last executing test programs: 38.877520556s ago: executing program 1 (id=401): r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1) r3 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x143041, 0x2a) pwritev2(r3, &(0x7f00000001c0)=[{&(0x7f0000000080)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0xe4) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ioctl$KVM_SET_USER_MEMORY_REGION2(r2, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x10000, 0x2000, &(0x7f0000191000/0x2000)=nil, 0x0, r4}) mq_open(&(0x7f0000000080)='eth0\x00#~\x02\x00\x00\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\x00\x00\x00\x00\x90\x88\v8I$\xfd\x05\x00\x00\x00\x00\x00\x80\x00\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94uu_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.mT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18A\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x05\x00\x00\x00\x00\x00f\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18\x82\xff_\f\xed\xdfHb\xaazi/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xce\x00\x00\x00\xe8\vq,\xbb\xc7\xaf\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J', 0x42, 0x120, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r5, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x3, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x2, 0x45) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r6, 0x5607, 0x8) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, &(0x7f0000000140)=@attr_pmu_irq={0x0, 0x1, 0x1, &(0x7f0000000100)=0x7}) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0xffffffffffff042f}}, './file0\x00'}) pread64$ublk_ch(r7, &(0x7f00000003c0)=@buf_4k, 0x1000, 0x5) r8 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r8, 0xc040aed5, &(0x7f0000000340)={0x10000, 0x1000000}) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r9 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r9, 0x0, 0x0) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r10, &(0x7f0000000480)=""/74, 0x49) read$char_usb(r10, &(0x7f0000000480)=""/74, 0x4a) syz_usb_ep_write$ath9k_ep1(r9, 0x82, 0x494, &(0x7f0000000d80)=ANY=[]) socket$nl_generic(0x10, 0x3, 0x10) 35.756021831s ago: executing program 1 (id=417): fsopen(&(0x7f0000000280)='ceph\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='0\x00', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0) write(r1, &(0x7f0000000100)='1\x00', 0x1) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd98, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x3, @empty, 0xffff}, 0x1c) listen(r4, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) r6 = socket(0x11, 0x3, 0x2) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo\x00') getdents64(r7, &(0x7f0000000000)=""/24, 0x18) getdents64(r7, 0x0, 0x36) r8 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=@bridge_dellink={0x2c, 0x13, 0x1, 0x0, 0x8000000, {0x7, 0x0, 0x0, r9, 0x40}, [@IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x4, 0x0, 0x1, {0x4, 0xa}}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000040}, 0x8c0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000100)={'macvlan1\x00', &(0x7f0000000180)=@ethtool_link_settings={0x4c, 0x10000, 0x0, 0x0, 0x3, 0x8, 0x9, 0x0, 0x0, 0x4, [0x8, 0x0, 0xc60, 0xffffffff, 0x0, 0x5, 0x0, 0xa]}}) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendto$inet(r5, &(0x7f0000000040)="a6", 0xffffff4c, 0x0, 0x0, 0x0) syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) unshare(0x26020480) 34.421487281s ago: executing program 1 (id=422): socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135a56412a20d4363f5df408fc6441639e75c7470bb11", 0x30, 0xfffffffffffffffe) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='rpc_pipefs\x00', &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='rpc_pipefs\x00', 0x12b6c3, 0x108) r3 = fsopen(&(0x7f0000000300)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000400)='source\x00', &(0x7f0000000500)='127.0.0.1:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000600)='addr\x00', &(0x7f0000000700)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000800)='clientaddr\x00', &(0x7f0000000900)='127b\f\x00\x00.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000a00)='vers\x00', &(0x7f0000000b00)='4.0\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) r4 = fsopen(&(0x7f0000000e00)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) (async) nanosleep(&(0x7f0000000e00)={0x0, 0x186a0}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, 0x0, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 32.904139235s ago: executing program 1 (id=430): socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135a56412a20d4363f5df408fc6441639e75c7470bb11", 0x30, 0xfffffffffffffffe) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='rpc_pipefs\x00', &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='rpc_pipefs\x00', 0x12b6c3, 0x108) r4 = fsopen(&(0x7f0000000300)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000600)='addr\x00', &(0x7f0000000700)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000800)='clientaddr\x00', &(0x7f0000000900)='127b\f\x00\x00.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000a00)='vers\x00', &(0x7f0000000b00)='4.0\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) r5 = fsopen(&(0x7f0000000e00)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) (async) r6 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r3, r6, r3}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 32.02919498s ago: executing program 1 (id=431): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./proc/fs/nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/fs/nfsd/threads\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)="35fc3a12f45d48e3120ec76bfe8d5ba7449af3c59c81f374329851daf843e48e30428c737ad0d7b957d1ab7dba23ca87748421", 0x33) (async) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000780)='/sys/power/pm_freeze_timeout', 0x42, 0x0) write$rfkill(r1, &(0x7f0000000180)={0x9, 0x6, 0x1}, 0x8) (async) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x3d5) 31.954121021s ago: executing program 1 (id=432): r0 = mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf\"\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`\x1e\x91<~\xd8\xabs\xbd*e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2\x04\x00\x00\x00\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\x1e\xfc/fm\xa9`)\xfc7\x84\f+\xf7\x95\xab[J\xe7\x9d\xd8\xe3\x86\xdb\xfe|\xe91\n\xa0\xdf\v\\\xe4\x00'/941, 0x40, 0x170, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) add_key$user(&(0x7f00000000c0), 0x0, &(0x7f0000000380)="7ccd08", 0x3, 0xfffffffffffffffc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x200, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x0, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x1, 0x1003, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x8}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x4, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x20000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000002000010000000000000000000220000000000000000000000500190002000000080009000000000008000b0005000000080017004e214e22080001"], 0x5c}}, 0x0) connect$bt_sco(r5, &(0x7f0000000080)={0x1f, @none}, 0x8) r7 = fanotify_init(0x200, 0x0) fanotify_mark(r7, 0x1, 0x8000000, r1, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f0000000740)={0x1, [], 0x7, "390c4bfe4f19aa"}) r9 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000001b40)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) r10 = syz_open_dev$loop(&(0x7f0000000040), 0x100013, 0xa4a82) ioctl$LOOP_SET_FD(r10, 0x4c00, r9) 28.983108352s ago: executing program 0 (id=441): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmsg$inet6(r0, &(0x7f0000001b80)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000600)="78974b7cf764d1dbebd9af2b734f1e5712671b57f9d249f5f9d8f48c540888bd56233ea0a9107edf098f8bbe3d667a28c74804711107cfa721eb05dca5b4bd5259cbe7212099cdb7688041f8e94062771590f54d56868177c083cb5ece03ac4fd79b33190f323ce4ec562fed94a8ac0e88f1a5fc21c511d5da964f13d323a982ae78fa370d762b2c545194b9a4b0d75b8d77bd869cae8afb56b7db134827f0fb1c0b6001c326c5e5bc2c2b0e5ae181ac74d75c6106055d598df632c0bee46b57c3ea3940bc703d46ceecc663d96beff4120284272463b03b708debf5eccae91427618c4c15f5d53074980ebf9e98f2b7886e2db3683068cc9f03a0433c1bae86ebcd70b65490b7513eb86fd34a3fe22cf04898d4195a247bc44bde49f700ecb07ee52c682ddefdec208fce46b2e2018322157c7e3b0911e6be0c96628825d70e378f79431fefe35664feb3e31457d693a090450ada9b717ac1d273963853014886d9bf745ddadda544fe976925d6ee4e04326e9ba0ab3be4047a73e3b88319c573047ba90717a192098c080bdf3716446dabdb693df76fbd23745e485f979b5204dea3408e0b44f536457f044bf8966df36519e28de3326b0efd83d39cffb64c98d887499e3a4393cbfe5d9b74a2ca42ce14740088dbf0285ab71c7a5c5af025f4489e93389aaec003a48879d98da1eadd193a555b53ac5c0376b1639210ddfb14843bff1bd6092f876431c10002916f297cd00d1a6aa41a08eec83ca6cd5d5c13f7473768886dc63d5509e4dd571da69aef760c1145ba02efa7bcd9a4f0df4e28230d4f57d3040ff9fdbe7170c9f49715479ee5e3d584062e46e35f4f2beb0c3c6fab775d5470fee7e557ab13afa231b847a7cfd77e388aeb71ad94457243d317ac1e8b45749039b04a32ace10e77768cb0d7bec27d0f68aec09c896f0f54ccfc030aafd83e656c4788c10fb1e3f92cf9c61083047801a34e08f8476e08267e2814cac71fc23eea187b480e3e3d3ed4a80fb00f1d2a1b1130be1e2479bac94c8176b307447aee71c02b33b67d9db2cf3a41c2960477dfb8d1a1c989bef63d1afd7c203968882f850b4514bc52d270e5420478309725b925799e598984eb3bd12b9ab916db073108f373ddbd65", 0x32d}], 0x1}, 0x2400c81d) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000200)={0x0, 0x7, 0x9, 0xa, 0x6, 0x400, 0x35, 0x77, {0x0, @in6={{0xa, 0x4e21, 0x6, @private1={0xfc, 0x1, '\x00', 0x1}, 0x193e}}, 0xfffff682, 0x7, 0x8, 0xe2, 0x1}}, &(0x7f00000002c0)=0xb0) 28.92023441s ago: executing program 0 (id=442): r0 = mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf\"\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`\x1e\x91<~\xd8\xabs\xbd*e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2\x04\x00\x00\x00\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\x1e\xfc/fm\xa9`)\xfc7\x84\f+\xf7\x95\xab[J\xe7\x9d\xd8\xe3\x86\xdb\xfe|\xe91\n\xa0\xdf\v\\\xe4\x00'/941, 0x40, 0x170, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) add_key$user(&(0x7f00000000c0), 0x0, &(0x7f0000000380)="7ccd08", 0x3, 0xfffffffffffffffc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x200, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x0, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x1, 0x1003, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x8}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x4, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x20000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000002000010000000000000000000220000000000000000000000500190002000000080009000000000008000b0005000000080017004e214e22080001"], 0x5c}}, 0x0) connect$bt_sco(r5, &(0x7f0000000080)={0x1f, @none}, 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@array={0x0, 0x0, 0x0, 0xa, 0x3, {0x0, 0x1000000}}]}}, &(0x7f00000000c0)=""/196, 0x32, 0xc4, 0x1}, 0x28) r7 = fanotify_init(0x200, 0x0) fanotify_mark(r7, 0x1, 0x8000000, r1, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f0000000740)={0x1, [], 0x7, "390c4bfe4f19aa"}) r8 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000001b40)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000040), 0x100013, 0xa4a82) ioctl$LOOP_SET_FD(r9, 0x4c00, r8) 27.560058841s ago: executing program 0 (id=446): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) close(0x3) openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(&(0x7f0000000000)='./bus\x00', 0x12) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0xc4, 0x8, 0x8}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000080), 0x8000, r0}, 0x38) write(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) sysinfo(0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0xf3a, 0x0) 27.363916768s ago: executing program 0 (id=447): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$kcm(0xa, 0x922000000003, 0x11) recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x100) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000280), 0x8) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000bc0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000b80)={&(0x7f0000001c00)=ANY=[@ANYBLOB, @ANYRES16=r2, @ANYBLOB="e92b2bbd7000fcdbdf250500000005000700040000000c00038008000200cc000000050007000200000005000700020000001c030380ed0005004d33b00036d244d88525ef4e889662c6bc7649b78d57ba8070c441c3ee66e2e30c02ca5f228f27bdfaca7fb92c43d80046afeeecf4e58d7c8a7fd245be1c0184452ac3a80091c5d195cdbdb41d7ef865a22c65d0b1ada1a65f23007fc05a32204b98e2c2ac925784ef4bd4c334dc87b707bb54e290dff7b724b2677892324eec825e652437d67ecd3078795a59d9850e3f6cf994ac5ba908fabaae64dd7a7c5a9d7210629cbcc4f0341988d7dbb18a270f94916d7fa545d9ee703e3e426997f245b084d157aeb9e7c2146a3a4d9c7661cfc55f1d2742840c728bec6a6a87bbdfa801315e55ca18ba8f000000b60004000dd4092264a787b299d2dfbd271c1587375a23c063a1503b062b9b8dd7e56fb6c2d668d4b52bcfe50db7b35279bda1c3312392ea26621b8a9910190dde8d8b8e58a56b703510012fa228382f65b0a0f721dc432b79e4357ed97e4a7b2541b6d255dc69f9943194a15a0243176820fe5b7bfd1235a5fda8035deea1c417499e481555abd34938144bff23d01404b52c84a206dfbdff8f111bc39f4da0fb54f355ce4a85c657cd942ec87bbbdf6443334633bc0000a90005006eae8b849424b9d4fc0851f8ce0f5f6837648dafa6b7876c842d5f5a33abec9a5fcf1bcffc193447c7860c5f82d39a8468078c1cda772eb10aa12a1bff247d016a24b312dd5c6c23466c3cdfd612e3cdac9410700cd9dd4628c4403a0bc543b5ecdc4d6413a1d3ce4d5abcbb245bd2eeb58bc3a92db36ccb343003e83156dff7527678e5a9ed3a625c924dd287e30ddb14eb33705dd5f50f2a4dbdc18f0dfc95026f4d2f5500000008000200ff7f0000b900050008c5a56e51dff9a11b922e34f23e3c23dbe15d41670821d075415e8a7369d5efe65961fabf5362486d51d5c224ea4ba45d3e0dea14fa3a5f777513afee8a9c2227466da0f048e1e6c17f4a51cfca0bd57ba7bdd790fcd35f7eacc533c2cd52ae8f1c43057229a81f6fb5b457faf360d9c3fd5ed8f31235e7007263aa9ba651015b62f3d4e93f0b1ecfd44407dd84e21ecdc37338b0adff4343e9061c9055b173206b7efd86e807ad48bc187d4259296d79dfb45c47000000080005000600000008000900000000006801038045000500942dc97fab698d2862ecc47545dc3d97a34985196a83bd936c61b1c7c5c382e158eba70c19925e839eaeb7e443cdd43416f934590343260eb5166d1e62d99415f3000000080002000400000054000380200001800500020000000000040003000800020047504c00040003000400030030000180120002002f2b2a7d2125972140217f292f000000080001001300000005000200000000000800010007000000040001004a000400e2909ae7026c194e9b18f3b56dc8c174262968c43df88f9db743d9ef7571ddbb84ae12a665798788b6a13fc4855c9e671507ac60e25199e067415bb4455c4d3f0d683c7f880100006e000400f5a1f691ccf7068905d7124e1069684c8ba66943bda53536433549c8484076e521d24744d494eda4fd03888a0708b668e36c232ceb85601629cffe332a5d4e696f9151223c7035a1b6309d16a1dea1516629ddc263f9d3b0e14588ab6fba39f355af577002ac05ee9ff00000540103804d000500f8aca886b20b30ea27c4fed8a7fe89448997a1738f7362c8b0d18e53d3d46d60088ad3a27c308b08bc32c22bab54824b2f3903a90d8fbb8590f9d7edd607b9172d8bac724323fedd52000000ff00040038ab98de4c3b4406c11dc16afd7893bcef6a05d1a1160d31c4e827535d0390396d5ce2e14347f2e51b0c8ae652451ce69c87c0f2f99f237abd62a3112c4e6c93e5ced26eea4e63510a0c6bcb010d384645c8240e9f8416dfae671878df6a1bce4d0ec9938eb1df5648a43055a652123756fd3d78a64982771ca794f09e930e174b0415519be7d99af8f96a4a048009b25be100492b6adb6bdc17d63b9e7aae5ad1eed5207616e4c4f634e1e77dc481fd9f31cb9de313f14e5cb76aed383df4d453366216304292b4311c861ac9f1628e8c35a5e5aab81f45b87cf8e1b354ea49a1bb2eae186182238f6091c7196fe709533103c490592e55b50d88000500060009000000"], 0x628}, 0x1, 0x0, 0x0, 0xa080}, 0x4000014) getsockopt$IP_SET_OP_GET_BYNAME(r0, 0x1, 0x53, &(0x7f0000000140)={0x6, 0x7, 'syz0\x00'}, &(0x7f0000000180)=0x28) close(r0) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000500), &(0x7f0000000540)=0xc) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x28c, 0x1}, {0x7}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000740)=ANY=[@ANYBLOB="38000000090601a1c97bb73d035c2300000000000900020073797a3100000000050001"], 0x38}, 0x1, 0x0, 0x0, 0x10000047}, 0x4801) bpf$ENABLE_STATS(0x20, &(0x7f0000000200), 0x4) socket$nl_generic(0x10, 0x3, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x0) syz_emit_ethernet(0x7e, &(0x7f00000010c0)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb08004500007000000000000190780a010102ac1414aa030490500100000045000000000000000011000000000000e0000002440c0001ac1414bb6f21000044340001e000000100000000ac1414bb00000000ac14140000000000ac1414aa000000000000000000000000ac1e000100000000"], 0x0) 26.705485486s ago: executing program 0 (id=449): syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x1e) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000080)='./file0\x00') unlink(&(0x7f00000002c0)='./file0\x00') link(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000000)='./file0\x00') mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x0) 26.614063986s ago: executing program 0 (id=450): mq_open(0x0, 0x40, 0x170, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x8, 0x8}]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x200, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x0, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x1, 0x1003, 0xf}}]}, {0x4}, {0xffffffffffffff4a, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x8}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x4, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x20000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_ALLOC_STREAMS(r1, 0x8008551c, &(0x7f0000000000)=ANY=[@ANYBLOB="1931400001"]) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000010000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x90) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="fb020000fa", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)={@map=r8, r7, 0x7}, 0x10) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000002000010000000000000000000220000000000000000000000500190002000000080009000000000008000b0005000000080017004e214e22080001"], 0x5c}}, 0x0) connect$bt_sco(r5, &(0x7f0000000080)={0x1f, @none}, 0x8) r9 = fanotify_init(0x200, 0x0) fanotify_mark(r9, 0x1, 0x8000000, r0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 16.956881997s ago: executing program 32 (id=432): r0 = mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf\"\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`\x1e\x91<~\xd8\xabs\xbd*e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2\x04\x00\x00\x00\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\x1e\xfc/fm\xa9`)\xfc7\x84\f+\xf7\x95\xab[J\xe7\x9d\xd8\xe3\x86\xdb\xfe|\xe91\n\xa0\xdf\v\\\xe4\x00'/941, 0x40, 0x170, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) add_key$user(&(0x7f00000000c0), 0x0, &(0x7f0000000380)="7ccd08", 0x3, 0xfffffffffffffffc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x200, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x0, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x1, 0x1003, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x8}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x4, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x20000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000002000010000000000000000000220000000000000000000000500190002000000080009000000000008000b0005000000080017004e214e22080001"], 0x5c}}, 0x0) connect$bt_sco(r5, &(0x7f0000000080)={0x1f, @none}, 0x8) r7 = fanotify_init(0x200, 0x0) fanotify_mark(r7, 0x1, 0x8000000, r1, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f0000000740)={0x1, [], 0x7, "390c4bfe4f19aa"}) r9 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000001b40)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) r10 = syz_open_dev$loop(&(0x7f0000000040), 0x100013, 0xa4a82) ioctl$LOOP_SET_FD(r10, 0x4c00, r9) 11.217953626s ago: executing program 33 (id=450): mq_open(0x0, 0x40, 0x170, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x8, 0x8}]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x200, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x0, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x1, 0x1003, 0xf}}]}, {0x4}, {0xffffffffffffff4a, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x8}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x4, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x20000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_ALLOC_STREAMS(r1, 0x8008551c, &(0x7f0000000000)=ANY=[@ANYBLOB="1931400001"]) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000010000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x90) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="fb020000fa", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)={@map=r8, r7, 0x7}, 0x10) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000002000010000000000000000000220000000000000000000000500190002000000080009000000000008000b0005000000080017004e214e22080001"], 0x5c}}, 0x0) connect$bt_sco(r5, &(0x7f0000000080)={0x1f, @none}, 0x8) r9 = fanotify_init(0x200, 0x0) fanotify_mark(r9, 0x1, 0x8000000, r0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 8.316141234s ago: executing program 4 (id=495): socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135a56412a20d4363f5df408fc6441639e75c7470bb11", 0x30, 0xfffffffffffffffe) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='rpc_pipefs\x00', &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='rpc_pipefs\x00', 0x12b6c3, 0x108) r4 = fsopen(&(0x7f0000000300)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000400)='source\x00', &(0x7f0000000500)='127.0.0.1:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000600)='addr\x00', &(0x7f0000000700)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000800)='clientaddr\x00', &(0x7f0000000900)='127b\f\x00\x00.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000a00)='vers\x00', &(0x7f0000000b00)='4.0\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) r5 = fsopen(&(0x7f0000000e00)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) (async) nanosleep(&(0x7f0000000e00)={0x0, 0x186a0}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000140)={r3, 0x0, r3}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 7.709904334s ago: executing program 5 (id=485): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x20801, 0x0) close(0x3) openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(&(0x7f0000000000)='./bus\x00', 0x12) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0xc4, 0x8, 0x8}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000080), 0x8000, r1}, 0x38) write(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(0x0, 0xffffffffffffffff) sysinfo(0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r2, 0x0) pipe(&(0x7f0000000080)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x8}) timer_settime(0x0, 0x1, 0x0, 0x0) 7.267296884s ago: executing program 4 (id=498): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x20801, 0x0) close(0x3) openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) mkdir(&(0x7f0000000000)='./bus\x00', 0x12) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0xc4, 0x8, 0x8}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000080), 0x8000, r0}, 0x38) 6.738991354s ago: executing program 4 (id=500): r0 = syz_ublk_setup_io_uring(0x20, 0x0, 0x0, 0x0, &(0x7f0000000180)=0x0) syz_ublk_add_dev(r0, 0x0, 0x0, r1, &(0x7f00000031c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xffffffffffffffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) ftruncate(0xffffffffffffffff, 0xffffffffffffffff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x8c, 0x30, 0x1, 0xffffffff, 0x0, {}, [{0x78, 0x1, [@m_ct={0x2c, 0x2, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40844}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0x278, &(0x7f0000000340)={0x0, 0x0, 0x13580}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000000)) syz_usbip_server_init(0x6) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r5, 0x107, 0x5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x4) syz_open_dev$tty20(0xc, 0x4, 0x1) mmap$xdp(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x7000001, 0x13, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x600000, 0x9) 6.723981694s ago: executing program 5 (id=501): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a0000000200", 0x6) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000140)=[@in6={0xa, 0x4e22, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}, @in6={0xa, 0x4e22, 0x6, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x8}, @in={0x2, 0x4e24, @broadcast}], 0x48) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000080), 0x1) sendto$inet6(r0, &(0x7f0000000040), 0x34000, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x100000, @loopback}, 0x1c) mkdir(&(0x7f0000000040)='./sys_mount\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys_mount\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys_mount/block/nullb0/queue/scheduler\x00', 0x2, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x39) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$alg(0xffffffffffffffff, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) r2 = syz_open_dev$vim2m(&(0x7f0000000100), 0x1, 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r3, 0x7003) ioctl$RTC_AIE_ON(r3, 0x7001) ioctl$RTC_SET_TIME(r3, 0x4024700a, &(0x7f0000000100)={0x2b, 0x1e, 0x0, 0x2, 0x8, 0xa9, 0x5, 0x2, 0x1}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x19, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000"], 0xa8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) ioctl$vim2m_VIDIOC_STREAMON(r2, 0x40045612, 0x0) socket$netlink(0x10, 0x3, 0x0) 5.112245556s ago: executing program 5 (id=504): r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1) r3 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x143041, 0x2a) pwritev2(r3, &(0x7f00000001c0)=[{&(0x7f0000000080)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0xe4) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ioctl$KVM_SET_USER_MEMORY_REGION2(r2, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x10000, 0x2000, &(0x7f0000191000/0x2000)=nil, 0x0, r4}) mq_open(&(0x7f0000000080)='eth0\x00#~\x02\x00\x00\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\x00\x00\x00\x00\x90\x88\v8I$\xfd\x05\x00\x00\x00\x00\x00\x80\x00\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94uu_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.mT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18A\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x05\x00\x00\x00\x00\x00f\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18\x82\xff_\f\xed\xdfHb\xaazi/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xce\x00\x00\x00\xe8\vq,\xbb\xc7\xaf\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J', 0x42, 0x120, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r5, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x3, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x2, 0x45) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r6, 0x5607, 0x8) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, &(0x7f0000000140)=@attr_pmu_irq={0x0, 0x1, 0x1, &(0x7f0000000100)=0x7}) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0xffffffffffff042f}}, './file0\x00'}) pread64$ublk_ch(r7, &(0x7f00000003c0)=@buf_4k, 0x1000, 0x5) r8 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r8, 0xc040aed5, &(0x7f0000000340)={0x10000, 0x1000000}) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r9 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r9, 0x0, 0x0) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r10, &(0x7f0000000480)=""/74, 0x4a) syz_usb_ep_write$ath9k_ep1(r9, 0x82, 0x494, &(0x7f0000000d80)=ANY=[]) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000001500010000e3fffffbffffff100000000800020008"], 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x20048080) 4.925033066s ago: executing program 3 (id=506): socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], 0x0, 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='rpc_pipefs\x00', 0x12b6c3, 0x108) r3 = fsopen(&(0x7f0000000300)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000400)='source\x00', &(0x7f0000000500)='127.0.0.1:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000600)='addr\x00', &(0x7f0000000700)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000800)='clientaddr\x00', &(0x7f0000000900)='127b\f\x00\x00.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000a00)='vers\x00', &(0x7f0000000b00)='4.0\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) r4 = fsopen(&(0x7f0000000e00)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) (async) nanosleep(&(0x7f0000000e00)={0x0, 0x186a0}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={0x0, r5}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 3.895429619s ago: executing program 2 (id=508): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x20801, 0x0) close(0x3) openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) mkdir(&(0x7f0000000000)='./bus\x00', 0x12) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0xc4, 0x8, 0x8}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000080), 0x8000, r0}, 0x38) 3.89437395s ago: executing program 3 (id=509): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r0, &(0x7f0000000380), 0x0, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='scalable', 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000040)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x2, 0xb3, &(0x7f0000000140)=""/179, 0x41100, 0x7b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3c}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) timer_create(0x7, 0x0, 0x0) timer_delete(0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) file_getattr(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x100) shutdown(r0, 0x1) 2.696060178s ago: executing program 4 (id=510): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in={{0x2, 0x2, @empty}}, 0x1, 0x0, 0x0, 0x0, 0xce025a}, 0x9c) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x9, @remote, 0x2}, 0x1c) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000500)=ANY=[@ANYBLOB="ffffffffffffaaaaaaabaabb86dd6000000800282aff00000000000000000000000000000000ff020000000000000000000000000001870090780000002f80bdf7aa00fe8000000000000000000000000000ff7f02000000000000000000887c8d7a773c605bbde727c9000a2352634f4439f9c3c1529ca6612ee51dac3fe3a01128c82b6e11718e0852b5f5e31e547b5c8d80e3d33f63277cfa626c84525008866c5670cceb6719f98ea0bc3e208349d6bc4af6"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000340)=ANY=[]) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000000)='./bus\x00', 0x12) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000004c0), 0xa8201, 0x0) socket(0x10, 0x3, 0x0) r4 = socket(0x1d, 0x802, 0x6) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000040)={'wlan1\x00', &(0x7f0000000080)=@ethtool_ringparam={0x11, 0x9c, 0x7b5, 0x0, 0x0, 0x7579e159, 0x0, 0xfffffdfc, 0xef4}}) r5 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x9640, 0x0) ppoll(&(0x7f0000000040)=[{r5, 0xb00}], 0x1, 0x0, 0x0, 0x0) write$dsp(r3, &(0x7f0000002200)="44e211a385424bf02640ba0d3a219de1033222bea86d14dc6bc540f652f0873cec4d2b540364b6e4ff506bf40b976a8485725d9cfab14bb4c91a5fd888b8b983ef960999942529696b90b853c1f1a3b01af9b0cdc6a605c13de44b58eaf66b597768a5a9bccdb34c1aa1c48b2484cf0f1d68f8b5c1d9f6179459a466a2e865c2a66274717ef95f59fcf4d5b05c4540a35bb64a8fab9af3ad51f3c648121e933ea77809f3901ca59ed3e990ff80d87a814eb6fb68e3305fd9420d4a163ad5654ce60386346b6d1154ecef0f4a782c4459c0a8ca7278655e6f806c4bc2e870000bfcb1346232b0ccce39ee18152165cf3f85e87ae23c4113586cf300b39d7589b28372e554f7d748b618bca2a4298d82864e0d8212f4fbd80fd854691ccac21279bb85aacac8a3301ad2ece3d6061dbcc63e4af0fefc68fab6e5319f6d9e6a2708e41e60b2673d62ec952bae35b854fe7e87bc78e2d1a56cc383e5a1783ce35eaa20868d97eb1198ecae2d6375d7cd6992883aa3bbbdcb93b92b6eca3d6cde5baa92a6adda4540d5fce6d4772e5711b3744210587c05833966b300da0a378787ad06e9d5cba6e569b14c013b8428dad38eb6d2bc547615dac42aca90ac891e6db4d1dd029fe628170433f9229a286a814d39afd5a019db11c185b72c34e01ea5e82a5008a059e6791c9b807c4aab4e9807a5a7896a4c5bfa42f15284c1481618461ce3501cf24a722e74923d01bd7d586eec5d5ccba03eee1c8fc83bc5d73675a11eaaebdcd25fb806155f5e669ed8af3267b214f7d23cf8600ab7e909e7347783b94f235ea797d2c1bd83c7f499c04532f2b63a55b336fa9e5305a4a22cdde74360995ffd241c9592043df3dc99dac462dd43443604ffed04b1ee23b6665e0955e0b38fa71f73af930a9762d6d4d762e11df043a78b90f49f1645acffe61094a20b4caaeca22feca5f66c549cfcda38a1a7b6b79b71aba7a696975a257a94344bf65b7b79212a61f465ee55b530582e8b1dc993c379dd40ab5dd860c5828e2c27afae20539978340db55a68897920c1019e75e0b43b4c93cb1061c98f683f8d407fae9b1a87f2f9cd2b8252059ac39766fc174c344c5224b43bbea978d722c93e727292c738b293da0b9f12b4f11c8f354ae91d644131ce3873612146d79fe3ace49c1446a79e0a324f23cc0b6fb673fc6c34315fa0baf03fb5bd36656a2272c9a4d80a312dfbec125af5aacd2faf633650e3ab54f9fd2c6ee76d5abd9fac547fe7880d0dd9341ac0f095c529d3232447a0d1b28c101a2a95c4a9040041fbdf47ff7da3abe4ee7d8acac57b6553e58f1c5f832e7b920ef3708b98e4917f5b855928344da2ad0a9755d3f90d31f3e427bc869a163844b5e38c62302cc2938b03c132caa4d8044ed92680d406b7d635026f38082b26d6d3dfe80e8f659f1101cec8ea74418699a4fedfcd4ce6f2693cce43123c03122f61b62497bc2fdc2307786943feb7325d645657ae5e58d1e2587003ed4712aba34973199238d3f3d29704ba86538a764abb4d69b9efabcd956fa688536e0661a2a2e0fc84d3e4152187fd90dfbd5023aa12e964d1f3bff4e2c2915f2600a3ab701b177bda95ba8203a45182e03cc07db3b20342cd45d4f8954edebb32fb7fdf49d1952477da9ead5d4ba6de96c42f5923e3dce7188b9e9ec1862dd2fd39d256e1de8cd0906f67a8423b29f0b5bf81539828a1f8ae7e747e6b43bd639c6d6a52a29a0e4944f6b07390fc390770154135acf448ed23c507009af66d20b175723069f8eef06c2cd3edc86bd80ebbe2f5cd56c379d655632b62794aa3757ea10fb232414a9477277261879e88c49e8eb5253c91551c13ed725f3551939533d7c131109d10b4300e24db600f8020b10e9aac24d8572873fac24d149398a3306707c5c3de875eca837e140d23b02637ef888d539b6f0c7fd6d97fd8b9edf9a82bf19d75cec625237a6b9716ac0003d1b8c8db5d04f5231bed4aac9e93da9b6bfea002af81eb77a3ef8cab9878fac2574742277e5403e44844e50e64d1471213c724cf14142291a44ff108c1334fd2aa086aff52cdf1e7c53a3c9757a6717ad360137a50c4968865083c132abfc3a5eba97a4387bd5affdf091f8396b443dad822a15150d68a0d9728c548fb793e6c9d5420561fe683b8b5e89227d357873891e95d87db4a33056f3af5aabdffa3cbaacc44bdbcca971d8e84586545ae5b0e5eb5c7fada201db84c3faf06eb3812c560d7b0c680e9c4908837c5fb10627eb828dc34718004c066b8d999d34fe25b831771eda169c2bd54aab176e851db66c2623a01b8ef09c006c9aeb2fc87502231f75f5e4e01cc2674847c4c4eef86afee4ae3646b25d11d885befe01c43a34d60eff675eabefceba4664fbc211b3f014e315ea8e4c95f5088b82c590695616127cf63ebcee2fd78f3856443d3cb529376d34db3db1a6949cb7c80bc403ba92952b694dec72c540763ce3901d262087bf5a16a89c4151ce2d2d97eb77dce3d93d99e087bc5352cbda39935c686cf294c3ba66fab0135acb713281c90d562fc473df7133df5af7d42e183e4b860ee7b624038141ee757cb14db143ef8e8617eb6cb24a0eb73ef230e417d543f4afc5858c43ad20819bf6eda31bd5c258e66e9703a9b1daa8b34f9db16cae43b131ef258da25272320e2b357357b1d12fd87d9a00551185f3d494426d3f33b0ee84e1ae65508b9916fec12805783a857ac5d70a661fce59088437cf991821d3cf5b0db477dc8f6bb38c8455bb628e563ca45cb65383db9ecfc80386cd05f92ab32bf825a0953c101609ca8239b6ef1fb5a7fcc55642f9b2911df108d64b8c72c5bd31645955056968d4917cbab525ae5994b5dcbd33de392081819012a16be8c1b4f164fa6a1c2d88fd957bd62f28a3e87ba1ffcf644116ffdcf26937d4e64b4e87bd4771b9e0a8d8eba4605a8eac0f8e320b1204eeab358a5a5b2caf3e534c28f9da5598fedc5f13b4a7930a569439c3bc43ac5f5195a29280042278f194f84f8e5ee210223f8a486d568fe4a51bf8ef813c1bd02a669e4e0ea79d1e6bad48257ace2e7feba18123a5e67fd7212a341f92061df472db87f1158b0a2088e48a3680edc29ce3d3156108c04e3b16a1cf18cd70c5f5eeeb59824fb869906679eceb4a6ab8ec8733e72db06403f357e128e3383e2b35269b20f032cc21da717ba3febe02fba9f4893074ee2fd98e85499e36ffe2077348bc541548a34bc32fa0f7c00d84cabfd31e5c75b6769a1ba5770c5217cb03d1f0a8c91ba8d524b42c7365e09d94d95cf43f7ec896718f210fd0ba4ef91a5262daf7cd2bae3c2aad3e2eb925bec9ca7c1b874776dc28784a3719cb191cc317ff897698b2667081cc9db30c96c6510766b65c55c5fd4b8564faca924e6f52c2b181561ee5403184a822f0a207d747602f616c5513cabfe55e525b2bce4d662ae0b9ea68c015d6ca87bc752ed3e527826191a36d23e8032e15f65b3d60a517f16c4ece8bc8b09681bad96a5300f7e30e6848612d67ad853bc1523799c568e46b1dfe0d37cbc202c1332718cfadd4d6938bc0bfb21fc15ad19a0506f669d5c8790b685d81c4acbdb8e1b06918e934b459e3f2b46fe0999e6eae4185edac1cb3e85e8b61de24794d339014c03a285a3d7ba91e00bed2d63b0edb933c290ddd62fb1c56b6d08cb99f47dabd72a667805d63a7784450a1bd1af6dfc2ec785ddb8b86fe4a44a7c8f86c4b19a61fdb701a81bd720bb70f8657e256b0f531ab7848b6206ba7cd4c32b866735a4b46091a0bb6c47c923a3efa99a09c0344228ed412f94c4eca96e6bf6ee75f23a1ae8415a892ff19bd190e1d67b8e1212be638eb179176e4074435ed381a7c2faaee9acbcf873823abd906e92f308b36c6c259e43d13b328ded6bf3c1f4a93a76e9a6d0483875456cf8f30eda231d9f26d6b3861a3f2db165758b0d7aacb7b5a8e9f4d775798556cee8dbe8a94fae8df837f71d66a0aaa48df5c36afa9033ec5283e713806d5a07f82729f9e888d309b713db36256757292443f00f1af08058057373ae710d90cefa5872bbeac931ddd145ba9a64997c0bc53cc59a954f8ee2670caac75e2a63b5a1ca6ca6e3f9287f080b271f34b2e63be2ad4c2b85b7c9683245b12491d221314ab2685e2a44787733af58502245e19af646f65dd26b44dda320d583d9ddd6567d6021dc2d7d731963d6cc790d8b082889045cb749de9857ee4388d0f3c2ef83d405d0a2328bd7f76fa4d3d0a2e8238c979babe572ab3e8ae2768ca212bad33249523fa89fc0498f5f29a68aa7aae681e41284f46b47cc996679c4f1d9936647cb9b47ca8dac8e161b5cc0ff29f48f4a42b6a567f1116a5c239e67069b96862e2ba0cb3d424d4c4810cc1f3da1c61f39e7cca3e519159c057a440db9838f9f14351f64ec24c70a21a874da100af89d4753d274bd87c6574de363d44ee5aa37bb360b3acf347b3a72fac5e66c939daf4c6cbfacb43ab73229cc0badacc30b6c771bee9a7a8e36a5839cf5d68ffac084e69cb7bb34f71fc2244e5d16d056f97f581e3c50112e81d8410b6aa6b33b924cbafbc8dcb163f22f0e7b618ecd22296328e3fafdc2366e49a7ab08fa0d5b55c8aaffa8c9fc2899c07cabcf35748b0f30edb03a8a55807b6c73cd0b64cdd1a77ec0dcb8be359715b284a9476a0013d69c825274f45b6ffa59df58ca07756af102a6bb0efa1b4b356f89c504097cf79c76ca07d325375bfac4d7c8483cabd8d7c9141c96948c32ec87c231b69d6776160b8b31dada7e0837b4c2dc2ecb28f9b0400589c12cde99dc7db30a9d4c4f8a904f6b2f2fba1d0c36544f84db803bef904ec5b1f976345f67688df6e2d866d9eda4a87395b8953c0dc1e93ca742d2141b3591bb0bfdb56a0f8eabf710a3479d8b8f7e3f0e73a6fd29fc946909f77a6ad3044495e4d6e661bc633f4eb63204dd9f47ee85676ec0aa8b713819a280c27f086445d62f258379ffd77ced5d2c8cdf7d87135d6806f340a111f42b042058b96daa2633a6975dc0c5580f93a38e3daba8fdfb21fd94ebb30a2e165a75c1788c1cfe2687af2c3d3908514722e19afb385a74d6ac8cb12ca6232cde2e99d4ac651b280e65b3b897e39984a64d55eb4f65ab0912675c3f334d7c7ce6ecd84044125d98ef9eb6cf46c5d5d01b3ba01fa4bb5ff70ba1d18cba8b28f3980fca9c75441ada9122d497ac2e779277edece11bd175bf79657c37b982acb078591520792cf8278b75177ad1aad8133b2e4a61c561b42f6ab11ff8227d75303720d121ad3f3ad2e350b4cbfb6c5476e0f73e58dd25a18f3b50d0b30a629b2f5e053422c5a18decb3ad311ca978dcb53d44c64f43ceec7f803370a9b4b91e837371c4ed274d636423cb189cfe1302c6605142d5765239c6c86384b7c6de980764793956cacff762f8c4feaef7dee318a977e942e3a2ef45e220857162ac83b0fd4f1deef6510005737e7588dac6679fd8ae630d60bb9509d848f00939134f0c52b2b122bcf7e46ce5ca2592d649ff00252e57d9541bafdfeb6492113f401eb428e543168a96bd06b31a9becd8f0fbb2b89d19479411bbe4e265480cf2a6f34e5bc02a98b9f29b8adc10f9096aa5096fe12ef67d9690388459664f9583095f9bef69f9725a76a2bab82cdefe92fefa283ad56c21ab3e8ea602130ad2d831c0a4fbbb7779476e74674034c6051272ca292540de9bfcb34536604865c759b639c6f1e58699635e037d3a8c", 0x1000) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000c40), r6) 2.695779241s ago: executing program 2 (id=511): socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135a56412a20d4363f5df408fc6441639e75c7470bb11", 0x30, 0xfffffffffffffffe) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='rpc_pipefs\x00', &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='rpc_pipefs\x00', 0x12b6c3, 0x108) r4 = fsopen(&(0x7f0000000300)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000600)='addr\x00', &(0x7f0000000700)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000800)='clientaddr\x00', &(0x7f0000000900)='127b\f\x00\x00.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000a00)='vers\x00', &(0x7f0000000b00)='4.0\x00', 0x0) fsopen(&(0x7f0000000e00)='nfs4\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) (async) nanosleep(&(0x7f0000000e00)={0x0, 0x186a0}, 0x0) r5 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r3, r5, r3}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 2.180893582s ago: executing program 3 (id=512): r0 = mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf\"\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`\x1e\x91<~\xd8\xabs\xbd*e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2\x04\x00\x00\x00\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\x1e\xfc/fm\xa9`)\xfc7\x84\f+\xf7\x95\xab[J\xe7\x9d\xd8\xe3\x86\xdb\xfe|\xe91\n\xa0\xdf\v\\\xe4\x00'/941, 0x40, 0x170, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) add_key$user(&(0x7f00000000c0), 0x0, &(0x7f0000000380)="7ccd08", 0x3, 0xfffffffffffffffc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x200, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x0, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x1, 0x1003, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x8}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x4, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x20000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000002000010000000000000000000220000000000000000000000500190002000000080009000000000008000b0005000000080017004e214e22080001"], 0x5c}}, 0x0) connect$bt_sco(r5, &(0x7f0000000080)={0x1f, @none}, 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@array={0x0, 0x0, 0x0, 0xa, 0x3, {0x0, 0x1000000}}]}}, &(0x7f00000000c0)=""/196, 0x32, 0xc4, 0x1}, 0x28) r7 = fanotify_init(0x200, 0x0) fanotify_mark(r7, 0x1, 0x8000000, r1, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f0000000740)={0x1, [], 0x7, "390c4bfe4f19aa"}) r8 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000001b40)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000040), 0x100013, 0xa4a82) ioctl$LOOP_SET_FD(r9, 0x4c00, r8) 1.752413647s ago: executing program 2 (id=513): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a0000000200", 0x6) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000140)=[@in6={0xa, 0x4e22, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}, @in6={0xa, 0x4e22, 0x6, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x8}, @in={0x2, 0x4e24, @broadcast}], 0x48) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000080), 0x1) sendto$inet6(r0, &(0x7f0000000040), 0x34000, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x100000, @loopback}, 0x1c) mkdir(&(0x7f0000000040)='./sys_mount\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys_mount\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys_mount/block/nullb0/queue/scheduler\x00', 0x2, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x39) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$alg(0xffffffffffffffff, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) r2 = syz_open_dev$vim2m(&(0x7f0000000100), 0x1, 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r3, 0x7003) ioctl$RTC_AIE_ON(r3, 0x7001) ioctl$RTC_SET_TIME(r3, 0x4024700a, &(0x7f0000000100)={0x2b, 0x1e, 0x0, 0x2, 0x8, 0xa9, 0x5, 0x2, 0x1}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x19, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000"], 0xa8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) ioctl$vim2m_VIDIOC_STREAMON(r2, 0x40045612, 0x0) socket$netlink(0x10, 0x3, 0x0) 1.599935367s ago: executing program 5 (id=514): socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135a56412a20d4363f5df408fc6441639e75c7470bb11", 0x30, 0xfffffffffffffffe) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='rpc_pipefs\x00', &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='rpc_pipefs\x00', 0x12b6c3, 0x108) r4 = fsopen(&(0x7f0000000300)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000400)='source\x00', &(0x7f0000000500)='127.0.0.1:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000600)='addr\x00', &(0x7f0000000700)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000800)='clientaddr\x00', &(0x7f0000000900)='127b\f\x00\x00.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000a00)='vers\x00', &(0x7f0000000b00)='4.0\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) r5 = fsopen(&(0x7f0000000e00)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) (async) nanosleep(&(0x7f0000000e00)={0x0, 0x186a0}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000140)={r3, 0x0, r3}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 1.22527109s ago: executing program 4 (id=515): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x20801, 0x0) close(0x3) openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(&(0x7f0000000000)='./bus\x00', 0x12) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0xc4, 0x8, 0x8}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000080), 0x8000, r1}, 0x38) write(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(0x0, 0xffffffffffffffff) sysinfo(0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0xf3a, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x8}) timer_settime(0x0, 0x1, 0x0, 0x0) 1.148244922s ago: executing program 2 (id=516): r0 = syz_open_dev$hidraw(&(0x7f0000000080), 0x1, 0x240) ioctl$HIDIOCGFEATURE(r0, 0xc0404807, &(0x7f00000005c0)={0x88, "895cd46771f00301c1ca639506f24c672ecfd2bd1050f9c5774eb3e02ce08f61bb32758aa48d8b91deae8e868458c5a16302ef180c82320b8e92c2821ee0eb19"}) 950.868947ms ago: executing program 3 (id=517): mkdir(&(0x7f0000000080)='./file1\x00', 0x8) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0_to_bond\x00'}) fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0) syz_open_dev$dvb_demux(&(0x7f0000000140), 0x0, 0x62400) gettid() openat$vicodec1(0xffffffffffffff9c, &(0x7f0000001440), 0x2, 0x0) sched_setscheduler(0x0, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0e0000000400000004000000ffff010000000000", @ANYRES32=0x1, @ANYBLOB="000000d17c"], 0x50) 946.537333ms ago: executing program 2 (id=518): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$kcm(0xa, 0x922000000003, 0x11) recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x100) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000280), 0x8) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000bc0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000b80)={&(0x7f0000001c00)=ANY=[@ANYBLOB, @ANYRES16=r2, @ANYBLOB="e92b2bbd7000fcdbdf250500000005000700040000000c00038008000200cc000000050007000200000005000700020000001c030380ed0005004d33b00036d244d88525ef4e889662c6bc7649b78d57ba8070c441c3ee66e2e30c02ca5f228f27bdfaca7fb92c43d80046afeeecf4e58d7c8a7fd245be1c0184452ac3a80091c5d195cdbdb41d7ef865a22c65d0b1ada1a65f23007fc05a32204b98e2c2ac925784ef4bd4c334dc87b707bb54e290dff7b724b2677892324eec825e652437d67ecd3078795a59d9850e3f6cf994ac5ba908fabaae64dd7a7c5a9d7210629cbcc4f0341988d7dbb18a270f94916d7fa545d9ee703e3e426997f245b084d157aeb9e7c2146a3a4d9c7661cfc55f1d2742840c728bec6a6a87bbdfa801315e55ca18ba8f000000b60004000dd4092264a787b299d2dfbd271c1587375a23c063a1503b062b9b8dd7e56fb6c2d668d4b52bcfe50db7b35279bda1c3312392ea26621b8a9910190dde8d8b8e58a56b703510012fa228382f65b0a0f721dc432b79e4357ed97e4a7b2541b6d255dc69f9943194a15a0243176820fe5b7bfd1235a5fda8035deea1c417499e481555abd34938144bff23d01404b52c84a206dfbdff8f111bc39f4da0fb54f355ce4a85c657cd942ec87bbbdf6443334633bc0000a90005006eae8b849424b9d4fc0851f8ce0f5f6837648dafa6b7876c842d5f5a33abec9a5fcf1bcffc193447c7860c5f82d39a8468078c1cda772eb10aa12a1bff247d016a24b312dd5c6c23466c3cdfd612e3cdac9410700cd9dd4628c4403a0bc543b5ecdc4d6413a1d3ce4d5abcbb245bd2eeb58bc3a92db36ccb343003e83156dff7527678e5a9ed3a625c924dd287e30ddb14eb33705dd5f50f2a4dbdc18f0dfc95026f4d2f5500000008000200ff7f0000b900050008c5a56e51dff9a11b922e34f23e3c23dbe15d41670821d075415e8a7369d5efe65961fabf5362486d51d5c224ea4ba45d3e0dea14fa3a5f777513afee8a9c2227466da0f048e1e6c17f4a51cfca0bd57ba7bdd790fcd35f7eacc533c2cd52ae8f1c43057229a81f6fb5b457faf360d9c3fd5ed8f31235e7007263aa9ba651015b62f3d4e93f0b1ecfd44407dd84e21ecdc37338b0adff4343e9061c9055b173206b7efd86e807ad48bc187d4259296d79dfb45c47000000080005000600000008000900000000006801038045000500942dc97fab698d2862ecc47545dc3d97a34985196a83bd936c61b1c7c5c382e158eba70c19925e839eaeb7e443cdd43416f934590343260eb5166d1e62d99415f3000000080002000400000054000380200001800500020000000000040003000800020047504c00040003000400030030000180120002002f2b2a7d2125972140217f292f000000080001001300000005000200000000000800010007000000040001004a000400e2909ae7026c194e9b18f3b56dc8c174262968c43df88f9db743d9ef7571ddbb84ae12a665798788b6a13fc4855c9e671507ac60e25199e067415bb4455c4d3f0d683c7f880100006e000400f5a1f691ccf7068905d7124e1069684c8ba66943bda53536433549c8484076e521d24744d494eda4fd03888a0708b668e36c232ceb85601629cffe332a5d4e696f9151223c7035a1b6309d16a1dea1516629ddc263f9d3b0e14588ab6fba39f355af577002ac05ee9ff00000540103804d000500f8aca886b20b30ea27c4fed8a7fe89448997a1738f7362c8b0d18e53d3d46d60088ad3a27c308b08bc32c22bab54824b2f3903a90d8fbb8590f9d7edd607b9172d8bac724323fedd52000000ff00040038ab98de4c3b4406c11dc16afd7893bcef6a05d1a1160d31c4e827535d0390396d5ce2e14347f2e51b0c8ae652451ce69c87c0f2f99f237abd62a3112c4e6c93e5ced26eea4e63510a0c6bcb010d384645c8240e9f8416dfae671878df6a1bce4d0ec9938eb1df5648a43055a652123756fd3d78a64982771ca794f09e930e174b0415519be7d99af8f96a4a048009b25be100492b6adb6bdc17d63b9e7aae5ad1eed5207616e4c4f634e1e77dc481fd9f31cb9de313f14e5cb76aed383df4d453366216304292b4311c861ac9f1628e8c35a5e5aab81f45b87cf8e1b354ea49a1bb2eae186182238f6091c7196fe709533103c490592e55b50d88000500060009000000"], 0x628}, 0x1, 0x0, 0x0, 0xa080}, 0x4000014) getsockopt$IP_SET_OP_GET_BYNAME(r0, 0x1, 0x53, &(0x7f0000000140)={0x6, 0x7, 'syz0\x00'}, &(0x7f0000000180)=0x28) close(r0) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000500), &(0x7f0000000540)=0xc) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x28c, 0x1}, {0x7}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) r6 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000740)=ANY=[@ANYBLOB="38000000090601a1c97bb73d035c2300000000000900020073797a3100000000050001"], 0x38}, 0x1, 0x0, 0x0, 0x10000047}, 0x4801) bpf$ENABLE_STATS(0x20, &(0x7f0000000200), 0x4) socket$nl_generic(0x10, 0x3, 0x10) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x0) syz_emit_ethernet(0x7e, &(0x7f00000010c0)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb08004500007000000000000190780a010102ac1414aa030490500100000045000000000000000011000000000000e0000002440c0001ac1414bb6f21000044340001e000000100000000ac1414bb00000000ac14140000000000ac1414aa000000000000000000000000ac1e000100000000"], 0x0) 276.23493ms ago: executing program 4 (id=519): ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f00000000c0)="aa06004e2400000000008133d576983340cb31a5fc977c294891f7c08bfcd111fbdf23ea32db0ecf20d5bc27bd8063", 0x2f}], 0x2) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x202) syz_open_procfs(0x0, &(0x7f0000000940)='net/bnep\x00') pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) write$tun(r0, &(0x7f00000000c0)=ANY=[], 0xfdef) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/remove\x00', 0x1, 0x0) write(r3, &(0x7f0000000140)='1', 0x1) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r4, r4) setpgid(0x0, r4) fchdir(r2) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=r4}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r5, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xd5d7a000) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) mount$binderfs(0x0, &(0x7f0000000700)='./binderfs\x00', 0x0, 0x20, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) chdir(&(0x7f0000000000)='./bus\x00') 95.079555ms ago: executing program 5 (id=520): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x10d801) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000300)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_GET_DEV_STATS(r1, 0xc4089434, &(0x7f0000000700)={0x0, 0x8000000000000001, 0x0, [0x5, 0x3, 0x9, 0x6d7, 0x605a], [0x4, 0x9856, 0x3, 0x1, 0x5, 0x200, 0x1, 0xa7, 0x7, 0x900000000, 0x1, 0x0, 0xfffffffffffffffe, 0x4, 0x81, 0x69f7, 0xae, 0x1822afc0, 0x6fc4, 0x7, 0x9, 0x10001, 0xfffffffffffffffc, 0x2, 0x3, 0x4, 0x1, 0x8000000000000001, 0x5, 0xed9b, 0x8a, 0xb, 0xfff, 0x3, 0x7, 0x2, 0x9ba7, 0x8, 0x6, 0x1, 0x4, 0xd5d0, 0xfff, 0x4, 0x9c30673800000, 0x8, 0xfff, 0x5, 0x100, 0x2, 0x5, 0x0, 0x7fffffff, 0xda, 0x1, 0x5, 0x6, 0xfffffffffffffffc, 0xc, 0x401, 0x73ea, 0xa, 0x8, 0x1, 0x4, 0x1, 0x3, 0x101, 0x0, 0x7, 0x9, 0x0, 0x8cd, 0x900000000000, 0x7, 0x3, 0x3, 0x2, 0x66f1989a, 0x4, 0x2, 0x3, 0xaf, 0x3, 0x8, 0x7, 0x1000, 0x9, 0xffff, 0xfffffffffffffffa, 0x5, 0x5, 0xe4, 0x9, 0x10000000000000, 0x5, 0xb, 0x8000000000000001, 0x9, 0x4, 0x3, 0x6, 0x10001, 0x80000000, 0x81, 0x6, 0x800, 0x6, 0x5, 0x80000000, 0xb0a, 0xa9, 0x4, 0x800, 0x813e, 0x101, 0x3, 0x2f, 0x4, 0x8000, 0x8]}) ioctl$BTRFS_IOC_BALANCE_V2(r2, 0xc4009420, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000100)={'vlan0\x00', &(0x7f0000000280)=@ethtool_sset_info}) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x641, 0x101001) write$evdev(r3, &(0x7f00000001c0)=[{{0x77359400}, 0x4, 0x4, 0x9}], 0xfffffffffffffe58) pread64(0xffffffffffffffff, 0x0, 0x0, 0x100000000004) setsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x7, &(0x7f0000000040)=0x2, 0x4) r4 = getpid() sched_rr_get_interval(r4, &(0x7f0000000180)) sched_setaffinity(r4, 0x0, 0x0) ioprio_set$pid(0x2, r4, 0x6000) r5 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8242, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x3) r8 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) clock_settime(0x2, 0x0) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r9, &(0x7f0000000080)='7', 0x1) write$char_usb(r9, &(0x7f0000000100)='V^', 0x2) syz_usb_disconnect(r8) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r7, 0x4008ae48, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a58000000060a010400000000000000000a0000010900010073797a1e510000002c0001000000080002400000001209000440000000030900020073797a32000000001400ea001100010000000000000000000100000a0000000000000000000000000200"], 0x80}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002180)=ANY=[@ANYBLOB="b8000000290001000000000000080000ac1414bb000000000000000000000000fc000000000000000000000000000000000000001000000002002000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000ea440000000000000000000000000000000000000000000000000100000000000000090000000000000002002000000000000000000000000000010000000000000002"], 0xb8}, 0x1, 0x0, 0x0, 0x2404c831}, 0x0) 43.71086ms ago: executing program 3 (id=521): syz_emit_ethernet(0x46, &(0x7f0000000400)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780c206050086dd6018232500102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa080002"], 0x0) (fail_nth: 1) 6.903874ms ago: executing program 2 (id=522): syz_emit_ethernet(0x46, &(0x7f0000000400)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780c206050086dd6018232500102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa080002"], 0x0) 0s ago: executing program 3 (id=523): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000014c0)=ANY=[@ANYBLOB="50010000", @ANYRES16=r1, @ANYBLOB="010000000000fcdbdf250100000008000100000000000400048008000c8004000b800800020001000000200108801c000780080005000000000008001c001c870a5c080005000000000024000780080005000000000008000500000000000800050029c8"], 0x150}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000400)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780c206050086dd6018232500102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa080002"], 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:10140' (ED25519) to the list of known hosts. [ 42.067278][ T5729] cgroup: Unknown subsys name 'net' [ 42.230226][ T5729] cgroup: Unknown subsys name 'cpuset' [ 42.234202][ T5729] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 43.186937][ T5729] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 47.144289][ T5749] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 47.150480][ T5752] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 47.155613][ T5752] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 47.160575][ T5749] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 47.161418][ T5752] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 47.168640][ T5749] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 47.171405][ T5757] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 47.173165][ T5749] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 47.173436][ T5752] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 47.174296][ T5752] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 47.175114][ T5757] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 47.175446][ T5757] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 47.176844][ T5762] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 47.177962][ T5762] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 47.182028][ T5752] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 47.182742][ T5762] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 47.185733][ T5752] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 47.186376][ T5749] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 47.187319][ T5749] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 47.187922][ T5749] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 47.752837][ T5751] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.756362][ T5751] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.759008][ T5751] bridge_slave_0: entered allmulticast mode [ 47.762266][ T5751] bridge_slave_0: entered promiscuous mode [ 47.784144][ T5751] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.786803][ T5751] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.789006][ T5751] bridge_slave_1: entered allmulticast mode [ 47.791564][ T5751] bridge_slave_1: entered promiscuous mode [ 47.847832][ T5751] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.861742][ T5747] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.864097][ T5747] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.866439][ T5747] bridge_slave_0: entered allmulticast mode [ 47.869244][ T5747] bridge_slave_0: entered promiscuous mode [ 47.875708][ T5751] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.888485][ T5756] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.890772][ T5756] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.893095][ T5756] bridge_slave_0: entered allmulticast mode [ 47.895855][ T5756] bridge_slave_0: entered promiscuous mode [ 47.909860][ T5747] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.912966][ T5747] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.915428][ T5747] bridge_slave_1: entered allmulticast mode [ 47.919316][ T5747] bridge_slave_1: entered promiscuous mode [ 47.927171][ T5756] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.929601][ T5756] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.931859][ T5756] bridge_slave_1: entered allmulticast mode [ 47.934852][ T5756] bridge_slave_1: entered promiscuous mode [ 47.937423][ T5758] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.939842][ T5758] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.942206][ T5758] bridge_slave_0: entered allmulticast mode [ 47.945104][ T5758] bridge_slave_0: entered promiscuous mode [ 47.969966][ T5758] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.972431][ T5758] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.974800][ T5758] bridge_slave_1: entered allmulticast mode [ 47.977672][ T5758] bridge_slave_1: entered promiscuous mode [ 47.988210][ T5751] team0: Port device team_slave_0 added [ 47.991544][ T5751] team0: Port device team_slave_1 added [ 48.016972][ T5747] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.028547][ T5756] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.034952][ T5756] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.041586][ T5758] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.046569][ T5747] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.074429][ T5751] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.076675][ T5751] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.084847][ T5751] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.090285][ T5758] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.094471][ T5747] team0: Port device team_slave_0 added [ 48.103475][ T5751] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.105710][ T5751] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.114285][ T5751] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.125803][ T5747] team0: Port device team_slave_1 added [ 48.129032][ T5756] team0: Port device team_slave_0 added [ 48.136091][ T5756] team0: Port device team_slave_1 added [ 48.163117][ T5756] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.165799][ T5756] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.174943][ T5756] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.180876][ T5758] team0: Port device team_slave_0 added [ 48.192081][ T5747] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.194534][ T5747] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.202500][ T5747] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.206456][ T5756] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.209181][ T5756] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.219363][ T5756] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.225306][ T5758] team0: Port device team_slave_1 added [ 48.250156][ T5747] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.252422][ T5747] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.260784][ T5747] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.277635][ T5758] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.279888][ T5758] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.287925][ T5758] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.303851][ T5751] hsr_slave_0: entered promiscuous mode [ 48.306334][ T5751] hsr_slave_1: entered promiscuous mode [ 48.318424][ T5758] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.320612][ T5758] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.328696][ T5758] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.348723][ T5756] hsr_slave_0: entered promiscuous mode [ 48.352900][ T5756] hsr_slave_1: entered promiscuous mode [ 48.356016][ T5756] debugfs: 'hsr0' already exists in 'hsr' [ 48.358652][ T5756] Cannot create hsr debugfs directory [ 48.378786][ T5747] hsr_slave_0: entered promiscuous mode [ 48.381041][ T5747] hsr_slave_1: entered promiscuous mode [ 48.383092][ T5747] debugfs: 'hsr0' already exists in 'hsr' [ 48.384874][ T5747] Cannot create hsr debugfs directory [ 48.477521][ T5758] hsr_slave_0: entered promiscuous mode [ 48.480702][ T5758] hsr_slave_1: entered promiscuous mode [ 48.483888][ T5758] debugfs: 'hsr0' already exists in 'hsr' [ 48.486337][ T5758] Cannot create hsr debugfs directory [ 48.681985][ T5751] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 48.692343][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.695237][ T5751] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 48.700689][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.718718][ T5751] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 48.726208][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.730090][ T5751] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 48.743316][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.790077][ T5756] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 48.796155][ T5756] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.800088][ T5756] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 48.806688][ T5756] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.811445][ T5756] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 48.818455][ T5756] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.823192][ T5756] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 48.830339][ T5756] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.886630][ T5747] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 48.891210][ T5747] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.893878][ T5747] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 48.897582][ T5747] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.902479][ T5747] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 48.906783][ T5747] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.910188][ T5747] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 48.914200][ T5747] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.972550][ T5758] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 48.980303][ T5758] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.983509][ T5758] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 48.990462][ T5758] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.998198][ T5758] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 49.005157][ T5758] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.013024][ T5751] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.015430][ T5758] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 49.021591][ T5758] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.080374][ T5751] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.089092][ T5756] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.103115][ T1164] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.105734][ T1164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.122587][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.124899][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.134751][ T5756] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.145797][ T1164] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.148138][ T1164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.161572][ T5747] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.168948][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.171244][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.194549][ T5758] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.199876][ T5747] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.216576][ T1164] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.218153][ T5760] Bluetooth: hci0: command tx timeout [ 49.218176][ T5749] Bluetooth: hci3: command tx timeout [ 49.218306][ T5749] Bluetooth: hci1: command tx timeout [ 49.219191][ T1164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.226676][ T5760] Bluetooth: hci2: command tx timeout [ 49.247839][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.251353][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.263599][ T5758] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.274361][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.277570][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.300240][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.303167][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.515181][ T5751] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.545615][ T5751] veth0_vlan: entered promiscuous mode [ 49.565118][ T5751] veth1_vlan: entered promiscuous mode [ 49.578838][ T5756] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.599693][ T5751] veth0_macvtap: entered promiscuous mode [ 49.608410][ T5758] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.613548][ T5751] veth1_macvtap: entered promiscuous mode [ 49.639052][ T5756] veth0_vlan: entered promiscuous mode [ 49.644831][ T5751] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.650543][ T5747] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.657577][ T5751] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.671539][ T5756] veth1_vlan: entered promiscuous mode [ 49.718894][ T5758] veth0_vlan: entered promiscuous mode [ 49.735050][ T5747] veth0_vlan: entered promiscuous mode [ 49.743596][ T5756] veth0_macvtap: entered promiscuous mode [ 49.749379][ T5758] veth1_vlan: entered promiscuous mode [ 49.763934][ T5756] veth1_macvtap: entered promiscuous mode [ 49.765755][ T1162] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.769076][ T1162] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.769851][ T5747] veth1_vlan: entered promiscuous mode [ 49.792733][ T89] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.796254][ T89] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.796594][ T5756] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.810012][ T5756] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.837657][ T5758] veth0_macvtap: entered promiscuous mode [ 49.848109][ T5758] veth1_macvtap: entered promiscuous mode [ 49.859674][ T5747] veth0_macvtap: entered promiscuous mode [ 49.865463][ T5751] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 49.881004][ T5747] veth1_macvtap: entered promiscuous mode [ 49.885808][ T5751] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 49.892354][ T5751] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 49.896586][ T1162] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.898122][ T5751] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 49.904295][ T1162] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.912637][ T5751] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 49.934587][ T5747] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.952607][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.953678][ T5758] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.956017][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.969518][ T5747] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.977350][ T5758] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.048935][ T5826] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.055096][ T5826] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.060131][ T5826] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.064379][ T5826] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.070409][ T5826] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.073409][ T5826] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.076580][ T5826] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.081646][ T5826] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.084704][ T5826] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.088193][ T5826] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.090953][ T5826] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.093671][ T5826] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.096466][ T5826] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.099867][ T5826] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.102627][ T5826] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.105485][ T5826] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.150219][ T1162] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.153888][ T1162] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.185639][ T229] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.185864][ T1162] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.191992][ T1162] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.192663][ T229] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.236612][ T1162] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.240388][ T1162] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.013844][ C1] process 5905 (syz.0.1) no longer affine to cpu1 [ 51.233030][ T5905] process 5908 (syz.0.1) no longer affine to cpu1 [ 51.234308][ T5905] process 5913 (syz.0.1) no longer affine to cpu1 [ 51.234334][ T5905] process 5914 (syz.0.1) no longer affine to cpu1 [ 51.290173][ T5917] smpboot: CPU 1 is now offline [ 51.298727][ T5760] Bluetooth: hci2: command tx timeout [ 51.298754][ T5755] Bluetooth: hci0: command tx timeout [ 51.307325][ T5755] Bluetooth: hci1: command tx timeout [ 51.310122][ T5755] Bluetooth: hci3: command tx timeout [ 51.584900][ T5927] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 52.389575][ T5944] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11'. [ 53.377333][ T5760] Bluetooth: hci3: command tx timeout [ 53.377350][ T5755] Bluetooth: hci1: command tx timeout [ 53.377432][ T5749] Bluetooth: hci0: command tx timeout [ 53.377890][ T5762] Bluetooth: hci2: command tx timeout [ 53.646125][ T5962] smpboot: CPU 1 is now offline [ 53.673245][ T5962] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 53.764525][ T5968] smpboot: CPU 1 is now offline [ 53.809576][ T5969] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 55.457809][ T5755] Bluetooth: hci0: command tx timeout [ 55.457831][ T5760] Bluetooth: hci2: command tx timeout [ 55.459588][ T5762] Bluetooth: hci1: command tx timeout [ 55.467149][ T5760] Bluetooth: hci3: command tx timeout [ 56.321332][ T6009] syzkaller0: entered promiscuous mode [ 56.323160][ T6009] syzkaller0: entered allmulticast mode [ 56.538914][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 56.673738][ T6016] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.677567][ T6016] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.762943][ T6016] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 56.770269][ T6016] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 56.897217][ T5617] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.901817][ T5617] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.905101][ T5617] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.908780][ T5617] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.126830][ C1] process 6027 (syz.3.32) no longer affine to cpu1 [ 57.147958][ T6036] smpboot: CPU 1 is now offline [ 57.204239][ T6026] process 6029 (syz.0.31) no longer affine to cpu1 [ 57.222722][ T6036] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 58.409482][ T6061] loop9: detected capacity change from 0 to 7 [ 58.416462][ T6061] Buffer I/O error on dev loop9, logical block 0, async page read [ 58.420962][ T6061] Buffer I/O error on dev loop9, logical block 0, async page read [ 58.423919][ T6061] Buffer I/O error on dev loop9, logical block 0, async page read [ 58.426435][ T6061] Buffer I/O error on dev loop9, logical block 0, async page read [ 58.429212][ T6061] Buffer I/O error on dev loop9, logical block 0, async page read [ 58.431723][ T6061] Buffer I/O error on dev loop9, logical block 0, async page read [ 58.434254][ T6061] Buffer I/O error on dev loop9, logical block 0, async page read [ 58.436781][ T6061] ldm_validate_partition_table(): Disk read failed. [ 58.439800][ T6061] Buffer I/O error on dev loop9, logical block 0, async page read [ 58.442303][ T6061] Buffer I/O error on dev loop9, logical block 0, async page read [ 58.444840][ T6061] Buffer I/O error on dev loop9, logical block 0, async page read [ 58.447516][ T6061] Dev loop9: unable to read RDB block 0 [ 58.449297][ T6061] loop9: unable to read partition table [ 58.451900][ T6061] loop9: partition table beyond EOD, truncated [ 58.454598][ T6061] loop_reread_partitions: partition scan of loop9 (þ被xüŸÑø éÚ¬§½dG¤´à–ƒÝ¡¯ â·û [ 58.454598][ T6061] ) failed (rc=-5) [ 58.475351][ T1355] IPVS: starting estimator thread 0... [ 58.577202][ T6064] IPVS: using max 43 ests per chain, 103200 per kthread [ 58.855359][ T6072] e1000e 0000:00:02.0 eth1: removed PHC [ 59.152163][ T6072] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 59.718785][ T6077] usb_phy_generic usb_phy_generic.2.auto: dummy supplies not allowed for exclusive requests (id=vbus) [ 59.736501][ T6077] dwc2 dwc2.3.auto: supply vusb_d not found, using dummy regulator [ 59.741810][ T6077] dwc2 dwc2.3.auto: supply vusb_a not found, using dummy regulator [ 59.745119][ T6077] dwc2 dwc2.3.auto: Configuration mismatch. dr_mode forced to host [ 59.747978][ T6077] dwc2 dwc2.3.auto: Bad value for GSNPSID: 0x52540012 [ 61.316677][ T6111] process 6113 (syz.1.48) no longer affine to cpu1 [ 61.456957][ T6115] smpboot: CPU 1 is now offline [ 61.665838][ T6139] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 63.495047][ T6177] process 6174 (syz.2.56) no longer affine to cpu1 [ 63.495050][ T27] process 6173 (syz.3.57) no longer affine to cpu1 [ 63.495523][ T6173] process 6180 (syz.3.57) no longer affine to cpu1 [ 63.520290][ T6184] process 6185 (syz.1.59) no longer affine to cpu1 [ 63.524284][ T6182] smpboot: CPU 1 is now offline [ 63.751361][ T6173] process 6175 (syz.3.57) no longer affine to cpu1 [ 63.754298][ T6174] process 6176 (syz.2.56) no longer affine to cpu1 [ 65.068214][ T5760] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 65.072439][ T5760] CPU: 0 UID: 0 PID: 5760 Comm: kworker/u34:6 Not tainted syzkaller #0 PREEMPT(full) [ 65.072457][ T5760] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 65.072466][ T5760] Workqueue: hci2 hci_rx_work [ 65.072485][ T5760] Call Trace: [ 65.072490][ T5760] [ 65.072496][ T5760] dump_stack_lvl+0x100/0x190 [ 65.072512][ T5760] sysfs_warn_dup.cold+0x1c/0x28 [ 65.072532][ T5760] sysfs_create_dir_ns+0x24b/0x2b0 [ 65.072551][ T5760] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 65.072568][ T5760] ? find_held_lock+0x2b/0x80 [ 65.072583][ T5760] ? kobject_add_internal+0x25f/0x930 [ 65.072600][ T5760] ? kobject_add_internal+0x25f/0x930 [ 65.072618][ T5760] ? do_raw_spin_unlock+0x145/0x1e0 [ 65.072632][ T5760] kobject_add_internal+0x2c8/0x930 [ 65.072651][ T5760] kobject_add+0x16a/0x1e0 [ 65.072668][ T5760] ? __pfx_kobject_add+0x10/0x10 [ 65.072684][ T5760] ? class_to_subsys+0x10f/0x150 [ 65.072699][ T5760] ? kobject_put+0xb9/0x640 [ 65.072714][ T5760] ? _raw_spin_unlock+0x28/0x50 [ 65.072728][ T5760] device_add+0x294/0x1970 [ 65.072747][ T5760] ? __pfx_dev_set_name+0x10/0x10 [ 65.072759][ T5760] ? __pfx_device_add+0x10/0x10 [ 65.072776][ T5760] ? mgmt_send_event_skb+0x2fb/0x460 [ 65.072794][ T5760] hci_conn_add_sysfs+0x1a3/0x260 [ 65.072811][ T5760] le_conn_complete_evt+0x11eb/0x1f60 [ 65.072828][ T5760] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 65.072840][ T5760] ? hci_event_packet+0x186/0xcd0 [ 65.072856][ T5760] hci_le_conn_complete_evt+0x23c/0x3a0 [ 65.072870][ T5760] ? skb_pull_data+0x15f/0x1e0 [ 65.072882][ T5760] hci_le_meta_evt+0x34a/0x5f0 [ 65.072897][ T5760] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 65.072912][ T5760] hci_event_packet+0x51c/0xcd0 [ 65.072925][ T5760] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 65.072939][ T5760] ? __pfx_hci_event_packet+0x10/0x10 [ 65.072953][ T5760] ? kcov_remote_start+0x384/0x670 [ 65.072970][ T5760] ? lockdep_hardirqs_on+0x78/0x100 [ 65.072986][ T5760] hci_rx_work+0x451/0xfc0 [ 65.073001][ T5760] process_one_work+0xa23/0x1940 [ 65.073023][ T5760] ? __pfx_process_one_work+0x10/0x10 [ 65.073043][ T5760] ? __pfx_hci_rx_work+0x10/0x10 [ 65.073057][ T5760] worker_thread+0x5ef/0xe50 [ 65.073078][ T5760] ? kthread+0x13a/0x450 [ 65.073091][ T5760] ? __pfx_worker_thread+0x10/0x10 [ 65.073116][ T5760] kthread+0x370/0x450 [ 65.073132][ T5760] ? __pfx_kthread+0x10/0x10 [ 65.073150][ T5760] ret_from_fork+0x72b/0xd50 [ 65.073167][ T5760] ? __pfx_ret_from_fork+0x10/0x10 [ 65.073183][ T5760] ? __switch_to+0x800/0x10f0 [ 65.073202][ T5760] ? __pfx_kthread+0x10/0x10 [ 65.073219][ T5760] ret_from_fork_asm+0x1a/0x30 [ 65.073240][ T5760] [ 65.073257][ T5760] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 65.176924][ T5760] Bluetooth: hci2: failed to register connection device [ 65.420325][ T6222] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 65.428658][ T6222] ======================================================= [ 65.428658][ T6222] WARNING: The mand mount option has been deprecated and [ 65.428658][ T6222] and is ignored by this kernel. Remove the mand [ 65.428658][ T6222] option from the mount to silence this warning. [ 65.428658][ T6222] ======================================================= [ 65.627098][ T5828] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 65.705499][ T6233] warning: `syz.1.70' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 65.777122][ T5828] usb 8-1: Using ep0 maxpacket: 8 [ 65.781489][ T5828] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 65.785662][ T5828] usb 8-1: config 0 has no interfaces? [ 65.796305][ T5828] usb 8-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 65.800995][ T5828] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.805742][ T5828] usb 8-1: Product: syz [ 65.808382][ T5828] usb 8-1: Manufacturer: syz [ 65.810297][ T5828] usb 8-1: SerialNumber: syz [ 65.822782][ T5828] usb 8-1: config 0 descriptor?? [ 65.939298][ T6237] netlink: 8 bytes leftover after parsing attributes in process `syz.1.72'. [ 65.944999][ T6237] netlink: 'syz.1.72': attribute type 2 has an invalid length. [ 65.948061][ T6237] Zero length message leads to an empty skb [ 66.148603][ T6241] netlink: 88 bytes leftover after parsing attributes in process `syz.1.74'. [ 66.207802][ T6244] Bluetooth: MGMT ver 1.23 [ 66.310704][ T6241] netlink: 8 bytes leftover after parsing attributes in process `syz.1.74'. [ 66.441128][ T6254] FAULT_INJECTION: forcing a failure. [ 66.441128][ T6254] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 66.446146][ T6254] CPU: 2 UID: 0 PID: 6254 Comm: syz.1.77 Not tainted syzkaller #0 PREEMPT(full) [ 66.446161][ T6254] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 66.446168][ T6254] Call Trace: [ 66.446172][ T6254] [ 66.446177][ T6254] dump_stack_lvl+0x100/0x190 [ 66.446194][ T6254] should_fail_ex.cold+0x5/0xa [ 66.446208][ T6254] _copy_to_user+0x32/0xd0 [ 66.446233][ T6254] simple_read_from_buffer+0xcb/0x170 [ 66.446253][ T6254] proc_fail_nth_read+0x1af/0x230 [ 66.446269][ T6254] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 66.446284][ T6254] ? rw_verify_area+0xce/0x6d0 [ 66.446301][ T6254] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 66.446315][ T6254] vfs_read+0x1e4/0xb40 [ 66.446327][ T6254] ? __pfx_vfs_read+0x10/0x10 [ 66.446335][ T6254] ? find_held_lock+0x2b/0x80 [ 66.446350][ T6254] ? __fget_files+0x215/0x3d0 [ 66.446363][ T6254] ? __fget_files+0x21f/0x3d0 [ 66.446377][ T6254] ksys_read+0x12a/0x250 [ 66.446386][ T6254] ? __pfx_ksys_read+0x10/0x10 [ 66.446400][ T6254] do_int80_emulation+0x14b/0x720 [ 66.446417][ T6254] asm_int80_emulation+0x1a/0x20 [ 66.446428][ T6254] RIP: 0023:0xf71873eb [ 66.446437][ T6254] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 66.446447][ T6254] RSP: 002b:00000000f54464bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 66.446465][ T6254] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54465d0 [ 66.446471][ T6254] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 66.446477][ T6254] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 66.446483][ T6254] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 66.446489][ T6254] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 66.446502][ T6254] [ 66.589073][ T6257] netlink: 12 bytes leftover after parsing attributes in process `syz.1.78'. [ 66.591862][ T6257] netlink: 4 bytes leftover after parsing attributes in process `syz.1.78'. [ 67.427144][ T5617] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.427847][ T5828] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 67.553369][ T6268] FAULT_INJECTION: forcing a failure. [ 67.553369][ T6268] name failslab, interval 1, probability 0, space 0, times 0 [ 67.557622][ T6268] CPU: 2 UID: 0 PID: 6268 Comm: syz.1.82 Not tainted syzkaller #0 PREEMPT(full) [ 67.557637][ T6268] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 67.557644][ T6268] Call Trace: [ 67.557648][ T6268] [ 67.557653][ T6268] dump_stack_lvl+0x100/0x190 [ 67.557670][ T6268] should_fail_ex.cold+0x5/0xa [ 67.557683][ T6268] should_failslab+0xc2/0x120 [ 67.557701][ T6268] __kmalloc_noprof+0xfc/0x820 [ 67.557716][ T6268] ? kernfs_fop_write_iter+0x26a/0x5f0 [ 67.557733][ T6268] kernfs_fop_write_iter+0x26a/0x5f0 [ 67.557747][ T6268] vfs_write+0x6ac/0x1050 [ 67.557758][ T6268] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 67.557773][ T6268] ? __pfx_vfs_write+0x10/0x10 [ 67.557782][ T6268] ? find_held_lock+0x2b/0x80 [ 67.557804][ T6268] ksys_write+0x12a/0x250 [ 67.557814][ T6268] ? __pfx_ksys_write+0x10/0x10 [ 67.557823][ T6268] ? ksys_write+0x1ac/0x250 [ 67.557833][ T6268] ? __pfx_ksys_write+0x10/0x10 [ 67.557846][ T6268] __do_fast_syscall_32+0xe7/0x970 [ 67.557861][ T6268] ? lockdep_hardirqs_on+0x78/0x100 [ 67.557876][ T6268] do_fast_syscall_32+0x32/0x70 [ 67.557890][ T6268] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 67.557905][ T6268] RIP: 0023:0xf7f87fec [ 67.557918][ T6268] Code: Unable to access opcode bytes at 0xf7f87fc2. [ 67.557924][ T6268] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 67.557934][ T6268] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400 [ 67.557941][ T6268] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000000 [ 67.557947][ T6268] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 67.557953][ T6268] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 67.557959][ T6268] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 67.557972][ T6268] [ 67.640197][ T5828] usb 5-1: unable to get BOS descriptor or descriptor too short [ 67.643130][ T5828] usb 5-1: not running at top speed; connect to a high speed hub [ 67.646556][ T5828] usb 5-1: config 10 has an invalid interface number: 3 but max is 0 [ 67.649552][ T5828] usb 5-1: config 10 has no interface number 0 [ 67.651550][ T5828] usb 5-1: config 10 interface 3 has no altsetting 0 [ 67.653917][ T6270] Format for adding new device is "id port_count num_queues" (uint uint uint). [ 67.655408][ T5828] usb 5-1: New USB device found, idVendor=11ba, idProduct=1003, bcdDevice=14.c2 [ 67.659769][ T5828] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.662224][ T5828] usb 5-1: Product: syz [ 67.663504][ T5828] usb 5-1: Manufacturer: syz [ 67.665000][ T5828] usb 5-1: SerialNumber: syz [ 67.828508][ T6281] batadv_slave_1: entered promiscuous mode [ 67.832196][ T6281] macvlan2: entered allmulticast mode [ 67.833990][ T6281] batadv_slave_1: entered allmulticast mode [ 67.841582][ T6281] batman_adv: batadv0: Adding interface: macvlan2 [ 67.843798][ T6281] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.851700][ T6281] batman_adv: batadv0: Interface activated: macvlan2 [ 68.035756][ T5827] usb 8-1: USB disconnect, device number 2 [ 68.041278][ T5828] pvrusb2: Hardware description: OnAir Creator Hybrid USB tuner [ 68.052108][ T5828] usb 5-1: selecting invalid altsetting 0 [ 68.067097][ T2519] pvrusb2: Invalid write control endpoint [ 68.084454][ T5828] usb 5-1: USB disconnect, device number 2 [ 68.159080][ T2519] pvrusb2: Invalid write control endpoint [ 68.161523][ T2519] pvrusb2: Invalid write control endpoint [ 68.163943][ T2519] pvrusb2: Invalid write control endpoint [ 68.166446][ T2519] pvrusb2: Invalid write control endpoint [ 68.169664][ T2519] pvrusb2: Invalid write control endpoint [ 68.172993][ T2519] pvrusb2: Invalid write control endpoint [ 68.175338][ T2519] pvrusb2: Invalid write control endpoint [ 68.179868][ T2519] pvrusb2: Invalid write control endpoint [ 68.181778][ T2519] pvrusb2: Invalid write control endpoint [ 68.183637][ T2519] pvrusb2: Invalid write control endpoint [ 68.190849][ T2519] pvrusb2: Invalid write control endpoint [ 68.192686][ T2519] pvrusb2: Invalid write control endpoint [ 68.200176][ T2519] pvrusb2: Invalid write control endpoint [ 68.202992][ T2519] pvrusb2: Invalid write control endpoint [ 68.205094][ T2519] pvrusb2: Invalid write control endpoint [ 68.206964][ T2519] pvrusb2: Invalid write control endpoint [ 68.209145][ T2519] pvrusb2: Invalid write control endpoint [ 68.211601][ T2519] pvrusb2: Invalid write control endpoint [ 68.213450][ T2519] pvrusb2: Invalid write control endpoint [ 68.215287][ T2519] pvrusb2: Invalid write control endpoint [ 68.217698][ T2519] pvrusb2: Invalid write control endpoint [ 68.219680][ T2519] pvrusb2: Invalid write control endpoint [ 68.221516][ T2519] pvrusb2: Invalid write control endpoint [ 68.223410][ T2519] pvrusb2: Invalid write control endpoint [ 68.225253][ T2519] pvrusb2: Invalid write control endpoint [ 68.227385][ T2519] pvrusb2: Invalid write control endpoint [ 68.229280][ T2519] pvrusb2: Invalid write control endpoint [ 68.231167][ T2519] pvrusb2: Invalid write control endpoint [ 68.233022][ T2519] pvrusb2: Invalid write control endpoint [ 68.234905][ T2519] pvrusb2: Invalid write control endpoint [ 68.236787][ T2519] pvrusb2: Invalid write control endpoint [ 68.240960][ T2519] pvrusb2: Invalid write control endpoint [ 68.249350][ T2519] pvrusb2: Module ID 3 (saa7115) for device OnAir Creator Hybrid USB tuner failed to load. Possible missing sub-device kernel module or initialization failure within module. [ 68.282890][ T2519] cs53l32a 2-0011: chip found @ 0x22 (pvrusb2_a) [ 68.286598][ T2519] pvrusb2: Invalid write control endpoint [ 68.290146][ T2519] pvrusb2: Invalid write control endpoint [ 68.292700][ T2519] pvrusb2: Invalid write control endpoint [ 68.295223][ T2519] pvrusb2: Invalid write control endpoint [ 68.299446][ T2519] pvrusb2: Invalid write control endpoint [ 68.301931][ T2519] pvrusb2: Invalid write control endpoint [ 68.304413][ T2519] pvrusb2: Invalid write control endpoint [ 68.310167][ T2519] pvrusb2: Invalid write control endpoint [ 68.312714][ T2519] pvrusb2: Invalid write control endpoint [ 68.315234][ T2519] pvrusb2: Invalid write control endpoint [ 68.320472][ T2519] pvrusb2: Invalid write control endpoint [ 68.323012][ T2519] pvrusb2: Invalid write control endpoint [ 68.325535][ T2519] pvrusb2: Invalid write control endpoint [ 68.328567][ T2519] pvrusb2: Invalid write control endpoint [ 68.331204][ T2519] pvrusb2: Invalid write control endpoint [ 68.333713][ T2519] pvrusb2: Invalid write control endpoint [ 68.336081][ T2519] pvrusb2: Invalid write control endpoint [ 68.343664][ T2519] pvrusb2: Invalid write control endpoint [ 68.345495][ T2519] pvrusb2: Invalid write control endpoint [ 68.347543][ T2519] pvrusb2: Invalid write control endpoint [ 68.349352][ T2519] pvrusb2: Invalid write control endpoint [ 68.353933][ T2519] pvrusb2: Attached sub-driver cs53l32a [ 68.373061][ T2519] pvrusb2: Invalid write control endpoint [ 68.376180][ T2519] pvrusb2: Invalid write control endpoint [ 68.378260][ T2519] pvrusb2: Invalid write control endpoint [ 68.380514][ T2519] pvrusb2: Invalid write control endpoint [ 68.383176][ T2519] pvrusb2: Module ID 4 (tuner) for device OnAir Creator Hybrid USB tuner failed to load. Possible missing sub-device kernel module or initialization failure within module. [ 68.388838][ T2519] pvrusb2: Device being rendered inoperable [ 68.390713][ T2519] pvrusb2: ***WARNING*** pvrusb2 driver initialization failed due to the failure of one or more sub-device kernel modules. [ 68.395280][ T2519] pvrusb2: You need to resolve the failing condition before this driver can function. There should be some earlier messages giving more information about the problem. [ 68.733787][ T6290] FAULT_INJECTION: forcing a failure. [ 68.733787][ T6290] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 68.738262][ T6290] CPU: 2 UID: 0 PID: 6290 Comm: syz.3.86 Not tainted syzkaller #0 PREEMPT(full) [ 68.738288][ T6290] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 68.738294][ T6290] Call Trace: [ 68.738298][ T6290] [ 68.738302][ T6290] dump_stack_lvl+0x100/0x190 [ 68.738320][ T6290] should_fail_ex.cold+0x5/0xa [ 68.738334][ T6290] _copy_from_user+0x2e/0xd0 [ 68.738353][ T6290] get_compat_msghdr+0xb3/0x480 [ 68.738371][ T6290] ? __pfx_get_compat_msghdr+0x10/0x10 [ 68.738392][ T6290] ___sys_sendmsg+0x1b6/0x1e0 [ 68.738405][ T6290] ? __pfx____sys_sendmsg+0x10/0x10 [ 68.738423][ T6290] ? find_held_lock+0x2b/0x80 [ 68.738446][ T6290] __sys_sendmsg+0x160/0x210 [ 68.738461][ T6290] ? __pfx___sys_sendmsg+0x10/0x10 [ 68.738479][ T6290] ? exit_to_user_mode_loop+0x166/0x6f0 [ 68.738490][ T6290] ? rcu_is_watching+0x12/0xc0 [ 68.738507][ T6290] __do_fast_syscall_32+0xe7/0x970 [ 68.738522][ T6290] ? lockdep_hardirqs_on+0x78/0x100 [ 68.738536][ T6290] do_fast_syscall_32+0x32/0x70 [ 68.738551][ T6290] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 68.738565][ T6290] RIP: 0023:0xf709efec [ 68.738578][ T6290] Code: Unable to access opcode bytes at 0xf709efc2. [ 68.738583][ T6290] RSP: 002b:00000000f546c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 68.738594][ T6290] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 68.738600][ T6290] RDX: 0000000020008004 RSI: 0000000000000000 RDI: 0000000000000000 [ 68.738606][ T6290] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 68.738612][ T6290] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 68.738618][ T6290] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 68.738635][ T6290] [ 69.468268][ T6298] FAULT_INJECTION: forcing a failure. [ 69.468268][ T6298] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 69.474351][ T6298] CPU: 0 UID: 0 PID: 6298 Comm: syz.2.91 Not tainted syzkaller #0 PREEMPT(full) [ 69.474366][ T6298] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 69.474373][ T6298] Call Trace: [ 69.474377][ T6298] [ 69.474381][ T6298] dump_stack_lvl+0x100/0x190 [ 69.474415][ T6298] should_fail_ex.cold+0x5/0xa [ 69.474429][ T6298] _copy_from_user+0x2e/0xd0 [ 69.474449][ T6298] __sys_bpf+0x2f5/0x4e80 [ 69.474466][ T6298] ? __pfx___sys_bpf+0x10/0x10 [ 69.474478][ T6298] ? find_held_lock+0x2b/0x80 [ 69.474494][ T6298] ? get_pid_task+0xfc/0x250 [ 69.474508][ T6298] ? get_pid_task+0xfc/0x250 [ 69.474525][ T6298] ? proc_fail_nth_write+0x9f/0x220 [ 69.474541][ T6298] ? find_held_lock+0x2b/0x80 [ 69.474557][ T6298] ? rcu_read_lock_any_held+0x6a/0xa0 [ 69.474573][ T6298] ? find_held_lock+0x2b/0x80 [ 69.474586][ T6298] ? ksys_write+0x190/0x250 [ 69.474597][ T6298] ? ksys_write+0x190/0x250 [ 69.474616][ T6298] ? fput+0x79/0x100 [ 69.474630][ T6298] ? __ia32_sys_bpf+0xcc/0x170 [ 69.474645][ T6298] __ia32_sys_bpf+0xcc/0x170 [ 69.474658][ T6298] ? __do_fast_syscall_32+0x98/0x970 [ 69.474680][ T6298] __do_fast_syscall_32+0xe7/0x970 [ 69.474694][ T6298] ? lockdep_hardirqs_on+0x78/0x100 [ 69.474708][ T6298] do_fast_syscall_32+0x32/0x70 [ 69.474723][ T6298] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 69.474738][ T6298] RIP: 0023:0xf7f14fec [ 69.474751][ T6298] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 69.474756][ T6298] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 69.474767][ T6298] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 00000000800003c0 [ 69.474774][ T6298] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 69.474780][ T6298] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 69.474785][ T6298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 69.474791][ T6298] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 69.474805][ T6298] [ 69.661484][ T6308] FAULT_INJECTION: forcing a failure. [ 69.661484][ T6308] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 69.665667][ T6308] CPU: 0 UID: 0 PID: 6308 Comm: syz.2.95 Not tainted syzkaller #0 PREEMPT(full) [ 69.665687][ T6308] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 69.665693][ T6308] Call Trace: [ 69.665698][ T6308] [ 69.665703][ T6308] dump_stack_lvl+0x100/0x190 [ 69.665721][ T6308] should_fail_ex.cold+0x5/0xa [ 69.665735][ T6308] _copy_from_user+0x2e/0xd0 [ 69.665754][ T6308] get_compat_msghdr+0xb3/0x480 [ 69.665772][ T6308] ? __pfx_get_compat_msghdr+0x10/0x10 [ 69.665793][ T6308] ___sys_sendmsg+0x1b6/0x1e0 [ 69.665806][ T6308] ? __pfx____sys_sendmsg+0x10/0x10 [ 69.665823][ T6308] ? find_held_lock+0x2b/0x80 [ 69.665847][ T6308] __sys_sendmsg+0x160/0x210 [ 69.665862][ T6308] ? __pfx___sys_sendmsg+0x10/0x10 [ 69.665881][ T6308] ? __pfx_ksys_write+0x10/0x10 [ 69.665894][ T6308] __do_fast_syscall_32+0xe7/0x970 [ 69.665909][ T6308] ? lockdep_hardirqs_on+0x78/0x100 [ 69.665924][ T6308] do_fast_syscall_32+0x32/0x70 [ 69.665939][ T6308] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 69.665954][ T6308] RIP: 0023:0xf7f14fec [ 69.665967][ T6308] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 69.665972][ T6308] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 69.665982][ T6308] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 69.665989][ T6308] RDX: 0000000000040000 RSI: 0000000000000000 RDI: 0000000000000000 [ 69.665995][ T6308] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 69.666001][ T6308] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 69.666007][ T6308] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 69.666019][ T6308] [ 69.755020][ T6311] syzkaller0: entered promiscuous mode [ 69.756940][ T6311] syzkaller0: entered allmulticast mode [ 70.901242][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.904050][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.307180][ T5828] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 71.447151][ T5828] usb 5-1: device descriptor read/64, error -71 [ 71.487112][ T5827] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 71.649204][ T5827] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 71.652469][ T5827] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 0 [ 71.655599][ T5827] usb 7-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 71.658825][ T5827] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 71.672385][ T5827] usb 7-1: USB2VGA dongle found at address 2 [ 71.683415][ T5827] usb 7-1: Allocated 8 output buffers [ 71.707250][ T5828] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 71.850790][ T5828] usb 5-1: device descriptor read/64, error -71 [ 71.967460][ T5828] usb usb5-port1: attempt power cycle [ 72.317383][ T5828] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 72.338638][ T5828] usb 5-1: device descriptor read/8, error -71 [ 72.352910][ T6345] FAULT_INJECTION: forcing a failure. [ 72.352910][ T6345] name failslab, interval 1, probability 0, space 0, times 0 [ 72.358814][ T6345] CPU: 3 UID: 0 PID: 6345 Comm: syz.1.107 Not tainted syzkaller #0 PREEMPT(full) [ 72.358851][ T6345] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 72.358862][ T6345] Call Trace: [ 72.358868][ T6345] [ 72.358873][ T6345] dump_stack_lvl+0x100/0x190 [ 72.358892][ T6345] should_fail_ex.cold+0x5/0xa [ 72.358907][ T6345] should_failslab+0xc2/0x120 [ 72.358924][ T6345] __kmalloc_noprof+0xfc/0x820 [ 72.358939][ T6345] ? rcu_is_watching+0x12/0xc0 [ 72.358954][ T6345] ? tomoyo_realpath_from_path+0xb6/0x690 [ 72.358975][ T6345] tomoyo_realpath_from_path+0xb6/0x690 [ 72.358994][ T6345] tomoyo_path_number_perm+0x23c/0x580 [ 72.359009][ T6345] ? tomoyo_path_number_perm+0x22e/0x580 [ 72.359023][ T6345] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 72.359038][ T6345] ? get_pid_task+0x106/0x250 [ 72.359065][ T6345] ? find_held_lock+0x2b/0x80 [ 72.359079][ T6345] ? __fget_files+0x215/0x3d0 [ 72.359089][ T6345] ? hook_file_ioctl_common+0x140/0x440 [ 72.359104][ T6345] ? __fget_files+0x215/0x3d0 [ 72.359116][ T6345] ? __fget_files+0x21f/0x3d0 [ 72.359127][ T6345] security_file_ioctl_compat+0xd3/0x230 [ 72.359143][ T6345] __ia32_compat_sys_ioctl+0xc2/0x360 [ 72.359162][ T6345] __do_fast_syscall_32+0xe7/0x970 [ 72.359178][ T6345] ? lockdep_hardirqs_on+0x78/0x100 [ 72.359192][ T6345] do_fast_syscall_32+0x32/0x70 [ 72.359207][ T6345] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 72.359221][ T6345] RIP: 0023:0xf7f87fec [ 72.359234][ T6345] Code: Unable to access opcode bytes at 0xf7f87fc2. [ 72.359240][ T6345] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 72.359251][ T6345] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000004048aecb [ 72.359258][ T6345] RDX: 00000000800000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 72.359264][ T6345] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 72.359270][ T6345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 72.359276][ T6345] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 72.359289][ T6345] [ 72.359628][ T6345] ERROR: Out of memory at tomoyo_realpath_from_path. [ 72.497095][ T5762] Bluetooth: hci2: command 0x0406 tx timeout [ 72.577086][ T5828] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 72.597787][ T5828] usb 5-1: device descriptor read/8, error -71 [ 72.707577][ T5828] usb usb5-port1: unable to enumerate USB device [ 72.827664][ T6352] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 74.373413][ T6373] FAULT_INJECTION: forcing a failure. [ 74.373413][ T6373] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 74.384244][ T6373] CPU: 3 UID: 0 PID: 6373 Comm: syz.1.114 Not tainted syzkaller #0 PREEMPT(full) [ 74.384260][ T6373] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 74.384267][ T6373] Call Trace: [ 74.384271][ T6373] [ 74.384275][ T6373] dump_stack_lvl+0x100/0x190 [ 74.384315][ T6373] should_fail_ex.cold+0x5/0xa [ 74.384330][ T6373] _copy_from_user+0x2e/0xd0 [ 74.384351][ T6373] get_compat_msghdr+0xb3/0x480 [ 74.384370][ T6373] ? __pfx_get_compat_msghdr+0x10/0x10 [ 74.384392][ T6373] ___sys_sendmsg+0x1b6/0x1e0 [ 74.384405][ T6373] ? __pfx____sys_sendmsg+0x10/0x10 [ 74.384423][ T6373] ? find_held_lock+0x2b/0x80 [ 74.384446][ T6373] __sys_sendmsg+0x160/0x210 [ 74.384461][ T6373] ? __pfx___sys_sendmsg+0x10/0x10 [ 74.384480][ T6373] ? __pfx_ksys_write+0x10/0x10 [ 74.384494][ T6373] __do_fast_syscall_32+0xe7/0x970 [ 74.384509][ T6373] ? lockdep_hardirqs_on+0x78/0x100 [ 74.384523][ T6373] do_fast_syscall_32+0x32/0x70 [ 74.384538][ T6373] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 74.384553][ T6373] RIP: 0023:0xf7f87fec [ 74.384567][ T6373] Code: Unable to access opcode bytes at 0xf7f87fc2. [ 74.384571][ T6373] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 74.384582][ T6373] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300 [ 74.384589][ T6373] RDX: 0000000024000004 RSI: 0000000000000000 RDI: 0000000000000000 [ 74.384595][ T6373] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 74.384601][ T6373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 74.384607][ T6373] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 74.384619][ T6373] [ 74.494599][ T6380] netlink: 12 bytes leftover after parsing attributes in process `syz.1.119'. [ 74.907146][ T5841] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 75.068771][ T5841] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 75.071965][ T5841] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 0 [ 75.075009][ T5841] usb 8-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 75.078135][ T5841] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.089402][ T5841] usb 8-1: USB2VGA dongle found at address 3 [ 75.094378][ T5841] usb 8-1: Allocated 8 output buffers [ 75.657101][ T1355] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 75.907146][ T1355] usb 6-1: device descriptor read/64, error -71 [ 75.939437][ T6406] FAULT_INJECTION: forcing a failure. [ 75.939437][ T6406] name failslab, interval 1, probability 0, space 0, times 0 [ 75.943407][ T6406] CPU: 3 UID: 0 PID: 6406 Comm: syz.2.125 Not tainted syzkaller #0 PREEMPT(full) [ 75.943422][ T6406] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.943429][ T6406] Call Trace: [ 75.943433][ T6406] [ 75.943437][ T6406] dump_stack_lvl+0x100/0x190 [ 75.943456][ T6406] should_fail_ex.cold+0x5/0xa [ 75.943470][ T6406] should_failslab+0xc2/0x120 [ 75.943487][ T6406] kmem_cache_alloc_noprof+0x91/0x6a0 [ 75.943502][ T6406] ? __mutex_unlock_slowpath+0x35d/0x930 [ 75.943517][ T6406] ? do_getname+0x35/0x390 [ 75.943534][ T6406] do_getname+0x35/0x390 [ 75.943548][ T6406] user_path_at+0x26/0x60 [ 75.943566][ T6406] __ia32_sys_umount+0x109/0x190 [ 75.943580][ T6406] ? __pfx___ia32_sys_umount+0x10/0x10 [ 75.943608][ T6406] __do_fast_syscall_32+0xe7/0x970 [ 75.943623][ T6406] ? lockdep_hardirqs_on+0x78/0x100 [ 75.943637][ T6406] do_fast_syscall_32+0x32/0x70 [ 75.943651][ T6406] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 75.943666][ T6406] RIP: 0023:0xf7f14fec [ 75.943675][ T6406] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 75.943686][ T6406] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000034 [ 75.943696][ T6406] RAX: ffffffffffffffda RBX: 00000000800002c0 RCX: 0000000000000009 [ 75.943703][ T6406] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 75.943709][ T6406] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 75.943726][ T6406] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.943732][ T6406] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 75.943745][ T6406] [ 76.038151][ T6413] syzkaller0: entered promiscuous mode [ 76.040113][ T6413] syzkaller0: entered allmulticast mode [ 76.147166][ T1355] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 76.278188][ T1355] usb 6-1: device descriptor read/64, error -71 [ 76.389314][ T1355] usb usb6-port1: attempt power cycle [ 76.727201][ T1355] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 76.747544][ T1355] usb 6-1: device descriptor read/8, error -71 [ 76.987130][ T1355] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 77.008318][ T1355] usb 6-1: device descriptor read/8, error -71 [ 77.117584][ T1355] usb usb6-port1: unable to enumerate USB device [ 78.123071][ T42] audit: type=1326 audit(1785512466.509:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6446 comm="syz.0.136" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f94fec code=0x0 [ 78.194512][ T6450] FAULT_INJECTION: forcing a failure. [ 78.194512][ T6450] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 78.198744][ T6450] CPU: 3 UID: 0 PID: 6450 Comm: syz.3.137 Not tainted syzkaller #0 PREEMPT(full) [ 78.198773][ T6450] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.198781][ T6450] Call Trace: [ 78.198785][ T6450] [ 78.198790][ T6450] dump_stack_lvl+0x100/0x190 [ 78.198807][ T6450] should_fail_ex.cold+0x5/0xa [ 78.198820][ T6450] _copy_from_user+0x2e/0xd0 [ 78.198839][ T6450] move_addr_to_kernel+0x65/0x170 [ 78.198853][ T6450] __sys_bind+0x11d/0x260 [ 78.198866][ T6450] ? __pfx___sys_bind+0x10/0x10 [ 78.198877][ T6450] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 78.198898][ T6450] ? exit_to_user_mode_loop+0x166/0x6f0 [ 78.198910][ T6450] ? rcu_is_watching+0x12/0xc0 [ 78.198926][ T6450] __ia32_sys_bind+0x71/0xb0 [ 78.198937][ T6450] ? lockdep_hardirqs_on+0x78/0x100 [ 78.198950][ T6450] __do_fast_syscall_32+0xe7/0x970 [ 78.198965][ T6450] ? lockdep_hardirqs_on+0x78/0x100 [ 78.198979][ T6450] do_fast_syscall_32+0x32/0x70 [ 78.198994][ T6450] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 78.199009][ T6450] RIP: 0023:0xf709efec [ 78.199022][ T6450] Code: Unable to access opcode bytes at 0xf709efc2. [ 78.199027][ T6450] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000169 [ 78.199038][ T6450] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800001c0 [ 78.199044][ T6450] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 78.199050][ T6450] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 78.199056][ T6450] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 78.199062][ T6450] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 78.199075][ T6450] [ 79.337115][ T5828] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 79.529211][ T5828] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 79.534304][ T5828] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 0 [ 79.537588][ T5828] usb 5-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 79.540435][ T5828] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.551059][ T5828] usb 5-1: USB2VGA dongle found at address 7 [ 79.558044][ T5828] usb 5-1: Allocated 8 output buffers [ 79.616092][ T6476] serio: Serial port ttynull [ 79.877276][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 79.987279][ T1355] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 80.117157][ T1355] usb 6-1: device descriptor read/64, error -71 [ 80.149061][ T6488] binder_alloc: binder_alloc_mmap_handler: 6486 80ffc000-81000000 already mapped failed -16 [ 80.367125][ T1355] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 80.717215][ T1355] usb 6-1: device descriptor read/64, error -71 [ 80.827869][ T1355] usb usb6-port1: attempt power cycle [ 81.187145][ T1355] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 81.217547][ T1355] usb 6-1: device descriptor read/8, error -71 [ 81.467157][ T1355] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 81.487878][ T1355] usb 6-1: device descriptor read/8, error -71 [ 81.566052][ T10] cfg80211: failed to load regulatory.db [ 81.598084][ T1355] usb usb6-port1: unable to enumerate USB device [ 82.388111][ T6523] FAULT_INJECTION: forcing a failure. [ 82.388111][ T6523] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 82.392772][ T6523] CPU: 2 UID: 0 PID: 6523 Comm: syz.0.160 Not tainted syzkaller #0 PREEMPT(full) [ 82.392786][ T6523] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 82.392793][ T6523] Call Trace: [ 82.392798][ T6523] [ 82.392803][ T6523] dump_stack_lvl+0x100/0x190 [ 82.392821][ T6523] should_fail_ex.cold+0x5/0xa [ 82.392834][ T6523] _copy_from_user+0x2e/0xd0 [ 82.392853][ T6523] get_compat_msghdr+0xb3/0x480 [ 82.392871][ T6523] ? __pfx_get_compat_msghdr+0x10/0x10 [ 82.392889][ T6523] ? _kstrtoull+0x13c/0x1f0 [ 82.392901][ T6523] ? __pfx__kstrtoull+0x10/0x10 [ 82.392914][ T6523] ___sys_sendmsg+0x1b6/0x1e0 [ 82.392927][ T6523] ? __pfx____sys_sendmsg+0x10/0x10 [ 82.392938][ T6523] ? __lock_acquire+0x49f/0x1a40 [ 82.392971][ T6523] __sys_sendmmsg+0x309/0x440 [ 82.392987][ T6523] ? __pfx___sys_sendmmsg+0x10/0x10 [ 82.393002][ T6523] ? find_held_lock+0x2b/0x80 [ 82.393018][ T6523] ? __mutex_unlock_slowpath+0x35d/0x930 [ 82.393051][ T6523] ? fput+0x79/0x100 [ 82.393067][ T6523] ? ksys_write+0x1ac/0x250 [ 82.393079][ T6523] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 82.393099][ T6523] ? lockdep_hardirqs_on+0x78/0x100 [ 82.393118][ T6523] __do_fast_syscall_32+0xe7/0x970 [ 82.393137][ T6523] ? lockdep_hardirqs_on+0x78/0x100 [ 82.393157][ T6523] do_fast_syscall_32+0x32/0x70 [ 82.393177][ T6523] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 82.393197][ T6523] RIP: 0023:0xf7f94fec [ 82.393215][ T6523] Code: Unable to access opcode bytes at 0xf7f94fc2. [ 82.393222][ T6523] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 82.393237][ T6523] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000480 [ 82.393247][ T6523] RDX: 00000000000002e9 RSI: 0000000000000000 RDI: 0000000000000000 [ 82.393255][ T6523] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 82.393261][ T6523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 82.393267][ T6523] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 82.393280][ T6523] [ 83.406914][ T6550] netlink: 12 bytes leftover after parsing attributes in process `syz.0.169'. [ 84.257202][ T29] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 84.387103][ T29] usb 6-1: device descriptor read/64, error -71 [ 84.627134][ T29] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 84.767660][ T29] usb 6-1: device descriptor read/64, error -71 [ 84.878423][ T29] usb usb6-port1: attempt power cycle [ 85.227102][ T29] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 85.247846][ T29] usb 6-1: device descriptor read/8, error -71 [ 85.487193][ T29] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 85.511027][ T29] usb 6-1: device descriptor read/8, error -71 [ 85.516441][ T6576] netlink: 16 bytes leftover after parsing attributes in process `syz.0.177'. [ 85.527934][ T6581] syzkaller0: entered promiscuous mode [ 85.529625][ T6581] syzkaller0: entered allmulticast mode [ 85.629431][ T29] usb usb6-port1: unable to enumerate USB device [ 87.016632][ T6637] FAULT_INJECTION: forcing a failure. [ 87.016632][ T6637] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 87.022258][ T6637] CPU: 3 UID: 0 PID: 6637 Comm: syz.3.183 Not tainted syzkaller #0 PREEMPT(full) [ 87.022286][ T6637] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.022296][ T6637] Call Trace: [ 87.022302][ T6637] [ 87.022310][ T6637] dump_stack_lvl+0x100/0x190 [ 87.022338][ T6637] should_fail_ex.cold+0x5/0xa [ 87.022361][ T6637] _copy_from_user+0x2e/0xd0 [ 87.022389][ T6637] io_uring_setup+0xc0/0x160 [ 87.022408][ T6637] ? rcu_read_lock_any_held+0x6a/0xa0 [ 87.022431][ T6637] ? find_held_lock+0x2b/0x80 [ 87.022454][ T6637] ? __pfx_io_uring_setup+0x10/0x10 [ 87.022472][ T6637] ? ksys_write+0x190/0x250 [ 87.022499][ T6637] ? __mutex_unlock_slowpath+0x35d/0x930 [ 87.022532][ T6637] ? fput+0x79/0x100 [ 87.022550][ T6637] ? ksys_write+0x1ac/0x250 [ 87.022566][ T6637] ? __pfx_ksys_write+0x10/0x10 [ 87.022584][ T6637] __ia32_sys_io_uring_setup+0xc2/0x170 [ 87.022603][ T6637] __do_fast_syscall_32+0xe7/0x970 [ 87.022624][ T6637] ? lockdep_hardirqs_on+0x78/0x100 [ 87.022654][ T6637] do_fast_syscall_32+0x32/0x70 [ 87.022677][ T6637] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 87.022698][ T6637] RIP: 0023:0xf709efec [ 87.022718][ T6637] Code: Unable to access opcode bytes at 0xf709efc2. [ 87.022725][ T6637] RSP: 002b:00000000f548d43c EFLAGS: 00000286 ORIG_RAX: 00000000000001a9 [ 87.022742][ T6637] RAX: ffffffffffffffda RBX: 0000000000000e26 RCX: 0000000080000808 [ 87.022753][ T6637] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 87.022763][ T6637] RBP: 00000000f548d4fc R08: 0000000000000000 R09: 0000000000000000 [ 87.022772][ T6637] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.022782][ T6637] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 87.022803][ T6637] [ 87.607263][ T6658] netlink: 16 bytes leftover after parsing attributes in process `syz.2.190'. [ 88.357127][ T1492] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 88.487664][ T1492] usb 6-1: device descriptor read/64, error -71 [ 88.767115][ T1492] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 88.917142][ T1492] usb 6-1: device descriptor read/64, error -71 [ 89.027529][ T1492] usb usb6-port1: attempt power cycle [ 89.377200][ T1492] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 89.397819][ T1492] usb 6-1: device descriptor read/8, error -71 [ 89.422234][ T6723] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 89.427599][ T6723] CPU: 1 UID: 0 PID: 6723 Comm: syz.2.197 Not tainted syzkaller #0 PREEMPT(full) [ 89.427629][ T6723] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 89.427643][ T6723] Call Trace: [ 89.427649][ T6723] [ 89.427657][ T6723] dump_stack_lvl+0x100/0x190 [ 89.427699][ T6723] sysfs_warn_dup.cold+0x1c/0x28 [ 89.427729][ T6723] sysfs_create_dir_ns+0x24b/0x2b0 [ 89.427762][ T6723] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 89.427797][ T6723] ? find_held_lock+0x2b/0x80 [ 89.427825][ T6723] ? kobject_add_internal+0x25f/0x930 [ 89.427857][ T6723] ? kobject_add_internal+0x25f/0x930 [ 89.427889][ T6723] ? class_dir_child_ns_type+0xd/0x60 [ 89.427932][ T6723] kobject_add_internal+0x2c8/0x930 [ 89.427975][ T6723] kobject_add+0x16a/0x1e0 [ 89.428006][ T6723] ? __pfx_kobject_add+0x10/0x10 [ 89.428036][ T6723] ? get_device_parent+0x1b3/0x4c0 [ 89.428065][ T6723] ? kobject_put+0xb9/0x640 [ 89.428094][ T6723] ? device_add+0xc4d/0x1970 [ 89.428127][ T6723] device_add+0x294/0x1970 [ 89.428158][ T6723] ? lockdep_init_map_type+0x5c/0x250 [ 89.428177][ T6723] ? __pfx_device_add+0x10/0x10 [ 89.428206][ T6723] ? lockdep_init_map_type+0x5c/0x250 [ 89.428224][ T6723] ? __init_waitqueue_head+0xca/0x150 [ 89.428254][ T6723] tty_register_device_attr+0x388/0x7f0 [ 89.428285][ T6723] ? lockdep_init_map_type+0x5c/0x250 [ 89.428306][ T6723] ? __pfx_tty_register_device_attr+0x10/0x10 [ 89.428339][ T6723] ? tty_port_init+0x156/0x1c0 [ 89.428369][ T6723] gsm_activate_mux+0x155/0x2a0 [ 89.428399][ T6723] gsmld_ioctl+0xbbc/0x15c0 [ 89.428423][ T6723] ? __pfx_gsmld_ioctl+0x10/0x10 [ 89.428458][ T6723] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 89.428493][ T6723] ? __pfx_gsmld_ioctl+0x10/0x10 [ 89.428511][ T6723] tty_compat_ioctl+0x396/0x420 [ 89.428537][ T6723] ? __pfx_tty_compat_ioctl+0x10/0x10 [ 89.428564][ T6723] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 89.428599][ T6723] __do_fast_syscall_32+0xe7/0x970 [ 89.428630][ T6723] do_fast_syscall_32+0x32/0x70 [ 89.428660][ T6723] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 89.428701][ T6723] RIP: 0023:0xf7f14fec [ 89.428725][ T6723] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 89.428733][ T6723] RSP: 002b:00000000f539450c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 89.428753][ T6723] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000404c4701 [ 89.428766][ T6723] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 89.428778][ T6723] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 89.428794][ T6723] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 89.428806][ T6723] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 89.428830][ T6723] [ 89.428853][ T6723] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 89.656544][ T6723] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 89.658729][ T6723] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 89.669747][ T6723] vhci_hcd vhci_hcd.0: Device attached [ 89.727215][ T1492] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 89.749069][ T1492] usb 6-1: device descriptor read/8, error -71 [ 89.842223][ T6728] FAULT_INJECTION: forcing a failure. [ 89.842223][ T6728] name failslab, interval 1, probability 0, space 0, times 0 [ 89.846123][ T6728] CPU: 3 UID: 0 PID: 6728 Comm: syz.0.198 Not tainted syzkaller #0 PREEMPT(full) [ 89.846137][ T6728] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 89.846144][ T6728] Call Trace: [ 89.846149][ T6728] [ 89.846153][ T6728] dump_stack_lvl+0x100/0x190 [ 89.846171][ T6728] should_fail_ex.cold+0x5/0xa [ 89.846184][ T6728] should_failslab+0xc2/0x120 [ 89.846203][ T6728] __kmalloc_noprof+0xfc/0x820 [ 89.846217][ T6728] ? rcu_is_watching+0x12/0xc0 [ 89.846232][ T6728] ? tomoyo_realpath_from_path+0xb6/0x690 [ 89.846256][ T6728] tomoyo_realpath_from_path+0xb6/0x690 [ 89.846275][ T6728] tomoyo_path_number_perm+0x23c/0x580 [ 89.846291][ T6728] ? tomoyo_path_number_perm+0x22e/0x580 [ 89.846306][ T6728] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 89.846320][ T6728] ? get_pid_task+0x106/0x250 [ 89.846348][ T6728] ? find_held_lock+0x2b/0x80 [ 89.846363][ T6728] ? __fget_files+0x215/0x3d0 [ 89.846374][ T6728] ? hook_file_ioctl_common+0x140/0x440 [ 89.846388][ T6728] ? __fget_files+0x215/0x3d0 [ 89.846401][ T6728] ? __fget_files+0x21f/0x3d0 [ 89.846413][ T6728] security_file_ioctl_compat+0xd3/0x230 [ 89.846430][ T6728] __ia32_compat_sys_ioctl+0xc2/0x360 [ 89.846449][ T6728] __do_fast_syscall_32+0xe7/0x970 [ 89.846465][ T6728] ? lockdep_hardirqs_on+0x78/0x100 [ 89.846480][ T6728] do_fast_syscall_32+0x32/0x70 [ 89.846495][ T6728] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 89.846510][ T6728] RIP: 0023:0xf7f94fec [ 89.846525][ T6728] Code: Unable to access opcode bytes at 0xf7f94fc2. [ 89.846529][ T6728] RSP: 002b:00000000f543550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 89.846540][ T6728] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000000005423 [ 89.846547][ T6728] RDX: 0000000080000140 RSI: 0000000000000000 RDI: 0000000000000000 [ 89.846553][ T6728] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 89.846559][ T6728] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 89.846565][ T6728] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 89.846578][ T6728] [ 89.846582][ T6728] ERROR: Out of memory at tomoyo_realpath_from_path. [ 89.867470][ T1492] usb usb6-port1: unable to enumerate USB device [ 89.965155][ T6729] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty65' [ 89.968170][ T29] usb 42-1: SetAddress Request (2) to port 0 [ 89.970299][ T29] usb 42-1: new SuperSpeed USB device number 2 using vhci_hcd [ 89.972889][ T6729] CPU: 1 UID: 0 PID: 6729 Comm: syz.0.198 Not tainted syzkaller #0 PREEMPT(full) [ 89.972904][ T6729] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 89.972911][ T6729] Call Trace: [ 89.972916][ T6729] [ 89.972920][ T6729] dump_stack_lvl+0x100/0x190 [ 89.972938][ T6729] sysfs_warn_dup.cold+0x1c/0x28 [ 89.972955][ T6729] sysfs_create_dir_ns+0x24b/0x2b0 [ 89.972973][ T6729] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 89.972989][ T6729] ? find_held_lock+0x2b/0x80 [ 89.973003][ T6729] ? kobject_add_internal+0x25f/0x930 [ 89.973021][ T6729] ? kobject_add_internal+0x25f/0x930 [ 89.973044][ T6729] ? class_dir_child_ns_type+0xd/0x60 [ 89.973064][ T6729] kobject_add_internal+0x2c8/0x930 [ 89.973083][ T6729] kobject_add+0x16a/0x1e0 [ 89.973100][ T6729] ? __pfx_kobject_add+0x10/0x10 [ 89.973118][ T6729] ? get_device_parent+0x1b3/0x4c0 [ 89.973135][ T6729] ? kobject_put+0xb9/0x640 [ 89.973152][ T6729] ? device_add+0xc4d/0x1970 [ 89.973170][ T6729] device_add+0x294/0x1970 [ 89.973187][ T6729] ? lockdep_init_map_type+0x5c/0x250 [ 89.973198][ T6729] ? __pfx_device_add+0x10/0x10 [ 89.973215][ T6729] ? lockdep_init_map_type+0x5c/0x250 [ 89.973225][ T6729] ? __init_waitqueue_head+0xca/0x150 [ 89.973241][ T6729] tty_register_device_attr+0x388/0x7f0 [ 89.973258][ T6729] ? lockdep_init_map_type+0x5c/0x250 [ 89.973268][ T6729] ? __pfx_tty_register_device_attr+0x10/0x10 [ 89.973287][ T6729] ? tty_port_init+0x156/0x1c0 [ 89.973304][ T6729] gsm_activate_mux+0x155/0x2a0 [ 89.973321][ T6729] gsmld_ioctl+0xbbc/0x15c0 [ 89.973334][ T6729] ? __pfx_gsmld_ioctl+0x10/0x10 [ 89.973353][ T6729] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 89.973373][ T6729] ? __pfx_gsmld_ioctl+0x10/0x10 [ 89.973382][ T6729] tty_compat_ioctl+0x396/0x420 [ 89.973397][ T6729] ? __pfx_tty_compat_ioctl+0x10/0x10 [ 89.973413][ T6729] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 89.973431][ T6729] __do_fast_syscall_32+0xe7/0x970 [ 89.973449][ T6729] do_fast_syscall_32+0x32/0x70 [ 89.973463][ T6729] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 89.973478][ T6729] RIP: 0023:0xf7f94fec [ 89.973492][ T6729] Code: Unable to access opcode bytes at 0xf7f94fc2. [ 89.973497][ T6729] RSP: 002b:00000000f541450c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 89.973508][ T6729] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000404c4701 [ 89.973514][ T6729] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 89.973520][ T6729] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 89.973527][ T6729] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 89.973534][ T6729] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 89.973547][ T6729] [ 89.973560][ T6729] kobject: kobject_add_internal failed for gsmtty65 with -EEXIST, don't try to register things with the same name in the same directory. [ 90.071586][ T6726] vhci_hcd: connection reset by peer [ 90.083499][ T5617] vhci_hcd vhci_hcd.2: stop threads [ 90.086033][ T5617] vhci_hcd vhci_hcd.2: release socket [ 90.091194][ T5617] vhci_hcd vhci_hcd.2: disconnect device [ 91.826819][ T6753] netlink: 16 bytes leftover after parsing attributes in process `syz.0.204'. [ 92.602204][ T6777] macsec1: entered promiscuous mode [ 92.737492][ T6463] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 92.936688][ T6463] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 93.710645][ T6463] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 0 [ 93.718937][ T6463] usb 6-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 93.721758][ T6463] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.745443][ T6463] usb 6-1: USB2VGA dongle found at address 18 [ 93.748885][ T6463] usb 6-1: Allocated 8 output buffers [ 95.147262][ T29] usb 42-1: device descriptor read/8, error -110 [ 95.548101][ T29] usb usb42-port1: attempt power cycle [ 95.900303][ T6830] netlink: 16 bytes leftover after parsing attributes in process `syz.3.219'. [ 96.168030][ T29] usb usb42-port1: unable to enumerate USB device [ 98.464459][ T6917] netlink: 16 bytes leftover after parsing attributes in process `syz.0.230'. [ 102.172791][ T7001] netlink: 16 bytes leftover after parsing attributes in process `syz.3.239'. [ 102.855578][ T7035] FAULT_INJECTION: forcing a failure. [ 102.855578][ T7035] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 102.861140][ T7035] CPU: 3 UID: 0 PID: 7035 Comm: syz.0.245 Not tainted syzkaller #0 PREEMPT(full) [ 102.861162][ T7035] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.861174][ T7035] Call Trace: [ 102.861180][ T7035] [ 102.861188][ T7035] dump_stack_lvl+0x100/0x190 [ 102.861216][ T7035] should_fail_ex.cold+0x5/0xa [ 102.861238][ T7035] _copy_from_user+0x2e/0xd0 [ 102.861268][ T7035] get_compat_msghdr+0xb3/0x480 [ 102.861298][ T7035] ? __pfx_get_compat_msghdr+0x10/0x10 [ 102.861334][ T7035] ___sys_sendmsg+0x1b6/0x1e0 [ 102.861356][ T7035] ? __pfx____sys_sendmsg+0x10/0x10 [ 102.861387][ T7035] ? find_held_lock+0x2b/0x80 [ 102.861424][ T7035] __sys_sendmsg+0x160/0x210 [ 102.861450][ T7035] ? __pfx___sys_sendmsg+0x10/0x10 [ 102.861481][ T7035] ? __pfx_ksys_write+0x10/0x10 [ 102.861504][ T7035] __do_fast_syscall_32+0xe7/0x970 [ 102.861530][ T7035] ? lockdep_hardirqs_on+0x78/0x100 [ 102.861552][ T7035] do_fast_syscall_32+0x32/0x70 [ 102.861576][ T7035] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 102.861599][ T7035] RIP: 0023:0xf7f94fec [ 102.861618][ T7035] Code: Unable to access opcode bytes at 0xf7f94fc2. [ 102.861626][ T7035] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 102.861643][ T7035] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 102.861653][ T7035] RDX: 00000000020440d0 RSI: 0000000000000000 RDI: 0000000000000000 [ 102.861665][ T7035] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 102.861674][ T7035] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.861683][ T7035] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 102.861701][ T7035] [ 105.337716][ T7055] netlink: 16 bytes leftover after parsing attributes in process `syz.1.251'. [ 105.923372][ T7082] netlink: 16 bytes leftover after parsing attributes in process `syz.3.252'. [ 107.870585][ T7134] netfs: Duplicate cookie detected [ 107.872672][ T7134] netfs: O-cookie c=00000003 [fl=4008 na=0 nA=0 s=-] [ 107.874762][ T7134] netfs: O-cookie V=00000002 [9p,syz,] [ 107.876641][ T7134] netfs: O-key=[8] '5738ac0400000000' [ 107.878513][ T7134] netfs: N-cookie c=00000004 [fl=8 na=0 nA=0 s=-] [ 107.880536][ T7134] netfs: N-cookie V=00000002 [9p,syz,] [ 107.882269][ T7134] netfs: N-key=[8] '5738ac0400000000' [ 108.567427][ T7137] netlink: 16 bytes leftover after parsing attributes in process `syz.3.262'. [ 109.011419][ T7168] netlink: 40 bytes leftover after parsing attributes in process `syz.0.264'. [ 109.130269][ T7172] netlink: 16 bytes leftover after parsing attributes in process `syz.3.265'. [ 111.237840][ T7219] netlink: 16 bytes leftover after parsing attributes in process `syz.3.273'. [ 111.248426][ T7222] netfs: Duplicate cookie detected [ 111.250088][ T7222] netfs: O-cookie c=00000005 [fl=4008 na=0 nA=0 s=-] [ 111.252330][ T7222] netfs: O-cookie V=00000003 [9p,syz,] [ 111.254115][ T7222] netfs: O-key=[8] '5738ac0400000000' [ 111.255833][ T7222] netfs: N-cookie c=00000006 [fl=8 na=0 nA=0 s=-] [ 111.258023][ T7222] netfs: N-cookie V=00000003 [9p,syz,] [ 111.260000][ T7222] netfs: N-key=[8] '5738ac0400000000' [ 111.731544][ T7245] netlink: 16 bytes leftover after parsing attributes in process `syz.0.279'. [ 112.541814][ T7273] netfs: Duplicate cookie detected [ 112.544145][ T7273] netfs: O-cookie c=00000007 [fl=4008 na=0 nA=0 s=-] [ 112.547186][ T7273] netfs: O-cookie V=00000004 [9p,syz,] [ 112.549631][ T7273] netfs: O-key=[8] '5738ac0400000000' [ 112.551919][ T7273] netfs: N-cookie c=00000008 [fl=8 na=0 nA=0 s=-] [ 112.554575][ T7273] netfs: N-cookie V=00000004 [9p,syz,] [ 112.556855][ T7273] netfs: N-key=[8] '5738ac0400000000' [ 113.492896][ T7308] netlink: 16 bytes leftover after parsing attributes in process `syz.1.292'. [ 114.630180][ T7334] netfs: Duplicate cookie detected [ 114.631969][ T7334] netfs: O-cookie c=00000009 [fl=4008 na=0 nA=0 s=-] [ 114.634299][ T7334] netfs: O-cookie V=00000005 [9p,syz,] [ 114.636173][ T7334] netfs: O-key=[8] '5738ac0400000000' [ 114.638009][ T7334] netfs: N-cookie c=0000000a [fl=8 na=0 nA=0 s=-] [ 114.640158][ T7334] netfs: N-cookie V=00000005 [9p,syz,] [ 114.641968][ T7334] netfs: N-key=[8] '5738ac0400000000' [ 116.139920][ T7379] netlink: 16 bytes leftover after parsing attributes in process `syz.3.303'. [ 121.033986][ T7474] netlink: 16 bytes leftover after parsing attributes in process `syz.1.320'. [ 121.732274][ T7501] netlink: 16 bytes leftover after parsing attributes in process `syz.3.323'. [ 123.613189][ T42] audit: type=1807 audit(1785512511.999:3): UNKNOWN=„ res=0 [ 123.613339][ T7557] ima: policy update failed [ 123.615608][ T42] audit: type=1802 audit(1785512511.999:4): pid=7558 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.1.333" res=0 errno=0 [ 123.622637][ T42] audit: type=1802 audit(1785512512.009:5): pid=7557 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.1.333" res=0 errno=0 [ 124.651491][ T7581] netlink: 16 bytes leftover after parsing attributes in process `syz.1.336'. [ 126.960079][ T7623] IPv6: NLM_F_CREATE should be specified when creating new route [ 126.962726][ T7623] IPv6: Can't replace route, no match found [ 126.966302][ T7623] mmap: syz.1.347 (7623) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 128.864673][ T7679] FAULT_INJECTION: forcing a failure. [ 128.864673][ T7679] name failslab, interval 1, probability 0, space 0, times 0 [ 128.868980][ T7679] CPU: 0 UID: 0 PID: 7679 Comm: syz.2.352 Not tainted syzkaller #0 PREEMPT(full) [ 128.868996][ T7679] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 128.869002][ T7679] Call Trace: [ 128.869007][ T7679] [ 128.869011][ T7679] dump_stack_lvl+0x100/0x190 [ 128.869043][ T7679] should_fail_ex.cold+0x5/0xa [ 128.869057][ T7679] should_failslab+0xc2/0x120 [ 128.869074][ T7679] __kmalloc_noprof+0xfc/0x820 [ 128.869088][ T7679] ? rcu_is_watching+0x12/0xc0 [ 128.869103][ T7679] ? tomoyo_realpath_from_path+0xb6/0x690 [ 128.869123][ T7679] tomoyo_realpath_from_path+0xb6/0x690 [ 128.869144][ T7679] tomoyo_path_number_perm+0x23c/0x580 [ 128.869171][ T7679] ? tomoyo_path_number_perm+0x22e/0x580 [ 128.869186][ T7679] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 128.869201][ T7679] ? get_pid_task+0x106/0x250 [ 128.869237][ T7679] ? find_held_lock+0x2b/0x80 [ 128.869253][ T7679] ? __fget_files+0x215/0x3d0 [ 128.869263][ T7679] ? hook_file_ioctl_common+0x140/0x440 [ 128.869278][ T7679] ? __fget_files+0x215/0x3d0 [ 128.869290][ T7679] ? __fget_files+0x21f/0x3d0 [ 128.869302][ T7679] security_file_ioctl_compat+0xd3/0x230 [ 128.869318][ T7679] __ia32_compat_sys_ioctl+0xc2/0x360 [ 128.869337][ T7679] __do_fast_syscall_32+0xe7/0x970 [ 128.869352][ T7679] ? lockdep_hardirqs_on+0x78/0x100 [ 128.869379][ T7679] do_fast_syscall_32+0x32/0x70 [ 128.869398][ T7679] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 128.869413][ T7679] RIP: 0023:0xf7f14fec [ 128.869422][ T7679] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 128.869433][ T7679] RSP: 002b:00000000f53b550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 128.869444][ T7679] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0045003 [ 128.869451][ T7679] RDX: 0000000080000140 RSI: 0000000000000000 RDI: 0000000000000000 [ 128.869457][ T7679] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 128.869463][ T7679] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 128.869469][ T7679] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 128.869482][ T7679] [ 128.869526][ T7679] ERROR: Out of memory at tomoyo_realpath_from_path. [ 130.167868][ T7698] netlink: 8 bytes leftover after parsing attributes in process `syz.0.361'. [ 130.185132][ T7698] netlink: 8 bytes leftover after parsing attributes in process `syz.0.361'. [ 130.191754][ T7698] netlink: 8 bytes leftover after parsing attributes in process `syz.0.361'. [ 130.202265][ T7698] netlink: 8 bytes leftover after parsing attributes in process `syz.0.361'. [ 130.225592][ T7700] FAULT_INJECTION: forcing a failure. [ 130.225592][ T7700] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 130.229795][ T7700] CPU: 1 UID: 0 PID: 7700 Comm: syz.1.360 Not tainted syzkaller #0 PREEMPT(full) [ 130.229823][ T7700] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 130.229830][ T7700] Call Trace: [ 130.229835][ T7700] [ 130.229839][ T7700] dump_stack_lvl+0x100/0x190 [ 130.229857][ T7700] should_fail_ex.cold+0x5/0xa [ 130.229870][ T7700] _copy_from_user+0x2e/0xd0 [ 130.229889][ T7700] do_handle_open+0xeb/0xf20 [ 130.229905][ T7700] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 130.229921][ T7700] ? __pfx_do_handle_open+0x10/0x10 [ 130.229936][ T7700] ? fput+0x79/0x100 [ 130.229950][ T7700] ? exit_to_user_mode_loop+0x166/0x6f0 [ 130.229962][ T7700] ? rcu_is_watching+0x12/0xc0 [ 130.229977][ T7700] ? __do_fast_syscall_32+0xe7/0x970 [ 130.229992][ T7700] __do_fast_syscall_32+0xe7/0x970 [ 130.230006][ T7700] ? lockdep_hardirqs_on+0x78/0x100 [ 130.230020][ T7700] do_fast_syscall_32+0x32/0x70 [ 130.230035][ T7700] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 130.230050][ T7700] RIP: 0023:0xf7f87fec [ 130.230063][ T7700] Code: Unable to access opcode bytes at 0xf7f87fc2. [ 130.230068][ T7700] RSP: 002b:00000000f540450c EFLAGS: 00000292 ORIG_RAX: 0000000000000156 [ 130.230078][ T7700] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080000140 [ 130.230085][ T7700] RDX: 00000000002241c2 RSI: 0000000000000000 RDI: 0000000000000000 [ 130.230091][ T7700] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 130.230097][ T7700] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 130.230105][ T7700] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 130.230120][ T7700] [ 131.048803][ T7714] Cache volume key already in use (9p,syz,) [ 132.339181][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.341216][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.540552][ T7756] netlink: 16 bytes leftover after parsing attributes in process `syz.3.372'. [ 136.956059][ T7867] FAULT_INJECTION: forcing a failure. [ 136.956059][ T7867] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 136.960254][ T7867] CPU: 3 UID: 0 PID: 7867 Comm: syz.3.387 Not tainted syzkaller #0 PREEMPT(full) [ 136.960270][ T7867] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 136.960277][ T7867] Call Trace: [ 136.960281][ T7867] [ 136.960285][ T7867] dump_stack_lvl+0x100/0x190 [ 136.960304][ T7867] should_fail_ex.cold+0x5/0xa [ 136.960317][ T7867] _copy_from_iter+0x1f4/0x1690 [ 136.960351][ T7867] ? __lock_acquire+0x49f/0x1a40 [ 136.960370][ T7867] ? __pfx__copy_from_iter+0x10/0x10 [ 136.960388][ T7867] ? _parse_integer_limit+0x1ac/0x220 [ 136.960405][ T7867] tun_get_user+0x3ba/0x3c20 [ 136.960427][ T7867] ? __pfx_tun_get_user+0x10/0x10 [ 136.960440][ T7867] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 136.960457][ T7867] ? find_held_lock+0x2b/0x80 [ 136.960470][ T7867] ? tun_get+0x191/0x370 [ 136.960480][ T7867] ? tun_get+0x191/0x370 [ 136.960494][ T7867] tun_chr_write_iter+0xdc/0x200 [ 136.960508][ T7867] vfs_write+0x6ac/0x1050 [ 136.960520][ T7867] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 136.960533][ T7867] ? __pfx_vfs_write+0x10/0x10 [ 136.960542][ T7867] ? find_held_lock+0x2b/0x80 [ 136.960563][ T7867] ksys_write+0x12a/0x250 [ 136.960573][ T7867] ? __pfx_ksys_write+0x10/0x10 [ 136.960583][ T7867] ? ksys_write+0x1ac/0x250 [ 136.960592][ T7867] ? __pfx_ksys_write+0x10/0x10 [ 136.960605][ T7867] __do_fast_syscall_32+0xe7/0x970 [ 136.960621][ T7867] ? lockdep_hardirqs_on+0x78/0x100 [ 136.960635][ T7867] do_fast_syscall_32+0x32/0x70 [ 136.960650][ T7867] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 136.960664][ T7867] RIP: 0023:0xf709efec [ 136.960677][ T7867] Code: Unable to access opcode bytes at 0xf709efc2. [ 136.960682][ T7867] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 136.960693][ T7867] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000280 [ 136.960700][ T7867] RDX: 000000000000ffdd RSI: 0000000000000000 RDI: 0000000000000000 [ 136.960706][ T7867] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 136.960712][ T7867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 136.960718][ T7867] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 136.960730][ T7867] [ 140.562046][ T7915] FAULT_INJECTION: forcing a failure. [ 140.562046][ T7915] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 140.566133][ T7915] CPU: 1 UID: 0 PID: 7915 Comm: syz.1.400 Not tainted syzkaller #0 PREEMPT(full) [ 140.566148][ T7915] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 140.566155][ T7915] Call Trace: [ 140.566160][ T7915] [ 140.566164][ T7915] dump_stack_lvl+0x100/0x190 [ 140.566182][ T7915] should_fail_ex.cold+0x5/0xa [ 140.566196][ T7915] _copy_to_user+0x32/0xd0 [ 140.566216][ T7915] simple_read_from_buffer+0xcb/0x170 [ 140.566236][ T7915] proc_fail_nth_read+0x1af/0x230 [ 140.566252][ T7915] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 140.566268][ T7915] ? rw_verify_area+0xce/0x6d0 [ 140.566285][ T7915] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 140.566303][ T7915] vfs_read+0x1e4/0xb40 [ 140.566316][ T7915] ? __pfx_vfs_read+0x10/0x10 [ 140.566324][ T7915] ? find_held_lock+0x2b/0x80 [ 140.566339][ T7915] ? __fget_files+0x215/0x3d0 [ 140.566352][ T7915] ? __fget_files+0x21f/0x3d0 [ 140.566365][ T7915] ksys_read+0x12a/0x250 [ 140.566375][ T7915] ? __pfx_ksys_read+0x10/0x10 [ 140.566389][ T7915] do_int80_emulation+0x14b/0x720 [ 140.566406][ T7915] asm_int80_emulation+0x1a/0x20 [ 140.566417][ T7915] RIP: 0023:0xf71873eb [ 140.566426][ T7915] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 140.566436][ T7915] RSP: 002b:00000000f54464bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 140.566447][ T7915] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f54465d0 [ 140.566454][ T7915] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 140.566460][ T7915] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 140.566465][ T7915] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 140.566471][ T7915] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 140.566485][ T7915] [ 141.143661][ T7921] netlink: 4 bytes leftover after parsing attributes in process `syz.2.397'. [ 141.147769][ T7921] netlink: 'syz.2.397': attribute type 2 has an invalid length. [ 141.150216][ T7921] netlink: 8 bytes leftover after parsing attributes in process `syz.2.397'. [ 141.158322][ T7921] : entered promiscuous mode [ 141.708657][ T7947] FAULT_INJECTION: forcing a failure. [ 141.708657][ T7947] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 141.712704][ T7947] CPU: 0 UID: 0 PID: 7947 Comm: syz.2.410 Not tainted syzkaller #0 PREEMPT(full) [ 141.712718][ T7947] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 141.712725][ T7947] Call Trace: [ 141.712729][ T7947] [ 141.712734][ T7947] dump_stack_lvl+0x100/0x190 [ 141.712751][ T7947] should_fail_ex.cold+0x5/0xa [ 141.712764][ T7947] _copy_to_user+0x32/0xd0 [ 141.712788][ T7947] simple_read_from_buffer+0xcb/0x170 [ 141.712810][ T7947] proc_fail_nth_read+0x1af/0x230 [ 141.712826][ T7947] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 141.712842][ T7947] ? rw_verify_area+0xce/0x6d0 [ 141.712859][ T7947] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 141.712874][ T7947] vfs_read+0x1e4/0xb40 [ 141.712886][ T7947] ? __pfx_vfs_read+0x10/0x10 [ 141.712895][ T7947] ? find_held_lock+0x2b/0x80 [ 141.712910][ T7947] ? __fget_files+0x215/0x3d0 [ 141.712923][ T7947] ? __fget_files+0x21f/0x3d0 [ 141.712937][ T7947] ksys_read+0x12a/0x250 [ 141.712947][ T7947] ? __pfx_ksys_read+0x10/0x10 [ 141.712961][ T7947] do_int80_emulation+0x14b/0x720 [ 141.712978][ T7947] asm_int80_emulation+0x1a/0x20 [ 141.712990][ T7947] RIP: 0023:0xf71173eb [ 141.713000][ T7947] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 141.713010][ T7947] RSP: 002b:00000000f53d64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 141.713021][ T7947] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53d65d0 [ 141.713028][ T7947] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 141.713034][ T7947] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 141.713041][ T7947] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 141.713047][ T7947] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 141.713060][ T7947] [ 143.789354][ T7968] smpboot: CPU 1 is now offline [ 143.818775][ T7968] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 150.963189][ T8065] netlink: 24 bytes leftover after parsing attributes in process `syz.0.442'. [ 152.858321][ T8119] netfs: Duplicate cookie detected [ 152.860059][ T8119] netfs: O-cookie c=00000013 [fl=4008 na=0 nA=0 s=-] [ 152.862135][ T8119] netfs: O-cookie V=0000000e [9p,syz,] [ 152.863870][ T8119] netfs: O-key=[8] '5738ac0400000000' [ 152.865549][ T8119] netfs: N-cookie c=00000014 [fl=8 na=0 nA=0 s=-] [ 152.867650][ T8119] netfs: N-cookie V=0000000e [9p,syz,] [ 152.869408][ T8119] netfs: N-key=[8] '5738ac0400000000' [ 153.148159][ T42] audit: type=1326 audit(1785512541.539:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8121 comm="syz.0.450" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f94fec code=0x0 [ 153.364747][ T8125] netlink: 24 bytes leftover after parsing attributes in process `syz.0.450'. [ 155.387155][ T5760] Bluetooth: hci3: command 0x0405 tx timeout [ 158.119439][ T8218] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 158.123077][ T8218] CPU: 2 UID: 0 PID: 8218 Comm: syz.2.461 Not tainted syzkaller #0 PREEMPT(full) [ 158.123103][ T8218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 158.123116][ T8218] Call Trace: [ 158.123124][ T8218] [ 158.123132][ T8218] dump_stack_lvl+0x100/0x190 [ 158.123164][ T8218] sysfs_warn_dup.cold+0x1c/0x28 [ 158.123197][ T8218] sysfs_create_dir_ns+0x24b/0x2b0 [ 158.123227][ T8218] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 158.123255][ T8218] ? find_held_lock+0x2b/0x80 [ 158.123279][ T8218] ? kobject_add_internal+0x25f/0x930 [ 158.123307][ T8218] ? kobject_add_internal+0x25f/0x930 [ 158.123337][ T8218] ? class_dir_child_ns_type+0xd/0x60 [ 158.123371][ T8218] kobject_add_internal+0x2c8/0x930 [ 158.123407][ T8218] kobject_add+0x16a/0x1e0 [ 158.123433][ T8218] ? __pfx_kobject_add+0x10/0x10 [ 158.123461][ T8218] ? get_device_parent+0x1b3/0x4c0 [ 158.123488][ T8218] ? kobject_put+0xb9/0x640 [ 158.123521][ T8218] device_add+0x294/0x1970 [ 158.123551][ T8218] ? lockdep_init_map_type+0x5c/0x250 [ 158.123570][ T8218] ? __pfx_device_add+0x10/0x10 [ 158.123600][ T8218] ? lockdep_init_map_type+0x5c/0x250 [ 158.123620][ T8218] ? __init_waitqueue_head+0xca/0x150 [ 158.123648][ T8218] tty_register_device_attr+0x388/0x7f0 [ 158.123676][ T8218] ? lockdep_init_map_type+0x5c/0x250 [ 158.123695][ T8218] ? __pfx_tty_register_device_attr+0x10/0x10 [ 158.123727][ T8218] ? tty_port_init+0x156/0x1c0 [ 158.123757][ T8218] gsm_activate_mux+0x155/0x2a0 [ 158.123792][ T8218] gsmld_ioctl+0xbbc/0x15c0 [ 158.123818][ T8218] ? __pfx_gsmld_ioctl+0x10/0x10 [ 158.123855][ T8218] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 158.123888][ T8218] ? __pfx_gsmld_ioctl+0x10/0x10 [ 158.123904][ T8218] tty_compat_ioctl+0x396/0x420 [ 158.123930][ T8218] ? __pfx_tty_compat_ioctl+0x10/0x10 [ 158.123956][ T8218] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 158.123987][ T8218] __do_fast_syscall_32+0xe7/0x970 [ 158.124017][ T8218] do_fast_syscall_32+0x32/0x70 [ 158.124042][ T8218] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 158.124066][ T8218] RIP: 0023:0xf7f14fec [ 158.124088][ T8218] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 158.124096][ T8218] RSP: 002b:00000000f53b550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 158.124117][ T8218] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000404c4701 [ 158.124130][ T8218] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 158.124139][ T8218] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 158.124150][ T8218] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 158.124160][ T8218] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 158.124183][ T8218] [ 158.124204][ T8218] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 158.271290][ T8217] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(9) [ 158.273405][ T8217] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 158.277590][ T8217] vhci_hcd vhci_hcd.0: Device attached [ 158.548193][ T29] usb 42-1: SetAddress Request (6) to port 0 [ 158.550383][ T29] usb 42-1: new SuperSpeed USB device number 6 using vhci_hcd [ 158.662149][ T8221] vhci_hcd: connection reset by peer [ 158.665165][ T13] vhci_hcd vhci_hcd.2: stop threads [ 158.666859][ T13] vhci_hcd vhci_hcd.2: release socket [ 158.668660][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 162.740115][ T5760] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 162.749794][ T5760] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 162.755142][ T5760] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 162.758992][ T5760] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 162.762506][ T5760] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 163.127320][ T8252] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.129790][ T8252] bridge0: port 1(bridge_slave_0) entered disabled state [ 163.132133][ T8252] bridge_slave_0: entered allmulticast mode [ 163.134743][ T8252] bridge_slave_0: entered promiscuous mode [ 163.139363][ T8252] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.141794][ T8252] bridge0: port 2(bridge_slave_1) entered disabled state [ 163.144121][ T8252] bridge_slave_1: entered allmulticast mode [ 163.146775][ T8252] bridge_slave_1: entered promiscuous mode [ 163.162316][ T8252] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 163.166668][ T8252] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 163.181470][ T8252] team0: Port device team_slave_0 added [ 163.184719][ T8252] team0: Port device team_slave_1 added [ 163.197990][ T8252] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 163.200115][ T8252] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 163.207922][ T8252] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 163.212194][ T8252] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 163.214339][ T8252] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 163.222292][ T8252] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 163.244301][ T8252] hsr_slave_0: entered promiscuous mode [ 163.246510][ T8252] hsr_slave_1: entered promiscuous mode [ 163.248994][ T8252] debugfs: 'hsr0' already exists in 'hsr' [ 163.250776][ T8252] Cannot create hsr debugfs directory [ 163.346941][ T8252] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 163.351948][ T8252] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 163.354787][ T8252] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 163.359278][ T8252] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 163.362113][ T8252] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 163.366977][ T8252] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 163.369873][ T8252] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 163.373649][ T8252] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 163.399035][ T8252] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.401862][ T8252] bridge0: port 2(bridge_slave_1) entered forwarding state [ 163.405397][ T8252] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.408498][ T8252] bridge0: port 1(bridge_slave_0) entered forwarding state [ 163.462380][ T8252] 8021q: adding VLAN 0 to HW filter on device bond0 [ 163.475586][ T1164] bridge0: port 1(bridge_slave_0) entered disabled state [ 163.479330][ T1164] bridge0: port 2(bridge_slave_1) entered disabled state [ 163.492513][ T8252] 8021q: adding VLAN 0 to HW filter on device team0 [ 163.500515][ T1164] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.502672][ T1164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 163.509808][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.513062][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 163.604884][ T5723] hid-generic 0004:FFFFFFFF:0000.0002: unknown main item tag 0x0 [ 163.608004][ T5723] hid-generic 0004:FFFFFFFF:0000.0002: unknown main item tag 0x0 [ 163.611069][ T5723] hid-generic 0004:FFFFFFFF:0000.0002: unknown main item tag 0x0 [ 163.613761][ T5723] hid-generic 0004:FFFFFFFF:0000.0002: unknown main item tag 0x0 [ 163.616189][ T5723] hid-generic 0004:FFFFFFFF:0000.0002: unknown main item tag 0x0 [ 163.619040][ T5723] hid-generic 0004:FFFFFFFF:0000.0002: unknown main item tag 0x0 [ 163.621630][ T5723] hid-generic 0004:FFFFFFFF:0000.0002: unknown main item tag 0x0 [ 163.624198][ T5723] hid-generic 0004:FFFFFFFF:0000.0002: unknown main item tag 0x0 [ 163.626714][ T5723] hid-generic 0004:FFFFFFFF:0000.0002: unknown main item tag 0x0 [ 163.629273][ T29] usb 42-1: device descriptor read/8, error -110 [ 163.631591][ T5723] hid-generic 0004:FFFFFFFF:0000.0002: unknown main item tag 0x0 [ 163.644880][ T5723] hid-generic 0004:FFFFFFFF:0000.0002: hidraw1: HID v0.00 Device [syz0] on syz0 [ 163.759628][ T8252] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 163.897829][ T8252] veth0_vlan: entered promiscuous mode [ 163.905358][ T8252] veth1_vlan: entered promiscuous mode [ 163.920788][ T8252] veth0_macvtap: entered promiscuous mode [ 163.925030][ T8252] veth1_macvtap: entered promiscuous mode [ 163.938557][ T8252] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 163.944273][ T8252] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 163.982660][ T229] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 163.985423][ T229] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 163.996338][ T220] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 163.997284][ T5826] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.999145][ T220] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 164.001658][ T5826] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.017168][ T5617] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.020552][ T5617] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.020681][ T29] usb usb42-port1: attempt power cycle [ 164.443986][ T8306] smpboot: CPU 1 is now offline [ 164.718879][ T29] usb usb42-port1: unable to enumerate USB device [ 164.817170][ T5762] Bluetooth: hci0: command tx timeout [ 164.920769][ T8315] xt_CT: You must specify a L4 protocol and not use inversions on it [ 164.926303][ T8315] tmpfs: Unknown parameter 'usrquota' [ 166.086985][ T8324] netlink: 16 bytes leftover after parsing attributes in process `syz.3.474'. [ 166.214747][ T8339] netfs: Duplicate cookie detected [ 166.216493][ T8339] netfs: O-cookie c=00000015 [fl=4008 na=0 nA=0 s=-] [ 166.218921][ T8339] netfs: O-cookie V=0000000f [9p,syz,] [ 166.220671][ T8339] netfs: O-key=[8] '5738ac0400000000' [ 166.222428][ T8339] netfs: N-cookie c=00000016 [fl=8 na=0 nA=0 s=-] [ 166.224456][ T8339] netfs: N-cookie V=0000000f [9p,syz,] [ 166.226240][ T8339] netfs: N-key=[8] '5738ac0400000000' [ 166.897353][ T5762] Bluetooth: hci0: command tx timeout [ 168.686626][ T5749] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 168.692786][ T5749] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 168.699568][ T5749] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 168.704988][ T5749] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 168.713674][ T5749] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 168.988175][ T5749] Bluetooth: hci0: command tx timeout [ 169.142295][ T5827] usb 7-1: Failed to early initialize device [ 169.196486][ T5827] usb 7-1: USB disconnect, device number 2 [ 169.391702][ T8373] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.398323][ T8373] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.404716][ T8373] bridge_slave_0: entered allmulticast mode [ 169.416679][ T8373] bridge_slave_0: entered promiscuous mode [ 169.428178][ T8373] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.432500][ T8373] bridge0: port 2(bridge_slave_1) entered disabled state [ 169.436645][ T8373] bridge_slave_1: entered allmulticast mode [ 169.444206][ T8373] bridge_slave_1: entered promiscuous mode [ 169.474857][ T8373] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 169.481978][ T8373] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 169.505844][ T8373] team0: Port device team_slave_0 added [ 169.510634][ T8373] team0: Port device team_slave_1 added [ 169.532785][ T8373] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 169.535883][ T8373] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 169.546566][ T8373] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 169.558100][ T8373] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 169.560950][ T8373] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 169.577108][ T8373] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 169.581912][ T8377] orangefs_mount: mount request failed with -4 [ 169.628697][ T8373] hsr_slave_0: entered promiscuous mode [ 169.637656][ T8373] hsr_slave_1: entered promiscuous mode [ 169.640563][ T8373] debugfs: 'hsr0' already exists in 'hsr' [ 169.642691][ T8373] Cannot create hsr debugfs directory [ 169.804133][ T8373] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 169.813481][ T8373] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 169.816252][ T8373] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 169.821225][ T8373] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 169.824305][ T8373] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 169.850959][ T8373] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 169.857104][ T8373] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 169.870822][ T8373] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 170.083600][ T8373] bridge0: port 2(bridge_slave_1) entered blocking state [ 170.085949][ T8373] bridge0: port 2(bridge_slave_1) entered forwarding state [ 170.088360][ T8373] bridge0: port 1(bridge_slave_0) entered blocking state [ 170.090571][ T8373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 170.127243][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 170.130311][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 170.182909][ T8373] 8021q: adding VLAN 0 to HW filter on device bond0 [ 170.218712][ T8373] 8021q: adding VLAN 0 to HW filter on device team0 [ 170.223702][ T220] bridge0: port 1(bridge_slave_0) entered blocking state [ 170.226042][ T220] bridge0: port 1(bridge_slave_0) entered forwarding state [ 170.263700][ T5749] Bluetooth: hci1: command 0x0406 tx timeout [ 170.266584][ T5749] Bluetooth: hci3: command 0x0405 tx timeout [ 170.269614][ T5749] Bluetooth: hci2: command 0x0406 tx timeout [ 170.281859][ T220] bridge0: port 2(bridge_slave_1) entered blocking state [ 170.284157][ T220] bridge0: port 2(bridge_slave_1) entered forwarding state [ 170.800854][ T5760] Bluetooth: hci4: command tx timeout [ 171.057188][ T5760] Bluetooth: hci0: command tx timeout [ 171.217225][ T5841] usb 8-1: Failed to early initialize device [ 171.225280][ T5841] usb 8-1: USB disconnect, device number 3 [ 171.333120][ T8373] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 171.378507][ T8458] xt_cgroup: path and classid specified [ 171.513585][ T8373] veth0_vlan: entered promiscuous mode [ 171.520907][ T8373] veth1_vlan: entered promiscuous mode [ 171.542113][ T8373] veth0_macvtap: entered promiscuous mode [ 171.590757][ T8373] veth1_macvtap: entered promiscuous mode [ 171.608822][ T8373] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 171.617984][ T8373] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 171.672819][ T5826] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.734460][ T1164] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 171.736795][ T1164] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 171.737191][ T5617] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.746905][ T5617] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.794452][ T220] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 171.801529][ T220] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 171.809197][ T5826] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 172.817137][ T5760] Bluetooth: hci4: command tx timeout [ 173.317254][ T8490] syz.2.497 (8490) used greatest stack depth: 19104 bytes left [ 173.387785][ T34] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 173.548344][ T34] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 173.555099][ T34] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 173.564272][ T34] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 173.570155][ T34] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.645056][ T8511] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 173.757580][ T34] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 174.695238][ T8511] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 174.697357][ T8511] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 174.701347][ T8511] vhci_hcd vhci_hcd.0: Device attached [ 174.897512][ T5760] Bluetooth: hci4: command tx timeout [ 174.987427][ T8471] usb 46-1: SetAddress Request (2) to port 0 [ 174.991152][ T8471] usb 46-1: new SuperSpeed USB device number 2 using vhci_hcd [ 175.257217][ T5827] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 175.417070][ T5827] usb 10-1: Using ep0 maxpacket: 8 [ 175.421402][ T5827] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 175.425041][ T5827] usb 10-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 175.428207][ T5827] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.432884][ T5827] usb 10-1: config 0 descriptor?? [ 175.537286][ T5828] usb 5-1: Failed to early initialize device [ 175.555216][ T5828] usb 5-1: USB disconnect, device number 7 [ 175.646197][ T5827] iowarrior 10-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 176.726320][ T8534] vhci_hcd: connection reset by peer [ 176.733021][ T5826] vhci_hcd vhci_hcd.4: stop threads [ 176.737550][ T2327] usb 9-1: USB disconnect, device number 2 [ 176.745739][ T5826] vhci_hcd vhci_hcd.4: release socket [ 176.755675][ T5826] vhci_hcd vhci_hcd.4: disconnect device [ 176.977145][ T5760] Bluetooth: hci4: command tx timeout [ 177.736423][ T1355] usb 10-1: USB disconnect, device number 2 [ 177.874179][ T8567] netlink: 24 bytes leftover after parsing attributes in process `syz.3.512'. [ 178.398980][ T5826] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.780668][ T8587] netlink: 16 bytes leftover after parsing attributes in process `syz.2.518'. [ 179.321717][ T5826] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.533166][ T5826] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.576586][ T8617] netlink: 220 bytes leftover after parsing attributes in process `syz.3.523'. [ 179.588758][ T8617] netlink: 8 bytes leftover after parsing attributes in process `syz.3.523'. [ 179.653925][ T8624] netlink: 'syz.2.524': attribute type 2 has an invalid length. [ 179.662539][ T8592] ================================================================== [ 179.665128][ T8592] BUG: KASAN: slab-use-after-free in __release_resource+0x276/0x2c0 [ 179.667642][ T8592] Read of size 8 at addr ffff888013a2ae38 by task syz.4.519/8592 [ 179.670923][ T8592] [ 179.672398][ T8592] CPU: 3 UID: 0 PID: 8592 Comm: syz.4.519 Not tainted syzkaller #0 PREEMPT(full) [ 179.672417][ T8592] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 179.672425][ T8592] Call Trace: [ 179.672431][ T8592] [ 179.672436][ T8592] dump_stack_lvl+0x100/0x190 [ 179.672454][ T8592] print_report+0x13d/0x4b0 [ 179.672474][ T8592] ? __virt_addr_valid+0x239/0x430 [ 179.672504][ T8592] ? __release_resource+0x276/0x2c0 [ 179.672518][ T8592] kasan_report+0xdf/0x1c0 [ 179.672537][ T8592] ? __release_resource+0x276/0x2c0 [ 179.672552][ T8592] __release_resource+0x276/0x2c0 [ 179.672566][ T8592] release_resource+0x26/0x40 [ 179.672581][ T8592] pci_remove_bus_device+0x2d3/0x3b0 [ 179.672598][ T8592] pci_stop_and_remove_bus_device_locked+0x1a/0x20 [ 179.672624][ T8592] remove_store+0x123/0x140 [ 179.672644][ T8592] ? __pfx_remove_store+0x10/0x10 [ 179.672659][ T8592] ? find_held_lock+0x2b/0x80 [ 179.672674][ T8592] ? sysfs_file_kobj+0xe4/0x290 [ 179.672688][ T8592] ? sysfs_file_kobj+0xe4/0x290 [ 179.672703][ T8592] ? __pfx_remove_store+0x10/0x10 [ 179.672717][ T8592] dev_attr_store+0x58/0x80 [ 179.672736][ T8592] ? __pfx_dev_attr_store+0x10/0x10 [ 179.672765][ T8592] sysfs_kf_write+0xf2/0x150 [ 179.672781][ T8592] kernfs_fop_write_iter+0x3e0/0x5f0 [ 179.672794][ T8592] ? __pfx_sysfs_kf_write+0x10/0x10 [ 179.672809][ T8592] vfs_write+0x6ac/0x1050 [ 179.672821][ T8592] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 179.672835][ T8592] ? __pfx_vfs_write+0x10/0x10 [ 179.672844][ T8592] ? find_held_lock+0x2b/0x80 [ 179.672860][ T8592] ksys_write+0x12a/0x250 [ 179.672870][ T8592] ? __pfx_ksys_write+0x10/0x10 [ 179.672881][ T8592] __do_fast_syscall_32+0xe7/0x970 [ 179.672897][ T8592] ? lockdep_hardirqs_on+0x78/0x100 [ 179.672911][ T8592] do_fast_syscall_32+0x32/0x70 [ 179.672925][ T8592] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 179.672940][ T8592] RIP: 0023:0xf6feefec [ 179.672962][ T8592] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 179.672973][ T8592] RSP: 002b:00000000f53dd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 179.672984][ T8592] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000140 [ 179.672991][ T8592] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 179.672997][ T8592] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 179.673004][ T8592] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 179.673010][ T8592] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 179.673019][ T8592] [ 179.673024][ T8592] [ 179.752392][ T8592] Allocated by task 6077: [ 179.753731][ T8592] kasan_save_stack+0x30/0x50 [ 179.755208][ T8592] kasan_save_track+0x14/0x30 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 179.756667][ T8592] __kasan_kmalloc+0xaa/0xb0 [ 179.758255][ T8592] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 179.760203][ T8592] kmemdup_noprof+0x29/0x60 [ 179.761579][ T8592] platform_device_add_resources+0x37/0x100 [ 179.763365][ T8592] dwc2_pci_probe+0x1d3/0x360 [ 179.764826][ T8592] local_pci_probe+0xdd/0x1b0 [ 179.766234][ T8592] pci_call_probe+0x176/0x800 [ 179.767638][ T8592] pci_device_probe+0x1cd/0x370 [ 179.769079][ T8592] really_probe+0x241/0xa60 [ 179.770461][ T8592] __driver_probe_device+0x20e/0x450 [ 179.772017][ T8592] device_driver_attach+0xd1/0x220 [ 179.773569][ T8592] bind_store+0xf4/0x190 [ 179.774945][ T8592] drv_attr_store+0x74/0xb0 [ 179.776386][ T8592] sysfs_kf_write+0xf2/0x150 [ 179.777853][ T8592] kernfs_fop_write_iter+0x3e0/0x5f0 [ 179.779589][ T8592] vfs_write+0x6ac/0x1050 [ 179.780957][ T8592] ksys_write+0x12a/0x250 [ 179.782321][ T8592] __do_fast_syscall_32+0xe7/0x970 [ 179.783936][ T8592] do_fast_syscall_32+0x32/0x70 [ 179.785493][ T8592] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 179.787479][ T8592] [ 179.788248][ T8592] Freed by task 8592: [ 179.789527][ T8592] kasan_save_stack+0x30/0x50 [ 179.791019][ T8592] kasan_save_track+0x14/0x30 [ 179.792510][ T8592] kasan_save_free_info+0x3b/0x70 [ 179.794090][ T8592] __kasan_slab_free+0x5f/0x80 [ 179.795625][ T8592] kfree+0x22b/0x6c0 [ 179.796885][ T8592] platform_device_release+0x8a/0xb0 [ 179.798560][ T8592] device_release+0xd2/0x270 [ 179.800031][ T8592] kobject_put+0x1f7/0x640 [ 179.801454][ T8592] put_device+0x1f/0x30 [ 179.802769][ T8592] platform_device_unregister+0x45/0x50 [ 179.804508][ T8592] dwc2_pci_remove+0x55/0xd0 [ 179.805978][ T8592] pci_device_remove+0xb2/0x1d0 [ 179.807525][ T8592] device_remove+0xcb/0x180 [ 179.808979][ T8592] device_release_driver_internal+0x44e/0x620 [ 179.810896][ T8592] pci_stop_bus_device+0x120/0x160 [ 179.812508][ T8592] pci_stop_and_remove_bus_device+0x58/0xa0 [ 179.814362][ T8592] pci_stop_and_remove_bus_device_locked+0x1a/0x20 [ 179.816428][ T8592] remove_store+0x123/0x140 [ 179.817888][ T8592] dev_attr_store+0x58/0x80 [ 179.819356][ T8592] sysfs_kf_write+0xf2/0x150 [ 179.820763][ T8592] kernfs_fop_write_iter+0x3e0/0x5f0 [ 179.822421][ T8592] vfs_write+0x6ac/0x1050 [ 179.823789][ T8592] ksys_write+0x12a/0x250 [ 179.825168][ T8592] __do_fast_syscall_32+0xe7/0x970 [ 179.826781][ T8592] do_fast_syscall_32+0x32/0x70 [ 179.828331][ T8592] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 179.830331][ T8592] [ 179.831108][ T8592] The buggy address belongs to the object at ffff888013a2ae00 [ 179.831108][ T8592] which belongs to the cache kmalloc-128 of size 128 [ 179.835408][ T8592] The buggy address is located 56 bytes inside of [ 179.835408][ T8592] freed 128-byte region [ffff888013a2ae00, ffff888013a2ae80) [ 179.839637][ T8592] [ 179.840408][ T8592] The buggy address belongs to the physical page: [ 179.842408][ T8592] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13a2a [ 179.845147][ T8592] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 179.847358][ T8592] page_type: f5(slab) [ 179.848640][ T8592] raw: 00fff00000000000 ffff88801bc42a00 dead000000000100 dead000000000122 [ 179.851303][ T8592] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 179.853957][ T8592] page dumped because: kasan: bad access detected [ 179.855985][ T8592] page_owner tracks the page as allocated [ 179.857781][ T8592] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5747, tgid 5747 (syz-executor), ts 57596461116, free_ts 57596333630 [ 179.863704][ T8592] post_alloc_hook+0xfd/0x120 [ 179.865184][ T8592] get_page_from_freelist+0xf48/0x3530 [ 179.866899][ T8592] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 179.868767][ T8592] new_slab+0xa2/0x640 [ 179.870061][ T8592] ___slab_alloc+0x5d1/0x800 [ 179.871529][ T8592] __kmalloc_flags_noprof+0x473/0x8b0 [ 179.873211][ T8592] alloc_slab_obj_exts+0x5a/0x160 [ 179.874798][ T8592] __memcg_slab_post_alloc_hook+0x3d4/0x1160 [ 179.876701][ T8592] kmem_cache_alloc_noprof+0x587/0x6a0 [ 179.878429][ T8592] copy_process+0x2e05/0x8030 [ 179.879938][ T8592] kernel_clone+0x176/0x9d0 [ 179.881377][ T8592] __do_compat_sys_ia32_clone+0xd4/0x120 [ 179.883151][ T8592] __do_fast_syscall_32+0xe7/0x970 [ 179.884771][ T8592] do_fast_syscall_32+0x32/0x70 [ 179.886338][ T8592] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 179.888335][ T8592] page last free pid 5747 tgid 5747 stack trace: [ 179.890323][ T8592] __free_frozen_pages+0x79f/0x1090 [ 179.891971][ T8592] __kasan_populate_vmalloc+0x1ea/0x210 [ 179.893665][ T8592] alloc_vmap_area+0x95d/0x2bb0 [ 179.895226][ T8592] __get_vm_area_node+0x1ca/0x330 [ 179.896828][ T8592] __vmalloc_node_range_noprof+0x228/0x1630 [ 179.898699][ T8592] __vmalloc_node_noprof+0xad/0xf0 [ 179.900321][ T8592] copy_process+0x7fb/0x8030 [ 179.901769][ T8592] kernel_clone+0x176/0x9d0 [ 179.903155][ T8592] __do_compat_sys_ia32_clone+0xd4/0x120 [ 179.904944][ T8592] __do_fast_syscall_32+0xe7/0x970 [ 179.906579][ T8592] do_fast_syscall_32+0x32/0x70 [ 179.908133][ T8592] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 179.910129][ T8592] [ 179.910905][ T8592] Memory state around the buggy address: [ 179.912444][ T8592] ffff888013a2ad00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 179.914745][ T8592] ffff888013a2ad80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 179.917290][ T8592] >ffff888013a2ae00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 179.919790][ T8592] ^ [ 179.921639][ T8592] ffff888013a2ae80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 179.924130][ T8592] ffff888013a2af00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 179.926618][ T8592] ================================================================== [ 179.929530][ T8592] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 179.931813][ T8592] CPU: 3 UID: 0 PID: 8592 Comm: syz.4.519 Not tainted syzkaller #0 PREEMPT(full) [ 179.934663][ T8592] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 179.937859][ T8592] Call Trace: [ 179.938961][ T8592] [ 179.939913][ T8592] dump_stack_lvl+0x100/0x190 [ 179.941410][ T8592] vpanic+0x552/0x970 [ 179.942684][ T8592] ? __pfx_vpanic+0x10/0x10 [ 179.944134][ T8592] ? mark_held_locks+0x40/0x70 [ 179.945680][ T8592] ? irqentry_exit+0x24d/0xa00 [ 179.947208][ T8592] ? __release_resource+0x276/0x2c0 [ 179.948866][ T8592] panic+0xd1/0xe0 [ 179.950060][ T8592] ? __pfx_panic+0x10/0x10 [ 179.951486][ T8592] check_panic_on_warn.cold+0x19/0x34 [ 179.953170][ T8592] end_report.part.0+0x3a/0x90 [ 179.954692][ T8592] kasan_report.cold+0xe/0x18 [ 179.956194][ T8592] ? __release_resource+0x276/0x2c0 [ 179.957848][ T8592] __release_resource+0x276/0x2c0 [ 179.959462][ T8592] release_resource+0x26/0x40 [ 179.960947][ T8592] pci_remove_bus_device+0x2d3/0x3b0 [ 179.962615][ T8592] pci_stop_and_remove_bus_device_locked+0x1a/0x20 [ 179.964651][ T8592] remove_store+0x123/0x140 [ 179.966112][ T8592] ? __pfx_remove_store+0x10/0x10 [ 179.967705][ T8592] ? find_held_lock+0x2b/0x80 [ 179.969206][ T8592] ? sysfs_file_kobj+0xe4/0x290 [ 179.970745][ T8592] ? sysfs_file_kobj+0xe4/0x290 [ 179.972288][ T8592] ? __pfx_remove_store+0x10/0x10 [ 179.973872][ T8592] dev_attr_store+0x58/0x80 [ 179.975333][ T8592] ? __pfx_dev_attr_store+0x10/0x10 [ 179.976989][ T8592] sysfs_kf_write+0xf2/0x150 [ 179.978453][ T8592] kernfs_fop_write_iter+0x3e0/0x5f0 [ 179.980138][ T8592] ? __pfx_sysfs_kf_write+0x10/0x10 [ 179.981776][ T8592] vfs_write+0x6ac/0x1050 [ 179.983153][ T8592] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 179.984941][ T8592] ? __pfx_vfs_write+0x10/0x10 [ 179.986395][ T8592] ? find_held_lock+0x2b/0x80 [ 179.987896][ T8592] ksys_write+0x12a/0x250 [ 179.989289][ T8592] ? __pfx_ksys_write+0x10/0x10 [ 179.990825][ T8592] __do_fast_syscall_32+0xe7/0x970 [ 179.992447][ T8592] ? lockdep_hardirqs_on+0x78/0x100 [ 179.994086][ T8592] do_fast_syscall_32+0x32/0x70 [ 179.995637][ T8592] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 179.997634][ T8592] RIP: 0023:0xf6feefec [ 179.998947][ T8592] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 180.004918][ T8592] RSP: 002b:00000000f53dd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 180.007510][ T8592] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000140 [ 180.009986][ T8592] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 180.012452][ T8592] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 180.014941][ T8592] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 180.017414][ T8592] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 180.019898][ T8592] [ 180.021435][ T8592] Kernel Offset: disabled [ 180.022694][ T8592] Rebooting in 86400 seconds.. VM DIAGNOSIS: 15:42:48 Registers: info registers vcpu 0 CPU#0 RAX=0000006e04c5a756 RBX=ffff88802b223d80 RCX=00000000000006e0 RDX=000000000000006e RSI=ffffffff81f96de5 RDI=ffff888073114a80 RBP=00000029cecfe492 RSP=ffffc90003d5fa58 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000000 R12=1ffff920007abf55 R13=0000000000000001 R14=0000000000000001 R15=ffff88802b223dc0 RIP=ffffffff81f96df8 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096be1000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000000c3d420f CR3=00000000555e1000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000000 RBX=0000000000000006 RCX=ffffffff81b51eaa RDX=ffff88801c742540 RSI=ffffffff81b51ece RDI=ffff88801c742540 RBP=0000000000000001 RSP=ffffc9000046fdf8 R8 =0000000000000001 R9 =0000000000000003 R10=0000000000000006 R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff9200008dfc4 R15=0000000000000000 RIP=ffffffff81b51ecf RFL=00000093 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096ce1000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00000000f546bff4 CR3=000000000e994000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000104080 Opmask01=0000000000000001 Opmask02=00000000ffffffff Opmask03=0000000000000000 Opmask04=00000000ffffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055647c2bb000 00007f565aff1b60 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fff0744c4f0 0000003000000010 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055647c2d6540 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f565aff1b20 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f565aff1b20 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f565af52c80 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 737265646c6f682f 34706f6f6c2f6b63 6f6c622f6c617574 7269762f73656369 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f565aff0000 737265646c6f682f ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2f6d697377685f31 3132303863616d2f 6c6175747269762f 736563697665642f ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2c323832302c4635 32302c443532302c 423532302c413532 302c413432302c34 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00414132302c3841 32302c344132302c 314132302c323832 302c463532302c44 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3532302c42353230 2c413532302c4134 32302c343432302c 363132302c453032 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 302c433032302c42 3032302c41303230 2c393032302c3830 32302c363032302c ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 323032302c313032 302c394631302c32 4331302c38423130 2c464131302c4541 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000000 RBX=0000000000000003 RCX=ffffffff81fd1d52 RDX=ffff888028f6a540 RSI=ffffffff81fd1d2c RDI=ffff888028f6a540 RBP=ffff88802b543360 RSP=ffffc9000490f470 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000000 R12=0000000000000003 R13=ffffed10056a866d R14=0000000000000001 R15=ffff88802b43c9c0 RIP=ffffffff81fd1d2e RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096de1000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f7f66ec0 CR3=0000000051d74000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000585858585858 2e7a797300000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000585858585858 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff 0f0e0d0c0b0a0908 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000020 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85a13075 RDI=ffffffff9b9f51a0 RBP=ffffffff9b9f5160 RSP=ffffc90030ecf530 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=0000000039353854 R12=0000000000000000 R13=0000000000000020 R14=ffffffff9b6f51ef R15=ffffffff85a13010 RIP=ffffffff85a1309f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096ee1000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00000000f71fe9ea CR3=00000000555e1000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000104080 Opmask01=0000000000000000 Opmask02=00000000ffff7fdf Opmask03=0000000000000000 Opmask04=00000000ffffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 44455a494c414954 494e495f43455355 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055647c2bae40 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055647c2d1040 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00ff000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f565af52c80 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 302e32303a30303a 303030302f30303a 303030306963702f 736563697665642f ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 005600051f40494c 43055c5155484005 424b4c55554c4e53 004057005b1a0f00 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 fec49aec7e52edf8 000055612a6c895a 00000000000000d1 0000000000327075 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 302c384132302c34 4132302c31413230 2c323832302c4635 32302c443532302c ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00414132302c3841 32302c344132302c 314132302c323832 302c463532302c44 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3532302c42353230 2c413532302c4134 32302c343432302c 363132302c453032 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 302c433032302c42 3032302c41303230 2c393032302c3830 32302c363032302c ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 323032302c313032 302c394631302c32 4331302c38423130 2c464131302c4541 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000