last executing test programs: 2.29943518s ago: executing program 0 (id=3755): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1a2) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x100) renameat2(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r0, &(0x7f0000000000)='7', 0x1) getdents(r0, 0x0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'ipvlan0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r4 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r2, {0x0, 0xd}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x24, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0xb}, @TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x1}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x40005}, 0x8010) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) 2.169523815s ago: executing program 0 (id=3757): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000004640), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000004680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000004740)={0x0, 0x0, &(0x7f0000004700)={&(0x7f00000046c0)={0x24, r1, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x8041}, 0x8000) (fail_nth: 4) 2.123885003s ago: executing program 0 (id=3758): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101901, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000000)={0x79, 0x0, 0x602}) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000c80)={0x1, 0x0, [{0x2, 0x2, 0x15bd07bf87c14d67, 0x0, @sint={0xffffffff, 0x4}}]}) (fail_nth: 4) 1.972768082s ago: executing program 0 (id=3759): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x141091, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) (async) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84880) splice(r1, 0x0, r2, 0x0, 0x6, 0xc) r3 = mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x800, 0x0, 0x2010, 0xffffffffffffffff, 0x20000000) (async, rerun: 64) r4 = syz_io_uring_setup(0x26c9, &(0x7f0000000540)={0x0, 0x69ee, 0x2, 0x1, 0x244}, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000180)=0x0) (rerun: 64) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd=r0, 0x8, 0x0, 0x0, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0, 0x4}}) syz_io_uring_setup(0x2037, &(0x7f0000000140)={0x0, 0xf7a, 0x2000, 0x3, 0x1de}, &(0x7f00000000c0), &(0x7f0000000340), &(0x7f0000000380)=0x0) ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, &(0x7f00000007c0)={0x0, 0xffff, 0x0, 0x0, 0x0}) r10 = mmap$IORING_OFF_CQ_RING(0x0, 0x1ff, 0x100000d, 0x1010, r4, 0x8000000) syz_ublk_add_dev(0xffffffffffffffff, 0x0, r10, 0x0, &(0x7f0000000600)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4eff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x2, 0xd79, 0x0, 0x0, 0x1000, 0xffffffff, r9, 0x0, 0x80}}}, &(0x7f0000000680)) sendmmsg$alg(r2, &(0x7f0000002480)=[{0x0, 0x0, &(0x7f0000001a40)=[{&(0x7f0000000840)="988607e7263178d3fbd062fa9e1520f5ec95d1932ae5c2c21711174143859c116b8d3d92128660b07733c9d76010b327218032c2564709371d46076fd2500b10b80d2943bbea00ca4cf6ee6d2330d80895459679551d5afbf1a71e2ce1aaa1b3fff2ff900292c5dc7a89", 0x6a}, {&(0x7f00000008c0)="e0d3c1fafb970202e94f9454dc20986f44d4", 0x12}, {&(0x7f0000000900)="985bd0341409d44455f8ff018ee758ece84138a04c131a97693fa42fdc3d675c88b32ace36dabec14dd6f58c5ee763", 0x2f}, {&(0x7f0000000940)="77f79875b855173b15e6aa142e330801f620f383cc27540923e0b9388ec9766028eb785ba17795d73c4e6161b7507a4eb5d32fbaedad7cb1aa7d2e0bc8ca7a7bc41f706803552d319667bc7f259ce0e20636693c8523cdf2aac62c184ccd43c293ab", 0x62}, {&(0x7f00000009c0)="b5910eec1305e13536a121d912e64bacc1a69b4c9e69d8107c057df43eb5dc1a1b4a617fc11164accc6459d3538a116decb042db2a93bab7c1e618b46a14561155958e00e080d0d7a8aa63fbd40925cb782bff33ee0236e84411f4738910d90bd76313397f9e3fa2c9f40ef4ac276601cb8c8f3c90f8d7b2b798a0532743f6d36d6c1b1904d543eff5e898d702a0e599d0a6856265d03a2af487287f9d71d62bca74f842640293ad679eac6797b4288c0f94287a80111e7ab6ca50cbd7eadb591c0f98b8e14e7b6a69a85b14cdf83abbde0939384ec24992aa7e200d726be9524f7529c5ac12e2bc6f811640d6a6ce4a9ed081ddce1319ca43cbf5cba1e94330b712ef9e49302da0af0c1ba47d6f022c955a4243988fc6b6a09d61f8ca455e07b33875b7e10752183adedf09a5fbec3ac830373f2aadd812bb509f5d55971a7a9e3dc2817d942c40bfa80d4a2d3d1027735033a320d66d65a83cd449bd962137e2ba6e85d0006ec326d6237bd439870dd4afc324eda7c0c0d48b4a55fee345ad083a5edf47a1b1e4dbfa538b53f28fecc2db8f4cf20d6b88856e3eb631fe928db7fd872f0419d02c29858abb447aeb5f6a4f86d81626fc8e446aa096b72b0804aca8046d4ed9f84e13129a84e0e0bf1faf140f9946c9a66753abe1fc61e113d1241dad69148b2aa51b5da8ee444d29ab9f256ab623947553b3d2f80dd94c5e2461d9e56887e3414cd345c215be24b56b85c036d05881bff6171035071cd91179c26c9690a4f9471630ef52342784330c8365e3f3e5edd01c92b6a2fe790dff4167fac69efba9d275f39d56d6c7921c3e4790e888ad96e0f984813bb883ebbbc5b9823d46a8020ba307ca16e72f0943e3dd7d060deea810eac9a3cb6230b154a358352e853651538d242e5f9ee00f50315d4b168873015872cbf4afbd9faa03e48150db70cdc2e51432e96912c057c90bb8b73076313b01143e1ef814cb1e85c3c37e89067755c9c583535e4cbd1d2cd4913be49466268bafe6b365c2c7d6b42d8cca2e146e89b89b50ec82e39c467ae478aa8013394eb61f2d43dc46601b79f31f9767cfb8b641ddf15f398fc201d86db889536679a65ef817241099009a7ed17b1d78171ed3ec299e722402005794ef82fba5e452ed8cf19451fdc49f11d78281ad2a9005c7a9409ea9f679a448579d11e8d895b214741641e869f8c00ac2d450372e31b9db379006a025b92786185120fbc5d5d56eb8ac4168c2e02c8e10f61c5234e81541c04ac8a9ad705e1deb1dd38f7459320f640edec48bb435fa89ee6f20cc941d9f42171ad83fdcfbb0d17735b5f4fc463a288e50073227a8e18eacc5273c0076a0fe28eb629acd4e532b5a7286a276ad38169e51cea85d2f02cb350ff01b2c35170b67aa3a3eb9b556c377081c172021da123e098ea2b4e12ed331e1ffd9852c097bdfa4b7fe21c04c7be443a6707ef6b545864792f5f1bbca068515bcf7a23f71f4710ab1a8f17ac0ba2de68ab6bfe1c53b40d47f6f85e31329b90d3065b9707d92a74e3d404112c9bc76a7eb634d247b1b5c1296b6cfc6036cb876f7505f79f461475b03fe281d75754895860787b379d14ea03ba7429239ffdabeb68b69cf1d85e89b939ce9655f9a935bff461ad5e65e53006ba7267d5d5e52179a2d7002048457ac349a53475238d17f57a97a2bfe99c6985591c3c8b6768af972fb9cfe51de2f5866ef6230ecc56c29cb352ba9868ac8ccb6c5cb7ea2f68390a10cd9c800c53accb06c886c8034288026798f2e8e89d75c59f7de63b83b45c8e38ce4e306ee452773a1630cab398ce912750bc02e1eb9fe9dccca3f460f3e62cdace7d4bf7bc8d9a6dfb30ee89e97c0fa515dc9cb21db25707470c72eed46f8149e254999608b2c57630bcc5ef8a1638d439e08279cc0eb2b83a05c8bbddc0e0fbb1c0366580dbc4c2678d19e702542ca5eca06d7ec786c6c9cffc29b47f1650d9e265ba0a26fc1c53ea799262882d6639bde575b0e1a3a98573cfb3ce21b4085904be27f26fcfcf7e54c6fd5fb703bef30e084761ac63f152c5a5d09278908ae896355628ea066bd0eb949e0089686bf47d10bb7fe1f981a471bf041e2e1bf5eb44a6d69d15371792723e86ac0ca1305fa3ee82c0fa3fe5865a283f66fa4484cba962f70a5a4b09b36f38e353070fabce0d21e0c953e4c5a9a49459b57ffb32613ebabbf56091c986a1a1d6ba081c505435a1fea5ecc9682040fb6da1dad87dc268775d533cb15632929c78aa6f5620f35c0ff5bd86a1acf0c443aa08fdaa13c1370a883064078ea4d44ecd76f00837e8db2d249eda09fb13de143d72486e23a6d9d3bfb48f72a145d16bf7dc92e7b1ccd7feb96e077ef304b21bbc3df36b33b1d0c5ce9035d577ada6a06b8b38907a4d3b5c7fddc3993b3c7ab50dc8e71688c4fa9d4e6be76ca3e3d49d0d352bc0f10353ddc26b12fdc0e00a1f249bbc64c122816ee90a099b23504ac7b8bd53ee005798930cbbdd2be19a0a58146bcd8654075fc426d83bcd899abacf4bcc8eefcf2c7e694c9373efa415ffeaa04c029e3f659df24fc3beda53cbccb360a0781cae851bc72358722c0e163e9bd14ef3123d1de0b5be5242a7c020b718fea029dd3016c5415feac90250d428de203cf6ed9eff318c7eea000ddbb3218f0742c78ec1647d39ec73c05dd44b48c8bfc16d2cd2f6661724d11c7477e644ccae26fe580339736695dd66d679f852545adc3c1431a4116194c210ccf523b177fb36442c3f6da2533f8aaee89db1a37f5c394c199c3c0d71b200a9886b92b984ac001d13cc6565580c15e2ae3663d00e518c4b7c9ae3690dd7f9672f41ab599c71bcb9229e8f17f72fdaada310a7200e95da616c470515b0957c8b9caa3650f7a7cb7f8c79520fa735d33c3d205f409b51b45d09c85551c4923699efc09faa8dfb29a46e92bc76496221cd408ec57ad0c18ebc7e07e33bf264488f89ce8054c537ddf02361d0fc6386a892383e1a48e67ff8e4bea8e979bc5bba25c2c5b00d0c21273ca2bbac112245c2ded5b780577b34773df9e0002f392f5d1599e485fd2f82b7ddbd71189854cd01aa8494b8d1a26e790f7c1a7bb0d0b9d29ebd191c84cafeca226d178da4172f2b63cdbdb9776b70f8d057fd76783a83a3922d9d620070e65c317402775932009c1aa4ac49b6f706e47e40ba9649250c9b8893f417dfd7dae4640d3972e2126bdf685a33f3c715da7517ecd46f44d69755b02540c7478b89ce7adba97251859e5915b6c914fb5ec09ee1f84173ff5e032d4fd02104fc4dd07d754e1d2c33143fa5246acfcaaecf19a79e7581141b6f536bcce090c99d338e256cccc5908648ae31647113c8d869210554543ab1a5233bc2761bc2e8e994a2fed8b3db1742b64fdfa9c9e8b5aabd5833c57c08499e60f6049d22917433b81bbc93dc8f0bd75291917913b02321ce7e75da1acb51de46b71fa96aa54bc1d05298463f82dfcd10bb82d4ef8141eab4f7f5a7c15c591a23012f294f70ef487eae4887a1cc7aa054ae53f16678e63ab0325379147a689e7e032d00929ae106551df53c817a3e0cdef27372028c566c3aa416f8a5a15ad476d48cac6d8de57bc24c1ea1575a86b28451464e4de6f43693b4c5e81717b6e4138637e1714982a9976edda2ae5db6dc0b63f5db7643f1034dda2bfa1031762a0b0d96d476062967207bd2ca3d04991b4b4a010eed97b0c8231dff81b3c1db412bc539de0eb774b080349081ddb63a68eb06780f967b13844b590008a1192cebe4ece9bf6a59833395d70c9258288e930092b3451bf81c550546d82a9bcfbafe3b9b212b379404e8699c7ea93bebb7c554ff4947e784fe3241c94746ff28fc9c18dae1459aaf9e5e1bec3498636d7d7b6fe5d004d0cfd86a7cf5dc4277a1fba3dfa1b3ede5fc6615bd781000ea2d12cd5b7fada1a54b6c9374ce1d61570d3b0ec6a181209b2f11216af4d67410235571f3a2484a5a16f550fccb1c769ecdd2b14627f363dbbfe7652cfff649ea8e60f8f4afa0ec8dbaf079b07bed2e5d4496ebe896fc89cf8e23d8ee223e293383139895ea75f10869dd3f319583cfae9c597fb2a0fa365fa4df3c41e198db3b262360ef84dae09723a2d3711f1698d341a5986c084648209b675164c8de5e15dd4c411b8a11448f3508525d4d6582237c43edf66c5fa3e5e5855fe32ab394e02c5603ac7cff923f007c7e196ef0c2d3fd80eaf12765551ad07e92e540a1fb22167bb2dbf874bb3e404a4ba64fb1b090ad0bee61647302a6550380862999b8c183894e35712ac79e091e248433422acc4c0b69746b291856f11d4cf61d145cf426ca4bca498670b1dd09c62950ac97d0694d787322db97cb496f73ff4552be43097e275f9a2969dcc1ea97a770691ab4532cdefc11b033777ec14587a5a87ea88b4175ee5c190f0625fa5e7cf52ae3da9e679a7d2286d37efde59f8b5036db2a255eddd0f8ef481d43db72f117d9afe2f21a46f717664c3a19cd4a325eb1b4e69a2da0fc51d3cc9c21aea52b80b2ee8f8c07474ea25e875ab89c28de20179286cc978f38077b3d3b96bdb86dd2bc6766cb7d71c8e64b0e59b3c0fca2b9f0ce891e566be179270bd02e54b9ebe54943045ef250afb5a7df14b183e012b2e209d91f300c8124b99efac2ba08c75e5425888c81c4e9569c626ba2e177c102dc7e0684016058cdb300ad45236f063d640385e0c2e316ab9f1110402b15b25de900055dd4ad5e4337bc6793a3dc79cb87ca604ebd4dd903880f5642d7981fb7715347d720885e99b3557ee4124613a5170f7bd39a08277f8cb42e2747554343793b0730005b3cb56ce0fa744ee25a97d6d5a8fcd6a505c46ccaf804b8f862e751b43e43eb0ef69803f4073a937db62f7d1ef97d760647e8eba35abffa8cd769b9f67193149d21c4a356f127f7cdce61ffb63ed04c5a20323ddad21ad2ffa9f6bde79d9a3c5d0693c6d221fc87421bc942c4102ea6c27427b15797378fb972ba335f1050900deab0fa37141d13d12d883515861d0d3678d0c89f748022ad337ae34451de803e31e8f8db62d810fae6b1d5a07b976f0287ce22ddd11be818afa8389619f1a39edb9b56cd616a9bd165641e89ad014c4601d155ee116b142a060384595de99cf2cf03db160874676bdb51d24d9f4330a4e377b21a469c21086327f20b26362f5441ade03e8127fd60a5ffeb59a454a8738e185d282a59f83e27ad5619ef1724363f2f2e498cd2ac5068dc0216175b22e720b6cb7b62c8801b236e9e259a4ae3546260e7f1c9450e7782024d8484e92d81bfb8981244d6c7732df54d19eb9dae1d531f7a5b2ead8dd41773a690e9a7e123747ce000fbef46c990dd7e295e3ddf931457f45d7945ecbb4a25a8c2eb1797dea0394854efa045e201352abbd22dac453de41e04363248808fefe25a0fdf5049148ce7428f23d4c3b4d7805ebed203508baed9f2fc35c5c40df8fb4ce50c524354837a7b8ee54aae84477de7a8ed0dcd6acb7040a0db73eb786a290cd5dfae76595b7646c8f9fc386ea7dfe8d1a0a39962a6785f6f7a0b2745c73b77fbe92945ffe0cf008ebc4dafce9effe0a778f206c6b5c4b4bbce3661f9af77c6589c54fd39b73e848c547abc07ea2f49fd47e37180e40c4a6f851e93c04a6e09f934431ac3ef151619009a51cafb4d54b485346a472c99929693c9221af4dae606c232a3d1bfda725fd7a5f0cb7937d4e4d4b6d7bb8860e73b8f6cfce91dec77a", 0x1000}, {&(0x7f00000019c0)="78c0ffb4f0d73c2c424f41c2a560fb4c9935390397cd77e0453f0fb699c2e77cc776bcef01f1931e2873dd77fe43c3c66eceb6f094f1665f08cf7aba08d659487884", 0x42}], 0x6, &(0x7f0000001a80)=[@iv={0x104, 0x117, 0x2, 0xf3, "88e41480b9d751a3d045eba8e8892b67836b95cf404b61376ae335af4d0c378a7666bae8aeb660de05f5236e91ee9f4e2fa34585b8040b32b678574597b4782aadf8e5d55799f87f4d156ae206b1a8da313dd18acf1f3bf03e81c93d62fdff84c657df8c5bff59f240114dd4708f3b0560dea37ce8d2decc6e932fe42e6808d71cbc2559440188894b8b42d963e06614041b654e1a96d08c272a454b3fc8ec1e0df711eb9fd2af871d2f0096744fc380ecccd9f5f3007bbe78e7703d3bfbbaa806b874386b29a28a68873f1c4940bfb44c66288a103839174723b65e510345a9c09910ae7074a3bcaebf1b6edadaced49563dd"}, @assoc={0x10, 0x117, 0x4, 0x8}], 0x114, 0x24000000}, {0x0, 0x0, &(0x7f0000001f40)=[{&(0x7f0000001f80)="d08b8df7c9a7fb71737296e370433233553ca764ca3aa3ece84c7bd61753f11a0fb416abc3791271953f88758c5be5a4bbf22670ef8203cf3ada9ba7a93172d83913eda3178708f311b80a3cacb3261dbe2dc784bc22d05b1c901fa81b4c19a0fb129cf586d44a193cb70a69e8adea55e6bf87f875b9630f52c2f0de7d1efc0c0fdc3096f20b75f7d61925dcce1b7d338f74a418d796e887577b4bc428bb63fef41a6fc6aab73c7783769108222e0cb804737775652283239118495bbcfa84fe8fc078c9713793ccb9ab16358ce5f6acad9913cbb05a4ec959d8a0ad52e6dc64003c74d2647ede8a11bd", 0xea}, {&(0x7f0000001cc0)="9566590d47701a939fe0d8ab66406b543ada8c29e12b385eead1b3934b427ea6582b924ba72c7ce227484b8dacb97f389db5c2d8a615a42e80ef71e16861081acd2d8b8b8cb115d997d62bd39bc46aa590beb265ec8a9fa96a29c0dcc4fe3dc82f42aa1661b107cb20b297bd0a2a2fc6e7999c1fbd668b77c08f73b32da5acfcc3e0fcb5785c977bd865f5d2a5", 0x8d}, {&(0x7f0000001d80)="a3b31dc45196634b34ebb4ab6607a7035d816635639535a225c2ed4e1bb0da54f9c8751965cb3e1156e3fdf23982fd6d03eca0d07fe98f019af5bec1c1d88e07a6f5649891ce76ce576294706588d897c15b62a10ba84ba83ea626fc9ed97f3e6301b2d206dd15533aa6d90c333c811467ebf7c94f570aa2f0a508cf5cfca8b3aba2", 0x82}, {&(0x7f0000001e40)="e743ca1bbc10d841db902fd527a7651ed42bb41c63b823d1863e394e5fe4068313561f6d90cf8aa9f5fa3eede91cea62b74edd46c813283fb9654dc48dc79c39fc25b89545964741759f397a25219051ff07f5a477668fa274879ac99b225c26ff97d756ada96164059ba3397d7d0d62ef99e0b468f43dedd09295483eb614086a77a630ef11b84bb74577c12b28a920373a1e3d5abf1df7c7d7e2ddf9290f67d56d6eb6126504d523a3eb0d030421cd8ce9fd3e1e68ba150add5afe2294bc1c99898a1437eb44960cf1cbbeb15e4c457c245c8ddf5a0a2ac9972b59b13a3fd2a29b561d367c40227aa79abb979127761fb4ab3bc2fd5458", 0xf8}], 0x4, &(0x7f0000001f80), 0x0, 0x4000000}, {0x0, 0x0, &(0x7f00000021c0)=[{&(0x7f00000020c0)="f0fccea16230b1f7f2b5300b8f39b437d75565682917355ffbc8179cb79daaea57ef6cc5cb24fd39a0573ca5c7e2afb3b0fb3459e61575c210289085096ee5ba3db9457625e2cd135b2fa3fe5647431de4ac6cafcc121b3ab069d70c71c59f35ccb0bbf39e118893f7501eab81aa4733d718dc9f01ba6b6dd7e63e79557f7bdc371059693faa636adedfc24f4ff02be54a15222a2275e7", 0x97}, {&(0x7f0000002180)}], 0x2, &(0x7f0000002200)=[@assoc={0x10, 0x117, 0x4, 0x3}], 0x10}, {0x0, 0x0, &(0x7f00000023c0)=[{&(0x7f00000022c0)="5513a203231defd7fb5704e2143cb4851caf8dd9f8a3cf58a147e4358a5947f73ccaae3475caa8240803b785b12139b71280efbf66f3574fdff10fe1778f5a445102c155485eef50c0a78696e81dc805b308608288e8b5a9efd6cf4e734276fbd37e0f5aba94e8dca467527e83dbb36f2af8f4c941b4af638bbed452f884532bd3a3e240f648ba2b772a7142b5c5b4ca8422ecda7c48268e0b21554865ab7fadbc85ae0734e553000db709443310dbdec0549c9b1549e9e315ac23544fb12cb7f59a43009bea877b5845e36a0144b56beaced269d170a38f", 0xd8}], 0x1, &(0x7f0000002440)=ANY=[@ANYBLOB="30f5fa0017010100020000001e0000004a866272e3b5e3493489654b287db9a38f2f873998563c92f63d7c0dce460000"], 0x30, 0x8000000}], 0x4, 0x0) (async) syz_ublk_add_dev(r2, r3, r6, r8, &(0x7f0000000700)={0x2e, 0x21, 0x0, r11, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000006c0)=@any_dev={0x2, 0x8d6, 0x0, 0x0, 0x1000, 0x9, 0xffffffffffffffff, 0x0, 0x134}}}, &(0x7f0000000780)) (async) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56d43, 0x1, 0x25d7dbfd, {0x0, 0x0, 0x0, r13, {0x0, 0xb}, {0xf, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x4) (async, rerun: 64) r14 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) (rerun: 64) close(r14) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$SIOCSIFHWADDR(r14, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r15 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r15, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r16, {0x0, 0xd}, {0xf, 0xb}, {0xffff, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) (async) r17 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r17, &(0x7f00000004c0)="800000800000210ee7decd7a0003", 0xe, 0x404c004, &(0x7f00000001c0)={0x11, 0x8100, r16, 0x1, 0xd8, 0x6, @broadcast}, 0x14) (async) r18 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x4b800, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r18, 0xc018937e, &(0x7f0000002400)={{0x1, 0x1, 0x1018, 0xffffffffffffffff, {0x1}}, './file0\x00'}) 1.972221386s ago: executing program 3 (id=3760): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)={0x1b, 0x0, 0x0, 0x40000}, 0x50) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000005c0)=0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x0) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) mount(&(0x7f0000000300)=@nullb, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi.usb0/in_ports\x00', &(0x7f00000001c0)='xfs\x00', 0x4, 0x0) 1.72354891s ago: executing program 3 (id=3764): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x19) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) syz_emit_ethernet(0x3e, &(0x7f0000000040)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x20, 0xfc, 0x1, 0x0, @rand_addr=0x1c101001, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x6, 0x0, 0x0, 0xfa, 0x9, {0x5, 0x4, 0x0, 0x3d, 0xfff6, 0x65, 0x5, 0x1, 0x4, 0x3, @private=0xa010102, @loopback}}}}}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000200)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x20, 0xfc, 0x1, 0x0, @rand_addr=0x1c101003, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x6, 0x0, 0x0, 0xfa, 0x9, {0x5, 0x4, 0x0, 0x3d, 0xfff6, 0x65, 0x5, 0x1, 0x4, 0x3, @private=0xa010102, @loopback}}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c101004, @empty=0xe00003a4, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@gettfilter={0x1c, 0x2e, 0x0, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x1, 0x7}, {0xfff1, 0xd}, {0xc, 0xfff3}}, [{0x8, 0xb, 0x7fff}, {0x8, 0xb, 0x4}, {0x8, 0xb, 0x3ff}, {0x8, 0xb, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newtfilter={0x44, 0x2c, 0xc3f, 0x70bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r4, {0x3}, {}, {0x7, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8100}, @TCA_FLOWER_KEY_VLAN_ETH_TYPE={0x6, 0x19, 0x8864}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000810}, 0x20084084) 1.383923998s ago: executing program 3 (id=3765): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) 1.383397563s ago: executing program 3 (id=3766): pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, 0x0, 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) symlinkat(&(0x7f0000000280)='./file0\x00', r2, &(0x7f00000000c0)='./file0\x00') unlinkat(r2, &(0x7f0000000040)='./file0\x00', 0x0) 1.313002701s ago: executing program 3 (id=3767): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000004640), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000004680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000004740)={0x0, 0x60, &(0x7f0000004700)={&(0x7f00000046c0)={0x24, r1, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x8041}, 0x8000) 1.312651115s ago: executing program 3 (id=3768): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[], 0x10448) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="38000000190009002cbd7000000000000a002000fe03fe020030000008001e0000040000140009"], 0x38}, 0x1, 0x0, 0x0, 0x4040029}, 0x4000050) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r2) sendto$inet6(r0, &(0x7f0000000100)="c93f81c433a91d", 0x7, 0x4000, 0x0, 0x0) sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="18000000b1c79c874873586632164633f72e02c17f363e879a5d4e468a1f2f82604ff267d99ce2b5f98c6070533bde493cebf7f2dc2c4ae01b69a89f52c5e5fbd3c5d6853d1f005c00067efa6075b1de1c33b6adddb1feb75b8d97b92d7e3fe02e638d0a4e97de1c746b77f4a0cf1dffb1205283c336173f800bfcdef393d9fd297136f6773634b875a0eccc5930e38c34421e7adcf793d126994a", @ANYRES16=r3, @ANYBLOB="3d0a28bd7000fddbdf250900000004000480"], 0x18}, 0x1, 0x0, 0x0, 0x4000}, 0x8010) sendmsg$TIPC_NL_NODE_GET(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="f0000000", @ANYRES16=r3, @ANYBLOB="45d627bd7000fbdbdf250d000000b40004801300010062726f6164636173742d6c696e6b00001400078008000100100000000800030005000000440004000000010004000000080001001c000000080003000100000008000200ca54000008000400050000000800010006000000080001001500000016000400080000001c000700c500000008000400040000000900010073797a30000000001c000780080002007f000000080001000400000008000300010100001c0005800c00028008000200dd1c00000c00028008000100030000000c0007800800010006000000ccff06b1eb1a4a18f3f65817f63f5c61aceb6c54386060bb6e04eae0606c0b73ab7f923fe153f149a49d5fe71741"], 0xf0}, 0x1, 0x0, 0x0, 0x1}, 0xccb870d0a5c05de5) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat$vcsu(0xffffff9c, &(0x7f0000000280), 0xd3e8f6c8fd92ec51, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0x6, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5800000002060108000000000000000000000000050005000a000040050001000700000005000400000000000900020073797a310000000014000300686173683a69702c706f72742c6970"], 0x58}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r6 = socket$netlink(0x10, 0x3, 0xc) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) syz_usb_disconnect(0xffffffffffffffff) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1c0000000700000500010006000000210251a5a54911a6f678feab0a1ca0907cd50db70939e5241cc8c0521452d97aaca7bb1f1e04b3efbe4adbadb619c5956bf7b461c4bbf57629a4eda78b190ba4a1ba6b148b759b4b609bea40841d150d16fce2ce9197e8ca148fe4f081465944ddab6d43cc3be66fa5b6894324e95233735b25c6777f367164dca5d3bbd9e6c6b868c15da0163fc1d7be18f7b4bbb4bfe7a5950eeaab4073b846b160b953580753cbf2a020a005793cc4e641b0f519237bcf23ace00ba23da3c521648e1068c9eecf08db818d5e38c7399fa742c810bf38dd926b00b800000000000000"], 0x1c}}, 0x0) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040341a02080000000000010902"], 0x0) close_range(r8, 0xffffffffffffffff, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/fcloop/ctl/set_cmd_drop\x00', 0x1, 0x0) 1.044255184s ago: executing program 0 (id=3770): sendmmsg$inet(0xffffffffffffffff, &(0x7f00000057c0)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000400)="a2", 0x1}], 0x1}}], 0x1, 0x4) mkdir(0x0, 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r4 = openat$panthor(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$DRM_IOCTL_GET_STATS(r4, 0x807c6406, &(0x7f0000002140)=""/29) r5 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, 0x0) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r6, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r7, 0xf, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8481f0000005e140604000000000e000a", 0x23}], 0x1}, 0x0) 963.772434ms ago: executing program 2 (id=3772): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)={0x1b, 0x0, 0x0, 0x40000}, 0x50) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000005c0)=0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x0) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mount(&(0x7f0000000300)=@nullb, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi.usb0/in_ports\x00', &(0x7f00000001c0)='xfs\x00', 0x4, 0x0) 828.473788ms ago: executing program 2 (id=3776): pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, 0x0, 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) symlinkat(&(0x7f0000000280)='./file0\x00', r2, &(0x7f00000000c0)='./file0\x00') unlinkat(r2, &(0x7f0000000040)='./file0\x00', 0x0) 572.261897ms ago: executing program 2 (id=3780): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010000500"/20, @ANYRES32=0x0, @ANYBLOB="01e1ff0001000000140003007665746830000000000000000000000008000a00", @ANYRES32=r2, @ANYBLOB], 0x3c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000500)={'veth1\x00', 0x0}) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000700)="ffffffffffff0011223344554305000f32000000000100112233445500112233445500ff0000", 0x26, 0x0, &(0x7f0000000800)={0x11, 0x300, r3, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000a80)=ANY=[@ANYBLOB="3400000011000500"/18, @ANYRES32=r3, @ANYBLOB="000000000000000014000300626174616476300000000000000000007d6c73db27a08975c65cdf3b611077c197f8a9a0a0bf93f74bd696070e4265c41f5fe3a512339be8457660b7e91def081da0ce64817224a9c12d93daedfc46c0a8a2334f180bec5485f103e5e3af1711"], 0x34}, 0x1, 0x0, 0x0, 0x2044}, 0x0) 382.507075ms ago: executing program 2 (id=3782): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) r1 = syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x4000) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000002000b33f00000000000010000a000000000000000000000008001a"], 0x24}}, 0x0) ioctl$BLKPG(r1, 0x1269, &(0x7f00000001c0)={0x2, 0x0, 0x94, &(0x7f00000000c0)={0x80000000000, 0x800, 0xf}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@bridge_delneigh={0x28, 0x1d, 0x200, 0x70bd26, 0x25dfdbfc, {0x2, 0x0, 0x0, 0x0, 0x4, 0x4a, 0x5}, [@NDA_FDB_EXT_ATTRS={0xc, 0xe, 0x0, 0x1, [@NFEA_ACTIVITY_NOTIFY={0x5, 0x1, 0x1}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000084}, 0xc090) sendmsg$nl_generic(r3, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="a80000002d0007012bbd7000fedbdf25047c0000080001800400dd808c0003"], 0xa8}, 0x1, 0x0, 0x0, 0x14008084}, 0x0) r4 = fsopen(&(0x7f0000000300)='tracefs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000000c0)='gid', &(0x7f0000000340)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x05\x8d\x15\xd2h\x93\xc9\xb57\xc3\xeaEb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\xf5O\xb1\x9f\xc5I\xect<\x8a\x00V\xcc\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\x11&\x1bM_\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k*5\xac\x9a\b}\xfb\xe1\x89)\x1eU\xb4', 0x0) write(r0, &(0x7f0000000000)='7', 0x1) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143142, 0x103) userfaultfd(0x800) openat$tun(0xffffff9c, &(0x7f0000000240), 0x230d00, 0x0) 382.347101ms ago: executing program 1 (id=3783): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r1, &(0x7f0000000040)="d15a0856c61a46862d3f7804c8c8fe6afe058d3817b8788037c4b254c33dc40f079eb3c9ee5163e177d4c60432b7ab06c7fad4c4536740d8d36e284815093cc992af0254e3febcae1f2d093d561153d4378af5e8833a99bc5ccc9fd0b0e4a72254798d01438b07f4dd2ca54be82afcc77b94e6008e886048f6ac42cb07633cd6364295d27a62bdc42d6e18c7823776ed25e87528b7b45cbeb31066982a8958770d18405ab297ccf98b5c3258c2e138f2220026f8240bf34514209093", &(0x7f0000000100)=""/44}, 0x1c) (async) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r1, &(0x7f0000000040)="d15a0856c61a46862d3f7804c8c8fe6afe058d3817b8788037c4b254c33dc40f079eb3c9ee5163e177d4c60432b7ab06c7fad4c4536740d8d36e284815093cc992af0254e3febcae1f2d093d561153d4378af5e8833a99bc5ccc9fd0b0e4a72254798d01438b07f4dd2ca54be82afcc77b94e6008e886048f6ac42cb07633cd6364295d27a62bdc42d6e18c7823776ed25e87528b7b45cbeb31066982a8958770d18405ab297ccf98b5c3258c2e138f2220026f8240bf34514209093", &(0x7f0000000100)=""/44}, 0x1c) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x2c, r3, 0x1, 0x70bd24, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x40) (async) sendmsg$BATADV_CMD_SET_HARDIF(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x2c, r3, 0x1, 0x70bd24, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x40) 313.455132ms ago: executing program 1 (id=3784): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000300)={0x9, "f00f000000000000000000000000000000000000000000000000000000000002"}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000080), 0x8100, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1}) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086201, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') 312.503065ms ago: executing program 2 (id=3785): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f00000003c0)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f0f3000000006926000000000000bf67000000000000560602000f0200006706000020000000620a00ff0ee60000bf250000000000002d350000000000006507000002080000070700004c0000003e75000000000000bf54000000000000070400000400f9ffcd35010000000000ce040000000000001c000000000000009500000000000000db13d5d8b741f2cdaabc8383c8f56bb5df3083d20f8c2bf304000000815dcf0066d7ded3c5c49a08a503ea6d54f7f3125a8200578ac0836d6454745e70a27444003c5b20451b624db6f5320e9befc1e00b8b32917c4d30d16b7edb732bc3ac330b16c442aff70d27659bc58e296b16750c5577c848754b4894b07f15bab1c640a5c0c4fd62f9db829b301ef67fd2b2726f3af0c54af2412313b17c4c8081c4ed0572261960e227d34cfbfda047bc2351c9d8363a8cb18b7330604da78b0aba47545f9a25a80dd7d28a5ae41824f611dd2de6dd581c52698f9542a444a8a3969946faded527a0bfe5504eb355cb0000000000000073be27152effbed9ed6a4e8f9c55a2ff11245f2c20856d491b80d749cf8917dbe01cc6c7b747923621bb16efb2025d19a1a27b0348135e32e442da8f26e05283ece8ad92c77f8141c7a2037380f28c9c638ee0151f4620b9b64185db0321a4e809a5438cdef28f7adac1735a50006fbae20d0930b55f0081db6fa0d14024cefa1611ef384de38787324bfb9f79a1e164c8fe80a2d9e4199960"], &(0x7f0000000100)='GPL\x00'}, 0x27) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10040003}, 0x20048064) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000240)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) syz_genetlink_get_family_id$batadv(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r2, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000700)=ANY=[@ANYRES16=r0, @ANYBLOB="080027bd7000fcdbdf250c0000000600280001000000562313b4d5f5b8344784ce908ff5a5ff3ed9d02f296551fe3f3b5da0397b5a597b0d3284502145abb63b9ba5f1f7dc39f3c7f793d1a4862c6cc4095fc6dba44f53663f769dd1ea4312331d85fe92e52e6bd540eea535343e3450a5dee9e7220665ab0d147d5d25cf"], 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x20008c5) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c00000003"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000066009040000000000000000020000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x48}}, 0x0) syz_emit_ethernet(0x2a, &(0x7f00000006c0)=ANY=[@ANYBLOB="040000000000aaaaaaaaaabb08004500001c0068000010119078000000000000000000004e200008907845f5aaa074dae92f6153ecbf5dbf296cde1378f5de"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='sys_mnt\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='sys_mnt/block/zram0/algorithm_params\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='\x00\x00', 0x2) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) socket$inet_udp(0x2, 0x2, 0x0) r7 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x11, r7, 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x2000000, 0x0) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000, 0x3, &(0x7f0000001000/0x2000)=nil) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r1, &(0x7f0000000940)=[{{0x0, 0xffffff07, &(0x7f0000000540), 0x2}, 0x3b61}], 0x4000048, 0x0, 0x0) sendmsg$IPSET_CMD_SAVE(r3, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, 0x8, 0x6, 0x801, 0x0, 0x0, {0x5, 0x0, 0x8}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x40}, 0x1) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000540)={r6, r3}, 0xc) socket$inet_sctp(0x2, 0x5, 0x84) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0xbc}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 312.362878ms ago: executing program 1 (id=3786): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x58}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) 246.425597ms ago: executing program 1 (id=3787): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)={0x1b, 0x0, 0x0, 0x40000}, 0x50) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000005c0)=0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x0) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@nullb, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi.usb0/in_ports\x00', &(0x7f00000001c0)='xfs\x00', 0x4, 0x0) 120.598513ms ago: executing program 0 (id=3788): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) syslog(0xa, 0x0, 0x20) 120.01497ms ago: executing program 2 (id=3789): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/rfkill/rfkill0/state\x00', 0x1, 0x0) write(r4, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4000) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=@newtfilter={0x30, 0x2c, 0xd27, 0x30bd29, 0x21dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xfff0}, {0x0, 0x1}, {0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x34000844}, 0x200c4094) 117.525751ms ago: executing program 1 (id=3790): pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, 0x0, 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) symlinkat(&(0x7f0000000280)='./file0\x00', r2, &(0x7f00000000c0)='./file0\x00') unlinkat(r2, &(0x7f0000000040)='./file0\x00', 0x0) 0s ago: executing program 1 (id=3791): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010000500"/20, @ANYRES32=0x0, @ANYBLOB="01e1ff0001000000140003007665746830000000000000000000000008000a00", @ANYRES32=r2, @ANYBLOB], 0x3c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000500)={'veth1\x00', 0x0}) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000700)="ffffffffffff0011223344554305000f32000000000100112233445500112233445500ff0000", 0x26, 0x0, &(0x7f0000000800)={0x11, 0x300, r3, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000a80)=ANY=[@ANYBLOB="3400000011000500"/18, @ANYRES32=r3, @ANYBLOB="000000000000000014000300626174616476300000000000000000007d6c73db27a08975c65cdf3b611077c197f8a9a0a0bf93f74bd696070e4265c41f5fe3a512339be8457660b7e91def081da0ce64817224a9c12d93daedfc46c0a8a2334f180bec5485f103e5e3af1711"], 0x34}, 0x1, 0x0, 0x0, 0x2044}, 0x0) 0s ago: executing program 2 (id=3792): r0 = syz_open_dev$loop(&(0x7f0000001280), 0x8, 0x4000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000500)='1\n', 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/nullb/nullb1/zone_nr_conv\x00', 0x2, 0x0) getpid() openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) move_mount(0xffffffffffffffff, &(0x7f0000000080)='./config/nullb/nullb1/zone_nr_conv\x00', r2, &(0x7f0000000180)='./config\x00', 0x364) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f0000000740)="14b2eaa8e735cb8ce361abf7a1daa22f4451c1758ce6f3c3d9b716c87d3f8c0be6d7fd984064ae4d594c56f145dfa1fd23ae347eb4758a6fba1a219e5a8be640734bbf09eda0eca4f60d4fa9288828f76a4069fbd53dca6c8cf6cb95d100a8e3cea28fbd5f52577fec83440f02afa131a4edc6fbf029cf43c4bc2efd13e0537d9603cf48e6a7e5f51e6e735212a54a3f3bd8a16087a386e7385309ae5cd1fe90320fcb9e6017dc6f23cd2899afc2cac71e7428b6225226087fd5847301eed022e33e3ea3f69a0f59a47d539205adb619595ad69aad5aac7870d3f674ceb9bb", 0xf000}, {0x0, 0x45}], 0x2) fcntl$getownex(r1, 0x10, &(0x7f00000001c0)={0x0, 0x0}) ptrace$ARCH_MAP_VDSO_64(0x1e, r4, 0x4, 0x2003) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') ioctl$VIDIOC_SUBDEV_S_FMT(0xffffffffffffffff, 0xc040564a, &(0x7f00000000c0)) mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x6) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40001, 0x0) ioctl$BLKZEROOUT(r5, 0x127f, &(0x7f0000000240)={0xf400, 0x1000000}) write(r2, &(0x7f0000001400)='2\n', 0x2) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r6, &(0x7f0000000040)="09000000010000", 0x7) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="e0000000000101040000000000000000020000001c00188008000140a080000008000240000000020820034000000002240001801400018008000100e000000108000200e00000010c0002800500010000000000040016404400108008000140fffff800080002400000000108000140ffff1fc508000140000006870800014000000004080003"], 0xe0}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$BLKSSZGET(r0, 0x1268, &(0x7f0000001380)) kernel console output (not intermixed with test programs): 859][T17869] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 631.500872][T17869] ? __alloc_skb+0x5b7/0x710 [ 631.500883][T17869] ? __alloc_skb+0x140/0x710 [ 631.500896][T17869] __alloc_skb+0x140/0x710 [ 631.500905][T17869] ? __alloc_skb+0x5b7/0x710 [ 631.500915][T17869] ? __pfx___alloc_skb+0x10/0x10 [ 631.500930][T17869] netlink_alloc_large_skb+0x69/0x150 [ 631.500948][T17869] netlink_sendmsg+0x680/0xda0 [ 631.500968][T17869] ? __pfx_netlink_sendmsg+0x10/0x10 [ 631.500986][T17869] ? apparmor_socket_sendmsg+0x165/0x280 [ 631.501002][T17869] ____sys_sendmsg+0xa4d/0xbe0 [ 631.501015][T17869] ? __pfx_netlink_sendmsg+0x10/0x10 [ 631.501033][T17869] ? __pfx_____sys_sendmsg+0x10/0x10 [ 631.501054][T17869] ___sys_sendmsg+0x190/0x1e0 [ 631.501071][T17869] ? __pfx____sys_sendmsg+0x10/0x10 [ 631.501093][T17869] ? find_held_lock+0x2b/0x80 [ 631.501113][T17869] __sys_sendmsg+0x160/0x210 [ 631.501126][T17869] ? __pfx___sys_sendmsg+0x10/0x10 [ 631.501141][T17869] ? __pfx_ksys_write+0x10/0x10 [ 631.501154][T17869] __do_fast_syscall_32+0x13a/0x8b0 [ 631.501169][T17869] ? lockdep_hardirqs_on+0x7d/0x110 [ 631.501182][T17869] do_fast_syscall_32+0x32/0x70 [ 631.501197][T17869] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 631.501213][T17869] RIP: 0023:0xf709efec [ 631.501227][T17869] Code: Unable to access opcode bytes at 0xf709efc2. [ 631.501233][T17869] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 631.501245][T17869] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 631.501252][T17869] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 631.501258][T17869] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 631.501265][T17869] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 631.501272][T17869] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 631.501286][T17869] [ 631.853809][T17879] ip6t_rt: too many addresses specified [ 631.877211][ T5814] usb 7-1: new high-speed USB device number 104 using dummy_hcd [ 632.027192][ T5814] usb 7-1: Using ep0 maxpacket: 16 [ 632.029083][ T5814] usb 7-1: New USB device found, idVendor=04bf, idProduct=1301, bcdDevice=c7.7b [ 632.030753][ T5814] usb 7-1: config 5 has an invalid interface number: 233 but max is 2 [ 632.030768][ T5814] usb 7-1: config 5 has an invalid interface number: 225 but max is 2 [ 632.030779][ T5814] usb 7-1: config 5 has an invalid interface number: 114 but max is 2 [ 632.030790][ T5814] usb 7-1: config 5 has no interface number 0 [ 632.030799][ T5814] usb 7-1: config 5 has no interface number 1 [ 632.030808][ T5814] usb 7-1: config 5 has no interface number 2 [ 632.030841][ T5814] usb 7-1: config 5 interface 233 altsetting 171 endpoint 0xF has invalid maxpacket 512, setting to 64 [ 632.030855][ T5814] usb 7-1: config 5 interface 233 altsetting 171 endpoint 0x9 has invalid maxpacket 1024, setting to 64 [ 632.030869][ T5814] usb 7-1: config 5 interface 233 altsetting 171 has an invalid descriptor for endpoint zero, skipping [ 632.030888][ T5814] usb 7-1: config 5 interface 225 altsetting 5 has a duplicate endpoint with address 0x9, skipping [ 632.030901][ T5814] usb 7-1: config 5 interface 225 altsetting 5 endpoint 0x2 has invalid maxpacket 1023, setting to 64 [ 632.030915][ T5814] usb 7-1: config 5 interface 225 altsetting 5 has a duplicate endpoint with address 0x7, skipping [ 632.030931][ T5814] usb 7-1: config 5 interface 114 altsetting 1 has a duplicate endpoint with address 0x3, skipping [ 632.030943][ T5814] usb 7-1: config 5 interface 114 altsetting 1 has a duplicate endpoint with address 0x1, skipping [ 632.030955][ T5814] usb 7-1: config 5 interface 114 altsetting 1 has a duplicate endpoint with address 0x7, skipping [ 632.030967][ T5814] usb 7-1: config 5 interface 233 has no altsetting 0 [ 632.030977][ T5814] usb 7-1: config 5 interface 225 has no altsetting 0 [ 632.030986][ T5814] usb 7-1: config 5 interface 114 has no altsetting 0 [ 632.032809][ T5814] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 632.032834][ T5814] usb 7-1: Product: syz [ 632.032847][ T5814] usb 7-1: Manufacturer: щ [ 632.032861][ T5814] usb 7-1: SerialNumber: syz [ 632.221087][T17887] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3257'. [ 634.486398][T17915] ip6t_rt: too many addresses specified [ 634.565861][T17917] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3267'. [ 634.768376][ T5814] cp210x 7-1:5.233: cp210x converter detected [ 634.771314][ T5814] cp210x 7-1:5.233: failed to get vendor val 0x370b size 1: -71 [ 634.774337][ T5814] cp210x 7-1:5.233: querying part number failed [ 634.782084][ T5814] usb 7-1: cp210x converter now attached to ttyUSB0 [ 634.788324][ T5814] cp210x 7-1:5.225: cp210x converter detected [ 634.790996][ T5814] cp210x 7-1:5.225: failed to get vendor val 0x370b size 1: -71 [ 634.793589][ T5814] cp210x 7-1:5.225: querying part number failed [ 634.799898][ T5814] usb 7-1: cp210x converter now attached to ttyUSB1 [ 634.805532][ T5814] cp210x 7-1:5.114: cp210x converter detected [ 634.808158][ T5814] cp210x 7-1:5.114: failed to get vendor val 0x370b size 1: -71 [ 634.810562][ T5814] cp210x 7-1:5.114: querying part number failed [ 634.814032][ T5814] usb 7-1: cp210x converter now attached to ttyUSB2 [ 634.817408][ T5814] usb 7-1: USB disconnect, device number 104 [ 634.829633][ T5814] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 634.832488][ T5814] cp210x 7-1:5.233: device disconnected [ 634.945769][ T5814] cp210x ttyUSB1: cp210x converter now disconnected from ttyUSB1 [ 634.949921][ T5814] cp210x 7-1:5.225: device disconnected [ 634.956379][ T5814] cp210x ttyUSB2: cp210x converter now disconnected from ttyUSB2 [ 634.960282][ T5814] cp210x 7-1:5.114: device disconnected [ 635.514435][T17928] cgroup: release_agent respecified [ 635.524263][T17928] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3269'. [ 635.525360][T17928] capability: warning: `syz.3.3269' uses 32-bit capabilities (legacy support in use) [ 635.663000][T17946] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3278'. [ 635.893696][T17951] netlink: 'syz.3.3277': attribute type 10 has an invalid length. [ 636.690611][T17965] FAULT_INJECTION: forcing a failure. [ 636.690611][T17965] name failslab, interval 1, probability 0, space 0, times 0 [ 636.690676][T17965] CPU: 3 UID: 0 PID: 17965 Comm: syz.3.3281 Tainted: G L syzkaller #0 PREEMPT(full) [ 636.690726][T17965] Tainted: [L]=SOFTLOCKUP [ 636.690734][T17965] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 636.690760][T17965] Call Trace: [ 636.690769][T17965] [ 636.690778][T17965] dump_stack_lvl+0x100/0x190 [ 636.690808][T17965] should_fail_ex.cold+0x5/0xa [ 636.690833][T17965] should_failslab+0xc2/0x120 [ 636.690857][T17965] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 636.690878][T17965] ? __alloc_skb+0x5b7/0x710 [ 636.690896][T17965] ? __alloc_skb+0x140/0x710 [ 636.690918][T17965] __alloc_skb+0x140/0x710 [ 636.690935][T17965] ? __alloc_skb+0x5b7/0x710 [ 636.690952][T17965] ? __pfx___alloc_skb+0x10/0x10 [ 636.690977][T17965] netlink_alloc_large_skb+0x69/0x150 [ 636.691008][T17965] netlink_sendmsg+0x680/0xda0 [ 636.691040][T17965] ? __pfx_netlink_sendmsg+0x10/0x10 [ 636.691072][T17965] ? apparmor_socket_sendmsg+0x165/0x280 [ 636.691097][T17965] ____sys_sendmsg+0xa4d/0xbe0 [ 636.691120][T17965] ? __pfx_netlink_sendmsg+0x10/0x10 [ 636.691150][T17965] ? __pfx_____sys_sendmsg+0x10/0x10 [ 636.691186][T17965] ___sys_sendmsg+0x190/0x1e0 [ 636.691212][T17965] ? __pfx____sys_sendmsg+0x10/0x10 [ 636.691250][T17965] ? find_held_lock+0x2b/0x80 [ 636.691286][T17965] __sys_sendmsg+0x160/0x210 [ 636.691323][T17965] ? __pfx___sys_sendmsg+0x10/0x10 [ 636.691351][T17965] ? __pfx_ksys_write+0x10/0x10 [ 636.691374][T17965] __do_fast_syscall_32+0x13a/0x8b0 [ 636.691398][T17965] ? lockdep_hardirqs_on+0x7d/0x110 [ 636.691421][T17965] do_fast_syscall_32+0x32/0x70 [ 636.691444][T17965] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 636.691468][T17965] RIP: 0023:0xf704efec [ 636.691489][T17965] Code: Unable to access opcode bytes at 0xf704efc2. [ 636.691498][T17965] RSP: 002b:00000000f53fb50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 636.691517][T17965] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000080000200 [ 636.691550][T17965] RDX: 0000000024008080 RSI: 0000000000000000 RDI: 0000000000000000 [ 636.691563][T17965] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 636.691575][T17965] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 636.691586][T17965] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 636.691611][T17965] [ 636.914091][T17968] netlink: 'syz.1.3280': attribute type 10 has an invalid length. [ 636.928556][T17964] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3283'. [ 637.614389][T17987] ip6t_rt: too many addresses specified [ 638.100662][T17994] netlink: 'syz.2.3289': attribute type 10 has an invalid length. [ 639.223489][T18008] FAULT_INJECTION: forcing a failure. [ 639.223489][T18008] name failslab, interval 1, probability 0, space 0, times 0 [ 639.223588][T18008] CPU: 2 UID: 0 PID: 18008 Comm: syz.2.3295 Tainted: G L syzkaller #0 PREEMPT(full) [ 639.223638][T18008] Tainted: [L]=SOFTLOCKUP [ 639.223648][T18008] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 639.223660][T18008] Call Trace: [ 639.223669][T18008] [ 639.223677][T18008] dump_stack_lvl+0x100/0x190 [ 639.223710][T18008] should_fail_ex.cold+0x5/0xa [ 639.223737][T18008] should_failslab+0xc2/0x120 [ 639.223764][T18008] __kmalloc_cache_noprof+0x91/0x6d0 [ 639.223795][T18008] ? io_uring_setup.cold+0x6c/0x1c5e [ 639.223831][T18008] io_uring_setup.cold+0x6c/0x1c5e [ 639.223864][T18008] ? rcu_read_lock_any_held+0x6a/0x90 [ 639.223888][T18008] ? vfs_write+0x15d/0x1050 [ 639.223906][T18008] ? __pfx_io_uring_setup+0x10/0x10 [ 639.223926][T18008] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 639.223964][T18008] ? __pfx_vfs_write+0x10/0x10 [ 639.223982][T18008] ? do_sys_openat2+0x159/0x1e0 [ 639.224026][T18008] ? ksys_write+0x1ac/0x250 [ 639.224046][T18008] ? __pfx_ksys_write+0x10/0x10 [ 639.224069][T18008] __ia32_sys_io_uring_setup+0xc2/0x170 [ 639.224095][T18008] __do_fast_syscall_32+0x13a/0x8b0 [ 639.224121][T18008] ? lockdep_hardirqs_on+0x7d/0x110 [ 639.224147][T18008] do_fast_syscall_32+0x32/0x70 [ 639.224173][T18008] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 639.224201][T18008] RIP: 0023:0xf709efec [ 639.224225][T18008] Code: Unable to access opcode bytes at 0xf709efc2. [ 639.224236][T18008] RSP: 002b:00000000f548d43c EFLAGS: 00000286 ORIG_RAX: 00000000000001a9 [ 639.224257][T18008] RAX: ffffffffffffffda RBX: 00000000000006d1 RCX: 0000000080000a88 [ 639.224272][T18008] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 639.224284][T18008] RBP: 00000000f548d4fc R08: 0000000000000000 R09: 0000000000000000 [ 639.224297][T18008] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 639.224328][T18008] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 639.224356][T18008] [ 639.473252][T18020] netlink: 884 bytes leftover after parsing attributes in process `syz.1.3300'. [ 639.495884][T18018] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3299'. [ 640.389431][T18036] ip6t_rt: too many addresses specified [ 640.642706][T18045] ip6t_rt: too many addresses specified [ 641.254106][T18054] netlink: 884 bytes leftover after parsing attributes in process `syz.3.3311'. [ 641.329066][T18052] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3312'. [ 641.545410][T18068] ip6t_rt: too many addresses specified [ 642.490182][T18082] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3322'. [ 642.826812][T18085] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3323'. [ 643.115710][T18099] ip6t_rt: too many addresses specified [ 643.460181][T18108] FAULT_INJECTION: forcing a failure. [ 643.460181][T18108] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 643.460255][T18108] CPU: 2 UID: 0 PID: 18108 Comm: syz.0.3329 Tainted: G L syzkaller #0 PREEMPT(full) [ 643.460286][T18108] Tainted: [L]=SOFTLOCKUP [ 643.460292][T18108] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 643.460300][T18108] Call Trace: [ 643.460305][T18108] [ 643.460311][T18108] dump_stack_lvl+0x100/0x190 [ 643.460332][T18108] should_fail_ex.cold+0x5/0xa [ 643.460348][T18108] _copy_from_iter+0x1f4/0x1690 [ 643.460363][T18108] ? __asan_memset+0x23/0x50 [ 643.460384][T18108] ? __pfx__copy_from_iter+0x10/0x10 [ 643.460396][T18108] ? __pfx___alloc_skb+0x10/0x10 [ 643.460414][T18108] netlink_sendmsg+0x808/0xda0 [ 643.460436][T18108] ? __pfx_netlink_sendmsg+0x10/0x10 [ 643.460456][T18108] ? apparmor_socket_sendmsg+0x165/0x280 [ 643.460473][T18108] ____sys_sendmsg+0xa4d/0xbe0 [ 643.460488][T18108] ? __pfx_netlink_sendmsg+0x10/0x10 [ 643.460507][T18108] ? __pfx_____sys_sendmsg+0x10/0x10 [ 643.460531][T18108] ___sys_sendmsg+0x190/0x1e0 [ 643.460548][T18108] ? __pfx____sys_sendmsg+0x10/0x10 [ 643.460572][T18108] ? find_held_lock+0x2b/0x80 [ 643.460595][T18108] __sys_sendmsg+0x160/0x210 [ 643.460608][T18108] ? __pfx___sys_sendmsg+0x10/0x10 [ 643.460625][T18108] ? __pfx_ksys_write+0x10/0x10 [ 643.460644][T18108] __do_fast_syscall_32+0x13a/0x8b0 [ 643.460663][T18108] ? lockdep_hardirqs_on+0x7d/0x110 [ 643.460678][T18108] do_fast_syscall_32+0x32/0x70 [ 643.460694][T18108] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 643.460710][T18108] RIP: 0023:0xf7f77fec [ 643.460724][T18108] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 643.460732][T18108] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 643.460745][T18108] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800007c0 [ 643.460753][T18108] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 643.460760][T18108] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 643.460767][T18108] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 643.460774][T18108] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 643.460790][T18108] [ 643.697793][T18114] ip6t_rt: too many addresses specified [ 643.876032][T18118] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3332'. [ 644.123565][T18130] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3334'. [ 644.123609][T18130] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3334'. [ 644.126932][T18130] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3334'. [ 644.773599][T18142] __nla_validate_parse: 1 callbacks suppressed [ 644.773847][T18142] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3338'. [ 645.980990][T18171] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3346'. [ 646.257223][T14629] usb 6-1: new low-speed USB device number 49 using dummy_hcd [ 646.428300][T14629] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 646.434128][T14629] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 646.437559][T14629] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 646.437589][T14629] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 646.437616][T14629] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 646.437638][T14629] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 646.455470][T14629] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 646.455543][T14629] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 646.455596][T14629] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 646.455611][T14629] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 646.455624][T14629] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 646.456438][T14629] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 646.456458][T14629] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 646.456470][T14629] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 646.456483][T14629] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 646.456495][T14629] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 646.459138][T14629] usb 6-1: string descriptor 0 read error: -22 [ 646.459194][T14629] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.465637][T14629] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 646.602134][T18181] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3352'. [ 646.639778][T18184] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3354'. [ 646.847121][T18191] input: PS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input21 [ 646.928535][T18193] tipc: Started in network mode [ 646.928591][T18193] tipc: Node identity , cluster identity 4711 [ 646.930055][T18193] tipc: Failed to obtain node identity [ 646.930081][T18193] tipc: Enabling of bearer rejected, failed to enable media [ 647.048221][T18198] ip6t_rt: too many addresses specified [ 647.061578][T18196] block device autoloading is deprecated and will be removed. [ 647.175466][T18200] netlink: 'syz.0.3357': attribute type 10 has an invalid length. [ 647.600373][T18208] FAULT_INJECTION: forcing a failure. [ 647.600373][T18208] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 647.600430][T18208] CPU: 3 UID: 0 PID: 18208 Comm: syz.2.3359 Tainted: G L syzkaller #0 PREEMPT(full) [ 647.600458][T18208] Tainted: [L]=SOFTLOCKUP [ 647.600464][T18208] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 647.600471][T18208] Call Trace: [ 647.600476][T18208] [ 647.600482][T18208] dump_stack_lvl+0x100/0x190 [ 647.600511][T18208] should_fail_ex.cold+0x5/0xa [ 647.600531][T18208] _copy_from_iter+0x1f4/0x1690 [ 647.600550][T18208] ? __pfx__copy_from_iter+0x10/0x10 [ 647.600560][T18208] ? trace_kmalloc+0xeb/0x110 [ 647.600574][T18208] ? __kasan_kmalloc+0xaa/0xb0 [ 647.600587][T18208] ? __kmalloc_noprof+0x350/0x840 [ 647.600599][T18208] ? kernfs_fop_write_iter+0x26a/0x5f0 [ 647.600617][T18208] kernfs_fop_write_iter+0x186/0x5f0 [ 647.600635][T18208] vfs_write+0x6af/0x1050 [ 647.600647][T18208] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 647.600665][T18208] ? __pfx_vfs_write+0x10/0x10 [ 647.600674][T18208] ? find_held_lock+0x2b/0x80 [ 647.600695][T18208] ksys_write+0x12a/0x250 [ 647.600705][T18208] ? __pfx_ksys_write+0x10/0x10 [ 647.600715][T18208] ? ksys_write+0x1ac/0x250 [ 647.600725][T18208] ? __pfx_ksys_write+0x10/0x10 [ 647.600739][T18208] __do_fast_syscall_32+0x13a/0x8b0 [ 647.600756][T18208] ? lockdep_hardirqs_on+0x7d/0x110 [ 647.600770][T18208] do_fast_syscall_32+0x32/0x70 [ 647.600784][T18208] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 647.600799][T18208] RIP: 0023:0xf709efec [ 647.600812][T18208] Code: Unable to access opcode bytes at 0xf709efc2. [ 647.600817][T18208] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 647.600829][T18208] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 647.600836][T18208] RDX: 0000000000000012 RSI: 0000000000000000 RDI: 0000000000000000 [ 647.600842][T18208] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 647.600849][T18208] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 647.600855][T18208] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 647.600870][T18208] [ 647.606768][T18208] netlink: 'syz.2.3359': attribute type 10 has an invalid length. [ 648.392881][T18218] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3364'. [ 648.687010][T18225] netlink: 'syz.2.3365': attribute type 1 has an invalid length. [ 648.687154][T18225] netlink: 'syz.2.3365': attribute type 4 has an invalid length. [ 648.687186][T18225] netlink: 15334 bytes leftover after parsing attributes in process `syz.2.3365'. [ 648.697096][T18225] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3365'. [ 649.398434][ T25] usb 6-1: USB disconnect, device number 49 [ 649.407394][T18234] netlink: 'syz.0.3368': attribute type 10 has an invalid length. [ 649.569149][T18241] ip6t_rt: too many addresses specified [ 650.846148][T18265] Console: switching to colour dummy device 80x25 [ 650.893992][T18262] zswap: compressor z not available [ 650.957217][ T5843] usb 8-1: new low-speed USB device number 86 using dummy_hcd [ 650.969728][T18264] zswap: compressor not available [ 651.046228][T18281] loop8: detected capacity change from 0 to 7 [ 651.053930][ C2] blk_print_req_error: 11 callbacks suppressed [ 651.054010][ C2] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 651.054074][ C2] buffer_io_error: 10 callbacks suppressed [ 651.054102][ C2] Buffer I/O error on dev loop8, logical block 0, async page read [ 651.054924][ C2] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 651.054974][ C2] Buffer I/O error on dev loop8, logical block 0, async page read [ 651.055173][ C2] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 651.055216][ C2] Buffer I/O error on dev loop8, logical block 0, async page read [ 651.055394][ C2] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 651.055435][ C2] Buffer I/O error on dev loop8, logical block 0, async page read [ 651.055641][ C2] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 651.055683][ C2] Buffer I/O error on dev loop8, logical block 0, async page read [ 651.055892][ C2] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 651.055934][ C2] Buffer I/O error on dev loop8, logical block 0, async page read [ 651.058223][ C2] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 651.058331][ C2] Buffer I/O error on dev loop8, logical block 0, async page read [ 651.058391][T18281] ldm_validate_partition_table(): Disk read failed. [ 651.058693][ C2] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 651.058737][ C2] Buffer I/O error on dev loop8, logical block 0, async page read [ 651.058949][ C2] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 651.059009][ C2] Buffer I/O error on dev loop8, logical block 0, async page read [ 651.059218][ C2] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 651.059260][ C2] Buffer I/O error on dev loop8, logical block 0, async page read [ 651.059499][T18281] Dev loop8: unable to read RDB block 0 [ 651.059790][T18281] loop8: unable to read partition table [ 651.059889][T18281] loop8: partition table beyond EOD, truncated [ 651.059920][T18281] loop_reread_partitions: partition scan of loop8 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 651.130265][ T5843] usb 8-1: unable to get BOS descriptor or descriptor too short [ 651.130308][ T5843] usb 8-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice= 0.40 [ 651.131868][ T5843] usb 8-1: config 18 has an invalid interface number: 166 but max is 0 [ 651.131889][ T5843] usb 8-1: config 18 has no interface number 0 [ 651.131910][ T5843] usb 8-1: too many endpoints for config 18 interface 166 altsetting 9: 162, using maximum allowed: 30 [ 651.131938][ T5843] usb 8-1: config 18 interface 166 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 162 [ 651.131961][ T5843] usb 8-1: config 18 interface 166 has no altsetting 0 [ 651.136107][ T5843] usb 8-1: string descriptor 0 read error: -22 [ 651.136205][ T5843] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 651.337448][T18289] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 651.352828][T18289] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 651.353027][T18289] pci 0000:00:01.0: BAR 2 [mem 0x81084000-0x81084fff] [ 651.353465][T18289] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 651.354339][T18289] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 651.361016][T18263] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 651.363804][T18263] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 651.365089][T18289] pci 0000:00:01.0: Adding to iommu group 1 [ 651.368905][T18289] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 651.368919][T18289] pci 0000:00:01.0: vgaarb: bridge control possible [ 651.368927][T18289] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 651.374162][T18289] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 651.374319][T18289] pci 0000:00:01.0: BAR 2 [mem 0x81084000-0x81084fff]: assigned [ 651.375944][T18289] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 651.384075][T18289] [drm] Found bochs VGA, ID 0xb0c5. [ 651.384091][T18289] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81084000. [ 651.397206][T18289] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 651.487573][T18296] ip6t_rt: too many addresses specified [ 651.518672][T18289] Console: switching to colour frame buffer device 160x50 [ 651.576109][T18289] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 653.102834][ T5843] usb 8-1: USB disconnect, device number 86 [ 653.216863][T18343] ip6t_rt: too many addresses specified [ 653.920164][T18354] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 653.920676][T18354] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 654.457440][ T25] usb 7-1: new high-speed USB device number 105 using dummy_hcd [ 654.587268][ T25] usb 7-1: device descriptor read/64, error -71 [ 654.803622][T18392] FAULT_INJECTION: forcing a failure. [ 654.803622][T18392] name failslab, interval 1, probability 0, space 0, times 0 [ 654.816334][T18392] CPU: 1 UID: 0 PID: 18392 Comm: syz.0.3416 Tainted: G L syzkaller #0 PREEMPT(full) [ 654.816386][T18392] Tainted: [L]=SOFTLOCKUP [ 654.816395][T18392] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 654.816407][T18392] Call Trace: [ 654.816457][T18392] [ 654.816466][T18392] dump_stack_lvl+0x100/0x190 [ 654.816540][T18392] should_fail_ex.cold+0x5/0xa [ 654.816564][T18392] should_failslab+0xc2/0x120 [ 654.816612][T18392] __kmalloc_noprof+0xfc/0x840 [ 654.816631][T18392] ? rcu_is_watching+0x13/0xc0 [ 654.816651][T18392] ? tomoyo_realpath_from_path+0xb6/0x690 [ 654.816684][T18392] tomoyo_realpath_from_path+0xb6/0x690 [ 654.816722][T18392] tomoyo_mkdev_perm+0x231/0x570 [ 654.816744][T18392] ? tomoyo_mkdev_perm+0x21d/0x570 [ 654.816767][T18392] ? __pfx_tomoyo_mkdev_perm+0x10/0x10 [ 654.816790][T18392] ? do_raw_spin_lock+0x128/0x260 [ 654.816824][T18392] ? do_raw_spin_unlock+0x145/0x1e0 [ 654.816870][T18392] ? simple_lookup+0xfc/0x1d0 [ 654.816894][T18392] tomoyo_path_mknod+0xe2/0x190 [ 654.816923][T18392] ? __pfx_tomoyo_path_mknod+0x10/0x10 [ 654.816952][T18392] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 654.816981][T18392] security_path_mknod+0x161/0x300 [ 654.817010][T18392] filename_mknodat+0x241/0x7f0 [ 654.817036][T18392] ? __pfx_filename_mknodat+0x10/0x10 [ 654.817073][T18392] ? strncpy_from_user+0x19d/0x2d0 [ 654.817096][T18392] ? do_getname+0x191/0x390 [ 654.817123][T18392] __ia32_sys_mknodat+0xb4/0xf0 [ 654.817146][T18392] __do_fast_syscall_32+0x13a/0x8b0 [ 654.817195][T18392] ? lockdep_hardirqs_on+0x7d/0x110 [ 654.817219][T18392] do_fast_syscall_32+0x32/0x70 [ 654.817242][T18392] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 654.817266][T18392] RIP: 0023:0xf7f77fec [ 654.817288][T18392] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 654.817320][T18392] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000129 [ 654.817339][T18392] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000040 [ 654.817351][T18392] RDX: 0000000000002000 RSI: 0000000000000103 RDI: 0000000000000000 [ 654.817362][T18392] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 654.817375][T18392] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 654.817385][T18392] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 654.817412][T18392] [ 654.817543][T18392] ERROR: Out of memory at tomoyo_realpath_from_path. [ 654.827251][ T25] usb 7-1: new high-speed USB device number 106 using dummy_hcd [ 654.923475][ T5813] Process accounting resumed [ 654.977300][ T25] usb 7-1: device descriptor read/64, error -71 [ 655.008378][T18399] FAULT_INJECTION: forcing a failure. [ 655.008378][T18399] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 655.008449][T18399] CPU: 1 UID: 0 PID: 18399 Comm: syz.1.3418 Tainted: G L syzkaller #0 PREEMPT(full) [ 655.008482][T18399] Tainted: [L]=SOFTLOCKUP [ 655.008489][T18399] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 655.008498][T18399] Call Trace: [ 655.008504][T18399] [ 655.008510][T18399] dump_stack_lvl+0x100/0x190 [ 655.008534][T18399] should_fail_ex.cold+0x5/0xa [ 655.008554][T18399] _copy_from_iter+0x1f4/0x1690 [ 655.008572][T18399] ? __asan_memset+0x23/0x50 [ 655.008596][T18399] ? __pfx__copy_from_iter+0x10/0x10 [ 655.008609][T18399] ? __pfx___alloc_skb+0x10/0x10 [ 655.008683][T18399] netlink_sendmsg+0x808/0xda0 [ 655.008709][T18399] ? __pfx_netlink_sendmsg+0x10/0x10 [ 655.008732][T18399] ? apparmor_socket_sendmsg+0x165/0x280 [ 655.008751][T18399] ____sys_sendmsg+0xa4d/0xbe0 [ 655.008769][T18399] ? __pfx_netlink_sendmsg+0x10/0x10 [ 655.008792][T18399] ? __pfx_____sys_sendmsg+0x10/0x10 [ 655.008814][T18399] ? _kstrtoull+0x144/0x200 [ 655.008832][T18399] ? __pfx__kstrtoull+0x10/0x10 [ 655.008851][T18399] ___sys_sendmsg+0x190/0x1e0 [ 655.008878][T18399] ? __pfx____sys_sendmsg+0x10/0x10 [ 655.008897][T18399] ? __lock_acquire+0x4c5/0x1ec0 [ 655.008924][T18399] ? __fget_files+0x34/0x3d0 [ 655.008953][T18399] __sys_sendmmsg+0x309/0x440 [ 655.008970][T18399] ? __pfx___sys_sendmmsg+0x10/0x10 [ 655.008984][T18399] ? find_held_lock+0x2b/0x80 [ 655.009004][T18399] ? __mutex_unlock_slowpath+0x35d/0x930 [ 655.009032][T18399] ? fput+0x7c/0x100 [ 655.009049][T18399] ? ksys_write+0x1ac/0x250 [ 655.009066][T18399] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 655.009085][T18399] ? lockdep_hardirqs_on+0x7d/0x110 [ 655.009102][T18399] __do_fast_syscall_32+0x13a/0x8b0 [ 655.009119][T18399] ? lockdep_hardirqs_on+0x7d/0x110 [ 655.009151][T18399] do_fast_syscall_32+0x32/0x70 [ 655.009169][T18399] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 655.009188][T18399] RIP: 0023:0xf7fe5fec [ 655.009205][T18399] Code: Unable to access opcode bytes at 0xf7fe5fc2. [ 655.009211][T18399] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 655.009226][T18399] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 655.009236][T18399] RDX: 0000000000000235 RSI: 0000000000000000 RDI: 0000000000000000 [ 655.009245][T18399] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 655.009253][T18399] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 655.009262][T18399] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 655.009281][T18399] [ 655.079841][T18401] syzkaller0: entered promiscuous mode [ 655.079854][T18401] syzkaller0: entered allmulticast mode [ 655.080584][T18401] syzkaller0: mtu less than device minimum [ 655.087296][ T25] usb usb7-port1: attempt power cycle [ 655.359924][T18420] openvswitch: netlink: Geneve opt len 5 is not a multiple of 4. [ 655.374812][T18420] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3426'. [ 655.397946][T18420] macsec1: entered promiscuous mode [ 655.398001][T18420] virt_wifi0: entered promiscuous mode [ 655.427482][ T25] usb 7-1: new high-speed USB device number 107 using dummy_hcd [ 655.450496][ T25] usb 7-1: device descriptor read/8, error -71 [ 655.687205][ T25] usb 7-1: new high-speed USB device number 108 using dummy_hcd [ 655.708002][ T25] usb 7-1: device descriptor read/8, error -71 [ 655.827520][ T25] usb usb7-port1: unable to enumerate USB device [ 656.409888][T18445] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3435'. [ 656.409942][T18445] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3435'. [ 656.410014][T18445] netlink: 'syz.0.3435': attribute type 7 has an invalid length. [ 656.415273][ T6719] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 656.434811][ T5747] Bluetooth: hci3: unexpected event for opcode 0x080f [ 656.437342][ T6719] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 656.437381][ T6719] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 656.437408][ T6719] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 656.747526][ T5747] Bluetooth: hci2: command 0x0406 tx timeout [ 656.922257][T18461] x_tables: ip_tables: esp match: only valid for protocol 50 [ 657.056422][T18475] x_tables: ip_tables: esp match: only valid for protocol 50 [ 657.440857][T18492] ip6t_rt: too many addresses specified [ 658.699031][T18513] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3449'. [ 658.982023][ T43] audit: type=1326 audit(2000000447.689:854): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18523 comm="syz.1.3454" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fe5fec code=0x0 [ 658.990881][ T25] syzkaller0: tun_net_xmit 76 [ 659.033330][T18525] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 659.033394][T18525] syzkaller0: Linktype set failed because interface is up [ 659.177373][ T5813] syzkaller0: tun_net_xmit 76 [ 659.387614][ T25] syzkaller0: tun_net_xmit 76 [ 659.582198][T18543] xt_NETMAP: bad MAP_IPS. [ 659.584397][T18543] netlink: 'syz.3.3463': attribute type 1 has an invalid length. [ 659.962997][T18557] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 659.963360][T18557] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 660.207617][ T853] usb 8-1: new low-speed USB device number 87 using dummy_hcd [ 660.388300][ T853] usb 8-1: Invalid ep0 maxpacket: 64 [ 660.464260][ T65] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 660.464364][ T65] Bluetooth: hci3: Injecting HCI hardware error event [ 660.467781][ T65] Bluetooth: hci3: hardware error 0x00 [ 660.527589][ T853] usb 8-1: new low-speed USB device number 88 using dummy_hcd [ 660.697205][ T853] usb 8-1: Invalid ep0 maxpacket: 64 [ 660.697628][ T853] usb usb8-port1: attempt power cycle [ 661.075458][ T853] usb 8-1: new low-speed USB device number 89 using dummy_hcd [ 661.105495][ T853] usb 8-1: Invalid ep0 maxpacket: 64 [ 661.237257][ T853] usb 8-1: new low-speed USB device number 90 using dummy_hcd [ 661.274041][ T853] usb 8-1: Invalid ep0 maxpacket: 64 [ 661.274447][ T853] usb usb8-port1: unable to enumerate USB device [ 662.604926][ T65] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 663.212005][ T43] audit: type=1326 audit(2000000451.919:855): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18576 comm="syz.0.3474" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 663.212946][ T43] audit: type=1326 audit(2000000451.919:857): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18576 comm="syz.0.3474" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 663.213007][ T43] audit: type=1326 audit(2000000451.919:858): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18576 comm="syz.0.3474" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 663.220083][ T43] audit: type=1326 audit(2000000451.919:856): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18576 comm="syz.0.3474" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 663.220130][ T43] audit: type=1326 audit(2000000451.929:859): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18576 comm="syz.0.3474" exe="/syz-executor" sig=0 arch=40000003 syscall=171 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 663.220198][ T43] audit: type=1326 audit(2000000451.929:860): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18576 comm="syz.0.3474" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 663.220307][ T43] audit: type=1326 audit(2000000451.929:861): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18576 comm="syz.0.3474" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 663.220695][ T43] audit: type=1326 audit(2000000451.929:862): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18576 comm="syz.0.3474" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 663.220787][ T43] audit: type=1326 audit(2000000451.929:863): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18576 comm="syz.0.3474" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 663.320680][T13330] syzkaller0: tun_net_xmit 76 [ 663.323063][T18577] XFS (nullb0): Invalid superblock magic number [ 663.343586][T18590] FAULT_INJECTION: forcing a failure. [ 663.343586][T18590] name failslab, interval 1, probability 0, space 0, times 0 [ 663.343655][T18590] CPU: 3 UID: 0 PID: 18590 Comm: syz.3.3475 Tainted: G L syzkaller #0 PREEMPT(full) [ 663.343697][T18590] Tainted: [L]=SOFTLOCKUP [ 663.343706][T18590] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 663.343717][T18590] Call Trace: [ 663.343725][T18590] [ 663.343734][T18590] dump_stack_lvl+0x100/0x190 [ 663.343762][T18590] should_fail_ex.cold+0x5/0xa [ 663.343787][T18590] should_failslab+0xc2/0x120 [ 663.343813][T18590] __kmalloc_noprof+0xfc/0x840 [ 663.343834][T18590] ? tomoyo_encode2+0xfb/0x3c0 [ 663.343864][T18590] tomoyo_encode2+0xfb/0x3c0 [ 663.343894][T18590] tomoyo_encode+0x29/0x50 [ 663.343920][T18590] tomoyo_realpath_from_path+0x18c/0x690 [ 663.343959][T18590] tomoyo_path_number_perm+0x23c/0x580 [ 663.343983][T18590] ? tomoyo_path_number_perm+0x22e/0x580 [ 663.344007][T18590] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 663.344031][T18590] ? get_pid_task+0x106/0x250 [ 663.344058][T18590] ? __lock_acquire+0x4c5/0x1ec0 [ 663.344095][T18590] ? __fget_files+0x34/0x3d0 [ 663.344116][T18590] ? find_held_lock+0x2b/0x80 [ 663.344134][T18590] ? __fget_files+0x215/0x3d0 [ 663.344153][T18590] ? hook_file_ioctl_common+0x140/0x440 [ 663.344174][T18590] ? __fget_files+0x215/0x3d0 [ 663.344199][T18590] ? __fget_files+0x21f/0x3d0 [ 663.344222][T18590] security_file_ioctl_compat+0xd3/0x230 [ 663.344249][T18590] __ia32_compat_sys_ioctl+0xc2/0x360 [ 663.344280][T18590] __do_fast_syscall_32+0x13a/0x8b0 [ 663.344303][T18590] ? lockdep_hardirqs_on+0x7d/0x110 [ 663.344328][T18590] do_fast_syscall_32+0x32/0x70 [ 663.344352][T18590] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 663.344377][T18590] RIP: 0023:0xf704efec [ 663.344398][T18590] Code: Unable to access opcode bytes at 0xf704efc2. [ 663.344408][T18590] RSP: 002b:00000000f541c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 663.344426][T18590] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000000005101 [ 663.344440][T18590] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 663.344451][T18590] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 663.344461][T18590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 663.344472][T18590] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 663.344498][T18590] [ 663.344558][T18590] ERROR: Out of memory at tomoyo_realpath_from_path. [ 663.351045][T18590] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 663.351069][T18590] syzkaller0: Linktype set failed because interface is up [ 663.656889][T18593] openvswitch: netlink: VXLAN extension 54 out of range max 1 [ 663.823400][T18601] ip6t_rt: too many addresses specified [ 664.793466][T18616] FAULT_INJECTION: forcing a failure. [ 664.793466][T18616] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 664.793521][T18616] CPU: 3 UID: 0 PID: 18616 Comm: syz.0.3484 Tainted: G L syzkaller #0 PREEMPT(full) [ 664.793548][T18616] Tainted: [L]=SOFTLOCKUP [ 664.793554][T18616] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 664.793561][T18616] Call Trace: [ 664.793566][T18616] [ 664.793571][T18616] dump_stack_lvl+0x100/0x190 [ 664.793590][T18616] should_fail_ex.cold+0x5/0xa [ 664.793606][T18616] _copy_from_iter+0x1f4/0x1690 [ 664.793620][T18616] ? __asan_memset+0x23/0x50 [ 664.793639][T18616] ? __pfx__copy_from_iter+0x10/0x10 [ 664.793650][T18616] ? __pfx___alloc_skb+0x10/0x10 [ 664.793669][T18616] netlink_sendmsg+0x808/0xda0 [ 664.793691][T18616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 664.793710][T18616] ? apparmor_socket_sendmsg+0x165/0x280 [ 664.793725][T18616] ____sys_sendmsg+0xa4d/0xbe0 [ 664.793738][T18616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 664.793757][T18616] ? __pfx_____sys_sendmsg+0x10/0x10 [ 664.793779][T18616] ___sys_sendmsg+0x190/0x1e0 [ 664.793795][T18616] ? __pfx____sys_sendmsg+0x10/0x10 [ 664.793819][T18616] ? find_held_lock+0x2b/0x80 [ 664.793841][T18616] __sys_sendmsg+0x160/0x210 [ 664.793853][T18616] ? __pfx___sys_sendmsg+0x10/0x10 [ 664.793880][T18616] ? __pfx_ksys_write+0x10/0x10 [ 664.793897][T18616] __do_fast_syscall_32+0x13a/0x8b0 [ 664.793912][T18616] ? lockdep_hardirqs_on+0x7d/0x110 [ 664.793926][T18616] do_fast_syscall_32+0x32/0x70 [ 664.793940][T18616] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 664.793955][T18616] RIP: 0023:0xf7f77fec [ 664.793969][T18616] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 664.793975][T18616] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 664.793987][T18616] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800001c0 [ 664.793995][T18616] RDX: 0000000000040000 RSI: 0000000000000000 RDI: 0000000000000000 [ 664.794002][T18616] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 664.794008][T18616] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 664.794015][T18616] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 664.794029][T18616] [ 666.126377][T18630] FAULT_INJECTION: forcing a failure. [ 666.126377][T18630] name failslab, interval 1, probability 0, space 0, times 0 [ 666.126443][T18630] CPU: 1 UID: 0 PID: 18630 Comm: syz.2.3487 Tainted: G L syzkaller #0 PREEMPT(full) [ 666.126472][T18630] Tainted: [L]=SOFTLOCKUP [ 666.126478][T18630] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 666.126485][T18630] Call Trace: [ 666.126490][T18630] [ 666.126495][T18630] dump_stack_lvl+0x100/0x190 [ 666.126514][T18630] should_fail_ex.cold+0x5/0xa [ 666.126529][T18630] should_failslab+0xc2/0x120 [ 666.126543][T18630] kmem_cache_alloc_noprof+0x92/0x6a0 [ 666.126556][T18630] ? fuse_request_alloc+0x22/0x200 [ 666.126572][T18630] fuse_request_alloc+0x22/0x200 [ 666.126583][T18630] fuse_get_req+0x20a/0x400 [ 666.126596][T18630] ? __pfx_fuse_get_req+0x10/0x10 [ 666.126608][T18630] ? __pfx_autoremove_wake_function+0x10/0x10 [ 666.126624][T18630] ? __pfx_from_kgid+0x10/0x10 [ 666.126642][T18630] fuse_chan_send+0x259/0x9c0 [ 666.126660][T18630] __fuse_simple_request+0x18e/0x1e0 [ 666.126676][T18630] fuse_removexattr+0x1a7/0x320 [ 666.126690][T18630] ? __pfx_fuse_removexattr+0x10/0x10 [ 666.126717][T18630] ? try_to_unlazy+0x296/0x910 [ 666.126746][T18630] fuse_set_acl+0x43d/0x610 [ 666.126760][T18630] ? __pfx_fuse_set_acl+0x10/0x10 [ 666.126773][T18630] ? make_vfsgid+0xf1/0x140 [ 666.126793][T18630] set_posix_acl+0x263/0x320 [ 666.126808][T18630] vfs_set_acl+0x411/0x9e0 [ 666.126821][T18630] ? mnt_get_write_access+0x52/0x2f0 [ 666.126839][T18630] do_set_acl+0x14c/0x1a0 [ 666.126853][T18630] do_setxattr+0xeb/0x180 [ 666.126867][T18630] filename_setxattr+0x167/0x1d0 [ 666.126881][T18630] ? __pfx_filename_setxattr+0x10/0x10 [ 666.126896][T18630] ? do_getname+0x191/0x390 [ 666.126913][T18630] path_setxattrat+0x1ff/0x3b0 [ 666.126926][T18630] ? __pfx_path_setxattrat+0x10/0x10 [ 666.126942][T18630] ? rcu_read_lock_any_held+0x6a/0x90 [ 666.126954][T18630] ? find_held_lock+0x2b/0x80 [ 666.126982][T18630] ? fput+0x7c/0x100 [ 666.126995][T18630] ? ksys_write+0x1ac/0x250 [ 666.127007][T18630] __ia32_sys_setxattr+0xc4/0x140 [ 666.127021][T18630] ? __do_fast_syscall_32+0xb3/0x8b0 [ 666.127035][T18630] ? lockdep_hardirqs_on+0x7d/0x110 [ 666.127048][T18630] __do_fast_syscall_32+0x13a/0x8b0 [ 666.127061][T18630] ? lockdep_hardirqs_on+0x7d/0x110 [ 666.127075][T18630] do_fast_syscall_32+0x32/0x70 [ 666.127089][T18630] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 666.127105][T18630] RIP: 0023:0xf709efec [ 666.127120][T18630] Code: Unable to access opcode bytes at 0xf709efc2. [ 666.127125][T18630] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 00000000000000e2 [ 666.127137][T18630] RAX: ffffffffffffffda RBX: 00000000800000c0 RCX: 0000000080002800 [ 666.127144][T18630] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 666.127151][T18630] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 666.127158][T18630] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 666.127164][T18630] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 666.127179][T18630] [ 666.545098][T18634] ip6t_rt: too many addresses specified [ 667.380727][ T43] kauditd_printk_skb: 102 callbacks suppressed [ 667.380806][ T43] audit: type=1804 audit(2000000456.089:966): pid=18644 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.3489" name="/newroot/268/bus/bus" dev="overlay" ino=1487 res=1 errno=0 [ 668.054591][T18653] openvswitch: netlink: VXLAN extension 54 out of range max 1 [ 668.069111][T18655] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3501'. [ 668.128828][T18658] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3494'. [ 668.980241][T18679] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 668.983284][T18679] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 668.986129][T18679] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3500'. [ 669.052209][T18687] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3500'. [ 669.058143][T18685] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 669.061088][T18685] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 669.528471][T18696] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3504'. [ 670.379160][T18717] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3510'. [ 670.379210][T18717] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3510'. [ 670.569936][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x4fac instead [ 670.572018][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x08a0 instead [ 670.572034][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000008: 0x0121 instead [ 670.572045][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000000c: 0xcc8a instead [ 670.572056][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000010: 0x272c instead [ 670.572068][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000014: 0xae14 instead [ 670.572078][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0x310e instead [ 670.572089][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000001c: 0x0336 instead [ 670.572099][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000020: 0x0f7c instead [ 670.572110][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000024: 0x58d7 instead [ 670.572123][T18719] jffs2: Further such events for this erase block will not be printed [ 670.572385][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001000: 0x0a60 instead [ 670.572397][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001004: 0xb9b7 instead [ 670.572407][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001008: 0xa7b5 instead [ 670.572418][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000100c: 0x64c5 instead [ 670.572429][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001010: 0xd7bf instead [ 670.572439][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001014: 0xe7f6 instead [ 670.572449][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001018: 0x120b instead [ 670.572459][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000101c: 0xdb1e instead [ 670.572470][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001020: 0xc5a5 instead [ 670.572480][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001024: 0x6eed instead [ 670.572491][T18719] jffs2: Further such events for this erase block will not be printed [ 670.572769][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002000: 0xb641 instead [ 670.572779][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002004: 0xd825 instead [ 670.572789][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002008: 0x2d83 instead [ 670.572799][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000200c: 0x8781 instead [ 670.572808][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002010: 0xac91 instead [ 670.572818][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002014: 0xf497 instead [ 670.572828][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002018: 0xbbc9 instead [ 670.572837][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000201c: 0x6d18 instead [ 670.572847][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002020: 0xa0df instead [ 670.572856][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002024: 0x3464 instead [ 670.572865][T18719] jffs2: Further such events for this erase block will not be printed [ 670.573314][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003000: 0x5643 instead [ 670.573334][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003004: 0xb742 instead [ 670.573350][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003008: 0x5885 instead [ 670.573367][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000300c: 0x7a28 instead [ 670.573384][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003010: 0x91a2 instead [ 670.573400][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003014: 0x57fe instead [ 670.573416][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003018: 0x91c0 instead [ 670.573431][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000301c: 0x5077 instead [ 670.573447][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003020: 0xcb84 instead [ 670.573461][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003024: 0x2db3 instead [ 670.573476][T18719] jffs2: Further such events for this erase block will not be printed [ 670.573830][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004000: 0xb4fc instead [ 670.573847][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004004: 0xf612 instead [ 670.573863][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004008: 0x290b instead [ 670.573877][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000400c: 0x4012 instead [ 670.573894][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004010: 0xb1f5 instead [ 670.573908][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004014: 0xc7fd instead [ 670.573924][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004018: 0x1d96 instead [ 670.573937][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000401c: 0x063b instead [ 670.573951][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004020: 0x5754 instead [ 670.573965][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004024: 0x5d49 instead [ 670.573978][T18719] jffs2: Further such events for this erase block will not be printed [ 670.574452][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005000: 0x90d2 instead [ 670.574469][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005004: 0x58b1 instead [ 670.574484][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005008: 0x9dc7 instead [ 670.574500][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000500c: 0x2a8c instead [ 670.574515][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005010: 0xb144 instead [ 670.574530][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005014: 0x72e6 instead [ 670.574546][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005018: 0xf1c4 instead [ 670.574560][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000501c: 0x6b81 instead [ 670.574576][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005020: 0xfa6e instead [ 670.574590][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005024: 0x845f instead [ 670.574604][T18719] jffs2: Further such events for this erase block will not be printed [ 670.574970][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006000: 0x5201 instead [ 670.574988][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006004: 0xfe41 instead [ 670.575003][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006008: 0xb87e instead [ 670.575017][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000600c: 0xb474 instead [ 670.575028][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006010: 0x7f30 instead [ 670.575037][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006014: 0x1598 instead [ 670.575046][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006018: 0xb8a0 instead [ 670.575054][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000601c: 0x8e75 instead [ 670.575063][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006020: 0x6923 instead [ 670.575072][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006024: 0x5e8d instead [ 670.575081][T18719] jffs2: Further such events for this erase block will not be printed [ 670.575972][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007000: 0xb09c instead [ 670.575993][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007004: 0xd361 instead [ 670.576008][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007008: 0x615c instead [ 670.576023][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000700c: 0x667b instead [ 670.576038][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007010: 0xa435 instead [ 670.576053][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007014: 0x8a9b instead [ 670.576068][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007018: 0x9608 instead [ 670.576083][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000701c: 0x81d6 instead [ 670.576098][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007020: 0xe44a instead [ 670.576113][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007024: 0x7ba2 instead [ 670.576127][T18719] jffs2: Further such events for this erase block will not be printed [ 670.576486][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008000: 0x69fa instead [ 670.576599][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008004: 0x1899 instead [ 670.576615][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008008: 0x3c2b instead [ 670.576630][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000800c: 0xa0da instead [ 670.576645][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008010: 0x7472 instead [ 670.576660][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008014: 0xf818 instead [ 670.576675][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008018: 0x14c7 instead [ 670.576831][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000801c: 0x23d0 instead [ 670.576843][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008020: 0x7db0 instead [ 670.576852][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008024: 0x24a3 instead [ 670.576862][T18719] jffs2: Further such events for this erase block will not be printed [ 670.577160][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009000: 0x9d61 instead [ 670.577172][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009004: 0xa736 instead [ 670.577182][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009008: 0x7497 instead [ 670.577191][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000900c: 0xe940 instead [ 670.577200][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009010: 0x120f instead [ 670.577210][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009014: 0x5656 instead [ 670.577219][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009018: 0x6312 instead [ 670.577228][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000901c: 0xa685 instead [ 670.577238][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009020: 0x2df2 instead [ 670.577248][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009024: 0xc3a2 instead [ 670.577257][T18719] jffs2: Further such events for this erase block will not be printed [ 670.577597][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a000: 0xb7d5 instead [ 670.577611][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a004: 0xda35 instead [ 670.577621][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a008: 0xf522 instead [ 670.578665][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a00c: 0xb732 instead [ 670.578677][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a010: 0xf58a instead [ 670.578687][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a014: 0x47a8 instead [ 670.578697][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a018: 0x3cc2 instead [ 670.578707][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a01c: 0xf51f instead [ 670.578716][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a020: 0x74ff instead [ 670.578772][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a024: 0x433f instead [ 670.578783][T18719] jffs2: Further such events for this erase block will not be printed [ 670.579754][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b000: 0xe3d4 instead [ 670.579767][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b004: 0x7211 instead [ 670.579777][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b008: 0x8b59 instead [ 670.579786][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b00c: 0x9b9d instead [ 670.579795][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b010: 0x1df4 instead [ 670.579804][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b014: 0x8261 instead [ 670.579813][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b018: 0x4afa instead [ 670.579822][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b01c: 0x1fa2 instead [ 670.579831][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b020: 0x6c54 instead [ 670.579840][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b024: 0x35d5 instead [ 670.579848][T18719] jffs2: Further such events for this erase block will not be printed [ 670.580698][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c000: 0x44de instead [ 670.580709][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c004: 0x34be instead [ 670.580717][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c008: 0x71e4 instead [ 670.580726][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c00c: 0x3527 instead [ 670.580735][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c010: 0x6de9 instead [ 670.580743][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c014: 0xbca7 instead [ 670.580752][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c018: 0xd8b2 instead [ 670.580761][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c01c: 0x204e instead [ 670.580769][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c020: 0x5f91 instead [ 670.580778][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c024: 0x59cc instead [ 670.580787][T18719] jffs2: Further such events for this erase block will not be printed [ 670.581030][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d000: 0xf83f instead [ 670.581040][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d004: 0xd61a instead [ 670.581048][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d008: 0xf680 instead [ 670.581057][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d00c: 0xac48 instead [ 670.581066][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d010: 0x9776 instead [ 670.581075][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d014: 0x7518 instead [ 670.581083][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d018: 0x1b56 instead [ 670.581092][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d01c: 0xea10 instead [ 670.581101][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d020: 0xcf40 instead [ 670.581110][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d024: 0x838a instead [ 670.581118][T18719] jffs2: Further such events for this erase block will not be printed [ 670.582662][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e000: 0xb541 instead [ 670.582674][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e004: 0x0ebe instead [ 670.582683][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e008: 0xb7a0 instead [ 670.582691][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e00c: 0xd6a9 instead [ 670.582700][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e010: 0x3519 instead [ 670.582709][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e014: 0x8333 instead [ 670.582718][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e018: 0x5286 instead [ 670.582727][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e01c: 0x1bf5 instead [ 670.582736][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e020: 0x81d5 instead [ 670.582745][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e024: 0xa702 instead [ 670.582754][T18719] jffs2: Further such events for this erase block will not be printed [ 670.582998][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f000: 0x2394 instead [ 670.583007][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f004: 0x6484 instead [ 670.583015][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f008: 0x416d instead [ 670.583024][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f00c: 0x221c instead [ 670.583033][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f010: 0x3a69 instead [ 670.583042][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f014: 0xe5e3 instead [ 670.583050][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f018: 0xc48d instead [ 670.583059][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f01c: 0x80b3 instead [ 670.583068][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f020: 0x21ef instead [ 670.583077][T18719] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f024: 0x7717 instead [ 670.583085][T18719] jffs2: Further such events for this erase block will not be printed [ 670.584997][T18719] jffs2: notice: (18719) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 671.301653][T18732] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3515'. [ 671.304785][ T43] audit: type=1326 audit(2000000460.009:967): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18729 comm="syz.3.3516" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 671.304944][ T43] audit: type=1326 audit(2000000460.009:968): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18729 comm="syz.3.3516" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 671.309129][ T43] audit: type=1326 audit(2000000460.019:969): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18729 comm="syz.3.3516" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 671.309379][ T43] audit: type=1326 audit(2000000460.019:970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18729 comm="syz.3.3516" exe="/syz-executor" sig=0 arch=40000003 syscall=171 compat=1 ip=0xf704efec code=0x7ffc0000 [ 671.309402][ T43] audit: type=1326 audit(2000000460.019:971): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18729 comm="syz.3.3516" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 671.309421][ T43] audit: type=1326 audit(2000000460.019:972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18729 comm="syz.3.3516" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 671.309544][ T43] audit: type=1326 audit(2000000460.019:973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18729 comm="syz.3.3516" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 671.310479][ T43] audit: type=1326 audit(2000000460.019:974): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18729 comm="syz.3.3516" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 671.310506][ T43] audit: type=1326 audit(2000000460.019:975): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18729 comm="syz.3.3516" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 671.324743][T18730] XFS (nullb0): Invalid superblock magic number [ 671.373759][T18738] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3515'. [ 672.178510][T18762] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3530'. [ 672.219937][T13330] kernel read not supported for file /dsp1 (pid: 13330 comm: kworker/0:7) [ 672.476002][T18774] FAULT_INJECTION: forcing a failure. [ 672.476002][T18774] name failslab, interval 1, probability 0, space 0, times 0 [ 672.476051][T18774] CPU: 0 UID: 0 PID: 18774 Comm: syz.0.3533 Tainted: G L syzkaller #0 PREEMPT(full) [ 672.476078][T18774] Tainted: [L]=SOFTLOCKUP [ 672.476084][T18774] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 672.476091][T18774] Call Trace: [ 672.476095][T18774] [ 672.476100][T18774] dump_stack_lvl+0x100/0x190 [ 672.476118][T18774] should_fail_ex.cold+0x5/0xa [ 672.476133][T18774] should_failslab+0xc2/0x120 [ 672.476147][T18774] __kmalloc_cache_noprof+0x91/0x6d0 [ 672.476165][T18774] ? bpf_uprobe_multi_link_attach+0xf6c/0x1510 [ 672.476181][T18774] bpf_uprobe_multi_link_attach+0xf6c/0x1510 [ 672.476193][T18774] ? find_held_lock+0x2b/0x80 [ 672.476208][T18774] ? __pfx_bpf_uprobe_multi_link_attach+0x10/0x10 [ 672.476219][T18774] ? __fget_files+0x21f/0x3d0 [ 672.476234][T18774] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 672.476252][T18774] __sys_bpf+0x427a/0x4a30 [ 672.476266][T18774] ? __pfx___sys_bpf+0x10/0x10 [ 672.476276][T18774] ? lock_acquire+0x1d1/0x380 [ 672.476290][T18774] ? get_pid_task+0x2a/0x250 [ 672.476301][T18774] ? find_held_lock+0x2b/0x80 [ 672.476312][T18774] ? get_pid_task+0xfc/0x250 [ 672.476322][T18774] ? get_pid_task+0xfc/0x250 [ 672.476337][T18774] ? proc_fail_nth_write+0x9f/0x220 [ 672.476355][T18774] ? find_held_lock+0x2b/0x80 [ 672.476369][T18774] ? rcu_read_lock_any_held+0x6a/0x90 [ 672.476381][T18774] ? find_held_lock+0x2b/0x80 [ 672.476392][T18774] ? ksys_write+0x190/0x250 [ 672.476402][T18774] ? ksys_write+0x190/0x250 [ 672.476412][T18774] ? lock_acquire+0x1d1/0x380 [ 672.476436][T18774] ? fput+0x7c/0x100 [ 672.476450][T18774] ? __ia32_sys_bpf+0xcc/0x170 [ 672.476460][T18774] __ia32_sys_bpf+0xcc/0x170 [ 672.476472][T18774] ? __do_fast_syscall_32+0xb3/0x8b0 [ 672.476487][T18774] __do_fast_syscall_32+0x13a/0x8b0 [ 672.476500][T18774] ? lockdep_hardirqs_on+0x7d/0x110 [ 672.476514][T18774] do_fast_syscall_32+0x32/0x70 [ 672.476528][T18774] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 672.476542][T18774] RIP: 0023:0xf7f77fec [ 672.476556][T18774] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 672.476562][T18774] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 672.476573][T18774] RAX: ffffffffffffffda RBX: 000000000000001c RCX: 00000000800003c0 [ 672.476581][T18774] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 672.476587][T18774] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 672.476594][T18774] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 672.476601][T18774] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 672.476615][T18774] [ 674.024312][T18814] FAULT_INJECTION: forcing a failure. [ 674.024312][T18814] name failslab, interval 1, probability 0, space 0, times 0 [ 674.024384][T18814] CPU: 2 UID: 0 PID: 18814 Comm: syz.0.3540 Tainted: G L syzkaller #0 PREEMPT(full) [ 674.024423][T18814] Tainted: [L]=SOFTLOCKUP [ 674.024432][T18814] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 674.024443][T18814] Call Trace: [ 674.024451][T18814] [ 674.024459][T18814] dump_stack_lvl+0x100/0x190 [ 674.024487][T18814] should_fail_ex.cold+0x5/0xa [ 674.024511][T18814] should_failslab+0xc2/0x120 [ 674.024532][T18814] __kmalloc_cache_noprof+0x91/0x6d0 [ 674.024559][T18814] ? ucma_write_cm_event+0x16a/0x6b0 [ 674.024582][T18814] ucma_write_cm_event+0x16a/0x6b0 [ 674.024605][T18814] ? __pfx_ucma_write_cm_event+0x10/0x10 [ 674.024631][T18814] ? aa_file_perm+0x7e4/0x14d0 [ 674.024689][T18814] ? __pfx_ucma_write_cm_event+0x10/0x10 [ 674.024711][T18814] ucma_write+0x1fb/0x330 [ 674.024730][T18814] ? __pfx_ucma_write+0x10/0x10 [ 674.024747][T18814] ? bpf_lsm_file_permission+0x9/0x10 [ 674.024770][T18814] ? security_file_permission+0x76/0x210 [ 674.024792][T18814] ? rw_verify_area+0xce/0x6d0 [ 674.024819][T18814] vfs_write+0x2aa/0x1050 [ 674.024837][T18814] ? __pfx_ucma_write+0x10/0x10 [ 674.024854][T18814] ? lock_acquire+0x1d1/0x380 [ 674.024877][T18814] ? __fget_files+0x34/0x3d0 [ 674.024895][T18814] ? __pfx_vfs_write+0x10/0x10 [ 674.024919][T18814] ? find_held_lock+0x2b/0x80 [ 674.024953][T18814] ? __fget_files+0x215/0x3d0 [ 674.024970][T18814] ? __fget_files+0x215/0x3d0 [ 674.024993][T18814] ? __fget_files+0x21f/0x3d0 [ 674.025019][T18814] ksys_write+0x1f8/0x250 [ 674.025037][T18814] ? __pfx_ksys_write+0x10/0x10 [ 674.025054][T18814] ? ksys_write+0x1ac/0x250 [ 674.025069][T18814] ? __pfx_ksys_write+0x10/0x10 [ 674.025092][T18814] __do_fast_syscall_32+0x13a/0x8b0 [ 674.025116][T18814] ? lockdep_hardirqs_on+0x7d/0x110 [ 674.025140][T18814] do_fast_syscall_32+0x32/0x70 [ 674.025161][T18814] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 674.025184][T18814] RIP: 0023:0xf7f77fec [ 674.025207][T18814] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 674.025215][T18814] RSP: 002b:00000000f541550c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 674.025232][T18814] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000cc0 [ 674.025244][T18814] RDX: 0000000000000118 RSI: 0000000000000000 RDI: 0000000000000000 [ 674.025255][T18814] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 674.025266][T18814] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 674.025277][T18814] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 674.025302][T18814] [ 674.129717][T14629] kernel read not supported for file /dsp1 (pid: 14629 comm: kworker/1:5) [ 674.237163][ T5814] usb 7-1: new high-speed USB device number 109 using dummy_hcd [ 674.407643][ T5814] usb 7-1: Using ep0 maxpacket: 8 [ 674.409100][ T5814] usb 7-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 674.410201][ T5814] usb 7-1: config 0 has an invalid interface number: 186 but max is 0 [ 674.410223][ T5814] usb 7-1: config 0 has no interface number 0 [ 674.410256][ T5814] usb 7-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 674.410268][ T5814] usb 7-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 674.410281][ T5814] usb 7-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 674.410294][ T5814] usb 7-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 674.410308][ T5814] usb 7-1: config 0 interface 186 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 674.410319][ T5814] usb 7-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 674.412074][ T5814] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.412087][ T5814] usb 7-1: Product: syz [ 674.412094][ T5814] usb 7-1: Manufacturer: syz [ 674.412102][ T5814] usb 7-1: SerialNumber: syz [ 674.414618][ T5814] usb 7-1: config 0 descriptor?? [ 674.618301][ T5814] iowarrior 7-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0 [ 674.792754][T18825] __nla_validate_parse: 6 callbacks suppressed [ 674.792814][T18825] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3545'. [ 674.818493][T18813] iowarrior 7-1:0.186: Error -90 while submitting URB [ 674.850609][T18828] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3545'. [ 674.888347][ T5813] usb 7-1: USB disconnect, device number 109 [ 674.950594][ T43] kauditd_printk_skb: 33 callbacks suppressed [ 674.953149][ T43] audit: type=1800 audit(2000000463.659:1009): pid=18836 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3549" name="(" dev="sda1" ino=2043 res=0 errno=0 [ 674.971607][T18834] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3543'. [ 674.971660][T18834] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3543'. [ 675.507429][T18849] FAULT_INJECTION: forcing a failure. [ 675.507429][T18849] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 675.511592][T18849] CPU: 2 UID: 0 PID: 18849 Comm: syz.2.3555 Tainted: G L syzkaller #0 PREEMPT(full) [ 675.511611][T18849] Tainted: [L]=SOFTLOCKUP [ 675.511616][T18849] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 675.511623][T18849] Call Trace: [ 675.511628][T18849] [ 675.511633][T18849] dump_stack_lvl+0x100/0x190 [ 675.511651][T18849] should_fail_ex.cold+0x5/0xa [ 675.511666][T18849] _copy_to_user+0x32/0xd0 [ 675.511686][T18849] drm_ioctl+0x608/0xc60 [ 675.511702][T18849] ? __pfx_drm_mode_rmfb_ioctl+0x10/0x10 [ 675.511719][T18849] ? __pfx_drm_ioctl+0x10/0x10 [ 675.511741][T18849] drm_compat_ioctl+0x386/0x4c0 [ 675.511760][T18849] ? __pfx_drm_compat_ioctl+0x10/0x10 [ 675.511782][T18849] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 675.511808][T18849] __do_fast_syscall_32+0x13a/0x8b0 [ 675.511828][T18849] ? lockdep_hardirqs_on+0x7d/0x110 [ 675.511850][T18849] do_fast_syscall_32+0x32/0x70 [ 675.511870][T18849] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 675.511885][T18849] RIP: 0023:0xf709efec [ 675.511899][T18849] Code: Unable to access opcode bytes at 0xf709efc2. [ 675.511904][T18849] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 675.511916][T18849] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c00464af [ 675.511923][T18849] RDX: 0000000080000280 RSI: 0000000000000000 RDI: 0000000000000000 [ 675.511930][T18849] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 675.511937][T18849] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 675.511943][T18849] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 675.511959][T18849] [ 676.113249][T18876] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3566'. [ 676.634964][T18907] netlink: 'syz.2.3579': attribute type 4 has an invalid length. [ 676.865981][T18923] FAULT_INJECTION: forcing a failure. [ 676.865981][T18923] name failslab, interval 1, probability 0, space 0, times 0 [ 676.866038][T18923] CPU: 1 UID: 0 PID: 18923 Comm: syz.2.3587 Tainted: G L syzkaller #0 PREEMPT(full) [ 676.866066][T18923] Tainted: [L]=SOFTLOCKUP [ 676.866071][T18923] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 676.866078][T18923] Call Trace: [ 676.866083][T18923] [ 676.866088][T18923] dump_stack_lvl+0x100/0x190 [ 676.866106][T18923] should_fail_ex.cold+0x5/0xa [ 676.866121][T18923] should_failslab+0xc2/0x120 [ 676.866136][T18923] __kmalloc_cache_noprof+0x91/0x6d0 [ 676.866152][T18923] ? binder_get_thread+0x1c7/0x850 [ 676.866171][T18923] ? binder_get_thread+0x201/0x850 [ 676.866191][T18923] binder_get_thread+0x201/0x850 [ 676.866210][T18923] binder_poll+0x3f/0x430 [ 676.866227][T18923] ? __pfx_binder_poll+0x10/0x10 [ 676.866244][T18923] do_select+0xd54/0x1850 [ 676.866266][T18923] ? __pfx_do_select+0x10/0x10 [ 676.866276][T18923] ? __lock_acquire+0x4c5/0x1ec0 [ 676.866291][T18923] ? __pfx___pollwait+0x10/0x10 [ 676.866311][T18923] ? __pfx_pollwake+0x10/0x10 [ 676.866329][T18923] ? __pfx_pollwake+0x10/0x10 [ 676.866347][T18923] ? __pfx_pollwake+0x10/0x10 [ 676.866365][T18923] ? __pfx_pollwake+0x10/0x10 [ 676.866384][T18923] ? __pfx_pollwake+0x10/0x10 [ 676.866402][T18923] ? __pfx_pollwake+0x10/0x10 [ 676.866427][T18923] ? _kstrtoull+0x144/0x200 [ 676.866441][T18923] ? lock_acquire+0x1d1/0x380 [ 676.866455][T18923] ? compat_core_sys_select+0xeb/0x8b0 [ 676.866466][T18923] ? find_held_lock+0x2b/0x80 [ 676.866477][T18923] ? compat_core_sys_select+0x1e6/0x8b0 [ 676.866488][T18923] ? compat_core_sys_select+0x1e6/0x8b0 [ 676.866501][T18923] ? compat_core_sys_select+0x68a/0x8b0 [ 676.866511][T18923] compat_core_sys_select+0x68a/0x8b0 [ 676.866526][T18923] ? __pfx_compat_core_sys_select+0x10/0x10 [ 676.866576][T18923] ? get_pid_task+0x2a/0x250 [ 676.866600][T18923] ? get_pid_task+0xfc/0x250 [ 676.866622][T18923] ? __pfx_set_compat_user_sigmask+0x10/0x10 [ 676.866640][T18923] ? __pfx_vfs_write+0x10/0x10 [ 676.866652][T18923] do_compat_pselect+0x27a/0x2b0 [ 676.866665][T18923] ? __pfx_do_compat_pselect+0x10/0x10 [ 676.866676][T18923] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 676.866694][T18923] __ia32_compat_sys_pselect6_time32+0x152/0x1c0 [ 676.866710][T18923] __do_fast_syscall_32+0x13a/0x8b0 [ 676.866724][T18923] ? lockdep_hardirqs_on+0x7d/0x110 [ 676.866738][T18923] do_fast_syscall_32+0x32/0x70 [ 676.866751][T18923] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 676.866767][T18923] RIP: 0023:0xf709efec [ 676.866782][T18923] Code: Unable to access opcode bytes at 0xf709efc2. [ 676.866787][T18923] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000134 [ 676.866822][T18923] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 00000000800000c0 [ 676.866829][T18923] RDX: 0000000000000000 RSI: 0000000080000140 RDI: 0000000000000000 [ 676.866836][T18923] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 676.866842][T18923] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 676.866849][T18923] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 676.866864][T18923] [ 677.125677][T18931] random: crng reseeded on system resumption [ 677.129619][T18931] FAULT_INJECTION: forcing a failure. [ 677.129619][T18931] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 677.129662][T18931] CPU: 2 UID: 0 PID: 18931 Comm: syz.0.3591 Tainted: G L syzkaller #0 PREEMPT(full) [ 677.129689][T18931] Tainted: [L]=SOFTLOCKUP [ 677.129695][T18931] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 677.129703][T18931] Call Trace: [ 677.129707][T18931] [ 677.129712][T18931] dump_stack_lvl+0x100/0x190 [ 677.129731][T18931] should_fail_ex.cold+0x5/0xa [ 677.129746][T18931] _copy_from_user+0x2e/0xd0 [ 677.129765][T18931] kstrtouint_from_user+0xd6/0x1d0 [ 677.129779][T18931] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 677.129796][T18931] ? lock_acquire+0x1d1/0x380 [ 677.129815][T18931] proc_fail_nth_write+0x83/0x220 [ 677.129833][T18931] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 677.129855][T18931] vfs_write+0x2aa/0x1050 [ 677.129866][T18931] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 677.129884][T18931] ? lock_acquire+0x1d1/0x380 [ 677.129898][T18931] ? __fget_files+0x34/0x3d0 [ 677.129910][T18931] ? __pfx_vfs_write+0x10/0x10 [ 677.129919][T18931] ? find_held_lock+0x2b/0x80 [ 677.129931][T18931] ? __fget_files+0x215/0x3d0 [ 677.129944][T18931] ? __fget_files+0x21f/0x3d0 [ 677.129959][T18931] ksys_write+0x12a/0x250 [ 677.129970][T18931] ? __pfx_ksys_write+0x10/0x10 [ 677.129984][T18931] do_int80_emulation+0x166/0x650 [ 677.130001][T18931] asm_int80_emulation+0x1a/0x20 [ 677.130012][T18931] RIP: 0023:0xf71775ab [ 677.130022][T18931] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 677.130032][T18931] RSP: 002b:00000000f54364bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 677.130044][T18931] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54365d0 [ 677.130051][T18931] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 677.130057][T18931] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 677.130064][T18931] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 677.130072][T18931] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 677.130087][T18931] [ 677.854064][T18954] ip6t_rt: too many addresses specified [ 678.312891][T18961] ip6t_rt: too many addresses specified [ 678.646729][T18969] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3603'. [ 679.529281][T18977] random: crng reseeded on system resumption [ 679.981469][T19002] ip6t_rt: too many addresses specified [ 680.634473][T19012] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 680.643677][T19012] kvm: pic: non byte read [ 680.654246][T19012] kvm: pic: level sensitive irq not supported [ 680.655008][T19012] kvm: pic: non byte read [ 680.657085][T19012] kvm: pic: level sensitive irq not supported [ 680.657807][T19012] kvm: pic: non byte read [ 680.660064][T19012] kvm: pic: level sensitive irq not supported [ 680.661297][T19012] kvm: pic: non byte read [ 680.663274][T19012] kvm: pic: level sensitive irq not supported [ 680.663896][T19012] kvm: pic: non byte read [ 680.665218][T19012] kvm: pic: level sensitive irq not supported [ 680.665575][T19012] kvm: pic: non byte read [ 680.757159][T19021] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 680.797221][T19026] Invalid logical block size (18) [ 680.840995][T19027] FAULT_INJECTION: forcing a failure. [ 680.840995][T19027] name failslab, interval 1, probability 0, space 0, times 0 [ 680.841302][T19027] CPU: 2 UID: 0 PID: 19027 Comm: syz.1.3622 Tainted: G L syzkaller #0 PREEMPT(full) [ 680.841331][T19027] Tainted: [L]=SOFTLOCKUP [ 680.841340][T19027] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 680.841351][T19027] Call Trace: [ 680.841358][T19027] [ 680.841366][T19027] dump_stack_lvl+0x100/0x190 [ 680.841392][T19027] should_fail_ex.cold+0x5/0xa [ 680.841408][T19027] should_failslab+0xc2/0x120 [ 680.841436][T19027] __kmalloc_noprof+0xfc/0x840 [ 680.841451][T19027] ? rcu_is_watching+0x13/0xc0 [ 680.841462][T19027] ? tomoyo_realpath_from_path+0xb6/0x690 [ 680.841483][T19027] tomoyo_realpath_from_path+0xb6/0x690 [ 680.841509][T19027] tomoyo_path_number_perm+0x23c/0x580 [ 680.841530][T19027] ? tomoyo_path_number_perm+0x22e/0x580 [ 680.841553][T19027] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 680.841575][T19027] ? get_pid_task+0x106/0x250 [ 680.841597][T19027] ? __lock_acquire+0x4c5/0x1ec0 [ 680.841633][T19027] ? __fget_files+0x34/0x3d0 [ 680.841653][T19027] ? find_held_lock+0x2b/0x80 [ 680.841671][T19027] ? __fget_files+0x215/0x3d0 [ 680.841686][T19027] ? hook_file_ioctl_common+0x140/0x440 [ 680.841705][T19027] ? __fget_files+0x215/0x3d0 [ 680.841728][T19027] ? __fget_files+0x21f/0x3d0 [ 680.841751][T19027] security_file_ioctl_compat+0xd3/0x230 [ 680.841775][T19027] __ia32_compat_sys_ioctl+0xc2/0x360 [ 680.841806][T19027] __do_fast_syscall_32+0x13a/0x8b0 [ 680.841829][T19027] ? lockdep_hardirqs_on+0x7d/0x110 [ 680.841849][T19027] do_fast_syscall_32+0x32/0x70 [ 680.841877][T19027] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 680.841900][T19027] RIP: 0023:0xf7fe5fec [ 680.841920][T19027] Code: Unable to access opcode bytes at 0xf7fe5fc2. [ 680.841927][T19027] RSP: 002b:00000000f548550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 680.841946][T19027] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 000000000000ae80 [ 680.841958][T19027] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 680.841970][T19027] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 680.841981][T19027] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 680.841992][T19027] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 680.842018][T19027] [ 680.842072][T19027] ERROR: Out of memory at tomoyo_realpath_from_path. [ 680.850978][T19027] kvm: pic: non byte read [ 680.853303][T19027] kvm: pic: level sensitive irq not supported [ 680.853741][T19027] kvm: pic: non byte read [ 680.855348][T19027] kvm: pic: level sensitive irq not supported [ 680.855761][T19027] kvm: pic: non byte read [ 680.858610][T19027] kvm: pic: level sensitive irq not supported [ 680.859149][T19027] kvm: pic: non byte read [ 680.861941][T19027] kvm: pic: level sensitive irq not supported [ 680.871833][T19027] kvm: pic: level sensitive irq not supported [ 681.392963][ T42] kernel read not supported for file /dummy_udc (pid: 42 comm: kworker/2:1) [ 682.535276][T19085] netlink: 'syz.1.3646': attribute type 2 has an invalid length. [ 682.585427][T19085] : entered promiscuous mode [ 683.323309][ T43] audit: type=1326 audit(2000000472.029:1010): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19105 comm="syz.2.3653" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 683.323397][ T43] audit: type=1326 audit(2000000472.029:1011): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19105 comm="syz.2.3653" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 683.323733][ T43] audit: type=1326 audit(2000000472.029:1012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19105 comm="syz.2.3653" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 683.323802][ T43] audit: type=1326 audit(2000000472.029:1013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19105 comm="syz.2.3653" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 683.323997][ T43] audit: type=1326 audit(2000000472.029:1014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19105 comm="syz.2.3653" exe="/syz-executor" sig=0 arch=40000003 syscall=171 compat=1 ip=0xf709efec code=0x7ffc0000 [ 683.324324][ T43] audit: type=1326 audit(2000000472.029:1015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19105 comm="syz.2.3653" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 683.324382][ T43] audit: type=1326 audit(2000000472.029:1016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19105 comm="syz.2.3653" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 683.324441][ T43] audit: type=1326 audit(2000000472.029:1017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19105 comm="syz.2.3653" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 683.324499][ T43] audit: type=1326 audit(2000000472.029:1018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19105 comm="syz.2.3653" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 683.324556][ T43] audit: type=1326 audit(2000000472.029:1019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19105 comm="syz.2.3653" exe="/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf709efec code=0x7ffc0000 [ 683.336947][T19106] XFS (nullb0): Invalid superblock magic number [ 683.812289][T19119] virt_wifi0: left promiscuous mode [ 683.827235][ T6719] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 683.827354][ T6719] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 683.827435][ T6719] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 683.827467][ T6719] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 684.573248][T19152] XFS (nullb0): Invalid superblock magic number [ 684.818967][ T65] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 684.970362][T19182] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3673'. [ 685.040048][T19186] XFS (nullb0): Invalid superblock magic number [ 685.237935][T19200] jffs2: notice: (19200) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 685.386674][T19213] block2mtd: too many arguments [ 685.398861][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.400945][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.379226][T19259] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3702'. [ 686.414057][T19269] binder: Binderfs stats mode cannot be changed during a remount [ 686.589571][T19278] FAULT_INJECTION: forcing a failure. [ 686.589571][T19278] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 686.589654][T19278] CPU: 2 UID: 0 PID: 19278 Comm: syz.0.3707 Tainted: G L syzkaller #0 PREEMPT(full) [ 686.589698][T19278] Tainted: [L]=SOFTLOCKUP [ 686.589707][T19278] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 686.589719][T19278] Call Trace: [ 686.589727][T19278] [ 686.589736][T19278] dump_stack_lvl+0x100/0x190 [ 686.589767][T19278] should_fail_ex.cold+0x5/0xa [ 686.589792][T19278] _copy_from_user+0x2e/0xd0 [ 686.589825][T19278] bond_do_ioctl+0x454/0x700 [ 686.589849][T19278] ? __pfx_bond_do_ioctl+0x10/0x10 [ 686.589881][T19278] ? stack_trace_save+0x8e/0xc0 [ 686.589906][T19278] ? __pfx_stack_trace_save+0x10/0x10 [ 686.589931][T19278] ? stack_depot_save_flags+0x27/0x9f0 [ 686.589962][T19278] ? kasan_save_free_info+0x3b/0x70 [ 686.589991][T19278] ? __kasan_slab_free+0x5f/0x80 [ 686.590013][T19278] ? kfree+0x22b/0x6d0 [ 686.590047][T19278] ? tomoyo_path_number_perm+0x46d/0x580 [ 686.590072][T19278] ? security_file_ioctl_compat+0xd3/0x230 [ 686.590095][T19278] ? __ia32_compat_sys_ioctl+0xc2/0x360 [ 686.590122][T19278] ? __do_fast_syscall_32+0x13a/0x8b0 [ 686.590146][T19278] ? do_fast_syscall_32+0x32/0x70 [ 686.590171][T19278] bond_siocdevprivate+0x1fc/0x210 [ 686.590188][T19278] ? __pfx_bond_siocdevprivate+0x10/0x10 [ 686.590209][T19278] ? full_name_hash+0xbc/0x100 [ 686.590232][T19278] ? netdev_name_node_lookup+0x107/0x150 [ 686.590263][T19278] dev_ifsioc+0xc2f/0x1f10 [ 686.590284][T19278] ? __pfx_dev_ifsioc+0x10/0x10 [ 686.590302][T19278] ? __pfx___mutex_lock+0x10/0x10 [ 686.590324][T19278] ? lock_acquire+0x1d1/0x380 [ 686.590347][T19278] ? dev_load+0x8e/0x240 [ 686.590361][T19278] ? dev_load+0x8e/0x240 [ 686.590382][T19278] dev_ioctl+0x70e/0x1070 [ 686.590401][T19278] sock_ioctl+0x494/0x6b0 [ 686.590426][T19278] ? __pfx_sock_ioctl+0x10/0x10 [ 686.590456][T19278] ? do_vfs_ioctl+0x226/0x13e0 [ 686.590485][T19278] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 686.590513][T19278] ? __pfx_unix_compat_ioctl+0x10/0x10 [ 686.590537][T19278] ? unix_ioctl+0x9c/0x570 [ 686.590568][T19278] compat_sock_ioctl+0x400/0x760 [ 686.590599][T19278] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 686.590623][T19278] ? hook_file_ioctl_common+0x140/0x440 [ 686.590653][T19278] ? __fget_files+0x21f/0x3d0 [ 686.590679][T19278] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 686.590707][T19278] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 686.590741][T19278] __do_fast_syscall_32+0x13a/0x8b0 [ 686.590765][T19278] ? lockdep_hardirqs_on+0x7d/0x110 [ 686.590788][T19278] do_fast_syscall_32+0x32/0x70 [ 686.590811][T19278] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 686.590835][T19278] RIP: 0023:0xf7f77fec [ 686.590857][T19278] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 686.590866][T19278] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 686.590886][T19278] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000000089fb [ 686.590899][T19278] RDX: 0000000080000340 RSI: 0000000000000000 RDI: 0000000000000000 [ 686.590912][T19278] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 686.590924][T19278] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 686.590935][T19278] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 686.590958][T19278] [ 687.655575][T19295] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3714'. [ 687.706717][T19307] FAULT_INJECTION: forcing a failure. [ 687.706717][T19307] name failslab, interval 1, probability 0, space 0, times 0 [ 687.706785][T19307] CPU: 2 UID: 0 PID: 19307 Comm: syz.2.3718 Tainted: G L syzkaller #0 PREEMPT(full) [ 687.706819][T19307] Tainted: [L]=SOFTLOCKUP [ 687.706828][T19307] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 687.706836][T19307] Call Trace: [ 687.706841][T19307] [ 687.706846][T19307] dump_stack_lvl+0x100/0x190 [ 687.706869][T19307] should_fail_ex.cold+0x5/0xa [ 687.706887][T19307] should_failslab+0xc2/0x120 [ 687.706913][T19307] kmem_cache_alloc_noprof+0x92/0x6a0 [ 687.706927][T19307] ? raw6_local_deliver+0x124/0xaf0 [ 687.706947][T19307] ? skb_clone+0x190/0x400 [ 687.706965][T19307] skb_clone+0x190/0x400 [ 687.706993][T19307] raw6_local_deliver+0x373/0xaf0 [ 687.707027][T19307] ip6_protocol_deliver_rcu+0x241/0x15b0 [ 687.707070][T19307] ? __pfx_nf_hook.constprop.0+0x10/0x10 [ 687.707102][T19307] ip6_input_finish+0x1e4/0x4a0 [ 687.707126][T19307] ip6_input+0x105/0x2f0 [ 687.707148][T19307] ip6_mc_input+0x513/0x1050 [ 687.707172][T19307] ? __pfx_ip6_mc_input+0x10/0x10 [ 687.707193][T19307] ? ip6_rcv_finish_core.isra.0+0x113/0x1260 [ 687.707210][T19307] ? __pfx_ip6_mc_input+0x10/0x10 [ 687.707224][T19307] ipv6_rcv+0x34c/0x3d0 [ 687.707238][T19307] ? __pfx_ipv6_rcv+0x10/0x10 [ 687.707251][T19307] __netif_receive_skb_one_core+0x12d/0x1e0 [ 687.707272][T19307] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 687.707292][T19307] ? lock_acquire+0x1d1/0x380 [ 687.707341][T19307] __netif_receive_skb+0x1f/0x120 [ 687.707361][T19307] netif_receive_skb+0x139/0x7d0 [ 687.707387][T19307] ? __pfx_netif_receive_skb+0x10/0x10 [ 687.707426][T19307] tun_rx_batched.isra.0+0x3f6/0x750 [ 687.707455][T19307] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 687.707481][T19307] ? tun_get_user+0x1e1e/0x3cc0 [ 687.707497][T19307] tun_get_user+0x1f53/0x3cc0 [ 687.707516][T19307] ? __lock_acquire+0x4c5/0x1ec0 [ 687.707532][T19307] ? __pfx_tun_get_user+0x10/0x10 [ 687.707546][T19307] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 687.707568][T19307] ? find_held_lock+0x2b/0x80 [ 687.707580][T19307] ? tun_get+0x191/0x370 [ 687.707591][T19307] ? tun_get+0x191/0x370 [ 687.707606][T19307] tun_chr_write_iter+0xdc/0x200 [ 687.707620][T19307] vfs_write+0x6af/0x1050 [ 687.707634][T19307] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 687.707649][T19307] ? __pfx_vfs_write+0x10/0x10 [ 687.707659][T19307] ? find_held_lock+0x2b/0x80 [ 687.707682][T19307] ksys_write+0x12a/0x250 [ 687.707693][T19307] ? __pfx_ksys_write+0x10/0x10 [ 687.707709][T19307] do_int80_emulation+0x166/0x650 [ 687.707735][T19307] asm_int80_emulation+0x1a/0x20 [ 687.707755][T19307] RIP: 0023:0xf71d75ab [ 687.707772][T19307] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 687.707785][T19307] RSP: 002b:00000000f548d44c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 687.707798][T19307] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000440 [ 687.707806][T19307] RDX: 000000000000006e RSI: 0000000000000000 RDI: 0000000000000000 [ 687.707814][T19307] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 687.707821][T19307] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 687.707829][T19307] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 687.707845][T19307] [ 687.816158][T19315] FAULT_INJECTION: forcing a failure. [ 687.816158][T19315] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 687.816226][T19315] CPU: 1 UID: 0 PID: 19315 Comm: syz.0.3721 Tainted: G L syzkaller #0 PREEMPT(full) [ 687.816260][T19315] Tainted: [L]=SOFTLOCKUP [ 687.816266][T19315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 687.816275][T19315] Call Trace: [ 687.816280][T19315] [ 687.816286][T19315] dump_stack_lvl+0x100/0x190 [ 687.816309][T19315] should_fail_ex.cold+0x5/0xa [ 687.816326][T19315] _copy_from_user+0x2e/0xd0 [ 687.816350][T19315] memdup_user+0x6b/0xe0 [ 687.816371][T19315] kvm_arch_vcpu_ioctl+0x2322/0x3a10 [ 687.816389][T19315] ? is_bpf_text_address+0x94/0x1a0 [ 687.816407][T19315] ? kernel_text_address+0x8d/0x100 [ 687.816435][T19315] ? __pfx_widen_string+0x10/0x10 [ 687.816456][T19315] ? __kernel_text_address+0xd/0x30 [ 687.816472][T19315] ? unwind_get_return_address+0x59/0xa0 [ 687.816489][T19315] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 687.816513][T19315] ? __lock_acquire+0x4c5/0x1ec0 [ 687.816534][T19315] ? stack_depot_save_flags+0x27/0x9f0 [ 687.816550][T19315] ? __lock_acquire+0x4c5/0x1ec0 [ 687.816583][T19315] ? lock_acquire+0x1d1/0x380 [ 687.816604][T19315] ? kvm_vcpu_ioctl+0x322/0x1700 [ 687.816624][T19315] ? rcu_is_watching+0x13/0xc0 [ 687.816636][T19315] ? trace_contention_end+0x126/0x160 [ 687.816656][T19315] ? __mutex_lock+0x26c/0x1bc0 [ 687.816672][T19315] ? kvm_vcpu_ioctl+0x322/0x1700 [ 687.816691][T19315] ? __pfx___mutex_lock+0x10/0x10 [ 687.816719][T19315] ? kvm_vcpu_ioctl+0x8a0/0x1700 [ 687.816734][T19315] kvm_vcpu_ioctl+0x8a0/0x1700 [ 687.816752][T19315] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 687.816769][T19315] ? tomoyo_path_number_perm+0x188/0x580 [ 687.816788][T19315] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 687.816805][T19315] ? get_pid_task+0x106/0x250 [ 687.816822][T19315] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 687.816842][T19315] ? do_vfs_ioctl+0x226/0x13e0 [ 687.816862][T19315] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 687.816886][T19315] ? __fget_files+0x34/0x3d0 [ 687.816901][T19315] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 687.816916][T19315] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 687.816934][T19315] ? __fget_files+0x21f/0x3d0 [ 687.816949][T19315] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 687.816965][T19315] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 687.816985][T19315] __do_fast_syscall_32+0x13a/0x8b0 [ 687.817000][T19315] ? lockdep_hardirqs_on+0x7d/0x110 [ 687.817015][T19315] do_fast_syscall_32+0x32/0x70 [ 687.817031][T19315] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 687.817046][T19315] RIP: 0023:0xf7f77fec [ 687.817062][T19315] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 687.817068][T19315] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 687.817081][T19315] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000004140aecd [ 687.817089][T19315] RDX: 0000000080000480 RSI: 0000000000000000 RDI: 0000000000000000 [ 687.817096][T19315] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 687.817103][T19315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 687.817112][T19315] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 687.817135][T19315] [ 688.376787][ T43] kauditd_printk_skb: 90 callbacks suppressed [ 688.376850][ T43] audit: type=1326 audit(2000000477.079:1110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19333 comm="syz.0.3728" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 688.378105][ T43] audit: type=1326 audit(2000000477.089:1111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19333 comm="syz.0.3728" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 688.379262][ T43] audit: type=1326 audit(2000000477.089:1112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19333 comm="syz.0.3728" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 688.379309][ T43] audit: type=1326 audit(2000000477.089:1113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19333 comm="syz.0.3728" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 688.379816][ T43] audit: type=1326 audit(2000000477.089:1114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19333 comm="syz.0.3728" exe="/syz-executor" sig=0 arch=40000003 syscall=171 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 688.379846][ T43] audit: type=1326 audit(2000000477.089:1115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19333 comm="syz.0.3728" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 688.379866][ T43] audit: type=1326 audit(2000000477.089:1116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19333 comm="syz.0.3728" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 688.379957][ T43] audit: type=1326 audit(2000000477.089:1117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19333 comm="syz.0.3728" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 688.380515][ T43] audit: type=1326 audit(2000000477.089:1118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19333 comm="syz.0.3728" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 688.380539][ T43] audit: type=1326 audit(2000000477.089:1119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19333 comm="syz.0.3728" exe="/syz-executor" sig=0 arch=40000003 syscall=21 compat=1 ip=0xf7f77fec code=0x7ffc0000 [ 688.383197][T19334] XFS (nullb0): Invalid superblock magic number [ 689.239176][T19368] XFS (nullb0): Invalid superblock magic number [ 689.572093][T19388] FAULT_INJECTION: forcing a failure. [ 689.572093][T19388] name failslab, interval 1, probability 0, space 0, times 0 [ 689.572152][T19388] CPU: 0 UID: 0 PID: 19388 Comm: syz.2.3744 Tainted: G L syzkaller #0 PREEMPT(full) [ 689.572181][T19388] Tainted: [L]=SOFTLOCKUP [ 689.572187][T19388] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 689.572194][T19388] Call Trace: [ 689.572199][T19388] [ 689.572204][T19388] dump_stack_lvl+0x100/0x190 [ 689.572222][T19388] should_fail_ex.cold+0x5/0xa [ 689.572237][T19388] should_failslab+0xc2/0x120 [ 689.572251][T19388] __kmalloc_noprof+0xfc/0x840 [ 689.572262][T19388] ? rcu_is_watching+0x13/0xc0 [ 689.572274][T19388] ? tomoyo_realpath_from_path+0xb6/0x690 [ 689.572293][T19388] tomoyo_realpath_from_path+0xb6/0x690 [ 689.572313][T19388] tomoyo_path_number_perm+0x23c/0x580 [ 689.572326][T19388] ? tomoyo_path_number_perm+0x22e/0x580 [ 689.572341][T19388] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 689.572355][T19388] ? get_pid_task+0x106/0x250 [ 689.572370][T19388] ? __lock_acquire+0x4c5/0x1ec0 [ 689.572391][T19388] ? __fget_files+0x34/0x3d0 [ 689.572402][T19388] ? find_held_lock+0x2b/0x80 [ 689.572413][T19388] ? __fget_files+0x215/0x3d0 [ 689.572425][T19388] ? hook_file_ioctl_common+0x140/0x440 [ 689.572439][T19388] ? __fget_files+0x215/0x3d0 [ 689.572452][T19388] ? __fget_files+0x21f/0x3d0 [ 689.572465][T19388] security_file_ioctl_compat+0xd3/0x230 [ 689.572481][T19388] __ia32_compat_sys_ioctl+0xc2/0x360 [ 689.572500][T19388] __do_fast_syscall_32+0x13a/0x8b0 [ 689.572516][T19388] ? lockdep_hardirqs_on+0x7d/0x110 [ 689.572530][T19388] do_fast_syscall_32+0x32/0x70 [ 689.572544][T19388] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 689.572559][T19388] RIP: 0023:0xf709efec [ 689.572572][T19388] Code: Unable to access opcode bytes at 0xf709efc2. [ 689.572577][T19388] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 689.572595][T19388] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000c0040d07 [ 689.572602][T19388] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 689.572609][T19388] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 689.572615][T19388] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 689.572622][T19388] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 689.572637][T19388] [ 689.574089][T19388] ERROR: Out of memory at tomoyo_realpath_from_path. [ 689.787315][ T5813] usb 8-1: new high-speed USB device number 91 using dummy_hcd [ 689.807249][T13330] usb 7-1: new high-speed USB device number 110 using dummy_hcd [ 689.950295][ T5813] usb 8-1: Using ep0 maxpacket: 16 [ 689.951145][ T5813] usb 8-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 689.952383][ T5813] usb 8-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 689.952421][ T5813] usb 8-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 689.952443][ T5813] usb 8-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 689.952462][ T5813] usb 8-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 689.952491][ T5813] usb 8-1: config 7 interface 0 has no altsetting 0 [ 689.952517][ T5813] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 689.957345][T13330] usb 7-1: Using ep0 maxpacket: 16 [ 689.958135][T13330] usb 7-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 689.959501][T13330] usb 7-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 689.959544][T13330] usb 7-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 689.959564][T13330] usb 7-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 689.959576][T13330] usb 7-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 689.959590][T13330] usb 7-1: config 7 interface 0 has no altsetting 0 [ 689.959608][T13330] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 690.277360][ T42] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 690.367334][ T5813] hid (null): invalid report_size 1734701673 [ 690.373390][ T5813] input: HID 0458:5010 as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:7.0/0003:0458:5010.0014/input/input22 [ 690.378964][T13330] hid (null): invalid report_size 1734701673 [ 690.390113][T13330] input: HID 0458:5010 as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:7.0/0003:0458:5010.0015/input/input23 [ 690.427419][ T42] usb 6-1: Using ep0 maxpacket: 16 [ 690.428693][ T42] usb 6-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 690.430002][ T42] usb 6-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 690.430100][ T42] usb 6-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 690.430123][ T42] usb 6-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 690.430142][ T42] usb 6-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 690.430165][ T42] usb 6-1: config 7 interface 0 has no altsetting 0 [ 690.430189][ T42] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 690.581719][ T5813] kye 0003:0458:5010.0014: input,hiddev0,hidraw1: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.3-1/input0 [ 690.600794][T13330] kye 0003:0458:5010.0015: input,hiddev1,hidraw2: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.2-1/input0 [ 690.673599][T13330] usb 7-1: USB disconnect, device number 110 [ 690.689256][T14629] usb 8-1: USB disconnect, device number 91 [ 690.702357][T19402] fido_id[19402]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb8/8-1/report_descriptor': No such file or directory [ 690.709287][T19403] fido_id[19403]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb7/7-1/report_descriptor': No such file or directory [ 690.855112][ T42] hid (null): invalid report_size 1734701673 [ 690.863151][ T42] input: HID 0458:5010 as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:7.0/0003:0458:5010.0016/input/input24 [ 690.948982][ T42] kye 0003:0458:5010.0016: input,hiddev0,hidraw1: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.1-1/input0 [ 691.080434][ T5814] usb 6-1: USB disconnect, device number 50 [ 691.243724][T19406] XFS (nullb0): Invalid superblock magic number [ 692.022524][T19428] jffs2: notice: (19428) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 692.156476][T19431] FAULT_INJECTION: forcing a failure. [ 692.156476][T19431] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 692.156548][T19431] CPU: 1 UID: 0 PID: 19431 Comm: syz.0.3757 Tainted: G L syzkaller #0 PREEMPT(full) [ 692.156586][T19431] Tainted: [L]=SOFTLOCKUP [ 692.156594][T19431] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 692.156606][T19431] Call Trace: [ 692.156612][T19431] [ 692.156620][T19431] dump_stack_lvl+0x100/0x190 [ 692.156646][T19431] should_fail_ex.cold+0x5/0xa [ 692.156667][T19431] _copy_from_iter+0x1f4/0x1690 [ 692.156687][T19431] ? __asan_memset+0x23/0x50 [ 692.156715][T19431] ? __pfx__copy_from_iter+0x10/0x10 [ 692.156731][T19431] ? __pfx___alloc_skb+0x10/0x10 [ 692.156751][T19431] ? aa_sk_perm+0x389/0xab0 [ 692.156777][T19431] netlink_sendmsg+0x808/0xda0 [ 692.156807][T19431] ? __pfx_netlink_sendmsg+0x10/0x10 [ 692.156834][T19431] ? apparmor_socket_sendmsg+0x165/0x280 [ 692.156856][T19431] ____sys_sendmsg+0xa4d/0xbe0 [ 692.156882][T19431] ? __pfx_netlink_sendmsg+0x10/0x10 [ 692.156909][T19431] ? __pfx_____sys_sendmsg+0x10/0x10 [ 692.156941][T19431] ___sys_sendmsg+0x190/0x1e0 [ 692.156965][T19431] ? __pfx____sys_sendmsg+0x10/0x10 [ 692.156999][T19431] ? find_held_lock+0x2b/0x80 [ 692.157031][T19431] __sys_sendmsg+0x160/0x210 [ 692.157066][T19431] ? __pfx___sys_sendmsg+0x10/0x10 [ 692.157090][T19431] ? __pfx_ksys_write+0x10/0x10 [ 692.157113][T19431] __do_fast_syscall_32+0x13a/0x8b0 [ 692.157134][T19431] ? lockdep_hardirqs_on+0x7d/0x110 [ 692.157155][T19431] do_fast_syscall_32+0x32/0x70 [ 692.157176][T19431] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 692.157197][T19431] RIP: 0023:0xf7f77fec [ 692.157217][T19431] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 692.157224][T19431] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 692.157242][T19431] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080004740 [ 692.157254][T19431] RDX: 0000000000008000 RSI: 0000000000000000 RDI: 0000000000000000 [ 692.157264][T19431] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 692.157274][T19431] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 692.157285][T19431] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 692.157307][T19431] [ 692.242515][T19434] FAULT_INJECTION: forcing a failure. [ 692.242515][T19434] name failslab, interval 1, probability 0, space 0, times 0 [ 692.242537][T19434] CPU: 1 UID: 0 PID: 19434 Comm: syz.0.3758 Tainted: G L syzkaller #0 PREEMPT(full) [ 692.242553][T19434] Tainted: [L]=SOFTLOCKUP [ 692.242558][T19434] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 692.242565][T19434] Call Trace: [ 692.242570][T19434] [ 692.242575][T19434] dump_stack_lvl+0x100/0x190 [ 692.242594][T19434] should_fail_ex.cold+0x5/0xa [ 692.242610][T19434] should_failslab+0xc2/0x120 [ 692.242625][T19434] __kvmalloc_node_noprof+0x113/0x9b0 [ 692.242638][T19434] ? __might_fault+0xc5/0x140 [ 692.242657][T19434] ? vmemdup_user+0x2a/0xe0 [ 692.242677][T19434] vmemdup_user+0x2a/0xe0 [ 692.242711][T19434] kvm_vm_ioctl+0x144e/0x42d0 [ 692.242733][T19434] ? tomoyo_path_number_perm+0x46d/0x580 [ 692.242748][T19434] ? stack_trace_save+0x8e/0xc0 [ 692.242762][T19434] ? __pfx_stack_trace_save+0x10/0x10 [ 692.242777][T19434] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 692.242794][T19434] ? __lock_acquire+0x4c5/0x1ec0 [ 692.242811][T19434] ? tomoyo_path_number_perm+0x46d/0x580 [ 692.242825][T19434] ? kasan_save_stack+0x3f/0x50 [ 692.242838][T19434] ? kasan_save_stack+0x30/0x50 [ 692.242850][T19434] ? kasan_save_track+0x14/0x30 [ 692.242862][T19434] ? kasan_save_free_info+0x3b/0x70 [ 692.242879][T19434] ? __kasan_slab_free+0x5f/0x80 [ 692.242892][T19434] ? kfree+0x22b/0x6d0 [ 692.242908][T19434] ? tomoyo_path_number_perm+0x46d/0x580 [ 692.242921][T19434] ? security_file_ioctl_compat+0xd3/0x230 [ 692.242935][T19434] ? __ia32_compat_sys_ioctl+0xc2/0x360 [ 692.242953][T19434] ? __do_fast_syscall_32+0x13a/0x8b0 [ 692.242967][T19434] ? kvm_arch_vm_compat_ioctl+0x2d0/0x470 [ 692.242990][T19434] ? __pfx_kvm_arch_vm_compat_ioctl+0x10/0x10 [ 692.243021][T19434] ? kasan_quarantine_put+0x104/0x240 [ 692.243034][T19434] ? lockdep_hardirqs_on+0x7d/0x110 [ 692.243048][T19434] ? find_held_lock+0x2b/0x80 [ 692.243059][T19434] ? tomoyo_path_number_perm+0x28f/0x580 [ 692.243073][T19434] ? tomoyo_path_number_perm+0x28f/0x580 [ 692.243090][T19434] ? tomoyo_path_number_perm+0x188/0x580 [ 692.243105][T19434] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 692.243120][T19434] ? get_pid_task+0x106/0x250 [ 692.243136][T19434] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 692.243153][T19434] ? do_vfs_ioctl+0x226/0x13e0 [ 692.243170][T19434] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 692.243189][T19434] kvm_vm_compat_ioctl+0x2f7/0x3f0 [ 692.243207][T19434] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 692.243225][T19434] ? __fget_files+0x34/0x3d0 [ 692.243237][T19434] ? find_held_lock+0x2b/0x80 [ 692.243247][T19434] ? __fget_files+0x215/0x3d0 [ 692.243258][T19434] ? hook_file_ioctl_common+0x140/0x440 [ 692.243293][T19434] ? __fget_files+0x21f/0x3d0 [ 692.243308][T19434] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 692.243327][T19434] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 692.243346][T19434] __do_fast_syscall_32+0x13a/0x8b0 [ 692.243359][T19434] ? lockdep_hardirqs_on+0x7d/0x110 [ 692.243372][T19434] do_fast_syscall_32+0x32/0x70 [ 692.243386][T19434] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 692.243400][T19434] RIP: 0023:0xf7f77fec [ 692.243414][T19434] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 692.243419][T19434] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 692.243430][T19434] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000004008ae6a [ 692.243438][T19434] RDX: 0000000080000c80 RSI: 0000000000000000 RDI: 0000000000000000 [ 692.243445][T19434] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 692.243451][T19434] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 692.243458][T19434] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 692.243472][T19434] [ 692.274930][T19435] batman_adv: batadv0: Adding interface: veth0 [ 692.274941][T19435] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 692.275016][T19435] batman_adv: batadv0: Interface activated: veth0 [ 692.284807][T19435] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3756'. [ 692.405853][T19444] FAULT_INJECTION: forcing a failure. [ 692.405853][T19444] name failslab, interval 1, probability 0, space 0, times 0 [ 692.405874][T19444] CPU: 1 UID: 0 PID: 19444 Comm: syz.2.3762 Tainted: G L syzkaller #0 PREEMPT(full) [ 692.405896][T19444] Tainted: [L]=SOFTLOCKUP [ 692.405901][T19444] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 692.405908][T19444] Call Trace: [ 692.405913][T19444] [ 692.405918][T19444] dump_stack_lvl+0x100/0x190 [ 692.405937][T19444] should_fail_ex.cold+0x5/0xa [ 692.405952][T19444] should_failslab+0xc2/0x120 [ 692.405966][T19444] __kmalloc_noprof+0xfc/0x840 [ 692.405978][T19444] ? dma_resv_list_alloc+0x26/0x80 [ 692.405998][T19444] dma_resv_list_alloc+0x26/0x80 [ 692.406014][T19444] dma_resv_reserve_fences+0x2d3/0x8b0 [ 692.406031][T19444] ? find_held_lock+0x2b/0x80 [ 692.406043][T19444] ? __fget_files+0x215/0x3d0 [ 692.406056][T19444] ? __pfx_dma_resv_reserve_fences+0x10/0x10 [ 692.406074][T19444] ? __pfx___might_resched+0x10/0x10 [ 692.406092][T19444] dma_buf_ioctl+0x67b/0x8a0 [ 692.406110][T19444] ? __pfx_dma_buf_ioctl+0x10/0x10 [ 692.406129][T19444] ? find_held_lock+0x2b/0x80 [ 692.406139][T19444] ? __fget_files+0x215/0x3d0 [ 692.406150][T19444] ? hook_file_ioctl_common+0x140/0x440 [ 692.406167][T19444] ? __fget_files+0x21f/0x3d0 [ 692.406180][T19444] ? __pfx_dma_buf_ioctl+0x10/0x10 [ 692.406197][T19444] compat_ptr_ioctl+0x6e/0xa0 [ 692.406213][T19444] ? __pfx_compat_ptr_ioctl+0x10/0x10 [ 692.406229][T19444] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 692.406247][T19444] __do_fast_syscall_32+0x13a/0x8b0 [ 692.406261][T19444] ? lockdep_hardirqs_on+0x7d/0x110 [ 692.406275][T19444] do_fast_syscall_32+0x32/0x70 [ 692.406289][T19444] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 692.406303][T19444] RIP: 0023:0xf709efec [ 692.406316][T19444] Code: Unable to access opcode bytes at 0xf709efc2. [ 692.406321][T19444] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 692.406348][T19444] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000040086203 [ 692.406356][T19444] RDX: 00000000800001c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 692.406363][T19444] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 692.406369][T19444] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 692.406376][T19444] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 692.406391][T19444] [ 692.531030][T19446] XFS (nullb0): Invalid superblock magic number [ 692.668321][T19441] cgroup: fork rejected by pids controller in /syz0 [ 692.822410][T19489] syz_tun: entered allmulticast mode [ 692.827149][T19488] syz_tun: left allmulticast mode [ 693.211100][T19504] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3769'. [ 693.383227][T19511] XFS (nullb0): Invalid superblock magic number [ 693.712471][T19535] netlink: 892 bytes leftover after parsing attributes in process `syz.1.3778'. [ 693.877197][T13330] usb 8-1: new high-speed USB device number 92 using dummy_hcd [ 693.894682][T19539] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3780'. [ 693.968209][T19550] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3782'. [ 693.968889][T19550] FAULT_INJECTION: forcing a failure. [ 693.968889][T19550] name failslab, interval 1, probability 0, space 0, times 0 [ 693.968917][T19550] CPU: 3 UID: 0 PID: 19550 Comm: syz.2.3782 Tainted: G L syzkaller #0 PREEMPT(full) [ 693.968945][T19550] Tainted: [L]=SOFTLOCKUP [ 693.968953][T19550] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 693.968965][T19550] Call Trace: [ 693.968973][T19550] [ 693.968980][T19550] dump_stack_lvl+0x100/0x190 [ 693.969012][T19550] should_fail_ex.cold+0x5/0xa [ 693.969039][T19550] should_failslab+0xc2/0x120 [ 693.969063][T19550] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 693.969084][T19550] ? __do_fast_syscall_32+0x13a/0x8b0 [ 693.969107][T19550] ? do_fast_syscall_32+0x32/0x70 [ 693.969130][T19550] ? __d_alloc+0x35/0xa50 [ 693.969158][T19550] __d_alloc+0x35/0xa50 [ 693.969182][T19550] d_alloc_parallel+0x105/0x14c0 [ 693.969215][T19550] ? lock_acquire+0x1d1/0x380 [ 693.969239][T19550] ? __d_lookup+0x73/0x4a0 [ 693.969266][T19550] ? __pfx_d_alloc_parallel+0x10/0x10 [ 693.969292][T19550] ? __d_lookup+0x25c/0x4a0 [ 693.969323][T19550] ? __d_lookup+0x266/0x4a0 [ 693.969355][T19550] lookup_open+0x6bb/0x1990 [ 693.969393][T19550] path_openat+0xa2c/0x2440 [ 693.969419][T19550] ? __pfx_path_openat+0x10/0x10 [ 693.969447][T19550] do_file_open+0x20e/0x430 [ 693.969471][T19550] ? __pfx_do_file_open+0x10/0x10 [ 693.969518][T19550] ? _raw_spin_unlock+0x28/0x50 [ 693.969538][T19550] ? alloc_fd+0x471/0x7a0 [ 693.969567][T19550] do_sys_openat2+0x10f/0x1e0 [ 693.969594][T19550] ? __pfx_do_sys_openat2+0x10/0x10 [ 693.969622][T19550] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 693.969653][T19550] __ia32_compat_sys_openat+0x12d/0x210 [ 693.969680][T19550] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 693.969717][T19550] __do_fast_syscall_32+0x13a/0x8b0 [ 693.969738][T19550] ? lockdep_hardirqs_on+0x7d/0x110 [ 693.969764][T19550] do_fast_syscall_32+0x32/0x70 [ 693.969787][T19550] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 693.969811][T19550] RIP: 0023:0xf709efec [ 693.969832][T19550] Code: Unable to access opcode bytes at 0xf709efc2. [ 693.969841][T19550] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 693.969861][T19550] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000040 [ 693.969874][T19550] RDX: 0000000000143142 RSI: 0000000000000103 RDI: 0000000000000000 [ 693.969887][T19550] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 693.969900][T19550] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 693.969912][T19550] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 693.969939][T19550] [ 694.007786][T13330] usb 8-1: device descriptor read/64, error -71 [ 694.132006][T19561] XFS (nullb0): Invalid superblock magic number [ 694.247608][T13330] usb 8-1: new high-speed USB device number 93 using dummy_hcd [ 694.365471][T19579] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3791'. [ 694.380723][T13330] usb 8-1: device descriptor read/64, error -71 [ 694.405708][T19581] [ 694.406796][T19581] ====================================================== [ 694.409702][T19581] WARNING: possible circular locking dependency detected [ 694.412512][T19581] syzkaller #0 Tainted: G L [ 694.415193][T19581] ------------------------------------------------------ [ 694.418104][T19581] syz.2.3792/19581 is trying to acquire lock: [ 694.420930][T19581] ffff88802a9c5e80 (&buffer->mutex){+.+.}-{4:4}, at: configfs_read_iter+0x79/0x6f0 [ 694.425177][T19581] [ 694.425177][T19581] but task is already holding lock: [ 694.428577][T19581] ffff88801d7e9500 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x5ab/0x2350 [ 694.432830][T19581] [ 694.432830][T19581] which lock already depends on the new lock. [ 694.432830][T19581] [ 694.437009][T19581] [ 694.437009][T19581] the existing dependency chain (in reverse order) is: [ 694.440897][T19581] [ 694.440897][T19581] -> #6 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 694.445053][T19581] lock_acquire+0x1d1/0x380 [ 694.447286][T19581] __mutex_lock+0x1a4/0x1bc0 [ 694.449719][T19581] process_measurement+0x5ab/0x2350 [ 694.452004][T19581] ima_file_check+0xcc/0x120 [ 694.454104][T19581] security_file_post_open+0xc4/0x210 [ 694.456545][T19581] path_openat+0x5cd/0x2440 [ 694.458622][T19581] do_file_open+0x20e/0x430 [ 694.460891][T19581] file_open_name+0x1c3/0x3e0 [ 694.463256][T19581] filp_open+0x2e/0x50 [ 694.465362][T19581] kernel_read_file_from_path_initns+0xec/0x240 [ 694.468081][T19581] _request_firmware+0x733/0x13c0 [ 694.470417][T19581] request_firmware+0x35/0x50 [ 694.472554][T19581] reg_reload_regdb+0x85/0x460 [ 694.474806][T19581] genl_family_rcv_msg_doit+0x214/0x300 [ 694.477314][T19581] genl_rcv_msg+0x560/0x800 [ 694.479387][T19581] netlink_rcv_skb+0x159/0x420 [ 694.481593][T19581] genl_rcv+0x28/0x40 [ 694.483812][T19581] netlink_unicast+0x585/0x850 [ 694.486401][T19581] netlink_sendmsg+0x8b0/0xda0 [ 694.488703][T19581] ____sys_sendmsg+0xa4d/0xbe0 [ 694.490838][T19581] ___sys_sendmsg+0x190/0x1e0 [ 694.492969][T19581] __sys_sendmsg+0x160/0x210 [ 694.494991][T19581] __do_fast_syscall_32+0x13a/0x8b0 [ 694.497363][T19581] do_fast_syscall_32+0x32/0x70 [ 694.499589][T19581] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 694.502348][T19581] [ 694.502348][T19581] -> #5 (cb_lock){++++}-{4:4}: [ 694.505210][T19581] lock_acquire+0x1d1/0x380 [ 694.507332][T19581] down_read+0x99/0x4c0 [ 694.509555][T19581] genl_rcv+0x19/0x40 [ 694.511956][T19581] netlink_unicast+0x585/0x850 [ 694.514479][T19581] netlink_sendmsg+0x8b0/0xda0 [ 694.516732][T19581] sock_sendmsg+0x394/0x410 [ 694.518823][T19581] splice_to_socket+0xb3c/0x11a0 [ 694.521087][T19581] do_splice+0x109c/0x1fa0 [ 694.523125][T19581] __do_splice+0x33b/0x370 [ 694.525226][T19581] __ia32_sys_splice+0x189/0x250 [ 694.527615][T19581] __do_fast_syscall_32+0x13a/0x8b0 [ 694.529945][T19581] do_fast_syscall_32+0x32/0x70 [ 694.532169][T19581] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 694.535493][T19581] [ 694.535493][T19581] -> #4 (&pipe->mutex){+.+.}-{4:4}: [ 694.538519][T19581] lock_acquire+0x1d1/0x380 [ 694.540608][T19581] __mutex_lock+0x1a4/0x1bc0 [ 694.542671][T19581] pipe_lock+0x69/0x80 [ 694.544685][T19581] iter_file_splice_write+0x1fd/0x10b0 [ 694.547022][T19581] do_splice+0x109c/0x1fa0 [ 694.548973][T19581] __do_splice+0x33b/0x370 [ 694.550972][T19581] __ia32_sys_splice+0x189/0x250 [ 694.553156][T19581] __do_fast_syscall_32+0x13a/0x8b0 [ 694.555497][T19581] do_fast_syscall_32+0x32/0x70 [ 694.557601][T19581] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 694.560668][T19581] [ 694.560668][T19581] -> #3 (sb_writers#5){.+.+}-{0:0}: [ 694.564404][T19581] lock_acquire+0x1d1/0x380 [ 694.566561][T19581] mnt_want_write+0x6f/0x420 [ 694.568513][T19581] lookup_open+0x150/0x1990 [ 694.570554][T19581] path_openat+0xa2c/0x2440 [ 694.572595][T19581] do_file_open+0x20e/0x430 [ 694.574626][T19581] file_open_name+0x1c3/0x3e0 [ 694.576752][T19581] filp_open+0x2e/0x50 [ 694.578562][T19581] nvmet_file_ns_enable+0x95/0x420 [ 694.580918][T19581] nvmet_ns_enable+0x35f/0x5d0 [ 694.583579][T19581] nvmet_ns_enable_store+0x11e/0x160 [ 694.586593][T19581] configfs_write_iter+0x302/0x4e0 [ 694.589129][T19581] vfs_write+0x6af/0x1050 [ 694.591297][T19581] ksys_write+0x12a/0x250 [ 694.593324][T19581] __do_fast_syscall_32+0x13a/0x8b0 [ 694.595645][T19581] do_fast_syscall_32+0x32/0x70 [ 694.597782][T19581] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 694.600555][T19581] [ 694.600555][T19581] -> #2 (&subsys->lock){+.+.}-{4:4}: [ 694.603545][T19581] lock_acquire+0x1d1/0x380 [ 694.605614][T19581] __mutex_lock+0x1a4/0x1bc0 [ 694.607805][T19581] nvmet_ns_device_path_store+0x57/0x1c0 [ 694.610721][T19581] configfs_write_iter+0x302/0x4e0 [ 694.612955][T19581] vfs_write+0x6af/0x1050 [ 694.614530][T19581] ksys_write+0x12a/0x250 [ 694.616082][T19581] __do_fast_syscall_32+0x13a/0x8b0 [ 694.618317][T19581] do_fast_syscall_32+0x32/0x70 [ 694.620292][T19581] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 694.622396][T19581] [ 694.622396][T19581] -> #1 (&p->frag_sem){.+.+}-{4:4}: [ 694.624811][T19581] lock_acquire+0x1d1/0x380 [ 694.626362][T19581] down_read+0x99/0x4c0 [ 694.628045][T19581] configfs_write_iter+0x218/0x4e0 [ 694.630551][T19581] vfs_write+0x6af/0x1050 [ 694.632596][T19581] ksys_write+0x12a/0x250 [ 694.634744][T19581] __do_fast_syscall_32+0x13a/0x8b0 [ 694.637460][T19581] do_fast_syscall_32+0x32/0x70 [ 694.639691][T19581] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 694.642501][T19581] [ 694.642501][T19581] -> #0 (&buffer->mutex){+.+.}-{4:4}: [ 694.645843][T19581] check_prev_add+0xeb/0xe60 [ 694.647964][T19581] __lock_acquire+0x1492/0x1ec0 [ 694.650223][T19581] lock_acquire+0x1d1/0x380 [ 694.652584][T19581] __mutex_lock+0x1a4/0x1bc0 [ 694.655132][T19581] configfs_read_iter+0x79/0x6f0 [ 694.657619][T19581] __kernel_read+0x397/0xad0 [ 694.659751][T19581] integrity_kernel_read+0x7e/0xb0 [ 694.662024][T19581] ima_calc_file_hash_tfm+0x25e/0x350 [ 694.664401][T19581] ima_calc_file_hash+0x1e3/0x380 [ 694.666781][T19581] ima_collect_measurement+0x94f/0xb30 [ 694.669454][T19581] process_measurement+0xdfe/0x2350 [ 694.672011][T19581] ima_file_check+0xcc/0x120 [ 694.674324][T19581] security_file_post_open+0xc4/0x210 [ 694.677429][T19581] path_openat+0x5cd/0x2440 [ 694.679484][T19581] do_file_open+0x20e/0x430 [ 694.681508][T19581] do_sys_openat2+0x10f/0x1e0 [ 694.683640][T19581] __ia32_compat_sys_openat+0x12d/0x210 [ 694.686171][T19581] __do_fast_syscall_32+0x13a/0x8b0 [ 694.688635][T19581] do_fast_syscall_32+0x32/0x70 [ 694.691127][T19581] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 694.694186][T19581] [ 694.694186][T19581] other info that might help us debug this: [ 694.694186][T19581] [ 694.698412][T19581] Chain exists of: [ 694.698412][T19581] &buffer->mutex --> cb_lock --> &ima_iint_mutex_key[depth] [ 694.698412][T19581] [ 694.703643][T19581] Possible unsafe locking scenario: [ 694.703643][T19581] [ 694.706673][T19581] CPU0 CPU1 [ 694.709337][T19581] ---- ---- [ 694.712004][T19581] lock(&ima_iint_mutex_key[depth]); [ 694.714456][T19581] lock(cb_lock); [ 694.717097][T19581] lock(&ima_iint_mutex_key[depth]); [ 694.720312][T19581] lock(&buffer->mutex); [ 694.722114][T19581] [ 694.722114][T19581] *** DEADLOCK *** [ 694.722114][T19581] [ 694.725337][T19581] locks held by syz.2.3792/19581: 1, last CPU#0: [ 694.727940][T19581] #0: ffff88801d7e9500 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x5ab/0x2350 [ 694.733013][T19581] [ 694.733013][T19581] stack backtrace: [ 694.735769][T19581] CPU: 0 UID: 0 PID: 19581 Comm: syz.2.3792 Tainted: G L syzkaller #0 PREEMPT(full) [ 694.740212][T19581] Tainted: [L]=SOFTLOCKUP [ 694.742014][T19581] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 694.746011][T19581] Call Trace: [ 694.747146][ T5814] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 694.750472][T19581] [ 694.751808][T19581] dump_stack_lvl+0x100/0x190 [ 694.753983][T19581] print_circular_bug.cold+0x178/0x1be [ 694.756588][T19581] check_noncircular+0x146/0x160 [ 694.758617][T19581] check_prev_add+0xeb/0xe60 [ 694.760528][T19581] __lock_acquire+0x1492/0x1ec0 [ 694.762528][T19581] ? is_bpf_text_address+0x8a/0x1a0 [ 694.764652][T19581] lock_acquire+0x1d1/0x380 [ 694.766601][T19581] ? configfs_read_iter+0x79/0x6f0 [ 694.768719][T19581] ? __pfx___might_resched+0x10/0x10 [ 694.771048][T19581] ? arch_stack_walk+0xa6/0xf0 [ 694.773255][T19581] __mutex_lock+0x1a4/0x1bc0 [ 694.775288][T19581] ? configfs_read_iter+0x79/0x6f0 [ 694.777386][T19581] ? configfs_read_iter+0x79/0x6f0 [ 694.779421][T19581] ? stack_trace_save+0x8e/0xc0 [ 694.781414][T19581] ? __pfx___mutex_lock+0x10/0x10 [ 694.783468][T19581] ? stack_depot_save_flags+0x27/0x9f0 [ 694.785858][T19581] ? __kasan_kmalloc+0xaa/0xb0 [ 694.788232][T19581] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 694.790806][T19581] ? ima_calc_file_hash_tfm+0x236/0x350 [ 694.793267][T19581] ? ima_calc_file_hash+0x1e3/0x380 [ 694.795431][T19581] ? ima_collect_measurement+0x94f/0xb30 [ 694.797684][T19581] ? process_measurement+0xdfe/0x2350 [ 694.799904][T19581] ? ima_file_check+0xcc/0x120 [ 694.801825][T19581] ? security_file_post_open+0xc4/0x210 [ 694.804100][T19581] ? configfs_read_iter+0x79/0x6f0 [ 694.806408][T19581] configfs_read_iter+0x79/0x6f0 [ 694.808851][T19581] __kernel_read+0x397/0xad0 [ 694.810992][T19581] ? __pfx___kernel_read+0x10/0x10 [ 694.813136][T19581] integrity_kernel_read+0x7e/0xb0 [ 694.815218][T19581] ? __pfx_integrity_kernel_read+0x10/0x10 [ 694.817571][T19581] ? ima_calc_file_hash_tfm+0x236/0x350 [ 694.819934][T19581] ima_calc_file_hash_tfm+0x25e/0x350 [ 694.822406][T19581] ? __pfx_ima_calc_file_hash_tfm+0x10/0x10 [ 694.825387][T19581] ? stack_trace_consume_entry+0x170/0x170 [ 694.827844][T19581] ? look_up_lock_class+0x64/0x120 [ 694.829918][T19581] ? ima_alloc_tfm+0x21a/0x2e0 [ 694.831855][T19581] ima_calc_file_hash+0x1e3/0x380 [ 694.833876][T19581] ima_collect_measurement+0x94f/0xb30 [ 694.836078][T19581] ? __pfx_ima_collect_measurement+0x10/0x10 [ 694.838567][T19581] ? process_measurement+0x5ab/0x2350 [ 694.840883][T19581] ? is_bad_inode+0xd/0x40 [ 694.842844][T19581] ? xattr_resolve_name+0x27d/0x3f0 [ 694.845145][T19581] ? vfs_getxattr_alloc+0xec/0x350 [ 694.847289][T19581] ? ima_get_hash_algo+0x241/0x400 [ 694.849448][T19581] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 694.851728][T19581] ? process_measurement+0xdfe/0x2350 [ 694.854049][T19581] process_measurement+0xdfe/0x2350 [ 694.856422][T19581] ? __pfx_process_measurement+0x10/0x10 [ 694.858815][T19581] ? lock_acquire+0x1d1/0x380 [ 694.860797][T19581] ? __configfs_open_file+0x6ca/0x9c0 [ 694.863006][T19581] ima_file_check+0xcc/0x120 [ 694.865014][T19581] ? __pfx_ima_file_check+0x10/0x10 [ 694.867424][T19581] security_file_post_open+0xc4/0x210 [ 694.870000][T19581] path_openat+0x5cd/0x2440 [ 694.872019][T19581] ? __pfx_path_openat+0x10/0x10 [ 694.874049][T19581] do_file_open+0x20e/0x430 [ 694.875976][T19581] ? __pfx_do_file_open+0x10/0x10 [ 694.878019][T19581] ? _raw_spin_unlock+0x28/0x50 [ 694.880008][T19581] ? alloc_fd+0x471/0x7a0 [ 694.881771][T19581] do_sys_openat2+0x10f/0x1e0 [ 694.883711][T19581] ? __pfx_do_sys_openat2+0x10/0x10 [ 694.885985][T19581] __ia32_compat_sys_openat+0x12d/0x210 [ 694.888546][T19581] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 694.891249][T19581] __do_fast_syscall_32+0x13a/0x8b0 [ 694.893648][T19581] ? lockdep_hardirqs_on+0x7d/0x110 [ 694.895832][T19581] do_fast_syscall_32+0x32/0x70 [ 694.897844][T19581] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 694.900572][T19581] RIP: 0023:0xf709efec [ 694.902331][T19581] Code: Unable to access opcode bytes at 0xf709efc2. [ 694.905085][T19581] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 694.908585][T19581] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080001300 [ 694.912190][T19581] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 694.915411][T19581] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 694.918374][T19581] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 694.921381][T19581] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 694.924978][T19581] [ 694.931050][T13330] usb usb8-port1: attempt power cycle [ 694.933378][ T43] kauditd_printk_skb: 13 callbacks suppressed [ 694.933449][ T43] audit: type=1800 audit(2000000483.639:1133): pid=19581 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3792" name="zone_nr_conv" dev="configfs" ino=81588 res=0 errno=0 [ 694.947166][ T5814] usb 6-1: Using ep0 maxpacket: 8 [ 694.947782][ T5814] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 694.948768][ T5814] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 694.948791][ T5814] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 694.948807][ T5814] usb 6-1: config 0 has no interface number 0 [ 694.948831][ T5814] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 694.948851][ T5814] usb 6-1: config 0 interface 55 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 694.948879][ T5814] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 694.952602][ T5814] usb 6-1: config 0 descriptor?? [ 694.956413][ T5814] ldusb 6-1:0.55: Interrupt in endpoint not found [ 694.979031][T19581] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3792'. [ 694.979085][T19581] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3792'. [ 694.979115][T19581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3792'. [ 695.158160][ T5814] usb 6-1: USB disconnect, device number 51 [ 695.267248][T13330] usb 8-1: new high-speed USB device number 94 using dummy_hcd [ 695.287668][T13330] usb 8-1: device descriptor read/8, error -71 [ 695.537196][T13330] usb 8-1: new high-speed USB device number 95 using dummy_hcd [ 695.557701][T13330] usb 8-1: device descriptor read/8, error -71 [ 695.677515][T13330] usb usb8-port1: unable to enumerate USB device