771:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6191 comm="syz.2.56" exe="/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf7f73fec code=0x7ffc0000 [ 133.565500][ T42] audit: type=1326 audit(1785496010.771:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6191 comm="syz.2.56" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f73fec code=0x7ffc0000 [ 133.565528][ T42] audit: type=1326 audit(1785496010.771:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6191 comm="syz.2.56" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f73fec code=0x7ffc0000 [ 134.289885][ T6204] netlink: 32 bytes leftover after parsing attributes in process `syz.0.59'. [ 134.439369][ T6208] syz.0.69: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 134.445781][ T6208] CPU: 1 UID: 0 PID: 6208 Comm: syz.0.69 Not tainted syzkaller #0 PREEMPT(full) [ 134.445804][ T6208] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.445812][ T6208] Call Trace: [ 134.445818][ T6208] [ 134.445825][ T6208] dump_stack_lvl+0x100/0x190 [ 134.445854][ T6208] warn_alloc.cold+0x94/0xa8 [ 134.445874][ T6208] ? __pfx_warn_alloc+0x10/0x10 [ 134.445898][ T6208] ? kasan_save_stack+0x3f/0x50 [ 134.445923][ T6208] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 134.445942][ T6208] ? xskq_create+0x52/0x1d0 [ 134.445959][ T6208] ? xsk_setsockopt+0x743/0xab0 [ 134.445976][ T6208] ? do_sock_setsockopt+0xf3/0x1d0 [ 134.446002][ T6208] ? __sys_setsockopt+0x119/0x190 [ 134.446020][ T6208] ? __ia32_sys_setsockopt+0xbc/0x160 [ 134.446041][ T6208] ? __do_fast_syscall_32+0xe7/0x970 [ 134.446063][ T6208] ? do_fast_syscall_32+0x32/0x70 [ 134.446083][ T6208] ? xskq_create+0xfb/0x1d0 [ 134.446095][ T6208] __vmalloc_node_range_noprof+0x136c/0x1630 [ 134.446117][ T6208] ? xskq_create+0xfb/0x1d0 [ 134.446133][ T6208] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 134.446160][ T6208] ? kasan_save_track+0x14/0x30 [ 134.446182][ T6208] ? __kasan_kmalloc+0xaa/0xb0 [ 134.446206][ T6208] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 134.446223][ T6208] ? xskq_create+0xfb/0x1d0 [ 134.446238][ T6208] vmalloc_user_noprof+0x9e/0xe0 [ 134.446261][ T6208] ? xskq_create+0xfb/0x1d0 [ 134.446279][ T6208] xskq_create+0xfb/0x1d0 [ 134.446299][ T6208] xsk_setsockopt+0x743/0xab0 [ 134.446316][ T6208] ? __pfx_aa_sk_perm+0x10/0x10 [ 134.446337][ T6208] ? __pfx_xsk_setsockopt+0x10/0x10 [ 134.446362][ T6208] ? find_held_lock+0x2b/0x80 [ 134.446386][ T6208] ? aa_sock_opt_perm+0xfe/0x1b0 [ 134.446406][ T6208] ? __pfx_xsk_setsockopt+0x10/0x10 [ 134.446426][ T6208] do_sock_setsockopt+0xf3/0x1d0 [ 134.446456][ T6208] __sys_setsockopt+0x119/0x190 [ 134.446485][ T6208] __ia32_sys_setsockopt+0xbc/0x160 [ 134.446507][ T6208] ? __do_fast_syscall_32+0x98/0x970 [ 134.446527][ T6208] ? lockdep_hardirqs_on+0x78/0x100 [ 134.446546][ T6208] __do_fast_syscall_32+0xe7/0x970 [ 134.446572][ T6208] do_fast_syscall_32+0x32/0x70 [ 134.446596][ T6208] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 134.446618][ T6208] RIP: 0023:0xf6fdefec [ 134.446637][ T6208] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 134.446643][ T6208] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 134.446657][ T6208] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000000011b [ 134.446668][ T6208] RDX: 0000000000000006 RSI: 0000000080000000 RDI: 0000000000000004 [ 134.446679][ T6208] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 134.446691][ T6208] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 134.446702][ T6208] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 134.446725][ T6208] [ 134.446733][ T6208] Mem-Info: [ 134.559145][ T6208] active_anon:5331 inactive_anon:360 isolated_anon:0 [ 134.559145][ T6208] active_file:8573 inactive_file:48294 isolated_file:0 [ 134.559145][ T6208] unevictable:1768 dirty:697 writeback:0 [ 134.559145][ T6208] slab_reclaimable:7657 slab_unreclaimable:53651 [ 134.559145][ T6208] mapped:23774 shmem:2299 pagetables:1030 [ 134.559145][ T6208] sec_pagetables:303 bounce:0 [ 134.559145][ T6208] kernel_misc_reclaimable:0 [ 134.559145][ T6208] free:33336 free_pcp:18138 free_cma:0 [ 134.579997][ T6208] Node 0 active_anon:100kB inactive_anon:132kB active_file:12kB inactive_file:232kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:116kB dirty:16kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8832kB pagetables:1272kB sec_pagetables:1152kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 134.586614][ T24] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 134.592988][ T6208] Node 1 active_anon:21224kB inactive_anon:1308kB active_file:34280kB inactive_file:192944kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:94980kB dirty:2772kB writeback:0kB shmem:5660kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:4560kB pagetables:2848kB sec_pagetables:60kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 134.609073][ T6208] Node 0 DMA free:1748kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:632kB local_pcp:112kB free_cma:0kB [ 134.620795][ T6208] lowmem_reserve[]: 0 280 280 280 280 [ 134.623311][ T6208] Node 0 DMA32 free:15500kB boost:0kB min:12772kB low:15964kB high:19156kB reserved_highatomic:0KB free_highatomic:0KB active_anon:100kB inactive_anon:132kB active_file:12kB inactive_file:232kB unevictable:3536kB writepending:16kB zspages:0kB present:1032196kB managed:286904kB mlocked:0kB bounce:0kB free_pcp:13940kB local_pcp:3944kB free_cma:0kB [ 134.643741][ T6208] lowmem_reserve[]: 0 0 0 0 0 [ 134.648005][ T6208] Node 1 DMA32 free:113916kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23524kB inactive_anon:1308kB active_file:34280kB inactive_file:192944kB unevictable:3536kB writepending:2772kB zspages:2820kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:58556kB local_pcp:28228kB free_cma:0kB [ 134.661411][ T6208] lowmem_reserve[]: 0 0 0 0 0 [ 134.663450][ T6208] Node 0 DMA: 27*4kB (UM) 3*8kB (U) 1*16kB (M) 4*32kB (UM) 1*64kB (U) 1*128kB (M) 1*256kB (M) 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 1748kB [ 134.669678][ T6208] Node 0 DMA32: 39*4kB (ME) 58*8kB (ME) 50*16kB (ME) 36*32kB (UME) 28*64kB (ME) 11*128kB (UME) 4*256kB (ME) 7*512kB (UME) 3*1024kB (M) 1*2048kB (U) 0*4096kB = 15500kB [ 134.676440][ T6208] Node 1 DMA32: 14*4kB (UME) 18*8kB (UE) 24*16kB (UE) 157*32kB (ME) 30*64kB (UME) 113*128kB (UME) 69*256kB (ME) 23*512kB (ME) 15*1024kB (M) 8*2048kB (UME) 6*4096kB (UM) = 107752kB [ 134.683298][ T6208] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 134.688141][ T6208] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 134.692067][ T6208] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 134.695900][ T6208] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 134.699547][ T6208] 61248 total pagecache pages [ 134.701430][ T6208] 636 pages in swap cache [ 134.703165][ T6208] Free swap = 118276kB [ 134.704836][ T6208] Total swap = 124996kB [ 134.706556][ T6208] 524155 pages RAM [ 134.708034][ T6208] 0 pages HighMem/MovableOnly [ 134.709940][ T6208] 211536 pages reserved [ 134.711633][ T6208] 0 pages cma reserved [ 134.745636][ T24] usb 7-1: Using ep0 maxpacket: 16 [ 134.753638][ T24] usb 7-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 134.759693][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.764138][ T24] usb 7-1: Product: syz [ 134.765606][ T24] usb 7-1: Manufacturer: syz [ 134.768452][ T6215] netlink: 'syz.3.61': attribute type 1 has an invalid length. [ 134.771733][ T24] usb 7-1: SerialNumber: syz [ 134.807635][ T6215] 8021q: adding VLAN 0 to HW filter on device bond1 [ 134.996011][ T24] usb 7-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 135.008443][ T24] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 135.012822][ T24] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 135.027471][ T24] usb 7-1: media controller created [ 135.041497][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 135.291034][ T24] zl10353_read_register: readreg error (reg=127, ret==-110) [ 135.294614][ T6206] netlink: 'syz.2.60': attribute type 1 has an invalid length. [ 135.471850][ T24] dvb_usb_gl861 7-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 135.487421][ T24] usb 7-1: USB disconnect, device number 2 [ 135.872444][ T6229] ntfs3(nullb0): Primary boot signature is not NTFS. [ 135.876468][ T6229] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 136.232278][ T6240] netlink: 'syz.0.66': attribute type 1 has an invalid length. [ 136.233147][ T6241] x_tables: duplicate underflow at hook 3 [ 136.244225][ T6240] netlink: 756 bytes leftover after parsing attributes in process `syz.0.66'. [ 136.298531][ T6241] ./bus: Can't lookup blockdev [ 137.167891][ T4258] usb 42-1: device descriptor read/8, error -110 [ 138.351126][ T4258] usb usb42-port1: attempt power cycle [ 138.391574][ T6271] xt_CT: You must specify a L4 protocol and not use inversions on it [ 138.534340][ T6268] XFS (nullb0): Invalid superblock magic number [ 138.558270][ T6272] netlink: 'syz.1.74': attribute type 1 has an invalid length. [ 138.624387][ T6272] 8021q: adding VLAN 0 to HW filter on device bond0 [ 138.926524][ T4258] usb usb42-port1: unable to enumerate USB device [ 139.944636][ T6285] overlayfs: metacopy with no lower data found - abort lookup (/file1) [ 140.193076][ T6292] netlink: 'syz.2.78': attribute type 10 has an invalid length. [ 140.208966][ T6292] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 140.213873][ T6292] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 140.230028][ T6292] netlink: 14 bytes leftover after parsing attributes in process `syz.2.78'. [ 140.241103][ T6292] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 140.250173][ T6292] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 140.257485][ T6292] bond0 (unregistering): (slave netdevsim1): Releasing backup interface [ 140.266381][ T6292] bond0 (unregistering): Released all slaves [ 140.328042][ T42] kauditd_printk_skb: 164 callbacks suppressed [ 140.328081][ T42] audit: type=1326 audit(1785496017.611:178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6293 comm="syz.0.77" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 140.342607][ T42] audit: type=1326 audit(1785496017.621:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6293 comm="syz.0.77" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 140.350173][ T42] audit: type=1326 audit(1785496017.631:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6293 comm="syz.0.77" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 140.357968][ T42] audit: type=1326 audit(1785496017.631:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6293 comm="syz.0.77" exe="/syz-executor" sig=0 arch=40000003 syscall=354 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 140.368399][ T42] audit: type=1326 audit(1785496017.631:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6293 comm="syz.0.77" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 140.376850][ T42] audit: type=1326 audit(1785496017.641:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6293 comm="syz.0.77" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 140.385500][ T42] audit: type=1326 audit(1785496017.651:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6293 comm="syz.0.77" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 140.395007][ T42] audit: type=1326 audit(1785496017.661:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6293 comm="syz.0.77" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 140.401988][ T42] audit: type=1326 audit(1785496017.661:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6293 comm="syz.0.77" exe="/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 140.409708][ T42] audit: type=1326 audit(1785496017.671:187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6293 comm="syz.0.77" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 142.862867][ T5829] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 142.999977][ T6330] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 143.002804][ T6330] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 143.026316][ T5829] usb 5-1: Using ep0 maxpacket: 8 [ 143.033803][ T6330] vhci_hcd vhci_hcd.0: Device attached [ 143.033856][ T5829] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 143.040696][ T5829] usb 5-1: config 0 has no interface number 0 [ 143.046190][ T5829] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 143.054032][ T5829] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 143.061604][ T5829] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 143.067496][ T5829] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 143.077309][ T5829] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 143.077327][ T5829] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.096427][ T5829] usb 5-1: config 0 descriptor?? [ 143.125075][ T5829] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 143.375668][ T55] usb 44-1: SetAddress Request (2) to port 0 [ 143.375794][ T55] usb 44-1: new SuperSpeed USB device number 2 using vhci_hcd [ 143.653869][ T6331] vhci_hcd: connection reset by peer [ 143.656544][ T13] vhci_hcd vhci_hcd.3: stop threads [ 143.658278][ T13] vhci_hcd vhci_hcd.3: release socket [ 143.661564][ T13] vhci_hcd vhci_hcd.3: disconnect device [ 144.131641][ T1442] ieee802154 phy0 wpan0: encryption failed: -22 [ 144.136099][ T1442] ieee802154 phy1 wpan1: encryption failed: -22 [ 144.332986][ T6344] overlayfs: metacopy with no lower data found - abort lookup (/file1) [ 145.526550][ T40] usb 5-1: USB disconnect, device number 3 [ 145.539492][ T40] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 147.162060][ T6376] x_tables: duplicate underflow at hook 3 [ 147.180220][ T6376] ./bus: Can't lookup blockdev [ 148.458348][ T55] usb 44-1: device descriptor read/8, error -110 [ 148.896235][ T55] usb usb44-port1: attempt power cycle [ 149.402706][ T6403] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 149.405738][ T6403] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 149.412090][ T6403] vhci_hcd vhci_hcd.0: Device attached [ 149.598864][ T55] usb usb44-port1: unable to enumerate USB device [ 149.630913][ T6403] macvlan2: entered promiscuous mode [ 149.638996][ T6403] bridge0: entered promiscuous mode [ 149.686075][ T5904] usb 40-1: SetAddress Request (2) to port 0 [ 149.691698][ T5904] usb 40-1: new SuperSpeed USB device number 2 using vhci_hcd [ 149.722075][ T6417] netlink: 28 bytes leftover after parsing attributes in process `syz.3.101'. [ 150.095965][ T6404] vhci_hcd: connection reset by peer [ 150.098380][ T13] vhci_hcd vhci_hcd.1: stop threads [ 150.101557][ T13] vhci_hcd vhci_hcd.1: release socket [ 150.108547][ T13] vhci_hcd vhci_hcd.1: disconnect device [ 151.920775][ T6438] netlink: 'syz.1.104': attribute type 1 has an invalid length. [ 154.765943][ T5904] usb 40-1: device descriptor read/8, error -110 [ 155.247886][ T5904] usb usb40-port1: attempt power cycle [ 155.394014][ T6472] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 155.396225][ T6472] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 155.412877][ T6472] vhci_hcd vhci_hcd.0: Device attached [ 155.665590][ T5904] usb 40-1: SetAddress Request (4) to port 0 [ 155.675325][ T5904] usb 40-1: new SuperSpeed USB device number 4 using vhci_hcd [ 156.376090][ T6470] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 156.467420][ T6488] warn_alloc: 1 callbacks suppressed [ 156.467437][ T6488] syz.3.118: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 156.474923][ T6488] CPU: 1 UID: 0 PID: 6488 Comm: syz.3.118 Not tainted syzkaller #0 PREEMPT(full) [ 156.474946][ T6488] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 156.474957][ T6488] Call Trace: [ 156.474964][ T6488] [ 156.474972][ T6488] dump_stack_lvl+0x100/0x190 [ 156.474998][ T6488] warn_alloc.cold+0x94/0xa8 [ 156.475018][ T6488] ? __pfx_warn_alloc+0x10/0x10 [ 156.475041][ T6488] ? kasan_save_stack+0x3f/0x50 [ 156.475065][ T6488] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 156.475081][ T6488] ? xskq_create+0x52/0x1d0 [ 156.475099][ T6488] ? xsk_setsockopt+0x743/0xab0 [ 156.475113][ T6488] ? do_sock_setsockopt+0xf3/0x1d0 [ 156.475142][ T6488] ? __sys_setsockopt+0x119/0x190 [ 156.475162][ T6488] ? __ia32_sys_setsockopt+0xbc/0x160 [ 156.475182][ T6488] ? __do_fast_syscall_32+0xe7/0x970 [ 156.475204][ T6488] ? do_fast_syscall_32+0x32/0x70 [ 156.475231][ T6488] ? xskq_create+0xfb/0x1d0 [ 156.475249][ T6488] __vmalloc_node_range_noprof+0x136c/0x1630 [ 156.475283][ T6488] ? xskq_create+0xfb/0x1d0 [ 156.475307][ T6488] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 156.475335][ T6488] ? kasan_save_track+0x14/0x30 [ 156.475355][ T6488] ? __kasan_kmalloc+0xaa/0xb0 [ 156.475376][ T6488] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 156.475392][ T6488] ? xskq_create+0xfb/0x1d0 [ 156.475432][ T6488] vmalloc_user_noprof+0x9e/0xe0 [ 156.475458][ T6488] ? xskq_create+0xfb/0x1d0 [ 156.475476][ T6488] xskq_create+0xfb/0x1d0 [ 156.475496][ T6488] xsk_setsockopt+0x743/0xab0 [ 156.475512][ T6488] ? __pfx_aa_sk_perm+0x10/0x10 [ 156.475534][ T6488] ? __pfx_xsk_setsockopt+0x10/0x10 [ 156.475552][ T6488] ? find_held_lock+0x2b/0x80 [ 156.475575][ T6488] ? aa_sock_opt_perm+0xfe/0x1b0 [ 156.475593][ T6488] ? __pfx_xsk_setsockopt+0x10/0x10 [ 156.475612][ T6488] do_sock_setsockopt+0xf3/0x1d0 [ 156.475639][ T6488] __sys_setsockopt+0x119/0x190 [ 156.475666][ T6488] __ia32_sys_setsockopt+0xbc/0x160 [ 156.475686][ T6488] ? __do_fast_syscall_32+0x98/0x970 [ 156.475707][ T6488] ? lockdep_hardirqs_on+0x78/0x100 [ 156.475727][ T6488] __do_fast_syscall_32+0xe7/0x970 [ 156.475751][ T6488] do_fast_syscall_32+0x32/0x70 [ 156.475773][ T6488] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 156.475800][ T6488] RIP: 0023:0xf6feefec [ 156.475821][ T6488] Code: Unable to access opcode bytes at 0xf6feefc2. [ 156.475829][ T6488] RSP: 002b:00000000f53dd50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 156.475847][ T6488] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000000011b [ 156.475858][ T6488] RDX: 0000000000000006 RSI: 0000000080000000 RDI: 0000000000000004 [ 156.475869][ T6488] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 156.475879][ T6488] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 156.475889][ T6488] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 156.475910][ T6488] [ 156.711762][ T6488] Mem-Info: [ 156.713227][ T6488] active_anon:25997 inactive_anon:130 isolated_anon:0 [ 156.713227][ T6488] active_file:8571 inactive_file:43627 isolated_file:0 [ 156.713227][ T6488] unevictable:1768 dirty:747 writeback:0 [ 156.713227][ T6488] slab_reclaimable:7705 slab_unreclaimable:53036 [ 156.713227][ T6488] mapped:30715 shmem:21648 pagetables:1060 [ 156.713227][ T6488] sec_pagetables:299 bounce:0 [ 156.713227][ T6488] kernel_misc_reclaimable:0 [ 156.713227][ T6488] free:24745 free_pcp:12416 free_cma:0 [ 156.749094][ T6488] Node 0 active_anon:3556kB inactive_anon:20kB active_file:4kB inactive_file:4kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:8kB writeback:0kB shmem:7036kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8832kB pagetables:1272kB sec_pagetables:1152kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 156.762594][ T6473] vhci_hcd: connection reset by peer [ 156.771061][ T5801] vhci_hcd vhci_hcd.1: stop threads [ 156.771587][ T6490] x_tables: duplicate underflow at hook 3 [ 156.776399][ T5801] vhci_hcd vhci_hcd.1: release socket [ 156.778791][ T6488] Node 1 active_anon:100452kB inactive_anon:508kB active_file:34280kB inactive_file:174504kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:126832kB dirty:2984kB writeback:0kB shmem:79700kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:2048kB kernel_stack:4824kB pagetables:2956kB sec_pagetables:44kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 156.779463][ T5801] vhci_hcd vhci_hcd.1: disconnect device [ 156.794894][ T6488] Node 0 DMA free:1748kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:652kB local_pcp:136kB free_cma:0kB [ 156.807937][ T6488] lowmem_reserve[]: 0 280 280 280 280 [ 156.810338][ T6488] Node 0 DMA32 free:15636kB boost:0kB min:12772kB low:15964kB high:19156kB reserved_highatomic:0KB free_highatomic:0KB active_anon:3556kB inactive_anon:20kB active_file:4kB inactive_file:4kB unevictable:3536kB writepending:8kB zspages:0kB present:1032196kB managed:286904kB mlocked:0kB bounce:0kB free_pcp:12604kB local_pcp:2724kB free_cma:0kB [ 156.827413][ T6488] lowmem_reserve[]: 0 0 0 0 0 [ 156.829879][ T6488] Node 1 DMA32 free:81192kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:96368kB inactive_anon:508kB active_file:34280kB inactive_file:174504kB unevictable:3536kB writepending:2984kB zspages:2664kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:37260kB local_pcp:2788kB free_cma:0kB [ 156.844863][ T6488] lowmem_reserve[]: 0 0 0 0 0 [ 156.849018][ T6488] Node 0 DMA: 27*4kB (UM) 3*8kB (U) 1*16kB (M) 4*32kB (UM) 1*64kB (U) 1*128kB (M) 1*256kB (M) 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 1748kB [ 156.856381][ T6488] Node 0 DMA32: 13*4kB (U) 52*8kB (UE) 26*16kB (UME) 63*32kB (UE) 19*64kB (UE) 6*128kB (UME) 10*256kB (UME) 8*512kB (UME) 4*1024kB (M) 0*2048kB 0*4096kB = 15636kB [ 156.865512][ T6488] Node 1 DMA32: 211*4kB (UME) 290*8kB (UME) 128*16kB (ME) 92*32kB (UME) 168*64kB (UME) 80*128kB (UME) 22*256kB (UME) 12*512kB (UME) 9*1024kB (UM) 5*2048kB (ME) 5*4096kB (UM) = 80860kB [ 156.875100][ T6488] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 156.878424][ T6488] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 156.883535][ T6488] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 156.889079][ T6488] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 156.893435][ T6488] 74483 total pagecache pages [ 156.897255][ T6488] 629 pages in swap cache [ 156.898912][ T6488] Free swap = 118316kB [ 156.900350][ T6488] Total swap = 124996kB [ 156.903275][ T6488] 524155 pages RAM [ 156.904859][ T6488] 0 pages HighMem/MovableOnly [ 156.906520][ T6488] 211536 pages reserved [ 156.908641][ T6488] 0 pages cma reserved [ 156.925174][ T6490] ./bus: Can't lookup blockdev [ 158.305656][ T6508] x_tables: duplicate underflow at hook 3 [ 158.321099][ T6508] ./bus: Can't lookup blockdev [ 160.565151][ T42] kauditd_printk_skb: 28 callbacks suppressed [ 160.565170][ T42] audit: type=1326 audit(1785496036.857:216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6530 comm="syz.0.128" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 160.589661][ T42] audit: type=1326 audit(1785496036.877:217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6530 comm="syz.0.128" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 160.606948][ T42] audit: type=1326 audit(1785496036.877:218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6530 comm="syz.0.128" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 160.625522][ T42] audit: type=1326 audit(1785496036.897:219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6530 comm="syz.0.128" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 160.632229][ T42] audit: type=1326 audit(1785496036.917:220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6530 comm="syz.0.128" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 160.639205][ T42] audit: type=1326 audit(1785496036.927:221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6530 comm="syz.0.128" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 160.646615][ T42] audit: type=1326 audit(1785496036.927:222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6530 comm="syz.0.128" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 160.654459][ T42] audit: type=1326 audit(1785496036.927:223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6530 comm="syz.0.128" exe="/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 160.661654][ T42] audit: type=1326 audit(1785496036.937:224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6530 comm="syz.0.128" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 160.668722][ T42] audit: type=1326 audit(1785496036.947:225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6530 comm="syz.0.128" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 160.710263][ T6541] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 160.712384][ T6541] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 160.717305][ T6541] vhci_hcd vhci_hcd.0: Device attached [ 160.765832][ T5904] usb 40-1: device descriptor read/8, error -110 [ 160.849909][ T6541] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 160.995546][ T5837] usb 44-1: SetAddress Request (6) to port 0 [ 160.995629][ T5837] usb 44-1: new SuperSpeed USB device number 6 using vhci_hcd [ 161.167272][ T5904] usb usb40-port1: unable to enumerate USB device [ 161.371158][ T6542] vhci_hcd: connection reset by peer [ 161.374910][ T5830] vhci_hcd vhci_hcd.3: stop threads [ 161.377700][ T5830] vhci_hcd vhci_hcd.3: release socket [ 161.380764][ T5830] vhci_hcd vhci_hcd.3: disconnect device [ 163.549515][ T6591] netlink: 'syz.2.149': attribute type 1 has an invalid length. [ 163.607439][ T6591] 8021q: adding VLAN 0 to HW filter on device bond0 [ 163.745547][ T54] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 163.896745][ T54] usb 8-1: Using ep0 maxpacket: 16 [ 163.909740][ T54] usb 8-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 163.913739][ T54] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.923607][ T54] usb 8-1: Product: syz [ 163.925620][ T54] usb 8-1: Manufacturer: syz [ 163.927643][ T54] usb 8-1: SerialNumber: syz [ 164.173684][ T54] usb 8-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 164.195368][ T54] usb 8-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 164.208317][ T54] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 164.217008][ T54] usb 8-1: media controller created [ 164.272006][ T54] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 164.451302][ T6608] netlink: 'syz.3.143': attribute type 1 has an invalid length. [ 164.499793][ T6608] 8021q: adding VLAN 0 to HW filter on device bond2 [ 164.515789][ T54] zl10353_read_register: readreg error (reg=127, ret==-110) [ 164.515936][ T6611] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 164.545184][ T6611] bond2: (slave batadv1): making interface the new active one [ 164.571377][ T6611] bond2: (slave batadv1): Enslaving as an active interface with an up link [ 164.683946][ T6593] bond2 (unregistering): (slave batadv1): Releasing active interface [ 164.690748][ T6593] bond2 (unregistering): Released all slaves [ 164.780407][ T54] dvb_usb_gl861 8-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 164.793366][ T54] usb 8-1: USB disconnect, device number 2 [ 165.870295][ T6626] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 165.870329][ T6626] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 165.871244][ T6626] vhci_hcd vhci_hcd.0: Device attached [ 166.354062][ T5837] usb 44-1: device descriptor read/8, error -110 [ 166.551287][ T5904] usb 42-1: SetAddress Request (10) to port 0 [ 166.554357][ T5904] usb 42-1: new SuperSpeed USB device number 10 using vhci_hcd [ 166.594518][ T6637] syz.0.155: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 166.601057][ T6637] CPU: 2 UID: 0 PID: 6637 Comm: syz.0.155 Not tainted syzkaller #0 PREEMPT(full) [ 166.601079][ T6637] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 166.601090][ T6637] Call Trace: [ 166.601095][ T6637] [ 166.601102][ T6637] dump_stack_lvl+0x100/0x190 [ 166.601135][ T6637] warn_alloc.cold+0x94/0xa8 [ 166.601153][ T6637] ? __pfx_warn_alloc+0x10/0x10 [ 166.601175][ T6637] ? kasan_save_stack+0x3f/0x50 [ 166.601199][ T6637] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 166.601214][ T6637] ? xskq_create+0x52/0x1d0 [ 166.601232][ T6637] ? xsk_setsockopt+0x743/0xab0 [ 166.601246][ T6637] ? do_sock_setsockopt+0xf3/0x1d0 [ 166.601271][ T6637] ? __sys_setsockopt+0x119/0x190 [ 166.601290][ T6637] ? __ia32_sys_setsockopt+0xbc/0x160 [ 166.601309][ T6637] ? __do_fast_syscall_32+0xe7/0x970 [ 166.601329][ T6637] ? do_fast_syscall_32+0x32/0x70 [ 166.601353][ T6637] ? xskq_create+0xfb/0x1d0 [ 166.601371][ T6637] __vmalloc_node_range_noprof+0x136c/0x1630 [ 166.601403][ T6637] ? xskq_create+0xfb/0x1d0 [ 166.601425][ T6637] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 166.601451][ T6637] ? kasan_save_track+0x14/0x30 [ 166.601470][ T6637] ? __kasan_kmalloc+0xaa/0xb0 [ 166.601489][ T6637] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 166.601506][ T6637] ? xskq_create+0xfb/0x1d0 [ 166.601522][ T6637] vmalloc_user_noprof+0x9e/0xe0 [ 166.601545][ T6637] ? xskq_create+0xfb/0x1d0 [ 166.601562][ T6637] xskq_create+0xfb/0x1d0 [ 166.601581][ T6637] xsk_setsockopt+0x743/0xab0 [ 166.601595][ T6637] ? __pfx_aa_sk_perm+0x10/0x10 [ 166.601617][ T6637] ? __pfx_xsk_setsockopt+0x10/0x10 [ 166.601634][ T6637] ? find_held_lock+0x2b/0x80 [ 166.601657][ T6637] ? aa_sock_opt_perm+0xfe/0x1b0 [ 166.601675][ T6637] ? __pfx_xsk_setsockopt+0x10/0x10 [ 166.601695][ T6637] do_sock_setsockopt+0xf3/0x1d0 [ 166.601721][ T6637] __sys_setsockopt+0x119/0x190 [ 166.601745][ T6637] __ia32_sys_setsockopt+0xbc/0x160 [ 166.601766][ T6637] ? __do_fast_syscall_32+0x98/0x970 [ 166.601786][ T6637] ? lockdep_hardirqs_on+0x78/0x100 [ 166.601804][ T6637] __do_fast_syscall_32+0xe7/0x970 [ 166.601827][ T6637] do_fast_syscall_32+0x32/0x70 [ 166.601848][ T6637] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 166.601868][ T6637] RIP: 0023:0xf6fdefec [ 166.601888][ T6637] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 166.601896][ T6637] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 166.601913][ T6637] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000000011b [ 166.601924][ T6637] RDX: 0000000000000006 RSI: 0000000080000000 RDI: 0000000000000004 [ 166.601934][ T6637] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 166.601944][ T6637] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 166.601954][ T6637] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 166.601974][ T6637] [ 166.601981][ T6637] Mem-Info: [ 166.735295][ T6637] active_anon:24989 inactive_anon:169 isolated_anon:0 [ 166.735295][ T6637] active_file:8571 inactive_file:43375 isolated_file:0 [ 166.735295][ T6637] unevictable:1768 dirty:856 writeback:0 [ 166.735295][ T6637] slab_reclaimable:7112 slab_unreclaimable:53737 [ 166.735295][ T6637] mapped:31838 shmem:21671 pagetables:1098 [ 166.735295][ T6637] sec_pagetables:299 bounce:0 [ 166.735295][ T6637] kernel_misc_reclaimable:0 [ 166.735295][ T6637] free:29391 free_pcp:7983 free_cma:0 [ 166.753724][ T6637] Node 0 active_anon:3600kB inactive_anon:16kB active_file:4kB inactive_file:4kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:68kB dirty:8kB writeback:0kB shmem:7076kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8736kB pagetables:1272kB sec_pagetables:1152kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 166.766320][ T6637] Node 1 active_anon:98256kB inactive_anon:660kB active_file:34280kB inactive_file:173496kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:129284kB dirty:3416kB writeback:0kB shmem:81508kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:4924kB pagetables:3020kB sec_pagetables:44kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 166.778783][ T6637] Node 0 DMA free:1748kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:652kB local_pcp:184kB free_cma:0kB [ 166.788787][ T6637] lowmem_reserve[]: 0 280 280 280 280 [ 166.790664][ T6637] Node 0 DMA32 free:15400kB boost:0kB min:12772kB low:15964kB high:19156kB reserved_highatomic:0KB free_highatomic:0KB active_anon:3600kB inactive_anon:16kB active_file:4kB inactive_file:4kB unevictable:3536kB writepending:8kB zspages:0kB present:1032196kB managed:286904kB mlocked:0kB bounce:0kB free_pcp:13448kB local_pcp:3440kB free_cma:0kB [ 166.801680][ T6637] lowmem_reserve[]: 0 0 0 0 0 [ 166.803302][ T6637] Node 1 DMA32 free:92616kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:102356kB inactive_anon:660kB active_file:34280kB inactive_file:173496kB unevictable:3536kB writepending:3416kB zspages:2664kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:19588kB local_pcp:576kB free_cma:0kB [ 166.814152][ T6637] lowmem_reserve[]: 0 0 0 0 0 [ 166.815836][ T6637] Node 0 DMA: 27*4kB (UM) 3*8kB (U) 1*16kB (M) 4*32kB (UM) 1*64kB (U) 1*128kB (M) 1*256kB (M) 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 1748kB [ 166.820709][ T6637] Node 0 DMA32: 16*4kB (UE) 73*8kB (UE) 38*16kB (UE) 70*32kB (UE) 22*64kB (UME) 8*128kB (UME) 7*256kB (UME) 5*512kB (UME) 5*1024kB (M) 0*2048kB 0*4096kB = 15400kB [ 166.826706][ T6637] Node 1 DMA32: 289*4kB (UE) 288*8kB (UME) 64*16kB (UE) 150*32kB (UE) 91*64kB (UME) 39*128kB (UME) 20*256kB (UME) 13*512kB (UME) 15*1024kB (UM) 8*2048kB (UME) 5*4096kB (UM) = 84100kB [ 166.834136][ T6637] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 166.838641][ T6637] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 166.842573][ T6637] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 166.848339][ T6637] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 166.856291][ T6637] 77146 total pagecache pages [ 166.858572][ T6637] 683 pages in swap cache [ 166.860311][ T6637] Free swap = 118312kB [ 166.861943][ T6637] Total swap = 124996kB [ 166.863678][ T6637] 524155 pages RAM [ 166.865273][ T6637] 0 pages HighMem/MovableOnly [ 166.867972][ T6637] 211536 pages reserved [ 166.869697][ T6637] 0 pages cma reserved [ 166.880718][ T5837] usb usb44-port1: attempt power cycle [ 167.263139][ T6649] netlink: 'syz.0.157': attribute type 1 has an invalid length. [ 167.293602][ T6649] 8021q: adding VLAN 0 to HW filter on device bond1 [ 167.439868][ T6631] vhci_hcd: connection reset by peer [ 167.444768][ T5830] vhci_hcd vhci_hcd.2: stop threads [ 167.448177][ T5830] vhci_hcd vhci_hcd.2: release socket [ 167.453122][ T5830] vhci_hcd vhci_hcd.2: disconnect device [ 167.506666][ T5837] usb usb44-port1: unable to enumerate USB device [ 172.095635][ T5904] usb 42-1: device descriptor read/8, error -110 [ 172.405545][ T5837] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 172.590899][ T5904] usb usb42-port1: attempt power cycle [ 172.624319][ T5837] usb 6-1: config 0 has an invalid interface number: 205 but max is 0 [ 172.627295][ T5837] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 172.630571][ T5837] usb 6-1: config 0 has no interface number 0 [ 172.632427][ T5837] usb 6-1: config 0 interface 205 has no altsetting 0 [ 172.636579][ T5837] usb 6-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 172.639337][ T5837] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.641688][ T5837] usb 6-1: Product: syz [ 172.642955][ T5837] usb 6-1: Manufacturer: syz [ 172.644319][ T5837] usb 6-1: SerialNumber: syz [ 172.650049][ T5837] usb 6-1: config 0 descriptor?? [ 172.657490][ T5837] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 172.660954][ T5837] dvb-usb: bulk message failed: -22 (3/0) [ 172.696000][ T5837] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 172.702187][ T5837] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 172.706373][ T5837] usb 6-1: media controller created [ 172.718826][ T5837] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 172.760855][ T5837] dvb-usb: bulk message failed: -22 (6/0) [ 172.764697][ T5837] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 172.914510][ T5837] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb6/6-1/input/input5 [ 172.926725][ T5837] dvb-usb: schedule remote query interval to 150 msecs. [ 172.929068][ T5837] dvb-usb: bulk message failed: -22 (3/0) [ 172.955573][ T5837] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 173.088274][ T5837] dvb-usb: bulk message failed: -22 (1/0) [ 173.092789][ T5837] dvb-usb: error while querying for an remote control event. [ 173.196926][ T5904] usb usb42-port1: unable to enumerate USB device [ 173.256714][ T5904] dvb-usb: bulk message failed: -22 (1/0) [ 173.258904][ T5904] dvb-usb: error while querying for an remote control event. [ 173.560878][ T5837] dvb-usb: bulk message failed: -22 (1/0) [ 173.563955][ T5837] dvb-usb: error while querying for an remote control event. [ 173.725550][ T5837] dvb-usb: bulk message failed: -22 (1/0) [ 173.729212][ T5837] dvb-usb: error while querying for an remote control event. [ 173.886236][ T5837] dvb-usb: bulk message failed: -22 (1/0) [ 173.891146][ T5837] dvb-usb: error while querying for an remote control event. [ 174.054159][ T5837] dvb-usb: bulk message failed: -22 (1/0) [ 174.100989][ T5837] dvb-usb: error while querying for an remote control event. [ 174.236610][ T9] usb 6-1: USB disconnect, device number 2 [ 174.371129][ T9] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 175.515327][ T6762] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 175.517468][ T6762] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 175.520211][ T6762] vhci_hcd vhci_hcd.0: Device attached [ 175.696810][ T40] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 175.762438][ T40] usb 39-1: new full-speed USB device number 2 using vhci_hcd [ 176.525045][ T6778] vivid-000: disconnect [ 176.869608][ T6763] vhci_hcd: connection reset by peer [ 176.872300][ T5830] vhci_hcd vhci_hcd.1: stop threads [ 176.874487][ T5830] vhci_hcd vhci_hcd.1: release socket [ 176.876803][ T5830] vhci_hcd vhci_hcd.1: disconnect device [ 177.013189][ T6768] vivid-000: reconnect [ 177.358051][ T6792] netlink: 28 bytes leftover after parsing attributes in process `syz.0.182'. [ 178.985497][ T54] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 179.145809][ T54] usb 7-1: Using ep0 maxpacket: 16 [ 179.151871][ T54] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 179.161725][ T54] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 179.167243][ T54] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.171999][ T54] usb 7-1: Product: syz [ 179.173438][ T54] usb 7-1: Manufacturer: syz [ 179.177391][ T54] usb 7-1: SerialNumber: syz [ 179.196983][ T54] usb 7-1: config 0 descriptor?? [ 179.213248][ T54] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 179.223559][ T54] em28xx 7-1:0.0: DVB interface 0 found: bulk [ 179.835240][ T54] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 179.945556][ T6821] netlink: 'syz.0.190': attribute type 1 has an invalid length. [ 180.098172][ T6821] 8021q: adding VLAN 0 to HW filter on device bond2 [ 180.243629][ T6802] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.253758][ T6802] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.319029][ T6826] syz.2.186 uses obsolete (PF_INET,SOCK_PACKET) [ 180.431829][ T6826] bond0: (slave ip6tnl0): refused to change device type [ 180.563938][ T6831] netlink: 8 bytes leftover after parsing attributes in process `syz.3.192'. [ 180.566875][ T6831] netlink: 4 bytes leftover after parsing attributes in process `syz.3.192'. [ 180.584742][ T6831] 8021q: adding VLAN 0 to HW filter on device bond0 [ 180.588494][ T6831] bond2: (slave bond0): making interface the new active one [ 180.591615][ T6831] bond2: (slave bond0): Enslaving as an active interface with an up link [ 180.605090][ T6831] netlink: 'syz.3.192': attribute type 4 has an invalid length. [ 180.607843][ T6831] netlink: 152 bytes leftover after parsing attributes in process `syz.3.192'. [ 180.615305][ T6831] .`: renamed from bond0 (while UP) [ 180.639528][ T6831] netlink: 8 bytes leftover after parsing attributes in process `syz.3.192'. [ 180.848953][ T40] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 181.328288][ T54] em28xx 7-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 181.338251][ T54] em28xx 7-1:0.0: board has no eeprom [ 181.341788][ T6802] em28xx 7-1:0.0: writing to i2c device at 0x0 failed (error=-5) [ 181.405552][ T54] em28xx 7-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 181.408014][ T54] em28xx 7-1:0.0: dvb set to bulk mode. [ 181.415237][ T5754] em28xx 7-1:0.0: Binding DVB extension [ 181.418223][ T54] usb 7-1: USB disconnect, device number 3 [ 181.436130][ T54] em28xx 7-1:0.0: Disconnecting em28xx [ 181.470998][ T5754] em28xx 7-1:0.0: Registering input extension [ 181.474488][ T54] em28xx 7-1:0.0: Closing input extension [ 181.501492][ T54] em28xx 7-1:0.0: Freeing device [ 181.746493][ T6847] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 181.748549][ T6847] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 181.752614][ T6847] vhci_hcd vhci_hcd.0: Device attached [ 181.938323][ T6847] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 182.027559][ T55] usb 38-1: SetAddress Request (2) to port 0 [ 182.037914][ T55] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 182.258260][ T6857] process 'syz.2.196' launched './file0' with NULL argv: empty string added [ 182.773426][ T6848] vhci_hcd: connection reset by peer [ 182.776758][ T12] vhci_hcd vhci_hcd.0: stop threads [ 182.778436][ T12] vhci_hcd vhci_hcd.0: release socket [ 182.782361][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 183.055676][ T10] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 183.227634][ T10] usb 7-1: config 0 has an invalid interface number: 205 but max is 0 [ 183.231345][ T10] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 183.235810][ T10] usb 7-1: config 0 has no interface number 0 [ 183.238431][ T10] usb 7-1: config 0 interface 205 has no altsetting 0 [ 183.243535][ T10] usb 7-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 183.247612][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.251305][ T10] usb 7-1: Product: syz [ 183.253178][ T10] usb 7-1: Manufacturer: syz [ 183.255206][ T10] usb 7-1: SerialNumber: syz [ 183.262826][ T10] usb 7-1: config 0 descriptor?? [ 183.268627][ T10] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 183.273373][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 183.306655][ T10] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 183.316192][ T10] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 183.321044][ T10] usb 7-1: media controller created [ 183.324606][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 183.333064][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 183.345997][ T10] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 183.354122][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb7/7-1/input/input7 [ 183.377920][ T10] dvb-usb: schedule remote query interval to 150 msecs. [ 183.381040][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 183.395592][ T10] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 183.535583][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 183.579582][ T10] dvb-usb: error while querying for an remote control event. [ 183.979020][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 183.980883][ T10] dvb-usb: error while querying for an remote control event. [ 184.135526][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 184.137442][ T10] dvb-usb: error while querying for an remote control event. [ 184.295631][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 184.299995][ T10] dvb-usb: error while querying for an remote control event. [ 184.461716][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 184.468783][ T10] dvb-usb: error while querying for an remote control event. [ 184.648815][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 184.653449][ T9] dvb-usb: error while querying for an remote control event. [ 184.903444][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 184.905858][ T9] dvb-usb: error while querying for an remote control event. [ 185.016296][ T978] usb 7-1: USB disconnect, device number 4 [ 185.080950][ T978] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 186.915557][ T9] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 187.138007][ T55] usb 38-1: device descriptor read/8, error -110 [ 187.995530][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 188.002333][ T9] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 188.005782][ T9] usb 6-1: config 0 has no interface number 0 [ 188.008298][ T9] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 188.012340][ T9] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 188.016799][ T9] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 188.021182][ T9] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 188.026579][ T9] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 188.029679][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 188.037575][ T9] usb 6-1: config 0 descriptor?? [ 188.048865][ T9] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 188.146132][ T55] usb usb38-port1: attempt power cycle [ 188.828258][ T55] usb usb38-port1: unable to enumerate USB device [ 188.828596][ T6959] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 188.833106][ T6959] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 188.858624][ T6959] vhci_hcd vhci_hcd.0: Device attached [ 189.035541][ T5754] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 189.095489][ T5754] usb 41-1: new full-speed USB device number 2 using vhci_hcd [ 189.780240][ T6960] vhci_hcd: connection reset by peer [ 189.789720][ T5801] vhci_hcd vhci_hcd.2: stop threads [ 189.792877][ T5801] vhci_hcd vhci_hcd.2: release socket [ 189.798023][ T5801] vhci_hcd vhci_hcd.2: disconnect device [ 190.187416][ T978] usb 6-1: USB disconnect, device number 3 [ 190.257642][ T978] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 190.572901][ T42] kauditd_printk_skb: 142 callbacks suppressed [ 190.572989][ T42] audit: type=1326 audit(1785496065.865:368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6973 comm="syz.3.217" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 190.609810][ T42] audit: type=1326 audit(1785496065.885:369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6973 comm="syz.3.217" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 190.635030][ T42] audit: type=1326 audit(1785496065.885:370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6973 comm="syz.3.217" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 190.641783][ T42] audit: type=1326 audit(1785496065.885:371): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6973 comm="syz.3.217" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 190.680222][ T42] audit: type=1326 audit(1785496065.885:372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6973 comm="syz.3.217" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 190.726336][ T6979] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 190.729071][ T6979] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 190.733158][ T42] audit: type=1326 audit(1785496065.895:373): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6973 comm="syz.3.217" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 190.759507][ T42] audit: type=1326 audit(1785496065.895:374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6973 comm="syz.3.217" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 190.878530][ T6979] vhci_hcd vhci_hcd.0: Device attached [ 190.883266][ T42] audit: type=1326 audit(1785496065.895:375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6973 comm="syz.3.217" exe="/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 190.905495][ T42] audit: type=1326 audit(1785496065.895:376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6973 comm="syz.3.217" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 190.914735][ T42] audit: type=1326 audit(1785496065.895:377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6973 comm="syz.3.217" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 191.259937][ T6980] vhci_hcd: connection closed [ 191.261282][ T12] vhci_hcd vhci_hcd.2: stop threads [ 191.265010][ T12] vhci_hcd vhci_hcd.2: release socket [ 191.266790][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 194.205588][ T5754] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 195.130643][ T4258] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 195.309311][ T4258] usb 7-1: Using ep0 maxpacket: 8 [ 195.322974][ T4258] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 195.326085][ T4258] usb 7-1: config 0 has no interface number 0 [ 195.329167][ T4258] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 195.333004][ T4258] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 195.337056][ T4258] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 195.341667][ T4258] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 195.346072][ T4258] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 195.349848][ T4258] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 195.372016][ T4258] usb 7-1: config 0 descriptor?? [ 195.394292][ T4258] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 195.755369][ T5837] usb usb42-port1: attempt power cycle [ 195.832530][ T7039] warn_alloc: 2 callbacks suppressed [ 195.832545][ T7039] syz.1.237: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 195.855463][ T7039] CPU: 3 UID: 0 PID: 7039 Comm: syz.1.237 Not tainted syzkaller #0 PREEMPT(full) [ 195.855481][ T7039] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 195.855488][ T7039] Call Trace: [ 195.855493][ T7039] [ 195.855498][ T7039] dump_stack_lvl+0x100/0x190 [ 195.855516][ T7039] warn_alloc.cold+0x94/0xa8 [ 195.855529][ T7039] ? __pfx_warn_alloc+0x10/0x10 [ 195.855545][ T7039] ? kasan_save_stack+0x3f/0x50 [ 195.855561][ T7039] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 195.855573][ T7039] ? xskq_create+0x52/0x1d0 [ 195.855588][ T7039] ? xsk_setsockopt+0x743/0xab0 [ 195.855598][ T7039] ? do_sock_setsockopt+0xf3/0x1d0 [ 195.855617][ T7039] ? __sys_setsockopt+0x119/0x190 [ 195.855631][ T7039] ? __ia32_sys_setsockopt+0xbc/0x160 [ 195.855645][ T7039] ? __do_fast_syscall_32+0xe7/0x970 [ 195.855659][ T7039] ? do_fast_syscall_32+0x32/0x70 [ 195.855675][ T7039] ? xskq_create+0xfb/0x1d0 [ 195.855687][ T7039] __vmalloc_node_range_noprof+0x136c/0x1630 [ 195.855709][ T7039] ? xskq_create+0xfb/0x1d0 [ 195.855724][ T7039] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 195.855744][ T7039] ? kasan_save_track+0x14/0x30 [ 195.855757][ T7039] ? __kasan_kmalloc+0xaa/0xb0 [ 195.855770][ T7039] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 195.855782][ T7039] ? xskq_create+0xfb/0x1d0 [ 195.855793][ T7039] vmalloc_user_noprof+0x9e/0xe0 [ 195.855809][ T7039] ? xskq_create+0xfb/0x1d0 [ 195.855821][ T7039] xskq_create+0xfb/0x1d0 [ 195.855834][ T7039] xsk_setsockopt+0x743/0xab0 [ 195.855844][ T7039] ? __pfx_aa_sk_perm+0x10/0x10 [ 195.855859][ T7039] ? __pfx_xsk_setsockopt+0x10/0x10 [ 195.855870][ T7039] ? find_held_lock+0x2b/0x80 [ 195.855885][ T7039] ? aa_sock_opt_perm+0xfe/0x1b0 [ 195.855897][ T7039] ? __pfx_xsk_setsockopt+0x10/0x10 [ 195.855909][ T7039] do_sock_setsockopt+0xf3/0x1d0 [ 195.855927][ T7039] __sys_setsockopt+0x119/0x190 [ 195.855945][ T7039] __ia32_sys_setsockopt+0xbc/0x160 [ 195.855961][ T7039] ? __do_fast_syscall_32+0x98/0x970 [ 195.855978][ T7039] ? lockdep_hardirqs_on+0x78/0x100 [ 195.855991][ T7039] __do_fast_syscall_32+0xe7/0x970 [ 195.856008][ T7039] do_fast_syscall_32+0x32/0x70 [ 195.856023][ T7039] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 195.856037][ T7039] RIP: 0023:0xf707efec [ 195.856052][ T7039] Code: Unable to access opcode bytes at 0xf707efc2. [ 195.856057][ T7039] RSP: 002b:00000000f546d50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 195.856068][ T7039] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000000011b [ 195.856074][ T7039] RDX: 0000000000000006 RSI: 0000000080000000 RDI: 0000000000000004 [ 195.856081][ T7039] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 195.856086][ T7039] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 195.856092][ T7039] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 195.856105][ T7039] [ 195.856110][ T7039] Mem-Info: [ 195.954851][ T7039] active_anon:27918 inactive_anon:221 isolated_anon:0 [ 195.954851][ T7039] active_file:8571 inactive_file:38741 isolated_file:0 [ 195.954851][ T7039] unevictable:1768 dirty:784 writeback:0 [ 195.954851][ T7039] slab_reclaimable:7140 slab_unreclaimable:54431 [ 195.954851][ T7039] mapped:35452 shmem:24514 pagetables:1081 [ 195.954851][ T7039] sec_pagetables:301 bounce:0 [ 195.954851][ T7039] kernel_misc_reclaimable:0 [ 195.954851][ T7039] free:23554 free_pcp:11259 free_cma:0 [ 195.982953][ T7039] Node 0 active_anon:3560kB inactive_anon:20kB active_file:4kB inactive_file:4kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:8kB writeback:0kB shmem:7036kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8736kB pagetables:1272kB sec_pagetables:1152kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 195.997619][ T7039] Node 1 active_anon:108012kB inactive_anon:864kB active_file:34280kB inactive_file:154960kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:130292kB dirty:3128kB writeback:0kB shmem:91020kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:4936kB pagetables:3028kB sec_pagetables:52kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 196.011550][ T7039] Node 0 DMA free:1704kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:712kB local_pcp:200kB free_cma:0kB [ 196.025060][ T7039] lowmem_reserve[]: 0 280 280 280 280 [ 196.028401][ T7039] Node 0 DMA32 free:15780kB boost:4096kB min:16868kB low:20060kB high:23252kB reserved_highatomic:0KB free_highatomic:0KB active_anon:3560kB inactive_anon:20kB active_file:4kB inactive_file:4kB unevictable:3536kB writepending:8kB zspages:0kB present:1032196kB managed:286904kB mlocked:0kB bounce:0kB free_pcp:14592kB local_pcp:3744kB free_cma:0kB [ 196.041831][ T7039] lowmem_reserve[]: 0 0 0 0 0 [ 196.044736][ T7039] Node 1 DMA32 free:76732kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:99612kB inactive_anon:864kB active_file:34280kB inactive_file:154960kB unevictable:3536kB writepending:3128kB zspages:2484kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:38652kB local_pcp:2512kB free_cma:0kB [ 196.057986][ T7039] lowmem_reserve[]: 0 0 0 0 0 [ 196.060153][ T7039] Node 0 DMA: 28*4kB (UM) 5*8kB (UM) 3*16kB (M) 5*32kB (UM) 3*64kB (UM) 1*128kB (M) 0*256kB 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 1704kB [ 196.066696][ T7039] Node 0 DMA32: 15*4kB (ME) 41*8kB (UME) 30*16kB (UME) 110*32kB (UME) 34*64kB (UME) 12*128kB (UM) 6*256kB (ME) 6*512kB (M) 3*1024kB (M) 0*2048kB 0*4096kB = 15780kB [ 196.073814][ T7039] Node 1 DMA32: 882*4kB (UME) 459*8kB (UME) 172*16kB (UME) 161*32kB (UME) 95*64kB (UME) 46*128kB (UME) 27*256kB (UME) 17*512kB (ME) 11*1024kB (M) 7*2048kB (ME) 2*4096kB (UM) = 76480kB [ 196.081824][ T7039] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 196.086172][ T7039] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 196.091290][ T7039] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 196.095311][ T7039] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 196.099644][ T7039] 69755 total pagecache pages [ 196.101737][ T7039] 783 pages in swap cache [ 196.103541][ T7039] Free swap = 118324kB [ 196.105310][ T7039] Total swap = 124996kB [ 196.107554][ T7039] 524155 pages RAM [ 196.109185][ T7039] 0 pages HighMem/MovableOnly [ 196.111231][ T7039] 211536 pages reserved [ 196.113010][ T7039] 0 pages cma reserved [ 196.398278][ T5837] usb usb42-port1: unable to enumerate USB device [ 196.611277][ T7053] netlink: 76 bytes leftover after parsing attributes in process `syz.0.231'. [ 197.887436][ T29] usb 7-1: USB disconnect, device number 5 [ 198.090852][ T7073] netlink: 8 bytes leftover after parsing attributes in process `syz.0.235'. [ 198.121910][ T29] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 199.266132][ T42] kauditd_printk_skb: 140 callbacks suppressed [ 199.266147][ T42] audit: type=1804 audit(1785496074.555:518): pid=7089 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.241" name="/newroot/71/file0" dev="tmpfs" ino=412 res=1 errno=0 [ 202.333791][ T7131] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 202.335897][ T7131] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 202.339277][ T7131] vhci_hcd vhci_hcd.0: Device attached [ 202.465539][ T40] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 202.489877][ T7134] netlink: 8 bytes leftover after parsing attributes in process `syz.2.250'. [ 202.506068][ T5925] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 202.525676][ T9] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 202.595734][ T9] usb 37-1: new full-speed USB device number 2 using vhci_hcd [ 202.675626][ T5925] usb 8-1: Using ep0 maxpacket: 8 [ 202.693840][ T5925] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 202.699298][ T5925] usb 8-1: config 0 has no interface number 0 [ 202.702331][ T5925] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 202.707029][ T5925] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 202.713223][ T5925] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 202.718084][ T5925] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 202.724323][ T5925] usb 8-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 202.728121][ T5925] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.780029][ T5925] usb 8-1: config 0 descriptor?? [ 202.862345][ T5925] ldusb 8-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 203.102275][ T7132] vhci_hcd: connection reset by peer [ 203.108859][ T5801] vhci_hcd vhci_hcd.0: stop threads [ 203.110942][ T5801] vhci_hcd vhci_hcd.0: release socket [ 203.113129][ T5801] vhci_hcd vhci_hcd.0: disconnect device [ 203.275478][ T40] usb 6-1: Using ep0 maxpacket: 16 [ 203.281201][ T40] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 203.288237][ T40] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 203.293158][ T40] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.298747][ T40] usb 6-1: Product: syz [ 203.300101][ T40] usb 6-1: Manufacturer: syz [ 203.302140][ T40] usb 6-1: SerialNumber: syz [ 203.305907][ T40] usb 6-1: config 0 descriptor?? [ 203.313684][ T40] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 203.317018][ T40] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 203.332160][ T7139] BTRFS info: 'norecovery' is for compatibility only, recommended to use 'rescue=nologreplay' [ 203.929837][ T40] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 204.358410][ T7129] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 204.361978][ T7129] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 204.549911][ T7146] bond0: (slave ip6tnl0): refused to change device type [ 205.275970][ T978] usb 8-1: USB disconnect, device number 3 [ 205.282000][ T978] ldusb 8-1:0.55: LD USB Device #0 now disconnected [ 205.415735][ T40] em28xx 6-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 205.419553][ T40] em28xx 6-1:0.0: board has no eeprom [ 205.423279][ T7129] em28xx 6-1:0.0: writing to i2c device at 0x0 failed (error=-5) [ 205.495534][ T40] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 205.500442][ T40] em28xx 6-1:0.0: dvb set to bulk mode. [ 205.507157][ T978] em28xx 6-1:0.0: Binding DVB extension [ 205.516144][ T40] usb 6-1: USB disconnect, device number 4 [ 205.534342][ T40] em28xx 6-1:0.0: Disconnecting em28xx [ 205.565910][ T978] em28xx 6-1:0.0: Registering input extension [ 205.569040][ T40] em28xx 6-1:0.0: Closing input extension [ 205.578205][ T1442] ieee802154 phy0 wpan0: encryption failed: -22 [ 205.580943][ T1442] ieee802154 phy1 wpan1: encryption failed: -22 [ 205.590061][ T40] em28xx 6-1:0.0: Freeing device [ 205.830411][ T7166] overlayfs: missing 'lowerdir' [ 205.876573][ T7166] uhci_hcd 0000:00:1d.0: remove, state 4 [ 205.879330][ T7166] usb usb2: USB disconnect, device number 1 [ 205.912082][ T7166] uhci_hcd 0000:00:1d.0: USB bus 2 deregistered [ 206.023551][ T7168] vxcan1: tx drop: invalid da for name 0x0000000000000003 [ 206.052988][ T7170] input: syz1 as /devices/virtual/input/input9 [ 206.157212][ T7174] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 206.191085][ T7167] pci 0000:00:1d.0: [8086:2934] type 00 class 0x0c0300 conventional PCI endpoint [ 206.214019][ T7167] pci 0000:00:1d.0: BAR 4 [io 0xc0e0-0xc0ff] [ 206.291261][ T7177] netlink: 16 bytes leftover after parsing attributes in process `syz.0.262'. [ 206.295349][ T7167] pci 0000:00:1d.0: Adding to iommu group 7 [ 206.391048][ T7167] pci 0000:00:1d.0: BAR 4 [io 0x2000-0x201f]: assigned [ 206.789824][ T7167] pci 0000:00:1d.0: quirk_usb_early_handoff+0x0/0x1360 took 377574 usecs [ 206.971234][ T7167] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 206.982901][ T7167] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 2 [ 206.986858][ T7167] uhci_hcd 0000:00:1d.0: detected 2 ports [ 206.995004][ T7167] uhci_hcd 0000:00:1d.0: irq 16, io port 0x00002000 [ 207.005782][ T7193] netlink: 8 bytes leftover after parsing attributes in process `syz.2.263'. [ 207.008765][ T7167] usb usb2: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 207.009108][ T7167] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 207.009119][ T7167] usb usb2: Product: UHCI Host Controller [ 207.029443][ T7167] usb usb2: Manufacturer: Linux syzkaller uhci_hcd [ 207.035340][ T7167] usb usb2: SerialNumber: 0000:00:1d.0 [ 207.153332][ T7167] hub 2-0:1.0: USB hub found [ 207.199762][ T7167] hub 2-0:1.0: 2 ports detected [ 207.815693][ T9] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 208.064231][ T7225] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.269'. [ 208.067382][ T7225] openvswitch: netlink: Message has 512 unknown bytes. [ 208.896935][ T7245] netlink: 156 bytes leftover after parsing attributes in process `syz.0.271'. [ 209.505503][ T9] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 209.657043][ T9] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 209.661916][ T9] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 209.667139][ T9] usb 8-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 209.670098][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.681345][ T9] usb 8-1: config 0 descriptor?? [ 210.179548][ T7265] netlink: 8 bytes leftover after parsing attributes in process `syz.1.274'. [ 210.380496][ T7268] batman_adv: batadv0: Adding interface: macvtap1 [ 210.382599][ T7268] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 210.395648][ T7268] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 210.441813][ T7269] batman_adv: batadv0: Removing interface: macvtap1 [ 211.000397][ T7278] netlink: 16 bytes leftover after parsing attributes in process `syz.1.277'. [ 212.261615][ T7334] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 212.263737][ T7334] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 212.267640][ T7334] vhci_hcd vhci_hcd.0: Device attached [ 212.568122][ T5754] usb 8-1: USB disconnect, device number 4 [ 212.922090][ T7330] geneve2: entered allmulticast mode [ 212.967462][ T7346] netlink: 156 bytes leftover after parsing attributes in process `syz.2.284'. [ 212.973744][ T5837] usb 40-1: SetAddress Request (6) to port 0 [ 212.976626][ T5837] usb 40-1: new SuperSpeed USB device number 6 using vhci_hcd [ 213.138903][ T7349] erspan0: entered promiscuous mode [ 213.148549][ T7349] netlink: 8 bytes leftover after parsing attributes in process `syz.0.292'. [ 213.242937][ T7335] vhci_hcd: connection reset by peer [ 213.245694][ T5801] vhci_hcd vhci_hcd.1: stop threads [ 213.247827][ T5801] vhci_hcd vhci_hcd.1: release socket [ 213.250293][ T5801] vhci_hcd vhci_hcd.1: disconnect device [ 214.696666][ T7371] netlink: 16 bytes leftover after parsing attributes in process `syz.2.290'. [ 215.185554][ T10] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 215.347081][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 215.350523][ T10] usb 5-1: config 3 has an invalid interface number: 249 but max is 0 [ 215.353619][ T10] usb 5-1: config 3 has no interface number 0 [ 215.355922][ T10] usb 5-1: config 3 interface 249 has no altsetting 0 [ 215.359599][ T10] usb 5-1: New USB device found, idVendor=0c45, idProduct=800a, bcdDevice=5a.9d [ 215.362595][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.365171][ T10] usb 5-1: Product: syz [ 215.366898][ T10] usb 5-1: Manufacturer: syz [ 215.368437][ T10] usb 5-1: SerialNumber: syz [ 216.158223][ T7433] netlink: 8 bytes leftover after parsing attributes in process `syz.3.296'. [ 216.376411][ T10] gspca_main: sn9c2028-2.14.0 probing 0c45:800a [ 216.382389][ T10] gspca_sn9c2028: read1 error -71 [ 216.386914][ T10] gspca_sn9c2028: read1 error -71 [ 216.391195][ T10] gspca_sn9c2028: read1 error -71 [ 216.395171][ T10] sn9c2028 5-1:3.249: probe with driver sn9c2028 failed with error -71 [ 216.406326][ T10] usb 5-1: USB disconnect, device number 4 [ 216.902109][ T7441] isofs_fill_super: bread failed, dev=sr0, iso_blknum=32, block=32 [ 217.125611][ T42] audit: type=1804 audit(1785496092.375:519): pid=7444 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.301" name="bus" dev="ramfs" ino=16443 res=1 errno=0 [ 218.561027][ T5837] usb 40-1: device descriptor read/8, error -110 [ 218.946031][ T5837] usb usb40-port1: attempt power cycle [ 218.981511][ T7456] futex_wake_op: syz.2.304 tries to shift op by 144; fix this program [ 218.990941][ T7456] futex_wake_op: syz.2.304 tries to shift op by 144; fix this program [ 219.003775][ T7459] input: syz1 as /devices/virtual/input/input10 [ 219.659865][ T5837] usb usb40-port1: unable to enumerate USB device [ 219.795810][ T978] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 219.906462][ T7471] overlayfs: failed to clone upperpath [ 219.955618][ T978] usb 6-1: Using ep0 maxpacket: 8 [ 220.176995][ T978] usb 6-1: unable to get BOS descriptor or descriptor too short [ 220.183869][ T978] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 220.189046][ T978] usb 6-1: can't read configurations, error -71 [ 220.727875][ T7477] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 220.730110][ T7477] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 220.735010][ T7477] vhci_hcd vhci_hcd.0: Device attached [ 221.005596][ T5837] usb 38-1: SetAddress Request (6) to port 0 [ 221.007596][ T5837] usb 38-1: new SuperSpeed USB device number 6 using vhci_hcd [ 221.200915][ T7493] erspan0: entered promiscuous mode [ 221.209393][ T7493] netlink: 8 bytes leftover after parsing attributes in process `syz.1.309'. [ 222.100542][ T7480] vhci_hcd: connection reset by peer [ 222.105431][ T7266] vhci_hcd vhci_hcd.0: stop threads [ 222.112683][ T7266] vhci_hcd vhci_hcd.0: release socket [ 222.119861][ T7266] vhci_hcd vhci_hcd.0: disconnect device [ 222.420405][ T7505] netlink: 16 bytes leftover after parsing attributes in process `syz.3.312'. [ 223.404814][ T7538] input: syz1 as /devices/virtual/input/input11 [ 223.504529][ T7540] bond1: Removing last arp target with arp_interval on [ 223.514797][ T7540] bond1: entered promiscuous mode [ 223.516709][ T7540] bond1: entered allmulticast mode [ 223.539793][ T7540] 8021q: adding VLAN 0 to HW filter on device bond1 [ 226.125654][ T5837] usb 38-1: device descriptor read/8, error -110 [ 226.338021][ T7582] netlink: 16 bytes leftover after parsing attributes in process `syz.3.326'. [ 226.446422][ T7590] netlink: 8 bytes leftover after parsing attributes in process `syz.2.325'. [ 226.557092][ T5837] usb usb38-port1: attempt power cycle [ 227.118359][ T5837] usb usb38-port1: unable to enumerate USB device [ 227.405812][ T7623] input: syz1 as /devices/virtual/input/input12 [ 228.464762][ T7642] fuse: Bad value for 'fd' [ 228.566480][ T10] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 228.731064][ T10] usb 8-1: Using ep0 maxpacket: 8 [ 229.169079][ T10] usb 8-1: unable to get BOS descriptor or descriptor too short [ 229.173582][ T10] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 229.182668][ T10] usb 8-1: can't read configurations, error -71 [ 230.393851][ T7657] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 230.395970][ T7657] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 230.440092][ T7657] vhci_hcd vhci_hcd.0: Device attached [ 230.612342][ T7657] geneve2: entered allmulticast mode [ 230.725521][ T5837] usb 44-1: SetAddress Request (10) to port 0 [ 230.728061][ T5837] usb 44-1: new SuperSpeed USB device number 10 using vhci_hcd [ 230.800031][ T7659] vhci_hcd: connection reset by peer [ 230.803604][ T5801] vhci_hcd vhci_hcd.3: stop threads [ 230.805942][ T5801] vhci_hcd vhci_hcd.3: release socket [ 230.808388][ T5801] vhci_hcd vhci_hcd.3: disconnect device [ 231.495237][ T7672] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 231.498066][ T7672] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 231.577512][ T7672] vhci_hcd vhci_hcd.0: Device attached [ 233.083723][ T7699] netlink: 4 bytes leftover after parsing attributes in process `syz.2.347'. [ 233.172990][ T7673] vhci_hcd: connection closed [ 233.173287][ T5801] vhci_hcd vhci_hcd.3: stop threads [ 233.176631][ T5801] vhci_hcd vhci_hcd.3: release socket [ 233.178384][ T5801] vhci_hcd vhci_hcd.3: disconnect device [ 233.256838][ T5100] Bluetooth: hci3: command 0x0419 tx timeout [ 233.259192][ T64] Bluetooth: hci1: command 0x0406 tx timeout [ 233.259305][ T5762] Bluetooth: hci0: command 0x0406 tx timeout [ 233.259402][ T5100] Bluetooth: hci2: command 0x0406 tx timeout [ 233.905563][ T978] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 234.081262][ T978] usb 5-1: config 0 has an invalid interface number: 205 but max is 0 [ 234.084034][ T978] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 234.089773][ T978] usb 5-1: config 0 has no interface number 0 [ 234.091865][ T978] usb 5-1: config 0 interface 205 has no altsetting 0 [ 234.098936][ T978] usb 5-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 234.103482][ T978] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.108842][ T978] usb 5-1: Product: syz [ 234.110228][ T978] usb 5-1: Manufacturer: syz [ 234.114203][ T978] usb 5-1: SerialNumber: syz [ 234.119700][ T978] usb 5-1: config 0 descriptor?? [ 234.125035][ T978] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 234.135463][ T978] dvb-usb: bulk message failed: -22 (3/0) [ 234.161639][ T978] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 234.167558][ T978] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 234.175581][ T978] usb 5-1: media controller created [ 234.180591][ T978] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 234.192249][ T978] dvb-usb: bulk message failed: -22 (6/0) [ 234.199534][ T978] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 234.212333][ T978] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb5/5-1/input/input13 [ 234.219459][ T978] dvb-usb: schedule remote query interval to 150 msecs. [ 234.224003][ T978] dvb-usb: bulk message failed: -22 (3/0) [ 234.245555][ T978] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 234.409703][ T978] dvb-usb: bulk message failed: -22 (1/0) [ 234.411821][ T978] dvb-usb: error while querying for an remote control event. [ 234.609692][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 234.611699][ T24] dvb-usb: error while querying for an remote control event. [ 234.775708][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 234.778153][ T24] dvb-usb: error while querying for an remote control event. [ 234.935877][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 234.938367][ T24] dvb-usb: error while querying for an remote control event. [ 235.095869][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 235.097919][ T24] dvb-usb: error while querying for an remote control event. [ 235.115914][ T7722] netlink: 8 bytes leftover after parsing attributes in process `syz.3.352'. [ 235.255853][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 235.261023][ T24] dvb-usb: error while querying for an remote control event. [ 235.425544][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 235.428182][ T24] dvb-usb: error while querying for an remote control event. [ 235.602098][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 235.619215][ T24] dvb-usb: error while querying for an remote control event. [ 235.670413][ T24] usb 5-1: USB disconnect, device number 5 [ 235.819178][ T5837] usb 44-1: device descriptor read/8, error -110 [ 235.821966][ T24] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 236.255573][ T24] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 236.342275][ T5837] usb usb44-port1: attempt power cycle [ 236.405691][ T5829] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 236.417161][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 236.449170][ T24] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 236.465571][ T24] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 236.469335][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.482030][ T24] usb 5-1: config 0 descriptor?? [ 237.051122][ T7739] batman_adv: batadv0: Adding interface: macvtap1 [ 237.053262][ T7739] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 237.061326][ T7739] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 237.095525][ T7739] batman_adv: batadv0: Removing interface: macvtap1 [ 237.374965][ T7750] netlink: 8 bytes leftover after parsing attributes in process `syz.2.360'. [ 237.712672][ T5837] usb usb44-port1: unable to enumerate USB device [ 238.535031][ T7767] netlink: 16 bytes leftover after parsing attributes in process `syz.1.366'. [ 238.541631][ T7767] netlink: 16 bytes leftover after parsing attributes in process `syz.1.366'. [ 238.596695][ T7768] netlink: 16 bytes leftover after parsing attributes in process `syz.2.365'. [ 239.107812][ T24] usb 5-1: USB disconnect, device number 6 [ 239.925584][ T5754] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 240.075523][ T5754] usb 5-1: Using ep0 maxpacket: 8 [ 240.233609][ T7810] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 240.236012][ T7810] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 240.240499][ T7810] vhci_hcd vhci_hcd.0: Device attached [ 240.361169][ T5754] usb 5-1: unable to get BOS descriptor or descriptor too short [ 240.369867][ T5754] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 240.369890][ T5754] usb 5-1: can't read configurations, error -71 [ 240.606503][ T1007] usb 44-1: SetAddress Request (14) to port 0 [ 240.617468][ T1007] usb 44-1: new SuperSpeed USB device number 14 using vhci_hcd [ 241.362223][ T7811] vhci_hcd: connection reset by peer [ 241.366159][ T7266] vhci_hcd vhci_hcd.3: stop threads [ 241.368466][ T7266] vhci_hcd vhci_hcd.3: release socket [ 241.370840][ T7266] vhci_hcd vhci_hcd.3: disconnect device [ 242.118451][ T7843] netlink: 16 bytes leftover after parsing attributes in process `syz.0.377'. [ 243.247039][ T7879] overlayfs: failed to clone lowerpath [ 243.645045][ T5756] Bluetooth: hci0: unexpected event for opcode 0x201c [ 243.697358][ T7896] x_tables: duplicate underflow at hook 1 [ 244.295857][ T7903] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 244.946777][ T7912] netlink: 16 bytes leftover after parsing attributes in process `syz.0.391'. [ 245.726063][ T1007] usb 44-1: device descriptor read/8, error -110 [ 246.116129][ T1007] usb usb44-port1: attempt power cycle [ 246.173607][ T7943] netlink: 'syz.0.394': attribute type 1 has an invalid length. [ 246.185185][ T7943] bridge0: port 2(bridge_slave_1) entered disabled state [ 246.188781][ T7943] bridge0: port 1(bridge_slave_0) entered disabled state [ 246.684706][ T1007] usb usb44-port1: unable to enumerate USB device [ 247.556356][ T54] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 247.730738][ T54] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 247.741456][ T54] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 247.753154][ T54] usb 6-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 247.765634][ T54] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.775076][ T54] usb 6-1: config 0 descriptor?? [ 248.371468][ T7984] batman_adv: batadv0: Adding interface: macvtap1 [ 248.374571][ T7984] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 248.386345][ T7984] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 248.435386][ T7984] batman_adv: batadv0: Removing interface: macvtap1 [ 249.594100][ T7996] warn_alloc: 1 callbacks suppressed [ 249.594119][ T7996] syz.2.410: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 249.611835][ T7996] CPU: 2 UID: 0 PID: 7996 Comm: syz.2.410 Not tainted syzkaller #0 PREEMPT(full) [ 249.611863][ T7996] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 249.611876][ T7996] Call Trace: [ 249.611886][ T7996] [ 249.611895][ T7996] dump_stack_lvl+0x100/0x190 [ 249.611929][ T7996] warn_alloc.cold+0x94/0xa8 [ 249.611967][ T7996] ? __pfx_warn_alloc+0x10/0x10 [ 249.611995][ T7996] ? kasan_save_stack+0x3f/0x50 [ 249.612022][ T7996] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 249.612042][ T7996] ? xskq_create+0x52/0x1d0 [ 249.612092][ T7996] ? xsk_setsockopt+0x743/0xab0 [ 249.612113][ T7996] ? do_sock_setsockopt+0xf3/0x1d0 [ 249.612150][ T7996] ? __sys_setsockopt+0x119/0x190 [ 249.612174][ T7996] ? __ia32_sys_setsockopt+0xbc/0x160 [ 249.612196][ T7996] ? __do_fast_syscall_32+0xe7/0x970 [ 249.612221][ T7996] ? do_fast_syscall_32+0x32/0x70 [ 249.612247][ T7996] ? xskq_create+0xfb/0x1d0 [ 249.612266][ T7996] __vmalloc_node_range_noprof+0x136c/0x1630 [ 249.612306][ T7996] ? xskq_create+0xfb/0x1d0 [ 249.612334][ T7996] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 249.612366][ T7996] ? kasan_save_track+0x14/0x30 [ 249.612385][ T7996] ? __kasan_kmalloc+0xaa/0xb0 [ 249.612407][ T7996] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 249.612434][ T7996] ? xskq_create+0xfb/0x1d0 [ 249.612456][ T7996] vmalloc_user_noprof+0x9e/0xe0 [ 249.612490][ T7996] ? xskq_create+0xfb/0x1d0 [ 249.612512][ T7996] xskq_create+0xfb/0x1d0 [ 249.612532][ T7996] xsk_setsockopt+0x743/0xab0 [ 249.612548][ T7996] ? __pfx_aa_sk_perm+0x10/0x10 [ 249.612577][ T7996] ? __pfx_xsk_setsockopt+0x10/0x10 [ 249.612598][ T7996] ? find_held_lock+0x2b/0x80 [ 249.612624][ T7996] ? aa_sock_opt_perm+0xfe/0x1b0 [ 249.612647][ T7996] ? __pfx_xsk_setsockopt+0x10/0x10 [ 249.612670][ T7996] do_sock_setsockopt+0xf3/0x1d0 [ 249.612702][ T7996] __sys_setsockopt+0x119/0x190 [ 249.612732][ T7996] __ia32_sys_setsockopt+0xbc/0x160 [ 249.612754][ T7996] ? __do_fast_syscall_32+0x98/0x970 [ 249.612780][ T7996] ? lockdep_hardirqs_on+0x78/0x100 [ 249.612799][ T7996] __do_fast_syscall_32+0xe7/0x970 [ 249.612827][ T7996] do_fast_syscall_32+0x32/0x70 [ 249.612853][ T7996] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 249.612879][ T7996] RIP: 0023:0xf7f73fec [ 249.612905][ T7996] Code: Unable to access opcode bytes at 0xf7f73fc2. [ 249.612913][ T7996] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 249.612933][ T7996] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000000011b [ 249.612944][ T7996] RDX: 0000000000000006 RSI: 0000000080000000 RDI: 0000000000000004 [ 249.612953][ T7996] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 249.612962][ T7996] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 249.612971][ T7996] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 249.612992][ T7996] [ 249.613050][ T7996] Mem-Info: [ 249.728519][ T7996] active_anon:22325 inactive_anon:294 isolated_anon:0 [ 249.728519][ T7996] active_file:8571 inactive_file:29072 isolated_file:0 [ 249.728519][ T7996] unevictable:1768 dirty:328 writeback:0 [ 249.728519][ T7996] slab_reclaimable:7186 slab_unreclaimable:55501 [ 249.728519][ T7996] mapped:27267 shmem:18776 pagetables:1045 [ 249.728519][ T7996] sec_pagetables:305 bounce:0 [ 249.728519][ T7996] kernel_misc_reclaimable:0 [ 249.728519][ T7996] free:33974 free_pcp:17834 free_cma:0 [ 249.747017][ T7996] Node 0 active_anon:3512kB inactive_anon:20kB active_file:4kB inactive_file:4kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:8kB writeback:0kB shmem:7036kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8800kB pagetables:1272kB sec_pagetables:1152kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 249.760601][ T7996] Node 1 active_anon:85988kB inactive_anon:1156kB active_file:34280kB inactive_file:116284kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:109040kB dirty:1304kB writeback:0kB shmem:68068kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:4972kB pagetables:2908kB sec_pagetables:68kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 249.779300][ T7996] Node 0 DMA free:1704kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:720kB local_pcp:220kB free_cma:0kB [ 249.797193][ T7996] lowmem_reserve[]: 0 280 280 280 280 [ 249.800281][ T7996] Node 0 DMA32 free:16688kB boost:4096kB min:16868kB low:20060kB high:23252kB reserved_highatomic:2048KB free_highatomic:416KB active_anon:3512kB inactive_anon:20kB active_file:4kB inactive_file:4kB unevictable:3536kB writepending:8kB zspages:0kB present:1032196kB managed:286904kB mlocked:0kB bounce:0kB free_pcp:14692kB local_pcp:3556kB free_cma:0kB [ 249.813716][ T7996] lowmem_reserve[]: 0 0 0 0 0 [ 249.820750][ T7996] Node 1 DMA32 free:117596kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:85800kB inactive_anon:1156kB active_file:34280kB inactive_file:116284kB unevictable:3536kB writepending:1404kB zspages:2400kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:55952kB local_pcp:16104kB free_cma:0kB [ 249.835920][ T7996] lowmem_reserve[]: 0 0 0 0 0 [ 249.837956][ T7996] Node 0 DMA: 28*4kB (UM) 5*8kB (UM) 3*16kB (M) 5*32kB (UM) 3*64kB (UM) 1*128kB (M) 0*256kB 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 1704kB [ 249.843811][ T7996] Node 0 DMA32: 2*4kB (E) 33*8kB (UME) 48*16kB (UME) 127*32kB (UMEH) 39*64kB (UMEH) 11*128kB (UM) 6*256kB (ME) 6*512kB (M) 3*1024kB (M) 0*2048kB 0*4096kB = 16688kB [ 249.854165][ T7996] Node 1 DMA32: 12*4kB (UME) 14*8kB (UM) 12*16kB (UME) 43*32kB (E) 298*64kB (UME) 124*128kB (UME) 54*256kB (UME) 47*512kB (UME) 18*1024kB (UM) 8*2048kB (UM) 2*4096kB (UM) = 117568kB [ 249.871329][ T7996] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 249.878769][ T7996] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 249.884482][ T7996] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 249.892741][ T7996] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 249.899220][ T7996] 57559 total pagecache pages [ 249.901210][ T7996] 924 pages in swap cache [ 249.905333][ T7996] Free swap = 118328kB [ 249.909931][ T7996] Total swap = 124996kB [ 249.911759][ T7996] 524155 pages RAM [ 249.913332][ T7996] 0 pages HighMem/MovableOnly [ 249.915288][ T7996] 211536 pages reserved [ 249.917390][ T7996] 0 pages cma reserved [ 250.237605][ T10] usb 8-1: new full-speed USB device number 7 using dummy_hcd [ 250.310244][ T54] usb 6-1: USB disconnect, device number 7 [ 250.387398][ T10] usb 8-1: config 0 has an invalid interface number: 205 but max is 0 [ 250.391121][ T10] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 250.395618][ T10] usb 8-1: config 0 has no interface number 0 [ 250.398330][ T10] usb 8-1: config 0 interface 205 has no altsetting 0 [ 250.403623][ T10] usb 8-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 250.407990][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 250.411512][ T10] usb 8-1: Product: syz [ 250.413406][ T10] usb 8-1: Manufacturer: syz [ 250.415380][ T10] usb 8-1: SerialNumber: syz [ 250.422728][ T10] usb 8-1: config 0 descriptor?? [ 250.432714][ T10] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 250.439069][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 250.461624][ T10] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 250.469750][ T10] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 250.475590][ T10] usb 8-1: media controller created [ 250.480816][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 250.494367][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 250.496916][ T10] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 250.504701][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb8/8-1/input/input14 [ 250.520709][ T10] dvb-usb: schedule remote query interval to 150 msecs. [ 250.526270][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 250.555605][ T10] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 250.685629][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 250.689375][ T10] dvb-usb: error while querying for an remote control event. [ 250.855546][ T5829] dvb-usb: bulk message failed: -22 (1/0) [ 250.858379][ T5829] dvb-usb: error while querying for an remote control event. [ 251.025772][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 251.027731][ T10] dvb-usb: error while querying for an remote control event. [ 251.185966][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 251.188511][ T10] dvb-usb: error while querying for an remote control event. [ 251.346229][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 251.348520][ T10] dvb-usb: error while querying for an remote control event. [ 251.516717][ T5829] dvb-usb: bulk message failed: -22 (1/0) [ 251.519460][ T5829] dvb-usb: error while querying for an remote control event. [ 251.679303][ T5829] dvb-usb: bulk message failed: -22 (1/0) [ 251.681335][ T5829] dvb-usb: error while querying for an remote control event. [ 252.057272][ T5829] dvb-usb: bulk message failed: -22 (1/0) [ 252.059650][ T5829] dvb-usb: error while querying for an remote control event. [ 252.216240][ T5829] dvb-usb: bulk message failed: -22 (1/0) [ 252.218847][ T5829] dvb-usb: error while querying for an remote control event. [ 252.220776][ T8024] fuse: Bad value for 'fd' [ 252.385596][ T5829] dvb-usb: bulk message failed: -22 (1/0) [ 252.390238][ T5829] dvb-usb: error while querying for an remote control event. [ 252.954425][ T5829] dvb-usb: bulk message failed: -22 (1/0) [ 253.003096][ T5829] dvb-usb: error while querying for an remote control event. [ 253.014275][ T5837] usb 8-1: USB disconnect, device number 7 [ 253.086125][ T5837] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 253.912175][ T8043] batman_adv: batadv0: Adding interface: macvtap1 [ 253.914908][ T8043] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 253.928164][ T8043] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 254.134662][ T8043] batman_adv: batadv0: Removing interface: macvtap1 [ 254.586368][ T978] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 254.877015][ T5756] Bluetooth: hci1: unexpected event for opcode 0x4ad0 [ 255.207189][ T8069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.428'. [ 255.342538][ T8067] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 255.344592][ T8067] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 255.467049][ T8067] vhci_hcd vhci_hcd.0: Device attached [ 255.786089][ T5837] usb 40-1: SetAddress Request (10) to port 0 [ 255.786512][ T5837] usb 40-1: new SuperSpeed USB device number 10 using vhci_hcd [ 256.163444][ T8067] wg2 speed is unknown, defaulting to 1000 [ 256.405625][ T848] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 256.570454][ T978] IPVS: starting estimator thread 0... [ 256.573572][ T8067] wg2 speed is unknown, defaulting to 1000 [ 256.575980][ T848] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 256.580815][ T848] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 256.583767][ T848] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 256.587345][ T848] usb 5-1: config 0 interface 0 has no altsetting 0 [ 256.590385][ T848] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 256.593407][ T848] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 256.597308][ T848] usb 5-1: config 0 interface 0 has no altsetting 0 [ 256.600539][ T848] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 256.603375][ T8067] wg2 speed is unknown, defaulting to 1000 [ 256.605615][ T848] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 256.612838][ T848] usb 5-1: config 0 interface 0 has no altsetting 0 [ 256.618053][ T848] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 256.622977][ T848] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 256.631749][ T848] usb 5-1: config 0 interface 0 has no altsetting 0 [ 256.636183][ T848] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 256.639194][ T848] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 256.644052][ T848] usb 5-1: config 0 interface 0 has no altsetting 0 [ 256.647858][ T848] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 256.650853][ T848] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 256.654412][ T848] usb 5-1: config 0 interface 0 has no altsetting 0 [ 256.656651][ T8082] IPVS: using max 44 ests per chain, 105600 per kthread [ 256.660734][ T848] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 256.663674][ T848] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 256.667279][ T848] usb 5-1: config 0 interface 0 has no altsetting 0 [ 256.670511][ T848] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 256.673520][ T848] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 256.676971][ T848] usb 5-1: config 0 interface 0 has no altsetting 0 [ 256.680667][ T848] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 256.683755][ T848] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 256.686686][ T848] usb 5-1: Product: syz [ 256.688008][ T848] usb 5-1: Manufacturer: syz [ 256.689597][ T848] usb 5-1: SerialNumber: syz [ 256.693064][ T848] usb 5-1: config 0 descriptor?? [ 256.698367][ T848] yurex 5-1:0.0: USB YUREX device now attached to Yurex #0 [ 257.013062][ T8086] Invalid ELF header magic: != ELF [ 257.069322][ T8086] overlayfs: overlapping lowerdir path [ 257.089083][ T8075] erspan0: left promiscuous mode [ 257.235707][ T8068] vhci_hcd: connection reset by peer [ 257.238902][ T5801] vhci_hcd vhci_hcd.1: stop threads [ 257.244092][ T5829] usb 5-1: USB disconnect, device number 9 [ 257.247610][ T5801] vhci_hcd vhci_hcd.1: release socket [ 257.252726][ T5829] yurex 5-1:0.0: USB YUREX #0 now disconnected [ 257.259075][ T5801] vhci_hcd vhci_hcd.1: disconnect device [ 257.271374][ T8075] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 257.285242][ T8075] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 257.354223][ T8067] infiniband syz2: set active [ 257.359561][ T8067] infiniband syz2: added wg2 [ 257.405078][ T8067] smbdirect: ib_dev[syz2]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 257.412717][ T8067] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 257.418625][ T8067] smbdirect: ib_dev[syz2]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 257.423427][ T29] wg2 speed is unknown, defaulting to 1000 [ 257.426472][ T5801] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.430682][ T5801] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.434520][ T5801] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.441065][ T5801] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.561656][ T8067] RDS/IB: syz2: added [ 257.563912][ T8067] smc: adding ib device syz2 with port count 1 [ 257.566249][ T8067] smc: ib device syz2 port 1 has no pnetid [ 257.571830][ T29] wg2 speed is unknown, defaulting to 1000 [ 257.579885][ T8067] wg2 speed is unknown, defaulting to 1000 [ 257.948264][ T8095] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.433'. [ 257.948460][ T8067] wg2 speed is unknown, defaulting to 1000 [ 257.954459][ T8095] openvswitch: netlink: Message has 512 unknown bytes. [ 258.185027][ T8067] wg2 speed is unknown, defaulting to 1000 [ 258.714482][ T8095] wg2 speed is unknown, defaulting to 1000 [ 259.057458][ T8117] netlink: 8 bytes leftover after parsing attributes in process `syz.3.438'. [ 259.316878][ T8067] wg2 speed is unknown, defaulting to 1000 [ 259.688809][ T42] audit: type=1326 audit(1785496134.985:520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8119 comm="syz.0.439" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 259.697332][ T42] audit: type=1326 audit(1785496134.995:521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8119 comm="syz.0.439" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 259.707797][ T42] audit: type=1326 audit(1785496134.995:522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8119 comm="syz.0.439" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 259.717013][ T42] audit: type=1326 audit(1785496135.005:523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8119 comm="syz.0.439" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 259.727553][ T42] audit: type=1326 audit(1785496135.005:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8119 comm="syz.0.439" exe="/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 260.306797][ T42] audit: type=1326 audit(1785496135.605:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8119 comm="syz.0.439" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 260.347698][ T42] audit: type=1326 audit(1785496135.605:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8119 comm="syz.0.439" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 260.399836][ T42] audit: type=1326 audit(1785496135.695:527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8119 comm="syz.0.439" exe="/syz-executor" sig=0 arch=40000003 syscall=345 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 260.468544][ T42] audit: type=1326 audit(1785496135.765:528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8119 comm="syz.0.439" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 260.481342][ T42] audit: type=1326 audit(1785496135.765:529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8119 comm="syz.0.439" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 260.657772][ T8149] fuse: Bad value for 'fd' [ 261.001771][ T5837] usb 40-1: device descriptor read/8, error -110 [ 261.780755][ T5837] usb usb40-port1: attempt power cycle [ 262.357114][ T5837] usb usb40-port1: unable to enumerate USB device [ 263.558156][ T8184] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 263.560468][ T8184] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 263.563918][ T8184] vhci_hcd vhci_hcd.0: Device attached [ 263.885687][ T5837] usb 38-1: SetAddress Request (10) to port 0 [ 263.905002][ T5837] usb 38-1: new SuperSpeed USB device number 10 using vhci_hcd [ 263.927860][ T8184] rdma_rxe: rxe_newlink: failed to add wg2 [ 264.284742][ T8185] vhci_hcd: connection reset by peer [ 264.293224][ T5801] vhci_hcd vhci_hcd.0: stop threads [ 264.294906][ T5801] vhci_hcd vhci_hcd.0: release socket [ 264.296808][ T5801] vhci_hcd vhci_hcd.0: disconnect device [ 267.009445][ T1442] ieee802154 phy0 wpan0: encryption failed: -22 [ 267.011474][ T1442] ieee802154 phy1 wpan1: encryption failed: -22 [ 267.266713][ T8245] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 267.266713][ T8245] Please contact the netfilter-devel mailing list or update your nftables rules. [ 267.662032][ T8250] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 267.664460][ T8250] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 267.675725][ T8250] vhci_hcd vhci_hcd.0: Device attached [ 267.847209][ T8250] rdma_rxe: rxe_newlink: failed to add wg2 [ 267.995540][ T4258] usb 44-1: SetAddress Request (18) to port 0 [ 267.997747][ T4258] usb 44-1: new SuperSpeed USB device number 18 using vhci_hcd [ 268.207318][ T8251] vhci_hcd: connection reset by peer [ 268.210698][ T12] vhci_hcd vhci_hcd.3: stop threads [ 268.212410][ T12] vhci_hcd vhci_hcd.3: release socket [ 268.216748][ T12] vhci_hcd vhci_hcd.3: disconnect device [ 269.106572][ T5837] usb 38-1: device descriptor read/8, error -110 [ 269.243060][ T8278] Invalid ELF header magic: != ELF [ 269.258030][ T8278] overlayfs: failed to clone lowerpath [ 269.498971][ T5837] usb usb38-port1: attempt power cycle [ 269.647124][ T8279] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.475'. [ 269.650088][ T8279] openvswitch: netlink: Message has 512 unknown bytes. [ 269.673961][ T8279] wg2 speed is unknown, defaulting to 1000 [ 270.086126][ T5837] usb usb38-port1: unable to enumerate USB device [ 270.489260][ T8298] ufs: You didn't specify the type of your ufs filesystem [ 270.489260][ T8298] [ 270.489260][ T8298] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 270.489260][ T8298] [ 270.489260][ T8298] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 270.513045][ T8298] ufs: failed to set blocksize [ 272.100108][ T8321] netlink: 12 bytes leftover after parsing attributes in process `syz.1.491'. [ 273.183508][ T4258] usb 44-1: device descriptor read/8, error -110 [ 273.487913][ T8346] netlink: 60 bytes leftover after parsing attributes in process `syz.2.496'. [ 273.491735][ T8346] bridge0: port 2(bridge_slave_1) entered disabled state [ 273.495312][ T8346] bridge0: port 1(bridge_slave_0) entered disabled state [ 273.656131][ T4258] usb usb44-port1: attempt power cycle [ 273.965618][ T54] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 274.137620][ T54] usb 5-1: config 0 has an invalid interface number: 205 but max is 0 [ 274.141085][ T54] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 274.145271][ T54] usb 5-1: config 0 has no interface number 0 [ 274.152082][ T54] usb 5-1: config 0 interface 205 has no altsetting 0 [ 274.304690][ T4258] usb usb44-port1: unable to enumerate USB device [ 274.582477][ T54] usb 5-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 274.586341][ T54] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 274.589539][ T54] usb 5-1: Product: syz [ 274.591318][ T54] usb 5-1: Manufacturer: syz [ 274.593314][ T54] usb 5-1: SerialNumber: syz [ 274.597647][ T54] usb 5-1: config 0 descriptor?? [ 274.606692][ T54] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 274.610295][ T54] dvb-usb: bulk message failed: -22 (3/0) [ 274.627352][ T54] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 274.630596][ T54] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 274.634216][ T54] usb 5-1: media controller created [ 274.637071][ T54] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 274.642010][ T54] dvb-usb: bulk message failed: -22 (6/0) [ 274.643968][ T54] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 274.649457][ T54] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb5/5-1/input/input17 [ 274.655901][ T54] dvb-usb: schedule remote query interval to 150 msecs. [ 274.658157][ T54] dvb-usb: bulk message failed: -22 (3/0) [ 274.675500][ T54] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 274.825494][ T54] dvb-usb: bulk message failed: -22 (1/0) [ 274.827895][ T54] dvb-usb: error while querying for an remote control event. [ 274.985484][ T54] dvb-usb: bulk message failed: -22 (1/0) [ 274.987861][ T54] dvb-usb: error while querying for an remote control event. [ 275.145569][ T54] dvb-usb: bulk message failed: -22 (1/0) [ 275.147873][ T54] dvb-usb: error while querying for an remote control event. [ 275.502392][ T54] dvb-usb: bulk message failed: -22 (1/0) [ 275.507093][ T54] dvb-usb: error while querying for an remote control event. [ 275.685490][ T54] dvb-usb: bulk message failed: -22 (1/0) [ 275.969116][ T54] dvb-usb: error while querying for an remote control event. [ 276.152578][ T8378] bridge_slave_0: left allmulticast mode [ 276.160967][ T8378] bridge_slave_0: left promiscuous mode [ 276.168371][ T8378] bridge0: port 1(bridge_slave_0) entered disabled state [ 276.225779][ T8378] bridge_slave_1: left allmulticast mode [ 276.239172][ T8378] bridge_slave_1: left promiscuous mode [ 276.255214][ T8378] bridge0: port 2(bridge_slave_1) entered disabled state [ 276.349463][ T8378] team0: Port device team_slave_0 removed [ 276.362550][ T8378] team0: Port device team_slave_1 removed [ 276.366306][ T8378] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 276.368762][ T8378] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 276.372612][ T8378] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 276.375054][ T8378] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 276.380946][ T8378] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 276.388920][ T4258] wg2 speed is unknown, defaulting to 1000 [ 276.409108][ T24] usb 5-1: USB disconnect, device number 10 [ 276.587717][ T24] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 277.035558][ T978] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 277.486708][ T978] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 277.491116][ T978] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 277.494225][ T978] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 277.498771][ T978] usb 8-1: config 0 interface 0 has no altsetting 0 [ 277.502978][ T978] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 277.507274][ T978] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 277.511999][ T978] usb 8-1: config 0 interface 0 has no altsetting 0 [ 277.520869][ T978] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 277.524775][ T978] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 277.545871][ T978] usb 8-1: config 0 interface 0 has no altsetting 0 [ 277.554247][ T978] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 277.563983][ T978] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 277.568885][ T978] usb 8-1: config 0 interface 0 has no altsetting 0 [ 277.572832][ T978] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 277.576872][ T978] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 277.581314][ T978] usb 8-1: config 0 interface 0 has no altsetting 0 [ 277.587755][ T978] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 277.591500][ T978] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 277.596059][ T978] usb 8-1: config 0 interface 0 has no altsetting 0 [ 277.600139][ T978] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 277.603862][ T978] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 277.610961][ T978] usb 8-1: config 0 interface 0 has no altsetting 0 [ 277.614810][ T978] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 277.618701][ T978] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 277.623193][ T978] usb 8-1: config 0 interface 0 has no altsetting 0 [ 277.627893][ T978] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 277.631815][ T978] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 277.635300][ T978] usb 8-1: Product: syz [ 277.637192][ T978] usb 8-1: Manufacturer: syz [ 277.639099][ T978] usb 8-1: SerialNumber: syz [ 277.643233][ T978] usb 8-1: config 0 descriptor?? [ 277.654819][ T978] yurex 8-1:0.0: USB YUREX device now attached to Yurex #0 [ 277.755480][ T54] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 277.886631][ T8388] bridge0: port 2(bridge_slave_1) entered disabled state [ 277.889473][ T8388] bridge0: port 1(bridge_slave_0) entered disabled state [ 277.905530][ T54] usb 5-1: Using ep0 maxpacket: 8 [ 277.909927][ T54] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 277.912877][ T54] usb 5-1: config 179 has no interface number 0 [ 277.915517][ T54] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 277.918974][ T54] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 277.922447][ T54] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 277.925964][ T54] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 277.929564][ T54] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 277.933636][ T54] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 277.937632][ T54] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 277.942046][ T8394] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 277.961566][ T8388] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 277.968654][ T8388] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 278.056398][ T8388] geneve2: left allmulticast mode [ 278.075616][ T12] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 278.078509][ T12] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 278.081752][ T12] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 278.085552][ T12] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 278.099473][ T54] usb 8-1: USB disconnect, device number 8 [ 278.107390][ T54] yurex 8-1:0.0: USB YUREX #0 now disconnected [ 278.357223][ T8394] syzkaller1: entered promiscuous mode [ 278.359235][ T8394] syzkaller1: entered allmulticast mode [ 278.380728][ T8394] wg2 speed is unknown, defaulting to 1000 [ 278.638731][ T10] usb 5-1: USB disconnect, device number 11 [ 278.638753][ C3] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 279.774187][ T8419] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.511'. [ 279.778236][ T8419] openvswitch: netlink: Message has 512 unknown bytes. [ 279.903762][ T8419] wg2 speed is unknown, defaulting to 1000 [ 282.046937][ T8449] netlink: 'syz.2.520': attribute type 1 has an invalid length. [ 282.077232][ T8449] netlink: 'syz.2.520': attribute type 2 has an invalid length. [ 282.112474][ T8453] netlink: 12 bytes leftover after parsing attributes in process `syz.3.521'. [ 282.719874][ T42] audit: type=1800 audit(1785496157.010:530): pid=8482 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.524" name="file0" dev="overlay" ino=729 res=0 errno=0 [ 282.773898][ T8482] uhci_hcd 0000:00:1d.0: remove, state 4 [ 282.776001][ T8482] usb usb2: USB disconnect, device number 1 [ 282.797107][ T8482] uhci_hcd 0000:00:1d.0: USB bus 2 deregistered [ 282.836840][ T8485] netlink: 60 bytes leftover after parsing attributes in process `syz.1.525'. [ 282.886785][ T8486] pci 0000:00:1d.0: [8086:2934] type 00 class 0x0c0300 conventional PCI endpoint [ 282.894193][ T8486] pci 0000:00:1d.0: BAR 4 [io 0x2000-0x201f] [ 282.912963][ T8486] pci 0000:00:1d.0: Adding to iommu group 7 [ 282.924826][ T8486] pci 0000:00:1d.0: BAR 4 [io 0x2000-0x201f]: assigned [ 282.992442][ T8486] pci 0000:00:1d.0: quirk_usb_early_handoff+0x0/0x1360 took 61745 usecs [ 283.029598][ T8486] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 283.041830][ T8486] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 2 [ 283.044691][ T8486] uhci_hcd 0000:00:1d.0: detected 2 ports [ 283.051193][ T8486] uhci_hcd 0000:00:1d.0: irq 16, io port 0x00002000 [ 283.054717][ T8486] usb usb2: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 283.057839][ T8486] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 283.060395][ T8486] usb usb2: Product: UHCI Host Controller [ 283.062224][ T8486] usb usb2: Manufacturer: Linux syzkaller uhci_hcd [ 283.064339][ T8486] usb usb2: SerialNumber: 0000:00:1d.0 [ 283.077690][ T8486] hub 2-0:1.0: USB hub found [ 283.079676][ T8486] hub 2-0:1.0: 2 ports detected [ 286.342810][ T8520] netlink: 12 bytes leftover after parsing attributes in process `syz.2.533'. [ 286.351269][ T8518] e1000e 0000:00:02.0 eth1: removed PHC [ 286.467555][ T8518] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 286.945693][ T5756] Bluetooth: hci2: unexpected event for opcode 0x201c [ 287.192386][ T8548] x_tables: duplicate underflow at hook 1 [ 287.271713][ T8548] hub 8-0:1.0: USB hub found [ 287.277315][ T8548] hub 8-0:1.0: 1 port detected [ 287.667241][ T8561] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 287.672557][ T8561] overlayfs: failed to set xattr on upper [ 287.678303][ T8561] overlayfs: ...falling back to redirect_dir=nofollow. [ 287.680911][ T8561] overlayfs: ...falling back to index=off. [ 287.684281][ T8561] overlayfs: ...falling back to uuid=null. [ 287.724923][ T8561] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 289.881015][ T8607] smc: removing ib device syz2 [ 289.898860][ T8607] smbdirect: ib_dev[syz2] removed [ 290.349375][ T8607] ------------[ cut here ]------------ [ 290.351139][ T8607] !xa_empty(&pool->xa) [ 290.351148][ T8607] WARNING: drivers/infiniband/sw/rxe/rxe_pool.c:116 at rxe_pool_cleanup+0x46/0x60, CPU#3: syz.0.546/8607 [ 290.368380][ T8607] Modules linked in: [ 290.369828][ T8607] CPU: 3 UID: 0 PID: 8607 Comm: syz.0.546 Not tainted syzkaller #0 PREEMPT(full) [ 290.375991][ T8607] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 290.379134][ T8607] RIP: 0010:rxe_pool_cleanup+0x46/0x60 [ 290.380849][ T8607] Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 29 48 83 bb 80 00 00 00 00 75 0b e8 16 aa 27 f9 5b c3 cc cc cc cc e8 0b aa 27 f9 90 <0f> 0b 90 e8 02 aa 27 f9 5b c3 cc cc cc cc e8 37 38 97 f9 eb d0 0f [ 290.396923][ T8607] RSP: 0000:ffffc90003c2f170 EFLAGS: 00010246 [ 290.408472][ T8607] RAX: 0000000000080000 RBX: ffff88804b7f1398 RCX: ffffc90007972000 [ 290.410887][ T8607] RDX: 0000000000080000 RSI: ffffffff88e203f5 RDI: ffff88804b7f1418 [ 290.416675][ T8607] RBP: ffffffff88e05e20 R08: 0000000000000005 R09: 0000000000000001 [ 290.425661][ T8607] R10: 0000000000000002 R11: 0000000000000000 R12: ffff88804b7f0698 [ 290.428063][ T8607] R13: ffff88804b7effe0 R14: ffff88804b7effe0 R15: ffff88804b7f10f8 [ 290.437053][ T8607] FS: 0000000000000000(0000) GS:ffff888096ee1000(0063) knlGS:00000000f53cdb40 [ 290.439806][ T8607] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 290.441824][ T8607] CR2: 0000000080054018 CR3: 00000000495d6000 CR4: 0000000000352ef0 [ 290.444275][ T8607] Call Trace: [ 290.445305][ T8607] [ 290.449554][ T8607] rxe_dealloc+0x25/0xc0 [ 290.450926][ T8607] ib_dealloc_device+0x49/0x230 [ 290.452501][ T8607] __ib_unregister_device+0x396/0x480 [ 290.457448][ T8607] ? __pfx_rxe_ns_pernet_set_sk6+0x10/0x10 [ 290.459283][ T8607] ib_unregister_device_and_put+0x5a/0x80 [ 290.461087][ T8607] nldev_dellink+0x308/0x430 [ 290.462587][ T8607] ? __pfx_nldev_dellink+0x10/0x10 [ 290.464216][ T8607] ? rcu_is_watching+0x12/0xc0 [ 290.467699][ T8607] ? apparmor_capable+0x1d7/0x4d0 [ 290.469316][ T8607] ? bpf_lsm_capable+0x9/0x10 [ 290.470863][ T8607] ? security_capable+0x80/0x260 [ 290.472467][ T8607] ? ns_capable+0xd2/0xf0 [ 290.473831][ T8607] ? __pfx_nldev_dellink+0x10/0x10 [ 290.475508][ T8607] rdma_nl_rcv_msg+0x392/0x6f0 [ 290.477038][ T8607] ? __pfx_rdma_nl_rcv_msg+0x10/0x10 [ 290.478723][ T8607] ? __lock_acquire+0x49f/0x1a40 [ 290.480251][ T8607] rdma_nl_rcv_skb.constprop.0.isra.0+0x2cb/0x410 [ 290.482286][ T8607] ? __pfx_rdma_nl_rcv_skb.constprop.0.isra.0+0x10/0x10 [ 290.484420][ T8607] ? netlink_deliver_tap+0x1ae/0xcc0 [ 290.486063][ T8607] netlink_unicast+0x585/0x850 [ 290.487638][ T8607] ? __pfx_netlink_unicast+0x10/0x10 [ 290.489296][ T8607] netlink_sendmsg+0x8b0/0xda0 [ 290.490813][ T8607] ? __pfx_netlink_sendmsg+0x10/0x10 [ 290.492492][ T8607] ? apparmor_socket_sendmsg+0x15b/0x270 [ 290.494219][ T8607] ____sys_sendmsg+0xa4d/0xbe0 [ 290.495765][ T8607] ? __pfx_netlink_sendmsg+0x10/0x10 [ 290.497448][ T8607] ? __pfx_____sys_sendmsg+0x10/0x10 [ 290.499087][ T8607] ___sys_sendmsg+0x190/0x1e0 [ 290.500624][ T8607] ? __pfx____sys_sendmsg+0x10/0x10 [ 290.502257][ T8607] ? futex_wait+0x11e/0x370 [ 290.503766][ T8607] ? find_held_lock+0x2b/0x80 [ 290.505272][ T8607] __sys_sendmsg+0x160/0x210 [ 290.506772][ T8607] ? __pfx___sys_sendmsg+0x10/0x10 [ 290.508411][ T8607] __do_fast_syscall_32+0xe7/0x970 [ 290.510029][ T8607] ? lockdep_hardirqs_on+0x78/0x100 [ 290.511661][ T8607] do_fast_syscall_32+0x32/0x70 [ 290.513238][ T8607] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 290.515187][ T8607] RIP: 0023:0xf6fdefec [ 290.516428][ T8607] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 290.518406][ T8607] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 290.521195][ T8607] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00000000800002c0 [ 290.523663][ T8607] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 290.526213][ T8607] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 290.528702][ T8607] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 290.531134][ T8607] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 290.533627][ T8607] [ 290.534620][ T8607] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 290.536898][ T8607] CPU: 3 UID: 0 PID: 8607 Comm: syz.0.546 Not tainted syzkaller #0 PREEMPT(full) [ 290.539745][ T8607] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 290.542616][ T8607] Call Trace: [ 290.543683][ T8607] [ 290.544637][ T8607] dump_stack_lvl+0x100/0x190 [ 290.546130][ T8607] vpanic+0x552/0x970 [ 290.547401][ T8607] ? __pfx_vpanic+0x10/0x10 [ 290.548871][ T8607] panic+0xd1/0xe0 [ 290.550073][ T8607] ? __pfx_panic+0x10/0x10 [ 290.551490][ T8607] check_panic_on_warn.cold+0x19/0x34 [ 290.553212][ T8607] ? rxe_pool_cleanup+0x46/0x60 [ 290.554816][ T8607] __warn.cold+0x191/0x318 [ 290.556247][ T8607] __report_bug+0x30f/0x440 [ 290.557712][ T8607] ? rxe_pool_cleanup+0x46/0x60 [ 290.559248][ T8607] ? __pfx___report_bug+0x10/0x10 [ 290.560842][ T8607] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 290.562698][ T8607] ? flush_workqueue_prep_pwqs+0x2e9/0x510 [ 290.564557][ T8607] ? __flush_workqueue+0x426/0x1200 [ 290.566186][ T8607] ? rxe_pool_cleanup+0x46/0x60 [ 290.567737][ T8607] report_bug+0xb2/0x220 [ 290.569080][ T8607] ? rxe_pool_cleanup+0x46/0x60 [ 290.570591][ T8607] handle_bug+0x16a/0x2a0 [ 290.571959][ T8607] exc_invalid_op+0x17/0x50 [ 290.573425][ T8607] asm_exc_invalid_op+0x1a/0x20 [ 290.574954][ T8607] RIP: 0010:rxe_pool_cleanup+0x46/0x60 [ 290.576672][ T8607] Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 29 48 83 bb 80 00 00 00 00 75 0b e8 16 aa 27 f9 5b c3 cc cc cc cc e8 0b aa 27 f9 90 <0f> 0b 90 e8 02 aa 27 f9 5b c3 cc cc cc cc e8 37 38 97 f9 eb d0 0f [ 290.582643][ T8607] RSP: 0000:ffffc90003c2f170 EFLAGS: 00010246 [ 290.584539][ T8607] RAX: 0000000000080000 RBX: ffff88804b7f1398 RCX: ffffc90007972000 [ 290.586986][ T8607] RDX: 0000000000080000 RSI: ffffffff88e203f5 RDI: ffff88804b7f1418 [ 290.589464][ T8607] RBP: ffffffff88e05e20 R08: 0000000000000005 R09: 0000000000000001 [ 290.591941][ T8607] R10: 0000000000000002 R11: 0000000000000000 R12: ffff88804b7f0698 [ 290.594438][ T8607] R13: ffff88804b7effe0 R14: ffff88804b7effe0 R15: ffff88804b7f10f8 [ 290.596898][ T8607] ? __pfx_rxe_dealloc+0x10/0x10 [ 290.598471][ T8607] ? rxe_pool_cleanup+0x45/0x60 [ 290.600008][ T8607] rxe_dealloc+0x25/0xc0 [ 290.601422][ T8607] ib_dealloc_device+0x49/0x230 [ 290.602998][ T8607] __ib_unregister_device+0x396/0x480 [ 290.604693][ T8607] ? __pfx_rxe_ns_pernet_set_sk6+0x10/0x10 [ 290.606526][ T8607] ib_unregister_device_and_put+0x5a/0x80 [ 290.608338][ T8607] nldev_dellink+0x308/0x430 [ 290.609652][ T8607] ? __pfx_nldev_dellink+0x10/0x10 [ 290.611223][ T8607] ? rcu_is_watching+0x12/0xc0 [ 290.612774][ T8607] ? apparmor_capable+0x1d7/0x4d0 [ 290.614371][ T8607] ? bpf_lsm_capable+0x9/0x10 [ 290.615869][ T8607] ? security_capable+0x80/0x260 [ 290.617655][ T8607] ? ns_capable+0xd2/0xf0 [ 290.619351][ T8607] ? __pfx_nldev_dellink+0x10/0x10 [ 290.621361][ T8607] rdma_nl_rcv_msg+0x392/0x6f0 [ 290.623273][ T8607] ? __pfx_rdma_nl_rcv_msg+0x10/0x10 [ 290.625349][ T8607] ? __lock_acquire+0x49f/0x1a40 [ 290.627296][ T8607] rdma_nl_rcv_skb.constprop.0.isra.0+0x2cb/0x410 [ 290.629808][ T8607] ? __pfx_rdma_nl_rcv_skb.constprop.0.isra.0+0x10/0x10 [ 290.632536][ T8607] ? netlink_deliver_tap+0x1ae/0xcc0 [ 290.634587][ T8607] netlink_unicast+0x585/0x850 [ 290.636469][ T8607] ? __pfx_netlink_unicast+0x10/0x10 [ 290.638366][ T8607] netlink_sendmsg+0x8b0/0xda0 [ 290.639902][ T8607] ? __pfx_netlink_sendmsg+0x10/0x10 [ 290.641573][ T8607] ? apparmor_socket_sendmsg+0x15b/0x270 [ 290.643368][ T8607] ____sys_sendmsg+0xa4d/0xbe0 [ 290.644897][ T8607] ? __pfx_netlink_sendmsg+0x10/0x10 [ 290.646564][ T8607] ? __pfx_____sys_sendmsg+0x10/0x10 [ 290.648273][ T8607] ___sys_sendmsg+0x190/0x1e0 [ 290.649755][ T8607] ? __pfx____sys_sendmsg+0x10/0x10 [ 290.651397][ T8607] ? futex_wait+0x11e/0x370 [ 290.652869][ T8607] ? find_held_lock+0x2b/0x80 [ 290.654361][ T8607] __sys_sendmsg+0x160/0x210 [ 290.655819][ T8607] ? __pfx___sys_sendmsg+0x10/0x10 [ 290.657443][ T8607] __do_fast_syscall_32+0xe7/0x970 [ 290.659074][ T8607] ? lockdep_hardirqs_on+0x78/0x100 [ 290.660733][ T8607] do_fast_syscall_32+0x32/0x70 [ 290.662267][ T8607] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 290.664280][ T8607] RIP: 0023:0xf6fdefec [ 290.665571][ T8607] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 290.667642][ T8607] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 290.670347][ T8607] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00000000800002c0 [ 290.672879][ T8607] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 290.675334][ T8607] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 290.677825][ T8607] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 290.680289][ T8607] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 290.682762][ T8607] [ 290.684441][ T8607] Kernel Offset: disabled [ 290.685639][ T8607] Rebooting in 86400 seconds..