last executing test programs: 32.154515834s ago: executing program 2 (id=574): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) write$tun(r0, &(0x7f0000000380)=ANY=[], 0xfdef) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r1, 0x0, 0x2) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r4, r4) setpgid(0x0, r4) fchdir(r3) mkdirat(0xffffffffffffff9c, 0x0, 0x108) mount$bpf(0x0, 0x0, 0x0, 0x4008, 0x0) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) 26.112526763s ago: executing program 2 (id=578): socket$inet_udp(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nullb/nullb1/zoned\x00', 0x2, 0x50) write(r0, &(0x7f0000000500)='1\n', 0x2) openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/nullb/nullb1/zone_nr_conv\x00', 0x2, 0x0) getpid() openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) setsockopt$MRT6_INIT(0xffffffffffffffff, 0x29, 0xc8, &(0x7f0000000100), 0x4) writev(r1, &(0x7f0000000840)=[{&(0x7f0000000740)="14b2eaa8e735cb8ce361abf7a1daa22f4451c1758ce6f3c3d9b716c87d3f8c0be6d7fd984064ae4d594c56f145dfa1fd23ae347eb4758a6fba1a219e5a8be640734bbf09eda0eca4f60d4fa9288828f76a4069fbd53dca6c8cf6cb95d100a8e3cea28fbd5f52577fec83440f02afa131a4edc6fbf029cf43c4bc2efd13e0537d9603cf48e6a7e5f51e6e735212a54a3f3bd8a16087a386e7385309ae5cd1fe90320fcb9e6017dc6f23cd2899afc2cac71e7428b6225226087fd5847301eed022e33e3ea3f69a0f59a47d539205adb619595ad69aad5aac7870d3f674ceb9bb", 0xf000}, {0x0, 0x45}], 0x2) ioctl$VIDIOC_SUBDEV_S_FMT(0xffffffffffffffff, 0xc040564a, &(0x7f00000000c0)) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40001, 0x0) ioctl$BLKZEROOUT(r2, 0x127f, &(0x7f0000000240)={0xf400, 0x1000000}) 23.291495275s ago: executing program 1 (id=581): openat$sndseq(0xffffffffffffff9c, 0x0, 0x800) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) getpid() sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, 0x0, &(0x7f0000000340)) r1 = syz_io_uring_setup(0xf00, 0x0, &(0x7f0000000100), &(0x7f0000000000), 0x0) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x11b) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) chdir(&(0x7f0000000100)='./file0\x00') chdir(&(0x7f0000000140)='./bus\x00') r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r2, &(0x7f0000001b00)=""/4119, 0x1017) 22.571662763s ago: executing program 2 (id=582): r0 = syz_open_dev$sg(&(0x7f0000000140), 0xa, 0x28102) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f00000001c0)=0x2001) r1 = fcntl$dupfd(r0, 0x0, r0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) readv(r1, &(0x7f0000000180)=[{&(0x7f0000000200)=""/132, 0x3f}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x10, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./proc/sys/net/ipv6/conf/syz_tun/addr_gen_mode\x00', 0x1, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r3) syz_usb_connect(0x6, 0x24, &(0x7f0000000440)=ANY=[], 0x0) ioctl$EVIOCRMFF(r3, 0x40085503, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x5}, {0xfff3}}}, 0x24}}, 0x0) write$ublk_bdev(r2, 0x0, 0x0) r6 = socket(0x2d, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r6) 20.957573624s ago: executing program 1 (id=584): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x7}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0xffffffff, 0x0, 0x1, 0x0, 0x6}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x0, 0x3c}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x6, 0x4, 0x3, 0x0, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0xffd8) 18.576921638s ago: executing program 3 (id=587): r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./dummy.img\x00', 0x42, 0x1ff) ftruncate(r0, 0x1000000) pwrite64(r0, &(0x7f0000000100)="6269746d030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000100"/192, 0x100, 0x1000) r1 = syz_open_dev$loop(&(0x7f00000001c0), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./sys\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='md0\x00', 0x4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='7:0\x00', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='raid1\x00', 0x6) r5 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r5, 0x0, 0x0) r6 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r6, 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r7, &(0x7f0000000580)='readonly', 0x8) 17.725011677s ago: executing program 2 (id=588): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) socket$inet_udp(0x2, 0x2, 0x0) setns(0xc9, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000195000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4a}, 0x94) r1 = epoll_create1(0x0) r2 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)=ANY=[@ANYRES32=r2, @ANYRES32=r0, @ANYBLOB="1100000000000000", @ANYRES32=r2, @ANYBLOB, @ANYRES32, @ANYRES8=0x0, @ANYRES32=r0], 0x14) setitimer(0x2, 0x0, 0x0) write$binfmt_aout(r2, &(0x7f0000000080)=ANY=[], 0xfffffffffffffe4f) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0xfffffffffffffff7) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x2, 0x0, &(0x7f0000000140)={0x0, 0x0}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) 14.520520407s ago: executing program 1 (id=590): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000140)={@local}) r5 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) openat$cgroup_int(r6, 0x0, 0x2, 0x0) ioctl$KDGETMODE(r6, 0x4b3b, 0x0) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r4, 0x7ab, &(0x7f0000000040)={&(0x7f0000000280)={{@local}, {@local}, 0x400, "787c2ce2fba15d4e9f8e96bc11e2ca247a20c3e26661b174fe1825253be9e8480cb4f3524914f59ba189c1429727ef39b4164f93bb821987b3b7f73495bc8e745304668e0e46798c7f5917ea8428d41cab5612336f04000000000000008e9c1c86a394feb64fb06f77dadbcb20fc62741432b7dca37007d68e98fe46135d6a1c5ed42102f58daa5211319db84aa9abac734be47c908dc3ffa3aa7b61ec16d3d1209fc618f6c4532ea582628502ac46d167db6d53d8f3184df68414e6b6ec0109664c570e155654e03d58dadd0e5a7bab42bbb4a9afdefc115eb1609e7b50dbd94b94ba09000000000000001c9e4a41d3e16af21d6c897a1121bc14de16e78d6d7f2ae79db44e302539fd926e0b91e0fc589e2fa19b218d0508b5ce3ad40d03936693ca5aa41ddc07cf492874569ab037e0530e38245b98131ae0c9afd871df5f51331938764f5a7dd96890edd467b2fbc335ed081729b5ea722a98b34d0dac6de995de4ee263c81b2567b3f87e0897857edd5d7e97d61fc67076eab4846010d4828cc879f95cddb69ff6438f2a109285c46d8224c36069d30c3c9cf4a6800ae224111136bd9c1e06c4bfc4685d7bb6a72345772b3ce9bf105490743dc4b700f24ce6b250b95e6c383fe44acaa55d140baf0ec339e3815b29a2246cb5c953048c43266485bbd9d0caecf00e9501a4433b54930cba54e06607ada2f5d818e4804294fcf53058e58e0d33d4aa6dc943811056908fe9116e65cdddac1d2fb24d1eacee389af38b7e5a7056d0de50c6b49fb38388cf28c2d6dd3dbbab84ffbef4b0c02a77f018e8a9749a557909e6aa96185d268dad7744b094d8c6134b8defe26674d65f908f9c3a8c201f661fc26efe0eff248d3a473fe32a5b3643bfad8f186c2af3fbaa1d38560c1244c79a0e48893eefb792af281650f34f6c2d9a6c622aba234b63586713cb66179a0897d98ee5228569c32c1a682807c8db7eb197ccbbd6549db86a6a9aebbf5dc14060f22e2b07d6166f43c25ae0c88be7a4dc38e7ed08972a355b0e5d6fc43b8e5594fa6b36a36a44bb94b75eaff11dc17105f54beda54da2a1ea1acfab354745057dd2e7725f2c8450b19fdf37e19f6ce43449e9191f5a5beb4a1bc176f6130052e83acefd8ff18d592bb75f15f86c9113e4bd67ad420c33ae706cdc10060277b83ef30a50d4ac19c9a791b309377aa20a4743bbb799abc3ba58071b628c9ba8103bbfe389939e55296ec9b4f8d3a03aff30ce9aa0dd6e5158a672be8f3da8349ed4ad82f6ca67ee29e8b234840cf7846e604e5b8135abd94d71fe0a79180e75d4e193ea8df466c087b660fe984943751a9f6df8545699701d478c2b3daa949155770e74835bcd972de27afd20b02ce0e504c15b0237437200"}, 0x418, 0x7fffffff}) ioctl$IOCTL_VMCI_DATAGRAM_RECEIVE(r4, 0x7ac, &(0x7f0000000000)={0x0, 0x0, 0xe5bb}) 14.337294157s ago: executing program 3 (id=591): r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) syz_clone3(&(0x7f0000001200)={0x5000, 0x0, 0x0, 0x0, {0x2}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x58) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$pptp(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x4) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4400ae8f, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000280)={[0x60000000004, 0x1000000000, 0x80000000000005, 0x41, 0x2000000, 0x0, 0x2004cb, 0xffffffffeffffffe, 0xa1d, 0x9, 0x5, 0x0, 0x3, 0x2, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000100)={{0x0, 0xeeee0000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x5, 0x9, 0x1}, {0xffff1000, 0x200000, 0xd, 0x0, 0x9, 0x0, 0x0, 0x0, 0x4, 0x7}, {0x2000, 0x5000, 0xc, 0xff, 0x4, 0x4, 0x0, 0x0, 0x3, 0xf6, 0x0, 0xfc}, {0x26000, 0xd000, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x8, 0x0, 0x6, 0xfc}, {0x6000, 0xfffef001, 0x9, 0xff, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0x83}, {0xdddd0000, 0xb000, 0x0, 0x35, 0x3, 0x0, 0x42, 0x0, 0x0, 0x0, 0xb2}, {0xeeef0000, 0xe6e31000, 0x8, 0xfe, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x4}, {0x30000, 0x25000, 0xf, 0x0, 0x0, 0x1, 0x0, 0xca, 0x3f, 0x0, 0x0, 0x1}, {0x80a0000, 0x807}, {0x7000}, 0x5df9ffdd, 0x0, 0x10000, 0x50, 0xfffffffffffffffc, 0x0, 0x0, [0x0, 0xe4, 0x1, 0x40]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 13.288737553s ago: executing program 2 (id=592): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000006e80)=@deltfilter={0xfc4, 0x2d, 0x8, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xa, 0xffff}, {0xffe0, 0xf}, {0xc, 0xc}}, [@TCA_RATE={0x6, 0x5, {0x10, 0x94}}, @TCA_CHAIN={0x8, 0xb, 0x4}, @filter_kind_options=@f_matchall={{0xd}, {0xd8, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x8}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xba12663a254f322, 0x5}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xd, 0x4}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_ACT={0xb4, 0x2, [@m_ct={0xb0, 0xb, 0x0, 0x0, {{0x7}, {0x4}, {0x85, 0x6, "dd3250e9d8432596ffa806169243b5dfe25427cbdbe18508f2ad470a5b6c0b71c137f772aa8423a557742b206087e8514a63a0f700200b52b82056e8c1b5057dc3d5994713b2516988d23ecad8a7d74a9b1436f2ea1596f239e7e6f9d16c5a2e0f99e7b1bd8daf2e388dac30320c5af530516c72effd0be9804ac555ea94a7af91"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}, @filter_kind_options=@f_bpf={{0x8}, {0xc, 0x2, [@TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x1}]}}, @filter_kind_options=@f_cgroup={{0xb}, {0xe88, 0x2, [@TCA_CGROUP_ACT={0xe84, 0x1, [@m_pedit={0xe80, 0xb, 0x0, 0x0, {{0xa}, {0xe54, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe50, 0x4, {{{0x2, 0x97c, 0x1, 0x6, 0x200}, 0x8a, 0x80, [{0x8, 0x5875f981, 0x6, 0x4, 0xa, 0x8}, {0x6, 0xec4a, 0xff, 0xfffffffe, 0x7}]}, [{0x8, 0xac1f, 0x100, 0xfffffff0, 0x2, 0x7}, {0xfffff000, 0x7, 0x80000000, 0x7, 0x200, 0x8}, {0x1800, 0x9, 0x6, 0xfffffff7, 0xffff, 0x7}, {0x4, 0xd5, 0x8, 0x0, 0x4447, 0x5}, {0x4, 0xc63f, 0x1, 0x1, 0xed1, 0x2}, {0xffffffff, 0xe8, 0x800, 0x83b, 0x8, 0x6}, {0xc, 0xffff7fff, 0x3, 0x5, 0x7f, 0xfffffffb}, {0xb, 0x9, 0x408, 0x80, 0x6, 0x768}, {0xffff8bff, 0x8, 0x3c27, 0x3, 0xc, 0x75ef2317}, {0x5, 0x8, 0x1, 0x4, 0x5, 0x3}, {0x8, 0x8, 0x80000000, 0x7, 0x0, 0x10}, {0xfff, 0x8, 0x80000000, 0x80, 0x6, 0x5}, {0xa0, 0x101, 0x6, 0x3, 0x0, 0xdf}, {0x4, 0x5, 0x2, 0x3, 0xfffff000, 0xaa6}, {0x7, 0x80000000, 0x8, 0xfffffff4, 0xfe6, 0x75}, {0x3, 0xa6, 0x0, 0x2, 0x40, 0x8}, {0x4, 0x9d3, 0x6, 0x5, 0xd, 0x4}, {0xfd3afc0, 0x3, 0x5, 0x2, 0xff, 0xfffffabf}, {0x5, 0x2, 0xfff, 0x2, 0x2, 0x81}, {0xcb09, 0xb, 0x3ff, 0x6, 0xa, 0x3}, {0x1000, 0x1, 0x200, 0x2, 0x5, 0xff}, {0x4a6, 0xd3, 0x0, 0x8, 0x4, 0x9}, {0x3, 0x4, 0x7fffffff, 0x8, 0x7, 0xe921}, {0x6, 0x4, 0x7fff, 0xc16, 0x9, 0x8}, {0xffff, 0x7, 0x7, 0x10000, 0xffffffff, 0xffff8001}, {0x6, 0xb, 0x28dc, 0x6, 0x7fff, 0x9}, {0x4, 0x8001, 0x1000, 0x60d1, 0x1, 0x1}, {0x5, 0x1, 0x4, 0xffff7fff, 0xe4c, 0x7cc28a0b}, {0x9, 0x8, 0x200020, 0xdb78, 0x4, 0x7}, {0x80, 0xffffffff, 0x4, 0x400, 0xffff5956, 0x8}, {0x1, 0x1000, 0x4, 0x4, 0xffffffff}, {0x6, 0x7fff, 0x3, 0x27a8, 0x9a3, 0x7}, {0x4, 0x80, 0x1ff, 0xffffffff, 0x5, 0x5}, {0x2, 0x62, 0x6e, 0x1000, 0x3, 0xff}, {0x7, 0x8, 0x2, 0xffffffff, 0x400, 0x10001}, {0x0, 0x7ff, 0x8, 0x7, 0xff, 0x69c}, {0x7, 0x7, 0x3, 0x2, 0x1, 0x2}, {0xd1b4, 0x2, 0x0, 0x2, 0x3ff, 0x6}, {0x636cf16a, 0x7fffffff, 0x80000000, 0x3, 0x7f, 0x660b}, {0x4, 0xb3, 0xc2c, 0x2, 0x5, 0x4}, {0xffff3de5, 0x5, 0x3, 0x6, 0x4b7, 0x7fffffff}, {0x10c3, 0x4, 0x4, 0xfffff1ce, 0x800, 0x4}, {0x750, 0x0, 0x7, 0x7, 0x6, 0x3}, {0x7, 0xff, 0x1bdf, 0x5, 0x7ff, 0x5}, {0xff, 0x1206f6e2, 0x0, 0x800, 0x2, 0x200}, {0x5, 0x1a, 0x400, 0x3, 0x608b, 0x9}, {0x4, 0x2, 0x2, 0x4, 0x9, 0x2}, {0x200, 0x8, 0x1, 0x6, 0x11f7, 0x7}, {0xffff, 0x2, 0x200, 0x9, 0xffff, 0x100}, {0x0, 0xffff8000, 0x6, 0xfff, 0xb1e, 0xc33}, {0x8, 0x76f, 0x5, 0x7, 0xffffffff, 0x9}, {0x80000001, 0x9, 0x3, 0x7, 0x80, 0xd}, {0x5, 0x80000001, 0x9, 0x3, 0xb5f, 0x3}, {0x4, 0xcfb, 0x7, 0x1, 0x2, 0x80000000}, {0x7fff, 0x8, 0x165, 0xb59c, 0x7, 0x2}, {0x14, 0x4, 0x527, 0x8, 0x10000}, {0xac1, 0x5, 0x2, 0x7, 0x4, 0xd3}, {0x1, 0xc7, 0x15, 0xb, 0x9, 0x4}, {0x9, 0x0, 0x8, 0x7, 0x5, 0x7fffffff}, {0x2, 0x5, 0x2, 0x1, 0x1a3f9ae0, 0xc}, {0x9, 0x8, 0x6, 0xd1, 0x9, 0x7}, {0x6, 0x334, 0xe7cf, 0x8000, 0x3a0, 0x9}, {0x67, 0x0, 0xc, 0x4, 0x400, 0x86c}, {0x3, 0x0, 0xfffffff6, 0x80000000, 0x3}, {0x0, 0xb6, 0x2, 0x6e52, 0x2, 0x3}, {0x4, 0x4, 0x81, 0x8, 0x8, 0x7}, {0xfffffffc, 0x9, 0x2, 0x0, 0x1, 0x7fff}, {0x1, 0x7fffffff, 0xffffffff, 0xe5d, 0x5, 0x7de7}, {0x1, 0x5a, 0x0, 0xfffffff9, 0x3, 0x7b}, {0x369f, 0x0, 0x1c18, 0x401, 0x3, 0x931}, {0xfff, 0x12fc, 0x7, 0x67d, 0x8001, 0x10}, {0x4, 0x7f, 0x9, 0x81, 0x101, 0x5}, {0x2, 0x8001, 0x925, 0x8, 0x7, 0xfffffff8}, {0xf2d, 0x7ee, 0x80000000, 0x988, 0x9, 0x6}, {0x0, 0x2, 0x5, 0x120000, 0x0, 0x9a}, {0x100, 0xfffffffe, 0x1ff, 0x5, 0x8, 0xfffffffb}, {0xfffffff8, 0x9, 0x7ff, 0x70, 0x9, 0x1}, {0x5, 0x3, 0x0, 0x8, 0x1, 0x80}, {0x81, 0x8, 0x5, 0x5, 0x1000, 0x800}, {0xd, 0x3, 0x3, 0x3, 0x21, 0x728e357b}, {0x0, 0x1, 0x9, 0x4, 0x2, 0xb}, {0xfffffffa, 0x80, 0x7, 0x10001, 0x6, 0x4}, {0x5afba23, 0xfffff43e, 0x9, 0xfffffff9, 0x3, 0x4}, {0x5, 0x40, 0x81, 0x6, 0x400, 0x2c000000}, {0x0, 0x1, 0x9, 0x200, 0x4, 0x100000}, {0x1, 0x400, 0xf, 0x9, 0x0, 0x40}, {0x5, 0x4361, 0x7, 0x5f, 0x3, 0x8}, {0x1, 0xcb46, 0x7f, 0x4, 0x7f, 0x2}, {0x401, 0x10000, 0x2, 0x2, 0x2, 0xfffff74e}, {0x8000, 0x1, 0x0, 0xfffffffd, 0x2, 0x6}, {0x9, 0x10, 0x2, 0x1, 0x3, 0xfc}, {0x7, 0x7, 0x5, 0x1, 0x8ca4, 0x6}, {0x5, 0x9a9, 0xffffffff, 0x8, 0xffffffbd, 0xfffffff9}, {0x1, 0x2, 0x452111f6, 0xfffffffb, 0x6, 0x9}, {0x5, 0x4, 0x7, 0x2, 0x9, 0x9}, {0x4, 0x8000, 0x9, 0xf, 0xd3be, 0xffffffff}, {0x5, 0x6, 0x8, 0x2, 0x3, 0x2}, {0x5, 0x8, 0x10000, 0x10001, 0xfffffffe, 0x6}, {0x7, 0x90, 0x1, 0x2, 0x6, 0x9}, {0x0, 0x6, 0xfff, 0x2, 0x1, 0x80000001}, {0x5, 0x9, 0xc, 0x6, 0x964, 0xffffffff}, {0xb, 0x4, 0x8, 0x81, 0xf513, 0x343}, {0x0, 0x1, 0xfffff801, 0x319, 0x2800000, 0x40}, {0x6, 0x8, 0x40, 0x7, 0x0, 0x5}, {0x3, 0x3, 0xd, 0x8, 0x10001, 0x2}, {0x2, 0x4, 0x7, 0x8, 0x400, 0x2}, {0x100, 0x8, 0x7fffffff, 0x0, 0x6, 0x9}, {0x8, 0x10, 0x7afb, 0x6, 0x1923f85c, 0x5}, {0x3, 0x9, 0x2, 0x3, 0x6, 0x7}, {0x6, 0x3, 0x7fffffff, 0x1, 0x4, 0x1c000000}, {0x1, 0xfffffffe, 0x3ff, 0x7fffffff, 0x1ff, 0x6}, {0x8000, 0xffff73df, 0xb, 0x66f3, 0x8001, 0x2}, {0x80, 0x521b6b31, 0x7, 0x3, 0x3, 0x6}, {0x6, 0x3, 0x0, 0x7, 0xfffffff7, 0x8}, {0x401, 0xe, 0xc, 0x7, 0x5f51, 0xbee}, {0x6, 0xb, 0x6, 0x3800, 0x8, 0x9}, {0x3, 0x4, 0x8, 0x6, 0x3, 0x4}, {0x1a70, 0x2, 0x8, 0x400, 0xe05, 0x7}, {0xffff, 0xc4, 0x684e, 0x9, 0x81, 0x93c}, {0x2, 0x3, 0x2, 0xffff, 0x80000001, 0x101}, {0x4, 0x12ef, 0x8001, 0x1b, 0x2, 0xf1d00}, {0xfffffff2, 0xb82, 0x101, 0x6, 0x3, 0xff}, {0x4, 0x816f, 0xbee, 0x4, 0x0, 0x3}, {0xb, 0x10, 0x0, 0x3, 0x9, 0x2}, {0x5, 0x9, 0x3, 0x81, 0x9}, {0xfff, 0x1, 0x6, 0x7, 0x4, 0x4a}, {0xb8b, 0x1, 0xb, 0xc, 0x40}, {0x4, 0xf1e0, 0x6ba2, 0x8001, 0x7, 0x416d}], [{0x2}, {0x5, 0x1}, {0x3, 0x1}, {0x5}, {}, {0x4}, {0x2, 0x1}, {0x2}, {0x5, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x5}, {}, {0x3, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x1}, {0xa46238420b1f4f47}, {0x5}, {0x5}, {0x5, 0x1}, {0x2, 0x1}, {0x3}, {0x3}, {0x3, 0x1}, {0x5}, {0x3, 0x1}, {0x2, 0x1}, {}, {0x2, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x5}, {0x5, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x3}, {0x1}, {0x2, 0x1}, {0x3, 0x2}, {0x4}, {0x2}, {0x1, 0x1}, {0x4}, {}, {0x2}, {0x4}, {}, {0x2, 0x1}, {0x0, 0x1}, {}, {0x4}, {0x7, 0x1}, {0x1}, {0x1}, {0x0, 0x1}, {0x4}, {0x5, 0x1}, {}, {0x1, 0x1}, {0x4}, {0x1}, {0x4, 0x1}, {0x5, 0x1}, {0x2}, {0x3}, {0x0, 0x1}, {0x5, 0x1}, {0x4}, {0x2, 0x1}, {0x5}, {0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x5}, {0x1, 0x1}, {0x4, 0x1}, {0x5}, {0x4}, {0x0, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x4}, {0x4, 0x1}, {0x5}, {0x4}, {0x5}, {0x3, 0x42b87ee76b9da29f}, {}, {0x1, 0x1}, {0x5, 0x1}, {0x4}, {0x5}, {0x4, 0x1}, {0x4, 0x1}, {0x4, 0x1}, {}, {0x4}, {0x2, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x1}, {0x2}, {0x5}, {0x5, 0x1}, {0x5}, {0x2}, {0x1, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x5}, {0x2, 0x1}, {0x3}, {0x5}, {0x4}, {0x1}, {0x4}, {0x5}, {0x1}, {0x4}, {0x5}]}}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}}]}, 0xfc4}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff3000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) gettid() mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000640)="3132f52c", 0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x523, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) 12.803188721s ago: executing program 0 (id=593): creat(&(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x145) symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{0x0}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0xfffff9, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, 0x0}, 0x108) r4 = eventfd(0x5f0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000001240)=@updpolicy={0xbc, 0x19, 0x1, 0x0, 0x25dfdbfe, {{@in=@rand_addr=0x64010101, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x10, 0x5c, 0x0, 0xffffffffffffffff}, {0xfffffffffffffffc, 0xa9, 0x3, 0xfffffffffffffffc, 0xfffffffffffff310, 0xffffffffffffffff, 0x1000, 0x1da774c7}, {0x7ff, 0x9ff, 0x2000006, 0x800000004000000}, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1}, [@XFRMA_IF_ID={0x8, 0x1f, 0x4}]}, 0xbc}, 0x1, 0x0, 0x0, 0x448c5}, 0x4000800) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x40a0ae49, &(0x7f0000000080)={0x7ff, 0x0, 0x0, r4}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f0000000000)={0x0, 0x300000, 0x8}) 9.924346219s ago: executing program 1 (id=594): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x2) r1 = syz_open_dev$usbmon(&(0x7f0000000080), 0x2, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r1, 0x0) connect$netlink(r0, 0x0, 0x0) mount$cgroup2(0x0, 0x0, 0x0, 0x10, 0x0) mount$tmpfs(0x0, 0x0, 0x0, 0x800004, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='afs\x00', 0x2000000, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(0x0, &(0x7f0000000440), 0x40000000, 0x0) madvise(&(0x7f000033c000/0x1000)=nil, 0x1000, 0x3) mknodat(0xffffffffffffff9c, 0x0, 0x2, 0x4) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2000010, &(0x7f0000002140)=ANY=[]) r2 = openat(0xffffffffffffff9c, 0x0, 0x22801, 0x0) fcntl$lock(r2, 0x5, 0x0) pipe(0x0) openat$binderfs_ctrl(0xffffffffffffff9c, 0x0, 0x800, 0x0) 9.810481775s ago: executing program 3 (id=595): timer_create(0x0, 0x0, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) readv(0xffffffffffffffff, &(0x7f0000000600)=[{0x0}], 0x1) eventfd(0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) r2 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r2, 0xc0045627, &(0x7f0000000100)=0x2) ppoll(&(0x7f0000000080)=[{r1, 0x42c0}], 0x1, 0x0, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 8.295043663s ago: executing program 0 (id=596): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x5, &(0x7f0000000240)=ANY=[@ANYBLOB="1802000003000000000000000000000085"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000080)=0x13) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000180)=0x3) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002640)=@newtaction={0xe6c, 0x30, 0x3f, 0x0, 0x0, {}, [{0xe58, 0x1, [@m_pedit={0xe54, 0x1, 0x0, 0x0, {{0xa}, {0xe28, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x4}, @TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x0, 0x0, 0x4}, 0x2}, [{0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {0xfffffffc, 0x0, 0x0, 0x0, 0x100}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, {0x5943}, {0x0, 0x800000, 0x0, 0xfffffffc}, {}, {}, {0x0, 0x0, 0x0, 0x10}, {}, {}, {0x0, 0xa2}, {0x0, 0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x1cbe}, {0x0, 0x0, 0x0, 0x5}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffe}, {0x8, 0x7ff}, {}, {0x0, 0xfffffffe, 0x400000}, {0x0, 0xfffffffc}, {}, {}, {}, {0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0x0, 0x4, 0xffffff6a}, {0x0, 0x0, 0x0, 0x0, 0x5}, {}, {}, {0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x0, 0x0, 0x0, 0x100}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x800000}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x7fffffff}, {0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x27a}, {0x0, 0x0, 0xffffffff}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0xffffffff}, {0x0, 0xfffffffc, 0x0, 0x0, 0xfffffffc}, {}, {0x0, 0x2}, {}, {}, {}, {0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x0, 0x0, 0x0, 0x0, 0x1}, {0xc}, {}, {0x0, 0x0, 0x2b7f}, {0x3ff, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x6, 0x0, 0x0, 0x0, 0x80}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0xcfc, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {0xfffffffd, 0x0, 0x0, 0x0, 0xa92}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x40000000, 0x1, 0x0, 0x10001}, {0x0, 0x0, 0x20}, {}, {0x80000}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, {0xfffffffc}, {}, {}, {}, {0x0, 0xa, 0xfffffffc}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x0, 0x0, 0x3}, {}, {}, {0x0, 0x0, 0x40, 0x0, 0x0, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1, 0x2}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x2}, {}, {0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x2}, {0x5}, {}, {}, {}, {}, {}, {0x7, 0x1}, {}, {}, {0x0, 0x1}, {}, {}, {0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe6c}}, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000000140)) rt_sigtimedwait(&(0x7f0000000040)={[0xfffffffffffffff7]}, &(0x7f0000000080), 0x0, 0x8) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000080)={@private0, 0x8000000, 0x0, 0xff, 0x1}, 0x20) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$TCSETS(r4, 0x40204706, &(0x7f0000000040)={0x1, 0x0, 0x5, 0x0, 0x0, "3eccd8f9d20000000000001000000200000500"}) io_submit(0x0, 0x1, &(0x7f0000004540)=[0x0]) read$FUSE(0xffffffffffffffff, &(0x7f0000000380)={0x2020}, 0x2020) write$rfkill(0xffffffffffffffff, &(0x7f0000000340)={0x6, 0x0, 0x3, 0x0, 0x1}, 0x8) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r0, 0x8983, &(0x7f0000000040)={0x1, 'wg2\x00', {}, 0xfffd}) 8.00127794s ago: executing program 2 (id=597): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x5, 0x16, &(0x7f0000000240)=ANY=[@ANYBLOB="61128c030000000061138c8800000000bf30000000000000070000000009240b2d03010000000000950000a7000000006916700000000000bf67000000000000b5070000fcff03046706"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4a}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002940)=@newtfilter={0xea4, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x1, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe70, 0x2, [@TCA_MATCHALL_ACT={0xe6c, 0x2, [@m_pedit={0xe68, 0x1, 0x0, 0x0, {{0xa}, {0xe3c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x2, 0x9, 0x20000000, 0x6}, 0x1, 0xfb}, [{0x2, 0x9c, 0x9, 0x5, 0x2, 0x7}, {0x0, 0x6, 0x4, 0x10000, 0xfffffffd, 0x81}, {0x1, 0x1, 0x8, 0x101, 0x1}, {0x3, 0x3, 0x0, 0x7, 0x5, 0x4}, {0xf, 0x7, 0x9, 0x51, 0x6}, {0x3, 0x8004, 0xc, 0x101, 0x103, 0x84b5}, {0x9c, 0x4, 0x9, 0x2, 0x487, 0x8}, {0x1, 0x10000, 0x5, 0x4, 0x3, 0x8000}, {0x7, 0x9, 0x1ff, 0x8, 0x2, 0x7fff}, {0x439356e7, 0x609, 0x16, 0xfffffffc, 0x10000, 0x6}, {0x5, 0x3, 0x8, 0x3, 0x400000, 0xffffffff}, {0x5, 0xfffffff8, 0x7, 0x7, 0x8, 0x5}, {0x5, 0x8, 0xfffffffe, 0x5, 0xfffff000, 0x7}, {0x768d, 0xcd, 0x8, 0x7, 0x5, 0x10000}, {0xfffffffe, 0xfffffffb, 0x6, 0x5, 0x7ff, 0x5}, {0x240, 0x6, 0xfffffffe, 0x6, 0x2}, {0xfffff9fd, 0x49, 0xa5f, 0xa, 0x5, 0x2}, {0x6, 0x9, 0x167, 0x2, 0x71, 0xa2}, {0x140, 0x2, 0xc, 0x6, 0x87}, {0x5, 0xa, 0x2, 0x4, 0x3, 0x2000}, {0x32d, 0x2008, 0x7fff, 0x4, 0x8, 0x9}, {0x6, 0x200, 0x58fe, 0x7ff, 0x4, 0x3}, {0x101, 0xd, 0x101, 0x0, 0x3, 0x2}, {0x0, 0x3, 0x2, 0x7437ec78, 0x2, 0x9}, {0xffffffff, 0x1, 0x9, 0x0, 0x1, 0x4}, {0xc, 0x80000e, 0x0, 0x3, 0x8, 0x81}, {0x3, 0x3, 0x8006, 0xe, 0x0, 0x80}, {0xd, 0x638c, 0x7ff, 0x0, 0x80000000, 0x2}, {0x4, 0xb, 0x6c5f1878, 0x57c4, 0x8, 0x25ff}, {0x4, 0xd, 0x1fadd976, 0x3071, 0x0, 0x1}, {0x5, 0x800, 0x3, 0x3, 0x3, 0x9}, {0x9, 0x1ff, 0x1000, 0x9c, 0x1, 0x5}, {0x9, 0xd76, 0x6, 0xdc2, 0xa16a, 0x2}, {0x1ff, 0x5, 0x1000007, 0x5, 0x2, 0xffffffff}, {0x1, 0x32158140, 0x0, 0x8, 0x6, 0x7}, {0xe, 0x4, 0x9000, 0x5, 0x2, 0x7f}, {0x3, 0x2ec74d53, 0x0, 0x0, 0x8, 0x2}, {0x5, 0xfff, 0xffffff13, 0x6, 0x2, 0x6}, {0x1, 0x6, 0x3, 0x4, 0xffb, 0xc}, {0x6, 0x6, 0x1ff, 0x8, 0x7ff, 0x8001}, {0x4, 0xffffffff, 0x0, 0xfffff740, 0x4, 0x4}, {0xffff, 0x5, 0x7, 0xac, 0xf}, {0x5, 0x3, 0x6, 0xfff, 0x4, 0x8001}, {0xd, 0x3, 0x80000000, 0x0, 0xffffff81, 0x7ff}, {0xfffffffb, 0x2, 0x1ff, 0x5d, 0xffff8001, 0x800000}, {0x0, 0x6, 0x7ffc, 0x9, 0x500, 0x7}, {0x1, 0xffffffff, 0x834, 0x7, 0x0, 0x3}, {0x7fff, 0x6, 0x0, 0x2002, 0x6, 0x8}, {0xf61, 0x101, 0x9, 0x2, 0x80000000, 0x7fff}, {0x8c7, 0x1, 0x8, 0x2, 0xffff, 0x20000000}, {0x0, 0x5, 0x1, 0xffff, 0x3, 0x3}, {0x9, 0x10001, 0x9f98, 0xbb, 0x8, 0x66a}, {0xfff, 0x6, 0x8, 0x80000001, 0x0, 0x7f}, {0xff, 0x6, 0x7f, 0x5, 0x3, 0xb}, {0x4, 0x4b, 0x0, 0x1, 0x7f, 0x7fffffff}, {0xfff, 0x47e4, 0x1, 0xffffffff, 0x80000001, 0x9}, {0x3, 0x4, 0x7, 0x6, 0x8, 0xe5}, {0x9, 0x9, 0x1, 0x9, 0x0, 0x2}, {0x8, 0x80000001, 0x7fff, 0xb2d9, 0xfffffffe, 0x8}, {0x80000001, 0x8, 0x5202, 0x2, 0x53ce, 0x3}, {0x6, 0x4, 0x8, 0x8, 0x7f, 0x80000000}, {0xfffffff9, 0x9, 0x6, 0x6, 0x9, 0x3}, {0xfffffffd, 0x8, 0x6, 0x5, 0x3, 0x8f}, {0x741, 0x0, 0x9, 0x7fffffff, 0x2, 0x200}, {0x401, 0x2, 0x8, 0x4, 0x8000, 0xc6e9}, {0x1, 0x2d73, 0x400, 0x5, 0x9f17, 0xffffff7f}, {0x10000, 0x401, 0x2b00, 0xfffff57b, 0xfffffc00, 0xd}, {0x3, 0x4, 0xc52b, 0x9, 0x5, 0xff}, {0x0, 0x4, 0x401, 0xffffffff, 0x1, 0x9}, {0x8, 0x4, 0x1, 0x2, 0x10, 0x1}, {0xff, 0x8, 0x6, 0x5, 0xff, 0x5}, {0x2, 0xb15ce2d, 0x80000001, 0xbeab, 0x4, 0x5}, {0x3, 0x18, 0x3, 0x7, 0x8, 0x4}, {0xfff, 0x9, 0x6, 0x3, 0x100, 0x57}, {0x9, 0x5, 0x8, 0x3, 0xa, 0x2}, {0xb3, 0xe, 0x3, 0x7e8, 0x7, 0x9}, {0x400000ff, 0x7, 0x5, 0x10001, 0x2, 0x6}, {0x1, 0x8f, 0xb0, 0xffffff46, 0x4, 0x88000000}, {0x9, 0x2, 0xfffffffc, 0x1, 0xd52, 0x3}, {0xd203, 0x7, 0x1, 0x10000, 0x43, 0xff}, {0x1004, 0x3ff, 0xffffffff, 0x1, 0x5, 0x100}, {0x1ff, 0x3, 0x7ff, 0xfffffff8, 0x1ff, 0x68}, {0x7, 0x20, 0x83ff, 0x1, 0x7, 0x4}, {0x0, 0x6, 0x0, 0x6, 0x5, 0xcca}, {0x7, 0x1, 0xfffffff1, 0x3ff, 0x100, 0x4}, {0x3, 0x9, 0x0, 0x400, 0x4, 0x9}, {0x9, 0x7, 0x8001, 0x7, 0x2, 0x2}, {0x5, 0xfff, 0x9, 0x5, 0xb5, 0x3}, {0x0, 0x1, 0x1, 0x5, 0xffffff01, 0xfff}, {0x7, 0x5, 0x2, 0xa5f, 0x0, 0xfffff9de}, {0x9, 0xffffffff, 0xe6b, 0xb, 0xb, 0x4}, {0x9, 0xffffff11, 0x1, 0x2, 0xff, 0x52e2}, {0x0, 0x1, 0x0, 0x7, 0xdb, 0x6}, {0x7, 0x400, 0x9, 0x8, 0xa, 0x104}, {0x81, 0x8, 0x988, 0x1, 0x0, 0x7}, {0xdc03, 0x7, 0x80, 0x8, 0xfffffff9, 0x4}, {0xa, 0xfffffffe, 0x1, 0x1ff, 0x1ff, 0xc1b7}, {0xa24b, 0x947d, 0x40, 0x4, 0x9, 0x2}, {0x9, 0x401, 0xa89, 0x5ef, 0x9, 0x8}, {0x4, 0x7fff, 0x0, 0x4, 0x7fffffff}, {0x3, 0xb8c, 0x6, 0x21761f6a, 0x1, 0x4}, {0xfff, 0xda, 0x1d, 0x4, 0x8, 0x2}, {0x8, 0x10, 0x100, 0x0, 0xfffffff7, 0xc}, {0xfffff000, 0x8, 0xe96, 0x9, 0x9, 0x34b0}, {0x4, 0x8, 0x8, 0x3, 0x6cf4, 0x1}, {0x3, 0x3, 0x7, 0x5, 0xbe, 0x81}, {0x4, 0x800, 0x4000, 0x5, 0x8, 0xfa2f}, {0x3, 0x8d, 0x81, 0x2, 0x8, 0x6}, {0x9, 0x2, 0x6, 0x4, 0xf, 0x5}, {0x100, 0x1, 0x2, 0xffffffff, 0x9, 0x74}, {0x4, 0x4, 0x8, 0x1, 0x0, 0x3}, {0x2, 0xfffffffb, 0xffffffff, 0x62f, 0x401, 0x30564e0}, {0x9a2f, 0x800, 0x8, 0x1, 0x80000000}, {0x20000009, 0x2, 0x800, 0x200, 0x9, 0xb}, {0x47, 0x6, 0x8936, 0xdcb, 0x3, 0x2}, {0x6, 0x80000000, 0x8, 0xe, 0xfffffffa, 0x8de3}, {0x0, 0x9, 0x8, 0xfff, 0x6, 0x1ff}, {0x8195, 0x2, 0x1000}, {0x1, 0x50, 0xff, 0x9e0f, 0x5, 0x3}, {0x7fff, 0x6, 0x0, 0x5, 0x8000, 0x3}, {0x7ff, 0x9, 0x9, 0x6, 0x7, 0xe77}, {0x1, 0x5e12, 0x3, 0xfffffffa, 0x2, 0x80000001}, {0xffffff8c, 0x9, 0x1, 0x1, 0x10, 0x5}, {0x7, 0x7, 0x104, 0x78d, 0xffffcff7, 0x9}, {0x1, 0xe, 0x7, 0x2, 0x2, 0x207f}, {0xf, 0x5, 0xfffffffa, 0xff, 0x80000, 0xfff}, {0x1, 0x7ff, 0x696e, 0xa, 0x49d, 0xb}, {0x9bf4, 0x0, 0x5, 0x3, 0x20003, 0x1000}], [{0x1, 0x1}, {0x2}, {}, {0x2}, {0x2, 0x745e81639ff0f356}, {0x4, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x3, 0x1}, {0x2}, {0x3}, {}, {}, {0x2}, {0x2}, {}, {0x3, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x2}, {0x5}, {0x2}, {0x1, 0x1}, {0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x4}, {0x3, 0x1}, {0x5, 0x1}, {0x36bc5bece03d104f}, {0x4, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {}, {0xa}, {0x3}, {0x3, 0x1}, {0x2}, {0x3}, {0x4, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x2}, {0x4}, {0x4, 0x1}, {0x4, 0x1}, {0x4}, {0x2}, {0x2, 0x1}, {0x5, 0x3}, {0x4, 0x1}, {0x1}, {0x4}, {0x0, 0x1}, {0x2}, {0x1, 0x1}, {0x3, 0x1}, {0x5}, {0x3, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {}, {0x2, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x3}, {0x6}, {0xa}, {0x3, 0x1}, {}, {0x5, 0x1}, {0x1}, {0x4}, {0x5}, {0x2590228f88cc2931}, {0x3, 0x1}, {0x4}, {0x0, 0x1}, {0x5, 0x1}, {0x6}, {0x2}, {0xb82e57098c7a44ef}, {0x3, 0x1}, {0x1}, {0x6, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x5}, {0x0, 0x1}, {0x4}, {0x4}, {0x0, 0x1}, {0x2}, {0x4, 0x1}, {0x1}, {0x1, 0x1}, {}, {0x3}, {0x1, 0x1}, {}, {0x4, 0x1}, {0x3}, {0x3}, {0x4}, {0x5}, {0x3, 0x1}, {0x4}, {0x3, 0x1}, {0x0, 0x1}, {0x4}, {0x4, 0x1}, {0x1}, {0x5, 0x1}, {0x4}, {0x0, 0x1}, {0x3}, {0x1}, {0x0, 0x1}, {0x4}], 0x1}}, @TCA_PEDIT_KEYS_EX={0x18, 0x5, 0x0, 0x1, [{0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}]}]}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xea4}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(r7, &(0x7f0000002900)={&(0x7f0000000340)=@xdp={0x2c, 0x8, r5, 0x109}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000280)='k', 0x14}], 0x1}, 0x20000885) 7.068015357s ago: executing program 1 (id=598): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='ns\x00') fchdir(r0) truncate(&(0x7f0000000200)='./mnt\x00', 0x4) socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newtfilter={0x43c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xd, 0xa}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_route={{0xa}, {0x40c, 0x2, [@TCA_ROUTE4_POLICE={0x408, 0x5, [@TCA_POLICE_RATE={0x404, 0x2, [0xffffffff, 0xad4, 0x10000, 0x5, 0xb60b, 0x2, 0x8, 0x1, 0x7, 0x8, 0x5, 0x4, 0xb2, 0x3, 0xcb9, 0x7, 0x7, 0x8000, 0x9, 0x10, 0xce3, 0x9, 0x7, 0x414b, 0x4603, 0x7, 0xff, 0x1, 0x5, 0x10, 0x5, 0x1ff, 0x100, 0x80002, 0x639d, 0x0, 0x2, 0x9, 0x15b, 0x9, 0x0, 0x80, 0x40, 0x1, 0x29, 0x3ff, 0x542, 0x3, 0x3, 0x4, 0x6, 0x4, 0x6, 0x6, 0x15e6, 0xc, 0x4, 0x7f, 0x9, 0x0, 0x83c, 0x0, 0x8, 0x52, 0x2, 0xa7ac, 0x7, 0xfffffffa, 0x4, 0x3, 0x2, 0x0, 0x9, 0x8, 0x9, 0x34b, 0x2, 0x0, 0xcd, 0x40, 0x7fffffff, 0x6, 0x44, 0x8, 0x1, 0x80, 0x3, 0xffff, 0x0, 0x4, 0x2, 0xd, 0x1, 0x8, 0x5, 0x100, 0x0, 0x7, 0x6, 0xfffffff7, 0x5, 0x2c000000, 0x64454b99, 0x1, 0x2, 0x3, 0x2, 0x4, 0x447, 0x0, 0x5c58, 0x0, 0x8001, 0x401, 0x169, 0x3, 0x4, 0xfffffff8, 0x584b, 0x7a498270, 0x7, 0x2, 0x3ec, 0x8, 0x1ff, 0x10000, 0x0, 0x7b685e6c, 0x9, 0x0, 0x7, 0x6, 0x8001, 0x9, 0xc, 0x5, 0x400, 0x0, 0xfff, 0x9, 0x6, 0x10000, 0x9cd, 0xff, 0x4, 0x7, 0x6, 0xb1, 0x7, 0x7, 0x80, 0x2, 0x4, 0x6, 0xf0, 0x8, 0x8, 0x3, 0x8, 0x3, 0x0, 0x9, 0x2, 0x1ff, 0x10001, 0x2, 0x6, 0xfffffffe, 0x4, 0xfffffff8, 0x3, 0x5, 0x8, 0x6, 0x3, 0x0, 0xffffffff, 0x1, 0x4, 0x7, 0x4, 0x5, 0x4, 0x1ff, 0xfffffffc, 0x5, 0x952, 0x0, 0x7f, 0x3, 0x326, 0x9, 0x3, 0x80000000, 0x5, 0x0, 0x1, 0x6, 0x100, 0x4, 0x5, 0xe87b, 0x2, 0x8, 0x7fff, 0x9, 0x4, 0x2, 0x6, 0x7fff, 0x1, 0x2, 0xa, 0xf, 0x800, 0x0, 0x4, 0x4, 0x100, 0x6, 0x2, 0x5d6, 0x0, 0x2, 0xee4, 0x9, 0x3, 0x7, 0x0, 0x4, 0x30e73fe0, 0x7, 0x3, 0x7ff, 0x2, 0x400, 0x1, 0x400000, 0x96c3, 0x1000, 0x0, 0x322c, 0x10001, 0x3, 0x94b, 0x4, 0x2, 0x2, 0x5, 0x8, 0x4, 0x3, 0x2, 0x9, 0x1]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x8c8}, 0x20004804) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000600000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000080), 0x1103, r4}, 0x38) 6.81183317s ago: executing program 3 (id=599): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000000), 0x20940, 0x0) ioctl$SNDCTL_SEQ_RESET(r0, 0x5100) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x7}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0xffffffff, 0x0, 0x1, 0x0, 0x6}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x0, 0x3c}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x6, 0x4, 0x3, 0x0, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r2 = socket$inet6(0xa, 0x3, 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$unix(0xffffffffffffffff, 0x0, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0xffd8) 6.66186367s ago: executing program 0 (id=600): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$vicodec0(0xffffff9c, &(0x7f0000000440), 0x2, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0xc0001, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000002340), 0x40800) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc058534f, &(0x7f0000002380)={{0x0, 0x1}, 0x0, 0x2000200, 0x2, {0x4, 0x1}, 0x3, 0xa}) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x15) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000140)=0x5976) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bind$nfc_llcp(r4, &(0x7f0000000080)={0x27, 0x0, 0xffffffffffffffff, 0xb, 0x10, 0x4, "f05b8df0e4c390553edef4d6479ccebe1b71e5c9906c4bc27d3e735881be951f269d987405ae5219e17d60885cf63a3f93c33b31485562b803767f0e2113b9", 0x35}, 0x60) bind$nfc_llcp(r4, &(0x7f0000001080)={0x27, 0x0, 0x0, 0x1, 0x5, 0x81, "bf4ee1a1cc3ebcffc0a5611154ee4f2b0e4bc32ff9b3d2064fc8cfd35115d8b2f42ec29e80a3250d99b87a57406cbe21951cd627a9165d8f8920789245c424", 0xa}, 0x60) r5 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000400)={0x0, 0x30b5, 0x400, 0x2, 0x3f}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x1, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2f41, 0x200, 0x1006, 0x200015a, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x40000, 0x10001, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x0, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xba}}], 0x1, &(0x7f0000000340)={0x2e, 0x14, 0x0, r11, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5c0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xd, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5b", 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0185648, &(0x7f0000000080)={0x980000, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x9b0954, 0x80008002, '\x00', @p_u8=&(0x7f0000000100)=0x1}}) sendmsg$nl_generic(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="640000002f00090025bd700000000000040000000c000c"], 0x64}, 0x1, 0x0, 0x0, 0x42014}, 0x80000) 2.048111381s ago: executing program 0 (id=601): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[], 0x0, 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r2 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000300)={r0, r1, 0x26, 0x0, @val=@netkit}, 0x1c) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) syz_emit_ethernet(0x273, &(0x7f0000000440)={@random="61fe71b72b5f", @link_local={0x17, 0x80, 0xc2, 0x2, 0x9}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "d23396", 0x23d, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, [{0x0, 0xa, "a78ce5400659808000000003004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42c60a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x1, "000000000000000026000400"}, {0x18, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d036397a0acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x3}, {0x21, 0x7, "fcc1876d4ec1876d4e6fa3ce2dfdb43a6f021659ff5c2d6b3d9363ed09bd9281c9fe68a3000000006f0000044e43e740e077e1d16212"}, {0x5, 0x14, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1eb91a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d96967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c000000000000000000"}, {0x0, 0x5, "090000000900000036da018dff16e70b8b1400000000e18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000006c0)="c1dc"}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_THREAD_EXIT(r6, 0x40046208, 0x0) close(r1) close(r2) 1.928045694s ago: executing program 3 (id=602): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1df) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='myproc\x00', 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x8000, 0x0) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000002, 0x8012, r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='myproc/iomem\x00', 0x0, 0x0) read(r1, &(0x7f0000000500), 0xfa0) syz_clone3(&(0x7f0000000380)={0x2140280, 0x0, 0x0, 0x0, {0x20080021}, 0x0, 0x0, 0x0, &(0x7f0000000340)}, 0x58) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='dummy_udc.0\n', 0xc) r3 = syz_open_procfs(0x0, &(0x7f0000000480)='fd/3\x00') mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) userfaultfd(0x80001) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x8) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f00000004c0)={{0x1, 0x1, 0x18, r3, {r1}}, '\x00'}) 1.686022816s ago: executing program 1 (id=603): r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f90224fc60", 0x14}], 0x1, 0x0, 0x0, 0x10}, 0x40040) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e23, 0x100bf26, @ipv4={'\x00', '\xff\xff', @loopback}, 0x183}, 0x1c) r2 = timerfd_create(0x0, 0x0) timerfd_settime(r2, 0x3, &(0x7f0000000180)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timerfd_settime(r2, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0)='team_slave_0\x00', 0x10) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) r3 = socket$igmp6(0xa, 0x3, 0x2) r4 = syz_open_dev$ttys(0xc, 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40008d0}, 0x800c) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a84000000060a0b0400000000000000000200000058000480540001800a0001006d617463680000004400028008000240000000002c0003005c8f022482395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad0b0001006e666163637400000900010073797a30000000000900020073797a32"], 0xac}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff}, 0x800) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000140)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB="2c777e866e6f3d86a414", @ANYRESHEX=r4, @ANYBLOB=',\x00']) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000080)={@dev, 0x0}, &(0x7f00000000c0)=0x14) setsockopt$MRT6_DEL_MIF(r3, 0x29, 0xcb, &(0x7f0000000100)={0x1, 0x0, 0x81, r7, 0x9}, 0xc) 1.110872154s ago: executing program 0 (id=604): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x64) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) openat$binder_debug(0xffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r5, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000001200)=[{}], 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000300)={r3, 0x8, 0x8000, 0x40000000, 0x1, 0xb}, 0x14) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) shutdown(r6, 0x0) recvmmsg(r6, &(0x7f00000004c0), 0xf02, 0xf0, 0x0) write(0xffffffffffffffff, &(0x7f0000000200)='2', 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="2ff000fea0"], 0x0, 0xb, 0x0, 0x0, 0x41100, 0x6e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x3c}, 0x1, 0x0, 0x0, 0x4004850}, 0x20040000) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x1000000000000, 0x2, 0x0, &(0x7f0000ffa000/0x4000)=nil) 380.202751ms ago: executing program 3 (id=605): mount(0x0, &(0x7f0000000060)='./sys\x00', &(0x7f0000000070)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) write(r0, &(0x7f0000000340), 0x0) close(0xffffffffffffffff) write(0xffffffffffffffff, &(0x7f0000000b00), 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x12a) symlinkat(0x0, 0xffffffffffffff9c, 0x0) symlinkat(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ed) mkdirat(r0, 0x0, 0x1ed) symlinkat(&(0x7f0000001500)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlinkat(&(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000001900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') 0s ago: executing program 0 (id=606): socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x40080, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) write(r2, 0x0, 0x0) mmap$xdp(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4, 0x12, r2, 0x80000000) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) syz_emit_ethernet(0x46, 0x0, 0x0) readlinkat(0xffffffffffffffff, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:39835' (ED25519) to the list of known hosts. [ 33.637201][ T5645] cgroup: Unknown subsys name 'net' [ 33.743601][ T5645] cgroup: Unknown subsys name 'cpuset' [ 33.748200][ T5645] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 34.836489][ T5645] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 39.533906][ T5732] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 39.534973][ T5732] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 39.536303][ T5732] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 39.536806][ T5732] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 39.537091][ T5732] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 39.537959][ T5732] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 39.538446][ T5732] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 39.538765][ T5732] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 39.540738][ T5746] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 39.541552][ T5746] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 39.543428][ T5744] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 39.545625][ T5744] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 39.549586][ T5745] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 39.554403][ T5744] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 39.554480][ T5744] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 39.555366][ T5746] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 39.555724][ T5744] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 39.556773][ T5744] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 39.557817][ T64] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 39.558571][ T5743] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 40.313239][ T5739] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.313975][ T5739] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.314093][ T5739] bridge_slave_0: entered allmulticast mode [ 40.314900][ T5739] bridge_slave_0: entered promiscuous mode [ 40.345060][ T5739] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.345141][ T5739] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.345239][ T5739] bridge_slave_1: entered allmulticast mode [ 40.346599][ T5739] bridge_slave_1: entered promiscuous mode [ 40.473816][ T5739] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 40.480396][ T5730] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.480501][ T5730] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.480593][ T5730] bridge_slave_0: entered allmulticast mode [ 40.481923][ T5730] bridge_slave_0: entered promiscuous mode [ 40.492498][ T5730] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.492570][ T5730] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.492835][ T5730] bridge_slave_1: entered allmulticast mode [ 40.494231][ T5730] bridge_slave_1: entered promiscuous mode [ 40.497693][ T5739] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.566118][ T5738] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.566202][ T5738] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.566294][ T5738] bridge_slave_0: entered allmulticast mode [ 40.568091][ T5738] bridge_slave_0: entered promiscuous mode [ 40.593038][ T5730] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 40.593432][ T5738] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.593509][ T5738] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.593613][ T5738] bridge_slave_1: entered allmulticast mode [ 40.594893][ T5738] bridge_slave_1: entered promiscuous mode [ 40.606752][ T5734] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.606824][ T5734] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.606910][ T5734] bridge_slave_0: entered allmulticast mode [ 40.608259][ T5734] bridge_slave_0: entered promiscuous mode [ 40.611839][ T5734] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.611915][ T5734] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.612013][ T5734] bridge_slave_1: entered allmulticast mode [ 40.613543][ T5734] bridge_slave_1: entered promiscuous mode [ 40.616454][ T5739] team0: Port device team_slave_0 added [ 40.618578][ T5730] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.621009][ T5739] team0: Port device team_slave_1 added [ 40.648462][ T5734] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 40.670974][ T5738] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 40.672444][ T5738] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.701967][ T5734] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.711043][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.711053][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.711066][ T5739] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.726746][ T5730] team0: Port device team_slave_0 added [ 40.735220][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.735230][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.735242][ T5739] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.743925][ T5734] team0: Port device team_slave_0 added [ 40.746173][ T5734] team0: Port device team_slave_1 added [ 40.748353][ T5730] team0: Port device team_slave_1 added [ 40.750046][ T5738] team0: Port device team_slave_0 added [ 40.769431][ T5738] team0: Port device team_slave_1 added [ 40.786890][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.786906][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.786926][ T5730] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.803281][ T5734] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.803296][ T5734] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.803313][ T5734] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.804304][ T5734] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.804315][ T5734] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.804335][ T5734] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.805436][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.805444][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.805456][ T5730] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.842921][ T5739] hsr_slave_0: entered promiscuous mode [ 40.843787][ T5739] hsr_slave_1: entered promiscuous mode [ 40.845185][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.845197][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.845219][ T5738] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.846982][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.846994][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.847015][ T5738] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.896969][ T5734] hsr_slave_0: entered promiscuous mode [ 40.897726][ T5734] hsr_slave_1: entered promiscuous mode [ 40.898279][ T5734] debugfs: 'hsr0' already exists in 'hsr' [ 40.898348][ T5734] Cannot create hsr debugfs directory [ 40.902807][ T5730] hsr_slave_0: entered promiscuous mode [ 40.903615][ T5730] hsr_slave_1: entered promiscuous mode [ 40.904105][ T5730] debugfs: 'hsr0' already exists in 'hsr' [ 40.904120][ T5730] Cannot create hsr debugfs directory [ 40.992511][ T5738] hsr_slave_0: entered promiscuous mode [ 40.993296][ T5738] hsr_slave_1: entered promiscuous mode [ 40.993822][ T5738] debugfs: 'hsr0' already exists in 'hsr' [ 40.993839][ T5738] Cannot create hsr debugfs directory [ 41.272571][ T5739] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 41.278629][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 41.279079][ T5739] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 41.284330][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 41.295593][ T5739] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 41.298170][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 41.303419][ T5739] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 41.307488][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 41.335564][ T5730] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 41.338743][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 41.347901][ T5730] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 41.351799][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 41.363864][ T5730] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 41.367955][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 41.368477][ T5730] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 41.370596][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 41.426562][ T5734] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 41.429625][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 41.430084][ T5734] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 41.434668][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 41.435642][ T5734] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 41.441498][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 41.442536][ T5734] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 41.447846][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 41.522763][ T5738] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 41.527655][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 41.529702][ T5738] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 41.535070][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 41.537563][ T5739] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.537700][ T5738] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 41.541352][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 41.542616][ T5738] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 41.546808][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 41.577475][ T5739] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.598141][ T464] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.598308][ T464] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.616192][ T464] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.616242][ T464] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.623811][ T5730] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.631101][ T5737] Bluetooth: hci1: command tx timeout [ 41.639390][ T5737] Bluetooth: hci2: command tx timeout [ 41.639417][ T64] Bluetooth: hci3: command tx timeout [ 41.639812][ T5743] Bluetooth: hci0: command tx timeout [ 41.642722][ T5730] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.665358][ T464] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.665404][ T464] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.680360][ T5734] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.690532][ T464] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.690576][ T464] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.730213][ T5734] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.735620][ T172] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.735670][ T172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.751680][ T172] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.752024][ T172] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.810751][ T5738] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.854507][ T5738] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.871580][ T122] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.871627][ T122] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.877753][ T5734] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 41.883671][ T122] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.883714][ T122] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.134471][ T5730] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.153533][ T5734] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.175167][ T5730] veth0_vlan: entered promiscuous mode [ 42.182663][ T5739] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.183011][ T5730] veth1_vlan: entered promiscuous mode [ 42.215453][ T5734] veth0_vlan: entered promiscuous mode [ 42.228742][ T5730] veth0_macvtap: entered promiscuous mode [ 42.237989][ T5734] veth1_vlan: entered promiscuous mode [ 42.241057][ T5730] veth1_macvtap: entered promiscuous mode [ 42.245634][ T5739] veth0_vlan: entered promiscuous mode [ 42.252203][ T5738] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.264447][ T5739] veth1_vlan: entered promiscuous mode [ 42.274350][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 42.284235][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 42.298643][ T5734] veth0_macvtap: entered promiscuous mode [ 42.307309][ T5734] veth1_macvtap: entered promiscuous mode [ 42.324714][ T5738] veth0_vlan: entered promiscuous mode [ 42.332889][ T5739] veth0_macvtap: entered promiscuous mode [ 42.336062][ T5739] veth1_macvtap: entered promiscuous mode [ 42.345024][ T5734] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 42.348259][ T5734] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 42.363472][ T5738] veth1_vlan: entered promiscuous mode [ 42.378528][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 42.382010][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 42.416419][ T1274] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.416438][ T1274] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.429522][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.430050][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.439754][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.439804][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.439839][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.463466][ T122] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.463479][ T122] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.463559][ T5738] veth0_macvtap: entered promiscuous mode [ 42.488967][ T5738] veth1_macvtap: entered promiscuous mode [ 42.492892][ T122] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.492910][ T122] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.499444][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.538128][ T122] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.538141][ T122] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.545727][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 42.548650][ T5730] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 42.557926][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 42.562352][ T5730] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 42.574833][ T1159] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.574850][ T1159] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.588403][ T5730] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 42.596166][ T5730] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 42.599460][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.605557][ T5730] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 42.618357][ T1159] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.618374][ T1159] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.620512][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.670499][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.715661][ T1274] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.715679][ T1274] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.720393][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.756955][ T5884] Bluetooth: ISO socket layer initialized [ 42.761202][ C1] sr 2:0:0:0: [sr0] tag#11 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 42.761247][ C1] sr 2:0:0:0: [sr0] tag#11 CDB: Read DVD structure ad d1 8b b6 80 3d [ 42.762855][ T1274] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.762868][ T1274] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.779338][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.779548][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.779720][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.779864][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.780102][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.780135][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.655577][ T5890] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.656147][ T5890] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.710247][ T5737] Bluetooth: hci2: command tx timeout [ 43.710272][ T5737] Bluetooth: hci0: command tx timeout [ 43.710950][ T5743] Bluetooth: hci3: command tx timeout [ 44.011990][ T5890] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 44.016482][ T5890] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 44.839648][ T5743] Bluetooth: hci1: command tx timeout [ 45.789484][ T5743] Bluetooth: hci3: command tx timeout [ 45.789516][ T5743] Bluetooth: hci0: command tx timeout [ 45.789528][ T5737] Bluetooth: hci2: command tx timeout [ 45.902885][ T5909] pim6reg: entered allmulticast mode [ 45.909109][ T5907] pim6reg: left allmulticast mode [ 45.967999][ T5914] fuse: Bad value for 'fd' [ 45.976587][ T5914] jffs2: notice: (5914) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 45.980415][ T13] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.981088][ T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.997605][ T43] audit: type=1326 audit(1790054682.483:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5911 comm="syz.1.9" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fc8fec code=0x0 [ 46.109668][ T5842] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.219965][ T5842] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.286392][ T5933] syz.2.13 uses obsolete (PF_INET,SOCK_PACKET) [ 46.725272][ T5942] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 46.919250][ T64] Bluetooth: hci1: command tx timeout [ 47.039120][ T5947] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 47.098245][ T5949] netlink: 44 bytes leftover after parsing attributes in process `syz.3.17'. [ 47.098352][ T5949] Zero length message leads to an empty skb [ 47.416174][ T5953] input: PS/2 BYD TouchPad as /devices/platform/i8042/serio1/input/input5 [ 47.839251][ T42] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 47.869401][ T5743] Bluetooth: hci0: command tx timeout [ 47.879832][ T5743] Bluetooth: hci2: command tx timeout [ 47.964756][ T5974] device-mapper: table: 248:0: thin-pool: Error creating metadata object (-EIO) [ 47.965086][ T5974] device-mapper: ioctl: error adding target to table [ 47.990129][ T42] usb 6-1: Using ep0 maxpacket: 16 [ 47.993658][ T42] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 47.995572][ T42] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 48.001740][ T42] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.001762][ T42] usb 6-1: Product: syz [ 48.001773][ T42] usb 6-1: Manufacturer: syz [ 48.001785][ T42] usb 6-1: SerialNumber: syz [ 48.007637][ T42] usb 6-1: config 0 descriptor?? [ 48.019383][ T42] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 48.019412][ T42] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 48.038282][ T5979] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 48.042147][ T5979] bond1: (slave lo): Enslaving as an active interface with an up link [ 48.042328][ T5979] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 48.154989][ T5983] netdevsim netdevsim3: Direct firmware load for . failed with error -2 [ 48.155075][ T5983] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 48.638191][ T42] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 49.155431][ T5743] Bluetooth: hci1: command 0x0406 tx timeout [ 49.785446][ T42] em28xx 6-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 49.785474][ T42] em28xx 6-1:0.0: board has no eeprom [ 49.859186][ T42] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 49.859253][ T42] em28xx 6-1:0.0: dvb set to bulk mode. [ 49.884212][ T42] em28xx 6-1:0.0: Binding DVB extension [ 50.003742][ T42] em28xx 6-1:0.0: Registering input extension [ 50.885514][ T42] usb 6-1: USB disconnect, device number 2 [ 50.934654][ T42] em28xx 6-1:0.0: Disconnecting em28xx [ 50.934794][ T42] em28xx 6-1:0.0: Closing input extension [ 51.052036][ T42] em28xx: Freeing device [ 52.120264][ T9] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 52.270061][ T9] usb 7-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 52.271699][ T9] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 52.271735][ T9] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 52.271767][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 52.303377][ T9] spcp8x5 7-1:1.0: required endpoints missing [ 52.770478][ T854] usb 7-1: USB disconnect, device number 2 [ 55.299302][ T50] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 55.356971][ T6098] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 55.357469][ T6098] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 55.361620][ T6098] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 55.362194][ T6098] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 55.371556][ T6098] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 55.372571][ T6098] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 55.373084][ T6098] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 55.377246][ T6098] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 55.378011][ T6098] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 55.378518][ T6098] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 55.397651][ T25] usb 8-1: new low-speed USB device number 2 using dummy_hcd [ 55.470325][ T50] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 55.471527][ T50] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 55.471555][ T50] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 55.471585][ T50] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.478416][ T6088] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 55.485988][ T50] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 55.550513][ T25] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 55.551895][ T25] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 55.551923][ T25] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 55.551973][ T25] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 55.551993][ T25] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 55.552009][ T25] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 55.552025][ T25] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 55.552045][ T25] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 55.552065][ T25] usb 8-1: config 168 interface 0 has no altsetting 0 [ 55.553625][ T25] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 55.553654][ T25] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 55.553716][ T25] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 55.553735][ T25] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 55.553751][ T25] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 55.553770][ T25] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 55.553791][ T25] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 55.553812][ T25] usb 8-1: config 168 interface 0 has no altsetting 0 [ 55.555674][ T25] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 55.555703][ T25] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 55.555733][ T25] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 55.555755][ T25] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 55.555778][ T25] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 55.555800][ T25] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 55.555854][ T25] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 55.555878][ T25] usb 8-1: config 168 interface 0 has no altsetting 0 [ 55.558686][ T25] usb 8-1: string descriptor 0 read error: -22 [ 55.558798][ T25] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.711060][ T25] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 55.793493][ T50] usb 6-1: USB disconnect, device number 3 [ 56.159705][ T50] usb 8-1: USB disconnect, device number 2 [ 56.521309][ T6116] syzkaller0: entered promiscuous mode [ 56.521324][ T6116] syzkaller0: entered allmulticast mode [ 56.522142][ T6115] netlink: 12 bytes leftover after parsing attributes in process `syz.1.56'. [ 57.319334][ T25] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 57.480275][ T25] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 57.483081][ T25] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 57.483106][ T25] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 57.483824][ T25] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 57.483859][ T25] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.508790][ T25] usb 8-1: config 0 descriptor?? [ 57.980728][ T6134] tipc: Started in network mode [ 57.980745][ T6134] tipc: Node identity 26dd55da8081, cluster identity 4711 [ 57.980903][ T6134] tipc: Enabled bearer , priority 0 [ 57.982200][ T6134] syzkaller0: entered promiscuous mode [ 57.982211][ T6134] syzkaller0: entered allmulticast mode [ 58.041345][ T25] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 58.065476][ T6134] tipc: Resetting bearer [ 58.074447][ T6133] tipc: Resetting bearer [ 58.084419][ T6133] tipc: Disabling bearer [ 58.241657][ T6137] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 58.246090][ T6124] netlink: 8 bytes leftover after parsing attributes in process `syz.3.60'. [ 58.268433][ T6137] kvm: pic: non byte read [ 58.284121][ T6140] FAULT_INJECTION: forcing a failure. [ 58.284121][ T6140] name failslab, interval 1, probability 0, space 0, times 1 [ 58.284150][ T6140] CPU: 3 UID: 0 PID: 6140 Comm: syz.2.64 Not tainted syzkaller #0 PREEMPT(full) [ 58.284172][ T6140] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 58.284182][ T6140] Call Trace: [ 58.284189][ T6140] [ 58.284196][ T6140] dump_stack_lvl+0x100/0x190 [ 58.284227][ T6140] should_fail_ex.cold+0x5/0xa [ 58.284252][ T6140] should_failslab+0xc2/0x120 [ 58.284279][ T6140] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 58.284302][ T6140] ? __alloc_skb+0x5b7/0x710 [ 58.284324][ T6140] ? __alloc_skb+0x140/0x710 [ 58.284351][ T6140] __alloc_skb+0x140/0x710 [ 58.284374][ T6140] ? __alloc_skb+0x5b7/0x710 [ 58.284396][ T6140] ? __pfx___alloc_skb+0x10/0x10 [ 58.284419][ T6140] ? futex_wait+0x11e/0x370 [ 58.284440][ T6140] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 58.284468][ T6140] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 58.284504][ T6140] nfc_genl_device_removed+0x7e/0x310 [ 58.284530][ T6140] ? __pfx_nfc_genl_device_removed+0x10/0x10 [ 58.284554][ T6140] ? __pfx___fsnotify_parent+0x10/0x10 [ 58.284605][ T6140] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 58.284637][ T6140] nfc_unregister_rfkill+0x22/0x2b0 [ 58.284667][ T6140] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 58.284696][ T6140] nci_unregister_device+0x3e/0x330 [ 58.284718][ T6140] ? ima_file_free+0xc6/0x340 [ 58.284741][ T6140] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 58.284769][ T6140] virtual_ncidev_close+0x4b/0xa0 [ 58.284797][ T6140] __fput+0x3ff/0xb50 [ 58.284827][ T6140] fput_close_sync+0x118/0x250 [ 58.284853][ T6140] ? __pfx_fput_close_sync+0x10/0x10 [ 58.284882][ T6140] __ia32_sys_close+0x8b/0x120 [ 58.284907][ T6140] __do_fast_syscall_32+0x13a/0x8b0 [ 58.284939][ T6140] do_fast_syscall_32+0x32/0x70 [ 58.284968][ T6140] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 58.284990][ T6140] RIP: 0023:0xf7f82fec [ 58.285010][ T6140] Code: Unable to access opcode bytes at 0xf7f82fc2. [ 58.285018][ T6140] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000006 [ 58.285041][ T6140] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 58.285053][ T6140] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 58.285064][ T6140] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 58.285076][ T6140] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 58.285087][ T6140] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 58.285112][ T6140] [ 58.714718][ T6155] kAFS: No cell specified [ 59.188127][ T6158] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 59.200529][ T6158] Bluetooth: MGMT ver 1.23 [ 59.293911][ T6160] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 60.104780][ T9] usb 8-1: USB disconnect, device number 3 [ 60.788131][ T6188] capability: warning: `syz.1.74' uses deprecated v2 capabilities in a way that may be insecure [ 60.828576][ T6188] FAULT_INJECTION: forcing a failure. [ 60.828576][ T6188] name failslab, interval 1, probability 0, space 0, times 0 [ 60.828608][ T6188] CPU: 2 UID: 0 PID: 6188 Comm: syz.1.74 Not tainted syzkaller #0 PREEMPT(full) [ 60.828629][ T6188] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 60.828640][ T6188] Call Trace: [ 60.828647][ T6188] [ 60.828654][ T6188] dump_stack_lvl+0x100/0x190 [ 60.828682][ T6188] should_fail_ex.cold+0x5/0xa [ 60.828708][ T6188] should_failslab+0xc2/0x120 [ 60.828732][ T6188] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 60.828755][ T6188] ? snd_pcm_hw_rule_add+0x3b3/0x510 [ 60.828785][ T6188] krealloc_node_align_noprof+0x321/0x3e0 [ 60.828807][ T6188] snd_pcm_hw_rule_add+0x3b3/0x510 [ 60.828830][ T6188] ? __pfx_snd_pcm_hw_rule_format+0x10/0x10 [ 60.828850][ T6188] ? __pfx_snd_pcm_hw_rule_add+0x10/0x10 [ 60.828875][ T6188] ? mutex_init_lockdep+0xf1/0x120 [ 60.828901][ T6188] ? snd_pcm_attach_substream+0x287/0xd20 [ 60.828926][ T6188] snd_pcm_open_substream+0x54a/0x1850 [ 60.828945][ T6188] ? __kasan_kmalloc+0xa0/0xb0 [ 60.828962][ T6188] ? __pfx_snd_pcm_open_substream+0x10/0x10 [ 60.828980][ T6188] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 60.829006][ T6188] ? snd_pcm_oss_open+0x5c5/0x1380 [ 60.829035][ T6188] snd_pcm_oss_open+0x715/0x1380 [ 60.829070][ T6188] ? __pfx_snd_pcm_oss_open+0x10/0x10 [ 60.829096][ T6188] ? __pfx_default_wake_function+0x10/0x10 [ 60.829139][ T6188] ? __lock_acquire+0x5c0/0x1f40 [ 60.829174][ T6188] ? do_raw_spin_lock+0x128/0x260 [ 60.829203][ T6188] ? soundcore_open+0x231/0x5a0 [ 60.829252][ T6188] ? __pfx_snd_pcm_oss_open+0x10/0x10 [ 60.829283][ T6188] soundcore_open+0x2e3/0x5a0 [ 60.829310][ T6188] ? __pfx_soundcore_open+0x10/0x10 [ 60.829335][ T6188] chrdev_open+0x234/0x6a0 [ 60.829359][ T6188] ? __pfx_chrdev_open+0x10/0x10 [ 60.829381][ T6188] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 60.829407][ T6188] do_dentry_open+0x6ab/0x14d0 [ 60.829427][ T6188] ? __pfx_chrdev_open+0x10/0x10 [ 60.829462][ T6188] vfs_open+0x82/0x3f0 [ 60.829489][ T6188] path_openat+0x19fa/0x2440 [ 60.829514][ T6188] ? __pfx_path_openat+0x10/0x10 [ 60.829541][ T6188] do_file_open+0x20e/0x430 [ 60.829564][ T6188] ? __pfx_do_file_open+0x10/0x10 [ 60.829602][ T6188] ? _raw_spin_unlock+0x28/0x50 [ 60.829624][ T6188] ? alloc_fd+0x471/0x7a0 [ 60.829647][ T6188] do_sys_openat2+0x10f/0x1e0 [ 60.829674][ T6188] ? __pfx_do_sys_openat2+0x10/0x10 [ 60.829707][ T6188] __ia32_compat_sys_openat+0x12d/0x210 [ 60.829734][ T6188] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 60.829769][ T6188] __do_fast_syscall_32+0x13a/0x8b0 [ 60.829796][ T6188] do_fast_syscall_32+0x32/0x70 [ 60.829822][ T6188] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 60.829844][ T6188] RIP: 0023:0xf7fc8fec [ 60.829864][ T6188] Code: Unable to access opcode bytes at 0xf7fc8fc2. [ 60.829872][ T6188] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 60.829890][ T6188] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000000 [ 60.829901][ T6188] RDX: 0000000000020080 RSI: 0000000000000000 RDI: 0000000000000000 [ 60.829909][ T6188] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 60.829918][ T6188] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 60.829928][ T6188] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 60.829952][ T6188] [ 61.383793][ T6198] netlink: 24 bytes leftover after parsing attributes in process `syz.2.77'. [ 61.389733][ C0] unchecked MSR access error: WRMSR to 0x404 (tried to write 0x0000000000000001) at rIP: 0xffffffff81b2afda (__mcheck_cpu_init_prepare_banks+0x18a/0x380) [ 61.389761][ C0] Call Trace: [ 61.389765][ C0] [ 61.389771][ C0] ? __pfx___mcheck_cpu_init_prepare_banks+0x10/0x10 [ 61.389782][ C0] ? sched_clock_cpu+0x6c/0x570 [ 61.389795][ C0] ? find_held_lock+0x2b/0x80 [ 61.389805][ C0] ? tick_nohz_irq_exit+0x142/0x240 [ 61.389821][ C0] ? __pfx_mce_cpu_restart+0x10/0x10 [ 61.389830][ C0] mce_cpu_restart+0xd5/0x1f0 [ 61.389844][ C0] __flush_smp_call_function_queue+0x289/0x8c0 [ 61.389861][ C0] __sysvec_call_function+0x81/0x420 [ 61.389876][ C0] sysvec_call_function+0x9e/0xc0 [ 61.389890][ C0] [ 61.389893][ C0] [ 61.389897][ C0] asm_sysvec_call_function+0x1a/0x20 [ 61.389907][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 61.389921][ C0] Code: 48 9d 02 e9 43 50 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 83 45 1d 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 61.389930][ C0] RSP: 0018:ffffffff8ea07cf0 EFLAGS: 00000202 [ 61.389939][ C0] RAX: 00000000000f7b75 RBX: ffffffff8ea91540 RCX: ffffffff8bce7185 [ 61.389945][ C0] RDX: 0000000000000001 RSI: ffffffff8e3f18bd RDI: ffffffff8c622c80 [ 61.389951][ C0] RBP: fffffbfff1d522a8 R08: 0000000000000001 R09: ffffed10056467bd [ 61.389957][ C0] R10: ffff88802b233deb R11: 0000000000000001 R12: 0000000000000000 [ 61.389962][ C0] R13: 0000000000000000 R14: 1ffffffff1d40fa2 R15: dffffc0000000000 [ 61.389971][ C0] ? ct_kernel_exit+0x125/0x180 [ 61.389988][ C0] default_idle+0x9/0x10 [ 61.389996][ C0] default_idle_call+0x6c/0xb0 [ 61.390005][ C0] do_idle+0x3ae/0x5b0 [ 61.390014][ C0] ? __pfx_do_idle+0x10/0x10 [ 61.390026][ C0] cpu_startup_entry+0x4f/0x60 [ 61.390035][ C0] rest_init+0x2d3/0x2e0 [ 61.390045][ C0] ? __pfx_rest_init+0x10/0x10 [ 61.390059][ C0] ? __pfx_kernel_init+0x10/0x10 [ 61.390069][ C0] ? acpi_ut_status_exit+0x111/0x1c0 [ 61.390081][ C0] ? acpi_ut_status_exit+0x111/0x1c0 [ 61.390092][ C0] ? acpi_enable_subsystem+0x4d9/0x4f0 [ 61.390105][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 61.390121][ C0] start_kernel+0x48e/0x490 [ 61.390135][ C0] x86_64_start_reservations+0x24/0x30 [ 61.390149][ C0] x86_64_start_kernel+0x12b/0x130 [ 61.390163][ C0] common_startup_64+0x13e/0x158 [ 61.390181][ C0] [ 61.398963][ T6198] ======================================================= [ 61.398963][ T6198] WARNING: The mand mount option has been deprecated and [ 61.398963][ T6198] and is ignored by this kernel. Remove the mand [ 61.398963][ T6198] option from the mount to silence this warning. [ 61.398963][ T6198] ======================================================= [ 61.508177][ T6200] netlink: 'syz.3.78': attribute type 10 has an invalid length. [ 61.508432][ T6200] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.510236][ T6200] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.516587][ T6200] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.516904][ T6200] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.517198][ T6200] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.517351][ T6200] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.521657][ T6200] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 61.567500][ T6202] netlink: 4 bytes leftover after parsing attributes in process `syz.1.79'. [ 61.749462][ T6212] netlink: 12 bytes leftover after parsing attributes in process `syz.1.84'. [ 61.752943][ T6212] netlink: 'syz.1.84': attribute type 1 has an invalid length. [ 61.752956][ T6212] netlink: 224 bytes leftover after parsing attributes in process `syz.1.84'. [ 62.081645][ T6223] syz.2.86 (6223): drop_caches: 2 [ 62.930630][ T6238] block nbd0: NBD_DISCONNECT [ 68.462079][ T6259] af_packet: tpacket_rcv: packet too big, clamped from 60 to 4294967272. macoff=96 [ 68.464169][ T6259] netlink: 'syz.1.95': attribute type 1 has an invalid length. [ 69.093653][ T6259] 8021q: adding VLAN 0 to HW filter on device bond1 [ 69.512052][ T6269] bond1: (slave geneve2): making interface the new active one [ 69.536152][ T6269] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 71.167479][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.167914][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.899802][ T6286] block nbd3: NBD_DISCONNECT [ 72.399006][ T6283] netlink: 4 bytes leftover after parsing attributes in process `syz.0.102'. [ 73.130692][ T1041] cfg80211: failed to load regulatory.db [ 73.912248][ T6293] netlink: 'syz.2.103': attribute type 10 has an invalid length. [ 73.956282][ T6293] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 75.188194][ T6295] netlink: 'syz.2.106': attribute type 1 has an invalid length. [ 75.789297][ T6295] 8021q: adding VLAN 0 to HW filter on device bond2 [ 76.168699][ T6295] process 'syz.2.106' launched '/dev/fd/7' with NULL argv: empty string added [ 76.481633][ T6300] bond2: (slave geneve2): making interface the new active one [ 76.493508][ T6300] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 76.493634][ T5842] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.623737][ T5842] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.651852][ T5842] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.651948][ T5842] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.849530][ T35] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 81.049243][ T35] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 81.078442][ T35] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 81.120669][ T35] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 81.120702][ T35] usb 7-1: Product: syz [ 81.120722][ T35] usb 7-1: Manufacturer: syz [ 81.120741][ T35] usb 7-1: SerialNumber: syz [ 81.622229][ T35] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 81.887926][ T9] usb 7-1: USB disconnect, device number 3 [ 82.042882][ T9] usblp0: removed [ 83.507508][ T6335] netlink: 4 bytes leftover after parsing attributes in process `syz.3.114'. [ 84.406102][ T6343] syzkaller0: entered promiscuous mode [ 84.406148][ T6343] syzkaller0: entered allmulticast mode [ 87.263032][ T6367] netlink: 12 bytes leftover after parsing attributes in process `syz.0.123'. [ 87.456609][ T6367] netlink: 'syz.0.123': attribute type 1 has an invalid length. [ 87.456641][ T6367] netlink: 224 bytes leftover after parsing attributes in process `syz.0.123'. [ 87.795529][ T6364] device-mapper: table: 248:0: thin-pool: Error creating metadata object (-EIO) [ 87.795554][ T6364] device-mapper: ioctl: error adding target to table [ 93.797602][ T6398] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 96.903814][ T6428] netlink: 12 bytes leftover after parsing attributes in process `syz.0.131'. [ 99.210273][ T6415] syzkaller0: entered promiscuous mode [ 99.210302][ T6415] syzkaller0: entered allmulticast mode [ 105.199918][ T9] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 105.339008][ T6440] FAULT_INJECTION: forcing a failure. [ 105.339008][ T6440] name failslab, interval 1, probability 0, space 0, times 0 [ 105.339064][ T6440] CPU: 0 UID: 0 PID: 6440 Comm: syz.3.135 Not tainted syzkaller #0 PREEMPT(full) [ 105.339096][ T6440] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.339112][ T6440] Call Trace: [ 105.339170][ T6440] [ 105.339206][ T6440] dump_stack_lvl+0x100/0x190 [ 105.339361][ T6440] should_fail_ex.cold+0x5/0xa [ 105.339573][ T6440] should_failslab+0xc2/0x120 [ 105.339651][ T6440] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 105.339749][ T6440] ? __alloc_skb+0x5b7/0x710 [ 105.339847][ T6440] ? __alloc_skb+0x140/0x710 [ 105.340170][ T6440] __alloc_skb+0x140/0x710 [ 105.340211][ T6440] ? __alloc_skb+0x5b7/0x710 [ 105.340284][ T6440] ? __pfx___alloc_skb+0x10/0x10 [ 105.340407][ T6440] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 105.340620][ T6440] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 105.340766][ T6440] nfc_genl_device_removed+0x7e/0x310 [ 105.340847][ T6440] ? __pfx_nfc_genl_device_removed+0x10/0x10 [ 105.340947][ T6440] ? __pfx___fsnotify_parent+0x10/0x10 [ 105.341215][ T6440] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 105.341385][ T6440] nfc_unregister_rfkill+0x22/0x2b0 [ 105.341457][ T6440] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 105.341507][ T6440] nci_unregister_device+0x3e/0x330 [ 105.341559][ T6440] ? ima_file_free+0xc6/0x340 [ 105.341665][ T6440] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 105.341801][ T6440] virtual_ncidev_close+0x4b/0xa0 [ 105.341914][ T6440] __fput+0x3ff/0xb50 [ 105.342198][ T6440] fput_close_sync+0x118/0x250 [ 105.342348][ T6440] ? __pfx_fput_close_sync+0x10/0x10 [ 105.342647][ T6440] __ia32_sys_close+0x8b/0x120 [ 105.342757][ T6440] __do_fast_syscall_32+0x13a/0x8b0 [ 105.342842][ T6440] ? lockdep_hardirqs_on+0x7d/0x110 [ 105.343084][ T6440] do_fast_syscall_32+0x32/0x70 [ 105.343154][ T6440] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 105.343207][ T6440] RIP: 0023:0xf700efec [ 105.343297][ T6440] Code: Unable to access opcode bytes at 0xf700efc2. [ 105.343317][ T6440] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000006 [ 105.343360][ T6440] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 105.343384][ T6440] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 105.343404][ T6440] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 105.343427][ T6440] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 105.343451][ T6440] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 105.343961][ T6440] [ 105.475091][ T9] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 105.495296][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.495320][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 105.495336][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 105.495473][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.633716][ T9] usb 6-1: config 0 descriptor?? [ 106.477464][ T9] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 107.454174][ T6461] netlink: 8 bytes leftover after parsing attributes in process `syz.1.137'. [ 108.941093][ T854] usb 6-1: reset high-speed USB device number 4 using dummy_hcd [ 109.845180][ T9] usb 6-1: USB disconnect, device number 4 [ 111.183624][ T6474] block nbd1: NBD_DISCONNECT [ 119.668623][ T6499] Could not find key with description: [syz] [ 119.668650][ T6499] process_request_key_err: No key [ 119.668668][ T6499] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 119.668689][ T6499] One or more global auth toks could not properly register; rc = [-2] [ 119.695774][ T6499] Error validating options; rc = [-2] [ 122.222786][ T6506] bond2: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 122.282984][ T6506] bond2: (slave lo): Enslaving as an active interface with an up link [ 122.311405][ T6506] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 123.754777][ T6516] block nbd2: NBD_DISCONNECT [ 128.009556][ T35] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 128.284850][ T35] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 128.302270][ T35] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 128.338853][ T35] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 128.338893][ T35] usb 6-1: Product: syz [ 128.338920][ T35] usb 6-1: Manufacturer: syz [ 128.338947][ T35] usb 6-1: SerialNumber: syz [ 128.776349][ T35] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 5 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 129.135801][ T35] usb 6-1: USB disconnect, device number 5 [ 129.448352][ T35] usblp0: removed [ 132.611761][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.612046][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.965877][ T6557] netlink: 12 bytes leftover after parsing attributes in process `syz.2.160'. [ 135.271146][ T6557] netlink: 'syz.2.160': attribute type 1 has an invalid length. [ 135.271186][ T6557] netlink: 224 bytes leftover after parsing attributes in process `syz.2.160'. [ 138.477862][ T6572] syzkaller0: entered promiscuous mode [ 138.477881][ T6572] syzkaller0: entered allmulticast mode [ 141.778720][ T6589] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 143.879872][ T35] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 144.130236][ T35] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 144.240898][ T35] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 144.336401][ T35] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 144.336438][ T35] usb 5-1: Product: syz [ 144.336464][ T35] usb 5-1: Manufacturer: syz [ 144.336490][ T35] usb 5-1: SerialNumber: syz [ 144.946707][ T35] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 145.260045][ T5741] usb 5-1: USB disconnect, device number 2 [ 145.418092][ T5741] usblp0: removed [ 154.792258][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 156.389579][ T9] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 156.566559][ T9] usb 8-1: Using ep0 maxpacket: 16 [ 156.572116][ T9] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 156.629817][ T9] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 156.684584][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.684608][ T9] usb 8-1: Product: syz [ 156.684623][ T9] usb 8-1: Manufacturer: syz [ 156.684638][ T9] usb 8-1: SerialNumber: syz [ 156.912017][ T9] usb 8-1: config 0 descriptor?? [ 157.090043][ T9] em28xx 8-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 157.090068][ T9] em28xx 8-1:0.0: DVB interface 0 found: bulk [ 157.929278][ T9] em28xx 8-1:0.0: unknown em28xx chip ID (0) [ 159.335405][ T9] em28xx 8-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 159.335442][ T9] em28xx 8-1:0.0: board has no eeprom [ 159.661286][ T9] em28xx 8-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 159.661323][ T9] em28xx 8-1:0.0: dvb set to bulk mode. [ 159.663926][ T5881] em28xx 8-1:0.0: Binding DVB extension [ 160.134670][ T9] usb 8-1: USB disconnect, device number 4 [ 160.401704][ T9] em28xx 8-1:0.0: Disconnecting em28xx [ 160.534365][ T5881] em28xx 8-1:0.0: Registering input extension [ 160.554770][ T9] em28xx 8-1:0.0: Closing input extension [ 161.044379][ T9] em28xx: Freeing device [ 165.430960][ T5745] Bluetooth: hci2: command 0x0406 tx timeout [ 165.431108][ T5745] Bluetooth: hci3: command 0x0406 tx timeout [ 165.446349][ T5745] Bluetooth: hci0: command 0x0406 tx timeout [ 167.961264][ T6700] sctp_transport_update_pmtu: 48 callbacks suppressed [ 167.961295][ T6700] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 167.979941][ T6700] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 167.993185][ T6700] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 168.038015][ T6700] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 168.110007][ T6700] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 168.116705][ T6700] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 168.143948][ T6700] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 168.149092][ T6700] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 168.163873][ T6700] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 168.182269][ T6700] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 182.419033][ T6766] sctp_transport_update_pmtu: 48 callbacks suppressed [ 182.419069][ T6766] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 182.432643][ T6766] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 182.437962][ T6766] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 182.454563][ T6766] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 182.476690][ T6766] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 182.486127][ T6766] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 182.496378][ T6766] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 182.502691][ T6766] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 182.520201][ T6766] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 182.524557][ T6766] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 183.673892][ T6770] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 186.105999][ T6779] netlink: 12 bytes leftover after parsing attributes in process `syz.3.208'. [ 186.385547][ T6783] netlink: 'syz.3.208': attribute type 1 has an invalid length. [ 186.385587][ T6783] netlink: 224 bytes leftover after parsing attributes in process `syz.3.208'. [ 188.348609][ T6791] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 188.847142][ T6796] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 192.777539][ T6811] syz.0.213 (6811): drop_caches: 2 [ 194.164816][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.165220][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 199.209343][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 200.273459][ T6835] netlink: 12 bytes leftover after parsing attributes in process `syz.1.222'. [ 200.474663][ T6835] netlink: 'syz.1.222': attribute type 1 has an invalid length. [ 200.474704][ T6835] netlink: 224 bytes leftover after parsing attributes in process `syz.1.222'. [ 203.612009][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 204.604457][ T6849] syz.1.226 (6849): drop_caches: 2 [ 206.903935][ T6861] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 216.699718][ T35] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 216.876208][ T35] usb 8-1: Using ep0 maxpacket: 32 [ 216.884014][ T35] usb 8-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 216.895937][ T35] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 216.917475][ T35] usb 8-1: config 0 descriptor?? [ 217.192675][ T35] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 217.232171][ T35] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 217.240743][ T35] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 217.241001][ T35] usb 8-1: media controller created [ 217.409266][ T35] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 218.956817][ T35] az6027: usb out operation failed. (-71) [ 218.996990][ T35] az6027: usb out operation failed. (-71) [ 218.997020][ T35] stb0899_attach: Driver disabled by Kconfig [ 218.997037][ T35] az6027: no front-end attached [ 218.997037][ T35] [ 219.007830][ T35] az6027: usb out operation failed. (-71) [ 219.007852][ T35] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 219.121325][ T35] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb8/8-1/input/input8 [ 219.208027][ T35] dvb-usb: schedule remote query interval to 400 msecs. [ 219.208066][ T35] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 219.328043][ T35] usb 8-1: USB disconnect, device number 5 [ 221.744550][ T35] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 227.319725][ T6955] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 227.320445][ T6955] block device autoloading is deprecated and will be removed. [ 230.072071][ T6961] syz.3.244 (6961): drop_caches: 2 [ 233.580078][ T35] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 233.903899][ T35] usb 6-1: Using ep0 maxpacket: 32 [ 235.526960][ T35] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 235.757183][ T35] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.063563][ T35] usb 6-1: config 0 descriptor?? [ 236.818499][ T35] usb 6-1: can't set config #0, error -71 [ 236.957336][ T35] usb 6-1: USB disconnect, device number 6 [ 242.409100][ T7010] syz.2.257 (7010): drop_caches: 2 [ 244.597888][ T6991] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.608533][ T6991] bridge0: port 1(bridge_slave_0) entered disabled state [ 245.458783][ T6991] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 245.552769][ T6991] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 247.320283][ T5810] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.320497][ T5810] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.320644][ T5810] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.320762][ T5810] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.493602][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.494041][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 262.341127][ T7069] netlink: 'syz.1.271': attribute type 2 has an invalid length. [ 262.440860][ T7071] mmap: syz.0.272 (7071) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.   @ [ 265.409481][ T43] audit: type=1800 audit(1790054901.893:3): pid=7096 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.279" name="(" dev="sda1" ino=2038 res=0 errno=0 [ 265.563282][ T7094] warning: `syz.2.278' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 266.193974][ T7094] i2c i2c-0: new_device: Instantiated device rt1715 at 0x04 [ 268.790205][ T7111] i2c i2c-0: delete_device: Can't find device in list [ 270.326713][ T1164] IPVS: starting estimator thread 0... [ 270.429824][ T7120] IPVS: using max 6 ests per chain, 14400 per kthread [ 270.895400][ T7119] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 288.087011][ T7204] FAULT_INJECTION: forcing a failure. [ 288.087011][ T7204] name failslab, interval 1, probability 0, space 0, times 0 [ 288.087044][ T7204] CPU: 1 UID: 0 PID: 7204 Comm: syz.1.302 Not tainted syzkaller #0 PREEMPT(full) [ 288.087063][ T7204] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 288.087075][ T7204] Call Trace: [ 288.087095][ T7204] [ 288.087115][ T7204] dump_stack_lvl+0x100/0x190 [ 288.087221][ T7204] should_fail_ex.cold+0x5/0xa [ 288.087318][ T7204] ? __pfx_switchdev_port_obj_del_deferred+0x10/0x10 [ 288.087345][ T7204] should_failslab+0xc2/0x120 [ 288.087392][ T7204] __kmalloc_noprof+0xfc/0x840 [ 288.087423][ T7204] ? mark_held_locks+0x40/0x70 [ 288.087477][ T7204] ? switchdev_deferred_enqueue+0x3e/0x2d0 [ 288.087620][ T7204] ? __pfx_switchdev_port_obj_del_deferred+0x10/0x10 [ 288.087644][ T7204] switchdev_deferred_enqueue+0x3e/0x2d0 [ 288.087725][ T7204] switchdev_port_obj_del+0xf3/0x150 [ 288.087801][ T7204] br_switchdev_host_mdb+0x203/0x3a0 [ 288.087965][ T7204] ? __pfx_br_switchdev_host_mdb+0x10/0x10 [ 288.088165][ T7204] ? lockdep_hardirqs_on+0x7d/0x110 [ 288.088255][ T7204] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 288.088291][ T7204] ? __wake_up+0x3f/0x60 [ 288.088380][ T7204] br_switchdev_mdb_notify+0x4b9/0x570 [ 288.088472][ T7204] ? __pfx_br_switchdev_mdb_notify+0x10/0x10 [ 288.088596][ T7204] ? __pfx_br_multicast_star_g_host_state+0x10/0x10 [ 288.088644][ T7204] ? nlmsg_notify+0xbf/0x290 [ 288.088798][ T7204] __br_mdb_notify+0x5c4/0x830 [ 288.088912][ T7204] br_multicast_host_leave+0x192/0x230 [ 288.088998][ T7204] br_mdb_del_bulk+0x7e8/0xad0 [ 288.089141][ T7204] ? __pfx_br_mdb_del_bulk+0x10/0x10 [ 288.089164][ T7204] ? __mutex_lock+0x829/0x1bd0 [ 288.089401][ T7204] ? __nla_parse+0x40/0x60 [ 288.089456][ T7204] ? __pfx_br_mdb_del_bulk+0x10/0x10 [ 288.089512][ T7204] rtnl_mdb_del+0x2f1/0x650 [ 288.089590][ T7204] ? __pfx_rtnl_mdb_del+0x10/0x10 [ 288.089758][ T7204] ? __pfx_rtnl_mdb_del+0x10/0x10 [ 288.089833][ T7204] rtnetlink_rcv_msg+0x3c9/0xe90 [ 288.089969][ T7204] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 288.089996][ T7204] ? trace_event_buffer_commit+0x20a/0xa80 [ 288.090142][ T7204] ? trace_event_raw_event_lock+0x1e2/0x2b0 [ 288.090273][ T7204] netlink_rcv_skb+0x159/0x420 [ 288.090312][ T7204] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 288.090391][ T7204] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 288.090610][ T7204] ? netlink_deliver_tap+0x1ae/0xcc0 [ 288.090800][ T7204] netlink_unicast+0x585/0x850 [ 288.090893][ T7204] ? __pfx_netlink_unicast+0x10/0x10 [ 288.091096][ T7204] netlink_sendmsg+0x8b0/0xda0 [ 288.091232][ T7204] ? __pfx_netlink_sendmsg+0x10/0x10 [ 288.091349][ T7204] ? apparmor_socket_sendmsg+0x165/0x280 [ 288.091474][ T7204] ____sys_sendmsg+0xa4d/0xbe0 [ 288.091511][ T7204] ? __pfx_netlink_sendmsg+0x10/0x10 [ 288.091624][ T7204] ? __pfx_____sys_sendmsg+0x10/0x10 [ 288.091754][ T7204] ? trace_buffer_unlock_commit_regs+0x37b/0x540 [ 288.091931][ T7204] ___sys_sendmsg+0x190/0x1e0 [ 288.092007][ T7204] ? __pfx____sys_sendmsg+0x10/0x10 [ 288.092058][ T7204] ? trace_event_raw_event_lock+0x1e2/0x2b0 [ 288.092433][ T7204] ? find_held_lock+0x2b/0x80 [ 288.092952][ T7204] __sys_sendmsg+0x160/0x210 [ 288.093038][ T7204] ? __pfx___sys_sendmsg+0x10/0x10 [ 288.093591][ T7204] __do_fast_syscall_32+0x13a/0x8b0 [ 288.093662][ T7204] ? lockdep_hardirqs_on+0x7d/0x110 [ 288.093876][ T7204] do_fast_syscall_32+0x32/0x70 [ 288.093986][ T7204] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 288.094030][ T7204] RIP: 0023:0xf7fc8fec [ 288.094097][ T7204] Code: Unable to access opcode bytes at 0xf7fc8fc2. [ 288.094113][ T7204] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 288.094147][ T7204] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800000c0 [ 288.094167][ T7204] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 288.094186][ T7204] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 288.094206][ T7204] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 288.094226][ T7204] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 288.094696][ T7204] [ 291.169766][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 295.917605][ T7247] netlink: 4 bytes leftover after parsing attributes in process `syz.1.311'. [ 299.684147][ T7114] syz.0.283 (7114) used greatest stack depth: 18984 bytes left [ 302.348483][ T7258] netlink: 8 bytes leftover after parsing attributes in process `syz.2.315'. [ 302.407654][ T7258] FAULT_INJECTION: forcing a failure. [ 302.407654][ T7258] name fail_futex, interval 1, probability 0, space 0, times 1 [ 302.407722][ T7258] CPU: 0 UID: 0 PID: 7258 Comm: syz.2.315 Not tainted syzkaller #0 PREEMPT(full) [ 302.407747][ T7258] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 302.407762][ T7258] Call Trace: [ 302.407782][ T7258] [ 302.407810][ T7258] dump_stack_lvl+0x100/0x190 [ 302.407942][ T7258] should_fail_ex.cold+0x5/0xa [ 302.408203][ T7258] get_futex_key+0x1d0/0x14f0 [ 302.408387][ T7258] ? __pfx_get_futex_key+0x10/0x10 [ 302.408603][ T7258] ? ___sys_sendmsg+0x127/0x1e0 [ 302.408853][ T7258] futex_wake+0xf4/0x5e0 [ 302.409077][ T7258] ? __pfx_futex_wake+0x10/0x10 [ 302.409345][ T7258] ? find_held_lock+0x2b/0x80 [ 302.409626][ T7258] do_futex+0x2b2/0x440 [ 302.409800][ T7258] ? __pfx_do_futex+0x10/0x10 [ 302.409939][ T7258] ? fput+0x7c/0x100 [ 302.410141][ T7258] __ia32_sys_futex_time32+0x2f4/0x470 [ 302.410275][ T7258] ? xfd_validate_state+0x129/0x190 [ 302.410343][ T7258] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 302.410770][ T7258] __do_fast_syscall_32+0x13a/0x8b0 [ 302.410953][ T7258] do_fast_syscall_32+0x32/0x70 [ 302.411075][ T7258] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 302.411149][ T7258] RIP: 0023:0xf7f82fec [ 302.411270][ T7258] Code: Unable to access opcode bytes at 0xf7f82fc2. [ 302.411283][ T7258] RSP: 002b:00000000f54465cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 302.411309][ T7258] RAX: ffffffffffffffda RBX: 00000000f7444f8c RCX: 0000000000000081 [ 302.411326][ T7258] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 302.411342][ T7258] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 302.411358][ T7258] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 302.411374][ T7258] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 302.411855][ T7258] [ 302.832885][ T7264] syzkaller0: entered promiscuous mode [ 302.832924][ T7264] syzkaller0: entered allmulticast mode [ 304.253696][ T7276] netlink: 'syz.2.316': attribute type 10 has an invalid length. [ 304.511142][ T7278] netlink: 4 bytes leftover after parsing attributes in process `syz.2.316'. [ 306.657843][ T7278] bridge_slave_1: left allmulticast mode [ 306.657876][ T7278] bridge_slave_1: left promiscuous mode [ 306.659469][ T7278] bridge0: port 2(bridge_slave_1) entered disabled state [ 306.969805][ T7278] bridge_slave_0: left allmulticast mode [ 306.969857][ T7278] bridge_slave_0: left promiscuous mode [ 306.971279][ T7278] bridge0: port 1(bridge_slave_0) entered disabled state [ 307.145601][ T7278] bond0: (slave bridge0): Releasing backup interface [ 307.579268][ T5737] Bluetooth: hci1: unexpected event for opcode 0x0c7b [ 309.675039][ T1274] IPVS: starting estimator thread 0... [ 309.860332][ T7321] IPVS: using max 7 ests per chain, 16800 per kthread [ 311.540381][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 311.949275][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 316.926459][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.926731][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 321.618384][ T7343] tipc: Enabling of bearer rejected, failed to enable media [ 321.685886][ T7351] netlink: 8 bytes leftover after parsing attributes in process `syz.3.328'. [ 328.334677][ T7386] NILFS (loop3): device size too small [ 329.020289][ T7386] netlink: 'syz.3.338': attribute type 9 has an invalid length. [ 329.020347][ T7386] netlink: 'syz.3.338': attribute type 7 has an invalid length. [ 329.020378][ T7386] netlink: 'syz.3.338': attribute type 8 has an invalid length. [ 331.199940][ T854] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 331.380541][ T854] usb 5-1: Using ep0 maxpacket: 8 [ 331.383597][ T854] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 331.402618][ T854] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 331.402824][ T854] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 331.402842][ T854] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 331.402861][ T854] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 331.402879][ T854] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 331.402999][ T854] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.801759][ T854] usb 5-1: usb_control_msg returned -32 [ 331.802147][ T854] usbtmc 5-1:16.0: can't read capabilities [ 332.433304][ T1737] usb 5-1: USB disconnect, device number 3 [ 332.459393][ T7396] usbtmc 5-1:16.0: usb_control_msg returned -71 [ 332.461179][ T7401] usbtmc 5-1:16.0: send_request_dev_dep_msg_in returned -19 [ 345.589856][ T7458] netlink: 64 bytes leftover after parsing attributes in process `syz.3.351'. [ 348.180269][ T7463] ntfs3(nullb0): Primary boot signature is not NTFS. [ 348.183873][ T7463] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 351.633433][ T7456] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 351.685056][ T7457] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 353.817731][ T25] libceph: connect (1)[c::]:6789 error -101 [ 353.820341][ T25] libceph: mon0 (1)[c::]:6789 connect error [ 353.851505][ T25] libceph: connect (1)[c::]:6789 error -101 [ 353.852688][ T25] libceph: mon0 (1)[c::]:6789 connect error [ 353.876371][ T7491] ceph: No mds server is up or the cluster is laggy [ 354.113009][ T25] libceph: connect (1)[c::]:6789 error -101 [ 354.119528][ T25] libceph: mon0 (1)[c::]:6789 connect error [ 356.957940][ T7512] netlink: 'syz.0.359': attribute type 4 has an invalid length. [ 360.312490][ T43] audit: type=1326 audit(1790054996.803:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7517 comm="syz.0.362" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 360.313956][ T43] audit: type=1326 audit(1790054996.803:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7517 comm="syz.0.362" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 360.348392][ T43] audit: type=1326 audit(1790054996.833:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7517 comm="syz.0.362" exe="/syz-executor" sig=0 arch=40000003 syscall=298 compat=1 ip=0xf701efec code=0x7ffc0000 [ 360.357893][ T43] audit: type=1326 audit(1790054996.843:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7517 comm="syz.0.362" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 360.369638][ T43] audit: type=1326 audit(1790054996.843:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7517 comm="syz.0.362" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 360.370662][ T43] audit: type=1326 audit(1790054996.863:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7517 comm="syz.0.362" exe="/syz-executor" sig=0 arch=40000003 syscall=224 compat=1 ip=0xf701efec code=0x7ffc0000 [ 360.372118][ T43] audit: type=1326 audit(1790054996.863:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7517 comm="syz.0.362" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 360.376648][ T43] audit: type=1326 audit(1790054996.863:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7517 comm="syz.0.362" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 360.377517][ T43] audit: type=1326 audit(1790054996.863:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7517 comm="syz.0.362" exe="/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf701efec code=0x7ffc0000 [ 360.415192][ T43] audit: type=1326 audit(1790054996.903:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7517 comm="syz.0.362" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 363.783867][ T7520] comedi comedi2: comedi_config --init_data is deprecated [ 369.289575][ T6168] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 369.360896][ T854] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 369.447512][ T6168] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 369.463625][ T6168] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 369.463643][ T6168] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 369.463655][ T6168] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 369.463883][ T6168] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 369.505626][ T6168] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 369.505648][ T6168] usb 7-1: Product: syz [ 369.505662][ T6168] usb 7-1: Manufacturer: syz [ 369.560423][ T854] usb 8-1: Using ep0 maxpacket: 8 [ 369.572900][ T854] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 369.604726][ T6168] cdc_wdm 7-1:1.0: skipping garbage [ 369.604759][ T6168] cdc_wdm 7-1:1.0: skipping garbage [ 369.617342][ T854] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 369.617972][ T854] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 369.617993][ T854] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 369.618013][ T854] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 369.618032][ T854] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 369.618117][ T854] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.652057][ T6168] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 369.652074][ T6168] cdc_wdm 7-1:1.0: Unknown control protocol [ 370.339265][ T854] usb 8-1: GET_CAPABILITIES returned 0 [ 370.339495][ T854] usbtmc 8-1:16.0: can't read capabilities [ 370.713961][ T854] usb 8-1: USB disconnect, device number 6 [ 371.577586][ T7561] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 371.596828][ T7561] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 373.332396][ T7576] tipc: Started in network mode [ 373.332436][ T7576] tipc: Node identity 92eb78f969cf, cluster identity 4711 [ 373.333776][ T7576] tipc: Enabled bearer , priority 0 [ 373.360963][ T7576] syzkaller0: entered promiscuous mode [ 373.360992][ T7576] syzkaller0: entered allmulticast mode [ 373.381479][ T6168] usb 7-1: USB disconnect, device number 4 [ 373.492442][ T25] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 373.531793][ T7576] tipc: Resetting bearer [ 373.583157][ T7575] tipc: Resetting bearer [ 373.671602][ T25] usb 8-1: Using ep0 maxpacket: 8 [ 373.678403][ T25] usb 8-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 373.710451][ T25] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 373.710473][ T25] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 373.710685][ T25] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 373.710703][ T25] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 373.710827][ T25] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.719614][ T7575] tipc: Disabling bearer [ 373.883301][ T25] hub 8-1:1.0: bad descriptor, ignoring hub [ 373.883353][ T25] hub 8-1:1.0: probe with driver hub failed with error -5 [ 373.914664][ T25] cdc_wdm 8-1:1.0: skipping garbage [ 373.914681][ T25] cdc_wdm 8-1:1.0: skipping garbage [ 373.991078][ T25] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 373.991106][ T25] cdc_wdm 8-1:1.0: Unknown control protocol [ 374.310319][ T7583] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 374.504011][ T854] usb 8-1: USB disconnect, device number 7 [ 377.689744][ T7602] fuse: Bad value for 'fd' [ 377.754685][ T7599] could not allocate digest TFM handle xcbc(serpent) [ 377.850532][ T7602] jffs2: notice: (7602) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 378.370046][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.370319][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.401921][ T7613] jffs2: notice: (7613) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 379.617095][ T7613] overlayfs: failed to resolve '/_wTz &yP7U!6 }nm5%fŸ9B[/fnzdh]sg6wDOpk%қ@@@ [ 379.617095][ T7613] BHF() [ 415.979516][ T7842] dump_stack_lvl+0x100/0x190 [ 415.979650][ T7842] should_fail_ex.cold+0x5/0xa [ 415.979757][ T7842] should_failslab+0xc2/0x120 [ 415.979804][ T7842] __kmalloc_cache_noprof+0x91/0x6d0 [ 415.979840][ T7842] ? get_mm_exe_file+0x8a/0x1a0 [ 415.979897][ T7842] ? get_current_details+0xa0/0x670 [ 415.980044][ T7842] get_current_details+0xa0/0x670 [ 415.980169][ T7842] landlock_merge_ruleset+0x7ea/0xd10 [ 415.980332][ T7842] __do_sys_landlock_restrict_self+0x264/0x10a0 [ 415.980498][ T7842] __do_fast_syscall_32+0x13a/0x8b0 [ 415.980611][ T7842] do_fast_syscall_32+0x32/0x70 [ 415.980662][ T7842] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 415.980694][ T7842] RIP: 0023:0xf7fc8fec [ 415.980746][ T7842] Code: Unable to access opcode bytes at 0xf7fc8fc2. [ 415.980758][ T7842] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 00000000000001be [ 415.980783][ T7842] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000000001a [ 415.980797][ T7842] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 415.980810][ T7842] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 415.980822][ T7842] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 415.980835][ T7842] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 415.981120][ T7842] [ 416.691870][ T5812] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 416.735331][ T7851] syzkaller0: entered promiscuous mode [ 416.735358][ T7851] syzkaller0: entered allmulticast mode [ 416.755654][ T7851] 0: reclassify loop, rule prio 0, protocol 700 [ 416.760363][ T7851] netlink: 168 bytes leftover after parsing attributes in process `syz.2.428'. [ 416.983876][ T5812] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 416.983989][ T5812] usb 5-1: no configurations [ 416.984008][ T5812] usb 5-1: can't read configurations, error -22 [ 427.856216][ T7927] netlink: 8 bytes leftover after parsing attributes in process `syz.2.438'. [ 434.083232][ T43] audit: type=1800 audit(1790055070.563:136): pid=7956 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.446" name="file0" dev="overlay" ino=627 res=0 errno=0 [ 434.367744][ T7958] jffs2: notice: (7958) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 434.832309][ T7958] overlayfs: failed to resolve '/_wTz &yP7U!6 }nm5%fŸ9B[/fnzdh]sg6wDOpk%қ@@@ [ 434.832309][ T7958] BHF() , priority 0 [ 463.991660][ T8092] tipc: Resetting bearer [ 464.359809][ T8090] tipc: Resetting bearer [ 464.469077][ T8090] tipc: Disabling bearer [ 465.627287][ T8106] i2c i2c-0: delete_device: Can't find device in list [ 466.959578][ T6168] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 467.129610][ T6168] usb 5-1: Using ep0 maxpacket: 32 [ 467.144203][ T6168] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 467.158816][ T6168] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 467.158839][ T6168] usb 5-1: config 0 has no interface number 0 [ 467.159040][ T6168] usb 5-1: config 0 interface 12 has no altsetting 0 [ 467.192193][ T6168] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.192212][ T6168] usb 5-1: Product: syz [ 467.192223][ T6168] usb 5-1: Manufacturer: syz [ 467.192234][ T6168] usb 5-1: SerialNumber: syz [ 467.256814][ T6168] usb 5-1: config 0 descriptor?? [ 467.980041][ T5799] usb 8-1: new full-speed USB device number 8 using dummy_hcd [ 468.482529][ T8116] netlink: 'syz.3.489': attribute type 1 has an invalid length. [ 468.482663][ T8116] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 468.529734][ T5799] usb 8-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 468.529826][ T5799] usb 8-1: no configurations [ 468.529841][ T5799] usb 8-1: can't read configurations, error -22 [ 469.669438][ T8110] nvme nvme0: rdma_resolve_addr failed (-19). [ 470.285221][ T6168] f81534 5-1:0.12: f81534_set_register: reg: 1002 data: 2f failed: -71 [ 470.285478][ T6168] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 470.285496][ T6168] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 470.286608][ T6168] f81534 5-1:0.12: probe with driver f81534 failed with error -71 [ 470.347392][ T6168] usb 5-1: USB disconnect, device number 6 [ 470.766858][ T0] NOHZ tick-stop error: local softirq work is pending, handler #288!!! [ 474.315753][ T8140] netlink: 76 bytes leftover after parsing attributes in process `syz.0.494'. [ 475.685958][ T8145] netlink: 'syz.2.495': attribute type 4 has an invalid length. [ 476.817815][ T8151] netlink: 'syz.2.498': attribute type 12 has an invalid length. [ 477.333448][ T8148] i2c i2c-0: delete_device: Can't find device in list [ 480.185149][ T8160] netlink: 4 bytes leftover after parsing attributes in process `syz.3.500'. [ 480.251459][ T8160] netlink: 68 bytes leftover after parsing attributes in process `syz.3.500'. [ 489.019706][ T8195] 8250_pericom 0000:00:00.0: probe with driver 8250_pericom failed with error -12 [ 489.098618][ T8195] 8250_pericom 0000:00:00.0: probe with driver 8250_pericom failed with error -12 [ 490.751528][ T35] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 490.923177][ T35] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 490.940735][ T35] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 490.940756][ T35] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 490.940768][ T35] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 490.941000][ T35] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 490.971534][ T35] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 490.971553][ T35] usb 6-1: Product: syz [ 490.971565][ T35] usb 6-1: Manufacturer: syz [ 491.070260][ T35] cdc_wdm 6-1:1.0: skipping garbage [ 491.070276][ T35] cdc_wdm 6-1:1.0: skipping garbage [ 491.190525][ T35] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 491.190544][ T35] cdc_wdm 6-1:1.0: Unknown control protocol [ 491.478626][ T8201] smbdirect: ib_dev[syz5]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 491.478652][ T8201] smbdirect: ib_dev[syz5]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 491.478676][ T8201] smbdirect: ib_dev[syz5]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 492.098156][ T8201] infiniband syz5: RDMA CMA: cma_listen_on_dev, error -98 [ 494.490463][ T42] usb 8-1: new full-speed USB device number 10 using dummy_hcd [ 494.605634][ T8198] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 494.631749][ T8198] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 494.968569][ T42] usb 8-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 494.968662][ T42] usb 8-1: no configurations [ 494.968677][ T42] usb 8-1: can't read configurations, error -22 [ 495.597034][ T8217] No such timeout policy "syz1" [ 496.339724][ T5881] usb 6-1: USB disconnect, device number 7 [ 497.760946][ T8231] : renamed from bond_slave_0 (while UP) [ 501.245588][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.246078][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 503.105164][ T8153] syz.3.496 (8153) used greatest stack depth: 16704 bytes left [ 503.141886][ T8253] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 503.143359][ T8253] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 503.143378][ T8253] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 507.280941][ T8269] netlink: 4 bytes leftover after parsing attributes in process `syz.3.528'. [ 511.588274][ T8297] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 515.448180][ T8317] netlink: 96 bytes leftover after parsing attributes in process `syz.1.535'. [ 515.448204][ T8317] netlink: 96 bytes leftover after parsing attributes in process `syz.1.535'. [ 516.912007][ T8322] netlink: 8 bytes leftover after parsing attributes in process `syz.3.536'. [ 516.912057][ T8322] netlink: 4 bytes leftover after parsing attributes in process `syz.3.536'. [ 516.966785][ T8325] netlink: 'syz.3.536': attribute type 4 has an invalid length. [ 516.966815][ T8325] netlink: 152 bytes leftover after parsing attributes in process `syz.3.536'. [ 517.548515][ T8321] 8021q: adding VLAN 0 to HW filter on device bond1 [ 517.578172][ T8328] Need at least one configuration in g1. [ 517.584332][ T8328] udc dummy_udc.0: failed to start g1: -22 [ 517.584361][ T8328] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 517.620805][ T8328] UDC core: g1: couldn't find an available UDC or it's busy [ 517.672762][ T8329] netlink: 4 bytes leftover after parsing attributes in process `syz.0.537'. [ 517.685979][ T8322] 8021q: adding VLAN 0 to HW filter on device bond0 [ 517.709948][ T8322] bond1: (slave bond0): making interface the new active one [ 517.722560][ T8322] bond1: (slave bond0): Enslaving as an active interface with an up link [ 517.758619][ T8325] .`: renamed from bond0 (while UP) [ 517.790498][ T8325] bond1: Primary slave changed to .`, reselecting active slave [ 518.570422][ T5842] bond1: (slave .`): link status definitely down, disabling slave [ 518.587560][ T5842] bond1: now running without any active interface! [ 518.594554][ T69] smbdirect: ib_dev[syz1] removed [ 518.596901][ T42] syz1: Port: 1 Link DOWN [ 525.275527][ T8372] FAULT_INJECTION: forcing a failure. [ 525.275527][ T8372] name failslab, interval 1, probability 0, space 0, times 0 [ 525.275556][ T8372] CPU: 3 UID: 0 PID: 8372 Comm: syz.3.548 Not tainted syzkaller #0 PREEMPT(full) [ 525.275573][ T8372] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 525.275583][ T8372] Call Trace: [ 525.275597][ T8372] [ 525.275613][ T8372] dump_stack_lvl+0x100/0x190 [ 525.275706][ T8372] should_fail_ex.cold+0x5/0xa [ 525.275880][ T8372] should_failslab+0xc2/0x120 [ 525.275918][ T8372] __kmalloc_noprof+0xfc/0x840 [ 525.275968][ T8372] ? __memcg_list_lru_alloc+0x418/0x680 [ 525.276130][ T8372] __memcg_list_lru_alloc+0x418/0x680 [ 525.276189][ T8372] ? xa_load+0x149/0x2c0 [ 525.276291][ T8372] ? __pfx___memcg_list_lru_alloc+0x10/0x10 [ 525.276464][ T8372] ? rcu_read_unlock+0x17/0x60 [ 525.276591][ T8372] memcg_list_lru_alloc+0xd3/0x100 [ 525.276746][ T8372] __memcg_slab_post_alloc_hook+0x27b/0x1270 [ 525.276917][ T8372] ? kasan_save_track+0x14/0x30 [ 525.277038][ T8372] kmem_cache_alloc_lru_noprof+0x4f6/0x6a0 [ 525.277079][ T8372] ? __d_alloc+0x35/0xa50 [ 525.277203][ T8372] __d_alloc+0x35/0xa50 [ 525.277243][ T8372] ? inode_set_ctime_current+0x283/0x850 [ 525.277349][ T8372] d_alloc_pseudo+0x1c/0xc0 [ 525.277393][ T8372] alloc_file_pseudo+0x118/0x290 [ 525.277483][ T8372] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 525.277672][ T8372] dma_buf_export+0x326/0xc60 [ 525.277751][ T8372] ? sg_alloc_table+0x4c/0x1c0 [ 525.277869][ T8372] system_heap_allocate+0xbb1/0x11f0 [ 525.278012][ T8372] ? __pfx_system_heap_allocate+0x10/0x10 [ 525.278142][ T8372] ? __might_fault+0xc5/0x140 [ 525.278409][ T8372] dma_heap_ioctl+0x3a0/0x6d0 [ 525.278514][ T8372] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 525.278824][ T8372] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 525.278892][ T8372] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 525.279019][ T8372] __do_fast_syscall_32+0x13a/0x8b0 [ 525.279130][ T8372] do_fast_syscall_32+0x32/0x70 [ 525.279195][ T8372] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 525.279237][ T8372] RIP: 0023:0xf700efec [ 525.279304][ T8372] Code: Unable to access opcode bytes at 0xf700efc2. [ 525.279317][ T8372] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 525.279345][ T8372] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0184800 [ 525.279358][ T8372] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 525.279367][ T8372] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 525.279375][ T8372] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 525.279384][ T8372] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 525.279678][ T8372] [ 526.740953][ T8364] input: syz1 as /devices/virtual/input/input9 [ 528.290809][ T8385] netlink: 4 bytes leftover after parsing attributes in process `syz.2.552'. [ 538.445860][ T8428] FAULT_INJECTION: forcing a failure. [ 538.445860][ T8428] name failslab, interval 1, probability 0, space 0, times 0 [ 538.445902][ T8428] CPU: 0 UID: 0 PID: 8428 Comm: syz.1.565 Not tainted syzkaller #0 PREEMPT(full) [ 538.445923][ T8428] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 538.445938][ T8428] Call Trace: [ 538.445965][ T8428] [ 538.445986][ T8428] dump_stack_lvl+0x100/0x190 [ 538.446045][ T8428] should_fail_ex.cold+0x5/0xa [ 538.446239][ T8428] should_failslab+0xc2/0x120 [ 538.446315][ T8428] __kmalloc_node_noprof+0xff/0x880 [ 538.446374][ T8428] ? __pfx___up_read+0x10/0x10 [ 538.446405][ T8428] ? crypto_create_tfm_node+0x8d/0x3b0 [ 538.446532][ T8428] crypto_create_tfm_node+0x8d/0x3b0 [ 538.446604][ T8428] ? __pfx_rsassa_pkcs1_init_tfm+0x10/0x10 [ 538.446683][ T8428] crypto_spawn_tfm2+0x62/0xc0 [ 538.446720][ T8428] rsassa_pkcs1_init_tfm+0x39/0xb0 [ 538.446767][ T8428] crypto_sig_init_tfm+0xba/0xf0 [ 538.446831][ T8428] crypto_create_tfm_node+0x171/0x3b0 [ 538.446962][ T8428] crypto_alloc_tfm_node+0x102/0x260 [ 538.447061][ T8428] public_key_verify_signature+0x21b/0x910 [ 538.447195][ T8428] ? __pfx_public_key_verify_signature+0x10/0x10 [ 538.447457][ T8428] ? asymmetric_key_generate_id+0x7e/0x180 [ 538.447678][ T8428] x509_check_for_self_signed+0x325/0x510 [ 538.447788][ T8428] x509_cert_parse+0x60c/0x910 [ 538.447910][ T8428] x509_key_preparse+0x65/0x9c0 [ 538.448040][ T8428] asymmetric_key_preparse+0xce/0x1d0 [ 538.448077][ T8428] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 538.448158][ T8428] __key_create_or_update+0x463/0xe30 [ 538.448255][ T8428] ? __pfx___key_create_or_update+0x10/0x10 [ 538.448350][ T8428] ? lookup_user_key+0x3f3/0x1300 [ 538.448628][ T8428] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 538.448785][ T8428] key_create_or_update+0x42/0x60 [ 538.449002][ T8428] __do_sys_add_key+0x2e8/0x460 [ 538.449101][ T8428] ? __pfx___do_sys_add_key+0x10/0x10 [ 538.449344][ T8428] __do_fast_syscall_32+0x13a/0x8b0 [ 538.449435][ T8428] do_fast_syscall_32+0x32/0x70 [ 538.449499][ T8428] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 538.449541][ T8428] RIP: 0023:0xf7fc8fec [ 538.449608][ T8428] Code: Unable to access opcode bytes at 0xf7fc8fc2. [ 538.449621][ T8428] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 000000000000011e [ 538.449650][ T8428] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000000000 [ 538.449663][ T8428] RDX: 0000000080000200 RSI: 0000000000000559 RDI: 00000000ffffffff [ 538.449671][ T8428] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 538.449684][ T8428] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 538.449692][ T8428] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 538.449946][ T8428] [ 540.100376][ T8434] netlink: 24 bytes leftover after parsing attributes in process `syz.3.566'. [ 540.131158][ T8434] netlink: 24 bytes leftover after parsing attributes in process `syz.3.566'. [ 540.609748][ T74] nvmet: connect request for invalid subsystem testsubsys! [ 540.614897][ T8437] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 542.849475][ T5799] usb 6-1: new full-speed USB device number 8 using dummy_hcd [ 543.055384][ T5799] usb 6-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 543.117959][ T5799] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 543.117991][ T5799] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 543.235320][ T5799] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.235357][ T5799] usb 6-1: Product: syz [ 543.235382][ T5799] usb 6-1: Manufacturer: syz [ 543.235408][ T5799] usb 6-1: SerialNumber: syz [ 543.709450][ T6168] usb 8-1: new full-speed USB device number 12 using dummy_hcd [ 545.937956][ T5799] usb 6-1: Audio class v2/v3 interfaces need an interface association [ 546.364966][ T8472] jffs2: notice: (8472) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 546.881859][ T8472] netlink: 8 bytes leftover after parsing attributes in process `syz.0.576'. [ 546.881886][ T8472] netlink: 8 bytes leftover after parsing attributes in process `syz.0.576'. [ 547.059515][ T5799] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 547.084913][ T8476] Illegal XDP return value 68 on prog (id 22) dev N/A, expect packet loss! [ 547.236383][ T5799] usb 6-1: USB disconnect, device number 8 [ 547.816846][ T7560] udevd[7560]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 548.910832][ T6168] usb 8-1: unable to get BOS descriptor or descriptor too short [ 548.919050][ T6168] usb 8-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 548.919486][ T6168] usb 8-1: no configurations [ 548.919496][ T6168] usb 8-1: can't read configurations, error -22 [ 549.090421][ T6168] usb 8-1: new full-speed USB device number 13 using dummy_hcd [ 549.302219][ T6168] usb 8-1: device descriptor read/64, error -32 [ 549.462807][ T6168] usb usb8-port1: attempt power cycle [ 550.070524][ T6168] usb 8-1: new full-speed USB device number 14 using dummy_hcd [ 550.280054][ T6168] usb 8-1: device not accepting address 14, error -71 [ 553.478118][ T8496] netlink: 4 bytes leftover after parsing attributes in process `syz.2.582'. [ 553.932775][ T8505] netlink: 4 bytes leftover after parsing attributes in process `syz.1.584'. [ 555.818369][ T8512] tc action pedit offset must be on 32 bit boundaries [ 556.562565][ T8517] loop0: detected capacity change from 0 to 32768 [ 556.861781][ T8517] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 558.030602][ T8536] syz.2.588 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 561.339486][ T8547] netlink: 'syz.1.590': attribute type 1 has an invalid length. [ 561.813970][ T8547] bond3: entered promiscuous mode [ 561.827973][ T8547] 8021q: adding VLAN 0 to HW filter on device bond3 [ 562.742390][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.742664][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.757825][ T8557] syz.0.593: vmalloc error: size 2147483264, exceeds total pages, mode:0x400cc0(GFP_KERNEL_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 562.758255][ T8557] CPU: 1 UID: 0 PID: 8557 Comm: syz.0.593 Not tainted syzkaller #0 PREEMPT(full) [ 562.758275][ T8557] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 562.758288][ T8557] Call Trace: [ 562.758313][ T8557] [ 562.758339][ T8557] dump_stack_lvl+0x100/0x190 [ 562.758451][ T8557] warn_alloc.cold+0x9e/0xb2 [ 562.758524][ T8557] ? __pfx_warn_alloc+0x10/0x10 [ 562.758638][ T8557] ? ring_buffer_lock_reserve+0x4bb/0x1220 [ 562.758763][ T8557] ? rb_commit+0x129/0x9d0 [ 562.759004][ T8557] __vmalloc_node_range_noprof+0x123b/0x1420 [ 562.759059][ T8557] ? ring_buffer_unlock_commit+0x2e7/0x700 [ 562.759170][ T8557] ? trace_buffer_unlock_commit_regs+0x37b/0x540 [ 562.759270][ T8557] ? do_replace+0x1c6/0x490 [ 562.759333][ T8557] ? trace_event_buffer_commit+0x20a/0xa80 [ 562.759411][ T8557] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 562.759499][ T8557] ? trace_event_raw_event_lock+0x1e2/0x2b0 [ 562.759582][ T8557] ? __pfx_trace_event_raw_event_lock+0x10/0x10 [ 562.759682][ T8557] ? do_replace+0x1c6/0x490 [ 562.759714][ T8557] __vmalloc_node_noprof+0xad/0xf0 [ 562.759770][ T8557] ? do_replace+0x1c6/0x490 [ 562.759899][ T8557] __vmalloc_noprof+0xa3/0x120 [ 562.759943][ T8557] ? __pfx___vmalloc_noprof+0x10/0x10 [ 562.760155][ T8557] do_replace+0x1c6/0x490 [ 562.760222][ T8557] ? __pfx_do_replace+0x10/0x10 [ 562.760462][ T8557] ? trace_buffer_unlock_commit_regs+0x37b/0x540 [ 562.760614][ T8557] compat_do_replace+0x589/0x7a0 [ 562.760749][ T8557] ? __pfx_compat_do_replace+0x10/0x10 [ 562.760769][ T8557] ? trace_event_raw_event_lock+0x1e2/0x2b0 [ 562.760815][ T8557] ? __pfx_trace_event_raw_event_lock+0x10/0x10 [ 562.761083][ T8557] ? bpf_lsm_capable+0x9/0x10 [ 562.761113][ T8557] ? security_capable+0x80/0x260 [ 562.761277][ T8557] do_ebt_set_ctl+0x3f4/0x4a0 [ 562.761394][ T8557] ? __pfx_do_ebt_set_ctl+0x10/0x10 [ 562.761498][ T8557] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 562.761528][ T8557] ? ring_buffer_unlock_commit+0x2e7/0x700 [ 562.761747][ T8557] ? nf_sockopt_find.isra.0+0x222/0x290 [ 562.761887][ T8557] nf_setsockopt+0x8d/0xf0 [ 562.762071][ T8557] ip_setsockopt+0xcb/0xf0 [ 562.762148][ T8557] tcp_setsockopt+0xa7/0x100 [ 562.762275][ T8557] smc_setsockopt+0x1b6/0xa40 [ 562.762319][ T8557] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 562.762416][ T8557] ? __pfx_smc_setsockopt+0x10/0x10 [ 562.762502][ T8557] ? aa_sock_opt_perm+0x114/0x1e0 [ 562.762617][ T8557] ? __pfx_smc_setsockopt+0x10/0x10 [ 562.762692][ T8557] do_sock_setsockopt+0xf3/0x1d0 [ 562.762799][ T8557] __sys_setsockopt+0x119/0x190 [ 562.762988][ T8557] __ia32_sys_setsockopt+0xbc/0x160 [ 562.763018][ T8557] ? __do_fast_syscall_32+0xb3/0x8b0 [ 562.763054][ T8557] ? lockdep_hardirqs_on+0x7d/0x110 [ 562.763104][ T8557] __do_fast_syscall_32+0x13a/0x8b0 [ 562.763242][ T8557] do_fast_syscall_32+0x32/0x70 [ 562.763301][ T8557] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 562.763327][ T8557] RIP: 0023:0xf701efec [ 562.763366][ T8557] Code: Unable to access opcode bytes at 0xf701efc2. [ 562.763375][ T8557] RSP: 002b:00000000f53ec50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 562.763395][ T8557] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000000000000 [ 562.763407][ T8557] RDX: 0000000000000080 RSI: 0000000080000100 RDI: 0000000000000108 [ 562.763418][ T8557] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 562.763434][ T8557] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 562.763445][ T8557] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 562.763700][ T8557] [ 562.788062][ T8557] Mem-Info: [ 562.788077][ T8557] active_anon:8060 inactive_anon:40526 isolated_anon:0 [ 562.788077][ T8557] active_file:10999 inactive_file:5743 isolated_file:0 [ 562.788077][ T8557] unevictable:1000 dirty:6 writeback:26 [ 562.788077][ T8557] slab_reclaimable:6070 slab_unreclaimable:52730 [ 562.788077][ T8557] mapped:24073 shmem:44056 pagetables:1191 [ 562.788077][ T8557] sec_pagetables:306 bounce:0 [ 562.788077][ T8557] kernel_misc_reclaimable:0 [ 562.788077][ T8557] free:22844 free_pcp:3584 free_cma:0 [ 562.788108][ T8557] Node 0 active_anon:1748kB inactive_anon:2840kB active_file:288kB inactive_file:264kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:2936kB dirty:0kB writeback:40kB shmem:5576kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8896kB pagetables:1692kB sec_pagetables:1116kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 562.788140][ T8557] Node 1 active_anon:30492kB inactive_anon:159264kB active_file:43708kB inactive_file:22708kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:93356kB dirty:24kB writeback:64kB shmem:170648kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:4896kB pagetables:3072kB sec_pagetables:108kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 562.788170][ T8557] Node 0 DMA free:2012kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:36kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:396kB local_pcp:120kB free_cma:0kB [ 562.788209][ T8557] lowmem_reserve[]: 0 277 277 277 277 [ 562.788257][ T8557] Node 0 DMA32 free:17340kB boost:0kB min:12628kB low:15784kB high:18940kB reserved_highatomic:0kB free_highatomic:0kB active_anon:1748kB inactive_anon:2804kB active_file:288kB inactive_file:264kB unevictable:2000kB writepending:40kB zspages:152kB present:1032196kB managed:284568kB mlocked:0kB bounce:0kB free_pcp:5108kB local_pcp:420kB free_cma:0kB [ 562.788297][ T8557] lowmem_reserve[]: 0 0 0 0 0 [ 562.788352][ T8557] Node 1 DMA32 free:72024kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0kB free_highatomic:0kB active_anon:30492kB inactive_anon:159264kB active_file:43708kB inactive_file:22708kB unevictable:2000kB writepending:88kB zspages:4792kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:8832kB local_pcp:568kB free_cma:0kB [ 562.788394][ T8557] lowmem_reserve[]: 0 0 0 0 0 [ 562.788766][ T8557] Node 0 DMA: 13*4kB (UM) 15*8kB (UM) 9*16kB (U) 7*32kB (U) 11*64kB (UM) 2*128kB (M) 2*256kB (M) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 2012kB [ 562.789213][ T8557] Node 0 DMA32: 96*4kB (UM) 48*8kB (UE) 41*16kB (UME) 100*32kB (UME) 37*64kB (UME) 13*128kB (UME) 8*256kB (ME) 9*512kB (UME) 2*1024kB (M) 0*2048kB 0*4096kB = 17360kB [ 562.789435][ T8557] Node 1 DMA32: 390*4kB (UME) 395*8kB (UME) 240*16kB (UME) 505*32kB (UME) 138*64kB (UME) 55*128kB (UME) 31*256kB (UME) 16*512kB (UME) 9*1024kB (UME) 1*2048kB (U) 1*4096kB (M) = 72080kB [ 562.789643][ T8557] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 562.789656][ T8557] Node 0 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 562.789669][ T8557] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 562.789683][ T8557] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 562.789697][ T8557] 61232 total pagecache pages [ 562.789707][ T8557] 437 pages in swap cache [ 562.789716][ T8557] Free swap = 81864kB [ 562.789726][ T8557] Total swap = 124996kB [ 562.789737][ T8557] 524155 pages RAM [ 562.789746][ T8557] 0 pages HighMem/MovableOnly [ 562.789756][ T8557] 212121 pages reserved [ 562.789766][ T8557] 0 pages cma reserved [ 567.913706][ T8582] netlink: 4 bytes leftover after parsing attributes in process `syz.3.599'. [ 573.018504][ T8598] xt_nfacct: accounting object `\$9ZM#mU|^c\F9YⳈ' does not exist [ 573.224076][ T8598] 9pnet_fd: Insufficient options for proto=fd [ 573.255454][ T8599] udc dummy_udc.0: failed to start g1: -19 [ 573.261533][ T8599] UDC core: g1: couldn't find an available UDC or it's busy [ 573.843616][ T8605] syz.0.604 (8605): attempted to duplicate a private mapping with mremap. This is not supported. [ 574.545734][ T8608] [ 574.546587][ T8608] ====================================================== [ 574.548793][ T8608] WARNING: possible circular locking dependency detected [ 574.550987][ T8608] syzkaller #0 Not tainted [ 574.552598][ T8608] ------------------------------------------------------ [ 574.554865][ T8608] syz.3.605/8608 is trying to acquire lock: [ 574.556804][ T8608] ffffffff903fe7e8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_streaming_header_allow_link+0x7c/0x650 [ 574.560287][ T8608] [ 574.560287][ T8608] but task is already holding lock: [ 574.562606][ T8608] ffff88802ac30ac0 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 574.566028][ T8608] [ 574.566028][ T8608] which lock already depends on the new lock. [ 574.566028][ T8608] [ 574.569241][ T8608] [ 574.569241][ T8608] the existing dependency chain (in reverse order) is: [ 574.572185][ T8608] [ 574.572185][ T8608] -> #3 (&sb->s_type->i_mutex_key#28){++++}-{4:4}: [ 574.574978][ T8608] lock_acquire+0x1d1/0x380 [ 574.576635][ T8608] down_write+0x8b/0x1f0 [ 574.578163][ T8608] configfs_depend_item_unlocked+0xf3/0x6a0 [ 574.580192][ T8608] usbg_make_tpg+0x251/0x610 [ 574.581882][ T8608] target_fabric_make_tpg+0xab/0x8c0 [ 574.583746][ T8608] configfs_mkdir+0x525/0xd40 [ 574.585435][ T8608] vfs_mkdir+0x364/0x850 [ 574.586998][ T8608] filename_mkdirat+0x48b/0x5e0 [ 574.588759][ T8608] __ia32_sys_mkdirat+0x88/0xc0 [ 574.590438][ T8608] __do_fast_syscall_32+0x13a/0x8b0 [ 574.592472][ T8608] do_fast_syscall_32+0x32/0x70 [ 574.594345][ T8608] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 574.596567][ T8608] [ 574.596567][ T8608] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 574.599138][ T8608] lock_acquire+0x1d1/0x380 [ 574.600731][ T8608] __mutex_lock+0x1a4/0x1bd0 [ 574.602381][ T8608] tcm_alloc_inst+0x5f/0x1e0 [ 574.604013][ T8608] try_get_usb_function_instance+0x136/0x1f0 [ 574.606133][ T8608] usb_get_function_instance+0x16/0x70 [ 574.608044][ T8608] function_make+0x18c/0x3f0 [ 574.609755][ T8608] configfs_mkdir+0x525/0xd40 [ 574.611626][ T8608] vfs_mkdir+0x364/0x850 [ 574.613186][ T8608] filename_mkdirat+0x48b/0x5e0 [ 574.614899][ T8608] __ia32_sys_mkdirat+0x88/0xc0 [ 574.616672][ T8608] __do_fast_syscall_32+0x13a/0x8b0 [ 574.618445][ T8608] do_fast_syscall_32+0x32/0x70 [ 574.620149][ T8608] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 574.622324][ T8608] [ 574.622324][ T8608] -> #1 (func_lock){+.+.}-{4:4}: [ 574.624571][ T8608] lock_acquire+0x1d1/0x380 [ 574.626228][ T8608] __mutex_lock+0x1a4/0x1bd0 [ 574.627868][ T8608] try_get_usb_function_instance+0x26/0x1f0 [ 574.629890][ T8608] usb_get_function_instance+0x16/0x70 [ 574.631821][ T8608] function_make+0x18c/0x3f0 [ 574.633444][ T8608] configfs_mkdir+0x525/0xd40 [ 574.635160][ T8608] vfs_mkdir+0x364/0x850 [ 574.636984][ T8608] filename_mkdirat+0x48b/0x5e0 [ 574.638713][ T8608] __ia32_sys_mkdirat+0x88/0xc0 [ 574.640425][ T8608] __do_fast_syscall_32+0x13a/0x8b0 [ 574.642213][ T8608] do_fast_syscall_32+0x32/0x70 [ 574.643909][ T8608] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 574.646092][ T8608] [ 574.646092][ T8608] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 574.648677][ T8608] check_prev_add+0xeb/0xe60 [ 574.650296][ T8608] __lock_acquire+0x1528/0x1f40 [ 574.652230][ T8608] lock_acquire+0x1d1/0x380 [ 574.653873][ T8608] __mutex_lock+0x1a4/0x1bd0 [ 574.655559][ T8608] uvcg_streaming_header_allow_link+0x7c/0x650 [ 574.657696][ T8608] configfs_symlink+0x695/0x1340 [ 574.659433][ T8608] vfs_symlink+0x178/0x4d0 [ 574.661014][ T8608] filename_symlinkat+0x2a6/0x560 [ 574.662766][ T8608] __ia32_sys_symlinkat+0x9b/0xe0 [ 574.664525][ T8608] __do_fast_syscall_32+0x13a/0x8b0 [ 574.666409][ T8608] do_fast_syscall_32+0x32/0x70 [ 574.668127][ T8608] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 574.670220][ T8608] [ 574.670220][ T8608] other info that might help us debug this: [ 574.670220][ T8608] [ 574.673370][ T8608] Chain exists of: [ 574.673370][ T8608] gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#28 [ 574.673370][ T8608] [ 574.677952][ T8608] Possible unsafe locking scenario: [ 574.677952][ T8608] [ 574.680252][ T8608] CPU0 CPU1 [ 574.681909][ T8608] ---- ---- [ 574.683576][ T8608] lock(&sb->s_type->i_mutex_key#28); [ 574.685429][ T8608] lock(tpg_instances_lock); [ 574.687694][ T8608] lock(&sb->s_type->i_mutex_key#28); [ 574.690160][ T8608] lock(gadget_subsys.su_mutex); [ 574.691774][ T8608] [ 574.691774][ T8608] *** DEADLOCK *** [ 574.691774][ T8608] [ 574.694273][ T8608] locks held by syz.3.605/8608: 2, last CPU#0: [ 574.696253][ T8608] #0: ffff888021920460 (sb_writers#17){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 574.699368][ T8608] #1: ffff88802ac30ac0 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 574.702738][ T8608] [ 574.702738][ T8608] stack backtrace: [ 574.704575][ T8608] CPU: 0 UID: 0 PID: 8608 Comm: syz.3.605 Not tainted syzkaller #0 PREEMPT(full) [ 574.707422][ T8608] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 574.710529][ T8608] Call Trace: [ 574.711603][ T8608] [ 574.712555][ T8608] dump_stack_lvl+0x100/0x190 [ 574.714099][ T8608] print_circular_bug.cold+0x178/0x1be [ 574.715927][ T8608] check_noncircular+0x146/0x160 [ 574.717505][ T8608] ? trace_buffer_unlock_commit_regs+0x37b/0x540 [ 574.719650][ T8608] check_prev_add+0xeb/0xe60 [ 574.721235][ T8608] __lock_acquire+0x1528/0x1f40 [ 574.722950][ T8608] ? ring_buffer_unlock_commit+0x2e7/0x700 [ 574.724881][ T8608] lock_acquire+0x1d1/0x380 [ 574.726360][ T8608] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 574.728551][ T8608] ? __pfx___might_resched+0x10/0x10 [ 574.730339][ T8608] __mutex_lock+0x1a4/0x1bd0 [ 574.731841][ T8608] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 574.733870][ T8608] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 574.736015][ T8608] ? __lock_acquire+0x5c0/0x1f40 [ 574.737758][ T8608] ? __pfx___mutex_lock+0x10/0x10 [ 574.739486][ T8608] ? make_vfsuid+0xec/0x140 [ 574.741105][ T8608] ? __pfx___might_resched+0x10/0x10 [ 574.742811][ T8608] ? make_vfsgid+0xf1/0x140 [ 574.744344][ T8608] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 574.746583][ T8608] ? security_inode_permission+0xbf/0x250 [ 574.748414][ T8608] uvcg_streaming_header_allow_link+0x7c/0x650 [ 574.750396][ T8608] ? inode_permission+0x374/0x620 [ 574.752018][ T8608] ? mntput_no_expire+0xe7/0x220 [ 574.753608][ T8608] configfs_symlink+0x695/0x1340 [ 574.755651][ T8608] ? bpf_lsm_inode_permission+0x9/0x10 [ 574.757426][ T8608] ? security_inode_permission+0xbf/0x250 [ 574.759306][ T8608] ? __pfx_configfs_symlink+0x10/0x10 [ 574.761130][ T8608] vfs_symlink+0x178/0x4d0 [ 574.762649][ T8608] filename_symlinkat+0x2a6/0x560 [ 574.764302][ T8608] ? __pfx_filename_symlinkat+0x10/0x10 [ 574.766142][ T8608] ? strncpy_from_user+0x19d/0x2d0 [ 574.767867][ T8608] ? do_getname+0x191/0x390 [ 574.769355][ T8608] __ia32_sys_symlinkat+0x9b/0xe0 [ 574.771020][ T8608] __do_fast_syscall_32+0x13a/0x8b0 [ 574.772747][ T8608] do_fast_syscall_32+0x32/0x70 [ 574.774289][ T8608] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 574.776295][ T8608] RIP: 0023:0xf700efec [ 574.777611][ T8608] Code: Unable to access opcode bytes at 0xf700efc2. [ 574.779657][ T8608] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000130 [ 574.782224][ T8608] RAX: ffffffffffffffda RBX: 0000000080001500 RCX: 00000000ffffff9c [ 574.784687][ T8608] RDX: 0000000080001600 RSI: 0000000000000000 RDI: 0000000000000000 [ 574.787418][ T8608] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 574.789865][ T8608] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 574.792322][ T8608] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 574.795017][ T8608]