last executing test programs: 1m19.510411221s ago: executing program 0 (id=13664): r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r0, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r1, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) syz_emit_ethernet(0xbe, &(0x7f00000004c0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1b, 0xb0, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x3, 0x24, 0x0, {0x25, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfc, 0x1, 0x7, @loopback, @rand_addr=0x640100fa, {[@cipso={0x86, 0x77, 0xffffffffffffffff, [{0x5, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0xa, "0200f31039ab0e6a"}, {0x0, 0xe, "7434954373561de584b703c8"}, {0x0, 0x9, "e706d30bd224f8"}, {0x2, 0x7, "cfa11cab1a"}, {0x0, 0x10, "84a4913275be675de6a70a05a0dc"}, {0x6, 0xa, "ed66554900000000"}, {0x2, 0x12, "73bc23f9ffffffa30900a301c84600c9"}, {0x0, 0xf, "c8f46976e79ea788f03d9d3205"}]}, @cipso={0x86, 0x6, 0x20}]}}}}}}}, 0x0) 1m19.416823924s ago: executing program 0 (id=13665): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r0, &(0x7f0000000200)={0x2, @long}, 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000370001000203000000dbdf250200000008000800", @ANYRES32, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (fail_nth: 2) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$kcm(0x29, 0x5, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) bind$unix(r5, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r5, 0x0) socket$unix(0x1, 0x1, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) connect$unix(r6, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r7) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r7, &(0x7f0000004680)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000180)=""/197, 0xc5}, {&(0x7f0000000280)=""/125, 0x7d}, {&(0x7f0000000340)=""/193, 0xc1}, {&(0x7f0000000440)=""/56, 0x38}, {&(0x7f0000001700)=""/4090, 0xffa}], 0x5}, 0x2}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x2}], 0x3, 0x0, 0x0) sendmmsg$unix(r6, &(0x7f0000002640)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="b2", 0x1}], 0x1, &(0x7f00000006c0)=ANY=[@ANYBLOB="14"], 0x18, 0x8800}}], 0x1, 0x40001) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=@delchain={0x2b54, 0x65, 0x8, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0xf, 0x1}, {0xffff, 0xffe0}, {0xf, 0x3}}, [@filter_kind_options=@f_flow={{0x9}, {0x68, 0x2, [@TCA_FLOW_POLICE={0x64, 0xa, 0x0, 0x1, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x1}, @TCA_POLICE_TBF={0x3c, 0x1, {0xa, 0x1, 0x3, 0xfffffff7, 0x3, {0x5, 0x1, 0xf0, 0x7, 0xf, 0x1d}, {0x9, 0x0, 0x1ff, 0x7, 0x1, 0x4}, 0x1, 0x6, 0x8}}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x100}, @TCA_POLICE_RATE64={0xc, 0x8, 0x8a}]}]}}, @TCA_RATE={0x6, 0x5, {0x0, 0x6}}, @TCA_CHAIN={0x8, 0xb, 0x3}, @filter_kind_options=@f_basic={{0xa}, {0x2aa0, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0xe, 0xffe0}}, @TCA_BASIC_EMATCHES={0x140, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x118, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x1, 0x7, 0x400}, {{0x4, 0x1}, {0x0, 0x0, 0x1}}}}, @TCF_EM_NBYTE={0x10, 0x2, 0x0, 0x0, {{0x101, 0x2, 0x4}, {0x1}}}, @TCF_EM_IPSET={0x10, 0x2, 0x0, 0x0, {{0x1, 0x8, 0x8}, {0x3, 0x4, 0x3}}}, @TCF_EM_CONTAINER={0x14, 0x3, 0x0, 0x0, {{0x1, 0x0, 0xfff6}, "062594b5d8"}}, @TCF_EM_CONTAINER={0xc, 0x3, 0x0, 0x0, {{0x9, 0x0, 0x24}}}, @TCF_EM_NBYTE={0x18, 0x1, 0x0, 0x0, {{0x2, 0x2, 0xffff}, {0x4, 0x7, 0x2, "ce2c8f0463460e"}}}, @TCF_EM_IPT={0x7c, 0x2, 0x0, 0x0, {{0x1ff, 0x9, 0x1}, [@TCA_EM_IPT_MATCH_DATA={0x6d, 0x5, "858910eb88cca5b9146d261b10f47f74b5875ec93b5b56ed9aa7a31b178dfd2f9b3d10d7712dc4d23d6f93d7333e524ecbcc3ed3fda6a26769c2c2e357f3f36ab7a904aac8851018c703794fe5dd7f247a8658f576ff700e8554cdab79aa4a8e95f80f0f057ebd8c3a"}]}}, @TCF_EM_NBYTE={0x14, 0x1, 0x0, 0x0, {{0x2, 0x2, 0x8}, {0xfff, 0x1, 0x2, "ee"}}}, @TCF_EM_NBYTE={0x18, 0x2, 0x0, 0x0, {{0x8, 0x2, 0x9}, {0x1, 0x6, 0x2, "817e52ba902b"}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xfff8}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x18, 0x3, 0x0, 0x0, {{0x100, 0x2, 0x8}, {0x7fc2, 0x7, 0x0, "bb13eae050c6bb"}}}]}]}, @TCA_BASIC_ACT={0x11b0, 0x3, [@m_sample={0xd8, 0x4, 0x0, 0x0, {{0xb}, {0x34, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x9}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0xf}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x4}, @TCA_SAMPLE_RATE={0x8, 0x3, 0xa0}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x5}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x7ff}]}, {0x7a, 0x6, "c34632e7e6d7a4fc638a0ee6effe2639b5bbb38ca7a4a0aaf4ffef7a25c3b2682c5ac752661d37577a99e8aae4e0b6c767b2bfd0ffc592e986c832b2edb8eb113d1a265a4527eb2bc2e8e687b83edde2f7936f7df918bded7c84c4ed72655c11dee0418fde41117887cc40585fd30fb1be3c92f4d029"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_ife={0xc4, 0x9, 0x0, 0x0, {{0x8}, {0x1c, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @multicast}, @TCA_IFE_DMAC={0xa, 0x3, @link_local}]}, {0x82, 0x6, "90c72b38268c2893f3f072cb5fb5099f59ebfdb11d3ccafcc0b889139ad5f03f840a1b10aaa1b4290ccb550661f697d0d87370c05c684dfabba0dee626901990860d30823b628ecf2805b1dbbebde5754179c9918b5fe674b022b37373b48fbe3fcb9e14744a5abe62260b8b1a43271db4b9918dc17424f1223d04c272dd"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_xt={0xec8, 0x1, 0x0, 0x0, {{0x7}, {0xe70, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0xe6a, 0x6, {0x2, 'raw\x00', 0x4, 0xfff, "e62567f29e6cd31c7c8c349d2ec659e20894412e6eaf4427f33c00cc7d046dce0162300eb18dff11baf800e0c2edcc84fe750e3372ff959085b6a65a62da5ff6fc3ccaba61abe71323a55c80b18663e4ea26e86e9953eb1b3216b53bc8a6308e025914c44bd238819d5fafb0ac0b4918a883fb82f3601360292e85fd411c2cd347499ec07603cf83ee48ecee006b2e90ba7f6ffba71f87686b52dc8ea94ddd544981bed6a7f505118306f982ecdcbfa2861a9243a2c12dacde16d91d76ef549ac0d24e3da695674cfe00ad868d5097f8d5284f0cb803d0a8a2ce800ff03fd1fce92ddca36b9ac704e4e7024d2c40bfe6291dd5a5fa24d785b712dc53b79f543e352cb9e6867ecc88d1865006864b678d386dee9aa58b24bf2eb9a65af874ee440dcb7d27b526ee2109ebd06f49761c2abc7ee7f5fb23f35c2299d94170a12fdefc85414f8cd1d3a54144f3384f3303f823bf5ee3479fc93153bef8a7886355859ea7d28a308842b54eae39f7eced340cd1014c8d136ebc7dc3bbefff553202e11da305d469013818717982f0a1c72e639b47a7c72a376ce5b46dd8b4193991bbb84d725f6d737f3d710aabc88b5a6b1a1f45427760ba8fdb02c38a049efd876156af265d98a8232343aeee4c8e374cbce8bb8dee1c8dbbf8658f87bab6108bf986a45055be93c18e8e1710fad982ca30e35edeff56de0d7c93a326ceec41b40941e880fbb0853f1bacd4c695e44461c862274ef7ea48f1a96f342b149dc779f1f25e634aa38ab730fa0cc3ff545061b896a25028f194d22068a48b688a8ef4460071fde509ce73d9deaefe1278767fe1fefa60db3b5edbf14388fa3fda4a81ea1e8ab2fc4f1bbc45bd885b266ee1465e1adfd5403a74af36f14e7ab6fb59bc356e0110fd1b13807776c39cb2ed21b700562cd678d3ff91becf17d4e4ca00be2b9f65010872124a908b11ed8a3a7c1d7ce1a0bc0bb3598eb1532745746ebce86e73340a8d4a993b2c3ab173370fe7162fe452321abeab094c51c9ac2f69ba0a9305877b03f1eb10aa40527e8825e5a04579f5a0f87446fc2ce06aa5b947b7d713b2a13485f45cf091838d2613abace43a23d32c22bddd311d3185f23d8538df219ab164f58c5294efaa1cbab96435bf4e19426b1c4e74335afe7b1cb43e254c4be67346bbc3b899b7076af1b8a849751e63d516f80ae1532becba01b5b2ccb5b50eb8e1e65a07e7ac77948e808b41d7b9570c25578874dbebff64e3549b5d25542997078b672895b821c1bec42c188378b355f70c210e6fa3114f050c531cffb485987b624aa7a4d302c2502417cef8e1ebfd4849a83c439e4e83b975ed9002bb23b32bec93f50edc608d1e3161a2c8ba6fbfc11dfc0716ffe82ab1c86a12c834d2ea279b1bf7c47ac6d3b94df7981da5daad4fa63b5ed0c417180697c1b7a05993eb550d6bf3836e378c323114b2d1f658f419953f8337f2550e91c411330d3aea4a31c4cbe00075cc1fd28074d1f5c8dd289f8082484afa7f32d671c9f02f45f36a9729af1002c1710e75f536085630a9c4729d9ad1352c5b2e39def95d52b606e4d1c67d49fc00ffb250e6f9139517dc5cafcb2e4bb156e0a3a82c480432ca18bb57c8e240a4d5f7c26437a4fc16bcf679c0f8203a48fd5dac2a4853215e83e9b13b00db94e84d510f627e83d2fefeaee674b6c12598e75bfc022a6f99b8176c9dfa976564810126aaaa285734ee1c9bf8f46560432c002bdb431a8b1dd836bb80bddc307d7e8dc284dc9eea21121f60a962fb9aadb593929bb8844eb5c3bc0bdcb5c1b886ee5bd605a24114de3382fa4ff70966faa4d7967c00a0edfc21442a6382632e7bb071a4c846a1ab2863f28d1d64ef70d42d523f784f3c3a7f64fb4f582c916c93f38a4cfdbafc576a36a83b93620b6fac3de32c17c7bcac0d1c09d2de4a67fa8b63b8ba8142e48bde97758932068fa4af662e85f1f0d61fd93530c940523b1ec33b5b729b5c0d6108534c0c83d7a63d169aa2501476a25df147fc303d3583b1b9f150684f65d391c83fc259ffa945e22ebfd40853c5154b38870cb68fcdcfbea8d2107bea7d8d6c47530f2391f5830c4050806509fe45857d8817b4a2845b8ef6fc4dc2e99f70330e958b8cb28cdeeba02090ddc8902fbbe9d598b8dc0caca23f80b856e2c0d0524796afba53265dfefb243ddf907b90d1169a5635253b8bff75d70464b4ae6242b5b69004ec817f6a457a989c5591b0b3745c36dcb4b87fe6354ff326f9c647d457253fa89eff67ef3d580ba353947bb3f8c4c99391a0cefff31b746f5e49db6f7e0375feeb7389ea317eb8c74b455417981882bfbaf7d16fa525324e587264a714a1125868c1d58468bdba8e490c26fd914e46b6a4ac87b640d70cb1c509adabb421f1c1a2dad054e6e64d7ea22d5f30e37f46a62ac6278edf2ebf86593abf29e0506468655bfc1b6ffeb3b32417c5929f126ccb7b5ad7c3b0154743c940a3419b3a7e90749aa496d6f459faec31f29191927f3dc7b36773d3ed719f3f461402b9e8847f2d92cdd23a26dcb5590d2f6a0b5e034cb5eb8bc27ffd4ae889b8d2c4bf33354f2a8b9cce2b7502dfa8cf3a801aec7210c1c8b1fce9d23d1c78f47bd2c694bddf3eaf532c9cc9e18ede7d14fd9814301c5e60b7edde982e104694a959e77abe188b9a07c8a3cbb1f170fe36d891c22ed8814fa1059ba322800dedf17c7a8aa69f24aa68a69df765aa9d95ace30c10f16b85fa2e6877f30ab748456490343989da18b01c33f32303247982b6bac7bdf3cf0b09d45bb79fa0cec186b83dc8590879adba6bd7f40db4b1762f59985f1019a5bba179bf56cb714e103178cee5eb1eefa22197ed5e53665bba6c9e9488986abcc6f84c5e88265da85fc0c2bbd154eb7fe70c969632a7f6c56455914c89c59e144cfc5076a44ba2c632e67a77bd1b82944138f7cc12006253e6ce3e504dd7e7d8d4861993ca7837eb7f19024816a678259d9fb3521c79af05ada7af65a75f4c99eceb5192ad551fc44fafd05b9447cf8343bb5eb3111c78be8bd766c0f43eb0e35416997ca0a83066a0d341ec8f21c61a5900b9e680343f7812bda065d8b0675a58a3919df5901d5e71e56904084cb9906aedea6bc083965e4cc3f95c55fdcd1a7ae7af104e6893626d55f234be3dbbdf4395f406da7067ec14159d51564b19c3717f2910fd275b0d23dbd66e3a726982679026e27d1159ba5b362e091c2ca1c39c29d7d7c56b052b65671852b57a590c96964d3344d5a5ffd5bff0a63a18fb16460f9a75c5f22e4fff247e729dee2e036f4817c07457ffc6def87919892ae6fdee19fca8e15a442c94890fda8acc685c73791cef872372241d71aa94db95e440d9041286408e19ef4cc2a9694d2cde7a2cbabe8cb8890b78d17e19dcba9794856ecf7edeb05c0401775e9b25f32a8eda6ff1e4c4f2a288d835da545cd9013288e30bfda3b9bd51b76c8d8f67fa9690a509abd02e66d61ffcdc85e20219396917f022dac804ef93ddf3f61de1d7131658b482af53db00590461a42e83f7ed153d2ee59a90aafdf174d9069118dcfcea3d6ed925c70862d2f9a2d0bfe37e2bdeef7c95f99dd687c9a1ffbfc76343a506ba73b95dcbfbc98f7eae1c21e010a94964166bf205d2e5a466858efcb9ff4391a8d0b1e68f8279a3a57e59bcdd83b693eaa5e9086e8be5a60ff756c75f05a819891e85075bfc48b6fe99321e9872f4882e55bfd7a416e4cbd2e4df2c7ce8c615cb4c6f9a452e36547e44de0e332eeb402b767d3062d75b503e5f4cf5d7f73c2bd6bd669b90df13afeacfb5afe9fcdb0262608884ae3c298e07f137236a035227cf27965e1a1c68c3fe5f1cf337c647307c915b3d7d84869a6eabade17649e8bcacd34fd5ece47cad1fb459b6111f88f76b6e4efe4ffb0b66f9d8a291bda5be076f3de7cc1ac4ea750332796c6ac8435643e1ff771a5725c043de0cd4c72f37bb48dc6600ba216de61565f91c1c6010c081a122c9ac338e2bfdd3a151e01dcc888dfa0b72cd753ad1b97b23df520418070327fac2e4b7de87c78055c7f64fed39fa7acbcc857fe5a001462660e38ba76bb6b2f65dccc701731b66b184d412cc011fc5a2f21c79bbe3a191d5856694e3dd5bdae7e45f375d8554a2c350ac215defb0738d3da5bad7212e37d9667f01de3919efba0f7dea243f4374df8f3ab5653776dc7d780cd2af4eab789cccfe00e79200d43a1d9ea836580fc008854063a5c15c374fe7f6078fff6cedc5899b0dde6d2b7c512e8549e97e257e507fa93cad62665d5212f0f284e49bd42cff6abfd846ea7b3b8b85d815a2e190c2e1660059e960eeb22edef176219dc9c00eed01984fac6bb62f04a9b54ad90c83daf330776875035175a5ac8d938ca1012448cd3309b672959b1cca66aeaabf0d3bbc4fef5675dc4dc1ca4689d729973f3846222ddcb58f7469a20d4887a0c10e89a3899262de6f10c15896567f22388791947d5c31188ab7a7c5011e2269308d8e85a9268cae0dc17767d9db0204ad5fa0d363b547959a7bfbc98b60e61985fe386b271b67579ff7160bc5a023d8759278012e3d938c35b4218ff09d81338ba519b4c516b3df6f6f7f4cd4fdb49ceecf3bb42ca3d137d967b2bf5157cd5fb9e39c81d739b42b9217e10e98f8d44eda2e397c853e10c3efe1014e1a808bd6d3f79703bde6a76e81d955a7ee9b1401fd83faa8ad30d57abc2c2fb2648ce5cd4aaa3758d6be4522fc40a3148157d5fe33c295f97b27e2d6c302a171b012866b2f33bfca07d4a2479e3faf60063f69e1242b7704ffa6323775546719ef07cdb5366c07677edd76b81c902e8a0ff35eec99de2beab44913040138bcf4e6c15453c38967ae6006ea2b23fc841dffd3d79e8c10e0929db029b4a9cfa52e4561a283597555f0c09cafc26066017bae2b622d40e5e1c41392d11a4dfcc4dd0c39bc8989fa678acd305c582f28d09b4bd43f1208100bae98a3718ec754cfb7a95a51565f3e7c5d121c5444c5170c6d96738504381f629e5f1153a4e6a195cc33d83c482d6968eee1bcb5ec4167edd4fe692c04739ff598ea4fe77ca89f78fedd46abd50983c45d4e6f8c0ccaa322374164f9d292d346453644e9"}}]}, {0x33, 0x6, "b9740bf0d37bc21c1155c23c8ec32fabcdf0e3359d1c8ae0b6ef5fdab9942adf3bac433039c788cd791371fe41b2b1"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_nat={0x148, 0xc, 0x0, 0x0, {{0x8}, {0xa4, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x10001, 0x8, 0xfffffffe, 0x967d}, @remote, @multicast2, 0xff000000, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x4, 0x7, 0x5, 0x0, 0x4}, @empty, @rand_addr=0x64010100, 0xff, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x4a3, 0x0, 0x8, 0x6, 0x8}, @remote, @broadcast, 0xff}}, @TCA_NAT_PARMS={0x28, 0x1, {{0xffff, 0x8, 0xffffffffdffffff9, 0x400, 0x5}, @multicast1, @empty, 0xff, 0x1}}]}, {0x7e, 0x6, "4e8b138ecb0bc643b90e46ef1ff0563b2817381070de500144b7afef20323b5e6b0f12af9f7b3566637340074b9f43ea00b4a3be44242d5e19b877761f156e5ca2867b98c42a53cbc88fc3e9d3f6202b81a285f7b04646dbed71a214f92f6a760376bbdaa4b18ccbbdd041dd6905f8d933fd1b569bb4acc9e5df"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}]}, @TCA_BASIC_EMATCHES={0x1118, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x74, 0x2, 0x0, 0x1, [@TCF_EM_IPSET={0x10, 0x2, 0x0, 0x0, {{0xaa, 0x8, 0x8}, {0x2, 0x4}}}, @TCF_EM_META={0x2c, 0x2, 0x0, 0x0, {{0x1}, [@TCA_EM_META_RVALUE={0x1d, 0x3, [@TCF_META_TYPE_VAR="b82f0b03cb5b4c1d73", @TCF_META_TYPE_INT=0x2, @TCF_META_TYPE_INT=0x8, @TCF_META_TYPE_VAR="3dd2b83178d323e6"]}]}}, @TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x101, 0x7, 0x8}, {{0x2, 0x1, 0x1}, {0x1}}}}, @TCF_EM_META={0x20, 0x3, 0x0, 0x0, {{0x0, 0x4, 0x20c}, [@TCA_EM_META_LVALUE={0x8, 0x2, [@TCF_META_TYPE_INT=0x1]}, @TCA_EM_META_LVALUE={0xb, 0x2, [@TCF_META_TYPE_VAR="2a2041269a2340"]}]}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x4cb}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x3}}, @TCA_EMATCH_TREE_LIST={0x106c, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0x556, 0x3, 0x5}, {0x4, 0x8, 0x0, 0x8000}}}, @TCF_EM_IPT={0x101c, 0x3, 0x0, 0x0, {{0x8, 0x9, 0x1ff}, [@TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_MATCH_DATA={0x1004, 0x5, "50a853ad0af7f219946edf0c5182d23e882c53e3e5234e5d6b3e7588ca62346766ed08fd0c6dc6375c18923f6fb81a89f837f5c6eca3b078ce2812631277765ce99d4350353e155d15ed17ca86bb174da95359be8b0c70734aeb6310b95f14c80fd653c884031a630bef2e432e4b7912acf8b86ab16c3b0adc8a472e0d4ddd6715f7433ccb4cd9937abc61689d599b32c2c5fdfdcd8f4367f52051b57511366206b5d0e0a06d68c9632c274fc7fe97a3f0784f4f3b4413ce2abeb9f5476c07788e1617681d6ada3fffee5747792f5cbafa4fa2b943a8db12d84502ecb7a7eb16d5b7c8b046eb55861d4bdcc86b9b1452f2d0775ed1df16d08c608859358a7a290f06cbbba7f61afea268dd532b1de685b2cdc4f40a99a4a9c67390d9aa358d6d49df40700457f2b42ec0d3b8e5e2025695fa12b08786f3222dff4a2e80651fb46012b46270b8746a0e154a58bf5f6f1124b98310ded026bca9ce18cffa91bfe2a8f670cc24b6d15a4da902ea700c87750ef847297374593121505807e7f3884bcbdd708b8e9761905929424b239a4d225adf7618d3f25b76fd9ae8745100d6f1a608b5e7468948e41b5ab323c462bb25d4aa1d3e89112d287497eaa4c686ce308b5b652d375e8824c7cdb97807a4bbbb02bb9b7422c18e5b785053a073cda120733f6d42dc78619df87ea864839e783a8242172ece710b97adb86e1d1bea5e2e8888944652899b78e7fb2c5c9d84c5c677e8604cc2f0d5ddd4485c15009fd0593afa6e58d6ee0772a73c6f5c200f7d787829e44f5d857d635df9101830832808e91425313659723b061576f07bc9bd3936368b467a842cf9bd7c7298b09fc9bfb977668e07d1e9ba2a89da6951cccf480efcd956ef72143c98c231cd4ca573ed6316f654963aabb64ab490c8bf017c8083c1a35c2f3e0f2fb96c8d55c399f737bf9e2fab57e850706415646e30694d7f44ffc640f3b6fc93d07f6b6c82d82acbfb2873a142a3743918a2db18ef3f997b2843c6169a726965ae0ffcc6c5e40cd0b245f866c1fb540917d9b9f1f90fff63e6703c3ad11fdf57be49331e76ba017fef5322b89b363b6ec4d508351bb38e4fa6d8d8cf8a6558c637a0f074c8a4fd53dc8f517eb69d30d4cc2b90d5455c5acaa9dcb3b100b201e0b8aa2827040b25522f41da2b3ab30c9aae3ac27cb344d51ad86172f7114c2aff9b8e6fac7af5f2cd3f02f2323c9582cf619acf9eb596247c8d7d6b7127ab7ab02dba62859fdf3918274f6ddeaee12642fc6c7b17b04efc09e875c67dda895dd9b594e2112edfb5dc9337231415a3a81e4503c54db432aa1bf143ae0e7c7da5f93e7ce45ffff04cf676b5ccebf6c5104a3cd269dc79094e39c34351e6169bd5958970a9c20b778b645899ce54aefb03c38ff15a1f61130666af295ecb591d7252a3ff4e0bf1cf00a66b9c5782c41904fab1716cf78131dfd5290c92acc9c95faf06ae79cebceae319aa0b050f2e13891f93f018f7198360ff0f7804743f45f8a82520cb03a3e67dcd0a161e8f2a624ff95e600eabc57c45a894476fa89c454aba531d57de6712725ea36ca7c480acc512fac8ea0c303fbb6ab69f4eb42312725617bdafcf3e86f05f76fbd6425f2f1e22ec9d1783941c57b1420b9eca632b45843c0d85ab9ad856e51d0ea7fcd74cc463ee2b845ddaeb18ec121e7d9d98419d659ab89c75ec7ef1649358d1b5df6637cf8219e6362bcf385af34f0bbb5d0a01a90d6da0b581ecf6b14fb997e721c15220491a3969c488f70e25fcf5fd92be2bbd2f1d471eb9594ac604ded5b5b3a98ed667086e7e743f4f44a531dc4b38c0acd47a1ddeefd0acfddafe9caed4503d027752e1c7690e55660c5c70229f829778382f90b7dedc2553124507dfc66f944e0f81de11c412a24a643e4651f0af09b90d42917f8566c6fc35fbb7ff0bdfd7b40e8f5b527391f56118377b3b322ad972fcb2eb3db2b12d9398f9081e045153e63f82a893f42c9851993c2aadd6f4600fd6cc14c41b8fba6e87f31c37d97d70c6f3befe8938f070f32f478f05b849014c60f25dd8fe53ccb958ee0551ba321b10feff6a56510c10fa7ee2fec9f9615916658ae59f851564e85faa612dba9d844cfe15888551047df6df27163771707f9b07b42c2b67497a648b4548100aa13add70c0f46afb5064743b09b3ec513258a3cd524c676d6ec036c5f9711cd310490be9a7e3fa57f81ee5c11d4f83c47026d38ce8fba4d3e099babea52bc5d19b855a072a8aaf18f1e38c023ca3d238e3e2e6f20fcfea02941248b50095c91509b3046b7faf8800b7459c26428e63c9d53e87bbbd092a0f5d750f0c243c8a6a45b4f906edcbe35636112da311fe7c5e4a4afc0c5f4dab36dbaa665baf5bb9d838435a6d37dbc08998d56203cf63c5d31fc82a1a1015ddf14a62ce969bee5486650f134629dc6a083e0f3770f83dba75cca57128bcae3a94d8fc70717ab8412928807c0202a26834a16d162a6b492c91e6e208880c9a331f295b6313edce120ebe35e2893338890653626677a9c3e6a94c3e9f78285d6a567a41c80893da68ccb7692826e73983933da71b2a15052d7add12f2185747997b44efd0347bb436a586c2461ca72165685bd8a8e0bb9a29578fc7428a2471a869713ca990e1115986e272b84efb7d4e5e42e457eee7dde002d6b6877e885d9e58acb4209ac2f162b407d7b6d99d84723965c4816c7c47dc0d02bded2896a4aabf7b892472aaf0c4ecf299597deb7012bdd9250fa4a2004b69e1f2519dffb7602650950a5ebacf6fa4abd4d7b97563886ee6ac7b0611d7207e5fd80bc631678f1b36d2a8307816410cc9b3e4f4d04fa3672c2995ac9b288f358a38564817c6bef7ee10f50947a323aa02add6c78796d323901c8aaaa3f2865c100a96d4e70b37ddd30cba557cfb7e18c45c3d9fe27faf766775c0ab075dd3ca26cecfb30b86be99f72507c68b43c0cbff2a1008a0dc989df93acef74ab226a72421c9fa48d389aee2bf63ee29cca5ca926d38037f8f6df8cee678b244ce638bdf863f0b9a63ebbd1f78aa506004b0f14be1a02f6282b5977791753eea46b6d3dada649fd5425753d31f822697421878925dc517b246bd9ba2078c60167d29a8ced98b684dd573a7d021da10396b16551de65dd14c87b7186cedbb4dec1e9844e3338f95c3a072e6e3f6b8a0429c41663358def89214bdc52c6375b92ff4758b56c5c043417c867f12938445075500c879e4a58e24d85057cd5114c56d0c7642722cc7e6dc64871e865fb32599f779eb6b2451c0b1511376ec0a7cb39236704bbd3685fa4e1d138773d7e63a634887fc4aa2d1d15574bb60070e507310b7d5a7ae07b31da2d4fcc2f95c4ebcc55dc1e5dd07abfd33d2d9dc1149370db10f75f10932e56161e9e5e83a97ef0c8dad9b1bf507ac26441df628643aa2c0568e7e8e033efaf776fbfefa8747c6f0f321eb3d9520f60bc03aaab32c7b003ec1c199a83fd5e7ea895bb02ed84b986e7270040c1a862887e69c33b58b2710c2ed1a6eec0ba565e62febe064cc8d887e3f4fd29f1b990c2d1a35d9d7aa656235e71faa43232080759d3cd4394f51d620aaf3e06725b043abb353395fa42137274552bee2baca82a44585ffa1ecd7afcf94dcb022164ae63d4965d36eca0265c4fdba76d8c477eb8227416d4949943bf4cad44339ffa12a564af18440b008848263f27d1234a1ebe998146ca970fc1898163361d75484cf3bb376f88cdf8407f1af4cbad2f073dc93086bafade9cb9fb40930283a4e47d1c8e010604d5dfa42f6696177c1e9c4bbb7ad02b7ee4e6b002d0317597db814469bd30f99f734563e10a21ac8105e5f1b3fde4ae98d739069290a668b2b1578d96679f7537e1550fedc3cd6fce3925a92c2ead159522e357870c69e0bbaceabd4c869e48257f641cb73c4f522ac7a8039e16f7289acf72d8bfa77ff983ca1e93733bc5ad77641dbb2ed9ed49caf41b018918027fb0a817f3170925ca8dbc9179cce2cfd9d6b8fa7259ced2d209455a6dfa9ddbb4cb76483a2a8613e20a931a2707d97e5069aadbe4d6ae93f6099febfe56cd2d07196d3354d8bd763bbf6f7da3010c1e86b39fb85c185a48c75d4041c6aab9f3a947feb92aaa0e8283825f741348de51ce19bb8657f31eb797be670d4411fe5f497d3254435a53ef15ec263bb96112c6862befc9fde10e5d9be08856c31e870d0d292548312036e64ffa5170a5c4e11b826fad6aa9e1b398058955dfbd93a505fdf8d15045c8c89d7f1f2eb3e80d6e0e1fabd8dd0f6cefe452c0ef8c8a34bc367de099ebc31be94b032b7cd708bf91c1a25b528f76c4dbb11a7d81288d4c18e6c89b0c2d949245da2e0b7356938ff2db4dd863191421f8b0148b3812ffdcbb90c626af9182565ebbfcd3c2d62d4f9dfb792f71cc7b889c70b8244c9b2180db96b1e56eb83dff85ecaa68549416b99c00c3015b70b5c93de954575c1797f7695c08a5711aa54566155af8c1fea5ab41173a85f815057a75b5e01fc9de2c45bcf52662a2ff45a49062eb37b889b2a8c116a3548dca9c69898bb0392634ea42e259812d3ba1437f44447b0138c54a7e45f685cb1175b74c1502837ef19f39d65bac1660fc6765fa74b62bba7dd2fc3ba4ab0ad3c8857fbc6ee0199dbb7a6f62ed997cf48298efef9e558c3e5233e63775a5c5f135fdccdd4d95cc09117e8b06a4305a79845922177b4473dbd50ecef4db8e2eb9e00c1b686fa59867311c82c22d087070bbcaa0208bd96bb165f55f766b03c6458abc48bea5a0d6c47bc6643446c68648925a7c12f885f48242e00e5d56791e25f319e707eccfb79e83662d3ebc0bb16b195e97cefef86710f8d5d47ab73332c1afe3746418382e90433fe94386f5e2a0de223f8b8e67c07329f0e605b40d6ed14e97d5e448866c7b23a6d07fc5c8200097d2a359dfb53b2fb6d935f651790d20d587c9adc81b91bb42ff700471ff3e84843c1fc5cea894e2e314d8182829b5c1e7545a74a21c7482b7b1f4ea8aee283d281bdfd39b74cc3fc964db722963c55cce8089fe4d3a46049515427d4472cefb49672e03b39d802d79c7437c1236a007e43e4ae5bf80cdd9bb829273fad977000a35d4e405eec4b72b1929f0c04ca4594dcb278004ee9a5b4df03a0bace8e460215dd831f9a8dc53ab74860605e911e8d8191f57d4030375bac02c27442f142a5397bc3cd21acb2af516e6100a09d414842d70807f1383af23e8a2901b8d69e2532249c320150be176607f873ef025547d49aadc0c468c0d0e4b81b1ac75f2cd997c975bd0e2feb11f4a506c7098d98b814dabd143341c97374ec09f526a2e7e3b8add3fb3231463b9f8aab12bac85369989a6858bbeb85eb11f5a950d5e9c68c12d08fad79d543d1c7a5ab6012e32a607c475596f5bbdf264b3b7cdcbba90f10e01ffce32b83b7ed9ef839863ca4de060f0b34316470c81bca39d9f1828979c7f4a28bfabdb3b3baca7be471ef5ad4f8589e233c41f7c70318a8c078a4d3136e23dbac5e5911cec8f2437afb172ea2a6dfe2b25c7c5b1fdc2267b3a466052a641fa208a9c57eee88489c4f7a562d904266f002bd27a71fc4777d913287a7a9fef244e0c59dac4f9a4835f1d93e1d2e4aeabe0ff7406e987b7eaa4b64dc548c7aef96ca36200d8ceed1ca8d83aca9bf5e77074841b987182273c791c6831f3e2da290c9ad9ba55056d1bc987d2853bce61bffee567d1b36793933c21b70e5d5368d91534e"}]}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x14e, 0x1, 0x80}, {0x5, 0x4, 0x4, 0x7, 0x1, 0x5461a0ec6a2e020a}}}, @TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x1000, 0x1, 0xffff}, {0x5, 0x2, 0x3c6c, 0x7, 0x8, 0x0, 0x2}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1000}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1ff}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x4}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x9}}]}, @TCA_BASIC_ACT={0x684, 0x3, [@m_nat={0x1f8, 0x13, 0x0, 0x0, {{0x8}, {0x194, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x1, 0xfffffff7, 0x0, 0x9, 0x6}, @multicast2, @empty, 0xffffff00, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0x200e, 0x2, 0x9, 0x3}, @multicast1, @remote, 0xffffff00}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x6, 0x5, 0x7, 0x8, 0x7}, @dev={0xac, 0x14, 0x14, 0x1d}, @broadcast, 0xff000000}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x5, 0x2e3, 0x10000000, 0x1000}, @dev={0xac, 0x14, 0x14, 0x11}, @loopback, 0xffffff00, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x8, 0x7, 0x8, 0x8, 0x2}, @loopback, @multicast2, 0xff000000}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x64a7, 0x7f, 0x1, 0x7, 0x3}, @local, @rand_addr=0x64010102, 0xffffff00}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x10001, 0x3, 0x62, 0x7}, @dev={0xac, 0x14, 0x14, 0x12}, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xffffffff}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x4, 0x1, 0x2, 0x1, 0xfffffffe}, @local, @private=0xa010102, 0xff000000}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x4242, 0x1, 0x6, 0x9, 0x2ebe}, @broadcast, @multicast1, 0xff000000, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0x2, 0x10000000, 0x3, 0x101}, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty, 0xff, 0x1}}]}, {0x3f, 0x6, "a18d9858af1b795227d5ffac6cab34fbf7034ab286d98b09773a14fd8089c1939936fc4628353f853b75dcab9e7a764dd1c703446e4329080bb222"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_nat={0x184, 0x6, 0x0, 0x0, {{0x8}, {0xcc, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0xb, 0x8, 0x2, 0x80, 0x3}, @empty, @private=0xa010101}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x1, 0xa, 0x5, 0x1, 0x101}, @broadcast, @rand_addr=0x64010101, 0xffffff00}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x6f7a, 0x4, 0x4, 0x9, 0xfffffff2}, @dev={0xac, 0x14, 0x14, 0x28}, @empty, 0xff}}, @TCA_NAT_PARMS={0x28, 0x1, {{0xed, 0x5, 0x5, 0x9, 0x2}, @private=0xa010101, @empty, 0xffffffff}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x1, 0x7ff, 0x3, 0x1000, 0x3}, @empty, @remote, 0xffffffff}}]}, {0x92, 0x6, "af1c05ac9d7a9669c9add8861e28017d96061bb10c945c8b9614e65d589e53a11f145876f6d290ab549d841cd725acbb8146ae8eec139ee7c9d75bd147f314c326aedde869618d2e302caa3f54b407a1361358c7eb67456f3dbd848fb1d4a15cc17ea28e1b92885f6d11a73637bebca39217a0f88f61f312529ee92fcaaa8738eb762829e270c6db4c7b51dff9ac"}, {0xc}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ctinfo={0x10c, 0x1e, 0x0, 0x0, {{0xb}, {0x5c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x8}, @TCA_CTINFO_ACT={0x18, 0x3, {0x8, 0x3, 0x5, 0x8001, 0x2}}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0xffffffff}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x200}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x8000}, @TCA_CTINFO_ACT={0x18, 0x3, {0x3, 0x4, 0x6, 0x27c, 0x6}}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x9}]}, {0x87, 0x6, "bb98d5b76649c9501a4e7ae1a61d6867f43db99757ab241d11d709fc320655a5b268bd2580678a63e67f3f23ac789983adfb524c468eab823cd20bea0c160d7a694b343f336638bd10c43f5d629ba6858f5cf41a93a1e29ec65b1570dffb6426605d75b4314fa3c1ff5f481d57cb15e67de0c07360133db36c50827ae196c803825911"}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_skbedit={0x84, 0x3, 0x0, 0x0, {{0xc}, {0x34, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x5, 0x4}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x1, 0x90a, 0xb9cfb8c82bb06638, 0x7, 0x7}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x3}]}, {0x25, 0x6, "9942d8ea8009deaeda657023cac9fefbc709c4f03574219e997d7ca0ff1972b04c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_nat={0xf4, 0x5, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x2, 0xca10, 0xffffffffffffffff, 0x8, 0xce}, @multicast2, @multicast1, 0xff, 0x1}}]}, {0xa3, 0x6, "3a7f81d7d614fc81f9214514cf25ad1133d630c6fbb12b382eede22c501385f7ce71a95de3bdd527fb129a797cffa78371875a4658846bbf23a0ead85defa4c318b1eb4e8e3009fd9b60dd4b4728635cdbf73c23ccfb50fca5c4e7743b1fe2862be32722f7e874f61d6f347a5fd58fa88210f08cbcf741581f389334b738fc31de8e86220a47482928e06f723579ef19315538de51fef4c5a8fa28c2628955"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1}}}}, @m_gact={0x80, 0x1a, 0x0, 0x0, {{0x9}, {0x4c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x40, 0xa, 0x0, 0x4, 0x7}}, @TCA_GACT_PARMS={0x18, 0x2, {0x3, 0x400, 0x0, 0x8, 0x7}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0xdef, 0x7e648b2a84e00007}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0x16ef, 0xffffffffffffffff}}]}, {0xa, 0x6, "52fd50760a99"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3}}}}]}, @TCA_BASIC_CLASSID={0x8, 0x1, {0xf, 0xffe0}}]}}]}, 0x2b54}, 0x1, 0x0, 0x0, 0x8810}, 0x8000) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x38, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x9, 0x4}, {}, {0x7, 0x6}}, [@filter_kind_options=@f_basic={{0xa}, {0x8, 0x2, [@TCA_BASIC_EMATCHES={0x4}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) getsockname$tipc(r3, &(0x7f0000000000), &(0x7f0000000040)=0x10) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r2, 0x81f8943c, &(0x7f0000000680)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_WAIT_SYNC(r4, 0x40089416, &(0x7f0000000640)=r9) 1m19.262153949s ago: executing program 0 (id=13666): socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) faccessat2(0xffffffffffffffff, 0x0, 0x44, 0x1000) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0xfffff5d4}}, './file0\x00'}) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000003c0)=0x4) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a7c000000000a050000000000000000000500000065004b0600c569bc800117f32f00858527ad959e2a8fdf4cacfefd920f1b9c5ef9a73dda6be0807a0a58c9560468a181e2d8d89c6abc7235466bd6833c29bc7a1316ae55be810ce14265790e30da6141d1e16556d494edd28202145f0853111d32d955389a460000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a30000000002c000000060a01040000000000000000050000000800010073797a3000dfffff0800010073797a3000000000140000001100010000000000000000000000000a"], 0xfc}}, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$unix(0x1, 0x1, 0x0) listen(r3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000000)={0x7, 0xd44, 0x6}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r5, 0x100000) clock_gettime(0x0, 0x0) pselect6(0x40, &(0x7f0000000080)={0x5, 0x3, 0x248, 0x5d92, 0x9, 0x1ce, 0x7fff, 0x2}, &(0x7f00000000c0)={0x6, 0x1, 0x8000006, 0x2, 0xcf69, 0x5, 0x6, 0x1}, &(0x7f0000000140)={0x3ff, 0x80, 0x5, 0x0, 0x101, 0xafc2, 0x5, 0x1}, &(0x7f00000001c0), &(0x7f0000000280)={&(0x7f0000000240)={[0x1000, 0x8]}, 0x8}) r6 = fsopen(&(0x7f0000000040)='rpc_pipefs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x0) 1m18.121455223s ago: executing program 0 (id=13668): r0 = socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x1e) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000080)='./file0\x00') unlink(&(0x7f00000002c0)='./file0\x00') link(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000000)='./file0\x00') mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c00, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) mount(&(0x7f0000000000)=@sr0, 0x0, &(0x7f00000000c0)='ufs\x00', 0x81, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = openat$drirender128(0xffffff9c, &(0x7f0000000000), 0x48000, 0x0) ioctl$DRM_IOCTL_GET_CAP(r2, 0xc010640c, &(0x7f0000000080)={0x4}) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="010027bd7000ffdbdf2570000000"], 0x14}, 0x1, 0x0, 0x0, 0x44100}, 0x4000000) r3 = accept4(r0, 0x0, 0x0, 0x80000) r4 = syz_open_dev$loop(&(0x7f0000000100), 0x18bdb, 0x325967a866143452) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000002c0)={r5, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0xd, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0x7fff]}}) ioctl$LOOP_SET_DIRECT_IO(r4, 0x4c08, 0x7fffffffffffffff) capset(&(0x7f00000002c0)={0x19980330}, &(0x7f0000000300)={0x2, 0x2, 0x2, 0xfffffffa, 0x5, 0xc72}) mq_open(&(0x7f0000000000)='::%\x00', 0x40, 0x80, &(0x7f00000000c0)={0x1, 0x4c, 0x76}) recvmmsg(r3, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee7, 0x8031, 0xffffffffffffffff, 0x0) r6 = openat$btrfs_control(0xffffff9c, &(0x7f0000000080), 0x640040, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000100)=0x0) quotactl_fd$Q_GETQUOTA(r6, 0xffffffff80000702, r7, &(0x7f0000000480)) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000480)={{{@in6=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={""/10, ""/2, @broadcast}}, 0x0, @in=@dev}}, &(0x7f0000000580)=0xe4) r9 = geteuid() mount$9p_rdma(&(0x7f0000000240), &(0x7f0000000400)='\x00', &(0x7f0000000440), 0x2, &(0x7f00000005c0)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@sq={'sq', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0x94}}, {@rq={'rq', 0x3d, 0x5}}, {@sq={'sq', 0x3d, 0x9d7}}, {@rq={'rq', 0x3d, 0x1}}], [{@euid_eq={'euid', 0x3d, r7}}, {@fowner_gt={'fowner>', r8}}, {@euid_lt}, {@uid_gt={'uid>', 0xee00}}, {@defcontext={'defcontext', 0x3d, 'system_u'}}, {@uid_lt={'uid<', r9}}, {@dont_hash}, {@seclabel}, {@subj_user={'subj_user', 0x3d, '*'}}, {@audit}]}}) 1m17.210449879s ago: executing program 0 (id=13672): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000000080008d804dd0000000000000109022400010000a008090400fe01030001000921fffffd0122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000080)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x40402) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f00000001c0)={0x0, 0x9, 0x1, 0x0}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000001c0)="00940a37", 0x4) sendto$unix(r3, &(0x7f0000000440)="36d9a32e92c131d730b1abaedb51eb66fd2d5b1f7eda4f0e859fdaf294bad70673813533d8bf1c6a77b65a7afdc01b29e73571071a68d5def5d7df839810da130b9348f4d9d407eb478d5bfb298c552a498271af70914e14ba9476fd2a0e47984c25ea20afab3064a748add27a7149e9c4705475bda2ecec9ec30214f28c5e16fd3f50f604f20232c534409e52bff64fc6ca0f5e254083aec2794b7216e002e87caf3d0fa7d04ff9e3b03e81595a04979594ff6ea888bf13de8e8f74c6178e31e47593732ae1a501ad3641d423195a788efdb643f50a8c8b9794a62f7b8dfa0fa7da9d391b92ce2a7f9fe0f9d584a3775f", 0x703d59595f6742a8, 0x800, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = syz_open_dev$sndctrl(&(0x7f0000001a00), 0x7f, 0x303e43) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r4, 0xc1205531, &(0x7f0000001a40)={0x1, 0x8, 0x5, 0x99e, '\x00', '\x00', '\x00', 0x5, 0x5, 0x7, 0x9, "0000000086f7ffffff0000000800"}) llistxattr(0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000040)={{0x1, 0x1, 0x18, r4}, './file0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f00000000c0)={0xa, 0x3, 0x1, 'queue1\x00', 0x8}) 1m16.906250081s ago: executing program 0 (id=13674): creat(0x0, 0x0) r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8, 0x12, r0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000001580), 0x1041, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r1, 0x400c330d, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_J1939_PROMISC(0xffffffffffffffff, 0x6b, 0x2, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) symlinkat(&(0x7f00000000c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') symlinkat(&(0x7f0000000280)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', 0x0, 0x4008, 0x0) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/partitions\x00', 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, 0x0, &(0x7f0000000100)) openat$cgroup_int(0xffffffffffffffff, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x40810}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008011}, 0x4004) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x2, 0x1000, 0xfffffffd}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x1, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0x16}}}, &(0x7f0000000280)=0x0) syz_ublk_setup_queues(r6, r11, &(0x7f00000005c0)={0x0, 0x1460, 0x10, 0x3, 0x1b2}, &(0x7f00000002c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xca33, 0x0, 0x6, 0x273, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1e3c, 0x400, 0x9, 0x102, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf39, 0x1000, 0x3, 0x102c4, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2e84, 0x1000, 0x2, 0x29f, 0x0, r6}}], 0x4, &(0x7f0000001540)={0x2e, 0x5c, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x6}, 0x0, r10, '\x00', {0x1, 0x48a, 0x0, 0x0}}, 0x0) 1m16.628049202s ago: executing program 32 (id=13674): creat(0x0, 0x0) r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8, 0x12, r0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000001580), 0x1041, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r1, 0x400c330d, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_J1939_PROMISC(0xffffffffffffffff, 0x6b, 0x2, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) symlinkat(&(0x7f00000000c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') symlinkat(&(0x7f0000000280)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', 0x0, 0x4008, 0x0) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/partitions\x00', 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, 0x0, &(0x7f0000000100)) openat$cgroup_int(0xffffffffffffffff, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x40810}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008011}, 0x4004) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x2, 0x1000, 0xfffffffd}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x1, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0x16}}}, &(0x7f0000000280)=0x0) syz_ublk_setup_queues(r6, r11, &(0x7f00000005c0)={0x0, 0x1460, 0x10, 0x3, 0x1b2}, &(0x7f00000002c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xca33, 0x0, 0x6, 0x273, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1e3c, 0x400, 0x9, 0x102, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf39, 0x1000, 0x3, 0x102c4, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2e84, 0x1000, 0x2, 0x29f, 0x0, r6}}], 0x4, &(0x7f0000001540)={0x2e, 0x5c, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x6}, 0x0, r10, '\x00', {0x1, 0x48a, 0x0, 0x0}}, 0x0) 6.170136463s ago: executing program 2 (id=13950): socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) faccessat2(0xffffffffffffffff, 0x0, 0x44, 0x1000) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0xfffff5d4}}, './file0\x00'}) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000003c0)=0x4) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a7c000000000a050000000000000000000500000065004b0600c569bc800117f32f00858527ad959e2a8fdf4cacfefd920f1b9c5ef9a73dda6be0807a0a58c9560468a181e2d8d89c6abc7235466bd6833c29bc7a1316ae55be810ce14265790e30da6141d1e16556d494edd28202145f0853111d32d955389a460000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a30000000002c000000060a01040000000000000000050000000800010073797a3000dfffff0800010073797a3000000000140000001100010000000000000000000000000a"], 0xfc}}, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$unix(0x1, 0x1, 0x0) listen(r3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000000)={0x7, 0xd44, 0x6}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r5, 0x100000) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000080)={0x5, 0x3, 0x248, 0x5d92, 0x9, 0x1ce, 0x7fff, 0x2}, 0x0, &(0x7f0000000140)={0x3ff, 0x80, 0x5, 0x0, 0x101, 0xafc2, 0x5, 0x1}, &(0x7f00000001c0)={r6, r7+60000000}, &(0x7f0000000280)={&(0x7f0000000240)={[0x1000, 0x8]}, 0x8}) fsopen(&(0x7f0000000040)='rpc_pipefs\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x0) 5.727709527s ago: executing program 4 (id=13954): timer_create(0x7, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) unshare(0x6020400) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = eventfd2(0xe5c, 0x80000) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000040)={r3, 0x1, 0x2}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x7, 0x6}) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x8001}, 0x4) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', 0x0, &(0x7f0000000280), 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_TP_METER(r4, &(0x7f0000003140)={0x0, 0x0, &(0x7f0000003100)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES16, @ANYBLOB="01002bbd700001dcdf25020000050a000900ffffffffffff000008000300", @ANYRES32=r4], 0x30}, 0x1, 0x0, 0x0, 0x20000050}, 0x20000884) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r5, 0x40045532, &(0x7f0000000040)=0x3) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000980)=@newae={0x64, 0x1e, 0x1, 0x70bd2a, 0x25dfdbfb, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4d6, 0xa, 0xff}, @in=@remote, 0x1, 0x3502}, [@lifetime_val={0x24, 0x9, {0xdda8, 0x735, 0x2, 0x2}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20004000}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e0000000400000008"], 0x48) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x14b000) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x0, 0x0) 5.295423459s ago: executing program 4 (id=13955): timer_create(0x7, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) unshare(0x6020400) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = eventfd2(0x42000006, 0x801) r4 = eventfd2(0xe5c, 0x80000) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000040)={r4, 0x1, 0x2, r3}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x7, 0x6}) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x8001}, 0x4) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', &(0x7f0000000240)=@FILEID_UDF_WITH_PARENT={0x14}, &(0x7f0000000280), 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000003140)={0x0, 0x0, &(0x7f0000003100)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002bbd700001dcdf25020000050a000900ffffffffffff000008000300", @ANYRES32=r5], 0x30}, 0x1, 0x0, 0x0, 0x20000050}, 0x20000884) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r7 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r7, 0x40045532, &(0x7f0000000040)=0x3) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000980)=@newae={0x64, 0x1e, 0x1, 0x70bd2a, 0x25dfdbfb, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4d6, 0xa, 0xff}, @in=@remote, 0x1, 0x3502}, [@lifetime_val={0x24, 0x9, {0xdda8, 0x735, 0x2, 0x2}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20004000}, 0x20) bpf$MAP_CREATE(0x0, 0x0, 0x48) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x14b000) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x0, 0x0) 5.019939737s ago: executing program 2 (id=13956): mount(0x0, &(0x7f0000000200)='./my_configfs\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./my_configfs/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./my_configfs/usb_gadget/g1\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) chdir(&(0x7f0000000b00)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='control/header/h\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='streaming/header/h\x00', 0x1ff) symlink(&(0x7f0000001000)='control/header/h\x00', &(0x7f0000001100)='control/class/fs/h\x00') symlink(&(0x7f0000001400)='streaming/uncompressed/u\x00', 0x0) symlink(&(0x7f0000001600)='streaming/header/h\x00', &(0x7f0000001700)='streaming/class/fs/h\x00') symlink(0x0, &(0x7f0000001900)='streaming/class/hs/h\x00') mount$binder(0x0, &(0x7f0000000040)='control/header/h\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}], [{@subj_type={'subj_type', 0x3d, 'configfs\x00'}}]}) symlink(0x0, &(0x7f0000001b00)='streaming/class/ss/h\x00') r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002100), 0x2, 0x0) r2 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d1d7a440041601801f44010203010902120001000000000904"], 0x0) syz_open_dev$sndctrl(&(0x7f0000000240), 0xdc3, 0x143000) syz_usb_disconnect(r2) close_range(r1, 0xffffffffffffffff, 0x0) fchdir(r0) symlink(&(0x7f0000001c00)='functions/uvc.usb0\x00', &(0x7f0000001d00)='configs/c.1/uvc.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000001e00)='UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000001f00)='usbip-vudc.0', 0xc) 4.786421704s ago: executing program 4 (id=13959): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x10040) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f00000002c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x3d, 0x28, 0x69, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1\x00', 0x1) write(0xffffffffffffffff, &(0x7f0000000140)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1\x00', 0x1) fsopen(&(0x7f0000000180)='gfs2meta\x00', 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000140)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x6c, 0xfffe, 0x0, 0x95, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x16, 0x20, 0xb, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x6, 0x7}, @md5sig={0x13, 0x12, "a16dc34416fcb1917fdf02dd82bbfc0e"}, @timestamp={0x8, 0xa, 0xffff, 0x3}, @mptcp=@mp_fclose={0x1e, 0xc, 0x4, 0x0, 0x6}, @mptcp=@synack={0x1e, 0x10, 0x7, 0x2, 0x80, 0x101, 0x4}]}}}}}}}, 0x0) 4.186429547s ago: executing program 4 (id=13961): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_POWER_SAVE(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)={0x24, r3, 0x1, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x40810) sendmsg$NL80211_CMD_START_P2P_DEVICE(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f0000000200)={0x1c, r1, 0x400, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @void}}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1000}, 0x88c5) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0xfc, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_TX_RATES={0xe0, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x44, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x18, 0x2, [{0x1}, {0x5, 0x3}, {0x6, 0x6}, {0x4, 0x6}, {0x3, 0x5}, {0x2, 0x2}, {0x0, 0x7}, {0x4, 0x7}, {0x3, 0x4}, {0x4, 0x5}, {0x0, 0x5}, {0x7, 0x8}, {0x0, 0x3}, {0x0, 0xa}, {0x5, 0x9}, {0x2, 0x7}, {0x4, 0x1}, {0x3, 0xa}, {0x2, 0x6}, {0x3, 0x2}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0xf, 0x2, [{0x0, 0x3}, {0x7, 0x9}, {0x5, 0x6}, {0x0, 0x8}, {0x6, 0x1}, {0x3, 0x7}, {0x2, 0x6}, {0x5, 0x7}, {}, {0x2, 0x2}, {0x0, 0x5}]}, @NL80211_TXRATE_HT={0x5, 0x2, [{0x4, 0x2}]}]}, @NL80211_BAND_6GHZ={0x98, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x9, 0x2, [{0x5, 0x6}, {0x2}, {0x0, 0x6}, {0x6, 0x1}, {0x4}]}, @NL80211_TXRATE_LEGACY={0x6, 0x1, [0x3, 0x2]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7e, 0x12ce, 0x400, 0x1f6, 0x6, 0x7, 0x3, 0x9]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x8, 0x5, 0x2, 0x80, 0x2, 0x9, 0x9]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_LEGACY={0x17, 0x1, [0x9, 0x4, 0x16, 0xb, 0x16, 0x6, 0x18, 0x12, 0x0, 0x0, 0x3, 0x0, 0x48, 0x16, 0x30, 0x3, 0x16, 0x18, 0x18]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x3, 0x7, 0xffff, 0x200, 0x0, 0x5, 0xfffa]}}, @NL80211_TXRATE_HT={0x11, 0x2, [{0x5, 0x4}, {0x3, 0x9}, {0x1, 0xa}, {0x1, 0x9}, {0x4, 0x6}, {0x6, 0x2}, {0x0, 0x2}, {0x7, 0x5}, {0x3, 0x5}, {0x7, 0x8}, {0x3, 0xa}, {0x2, 0x2}, {0x2, 0x4}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}]}]}, 0xfc}}, 0x0) 4.070210499s ago: executing program 4 (id=13963): timer_create(0x7, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) unshare(0x6020400) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = eventfd2(0x42000006, 0x801) r4 = eventfd2(0xe5c, 0x80000) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000040)={r4, 0x1, 0x2, r3}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x7, 0x6}) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x8001}, 0x4) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', &(0x7f0000000240)=@FILEID_UDF_WITH_PARENT={0x14}, &(0x7f0000000280), 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000003140)={0x0, 0x0, &(0x7f0000003100)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002bbd700001dcdf25020000050a000900ffffffffffff000008000300", @ANYRES32=r5], 0x30}, 0x1, 0x0, 0x0, 0x20000050}, 0x20000884) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r7 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r7, 0x40045532, &(0x7f0000000040)=0x3) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000980)=@newae={0x64, 0x1e, 0x1, 0x70bd2a, 0x25dfdbfb, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4d6, 0xa, 0xff}, @in=@remote, 0x1, 0x3502}, [@lifetime_val={0x24, 0x9, {0xdda8, 0x735, 0x2, 0x2}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20004000}, 0x20) bpf$MAP_CREATE(0x0, 0x0, 0x48) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x14b000) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x0, 0x0) 3.77985795s ago: executing program 1 (id=13965): socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) faccessat2(0xffffffffffffffff, 0x0, 0x44, 0x1000) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0xfffff5d4}}, './file0\x00'}) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000003c0)=0x4) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a7c000000000a050000000000000000000500000065004b0600c569bc800117f32f00858527ad959e2a8fdf4cacfefd920f1b9c5ef9a73dda6be0807a0a58c9560468a181e2d8d89c6abc7235466bd6833c29bc7a1316ae55be810ce14265790e30da6141d1e16556d494edd28202145f0853111d32d955389a460000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a30000000002c000000060a01040000000000000000050000000800010073797a3000dfffff0800010073797a3000000000140000001100010000000000000000000000000a"], 0xfc}}, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$unix(0x1, 0x1, 0x0) listen(r3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000000)={0x7, 0xd44, 0x6}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r5, 0x100000) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000080)={0x5, 0x3, 0x248, 0x5d92, 0x9, 0x1ce, 0x7fff, 0x2}, 0x0, &(0x7f0000000140)={0x3ff, 0x80, 0x5, 0x0, 0x101, 0xafc2, 0x5, 0x1}, &(0x7f00000001c0)={r6, r7+60000000}, &(0x7f0000000280)={&(0x7f0000000240)={[0x1000, 0x8]}, 0x8}) fsopen(&(0x7f0000000040)='rpc_pipefs\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x0) 3.589706557s ago: executing program 2 (id=13966): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = mq_open(&(0x7f0000000000)='!selinu\xff\x7f\x00\x00inux\x00T\x8b\xb5\xf3\xcb\xdd\xe3\xbf2\x86\x01\x84\xdd\x8a\x8f_l\xa1L\xb1\xef\xb2\xc9\xf7+C\xb2\x8e9\xb8\xec\x1a\xe5\xaeq\x8fZ\xff\xbcY+\xaf0<\xa3\xb8\"Zm\x1c\x18\x11\x93\xb5z \xc2\x8b\xa9\xc5\x9es\t\xfe\x002\xa0-\xaf\xcdP\x9f\xe5Iv\xce*\xa8\xa3\x14i\x05\x8f\x9b\x1eB\x9f\x9d#E\x19\xdc\xfe\xc7\xeb\xb5\xcd\xc8\xe2U\xce\x00\x00', 0x6e93ebbbcc0884f2, 0x2c, &(0x7f0000000300)={0x0, 0x1, 0x3}) mq_timedsend(r0, 0x0, 0x0, 0x0, 0x0) set_mempolicy(0x1, 0x0, 0x3) mq_timedsend(r0, 0x0, 0x0, 0xa, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001440)={&(0x7f0000000080)=ANY=[@ANYBLOB="9f0b00001800aeab7abebc823a1a7d79e10000000000000000000000000000020000000000"], &(0x7f0000000440)=""/4096, 0x1a, 0x1000, 0x0, 0x71f9, 0x10000}, 0x28) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000036c0)={0x19, 0x3, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @cgroup_sockopt=0x15, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r3, &(0x7f0000000a00)={'syz1\x00', {0x6ec9, 0x7, 0x5, 0x5}, 0x3e, [0x9, 0x5, 0x8, 0x2, 0x5334, 0x400, 0x80000000, 0x8ef7, 0x8, 0x0, 0x6, 0xf5, 0x5, 0x39, 0x747d5a16, 0x8, 0xfffffb9a, 0xfffffffc, 0x4, 0xfffffffb, 0x4, 0x3, 0x4, 0xf252, 0x1, 0x800, 0x300000, 0x7, 0xe, 0x5, 0x0, 0x0, 0x1ff, 0x8000, 0x3ff, 0x3, 0xd, 0x3, 0x6, 0x1000, 0x2, 0x200, 0x2, 0x400008, 0x8, 0x4, 0x2, 0x7, 0x40, 0x1009, 0x1, 0x199f, 0x8, 0x2, 0x9, 0x1, 0x4, 0x6, 0x1000, 0x5, 0x40, 0x9, 0x7, 0x5], [0x6, 0x1e, 0x3, 0x8000, 0xfffffffe, 0x3, 0x0, 0x5, 0x27, 0xfffffffc, 0x4, 0x7fff, 0x72c, 0x1c32, 0x3, 0x9, 0x10000, 0x400, 0x8001, 0x3, 0x1, 0x294, 0x5, 0x0, 0x981, 0x4, 0xfd, 0x3ff, 0x0, 0xfffffffe, 0x0, 0x1000001, 0x10, 0xfffffff9, 0x0, 0x5, 0x1, 0xffffffff, 0x6, 0x5, 0x800, 0xf6, 0x6, 0x96, 0xbffffffd, 0x101, 0x0, 0x2, 0x1, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0xb, 0x6, 0x2, 0x400001, 0x3, 0x8, 0x6, 0x200, 0x3], [0x3fd, 0xc584, 0x34711b8a, 0xcd4, 0xffff, 0x20, 0x4, 0x6, 0x8, 0x10, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x8, 0x3, 0x1000, 0x2, 0xe, 0x1, 0xfffffff9, 0xe55, 0x10, 0x80000001, 0x4, 0x4, 0x1000007, 0x9, 0x2, 0x20000005, 0x7d, 0x9, 0xb, 0x47, 0x2, 0x3, 0x4, 0x207, 0x6d7e, 0x3, 0x8, 0x8001, 0xbf23, 0x6, 0x8, 0x95a, 0xffffffff, 0x4, 0x3, 0x6, 0x100fffd, 0x2005, 0x7, 0x4, 0xea, 0x9, 0x5, 0x2, 0xd9, 0x0, 0x7ff, 0x401, 0x7], [0x108e, 0x7fff, 0x3, 0x3, 0x88, 0x2, 0x6, 0x1, 0x40, 0x2, 0x763, 0xb, 0x8000402, 0x800, 0x2, 0x1000, 0x7f, 0x4000008, 0x3fa6, 0x4, 0x8e8, 0x5, 0x9, 0x4, 0xe47, 0x4, 0x0, 0x4, 0x200, 0x1000, 0x3b, 0x2, 0x5, 0x800, 0xa809, 0x65f413f9, 0x4, 0x8, 0x8a8, 0x2, 0x40, 0x7, 0x2, 0x4, 0x4, 0x10, 0x0, 0x0, 0x7fff, 0x1, 0xfffffff8, 0x402, 0x1, 0x200, 0x7, 0x4edf, 0xfefffffd, 0x4, 0xe, 0x2, 0xe, 0x11, 0x133, 0x2]}, 0x45c) ioctl$UI_DEV_CREATE(r3, 0x5501) readv(r3, &(0x7f00000005c0)=[{0x0}, {&(0x7f00000003c0)=""/138, 0x8a}], 0x2) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=@newtaction={0x6c, 0x30, 0x51b, 0x0, 0x0, {}, [{0x58, 0x1, [@m_skbmod={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24}]}, {0x4, 0x14}, {0xc}, {0xc, 0x6}}}]}]}, 0x6c}}, 0x0) setsockopt$SO_J1939_PROMISC(r4, 0x6b, 0x2, &(0x7f0000000100), 0x4) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001600)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7f, '\x00', 0x0, r1, 0x0, 0x1}, 0x50) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@cgroup=r6, 0x2f, 0x0, 0x0, &(0x7f0000000240)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001680)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x0, '\x00', 0x0, r1, 0x2, 0x2}, 0x50) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r9 = dup(r8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r9, 0x0) ioctl$BLKZEROOUT(r9, 0x127f, &(0x7f0000000240)={0xf400, 0x1000000}) bpf$PROG_LOAD(0x5, &(0x7f0000001740)={0x10, 0x12, &(0x7f0000000200)=@raw=[@printk={@x, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}}, @func, @tail_call, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x7}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x6}], &(0x7f00000002c0)='GPL\x00', 0x9, 0x81, &(0x7f0000001480)=""/129, 0x40f00, 0x3, '\x00', 0x0, @fallback=0x1d, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001540)={0x3, 0x3, 0x2000, 0x8}, 0x10, 0x0, r2, 0x0, &(0x7f0000001700)=[0xffffffffffffffff, r2, r5, r6, r7, r9, 0x1], 0x0, 0x10, 0x4}, 0x94) 3.22922098s ago: executing program 3 (id=13967): socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) faccessat2(0xffffffffffffffff, 0x0, 0x44, 0x1000) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0xfffff5d4}}, './file0\x00'}) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000003c0)=0x4) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a7c000000000a050000000000000000000500000065004b0600c569bc800117f32f00858527ad959e2a8fdf4cacfefd920f1b9c5ef9a73dda6be0807a0a58c9560468a181e2d8d89c6abc7235466bd6833c29bc7a1316ae55be810ce14265790e30da6141d1e16556d494edd28202145f0853111d32d955389a460000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a30000000002c000000060a01040000000000000000050000000800010073797a3000dfffff0800010073797a3000000000140000001100010000000000000000000000000a"], 0xfc}}, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$unix(0x1, 0x1, 0x0) listen(r3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000000)={0x7, 0xd44, 0x6}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r5, 0x100000) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000080)={0x5, 0x3, 0x248, 0x5d92, 0x9, 0x1ce, 0x7fff, 0x2}, 0x0, &(0x7f0000000140)={0x3ff, 0x80, 0x5, 0x0, 0x101, 0xafc2, 0x5, 0x1}, &(0x7f00000001c0)={r6, r7+60000000}, &(0x7f0000000280)={&(0x7f0000000240)={[0x1000, 0x8]}, 0x8}) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x0) 2.768755773s ago: executing program 1 (id=13968): timer_create(0x7, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) unshare(0x6020400) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = eventfd2(0xe5c, 0x80000) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000040)={r3, 0x1, 0x2}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x7, 0x6}) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', &(0x7f0000000240)=@FILEID_UDF_WITH_PARENT={0x14}, &(0x7f0000000280), 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_TP_METER(r4, &(0x7f0000003140)={0x0, 0x0, &(0x7f0000003100)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="01002bbd700001dcdf25020000050a000900ffffffffffff000008000300", @ANYRES32=r4], 0x30}, 0x1, 0x0, 0x0, 0x20000050}, 0x20000884) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r5, 0x40045532, &(0x7f0000000040)=0x3) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000980)=@newae={0x64, 0x1e, 0x1, 0x70bd2a, 0x25dfdbfb, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4d6, 0xa, 0xff}, @in=@remote, 0x1, 0x3502}, [@lifetime_val={0x24, 0x9, {0xdda8, 0x735, 0x2, 0x2}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20004000}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e0000000400000008"], 0x48) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x14b000) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x0, 0x0) 2.559964567s ago: executing program 1 (id=13969): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fe80000000000000000000000000003bfe8000000000000000000000000000aa0000000000000c9c0a00103000000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000000000000007f00000000000000070200000000000003000000000000000000000000000000fdffffffffffffff0500000000000000ffffffffffffffffffffffff00000000000000000000000000000000000000000500000000000000000000000000000001010200"], 0xb8}, 0x1, 0x0, 0x0, 0x84811}, 0x0) ioctl$SW_SYNC_IOC_INC(0xffffffffffffffff, 0x40045701, &(0x7f0000000180)=0xffffffff) msgget$private(0x0, 0x400) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, 0x0, 0x0) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0xe7b, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x7) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r7 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000440)) keyctl$get_persistent(0x16, 0x0, r7) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_GET(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x2c, r9, 0x1, 0x70bd2d, 0x0, {0x1b}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x2c}}, 0x0) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f0000000140)={0x60, 0x3, &(0x7f0000001000/0x3000)=nil, &(0x7f0000f5a000/0x2000)=nil, 0x2, 0x0, 0x0, 0xdff, 0x3e, 0x0, 0x2, 0x54}) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000140)=@IORING_OP_MKDIRAT={0x25, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x64}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 2.375719013s ago: executing program 4 (id=13970): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000240)={0x1, 0x1, 0x0, &(0x7f0000000200)=""/51, 0x0}) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000340)) r1 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000080), 0x3, 0x8ac02) r2 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000080)) io_uring_enter(r2, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) syz_usb_disconnect(r1) 2.32153833s ago: executing program 3 (id=13971): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_POWER_SAVE(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)={0x24, r3, 0x1, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x40810) sendmsg$NL80211_CMD_START_P2P_DEVICE(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f0000000200)={0x1c, r1, 0x400, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @void}}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1000}, 0x88c5) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0xfc, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_TX_RATES={0xe0, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x44, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x18, 0x2, [{0x1}, {0x5, 0x3}, {0x6, 0x6}, {0x4, 0x6}, {0x3, 0x5}, {0x2, 0x2}, {0x0, 0x7}, {0x4, 0x7}, {0x3, 0x4}, {0x4, 0x5}, {0x0, 0x5}, {0x7, 0x8}, {0x0, 0x3}, {0x0, 0xa}, {0x5, 0x9}, {0x2, 0x7}, {0x4, 0x1}, {0x3, 0xa}, {0x2, 0x6}, {0x3, 0x2}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0xf, 0x2, [{0x0, 0x3}, {0x7, 0x9}, {0x5, 0x6}, {0x0, 0x8}, {0x6, 0x1}, {0x3, 0x7}, {0x2, 0x6}, {0x5, 0x7}, {}, {0x2, 0x2}, {0x0, 0x5}]}, @NL80211_TXRATE_HT={0x5, 0x2, [{0x4, 0x2}]}]}, @NL80211_BAND_6GHZ={0x98, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x9, 0x2, [{0x5, 0x6}, {0x2}, {0x0, 0x6}, {0x6, 0x1}, {0x4}]}, @NL80211_TXRATE_LEGACY={0x6, 0x1, [0x3, 0x2]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7e, 0x12ce, 0x400, 0x1f6, 0x6, 0x7, 0x3, 0x9]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x8, 0x5, 0x2, 0x80, 0x2, 0x9, 0x9]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_LEGACY={0x17, 0x1, [0x9, 0x4, 0x16, 0xb, 0x16, 0x6, 0x18, 0x12, 0x0, 0x0, 0x3, 0x0, 0x48, 0x16, 0x30, 0x3, 0x16, 0x18, 0x18]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x3, 0x7, 0xffff, 0x200, 0x0, 0x5, 0xfffa]}}, @NL80211_TXRATE_HT={0x11, 0x2, [{0x5, 0x4}, {0x3, 0x9}, {0x1, 0xa}, {0x1, 0x9}, {0x4, 0x6}, {0x6, 0x2}, {0x0, 0x2}, {0x7, 0x5}, {0x3, 0x5}, {0x7, 0x8}, {0x3, 0xa}, {0x2, 0x2}, {0x2, 0x4}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}]}]}, 0xfc}}, 0x0) 2.250055015s ago: executing program 3 (id=13972): socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) faccessat2(0xffffffffffffffff, 0x0, 0x44, 0x1000) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0xfffff5d4}}, './file0\x00'}) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000003c0)=0x4) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a7c000000000a050000000000000000000500000065004b0600c569bc800117f32f00858527ad959e2a8fdf4cacfefd920f1b9c5ef9a73dda6be0807a0a58c9560468a181e2d8d89c6abc7235466bd6833c29bc7a1316ae55be810ce14265790e30da6141d1e16556d494edd28202145f0853111d32d955389a460000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a30000000002c000000060a01040000000000000000050000000800010073797a3000dfffff0800010073797a3000000000140000001100010000000000000000000000000a"], 0xfc}}, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$unix(0x1, 0x1, 0x0) listen(r3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000000)={0x7, 0xd44, 0x6}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r5, 0x100000) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000080)={0x5, 0x3, 0x248, 0x5d92, 0x9, 0x1ce, 0x7fff, 0x2}, 0x0, &(0x7f0000000140)={0x3ff, 0x80, 0x5, 0x0, 0x101, 0xafc2, 0x5, 0x1}, &(0x7f00000001c0)={r6, r7+60000000}, &(0x7f0000000280)={&(0x7f0000000240)={[0x1000, 0x8]}, 0x8}) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x0) 2.120863006s ago: executing program 2 (id=13973): timer_create(0x7, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) unshare(0x6020400) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = eventfd2(0xe5c, 0x80000) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000040)={r3, 0x1, 0x2}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x7, 0x6}) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x8001}, 0x4) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', 0x0, &(0x7f0000000280), 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_TP_METER(r4, &(0x7f0000003140)={0x0, 0x0, &(0x7f0000003100)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES16, @ANYBLOB="01002bbd700001dcdf25020000050a000900ffffffffffff000008000300", @ANYRES32=r4], 0x30}, 0x1, 0x0, 0x0, 0x20000050}, 0x20000884) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r5, 0x40045532, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000980)=@newae={0x64, 0x1e, 0x1, 0x70bd2a, 0x25dfdbfb, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4d6, 0xa, 0xff}, @in=@remote, 0x1, 0x3502}, [@lifetime_val={0x24, 0x9, {0xdda8, 0x735, 0x2, 0x2}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20004000}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e0000000400000008"], 0x48) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x14b000) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x0, 0x0) 1.62439701s ago: executing program 1 (id=13974): ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0) write(0xffffffffffffffff, &(0x7f0000000240), 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$nci(0xffffffffffffffff, 0x0, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000500)={0x9, 0x6, 0x5, 0x80000001}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000540)='.\x00', 0x850003d1) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x393}, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000140)) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000480)={0x0, 0x18e2, 0x10000, 0x0, 0x1d2}, &(0x7f0000002680)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb656, 0x200, 0x5, 0x41}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x216, 0x0, 0x2, 0x19b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb6d4, 0x1, 0x1, 0x252}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xeaff, 0x800, 0x0, 0x231}}], 0x4, &(0x7f0000003900)={0x2e, 0x62, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb66, 0x0, 0x0}}, 0x0) syslog(0x3, &(0x7f0000000000)=""/112, 0x70) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0xc, 0x10, &(0x7f0000000a40)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000006b8a00fe00000000c7080000010000007b8af0ff00000000bda100000000000007000000f8ffffffbfa400000000000007040000f0ffffffb7020000080000fa18230000", @ANYRES32, @ANYBLOB="0000000000000000b704000008000000850000001a00000095"], &(0x7f00000008c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.396311165s ago: executing program 1 (id=13975): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/locks\x00', 0x0, 0x0) preadv(r1, &(0x7f0000000100)=[{&(0x7f0000000540)=""/227, 0xb5}], 0x1, 0x1bf, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r2, 0x400, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2040, 0x0) fcntl$getflags(r3, 0x401) openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) socket$xdp(0x2c, 0x3, 0x0) mount$9p_rdma(0x0, &(0x7f0000001400)='.\x00', &(0x7f0000001440), 0x1008840, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x4, 0xfffffe0000000001, 0xfa14, 0xffffffff}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0xfffffffd, 0x0, 0xb49, 0x2, 0x8, 0x0, 0x3}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000002c0)={0xcf, 0xfffffffb, 0x0, 'queue0\x00'}) write$sndseq(r0, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1001a) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000100)={0x0, 0x5, 0x60, {0xd34b, 0x114}, 0x10, 0x4}) 1.220231503s ago: executing program 2 (id=13976): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x10040) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f00000002c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x3d, 0x28, 0x69, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1\x00', 0x1) write(0xffffffffffffffff, &(0x7f0000000140)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1\x00', 0x1) fsopen(&(0x7f0000000180)='gfs2meta\x00', 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000140)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x6c, 0xfffe, 0x0, 0x95, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x16, 0x20, 0xb, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x6, 0x7}, @md5sig={0x13, 0x12, "a16dc34416fcb1917fdf02dd82bbfc0e"}, @timestamp={0x8, 0xa, 0xffff, 0x3}, @mptcp=@mp_fclose={0x1e, 0xc, 0x4, 0x0, 0x6}, @mptcp=@synack={0x1e, 0x10, 0x7, 0x2, 0x80, 0x101, 0x4}]}}}}}}}, 0x0) 1.130301197s ago: executing program 3 (id=13977): timer_create(0x7, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) unshare(0x6020400) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = eventfd2(0xe5c, 0x80000) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000040)={r3, 0x1, 0x2}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x7, 0x6}) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', &(0x7f0000000240)=@FILEID_UDF_WITH_PARENT={0x14}, &(0x7f0000000280), 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_TP_METER(r4, &(0x7f0000003140)={0x0, 0x0, &(0x7f0000003100)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="01002bbd700001dcdf25020000050a000900ffffffffffff000008000300", @ANYRES32=r4], 0x30}, 0x1, 0x0, 0x0, 0x20000050}, 0x20000884) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r5, 0x40045532, &(0x7f0000000040)=0x3) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000980)=@newae={0x64, 0x1e, 0x1, 0x70bd2a, 0x25dfdbfb, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4d6, 0xa, 0xff}, @in=@remote, 0x1, 0x3502}, [@lifetime_val={0x24, 0x9, {0xdda8, 0x735, 0x2, 0x2}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20004000}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e0000000400000008"], 0x48) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x14b000) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x0, 0x0) 932.101315ms ago: executing program 3 (id=13978): socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) faccessat2(0xffffffffffffffff, 0x0, 0x44, 0x1000) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0xfffff5d4}}, './file0\x00'}) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000003c0)=0x4) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a7c000000000a050000000000000000000500000065004b0600c569bc800117f32f00858527ad959e2a8fdf4cacfefd920f1b9c5ef9a73dda6be0807a0a58c9560468a181e2d8d89c6abc7235466bd6833c29bc7a1316ae55be810ce14265790e30da6141d1e16556d494edd28202145f0853111d32d955389a460000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a30000000002c000000060a01040000000000000000050000000800010073797a3000dfffff0800010073797a3000000000140000001100010000000000000000000000000a"], 0xfc}}, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$unix(0x1, 0x1, 0x0) listen(r3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000000)={0x7, 0xd44, 0x6}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r5, 0x100000) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000080)={0x5, 0x3, 0x248, 0x5d92, 0x9, 0x1ce, 0x7fff, 0x2}, 0x0, &(0x7f0000000140)={0x3ff, 0x80, 0x5, 0x0, 0x101, 0xafc2, 0x5, 0x1}, &(0x7f00000001c0)={r6, r7+60000000}, &(0x7f0000000280)={&(0x7f0000000240)={[0x1000, 0x8]}, 0x8}) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x0) 922.918936ms ago: executing program 2 (id=13979): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, 0x0, 0x0) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r4, 0x40045701, &(0x7f0000000180)=0xffffffff) msgget$private(0x0, 0x400) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, 0x0, 0x0) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0xe7b, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x5, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x7) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r8 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r8, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000440)) keyctl$get_persistent(0x16, 0x0, r8) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_GET(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x2c, r10, 0x1, 0x70bd2d, 0x0, {0x1b}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x2c}}, 0x0) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f0000000140)={0x60, 0x3, &(0x7f0000001000/0x3000)=nil, &(0x7f0000f5a000/0x2000)=nil, 0x2, 0x0, 0x0, 0xdff, 0x3e, 0x0, 0x2, 0x54}) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000140)=@IORING_OP_MKDIRAT={0x25, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x64}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 436.863576ms ago: executing program 1 (id=13980): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000100)={0x1d, r1, 0x0, {}, 0xfd}, 0x18) connect$can_j1939(r0, &(0x7f0000000080)={0x1d, r1, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) r2 = fsopen(&(0x7f0000000040)='exfat\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000240)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) sendmsg$can_j1939(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe) r3 = userfaultfd(0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000200000000000000000850000002a0000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000073000000"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$packet(0x11, 0x2, 0x300) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x61, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000180)=r5, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_RELOAD_REGDB(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x501, 0x70bd2c, 0x25dfdbf8}, 0x14}, 0x1, 0x0, 0x0, 0x20008001}, 0x40) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x2f1}) ioctl$F2FS_IOC_GARBAGE_COLLECT(r0, 0x4004f506, &(0x7f0000000000)) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r9 = dup3(r8, r7, 0x0) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r10, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r10, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r8, 0xfff80000) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r10, 0x40046208, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 0s ago: executing program 3 (id=13981): ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0) write(0xffffffffffffffff, &(0x7f0000000240), 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) write$nci(0xffffffffffffffff, 0x0, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000540)='.\x00', 0x850003d1) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x393}, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000140)) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000480)={0x0, 0x18e2, 0x10000, 0x0, 0x1d2}, &(0x7f0000002680)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb656, 0x200, 0x5, 0x41}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x216, 0x0, 0x2, 0x19b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb6d4, 0x1, 0x1, 0x252}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xeaff, 0x800, 0x0, 0x231}}], 0x4, &(0x7f0000003900)={0x2e, 0x62, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb66, 0x0, 0x0}}, 0x0) syslog(0x3, &(0x7f0000000000)=""/112, 0x70) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0xc, 0x10, &(0x7f0000000a40)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000006b8a00fe00000000c7080000010000007b8af0ff00000000bda100000000000007000000f8ffffffbfa400000000000007040000f0ffffffb7020000080000fa18230000", @ANYRES32, @ANYBLOB="0000000000000000b704000008000000850000001a00000095"], &(0x7f00000008c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kernel console output (not intermixed with test programs): , BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3307.982163][T24826] Call Trace: [ 3307.982201][T24826] [ 3307.982205][T24826] dump_stack_lvl+0x100/0x190 [ 3307.982258][T24826] should_fail_ex.cold+0x5/0xa [ 3307.982274][T24826] should_failslab+0xc2/0x120 [ 3307.982290][T24826] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 3307.982305][T24826] ? __alloc_skb+0x5b7/0x710 [ 3307.982340][T24826] ? __alloc_skb+0x140/0x710 [ 3307.982356][T24826] __alloc_skb+0x140/0x710 [ 3307.982369][T24826] ? __alloc_skb+0x5b7/0x710 [ 3307.982383][T24826] ? __pfx___alloc_skb+0x10/0x10 [ 3307.982401][T24826] netlink_alloc_large_skb+0x69/0x150 [ 3307.982414][T24826] netlink_sendmsg+0x680/0xda0 [ 3307.982428][T24826] ? __pfx_netlink_sendmsg+0x10/0x10 [ 3307.982442][T24826] ? apparmor_socket_sendmsg+0x15b/0x270 [ 3307.982476][T24826] ____sys_sendmsg+0xa4d/0xbe0 [ 3307.982487][T24826] ? __pfx_netlink_sendmsg+0x10/0x10 [ 3307.982499][T24826] ? __pfx_____sys_sendmsg+0x10/0x10 [ 3307.982517][T24826] ___sys_sendmsg+0x190/0x1e0 [ 3307.982530][T24826] ? __pfx____sys_sendmsg+0x10/0x10 [ 3307.982548][T24826] ? find_held_lock+0x2b/0x80 [ 3307.982571][T24826] __sys_sendmsg+0x160/0x210 [ 3307.982587][T24826] ? __pfx___sys_sendmsg+0x10/0x10 [ 3307.982606][T24826] ? __pfx_ksys_write+0x10/0x10 [ 3307.982619][T24826] __do_fast_syscall_32+0xe7/0x970 [ 3307.982634][T24826] ? lockdep_hardirqs_on+0x78/0x100 [ 3307.982649][T24826] do_fast_syscall_32+0x32/0x70 [ 3307.982663][T24826] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3307.982678][T24826] RIP: 0023:0xf703efec [ 3307.982692][T24826] Code: Unable to access opcode bytes at 0xf703efc2. [ 3307.982716][T24826] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 3307.982728][T24826] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080002140 [ 3307.982735][T24826] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 3307.982741][T24826] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3307.982747][T24826] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 3307.982754][T24826] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3307.982772][T24826] [ 3308.909230][T24830] netlink: 'syz.2.13585': attribute type 10 has an invalid length. [ 3308.919092][T24830] ipvlan0: entered allmulticast mode [ 3308.923632][T24830] veth0_vlan: entered allmulticast mode [ 3308.930031][T24830] team0: Device ipvlan0 failed to register rx_handler [ 3311.151902][T24846] random: crng reseeded on system resumption [ 3311.750378][T24848] ipvlan0: left allmulticast mode [ 3311.753006][T24848] veth0_vlan: left allmulticast mode [ 3312.162221][T24852] binder: Unknown parameter 'subj_type' [ 3312.399218][T22310] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 3312.461571][T24858] 9pnet: p9_errstr2errno: server reported unknown error ¶+ [ 3312.559052][T22310] usb 6-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 3312.561917][T22310] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3312.564520][T22310] usb 6-1: Product: syz [ 3312.565912][T22310] usb 6-1: Manufacturer: syz [ 3312.567660][T22310] usb 6-1: SerialNumber: syz [ 3312.574124][T22310] usb 6-1: config 0 descriptor?? [ 3312.630921][T24861] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3312.662269][T24861] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3312.664561][T24861] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3312.666880][T24861] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3312.669890][T24861] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3312.675649][T24861] pci 0000:00:01.0: Adding to iommu group 1 [ 3312.681845][T24861] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3312.683961][T24861] pci 0000:00:01.0: vgaarb: bridge control possible [ 3312.685989][T24861] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3312.698314][T24861] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3312.703301][T24861] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3312.718551][T24861] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3312.732680][T24861] [drm] Found bochs VGA, ID 0xb0c5. [ 3312.738862][T24861] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3312.751414][T24861] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3312.826544][T22310] usb 6-1: USB disconnect, device number 21 [ 3312.867480][T24861] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3313.061504][T24852] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 3313.067764][T24852] udc usbip-vudc.0: failed to start g1: -19 [ 3313.078250][T24852] UDC core: g1: couldn't find an available UDC or it's busy [ 3313.672140][T24875] binder: Binderfs stats mode cannot be changed during a remount [ 3313.738473][T24883] FAULT_INJECTION: forcing a failure. [ 3313.738473][T24883] name failslab, interval 1, probability 0, space 0, times 0 [ 3313.743840][T24883] CPU: 3 UID: 0 PID: 24883 Comm: syz.1.13599 Tainted: G L syzkaller #0 PREEMPT(full) [ 3313.743867][T24883] Tainted: [L]=SOFTLOCKUP [ 3313.743873][T24883] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3313.743884][T24883] Call Trace: [ 3313.743890][T24883] [ 3313.743896][T24883] dump_stack_lvl+0x100/0x190 [ 3313.743978][T24883] should_fail_ex.cold+0x5/0xa [ 3313.743997][T24883] should_failslab+0xc2/0x120 [ 3313.744019][T24883] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 3313.744039][T24883] ? __alloc_skb+0x5b7/0x710 [ 3313.744085][T24883] ? __alloc_skb+0x140/0x710 [ 3313.744108][T24883] __alloc_skb+0x140/0x710 [ 3313.744126][T24883] ? __alloc_skb+0x5b7/0x710 [ 3313.744144][T24883] ? __pfx___alloc_skb+0x10/0x10 [ 3313.744171][T24883] netlink_alloc_large_skb+0x69/0x150 [ 3313.744190][T24883] netlink_sendmsg+0x680/0xda0 [ 3313.744211][T24883] ? __pfx_netlink_sendmsg+0x10/0x10 [ 3313.744231][T24883] ? apparmor_socket_sendmsg+0x15b/0x270 [ 3313.744276][T24883] ____sys_sendmsg+0xa4d/0xbe0 [ 3313.744290][T24883] ? __pfx_netlink_sendmsg+0x10/0x10 [ 3313.744309][T24883] ? __pfx_____sys_sendmsg+0x10/0x10 [ 3313.744336][T24883] ___sys_sendmsg+0x190/0x1e0 [ 3313.744354][T24883] ? __pfx____sys_sendmsg+0x10/0x10 [ 3313.744383][T24883] ? find_held_lock+0x2b/0x80 [ 3313.744419][T24883] __sys_sendmsg+0x160/0x210 [ 3313.744441][T24883] ? __pfx___sys_sendmsg+0x10/0x10 [ 3313.744468][T24883] ? __pfx_ksys_write+0x10/0x10 [ 3313.744506][T24883] __do_fast_syscall_32+0xe7/0x970 [ 3313.744529][T24883] ? lockdep_hardirqs_on+0x78/0x100 [ 3313.744549][T24883] do_fast_syscall_32+0x32/0x70 [ 3313.744569][T24883] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3313.744590][T24883] RIP: 0023:0xf703efec [ 3313.744609][T24883] Code: Unable to access opcode bytes at 0xf703efc2. [ 3313.744616][T24883] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 3313.744633][T24883] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800002c0 [ 3313.744644][T24883] RDX: 0000000004000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 3313.744654][T24883] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3313.744663][T24883] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3313.744673][T24883] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3313.744695][T24883] [ 3314.008033][T24881] binder: Binderfs stats mode cannot be changed during a remount [ 3315.285777][T24907] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3315.301538][T24907] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3315.305959][T24907] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3315.310864][T24907] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3315.315168][T24907] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3315.335035][T24907] pci 0000:00:01.0: Adding to iommu group 1 [ 3315.356512][T24907] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3315.358652][T24907] pci 0000:00:01.0: vgaarb: bridge control possible [ 3315.360742][T24907] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3315.373601][T24907] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3315.377606][T24907] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3315.382999][T24907] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3315.400993][T24907] [drm] Found bochs VGA, ID 0xb0c5. [ 3315.403338][T24907] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3315.424195][T24907] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3315.503580][T24907] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3315.740915][T24912] binder: Unknown parameter 'subj_type' [ 3315.762104][T24914] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 3315.765638][T24914] openvswitch: netlink: VXLAN extension 54 out of range max 1 [ 3315.770723][T24914] AppArmor: change_hat: Invalid input 'š—' [ 3315.785826][ T42] audit: type=1326 audit(1785019896.349:935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24913 comm="syz.2.13608" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x0 [ 3315.989473][T14445] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 3316.154143][T14445] usb 6-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 3316.158878][T14445] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3316.161645][T14445] usb 6-1: Product: syz [ 3316.163328][T14445] usb 6-1: Manufacturer: syz [ 3316.166558][T14445] usb 6-1: SerialNumber: syz [ 3316.171682][T14445] usb 6-1: config 0 descriptor?? [ 3316.325341][T24923] binder: Binderfs stats mode cannot be changed during a remount [ 3316.380773][T14445] usb 6-1: USB disconnect, device number 22 [ 3316.600207][T24912] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 3316.603395][T24912] udc usbip-vudc.0: failed to start g1: -19 [ 3316.607958][T24912] UDC core: g1: couldn't find an available UDC or it's busy [ 3317.485451][T24944] netlink: 'syz.0.13616': attribute type 10 has an invalid length. [ 3317.489735][T24944] team0: Device ipvlan0 failed to register rx_handler [ 3318.127308][T24958] binder: Unknown parameter 'subj_type' [ 3318.236737][T24959] binder: Binderfs stats mode cannot be changed during a remount [ 3318.379290][ T9965] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 3318.615080][ T9965] usb 7-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 3318.631222][ T9965] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3318.634489][ T9965] usb 7-1: Product: syz [ 3318.639183][ T9965] usb 7-1: Manufacturer: syz [ 3318.640811][ T9965] usb 7-1: SerialNumber: syz [ 3318.694726][ T9965] usb 7-1: config 0 descriptor?? [ 3319.086725][T24969] random: crng reseeded on system resumption [ 3319.222060][T24972] ipvlan0: left allmulticast mode [ 3319.224292][T24972] veth0_vlan: left allmulticast mode [ 3319.224705][T24958] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 3319.234560][T24958] udc usbip-vudc.0: failed to start g1: -19 [ 3319.250509][T24958] UDC core: g1: couldn't find an available UDC or it's busy [ 3319.854715][ T9965] usb 7-1: USB disconnect, device number 29 [ 3319.936547][T24689] udevd[24689]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 3320.205211][T24986] 9pnet_virtio: no channels available for device syz [ 3321.611363][T24997] netlink: 'syz.3.13632': attribute type 10 has an invalid length. [ 3321.621772][T24997] team0: Device ipvlan0 failed to register rx_handler [ 3322.947541][T25006] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3322.966089][T25006] 8021q: adding VLAN 0 to HW filter on device team0 [ 3322.991705][T25006] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3323.203030][T25006] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 3323.209707][T25006] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 3323.227926][T25006] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 3323.231331][T25006] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 3323.252039][T25006] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 3323.395464][T12589] bridge0: port 1(bridge_slave_0) entered blocking state [ 3323.397706][T12589] bridge0: port 1(bridge_slave_0) entered listening state [ 3323.401751][T12589] bridge0: port 2(bridge_slave_1) entered blocking state [ 3323.404063][T12589] bridge0: port 2(bridge_slave_1) entered listening state [ 3323.524643][T25009] random: crng reseeded on system resumption [ 3323.692242][T25014] binder: Unknown parameter 'subj_type' [ 3323.741446][T25012] ipvlan0: left allmulticast mode [ 3323.743799][T25012] veth0_vlan: left allmulticast mode [ 3323.939259][ T8815] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 3324.801408][T25024] overlayfs: overlapping lowerdir path [ 3324.893322][ T8815] usb 6-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 3324.896392][ T8815] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3324.899181][ T8815] usb 6-1: Product: syz [ 3324.900594][ T8815] usb 6-1: Manufacturer: syz [ 3324.901960][ T8815] usb 6-1: SerialNumber: syz [ 3324.904816][ T8815] usb 6-1: config 0 descriptor?? [ 3325.113973][ T8815] usb 6-1: USB disconnect, device number 23 [ 3325.263856][T25032] syzkaller0: entered promiscuous mode [ 3325.267060][T25032] syzkaller0: entered allmulticast mode [ 3325.327451][T25014] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 3325.333425][T25014] udc usbip-vudc.0: failed to start g1: -19 [ 3325.336238][T25014] UDC core: g1: couldn't find an available UDC or it's busy [ 3326.385346][T25057] syzkaller0: entered promiscuous mode [ 3326.387127][T25057] syzkaller0: entered allmulticast mode [ 3326.794071][ T42] audit: type=1804 audit(1785019907.369:936): pid=25066 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.13652" name="/newroot/229/bus/bus" dev="overlay" ino=1267 res=1 errno=0 [ 3327.219461][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 3327.747800][T25082] binder: Unknown parameter 'subj_type' [ 3327.792072][T25085] FAULT_INJECTION: forcing a failure. [ 3327.792072][T25085] name failslab, interval 1, probability 0, space 0, times 0 [ 3327.797688][T25085] CPU: 1 UID: 0 PID: 25085 Comm: syz.0.13657 Tainted: G L syzkaller #0 PREEMPT(full) [ 3327.797732][T25085] Tainted: [L]=SOFTLOCKUP [ 3327.797740][T25085] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3327.797750][T25085] Call Trace: [ 3327.797759][T25085] [ 3327.797767][T25085] dump_stack_lvl+0x100/0x190 [ 3327.797866][T25085] should_fail_ex.cold+0x5/0xa [ 3327.797889][T25085] should_failslab+0xc2/0x120 [ 3327.797916][T25085] __kmalloc_cache_noprof+0x91/0x6c0 [ 3327.797940][T25085] ? pagemap_read+0x225/0x830 [ 3327.797994][T25085] pagemap_read+0x225/0x830 [ 3327.798023][T25085] ? __pfx_pagemap_read+0x10/0x10 [ 3327.798054][T25085] ? rw_verify_area+0xce/0x6d0 [ 3327.798082][T25085] ? __pfx_pagemap_read+0x10/0x10 [ 3327.798108][T25085] vfs_read+0x1e4/0xb40 [ 3327.798142][T25085] ? __pfx_vfs_read+0x10/0x10 [ 3327.798174][T25085] ? find_held_lock+0x2b/0x80 [ 3327.798199][T25085] ? __fget_files+0x215/0x3d0 [ 3327.798223][T25085] ? __fget_files+0x21f/0x3d0 [ 3327.798249][T25085] ksys_read+0x12a/0x250 [ 3327.798268][T25085] ? __pfx_ksys_read+0x10/0x10 [ 3327.798284][T25085] ? ksys_write+0x1ac/0x250 [ 3327.798303][T25085] ? __pfx_ksys_write+0x10/0x10 [ 3327.798327][T25085] __do_fast_syscall_32+0xe7/0x970 [ 3327.798376][T25085] ? lockdep_hardirqs_on+0x78/0x100 [ 3327.798402][T25085] do_fast_syscall_32+0x32/0x70 [ 3327.798426][T25085] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3327.798451][T25085] RIP: 0023:0xf7fe2fec [ 3327.798473][T25085] Code: Unable to access opcode bytes at 0xf7fe2fc2. [ 3327.798481][T25085] RSP: 002b:00000000f546450c EFLAGS: 00000292 ORIG_RAX: 0000000000000003 [ 3327.798502][T25085] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000800001c0 [ 3327.798514][T25085] RDX: 00000000ffffffd8 RSI: 0000000000000000 RDI: 0000000000000000 [ 3327.798526][T25085] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3327.798536][T25085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3327.798548][T25085] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3327.798574][T25085] [ 3328.222012][T25090] overlayfs: overlapping lowerdir path [ 3328.712777][T25093] netlink: 'syz.2.13661': attribute type 10 has an invalid length. [ 3328.716299][T25093] ipvlan0: entered allmulticast mode [ 3328.718679][T25093] veth0_vlan: entered allmulticast mode [ 3328.722675][T25093] team0: Device ipvlan0 failed to register rx_handler [ 3329.194988][T25101] FAULT_INJECTION: forcing a failure. [ 3329.194988][T25101] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3329.199221][T25101] CPU: 3 UID: 0 PID: 25101 Comm: syz.0.13663 Tainted: G L syzkaller #0 PREEMPT(full) [ 3329.199239][T25101] Tainted: [L]=SOFTLOCKUP [ 3329.199243][T25101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3329.199250][T25101] Call Trace: [ 3329.199255][T25101] [ 3329.199259][T25101] dump_stack_lvl+0x100/0x190 [ 3329.199276][T25101] should_fail_ex.cold+0x5/0xa [ 3329.199289][T25101] _copy_from_iter+0x1f4/0x1690 [ 3329.199310][T25101] ? __pfx__copy_from_iter+0x10/0x10 [ 3329.199328][T25101] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 3329.199349][T25101] copy_page_from_iter+0x238/0x300 [ 3329.199368][T25101] tun_build_skb.constprop.0+0x2ea/0x18f0 [ 3329.199386][T25101] ? __pfx_tun_build_skb.constprop.0+0x10/0x10 [ 3329.199399][T25101] ? unwind_get_return_address+0x59/0xa0 [ 3329.199417][T25101] ? arch_stack_walk+0xa6/0xf0 [ 3329.199435][T25101] ? __lock_acquire+0x49f/0x1a40 [ 3329.199461][T25101] tun_get_user+0x16d6/0x3c20 [ 3329.199480][T25101] ? __pfx_tun_get_user+0x10/0x10 [ 3329.199493][T25101] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 3329.199508][T25101] ? find_held_lock+0x2b/0x80 [ 3329.199522][T25101] ? tun_get+0x191/0x370 [ 3329.199532][T25101] ? tun_get+0x191/0x370 [ 3329.199546][T25101] tun_chr_write_iter+0xdc/0x200 [ 3329.199560][T25101] vfs_write+0x6ac/0x1050 [ 3329.199571][T25101] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 3329.199585][T25101] ? __pfx_vfs_write+0x10/0x10 [ 3329.199594][T25101] ? find_held_lock+0x2b/0x80 [ 3329.199616][T25101] ksys_write+0x12a/0x250 [ 3329.199627][T25101] ? __pfx_ksys_write+0x10/0x10 [ 3329.199640][T25101] do_int80_emulation+0x14b/0x720 [ 3329.199657][T25101] asm_int80_emulation+0x1a/0x20 [ 3329.199670][T25101] RIP: 0023:0xf71e72eb [ 3329.199679][T25101] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 3329.199690][T25101] RSP: 002b:00000000f54a644c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 3329.199701][T25101] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 00000000800004c0 [ 3329.199708][T25101] RDX: 00000000000000be RSI: 0000000000000000 RDI: 0000000000000000 [ 3329.199715][T25101] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3329.199722][T25101] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 3329.199728][T25101] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3329.199742][T25101] [ 3329.205642][T25102] futex_wake_op: syz.1.13662 tries to shift op by -1; fix this program [ 3330.923074][T25129] overlayfs: overlapping lowerdir path [ 3331.140535][T25132] 9pnet_virtio: no channels available for device syz [ 3331.616919][T21334] ALSA: mixer_oss: invalid OSS volume '' [ 3331.623572][T21334] ALSA: mixer_oss: invalid OSS volume 'ÊÒ±BËÂì;T`¿@$™¿¾E÷ócXÆMYdŸè,' [ 3331.638019][T21334] ALSA: mixer_oss: invalid OSS volume 'b«Ž@hé#' [ 3331.645731][T21334] ALSA: mixer_oss: invalid OSS volume '•‘h4¿–ÐX¬„S4v=0_>¤&äÏ' [ 3331.656085][T21334] ALSA: mixer_oss: invalid OSS volume '|œ/"tj' [ 3331.674792][T21334] ALSA: mixer_oss: invalid OSS volume '-z5²Šc^÷Jƒå6$̹' [ 3331.692384][T21334] ALSA: mixer_oss: invalid OSS volume '0ÉóT„®°yòÝäî¬ó‰´ª‡—‚j–P&†³aït' [ 3331.700074][T21334] ALSA: mixer_oss: invalid OSS volume '÷|á¥ó~‚\' [ 3331.704917][T21334] ALSA: mixer_oss: invalid OSS volume '­É@ô^3bÉœ‘}˜ÔG$º#\Ä("/øoúLÛ' [ 3331.711456][T21334] ALSA: mixer_oss: invalid OSS volume 'I ‹È:•þàâ' [ 3331.739619][T21334] ALSA: mixer_oss: invalid OSS volume '%^Óvƒªhc¾GJPÿÃÐöø¬rª('â¯Q=' [ 3331.743049][T21334] ALSA: mixer_oss: invalid OSS volume ' ‰Gjä;4÷ÊÃŒðÙÆzÜ3¸W´Ò¼0ÙF=%¾' [ 3331.746476][T21334] ALSA: mixer_oss: invalid OSS volume ';4— å‚«4òfhÊ߇G¥ŽIב°Q÷5o“J' [ 3331.749871][T21334] ALSA: mixer_oss: invalid OSS volume 'WöŒ’ló]Y1Õ-¬ž¾ÙJ<´¶³ªAÆ>ƒïo' [ 3332.289597][T23605] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 3332.307798][T23605] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 3332.314922][T23605] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 3332.331871][T23605] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 3332.337145][T23605] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 3332.369576][T17502] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 3332.375190][T17502] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 3332.377899][T17502] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 3332.381545][T17502] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 3332.383020][T25144] netlink: 'syz.3.13676': attribute type 8 has an invalid length. [ 3332.385916][T17502] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 3332.536910][ T12] bridge_slave_1: left allmulticast mode [ 3332.539663][ T12] bridge_slave_1: left promiscuous mode [ 3332.542209][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 3332.547713][ T12] bridge_slave_0: left allmulticast mode [ 3332.552433][ T12] bridge_slave_0: left promiscuous mode [ 3332.555146][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 3332.573450][ T12] pim6reg: left allmulticast mode [ 3332.699025][T25162] FAULT_INJECTION: forcing a failure. [ 3332.699025][T25162] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3332.703310][T25162] CPU: 0 UID: 0 PID: 25162 Comm: syz.1.13679 Tainted: G L syzkaller #0 PREEMPT(full) [ 3332.703328][T25162] Tainted: [L]=SOFTLOCKUP [ 3332.703332][T25162] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3332.703339][T25162] Call Trace: [ 3332.703344][T25162] [ 3332.703349][T25162] dump_stack_lvl+0x100/0x190 [ 3332.703365][T25162] should_fail_ex.cold+0x5/0xa [ 3332.703378][T25162] _copy_from_iter+0x1f4/0x1690 [ 3332.703399][T25162] ? __pfx__copy_from_iter+0x10/0x10 [ 3332.703416][T25162] ? kasan_save_track+0x14/0x30 [ 3332.703430][T25162] ? __kasan_kmalloc+0xaa/0xb0 [ 3332.703445][T25162] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 3332.703457][T25162] ? configfs_write_iter+0x388/0x4e0 [ 3332.703470][T25162] configfs_write_iter+0xb3/0x4e0 [ 3332.703484][T25162] vfs_write+0x6ac/0x1050 [ 3332.703494][T25162] ? __pfx_configfs_write_iter+0x10/0x10 [ 3332.703507][T25162] ? __pfx_vfs_write+0x10/0x10 [ 3332.703516][T25162] ? find_held_lock+0x2b/0x80 [ 3332.703539][T25162] ksys_write+0x12a/0x250 [ 3332.703549][T25162] ? __pfx_ksys_write+0x10/0x10 [ 3332.703558][T25162] ? ksys_write+0x1ac/0x250 [ 3332.703568][T25162] ? __pfx_ksys_write+0x10/0x10 [ 3332.703581][T25162] __do_fast_syscall_32+0xe7/0x970 [ 3332.703596][T25162] ? lockdep_hardirqs_on+0x78/0x100 [ 3332.703610][T25162] do_fast_syscall_32+0x32/0x70 [ 3332.703624][T25162] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3332.703638][T25162] RIP: 0023:0xf703efec [ 3332.703651][T25162] Code: Unable to access opcode bytes at 0xf703efc2. [ 3332.703657][T25162] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 3332.703672][T25162] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 3332.703680][T25162] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 3332.703686][T25162] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3332.703692][T25162] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3332.703699][T25162] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3332.703713][T25162] [ 3332.844929][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3332.863175][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3332.876110][ T12] bond0 (unregistering): Released all slaves [ 3332.891930][ T12] bond1 (unregistering): Released all slaves [ 3332.920535][ T12] bond2 (unregistering): Released all slaves [ 3332.944992][ T5458] 8021q: adding VLAN 0 to HW filter on device eth1 [ 3333.238362][ T12] tipc: Disabling bearer [ 3333.284599][ T12] tipc: Left network mode [ 3333.289124][ T5458] 8021q: adding VLAN 0 to HW filter on device eth2 [ 3333.369629][T25140] bridge0: port 1(bridge_slave_0) entered blocking state [ 3333.376251][T25140] bridge0: port 1(bridge_slave_0) entered disabled state [ 3333.382191][T25140] bridge_slave_0: entered allmulticast mode [ 3333.387636][T25140] bridge_slave_0: entered promiscuous mode [ 3333.441073][T25140] bridge0: port 2(bridge_slave_1) entered blocking state [ 3333.495040][T25140] bridge0: port 2(bridge_slave_1) entered disabled state [ 3333.564951][T25140] bridge_slave_1: entered allmulticast mode [ 3333.602276][T25140] bridge_slave_1: entered promiscuous mode [ 3333.740103][ T5458] 8021q: adding VLAN 0 to HW filter on device eth3 [ 3333.971201][T25194] overlayfs: overlapping lowerdir path [ 3334.568901][T23605] Bluetooth: hci1: command tx timeout [ 3334.644379][T25140] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3334.654656][T25140] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3334.676698][T25198] syzkaller0: entered promiscuous mode [ 3334.680338][T25198] syzkaller0: entered allmulticast mode [ 3334.684476][T25140] team0: Port device team_slave_0 added [ 3334.708602][T25140] team0: Port device team_slave_1 added [ 3334.740738][T25198] FAULT_INJECTION: forcing a failure. [ 3334.740738][T25198] name failslab, interval 1, probability 0, space 0, times 0 [ 3334.749010][T25198] CPU: 3 UID: 0 PID: 25198 Comm: syz.2.13682 Tainted: G L syzkaller #0 PREEMPT(full) [ 3334.749030][T25198] Tainted: [L]=SOFTLOCKUP [ 3334.749034][T25198] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3334.749041][T25198] Call Trace: [ 3334.749046][T25198] [ 3334.749051][T25198] dump_stack_lvl+0x100/0x190 [ 3334.749067][T25198] should_fail_ex.cold+0x5/0xa [ 3334.749080][T25198] should_failslab+0xc2/0x120 [ 3334.749097][T25198] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 3334.749114][T25198] ? __alloc_skb+0x5b7/0x710 [ 3334.749135][T25198] ? __alloc_skb+0x140/0x710 [ 3334.749157][T25198] __alloc_skb+0x140/0x710 [ 3334.749176][T25198] ? __alloc_skb+0x5b7/0x710 [ 3334.749194][T25198] ? __pfx___alloc_skb+0x10/0x10 [ 3334.749215][T25198] ? find_held_lock+0x2b/0x80 [ 3334.749234][T25198] alloc_skb_with_frags+0xdd/0x760 [ 3334.749251][T25198] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 3334.749271][T25198] sock_alloc_send_pskb+0x801/0x980 [ 3334.749285][T25198] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 3334.749305][T25198] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 3334.749322][T25198] ? find_held_lock+0x2b/0x80 [ 3334.749340][T25198] ? dev_get_by_index+0x180/0x380 [ 3334.749361][T25198] ? dev_get_by_index+0x180/0x380 [ 3334.749388][T25198] packet_sendmsg+0x1eda/0x5100 [ 3334.749415][T25198] ? __pfx___might_resched+0x10/0x10 [ 3334.749444][T25198] ? aa_sk_perm+0x309/0xaa0 [ 3334.749469][T25198] ? __pfx_aa_sk_perm+0x10/0x10 [ 3334.749489][T25198] ? __pfx_packet_sendmsg+0x10/0x10 [ 3334.749507][T25198] ? __might_fault+0xc5/0x140 [ 3334.749530][T25198] ? apparmor_socket_sendmsg+0x15b/0x270 [ 3334.749550][T25198] __sys_sendto+0x48b/0x4e0 [ 3334.749569][T25198] ? __pfx_packet_sendmsg+0x10/0x10 [ 3334.749588][T25198] ? __pfx___sys_sendto+0x10/0x10 [ 3334.749624][T25198] ? fput+0x79/0x100 [ 3334.749643][T25198] ? ksys_write+0x1ac/0x250 [ 3334.749661][T25198] __ia32_sys_sendto+0xdd/0x1b0 [ 3334.749679][T25198] ? __do_fast_syscall_32+0x98/0x970 [ 3334.749700][T25198] ? lockdep_hardirqs_on+0x78/0x100 [ 3334.749719][T25198] __do_fast_syscall_32+0xe7/0x970 [ 3334.749739][T25198] ? lockdep_hardirqs_on+0x78/0x100 [ 3334.749762][T25198] do_fast_syscall_32+0x32/0x70 [ 3334.749783][T25198] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3334.749803][T25198] RIP: 0023:0xf7fb5fec [ 3334.749816][T25198] Code: Unable to access opcode bytes at 0xf7fb5fc2. [ 3334.749822][T25198] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 3334.749833][T25198] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000240 [ 3334.749840][T25198] RDX: 000000000000000e RSI: 0000000000000040 RDI: 00000000800001c0 [ 3334.749847][T25198] RBP: 0000000000000014 R08: 0000000000000000 R09: 0000000000000000 [ 3334.749854][T25198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3334.749861][T25198] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3334.749874][T25198] [ 3334.878445][T25140] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 3334.884384][T25140] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3334.896174][T25140] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 3334.902271][T25140] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 3334.905101][T25140] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3334.915327][T25140] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 3334.986129][ T12] hsr_slave_0: left promiscuous mode [ 3334.991588][ T12] hsr_slave_1: left promiscuous mode [ 3334.993773][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 3334.997187][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 3335.032508][T25205] random: crng reseeded on system resumption [ 3335.158205][ T12] team0 (unregistering): Port device team_slave_1 removed [ 3335.197362][ T12] team0 (unregistering): Port device team_slave_0 removed [ 3335.289451][ T5458] 8021q: adding VLAN 0 to HW filter on device eth4 [ 3335.450795][T25206] bridge0: port 2(bridge_slave_1) entered disabled state [ 3335.453801][T25206] bridge0: port 1(bridge_slave_0) entered disabled state [ 3335.506387][T25206] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 3335.537740][T25206] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 3336.031611][T25206] ipvlan0: left allmulticast mode [ 3336.039416][T25206] veth0_vlan: left allmulticast mode [ 3336.071704][T25140] hsr_slave_0: entered promiscuous mode [ 3336.075345][T25140] hsr_slave_1: entered promiscuous mode [ 3336.082108][T25140] debugfs: 'hsr0' already exists in 'hsr' [ 3336.088603][T25140] Cannot create hsr debugfs directory [ 3336.649073][T23605] Bluetooth: hci1: command tx timeout [ 3336.894890][T25140] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 3337.010967][T25140] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 3337.014730][T25140] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 3337.037906][T25140] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 3337.064691][T25140] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 3337.082432][T25140] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 3337.087293][T25140] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 3337.093383][T25140] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 3337.132767][ T12] IPVS: stop unused estimator thread 0... [ 3337.242509][T25253] 9p: Bad value for 'rfdno' [ 3337.282067][T25258] FAULT_INJECTION: forcing a failure. [ 3337.282067][T25258] name failslab, interval 1, probability 0, space 0, times 0 [ 3337.286648][T25258] CPU: 3 UID: 0 PID: 25258 Comm: syz.1.13695 Tainted: G L syzkaller #0 PREEMPT(full) [ 3337.286665][T25258] Tainted: [L]=SOFTLOCKUP [ 3337.286670][T25258] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3337.286676][T25258] Call Trace: [ 3337.286682][T25258] [ 3337.286686][T25258] dump_stack_lvl+0x100/0x190 [ 3337.286704][T25258] should_fail_ex.cold+0x5/0xa [ 3337.286723][T25258] should_failslab+0xc2/0x120 [ 3337.286745][T25258] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 3337.286771][T25258] ? alloc_vmap_area+0x640/0x2bb0 [ 3337.286805][T25258] alloc_vmap_area+0x640/0x2bb0 [ 3337.286834][T25258] ? kasan_save_track+0x14/0x30 [ 3337.286857][T25258] ? __kasan_kmalloc+0xaa/0xb0 [ 3337.286877][T25258] ? __pfx_alloc_vmap_area+0x10/0x10 [ 3337.286902][T25258] ? __get_vm_area_node+0x101/0x330 [ 3337.286928][T25258] __get_vm_area_node+0x1ca/0x330 [ 3337.286955][T25258] __vmalloc_node_range_noprof+0x228/0x1630 [ 3337.286978][T25258] ? kernel_clone+0x176/0x9d0 [ 3337.286996][T25258] ? kernel_clone+0x176/0x9d0 [ 3337.287012][T25258] ? __memcg_slab_post_alloc_hook+0x749/0x1160 [ 3337.287031][T25258] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 3337.287051][T25258] ? trace_kmem_cache_alloc+0xdd/0x100 [ 3337.287069][T25258] ? kernel_clone+0x176/0x9d0 [ 3337.287082][T25258] __vmalloc_node_noprof+0xad/0xf0 [ 3337.287098][T25258] ? kernel_clone+0x176/0x9d0 [ 3337.287113][T25258] copy_process+0x7fb/0x8030 [ 3337.287129][T25258] ? __lock_acquire+0x49f/0x1a40 [ 3337.287150][T25258] ? __pfx_copy_process+0x10/0x10 [ 3337.287165][T25258] ? get_pid_task+0xfc/0x250 [ 3337.287179][T25258] ? get_pid_task+0xfc/0x250 [ 3337.287196][T25258] kernel_clone+0x176/0x9d0 [ 3337.287209][T25258] ? proc_fail_nth_write+0x9f/0x220 [ 3337.287225][T25258] ? __pfx_kernel_clone+0x10/0x10 [ 3337.287241][T25258] ? find_held_lock+0x2b/0x80 [ 3337.287254][T25258] ? ksys_write+0x190/0x250 [ 3337.287264][T25258] ? ksys_write+0x190/0x250 [ 3337.287277][T25258] __do_compat_sys_ia32_clone+0xd4/0x120 [ 3337.287292][T25258] ? __pfx___do_compat_sys_ia32_clone+0x10/0x10 [ 3337.287310][T25258] ? fput+0x79/0x100 [ 3337.287323][T25258] ? ksys_write+0x1ac/0x250 [ 3337.287333][T25258] ? __pfx_ksys_write+0x10/0x10 [ 3337.287346][T25258] __do_fast_syscall_32+0xe7/0x970 [ 3337.287361][T25258] ? lockdep_hardirqs_on+0x78/0x100 [ 3337.287374][T25258] do_fast_syscall_32+0x32/0x70 [ 3337.287389][T25258] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3337.287403][T25258] RIP: 0023:0xf703efec [ 3337.287417][T25258] Code: Unable to access opcode bytes at 0xf703efc2. [ 3337.287422][T25258] RSP: 002b:00000000f542d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000078 [ 3337.287434][T25258] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 3337.287440][T25258] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 3337.287447][T25258] RBP: 00000000f7434f80 R08: 0000000000000000 R09: 0000000000000000 [ 3337.287453][T25258] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 3337.287460][T25258] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3337.287474][T25258] [ 3337.287490][T25258] syz.1.13695: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 3337.427195][T25258] CPU: 3 UID: 0 PID: 25258 Comm: syz.1.13695 Tainted: G L syzkaller #0 PREEMPT(full) [ 3337.427225][T25258] Tainted: [L]=SOFTLOCKUP [ 3337.427232][T25258] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3337.427243][T25258] Call Trace: [ 3337.427254][T25258] [ 3337.427264][T25258] dump_stack_lvl+0x100/0x190 [ 3337.427292][T25258] warn_alloc.cold+0x94/0xa8 [ 3337.427313][T25258] ? __pfx_warn_alloc+0x10/0x10 [ 3337.427335][T25258] ? lockdep_hardirqs_on+0x78/0x100 [ 3337.427361][T25258] ? __get_vm_area_node+0x2cd/0x330 [ 3337.427394][T25258] ? __get_vm_area_node+0x208/0x330 [ 3337.427425][T25258] __vmalloc_node_range_noprof+0xccd/0x1630 [ 3337.427463][T25258] ? kernel_clone+0x176/0x9d0 [ 3337.427494][T25258] ? __memcg_slab_post_alloc_hook+0x749/0x1160 [ 3337.427523][T25258] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 3337.427559][T25258] ? trace_kmem_cache_alloc+0xdd/0x100 [ 3337.427589][T25258] ? kernel_clone+0x176/0x9d0 [ 3337.427611][T25258] __vmalloc_node_noprof+0xad/0xf0 [ 3337.427639][T25258] ? kernel_clone+0x176/0x9d0 [ 3337.427664][T25258] copy_process+0x7fb/0x8030 [ 3337.427690][T25258] ? __lock_acquire+0x49f/0x1a40 [ 3337.427734][T25258] ? __pfx_copy_process+0x10/0x10 [ 3337.427761][T25258] ? get_pid_task+0xfc/0x250 [ 3337.427785][T25258] ? get_pid_task+0xfc/0x250 [ 3337.427814][T25258] kernel_clone+0x176/0x9d0 [ 3337.427837][T25258] ? proc_fail_nth_write+0x9f/0x220 [ 3337.427864][T25258] ? __pfx_kernel_clone+0x10/0x10 [ 3337.427894][T25258] ? find_held_lock+0x2b/0x80 [ 3337.427918][T25258] ? ksys_write+0x190/0x250 [ 3337.427936][T25258] ? ksys_write+0x190/0x250 [ 3337.427958][T25258] __do_compat_sys_ia32_clone+0xd4/0x120 [ 3337.427983][T25258] ? __pfx___do_compat_sys_ia32_clone+0x10/0x10 [ 3337.428015][T25258] ? fput+0x79/0x100 [ 3337.428038][T25258] ? ksys_write+0x1ac/0x250 [ 3337.428056][T25258] ? __pfx_ksys_write+0x10/0x10 [ 3337.428079][T25258] __do_fast_syscall_32+0xe7/0x970 [ 3337.428104][T25258] ? lockdep_hardirqs_on+0x78/0x100 [ 3337.428128][T25258] do_fast_syscall_32+0x32/0x70 [ 3337.428153][T25258] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3337.428178][T25258] RIP: 0023:0xf703efec [ 3337.428201][T25258] Code: Unable to access opcode bytes at 0xf703efc2. [ 3337.428209][T25258] RSP: 002b:00000000f542d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000078 [ 3337.428228][T25258] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 3337.428240][T25258] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 3337.428252][T25258] RBP: 00000000f7434f80 R08: 0000000000000000 R09: 0000000000000000 [ 3337.428264][T25258] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 3337.428275][T25258] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3337.428300][T25258] [ 3337.428308][T25258] Mem-Info: [ 3337.548615][T25258] active_anon:6100 inactive_anon:3156 isolated_anon:0 [ 3337.548615][T25258] active_file:9392 inactive_file:15265 isolated_file:0 [ 3337.548615][T25258] unevictable:768 dirty:455 writeback:0 [ 3337.548615][T25258] slab_reclaimable:7306 slab_unreclaimable:75782 [ 3337.548615][T25258] mapped:28219 shmem:4126 pagetables:1185 [ 3337.548615][T25258] sec_pagetables:323 bounce:0 [ 3337.548615][T25258] kernel_misc_reclaimable:0 [ 3337.548615][T25258] free:31975 free_pcp:14896 free_cma:0 [ 3337.567491][T25258] Node 0 active_anon:88kB inactive_anon:156kB active_file:32kB inactive_file:4kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:5148kB dirty:16kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7360kB pagetables:1264kB sec_pagetables:1116kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 3337.581711][T25258] Node 1 active_anon:24312kB inactive_anon:12468kB active_file:37536kB inactive_file:61056kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:107728kB dirty:1804kB writeback:0kB shmem:14968kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7324kB pagetables:3476kB sec_pagetables:176kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 3337.595707][T25258] Node 0 DMA free:2068kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:16kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:548kB local_pcp:148kB free_cma:0kB [ 3337.608164][T25258] lowmem_reserve[]: 0 280 280 280 280 [ 3337.610788][T25258] Node 0 DMA32 free:15916kB boost:0kB min:12772kB low:15964kB high:19156kB reserved_highatomic:0KB free_highatomic:0KB active_anon:88kB inactive_anon:156kB active_file:16kB inactive_file:4kB unevictable:1536kB writepending:16kB zspages:0kB present:1032196kB managed:286968kB mlocked:0kB bounce:0kB free_pcp:7356kB local_pcp:1048kB free_cma:0kB [ 3337.611602][T25140] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3337.624521][T25258] lowmem_reserve[]: 0 0 0 0 0 [ 3337.628523][T25258] Node 1 DMA32 free:109916kB boost:6144kB min:53284kB low:65068kB high:76852kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24312kB inactive_anon:12468kB active_file:37536kB inactive_file:61056kB unevictable:1536kB writepending:1804kB zspages:1788kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:51656kB local_pcp:8684kB free_cma:0kB [ 3337.635081][T25140] 8021q: adding VLAN 0 to HW filter on device team0 [ 3337.643536][T25258] lowmem_reserve[]: 0 0 0 0 0 [ 3337.652670][T14765] bridge0: port 1(bridge_slave_0) entered blocking state [ 3337.655869][T14765] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3337.662196][T25258] Node 0 DMA: 125*4kB (UM) 34*8kB (UM) 13*16kB (UM) 4*32kB (M) 1*64kB (M) 1*128kB (M) 1*256kB (M) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 2068kB [ 3337.669294][T25258] Node 0 DMA32: 17*4kB (UME) 31*8kB (UME) 3*16kB (ME) 38*32kB (UME) 54*64kB (UME) 35*128kB (UME) 9*256kB (UM) 8*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 15916kB [ 3337.678742][T14765] bridge0: port 2(bridge_slave_1) entered blocking state [ 3337.681831][T14765] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3337.688234][T25258] Node 1 DMA32: 488*4kB (UME) 982*8kB (UE) 896*16kB (U) 600*32kB (UME) 343*64kB (UME) 98*128kB (U) 57*256kB (UME) 30*512kB (UME) 2*1024kB (UM) 0*2048kB 0*4096kB = 109840kB [ 3337.697759][T25258] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3337.707656][T25258] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3337.713285][T25258] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3337.717524][T25258] Node 1 hugepages_total=4 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 3337.726649][T25258] 29185 total pagecache pages [ 3337.728760][T25258] 354 pages in swap cache [ 3337.730460][T25140] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 3337.730733][T25258] Free swap = 120716kB [ 3337.735240][T25258] Total swap = 124996kB [ 3337.737407][T25258] 524155 pages RAM [ 3337.739114][T25258] 0 pages HighMem/MovableOnly [ 3337.742138][T25258] 211520 pages reserved [ 3337.743473][T25258] 0 pages cma reserved [ 3337.807464][T25274] FAULT_INJECTION: forcing a failure. [ 3337.807464][T25274] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3337.812240][T25274] CPU: 3 UID: 0 PID: 25274 Comm: syz.1.13697 Tainted: G L syzkaller #0 PREEMPT(full) [ 3337.812259][T25274] Tainted: [L]=SOFTLOCKUP [ 3337.812264][T25274] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3337.812271][T25274] Call Trace: [ 3337.812275][T25274] [ 3337.812279][T25274] dump_stack_lvl+0x100/0x190 [ 3337.812297][T25274] should_fail_ex.cold+0x5/0xa [ 3337.812309][T25274] _copy_to_user+0x32/0xd0 [ 3337.812328][T25274] simple_read_from_buffer+0xcb/0x170 [ 3337.812347][T25274] proc_fail_nth_read+0x1af/0x230 [ 3337.812363][T25274] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 3337.812402][T25274] ? rw_verify_area+0xce/0x6d0 [ 3337.812421][T25274] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 3337.812436][T25274] vfs_read+0x1e4/0xb40 [ 3337.812456][T25274] ? __pfx_vfs_read+0x10/0x10 [ 3337.812472][T25274] ? find_held_lock+0x2b/0x80 [ 3337.812487][T25274] ? __fget_files+0x215/0x3d0 [ 3337.812500][T25274] ? __fget_files+0x21f/0x3d0 [ 3337.812514][T25274] ksys_read+0x12a/0x250 [ 3337.812523][T25274] ? __pfx_ksys_read+0x10/0x10 [ 3337.812538][T25274] do_int80_emulation+0x14b/0x720 [ 3337.812554][T25274] asm_int80_emulation+0x1a/0x20 [ 3337.812566][T25274] RIP: 0023:0xf71772eb [ 3337.812576][T25274] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 3337.812587][T25274] RSP: 002b:00000000f542d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 3337.812598][T25274] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f542d5d0 [ 3337.812605][T25274] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 3337.812612][T25274] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3337.812618][T25274] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 3337.812625][T25274] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3337.812639][T25274] [ 3337.953857][T25280] netlink: 'syz.1.13698': attribute type 10 has an invalid length. [ 3337.956580][T25279] netlink: 'syz.1.13698': attribute type 10 has an invalid length. [ 3337.964360][T25280] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 3338.095312][T25140] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3338.300620][T25140] veth0_vlan: entered promiscuous mode [ 3338.305746][T25140] veth1_vlan: entered promiscuous mode [ 3338.325724][T25140] veth0_macvtap: entered promiscuous mode [ 3338.334853][T25140] veth1_macvtap: entered promiscuous mode [ 3338.352801][T25140] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 3338.362434][T25140] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 3338.374224][T18154] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3338.377854][T18154] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3338.390230][T18154] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3338.393969][T18154] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3338.473277][T14765] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3338.480397][T14765] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3338.517239][T12771] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3338.521643][T12771] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3338.728971][T23605] Bluetooth: hci1: command tx timeout [ 3340.054059][T25341] overlayfs: overlapping lowerdir path [ 3340.499020][T31101] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 3340.659819][T31101] usb 9-1: Using ep0 maxpacket: 32 [ 3340.663189][T31101] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 3340.667900][T31101] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 3340.670933][T31101] usb 9-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 3340.673313][T31101] usb 9-1: Product: syz [ 3340.674688][T31101] usb 9-1: Manufacturer: syz [ 3340.676016][T31101] usb 9-1: SerialNumber: syz [ 3340.678779][T31101] usb 9-1: config 0 descriptor?? [ 3340.681463][T25346] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 3340.684624][T31101] hub 9-1:0.0: bad descriptor, ignoring hub [ 3340.686361][T31101] hub 9-1:0.0: probe with driver hub failed with error -5 [ 3340.799018][T23605] Bluetooth: hci1: command tx timeout [ 3341.138350][T25352] binder: 25350:25352 ioctl 4c0a 0 returned -22 [ 3341.563561][T25369] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13717'. [ 3341.790044][T25373] FAULT_INJECTION: forcing a failure. [ 3341.790044][T25373] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3341.802409][T25373] CPU: 3 UID: 0 PID: 25373 Comm: syz.1.13720 Tainted: G L syzkaller #0 PREEMPT(full) [ 3341.802431][T25373] Tainted: [L]=SOFTLOCKUP [ 3341.802435][T25373] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3341.802442][T25373] Call Trace: [ 3341.802446][T25373] [ 3341.802451][T25373] dump_stack_lvl+0x100/0x190 [ 3341.802469][T25373] should_fail_ex.cold+0x5/0xa [ 3341.802482][T25373] _copy_to_user+0x32/0xd0 [ 3341.802500][T25373] simple_read_from_buffer+0xcb/0x170 [ 3341.802520][T25373] proc_fail_nth_read+0x1af/0x230 [ 3341.802536][T25373] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 3341.802565][T25373] ? rw_verify_area+0xce/0x6d0 [ 3341.802583][T25373] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 3341.802598][T25373] vfs_read+0x1e4/0xb40 [ 3341.802618][T25373] ? __pfx_vfs_read+0x10/0x10 [ 3341.802634][T25373] ? find_held_lock+0x2b/0x80 [ 3341.802650][T25373] ? __fget_files+0x215/0x3d0 [ 3341.802663][T25373] ? __fget_files+0x21f/0x3d0 [ 3341.802677][T25373] ksys_read+0x12a/0x250 [ 3341.802687][T25373] ? __pfx_ksys_read+0x10/0x10 [ 3341.802705][T25373] do_int80_emulation+0x14b/0x720 [ 3341.802722][T25373] asm_int80_emulation+0x1a/0x20 [ 3341.802734][T25373] RIP: 0023:0xf71772eb [ 3341.802743][T25373] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 3341.802755][T25373] RSP: 002b:00000000f542d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 3341.802766][T25373] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f542d5d0 [ 3341.802774][T25373] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 3341.802780][T25373] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3341.802787][T25373] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 3341.802793][T25373] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3341.802807][T25373] [ 3341.906121][ T9459] raw-gadget.1 gadget.4: failed to queue suspend event [ 3341.969170][T25346] raw-gadget.1 gadget.4: failed to queue resume event [ 3342.000478][T12589] raw-gadget.1 gadget.4: failed to queue suspend event [ 3342.079129][T25346] raw-gadget.1 gadget.4: failed to queue resume event [ 3342.152377][T12771] raw-gadget.1 gadget.4: failed to queue suspend event [ 3342.239024][T25346] raw-gadget.1 gadget.4: failed to queue resume event [ 3342.294739][T12771] raw-gadget.1 gadget.4: failed to queue suspend event [ 3342.369569][T25346] raw-gadget.1 gadget.4: failed to queue resume event [ 3342.390757][T14765] raw-gadget.1 gadget.4: failed to queue suspend event [ 3342.459361][T25346] raw-gadget.1 gadget.4: failed to queue resume event [ 3342.503834][T25379] FAULT_INJECTION: forcing a failure. [ 3342.503834][T25379] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3342.509531][T25379] CPU: 1 UID: 0 PID: 25379 Comm: syz.3.13723 Tainted: G L syzkaller #0 PREEMPT(full) [ 3342.509559][T25379] Tainted: [L]=SOFTLOCKUP [ 3342.509566][T25379] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3342.509575][T25379] Call Trace: [ 3342.509582][T25379] [ 3342.509589][T25379] dump_stack_lvl+0x100/0x190 [ 3342.509612][T25379] should_fail_ex.cold+0x5/0xa [ 3342.509631][T25379] _copy_from_user+0x2e/0xd0 [ 3342.509657][T25379] msr_io+0x93/0x480 [ 3342.509678][T25379] ? __pfx_do_get_msr+0x10/0x10 [ 3342.509704][T25379] ? __pfx_msr_io+0x10/0x10 [ 3342.509728][T25379] kvm_arch_vcpu_ioctl+0x18fd/0x57a0 [ 3342.509760][T25379] ? kvm_arch_vcpu_ioctl+0x18d5/0x57a0 [ 3342.509782][T25379] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 3342.509806][T25379] ? is_bpf_text_address+0x94/0x1a0 [ 3342.509830][T25379] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 3342.509851][T25379] ? arch_stack_walk+0xa6/0xf0 [ 3342.509883][T25379] ? __lock_acquire+0x49f/0x1a40 [ 3342.509909][T25379] ? stack_depot_save_flags+0x27/0x9d0 [ 3342.509934][T25379] ? __lock_acquire+0x49f/0x1a40 [ 3342.509977][T25379] ? lock_acquire+0x1b9/0x370 [ 3342.510006][T25379] ? rcu_is_watching+0x12/0xc0 [ 3342.510025][T25379] ? trace_contention_end+0x126/0x160 [ 3342.510042][T25379] ? __mutex_lock+0x26d/0x1bd0 [ 3342.510062][T25379] ? kvm_vcpu_ioctl+0x322/0x1700 [ 3342.510079][T25379] ? __pfx___mutex_lock+0x10/0x10 [ 3342.510116][T25379] ? kvm_vcpu_ioctl+0x8a0/0x1700 [ 3342.510131][T25379] kvm_vcpu_ioctl+0x8a0/0x1700 [ 3342.510149][T25379] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 3342.510166][T25379] ? tomoyo_path_number_perm+0x188/0x580 [ 3342.510189][T25379] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 3342.510210][T25379] ? get_pid_task+0x106/0x250 [ 3342.510232][T25379] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 3342.510258][T25379] ? do_vfs_ioctl+0x226/0x13e0 [ 3342.510281][T25379] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 3342.510310][T25379] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 3342.510326][T25379] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 3342.510344][T25379] ? __fget_files+0x21f/0x3d0 [ 3342.510364][T25379] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 3342.510381][T25379] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 3342.510406][T25379] __do_fast_syscall_32+0xe7/0x970 [ 3342.510426][T25379] ? lockdep_hardirqs_on+0x78/0x100 [ 3342.510447][T25379] do_fast_syscall_32+0x32/0x70 [ 3342.510467][T25379] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3342.510485][T25379] RIP: 0023:0xf7f76fec [ 3342.510504][T25379] Code: Unable to access opcode bytes at 0xf7f76fc2. [ 3342.510512][T25379] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 3342.510528][T25379] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000c008ae88 [ 3342.510538][T25379] RDX: 00000000800005c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 3342.510548][T25379] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3342.510557][T25379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3342.510567][T25379] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3342.510585][T25379] [ 3342.515275][T14765] raw-gadget.1 gadget.4: failed to queue suspend event [ 3342.516568][T25377] netlink: 'syz.1.13722': attribute type 1 has an invalid length. [ 3342.610421][T25346] raw-gadget.1 gadget.4: failed to queue resume event [ 3342.662784][T12771] raw-gadget.1 gadget.4: failed to queue suspend event [ 3342.759001][T25346] raw-gadget.1 gadget.4: failed to queue resume event [ 3342.798641][T12771] raw-gadget.1 gadget.4: failed to queue suspend event [ 3342.870478][T25346] raw-gadget.1 gadget.4: failed to queue resume event [ 3342.901417][T12771] raw-gadget.1 gadget.4: failed to queue suspend event [ 3342.989820][T25346] raw-gadget.1 gadget.4: failed to queue resume event [ 3343.009636][T12771] raw-gadget.1 gadget.4: failed to queue suspend event [ 3343.089614][T25346] raw-gadget.1 gadget.4: failed to queue resume event [ 3343.121325][ T1163] raw-gadget.1 gadget.4: failed to queue suspend event [ 3343.201363][T25346] raw-gadget.1 gadget.4: failed to queue resume event [ 3343.224474][ T1163] raw-gadget.1 gadget.4: failed to queue suspend event [ 3343.299363][T25346] raw-gadget.1 gadget.4: failed to queue resume event [ 3343.319952][ T1163] raw-gadget.1 gadget.4: failed to queue suspend event [ 3343.341448][T25346] raw-gadget.1 gadget.4: failed to queue disconnect event [ 3343.451249][ T9965] usb 9-1: USB disconnect, device number 2 [ 3343.503132][T25397] overlayfs: overlapping lowerdir path [ 3343.633962][T25399] FAULT_INJECTION: forcing a failure. [ 3343.633962][T25399] name failslab, interval 1, probability 0, space 0, times 0 [ 3343.651715][T25399] CPU: 3 UID: 0 PID: 25399 Comm: syz.1.13728 Tainted: G L syzkaller #0 PREEMPT(full) [ 3343.651733][T25399] Tainted: [L]=SOFTLOCKUP [ 3343.651737][T25399] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3343.651744][T25399] Call Trace: [ 3343.651749][T25399] [ 3343.651754][T25399] dump_stack_lvl+0x100/0x190 [ 3343.651770][T25399] should_fail_ex.cold+0x5/0xa [ 3343.651783][T25399] should_failslab+0xc2/0x120 [ 3343.651800][T25399] kmem_cache_alloc_noprof+0x91/0x6a0 [ 3343.651814][T25399] ? kernel_text_address+0x8d/0x100 [ 3343.651831][T25399] ? kvm_vm_ioctl+0x38c/0x4180 [ 3343.651849][T25399] kvm_vm_ioctl+0x38c/0x4180 [ 3343.651872][T25399] ? tomoyo_path_number_perm+0x46d/0x580 [ 3343.651893][T25399] ? stack_trace_save+0x8e/0xc0 [ 3343.651915][T25399] ? __pfx_stack_trace_save+0x10/0x10 [ 3343.651940][T25399] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 3343.651963][T25399] ? __lock_acquire+0x49f/0x1a40 [ 3343.652004][T25399] ? tomoyo_path_number_perm+0x46d/0x580 [ 3343.652025][T25399] ? kasan_save_stack+0x3f/0x50 [ 3343.652043][T25399] ? kasan_save_stack+0x30/0x50 [ 3343.652056][T25399] ? kasan_save_track+0x14/0x30 [ 3343.652069][T25399] ? kasan_save_free_info+0x3b/0x70 [ 3343.652080][T25399] ? __kasan_slab_free+0x5f/0x80 [ 3343.652094][T25399] ? kfree+0x22b/0x6c0 [ 3343.652103][T25399] ? tomoyo_path_number_perm+0x46d/0x580 [ 3343.652116][T25399] ? security_file_ioctl_compat+0xd3/0x230 [ 3343.652135][T25399] ? __ia32_compat_sys_ioctl+0xc2/0x360 [ 3343.652154][T25399] ? __do_fast_syscall_32+0xe7/0x970 [ 3343.652174][T25399] ? kvm_arch_vm_compat_ioctl+0x2d0/0x470 [ 3343.652201][T25399] ? __pfx_kvm_arch_vm_compat_ioctl+0x10/0x10 [ 3343.652249][T25399] ? kasan_quarantine_put+0x104/0x240 [ 3343.652268][T25399] ? lockdep_hardirqs_on+0x78/0x100 [ 3343.652290][T25399] ? find_held_lock+0x2b/0x80 [ 3343.652310][T25399] ? tomoyo_path_number_perm+0x28f/0x580 [ 3343.652332][T25399] ? tomoyo_path_number_perm+0x28f/0x580 [ 3343.652378][T25399] ? tomoyo_path_number_perm+0x188/0x580 [ 3343.652417][T25399] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 3343.652440][T25399] ? get_pid_task+0x106/0x250 [ 3343.652465][T25399] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 3343.652485][T25399] ? do_vfs_ioctl+0x226/0x13e0 [ 3343.652501][T25399] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 3343.652518][T25399] kvm_vm_compat_ioctl+0x2f7/0x3f0 [ 3343.652534][T25399] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 3343.652551][T25399] ? find_held_lock+0x2b/0x80 [ 3343.652564][T25399] ? __fget_files+0x215/0x3d0 [ 3343.652574][T25399] ? hook_file_ioctl_common+0x140/0x440 [ 3343.652592][T25399] ? __fget_files+0x21f/0x3d0 [ 3343.652605][T25399] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 3343.652622][T25399] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 3343.652642][T25399] __do_fast_syscall_32+0xe7/0x970 [ 3343.652656][T25399] ? lockdep_hardirqs_on+0x78/0x100 [ 3343.652670][T25399] do_fast_syscall_32+0x32/0x70 [ 3343.652684][T25399] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3343.652699][T25399] RIP: 0023:0xf703efec [ 3343.652713][T25399] Code: Unable to access opcode bytes at 0xf703efc2. [ 3343.652719][T25399] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 3343.652730][T25399] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000000ae41 [ 3343.652737][T25399] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 3343.652744][T25399] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3343.652750][T25399] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 3343.652756][T25399] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3343.652770][T25399] [ 3343.844767][T25402] netlink: 'syz.2.13729': attribute type 10 has an invalid length. [ 3343.855720][T25402] ipvlan0: entered allmulticast mode [ 3343.857990][T25402] veth0_vlan: entered allmulticast mode [ 3343.879540][T25402] team0: Device ipvlan0 failed to register rx_handler [ 3344.030563][T25409] syzkaller0: entered promiscuous mode [ 3344.033083][T25409] syzkaller0: entered allmulticast mode [ 3344.076478][T25409] FAULT_INJECTION: forcing a failure. [ 3344.076478][T25409] name failslab, interval 1, probability 0, space 0, times 0 [ 3344.087793][T25409] CPU: 0 UID: 0 PID: 25409 Comm: syz.1.13731 Tainted: G L syzkaller #0 PREEMPT(full) [ 3344.087822][T25409] Tainted: [L]=SOFTLOCKUP [ 3344.087829][T25409] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3344.087839][T25409] Call Trace: [ 3344.087846][T25409] [ 3344.087852][T25409] dump_stack_lvl+0x100/0x190 [ 3344.087877][T25409] should_fail_ex.cold+0x5/0xa [ 3344.087898][T25409] should_failslab+0xc2/0x120 [ 3344.087922][T25409] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 3344.087945][T25409] ? __alloc_skb+0x5b7/0x710 [ 3344.087965][T25409] ? __alloc_skb+0x140/0x710 [ 3344.087988][T25409] __alloc_skb+0x140/0x710 [ 3344.088007][T25409] ? __alloc_skb+0x5b7/0x710 [ 3344.088027][T25409] ? __pfx___alloc_skb+0x10/0x10 [ 3344.088051][T25409] ? find_held_lock+0x2b/0x80 [ 3344.088077][T25409] alloc_skb_with_frags+0xdd/0x760 [ 3344.088102][T25409] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 3344.088132][T25409] sock_alloc_send_pskb+0x801/0x980 [ 3344.088155][T25409] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 3344.088178][T25409] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 3344.088199][T25409] ? find_held_lock+0x2b/0x80 [ 3344.088217][T25409] ? dev_get_by_index+0x180/0x380 [ 3344.088238][T25409] ? dev_get_by_index+0x180/0x380 [ 3344.088267][T25409] packet_sendmsg+0x1eda/0x5100 [ 3344.088296][T25409] ? __pfx___might_resched+0x10/0x10 [ 3344.088327][T25409] ? aa_sk_perm+0x309/0xaa0 [ 3344.088375][T25409] ? __pfx_aa_sk_perm+0x10/0x10 [ 3344.088400][T25409] ? __pfx_packet_sendmsg+0x10/0x10 [ 3344.088419][T25409] ? __might_fault+0xc5/0x140 [ 3344.088445][T25409] ? apparmor_socket_sendmsg+0x15b/0x270 [ 3344.088466][T25409] __sys_sendto+0x48b/0x4e0 [ 3344.088486][T25409] ? __pfx_packet_sendmsg+0x10/0x10 [ 3344.088508][T25409] ? __pfx___sys_sendto+0x10/0x10 [ 3344.088546][T25409] ? fput+0x79/0x100 [ 3344.088568][T25409] ? ksys_write+0x1ac/0x250 [ 3344.088586][T25409] __ia32_sys_sendto+0xdd/0x1b0 [ 3344.088608][T25409] ? __do_fast_syscall_32+0x98/0x970 [ 3344.088630][T25409] ? lockdep_hardirqs_on+0x78/0x100 [ 3344.088650][T25409] __do_fast_syscall_32+0xe7/0x970 [ 3344.088669][T25409] ? lockdep_hardirqs_on+0x78/0x100 [ 3344.088695][T25409] do_fast_syscall_32+0x32/0x70 [ 3344.088717][T25409] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3344.088738][T25409] RIP: 0023:0xf703efec [ 3344.088758][T25409] Code: Unable to access opcode bytes at 0xf703efc2. [ 3344.088765][T25409] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 3344.088782][T25409] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000240 [ 3344.088793][T25409] RDX: 000000000000000e RSI: 0000000000000040 RDI: 00000000800001c0 [ 3344.088803][T25409] RBP: 0000000000000014 R08: 0000000000000000 R09: 0000000000000000 [ 3344.088830][T25409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3344.088840][T25409] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3344.088864][T25409] [ 3345.377420][ C2] vcan0: j1939_tp_rxtimer: 0xffff888073df8000: rx timeout, send abort [ 3345.380710][ C2] vcan0: j1939_xtp_rx_abort_one: 0xffff888073df8000: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 3346.429801][T22310] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 3346.599059][T22310] usb 7-1: Using ep0 maxpacket: 8 [ 3346.602853][T22310] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3346.606866][T22310] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3346.610590][ T1348] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 3346.613055][T22310] usb 7-1: config 0 interface 0 has no altsetting 0 [ 3346.615299][T22310] usb 7-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 3346.618058][T22310] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3346.622863][T22310] usb 7-1: config 0 descriptor?? [ 3346.789030][ T1348] usb 6-1: Using ep0 maxpacket: 8 [ 3346.792543][ T1348] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3346.796003][ T1348] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3346.799981][ T1348] usb 6-1: config 0 interface 0 has no altsetting 0 [ 3346.802586][ T1348] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 3346.806061][ T1348] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3346.811101][ T1348] usb 6-1: config 0 descriptor?? [ 3347.115692][T25455] netlink: 'syz.3.13745': attribute type 10 has an invalid length. [ 3347.121600][T25455] team0: Device ipvlan0 failed to register rx_handler [ 3347.598017][T25461] Set syz1 is full, maxelem 2076 reached [ 3348.863235][T25491] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 3348.870042][T25491] batman_adv: batadv0: Adding interface: gretap1 [ 3348.872725][T25491] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3348.882629][T25491] batman_adv: batadv0: Interface activated: gretap1 [ 3349.109955][T22310] usbhid 7-1:0.0: can't add hid device: -71 [ 3349.113367][T22310] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 3349.123430][T22310] usb 7-1: USB disconnect, device number 30 [ 3349.190193][T25503] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3349.204353][T25503] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3349.207738][T25503] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3349.211519][T25503] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3349.215320][T25503] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3349.228051][T25503] pci 0000:00:01.0: Adding to iommu group 1 [ 3349.241761][T25503] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3349.244387][T25503] pci 0000:00:01.0: vgaarb: bridge control possible [ 3349.246866][T25503] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3349.260853][T25503] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3349.264527][T25503] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3349.270587][T25503] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3349.287721][T25503] [drm] Found bochs VGA, ID 0xb0c5. [ 3349.290249][T25503] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3349.316240][T25503] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3349.329393][ T1348] usbhid 6-1:0.0: can't add hid device: -71 [ 3349.334080][ T1348] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 3349.351410][ T1348] usb 6-1: USB disconnect, device number 24 [ 3349.406111][T25503] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3349.482332][T25512] ipvlan2: entered allmulticast mode [ 3349.484644][T25512] batadv_slave_1: entered allmulticast mode [ 3349.489256][T25512] batman_adv: batadv0: Adding interface: ipvlan2 [ 3349.492213][T25512] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3349.504320][T25512] batman_adv: batadv0: Interface activated: ipvlan2 [ 3350.133230][T25529] netlink: 28 bytes leftover after parsing attributes in process `syz.1.13758'. [ 3350.156654][T25526] syzkaller0: entered promiscuous mode [ 3350.159312][T25526] syzkaller0: entered allmulticast mode [ 3350.402209][T25535] netlink: 'syz.3.13761': attribute type 10 has an invalid length. [ 3350.406579][T25535] team0: Device ipvlan0 failed to register rx_handler [ 3350.473684][T25536] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 3350.479767][T25536] block device autoloading is deprecated and will be removed. [ 3350.816892][T25544] fuse: Unknown parameter '0x0000000000000005' [ 3351.894206][T25560] binder: Unknown parameter 'subj_type' [ 3352.262141][T25567] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3352.282680][ T1348] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 3352.295130][T25567] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3352.300016][T25567] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3352.303129][T25567] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3352.306228][T25567] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3352.451059][T25567] pci 0000:00:01.0: Adding to iommu group 1 [ 3352.535307][T25567] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3352.537415][T25567] pci 0000:00:01.0: vgaarb: bridge control possible [ 3352.539410][T25567] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3352.571952][T25567] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3352.577450][T25567] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3352.594198][T25567] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3352.788954][T25567] [drm] Found bochs VGA, ID 0xb0c5. [ 3352.790919][T25567] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3352.882644][T25567] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3353.122532][ T1348] usb 7-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 3353.126591][ T1348] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3353.130117][ T1348] usb 7-1: Product: syz [ 3353.131903][ T1348] usb 7-1: Manufacturer: syz [ 3353.133996][ T1348] usb 7-1: SerialNumber: syz [ 3353.243103][T25567] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3353.249007][ T1348] usb 7-1: config 0 descriptor?? [ 3353.269549][T25577] overlayfs: overlapping lowerdir path [ 3353.460327][ T1348] usb 7-1: USB disconnect, device number 31 [ 3353.666976][T25560] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 3353.669412][T25560] udc usbip-vudc.0: failed to start g1: -19 [ 3353.672905][T25560] UDC core: g1: couldn't find an available UDC or it's busy [ 3353.747355][T25604] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3353.762612][T25604] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3353.765470][T25604] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3353.768494][T25604] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3353.774028][T25604] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3353.801224][T25604] pci 0000:00:01.0: Adding to iommu group 1 [ 3353.810406][T25604] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3353.813131][T25604] pci 0000:00:01.0: vgaarb: bridge control possible [ 3353.815858][T25604] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3353.826417][T25604] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3353.829788][T25604] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3353.834313][T25604] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3353.846131][T25604] [drm] Found bochs VGA, ID 0xb0c5. [ 3353.848150][T25604] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3353.862752][T25604] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3353.924455][T25604] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3354.938558][T25626] FAULT_INJECTION: forcing a failure. [ 3354.938558][T25626] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3354.942727][T25626] CPU: 1 UID: 0 PID: 25626 Comm: syz.1.13787 Tainted: G L syzkaller #0 PREEMPT(full) [ 3354.942745][T25626] Tainted: [L]=SOFTLOCKUP [ 3354.942749][T25626] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3354.942756][T25626] Call Trace: [ 3354.942761][T25626] [ 3354.942766][T25626] dump_stack_lvl+0x100/0x190 [ 3354.942836][T25626] should_fail_ex.cold+0x5/0xa [ 3354.942849][T25626] _copy_from_user+0x2e/0xd0 [ 3354.942888][T25626] move_addr_to_kernel+0x65/0x170 [ 3354.942922][T25626] get_compat_msghdr+0x3c7/0x480 [ 3354.942940][T25626] ? __pfx_get_compat_msghdr+0x10/0x10 [ 3354.942965][T25626] ___sys_sendmsg+0x1b6/0x1e0 [ 3354.942977][T25626] ? __pfx____sys_sendmsg+0x10/0x10 [ 3354.942995][T25626] ? find_held_lock+0x2b/0x80 [ 3354.943018][T25626] __sys_sendmsg+0x160/0x210 [ 3354.943039][T25626] ? __pfx___sys_sendmsg+0x10/0x10 [ 3354.943058][T25626] ? __pfx_ksys_write+0x10/0x10 [ 3354.943072][T25626] __do_fast_syscall_32+0xe7/0x970 [ 3354.943086][T25626] ? lockdep_hardirqs_on+0x78/0x100 [ 3354.943100][T25626] do_fast_syscall_32+0x32/0x70 [ 3354.943115][T25626] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3354.943129][T25626] RIP: 0023:0xf703efec [ 3354.943145][T25626] Code: Unable to access opcode bytes at 0xf703efc2. [ 3354.943150][T25626] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 3354.943161][T25626] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000500 [ 3354.943169][T25626] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000000 [ 3354.943175][T25626] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3354.943181][T25626] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3354.943188][T25626] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3354.943201][T25626] [ 3355.383485][T25638] binder: Unknown parameter 'subj_type' [ 3355.441606][T25642] FAULT_INJECTION: forcing a failure. [ 3355.441606][T25642] name failslab, interval 1, probability 0, space 0, times 0 [ 3355.446787][T25642] CPU: 3 UID: 0 PID: 25642 Comm: syz.3.13793 Tainted: G L syzkaller #0 PREEMPT(full) [ 3355.446815][T25642] Tainted: [L]=SOFTLOCKUP [ 3355.446821][T25642] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3355.446832][T25642] Call Trace: [ 3355.446838][T25642] [ 3355.446845][T25642] dump_stack_lvl+0x100/0x190 [ 3355.446870][T25642] should_fail_ex.cold+0x5/0xa [ 3355.446891][T25642] should_failslab+0xc2/0x120 [ 3355.446915][T25642] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 3355.446939][T25642] ? alloc_vmap_area+0x640/0x2bb0 [ 3355.446967][T25642] alloc_vmap_area+0x640/0x2bb0 [ 3355.446997][T25642] ? kasan_save_track+0x14/0x30 [ 3355.447018][T25642] ? __kasan_kmalloc+0xaa/0xb0 [ 3355.447040][T25642] ? __pfx_alloc_vmap_area+0x10/0x10 [ 3355.447064][T25642] ? __get_vm_area_node+0x101/0x330 [ 3355.447098][T25642] __get_vm_area_node+0x1ca/0x330 [ 3355.447127][T25642] __vmalloc_node_range_noprof+0x228/0x1630 [ 3355.447155][T25642] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 3355.447180][T25642] ? find_held_lock+0x2b/0x80 [ 3355.447201][T25642] ? process_measurement+0x4c8/0x2350 [ 3355.447223][T25642] ? process_measurement+0x4c8/0x2350 [ 3355.447246][T25642] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 3355.447277][T25642] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 3355.447306][T25642] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 3355.447338][T25642] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 3355.447360][T25642] __vmalloc_node_noprof+0xad/0xf0 [ 3355.447386][T25642] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 3355.447412][T25642] __vmalloc_noprof+0xa3/0x120 [ 3355.447437][T25642] ? __pfx___vmalloc_noprof+0x10/0x10 [ 3355.447463][T25642] ? rcu_is_watching+0x12/0xc0 [ 3355.447485][T25642] ? apparmor_capable+0x1d7/0x4d0 [ 3355.447507][T25642] bpf_prog_alloc_no_stats+0x58/0x640 [ 3355.447530][T25642] ? security_capable+0x80/0x260 [ 3355.447550][T25642] bpf_prog_alloc+0x3b/0x200 [ 3355.447573][T25642] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 3355.447597][T25642] bpf_prog_load+0x4a9/0x2fa0 [ 3355.447618][T25642] ? __pfx_bpf_prog_load+0x10/0x10 [ 3355.447634][T25642] ? __lock_acquire+0x49f/0x1a40 [ 3355.447679][T25642] __sys_bpf+0x18dc/0x4e80 [ 3355.447704][T25642] ? __pfx___sys_bpf+0x10/0x10 [ 3355.447723][T25642] ? find_held_lock+0x2b/0x80 [ 3355.447745][T25642] ? get_pid_task+0xfc/0x250 [ 3355.447766][T25642] ? get_pid_task+0xfc/0x250 [ 3355.447794][T25642] ? proc_fail_nth_write+0x9f/0x220 [ 3355.447817][T25642] ? find_held_lock+0x2b/0x80 [ 3355.447842][T25642] ? rcu_read_lock_any_held+0x6a/0xa0 [ 3355.447863][T25642] ? find_held_lock+0x2b/0x80 [ 3355.447882][T25642] ? ksys_write+0x190/0x250 [ 3355.447899][T25642] ? ksys_write+0x190/0x250 [ 3355.447934][T25642] ? fput+0x79/0x100 [ 3355.447957][T25642] ? __ia32_sys_bpf+0xcc/0x170 [ 3355.447977][T25642] __ia32_sys_bpf+0xcc/0x170 [ 3355.447997][T25642] ? __do_fast_syscall_32+0x98/0x970 [ 3355.448023][T25642] __do_fast_syscall_32+0xe7/0x970 [ 3355.448046][T25642] ? lockdep_hardirqs_on+0x78/0x100 [ 3355.448069][T25642] do_fast_syscall_32+0x32/0x70 [ 3355.448098][T25642] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3355.448122][T25642] RIP: 0023:0xf7f76fec [ 3355.448144][T25642] Code: Unable to access opcode bytes at 0xf7f76fc2. [ 3355.448152][T25642] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 3355.448170][T25642] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000440 [ 3355.448181][T25642] RDX: 0000000000000078 RSI: 0000000000000000 RDI: 0000000000000000 [ 3355.448192][T25642] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3355.448203][T25642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3355.448213][T25642] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3355.448237][T25642] [ 3355.448261][T25642] syz.3.13793: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 3355.603734][T25642] CPU: 2 UID: 0 PID: 25642 Comm: syz.3.13793 Tainted: G L syzkaller #0 PREEMPT(full) [ 3355.603762][T25642] Tainted: [L]=SOFTLOCKUP [ 3355.603768][T25642] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3355.603779][T25642] Call Trace: [ 3355.603786][T25642] [ 3355.603793][T25642] dump_stack_lvl+0x100/0x190 [ 3355.603819][T25642] warn_alloc.cold+0x94/0xa8 [ 3355.603839][T25642] ? __pfx_warn_alloc+0x10/0x10 [ 3355.603859][T25642] ? lockdep_hardirqs_on+0x78/0x100 [ 3355.603882][T25642] ? __get_vm_area_node+0x2cd/0x330 [ 3355.603913][T25642] ? __get_vm_area_node+0x208/0x330 [ 3355.603944][T25642] __vmalloc_node_range_noprof+0xccd/0x1630 [ 3355.603973][T25642] ? find_held_lock+0x2b/0x80 [ 3355.603995][T25642] ? process_measurement+0x4c8/0x2350 [ 3355.604016][T25642] ? process_measurement+0x4c8/0x2350 [ 3355.604040][T25642] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 3355.604072][T25642] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 3355.604102][T25642] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 3355.604133][T25642] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 3355.604163][T25642] __vmalloc_node_noprof+0xad/0xf0 [ 3355.604189][T25642] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 3355.604216][T25642] __vmalloc_noprof+0xa3/0x120 [ 3355.604242][T25642] ? __pfx___vmalloc_noprof+0x10/0x10 [ 3355.604271][T25642] ? rcu_is_watching+0x12/0xc0 [ 3355.604294][T25642] ? apparmor_capable+0x1d7/0x4d0 [ 3355.604341][T25642] bpf_prog_alloc_no_stats+0x58/0x640 [ 3355.604364][T25642] ? security_capable+0x80/0x260 [ 3355.604385][T25642] bpf_prog_alloc+0x3b/0x200 [ 3355.604407][T25642] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 3355.604434][T25642] bpf_prog_load+0x4a9/0x2fa0 [ 3355.604459][T25642] ? __pfx_bpf_prog_load+0x10/0x10 [ 3355.604479][T25642] ? __lock_acquire+0x49f/0x1a40 [ 3355.604542][T25642] __sys_bpf+0x18dc/0x4e80 [ 3355.604571][T25642] ? __pfx___sys_bpf+0x10/0x10 [ 3355.604592][T25642] ? find_held_lock+0x2b/0x80 [ 3355.604613][T25642] ? get_pid_task+0xfc/0x250 [ 3355.604634][T25642] ? get_pid_task+0xfc/0x250 [ 3355.604662][T25642] ? proc_fail_nth_write+0x9f/0x220 [ 3355.604687][T25642] ? find_held_lock+0x2b/0x80 [ 3355.604715][T25642] ? rcu_read_lock_any_held+0x6a/0xa0 [ 3355.604739][T25642] ? find_held_lock+0x2b/0x80 [ 3355.604759][T25642] ? ksys_write+0x190/0x250 [ 3355.604776][T25642] ? ksys_write+0x190/0x250 [ 3355.604811][T25642] ? fput+0x79/0x100 [ 3355.604835][T25642] ? __ia32_sys_bpf+0xcc/0x170 [ 3355.604853][T25642] __ia32_sys_bpf+0xcc/0x170 [ 3355.604873][T25642] ? __do_fast_syscall_32+0x98/0x970 [ 3355.604898][T25642] __do_fast_syscall_32+0xe7/0x970 [ 3355.604920][T25642] ? lockdep_hardirqs_on+0x78/0x100 [ 3355.604943][T25642] do_fast_syscall_32+0x32/0x70 [ 3355.604965][T25642] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3355.604988][T25642] RIP: 0023:0xf7f76fec [ 3355.605008][T25642] Code: Unable to access opcode bytes at 0xf7f76fc2. [ 3355.605017][T25642] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 3355.605035][T25642] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000440 [ 3355.605046][T25642] RDX: 0000000000000078 RSI: 0000000000000000 RDI: 0000000000000000 [ 3355.605057][T25642] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3355.605067][T25642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3355.605078][T25642] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3355.605101][T25642] [ 3355.605137][T25642] Mem-Info: [ 3355.638945][T31629] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 3355.640493][T25642] active_anon:3508 inactive_anon:3295 isolated_anon:0 [ 3355.640493][T25642] active_file:9496 inactive_file:13609 isolated_file:0 [ 3355.640493][T25642] unevictable:1768 dirty:404 writeback:0 [ 3355.640493][T25642] slab_reclaimable:7277 slab_unreclaimable:77621 [ 3355.640493][T25642] mapped:26476 shmem:2297 pagetables:1233 [ 3355.640493][T25642] sec_pagetables:324 bounce:0 [ 3355.640493][T25642] kernel_misc_reclaimable:0 [ 3355.640493][T25642] free:41002 free_pcp:7559 free_cma:0 [ 3355.765168][T25642] Node 0 active_anon:116kB inactive_anon:160kB active_file:28kB inactive_file:16kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:5148kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7552kB pagetables:1264kB sec_pagetables:1120kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 3355.778958][T25642] Node 1 active_anon:13916kB inactive_anon:13020kB active_file:37956kB inactive_file:54420kB unevictable:5536kB isolated(anon):0kB isolated(file):0kB mapped:100756kB dirty:1612kB writeback:0kB shmem:7652kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7392kB pagetables:3668kB sec_pagetables:176kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 3355.792883][T25642] Node 0 DMA free:2652kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:16kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 3355.804947][T25642] lowmem_reserve[]: 0 280 280 280 280 [ 3355.807268][T25642] Node 0 DMA32 free:15100kB boost:0kB min:12772kB low:15964kB high:19156kB reserved_highatomic:0KB free_highatomic:0KB active_anon:116kB inactive_anon:160kB active_file:12kB inactive_file:16kB unevictable:1536kB writepending:4kB zspages:0kB present:1032196kB managed:286968kB mlocked:0kB bounce:0kB free_pcp:4148kB local_pcp:2184kB free_cma:0kB [ 3355.819689][T25642] lowmem_reserve[]: 0 0 0 0 0 [ 3355.821833][T25642] Node 1 DMA32 free:146048kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:13916kB inactive_anon:13020kB active_file:37956kB inactive_file:54420kB unevictable:5536kB writepending:1612kB zspages:1780kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:26112kB local_pcp:2132kB free_cma:0kB [ 3355.835514][T25642] lowmem_reserve[]: 0 0 0 0 0 [ 3355.837504][T25642] Node 0 DMA: 177*4kB (U) 33*8kB (U) 13*16kB (U) 10*32kB (U) 2*64kB (U) 0*128kB 2*256kB (U) 1*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 2652kB [ 3355.843417][T25642] Node 0 DMA32: 11*4kB (UE) 34*8kB (UME) 20*16kB (UME) 56*32kB (UME) 34*64kB (ME) 28*128kB (UME) 9*256kB (UM) 9*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 15100kB [ 3355.850260][T25642] Node 1 DMA32: 867*4kB (UME) 1233*8kB (UME) 1052*16kB (UME) 656*32kB (UME) 393*64kB (UME) 134*128kB (UM) 69*256kB (UME) 30*512kB (UME) 11*1024kB (UM) 4*2048kB (U) 0*4096kB = 145940kB [ 3355.857741][T25642] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3355.861801][T25642] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3355.865666][T25642] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3355.869811][T25642] Node 1 hugepages_total=4 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 3355.873693][T25642] 25910 total pagecache pages [ 3355.875681][T25642] 510 pages in swap cache [ 3355.877473][T25642] Free swap = 120848kB [ 3355.879274][T25642] Total swap = 124996kB [ 3355.880977][T25642] 524155 pages RAM [ 3355.882548][T25642] 0 pages HighMem/MovableOnly [ 3355.884531][T25642] 211520 pages reserved [ 3355.886249][T25642] 0 pages cma reserved [ 3356.870526][T31629] usb 6-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 3356.875493][T31629] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3356.883378][T31629] usb 6-1: Product: syz [ 3356.885158][T31629] usb 6-1: Manufacturer: syz [ 3356.899112][T31629] usb 6-1: SerialNumber: syz [ 3356.906504][T31629] usb 6-1: config 0 descriptor?? [ 3357.087067][T25659] netlink: 72 bytes leftover after parsing attributes in process `syz.4.13797'. [ 3357.246359][ T8723] usb 6-1: USB disconnect, device number 25 [ 3357.319047][T25655] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3357.339956][T25655] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3357.344365][T25655] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3357.350210][T25655] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3357.356732][T25655] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3357.376960][T25655] pci 0000:00:01.0: Adding to iommu group 1 [ 3357.389383][T21024] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 3357.397159][T25655] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3357.399611][T25655] pci 0000:00:01.0: vgaarb: bridge control possible [ 3357.401855][T25655] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3357.452225][T25655] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3357.466324][T25655] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3357.475802][T25655] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3357.485256][T25638] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 3357.493440][T25638] udc usbip-vudc.0: failed to start g1: -19 [ 3357.503503][T25638] UDC core: g1: couldn't find an available UDC or it's busy [ 3357.523752][T25655] [drm] Found bochs VGA, ID 0xb0c5. [ 3357.531749][T25655] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3357.539516][T21024] usb 9-1: Using ep0 maxpacket: 16 [ 3357.542753][T21024] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3357.547511][T21024] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3357.553194][T21024] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3357.553405][T25655] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3357.558098][T21024] usb 9-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 3357.573872][T21024] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3357.590189][T21024] usb 9-1: config 0 descriptor?? [ 3357.771775][T25655] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3358.114658][T21024] input: HID 045e:07da as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/0003:045E:07DA.0010/input/input22 [ 3358.168116][T25686] binder: BINDER_SET_CONTEXT_MGR already set [ 3358.183369][T25686] binder: 25684:25686 ioctl 4018620d 80000080 returned -16 [ 3358.225346][T21024] microsoft 0003:045E:07DA.0010: input,hidraw1: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0 [ 3358.320377][T21024] usb 9-1: USB disconnect, device number 3 [ 3358.402682][T25691] fido_id[25691]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb9/report_descriptor': No such file or directory [ 3359.668962][T22310] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 3359.829036][T22310] usb 9-1: Using ep0 maxpacket: 32 [ 3359.832724][T22310] usb 9-1: too many configurations: 32, using maximum allowed: 8 [ 3359.848387][T22310] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 3359.851217][T22310] usb 9-1: can't read configurations, error -61 [ 3359.989210][T22310] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 3360.168968][T22310] usb 9-1: Using ep0 maxpacket: 32 [ 3360.173323][T22310] usb 9-1: too many configurations: 32, using maximum allowed: 8 [ 3360.182835][T22310] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 3360.186260][T22310] usb 9-1: can't read configurations, error -61 [ 3360.193861][T22310] usb usb9-port1: attempt power cycle [ 3360.539314][T22310] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 3360.570981][T22310] usb 9-1: Using ep0 maxpacket: 32 [ 3360.574102][T22310] usb 9-1: too many configurations: 32, using maximum allowed: 8 [ 3360.582229][T22310] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 3360.599627][T22310] usb 9-1: can't read configurations, error -61 [ 3360.789510][T22310] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 3360.822740][ T42] audit: type=1326 audit(1785019940.949:937): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25724 comm="syz.2.13804" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 3360.823952][T22310] usb 9-1: Using ep0 maxpacket: 32 [ 3360.831114][ T42] audit: type=1326 audit(1785019940.959:938): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25724 comm="syz.2.13804" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 3360.831159][ T42] audit: type=1326 audit(1785019940.959:939): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25724 comm="syz.2.13804" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71b72eb code=0x7ffc0000 [ 3360.850728][ T42] audit: type=1326 audit(1785019940.959:940): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25724 comm="syz.2.13804" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 3360.859711][ T42] audit: type=1326 audit(1785019940.959:941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25724 comm="syz.2.13804" exe="/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 3360.868463][ T42] audit: type=1326 audit(1785019940.969:942): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25724 comm="syz.2.13804" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 3360.877301][ T42] audit: type=1326 audit(1785019940.969:943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25724 comm="syz.2.13804" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 3360.893939][ T42] audit: type=1326 audit(1785019940.979:944): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25724 comm="syz.2.13804" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 3360.900753][T22310] usb 9-1: too many configurations: 32, using maximum allowed: 8 [ 3360.907260][ T42] audit: type=1326 audit(1785019940.979:945): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25724 comm="syz.2.13804" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 3360.922123][ T42] audit: type=1326 audit(1785019940.989:946): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25724 comm="syz.2.13804" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb5fec code=0x7ffc0000 [ 3360.955472][T22310] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 3360.970216][T22310] usb 9-1: can't read configurations, error -61 [ 3360.983813][T22310] usb usb9-port1: unable to enumerate USB device [ 3361.609421][T22310] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 3361.631495][T25759] binder: Unknown parameter 'subj_type' [ 3361.760918][T22310] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 3361.764758][T22310] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 3361.768624][T22310] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 3361.771652][T22310] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3361.777543][T25743] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 3361.806241][T22310] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 3361.872105][ T9122] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 3362.025708][ T9122] usb 7-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 3362.029250][ T9122] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3362.032145][ T9122] usb 7-1: Product: syz [ 3362.033987][ T9122] usb 7-1: Manufacturer: syz [ 3362.035617][ T9122] usb 7-1: SerialNumber: syz [ 3362.039999][ T9122] usb 7-1: config 0 descriptor?? [ 3362.123597][T21024] usb 6-1: USB disconnect, device number 26 [ 3362.216445][T25762] netlink: 'syz.4.13809': attribute type 1 has an invalid length. [ 3362.248221][ T9122] usb 7-1: USB disconnect, device number 32 [ 3362.330320][T25762] 8021q: adding VLAN 0 to HW filter on device bond1 [ 3362.430618][T25766] bond1: (slave veth3): Enslaving as an active interface with a down link [ 3362.455133][T25759] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 3362.457475][T25759] udc usbip-vudc.0: failed to start g1: -19 [ 3362.460164][T25759] UDC core: g1: couldn't find an available UDC or it's busy [ 3362.473267][T25768] vlan2: entered allmulticast mode [ 3362.475068][T25768] bridge0: entered allmulticast mode [ 3362.479284][T25768] bond1: (slave vlan2): making interface the new active one [ 3362.482522][T25768] vlan2: entered promiscuous mode [ 3362.484136][T25768] bridge0: entered promiscuous mode [ 3362.486545][T25768] bond1: (slave vlan2): Enslaving as an active interface with an up link [ 3363.397574][T25783] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3363.408552][T25783] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3363.413927][T25783] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3363.417024][T25783] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3363.421786][T25783] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3363.436789][T25783] pci 0000:00:01.0: Adding to iommu group 1 [ 3363.445589][T25783] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3363.448408][T25783] pci 0000:00:01.0: vgaarb: bridge control possible [ 3363.450807][T25783] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3363.485150][T25783] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3363.488605][T25783] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3363.496324][T25783] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3363.508640][T25783] [drm] Found bochs VGA, ID 0xb0c5. [ 3363.511231][T25783] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3363.531393][T25783] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3363.570435][T25783] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3364.456141][T25807] 9pnet_virtio: no channels available for device syz [ 3364.952100][T25812] binder: Unknown parameter 'subj_type' [ 3366.743878][T25831] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13826'. [ 3367.336549][T25845] overlayfs: overlapping lowerdir path [ 3367.780470][T25852] bridge0: port 2(bridge_slave_1) entered disabled state [ 3367.783073][T25852] bridge0: port 1(bridge_slave_0) entered disabled state [ 3367.829769][T25852] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 3367.835001][T25852] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 3367.907481][ T8796] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3367.911591][ T8796] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3367.917700][ T8796] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3367.924263][ T8796] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3369.090245][T25849] binder: Binderfs stats mode cannot be changed during a remount [ 3370.639313][T25880] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3370.658516][T25880] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3370.663038][T25880] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3370.666445][T25880] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3370.670957][T25880] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3370.687274][T25880] pci 0000:00:01.0: Adding to iommu group 1 [ 3370.700740][T25880] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3370.703501][T25880] pci 0000:00:01.0: vgaarb: bridge control possible [ 3370.706176][T25880] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3370.717546][T25880] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3370.721457][T25880] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3370.726245][T25880] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3370.743522][T25880] [drm] Found bochs VGA, ID 0xb0c5. [ 3370.745825][T25880] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3370.760058][T25880] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3370.814619][T25880] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3371.339024][ T9965] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 3371.490129][ T9965] usb 6-1: Using ep0 maxpacket: 32 [ 3371.499484][ T9965] usb 6-1: no configurations [ 3371.506990][ T9965] usb 6-1: can't read configurations, error -22 [ 3371.669227][ T9965] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 3371.829092][ T9965] usb 6-1: Using ep0 maxpacket: 32 [ 3371.846340][ T9965] usb 6-1: no configurations [ 3371.863397][ T9965] usb 6-1: can't read configurations, error -22 [ 3371.887949][ T9965] usb usb6-port1: attempt power cycle [ 3372.248935][ T9965] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 3372.291937][ T9965] usb 6-1: Using ep0 maxpacket: 32 [ 3372.305739][ T9965] usb 6-1: no configurations [ 3372.316387][ T9965] usb 6-1: can't read configurations, error -22 [ 3372.459566][ T9965] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 3372.493626][ T9965] usb 6-1: Using ep0 maxpacket: 32 [ 3372.507515][ T9965] usb 6-1: no configurations [ 3372.520086][ T9965] usb 6-1: can't read configurations, error -22 [ 3372.538616][ T9965] usb usb6-port1: unable to enumerate USB device [ 3373.205587][T25932] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3373.264901][T25932] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3373.278144][T25932] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3373.292544][T25932] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3373.299329][T25932] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3373.324369][T25932] pci 0000:00:01.0: Adding to iommu group 1 [ 3373.344567][T25932] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3373.346721][T25932] pci 0000:00:01.0: vgaarb: bridge control possible [ 3373.349029][T25932] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3373.372189][T25932] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3373.375383][T25932] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3373.391817][T25932] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3373.414047][T25932] [drm] Found bochs VGA, ID 0xb0c5. [ 3373.416314][T25932] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3373.453458][T25932] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3373.553637][T25932] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3373.959126][ T9965] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 3374.105613][T25956] binder: Unknown parameter 'subj_type' [ 3374.120662][ T9965] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 3374.124497][ T9965] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 3374.127732][ T9965] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 3374.131830][ T9965] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3374.137365][T25943] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 3374.143309][ T9965] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 3374.351199][ T9965] usb 9-1: USB disconnect, device number 8 [ 3374.363668][T21024] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 3374.539150][T21024] usb 6-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 3374.545305][T21024] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3374.553079][T21024] usb 6-1: Product: syz [ 3374.554904][T21024] usb 6-1: Manufacturer: syz [ 3374.559911][T21024] usb 6-1: SerialNumber: syz [ 3374.569209][T21024] usb 6-1: config 0 descriptor?? [ 3374.791882][T21025] usb 6-1: USB disconnect, device number 31 [ 3375.647585][T25977] overlayfs: overlapping lowerdir path [ 3377.849877][T25985] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 3379.570592][T26024] tipc: Started in network mode [ 3379.572864][T26024] tipc: Node identity 4, cluster identity 4711 [ 3379.580126][T26024] tipc: Node number set to 4 [ 3380.287216][T26030] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3380.302227][T26030] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3380.305229][T26030] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3380.310174][T26030] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3380.315721][T26030] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3380.331874][T26030] pci 0000:00:01.0: Adding to iommu group 1 [ 3380.350444][T26030] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3380.352867][T26030] pci 0000:00:01.0: vgaarb: bridge control possible [ 3380.355791][T26030] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3380.371062][T26030] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3380.373833][T26030] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3380.380397][T26030] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3380.390183][T26030] [drm] Found bochs VGA, ID 0xb0c5. [ 3380.392199][T26030] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3380.404812][T26030] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3380.445537][T26034] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(8) [ 3380.447938][T26034] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 3380.452079][T26034] vhci_hcd vhci_hcd.0: Device attached [ 3380.471046][T26030] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3380.473508][T12771] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3380.480738][T12771] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3380.690003][T26039] comedi comedi0: 8255: I/O base address not correctly aligned [ 3380.750337][T21024] usb 44-1: SetAddress Request (94) to port 0 [ 3380.753064][T21024] usb 44-1: new SuperSpeed USB device number 94 using vhci_hcd [ 3381.187361][T26036] vhci_hcd: connection reset by peer [ 3381.191212][ T8796] vhci_hcd vhci_hcd.3: stop threads [ 3381.193375][ T8796] vhci_hcd vhci_hcd.3: release socket [ 3381.195577][ T8796] vhci_hcd vhci_hcd.3: disconnect device [ 3381.219082][ T9965] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 3381.369168][ T9965] usb 7-1: Using ep0 maxpacket: 8 [ 3381.372822][ T9965] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3381.376704][ T9965] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3381.380550][ T9965] usb 7-1: config 0 interface 0 has no altsetting 0 [ 3381.382660][ T9965] usb 7-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 3381.386105][ T9965] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3381.390902][ T9965] usb 7-1: config 0 descriptor?? [ 3382.279156][T26062] netlink: 'syz.4.13880': attribute type 10 has an invalid length. [ 3382.282676][T26062] ipvlan0: entered allmulticast mode [ 3382.285054][T26062] veth0_vlan: entered allmulticast mode [ 3382.291494][T26062] team0: Device ipvlan0 failed to register rx_handler [ 3382.863465][T26068] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3382.895144][T26068] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3382.909059][T26068] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3382.915115][T26068] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3382.921966][T26068] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3382.943126][T26068] pci 0000:00:01.0: Adding to iommu group 1 [ 3382.954805][T26068] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3382.957511][T26068] pci 0000:00:01.0: vgaarb: bridge control possible [ 3382.960263][T26068] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3382.982241][T26068] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3382.986230][T26068] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3382.991984][T26068] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3383.007690][T26068] [drm] Found bochs VGA, ID 0xb0c5. [ 3383.010280][T26068] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3383.020549][T26068] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3383.062835][T26068] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3384.092057][ T9965] usbhid 7-1:0.0: can't add hid device: -71 [ 3384.097501][ T9965] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 3384.119595][ T9965] usb 7-1: USB disconnect, device number 33 [ 3384.816302][T26103] x_tables: ip6_tables: recent.0 match: invalid size 216 (kernel) != (user) 232 [ 3384.919986][T26100] binder: Binderfs stats mode cannot be changed during a remount [ 3384.979169][ T9965] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 3385.139048][ T9965] usb 9-1: Using ep0 maxpacket: 32 [ 3385.142385][ T9965] usb 9-1: too many configurations: 32, using maximum allowed: 8 [ 3385.148085][ T9965] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 3385.152245][ T9965] usb 9-1: can't read configurations, error -61 [ 3385.285176][T26105] binder: Binderfs stats mode cannot be changed during a remount [ 3385.289211][ T9965] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 3385.439088][ T9965] usb 9-1: Using ep0 maxpacket: 32 [ 3385.445468][ T9965] usb 9-1: too many configurations: 32, using maximum allowed: 8 [ 3385.453533][ T9965] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 3385.456945][ T9965] usb 9-1: can't read configurations, error -61 [ 3385.462697][ T9965] usb usb9-port1: attempt power cycle [ 3385.819672][ T9965] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 3385.839455][T21024] usb 44-1: device descriptor read/8, error -110 [ 3385.844962][ T9965] usb 9-1: Using ep0 maxpacket: 32 [ 3385.849711][ T9965] usb 9-1: too many configurations: 32, using maximum allowed: 8 [ 3385.859185][ T9965] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 3385.861942][ T9965] usb 9-1: can't read configurations, error -61 [ 3385.879157][T26116] netlink: 'syz.3.13895': attribute type 10 has an invalid length. [ 3386.008933][ T9965] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 3386.029689][ T9965] usb 9-1: Using ep0 maxpacket: 32 [ 3386.033581][ T9965] usb 9-1: too many configurations: 32, using maximum allowed: 8 [ 3386.048041][ T9965] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 3386.051800][ T9965] usb 9-1: can't read configurations, error -61 [ 3386.060516][ T9965] usb usb9-port1: unable to enumerate USB device [ 3386.259984][T21024] usb usb44-port1: attempt power cycle [ 3386.849558][T21024] usb usb44-port1: unable to enumerate USB device [ 3386.903116][T26145] binder: Unknown parameter 'subj_type' [ 3387.160579][T22310] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 3387.207018][T26148] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3387.221301][T26148] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3387.223881][T26148] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3387.226251][T26148] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3387.229689][T26148] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3387.241153][T26148] pci 0000:00:01.0: Adding to iommu group 1 [ 3387.245960][T26148] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3387.248365][T26148] pci 0000:00:01.0: vgaarb: bridge control possible [ 3387.250916][T26148] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3387.261890][T26148] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3387.265428][T26148] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3387.269724][T26148] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3387.277172][T26148] [drm] Found bochs VGA, ID 0xb0c5. [ 3387.279487][T26148] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3387.306780][T26148] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3387.323934][T22310] usb 9-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 3387.327683][T22310] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3387.331240][T22310] usb 9-1: Product: syz [ 3387.333013][T22310] usb 9-1: Manufacturer: syz [ 3387.335280][T22310] usb 9-1: SerialNumber: syz [ 3387.340311][T22310] usb 9-1: config 0 descriptor?? [ 3387.358123][T26148] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3387.552936][T22310] usb 9-1: USB disconnect, device number 13 [ 3387.756839][T26145] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 3387.759411][T26145] udc usbip-vudc.0: failed to start g1: -19 [ 3387.762284][T26145] UDC core: g1: couldn't find an available UDC or it's busy [ 3387.897001][ T9965] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 3388.048922][ T9965] usb 7-1: Using ep0 maxpacket: 8 [ 3388.059935][ T9965] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3388.063498][ T9965] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3388.066701][ T9965] usb 7-1: config 0 interface 0 has no altsetting 0 [ 3388.068735][ T9965] usb 7-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 3388.078190][ T9965] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3388.082689][ T9965] usb 7-1: config 0 descriptor?? [ 3388.650687][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 3389.389158][T26116] team0: Device ipvlan0 failed to register rx_handler [ 3389.516261][T26162] overlayfs: overlapping lowerdir path [ 3389.655131][T26167] overlayfs: overlapping lowerdir path [ 3390.459676][T26172] netlink: 'syz.4.13905': attribute type 10 has an invalid length. [ 3390.462351][T26172] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13905'. [ 3390.588128][ T9965] usbhid 7-1:0.0: can't add hid device: -71 [ 3390.590796][ T9965] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 3390.598364][ T9965] usb 7-1: USB disconnect, device number 34 [ 3390.677148][T26185] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3390.695667][T26185] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3390.699170][T26185] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3390.702975][T26185] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3390.711608][T26185] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3390.730506][T26190] netlink: 'syz.1.13910': attribute type 10 has an invalid length. [ 3390.734081][T26190] ipvlan0: entered allmulticast mode [ 3390.736393][T26190] veth0_vlan: entered allmulticast mode [ 3390.743563][T26190] team0: Device ipvlan0 failed to register rx_handler [ 3390.746836][T26185] pci 0000:00:01.0: Adding to iommu group 1 [ 3390.770174][T26185] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3390.772241][T26185] pci 0000:00:01.0: vgaarb: bridge control possible [ 3390.774261][T26185] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3390.796811][T26185] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3390.809276][T26185] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3390.817689][T26185] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3390.862654][T26185] [drm] Found bochs VGA, ID 0xb0c5. [ 3390.867152][T26185] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3390.885179][T26185] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3390.969948][T26185] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3391.018652][T26196] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3391.032837][T26196] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3391.036583][T26196] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3391.041805][T26196] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3391.045066][T26196] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3391.057378][T26196] pci 0000:00:01.0: Adding to iommu group 1 [ 3391.082856][T26196] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3391.085434][T26196] pci 0000:00:01.0: vgaarb: bridge control possible [ 3391.088061][T26196] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3391.105023][T26196] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3391.107985][T26196] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3391.115079][T26196] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3391.118461][T26200] netlink: 'syz.4.13912': attribute type 10 has an invalid length. [ 3391.125810][T26200] team0: Device ipvlan0 failed to register rx_handler [ 3391.139272][T26196] [drm] Found bochs VGA, ID 0xb0c5. [ 3391.141677][T26196] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3391.157098][T26196] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3391.203503][T26196] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3391.368959][T26204] overlayfs: overlapping lowerdir path [ 3393.316285][T17502] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 3393.332906][T17502] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 3393.344206][T17502] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 3393.347997][T17502] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 3393.351507][T17502] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 3393.779124][T21024] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 3393.805224][T26218] bridge0: port 1(bridge_slave_0) entered blocking state [ 3393.808271][T26218] bridge0: port 1(bridge_slave_0) entered disabled state [ 3393.813751][T26218] bridge_slave_0: entered allmulticast mode [ 3393.819490][T26218] bridge_slave_0: entered promiscuous mode [ 3393.823461][T26218] bridge0: port 2(bridge_slave_1) entered blocking state [ 3393.826270][T26218] bridge0: port 2(bridge_slave_1) entered disabled state [ 3393.829215][T26218] bridge_slave_1: entered allmulticast mode [ 3393.832074][T26218] bridge_slave_1: entered promiscuous mode [ 3393.849179][T26218] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3393.853669][T26218] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3393.874241][T26218] team0: Port device team_slave_0 added [ 3393.879348][T26218] team0: Port device team_slave_1 added [ 3393.898214][T26218] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 3393.900627][T26218] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3393.909772][T26218] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 3393.914579][T26218] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 3393.917086][T26218] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3393.926760][T26218] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 3393.928936][T21024] usb 7-1: Using ep0 maxpacket: 8 [ 3393.940584][T21024] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3393.946864][T21024] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3393.955501][T26218] hsr_slave_0: entered promiscuous mode [ 3393.955514][T21024] usb 7-1: config 0 interface 0 has no altsetting 0 [ 3393.957759][T26218] hsr_slave_1: entered promiscuous mode [ 3393.962608][T26218] debugfs: 'hsr0' already exists in 'hsr' [ 3393.965095][T26218] Cannot create hsr debugfs directory [ 3393.965677][T21024] usb 7-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 3393.975847][T21024] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3393.988335][T21024] usb 7-1: config 0 descriptor?? [ 3394.413313][T21024] mcp2221 0003:04D8:00DD.0011: unknown main item tag 0x0 [ 3394.417639][T21024] mcp2221 0003:04D8:00DD.0011: unknown main item tag 0x0 [ 3394.422902][T21024] mcp2221 0003:04D8:00DD.0011: unknown main item tag 0x0 [ 3394.426713][T21024] mcp2221 0003:04D8:00DD.0011: unknown main item tag 0x0 [ 3394.430120][T21024] mcp2221 0003:04D8:00DD.0011: unknown main item tag 0x0 [ 3394.433687][T21024] mcp2221 0003:04D8:00DD.0011: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 3394.590698][T26218] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 3394.598157][T26218] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 3394.601323][T26218] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 3394.605264][T26218] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 3394.610327][T26218] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 3394.616228][T26218] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 3394.619331][T26218] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 3394.623612][T26218] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 3394.699513][T26218] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3394.711368][T26218] 8021q: adding VLAN 0 to HW filter on device team0 [ 3394.716597][T25392] bridge0: port 1(bridge_slave_0) entered blocking state [ 3394.718899][T25392] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3394.725459][T25392] bridge0: port 2(bridge_slave_1) entered blocking state [ 3394.728004][T25392] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3395.198251][T26218] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3395.246994][T26218] veth0_vlan: entered promiscuous mode [ 3395.258110][T26218] veth1_vlan: entered promiscuous mode [ 3395.285604][T26218] veth0_macvtap: entered promiscuous mode [ 3395.293269][T26218] veth1_macvtap: entered promiscuous mode [ 3395.307097][T26218] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 3395.318013][T26218] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 3395.328442][ T8796] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3395.332056][ T8796] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3395.336276][ T8796] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3395.341838][ T8796] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3395.439824][T17502] Bluetooth: hci3: command tx timeout [ 3395.502203][T11846] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3395.506488][T11846] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3395.643984][T11846] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3395.647264][T11846] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3395.691492][ T9965] usb 7-1: reset high-speed USB device number 35 using dummy_hcd [ 3395.786799][T26275] netlink: 'syz.1.13924': attribute type 10 has an invalid length. [ 3395.789448][T26275] ipvlan0: entered allmulticast mode [ 3395.791214][T26275] veth0_vlan: entered allmulticast mode [ 3395.794552][T26275] team0: Device ipvlan0 failed to register rx_handler [ 3397.159739][ T6248] usb 7-1: USB disconnect, device number 35 [ 3397.519396][T17502] Bluetooth: hci3: command tx timeout [ 3398.240780][T26313] overlayfs: overlapping lowerdir path [ 3399.610854][T17502] Bluetooth: hci3: command tx timeout [ 3400.491150][T31022] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 3400.910958][T31022] usb 7-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 3400.918290][T31022] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3400.923069][T31022] usb 7-1: Product: syz [ 3400.933874][T31022] usb 7-1: Manufacturer: syz [ 3400.938699][T31022] usb 7-1: SerialNumber: syz [ 3401.487450][T31022] usb 7-1: config 0 descriptor?? [ 3401.678982][T17502] Bluetooth: hci3: command tx timeout [ 3401.721558][ T6248] usb 7-1: USB disconnect, device number 36 [ 3403.367270][T26370] binder: Binderfs stats mode cannot be changed during a remount [ 3404.019543][ T8723] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 3404.101768][T26388] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3404.104562][T26387] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 3404.115584][T26388] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3404.118417][T26388] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3404.121364][T26388] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3404.124391][T26388] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3404.142535][T26388] pci 0000:00:01.0: Adding to iommu group 1 [ 3404.153675][T26388] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3404.156370][T26388] pci 0000:00:01.0: vgaarb: bridge control possible [ 3404.158920][T26388] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3404.191998][ T8723] usb 7-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 3404.195285][ T8723] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3404.197741][T26388] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3404.199708][ T8723] usb 7-1: Product: syz [ 3404.204119][ T8723] usb 7-1: Manufacturer: syz [ 3404.205552][ T8723] usb 7-1: SerialNumber: syz [ 3404.208651][ T8723] usb 7-1: config 0 descriptor?? [ 3404.214040][T26388] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3404.241428][T26388] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3404.262384][T26388] [drm] Found bochs VGA, ID 0xb0c5. [ 3404.264932][T26388] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3404.329422][T26388] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3404.389572][T26388] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3404.414802][T25303] usb 7-1: USB disconnect, device number 37 [ 3404.660406][T26395] input: syz0 as /devices/virtual/input/input23 [ 3406.018316][T26406] input: syz1 as /devices/virtual/input/input24 [ 3406.135011][T26410] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13966'. [ 3406.139005][T26410] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13966'. [ 3406.719033][ T8723] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 3406.719095][T17502] Bluetooth: hci1: command 0x0c1a tx timeout [ 3406.721005][ T8723] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 3406.728955][T31022] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 3407.265886][T26430] overlayfs: overlapping lowerdir path [ 3407.610143][T26435] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 3407.623922][T26435] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 3407.631040][T26435] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 3407.634551][T26435] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 3407.637587][T26435] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 3407.669688][T26435] pci 0000:00:01.0: Adding to iommu group 1 [ 3407.678340][T26435] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 3407.681011][T26435] pci 0000:00:01.0: vgaarb: bridge control possible [ 3407.683534][T26435] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 3407.708382][T26435] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 3407.714954][T26435] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 3407.721945][T26435] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 3407.732603][T26435] [drm] Found bochs VGA, ID 0xb0c5. [ 3407.734279][T26435] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 3407.746605][T26435] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 3407.790804][T31022] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 3407.794400][T31022] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 3407.797485][T31022] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 3407.801238][T31022] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3407.811623][T26420] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 3407.815283][T26435] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 3407.816666][T31022] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 3408.751420][T31022] usb 9-1: USB disconnect, device number 14 [ 3408.799579][ T8723] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 3408.804125][ T8723] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 3408.808939][ C3] ------------[ cut here ]------------ [ 3408.811708][ C3] workqueue: cannot queue hci_cmd_timeout on wq hci3 [ 3408.814364][ C3] WARNING: kernel/workqueue.c:2305 at __queue_work+0xd2d/0x12b0, CPU#3: kworker/3:1H/20980 [ 3408.818135][ C3] Modules linked in: [ 3408.819981][ C3] CPU: 3 UID: 0 PID: 20980 Comm: kworker/3:1H Tainted: G L syzkaller #0 PREEMPT(full) [ 3408.824169][ C3] Tainted: [L]=SOFTLOCKUP [ 3408.825847][ C3] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3408.829669][ C3] Workqueue: events_highpri snd_vmidi_output_work [ 3408.832198][ C3] RIP: 0010:__queue_work+0xd31/0x12b0 [ 3408.834305][ C3] Code: 00 00 00 fc ff df 49 8d 94 24 70 01 00 00 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 52 05 00 00 48 8d 3d e3 9b 56 0f 48 8b 75 18 <67> 48 0f b9 3a 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 3408.841712][ C3] RSP: 0000:ffffc900005e8be0 EFLAGS: 00010046 [ 3408.844295][ C3] RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff1100bf0614e [ 3408.846836][ C3] RDX: ffff88804c0d7170 RSI: ffffffff8aab5320 RDI: ffffffff9125d490 [ 3408.849260][ C3] RBP: ffff88805f830a58 R08: 0000000000000005 R09: 0000000000000000 [ 3408.851727][ C3] R10: 0000000000000100 R11: 0000000000000000 R12: ffff88804c0d7000 [ 3408.854233][ C3] R13: 0000000000000000 R14: ffffffff81cf3e40 R15: 0000000000000001 [ 3408.856717][ C3] FS: 0000000000000000(0000) GS:ffff888096ee5000(0000) knlGS:0000000000000000 [ 3408.860071][ C3] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3408.862603][ C3] CR2: 0000000080001000 CR3: 0000000056fb1000 CR4: 0000000000352ef0 [ 3408.865673][ C3] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3408.868343][ C3] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 3408.870801][ C3] Call Trace: [ 3408.871849][ C3] [ 3408.872775][ C3] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 3408.874643][ C3] call_timer_fn+0x19a/0x610 [ 3408.876449][ C3] ? __pfx_call_timer_fn+0x10/0x10 [ 3408.878428][ C3] ? __run_timers+0x560/0xb00 [ 3408.880285][ C3] ? __run_timers+0x560/0xb00 [ 3408.882105][ C3] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 3408.884373][ C3] __run_timers+0x570/0xb00 [ 3408.886132][ C3] ? __pfx___run_timers+0x10/0x10 [ 3408.888089][ C3] ? _raw_spin_lock_irq+0x45/0x50 [ 3408.890036][ C3] run_timer_base+0x114/0x190 [ 3408.891869][ C3] ? __pfx_run_timer_base+0x10/0x10 [ 3408.893879][ C3] run_timer_softirq+0x1a/0x50 [ 3408.895746][ C3] handle_softirqs+0x1ea/0x9b0 [ 3408.897605][ C3] ? __pfx_handle_softirqs+0x10/0x10 [ 3408.899615][ C3] ? _raw_spin_unlock+0x28/0x50 [ 3408.901507][ C3] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 3408.903672][ C3] __irq_exit_rcu+0x162/0x210 [ 3408.905503][ C3] irq_exit_rcu+0x9/0x30 [ 3408.907153][ C3] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 3408.909332][ C3] [ 3408.910499][ C3] [ 3408.911468][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 3408.913790][ C3] RIP: 0010:finish_task_switch.isra.0+0x2cd/0x10c0 [ 3408.916353][ C3] Code: ab 0a 00 00 41 c7 87 20 0e 00 00 00 00 00 00 e9 47 04 00 00 49 8d 7f 48 e8 60 bb e5 09 e8 bb 8b 3c 00 fb 48 8d bb f8 16 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 [ 3408.923710][ C3] RSP: 0000:ffffc90002e378f0 EFLAGS: 00000206 [ 3408.926118][ C3] RAX: 00000000040ea847 RBX: ffff888020f7ca80 RCX: 0000000000000040 [ 3408.929178][ C3] RDX: 0000000000000000 RSI: ffffffff8e1a7e36 RDI: ffff888020f7e178 [ 3408.932240][ C3] RBP: ffffc90002e37948 R08: 0000000000000001 R09: 0000000000000000 [ 3408.935332][ C3] R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880217cca80 [ 3408.938400][ C3] R13: 0000000000000001 R14: ffffffff9122ca84 R15: ffff88802b53b600 [ 3408.941466][ C3] __schedule+0x1264/0x6730 [ 3408.943191][ C3] ? __pfx___schedule+0x10/0x10 [ 3408.945104][ C3] ? __wake_up+0x3f/0x60 [ 3408.946765][ C3] ? __wake_up+0x3f/0x60 [ 3408.948425][ C3] ? preempt_schedule_thunk+0x16/0x40 [ 3408.950503][ C3] preempt_schedule_common+0x42/0xc0 [ 3408.952571][ C3] preempt_schedule_thunk+0x16/0x40 [ 3408.954610][ C3] _raw_spin_unlock_irqrestore+0x61/0x80 [ 3408.956785][ C3] snd_rawmidi_transmit+0xf1/0x130 [ 3408.958781][ C3] snd_vmidi_output_work+0x111/0x390 [ 3408.960839][ C3] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 3408.963079][ C3] ? rcu_is_watching+0x12/0xc0 [ 3408.964973][ C3] process_one_work+0xa23/0x1940 [ 3408.966902][ C3] ? __pfx_process_one_work+0x10/0x10 [ 3408.969006][ C3] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 3408.971273][ C3] worker_thread+0x5ef/0xe50 [ 3408.973110][ C3] ? __pfx_worker_thread+0x10/0x10 [ 3408.975095][ C3] ? kthread+0x13a/0x450 [ 3408.976752][ C3] ? __pfx_worker_thread+0x10/0x10 [ 3408.978730][ C3] kthread+0x370/0x450 [ 3408.980336][ C3] ? __pfx_kthread+0x10/0x10 [ 3408.982136][ C3] ret_from_fork+0x72b/0xd50 [ 3408.983931][ C3] ? __pfx_ret_from_fork+0x10/0x10 [ 3408.985938][ C3] ? __switch_to+0x800/0x10f0 [ 3408.987782][ C3] ? __pfx_kthread+0x10/0x10 [ 3408.989567][ C3] ret_from_fork_asm+0x1a/0x30 [ 3408.991458][ C3] [ 3408.992597][ C3] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 3408.995436][ C3] CPU: 3 UID: 0 PID: 20980 Comm: kworker/3:1H Tainted: G L syzkaller #0 PREEMPT(full) [ 3408.999619][ C3] Tainted: [L]=SOFTLOCKUP [ 3409.001287][ C3] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 3409.005085][ C3] Workqueue: events_highpri snd_vmidi_output_work [ 3409.007557][ C3] Call Trace: [ 3409.008881][ C3] [ 3409.010007][ C3] dump_stack_lvl+0x100/0x190 [ 3409.011838][ C3] vpanic+0x552/0x970 [ 3409.013398][ C3] ? __pfx_vpanic+0x10/0x10 [ 3409.015179][ C3] panic+0xd1/0xe0 [ 3409.016660][ C3] ? __pfx_panic+0x10/0x10 [ 3409.018384][ C3] ? check_panic_on_warn+0x1f/0x90 [ 3409.020386][ C3] check_panic_on_warn.cold+0x19/0x34 [ 3409.022468][ C3] ? __queue_work+0xd2d/0x12b0 [ 3409.024358][ C3] __warn.cold+0x191/0x318 [ 3409.026092][ C3] __report_bug+0x30f/0x440 [ 3409.027869][ C3] ? __queue_work+0xd2d/0x12b0 [ 3409.029742][ C3] ? __pfx___report_bug+0x10/0x10 [ 3409.031691][ C3] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 3409.033749][ C3] ? mark_held_locks+0x40/0x70 [ 3409.035646][ C3] ? look_up_lock_class+0x55/0x120 [ 3409.037479][ C3] report_bug_entry+0xe1/0x290 [ 3409.038975][ C3] ? __queue_work+0xd31/0x12b0 [ 3409.040494][ C3] handle_bug+0x1cd/0x2a0 [ 3409.041842][ C3] exc_invalid_op+0x17/0x50 [ 3409.043257][ C3] asm_exc_invalid_op+0x1a/0x20 [ 3409.044796][ C3] RIP: 0010:__queue_work+0xd31/0x12b0 [ 3409.046479][ C3] Code: 00 00 00 fc ff df 49 8d 94 24 70 01 00 00 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 52 05 00 00 48 8d 3d e3 9b 56 0f 48 8b 75 18 <67> 48 0f b9 3a 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 [ 3409.052331][ C3] RSP: 0000:ffffc900005e8be0 EFLAGS: 00010046 [ 3409.054246][ C3] RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff1100bf0614e [ 3409.056663][ C3] RDX: ffff88804c0d7170 RSI: ffffffff8aab5320 RDI: ffffffff9125d490 [ 3409.059110][ C3] RBP: ffff88805f830a58 R08: 0000000000000005 R09: 0000000000000000 [ 3409.061581][ C3] R10: 0000000000000100 R11: 0000000000000000 R12: ffff88804c0d7000 [ 3409.064024][ C3] R13: 0000000000000000 R14: ffffffff81cf3e40 R15: 0000000000000001 [ 3409.066568][ C3] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 3409.068406][ C3] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 3409.070068][ C3] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 3409.071865][ C3] call_timer_fn+0x19a/0x610 [ 3409.073325][ C3] ? __pfx_call_timer_fn+0x10/0x10 [ 3409.074922][ C3] ? __run_timers+0x560/0xb00 [ 3409.076386][ C3] ? __run_timers+0x560/0xb00 [ 3409.077844][ C3] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 3409.079633][ C3] __run_timers+0x570/0xb00 [ 3409.081069][ C3] ? __pfx___run_timers+0x10/0x10 [ 3409.082629][ C3] ? _raw_spin_lock_irq+0x45/0x50 [ 3409.084225][ C3] run_timer_base+0x114/0x190 [ 3409.085692][ C3] ? __pfx_run_timer_base+0x10/0x10 [ 3409.087301][ C3] run_timer_softirq+0x1a/0x50 [ 3409.088787][ C3] handle_softirqs+0x1ea/0x9b0 [ 3409.090289][ C3] ? __pfx_handle_softirqs+0x10/0x10 [ 3409.091924][ C3] ? _raw_spin_unlock+0x28/0x50 [ 3409.093433][ C3] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 3409.095200][ C3] __irq_exit_rcu+0x162/0x210 [ 3409.096669][ C3] irq_exit_rcu+0x9/0x30 [ 3409.097980][ C3] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 3409.099698][ C3] [ 3409.100635][ C3] [ 3409.101557][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 3409.103384][ C3] RIP: 0010:finish_task_switch.isra.0+0x2cd/0x10c0 [ 3409.105401][ C3] Code: ab 0a 00 00 41 c7 87 20 0e 00 00 00 00 00 00 e9 47 04 00 00 49 8d 7f 48 e8 60 bb e5 09 e8 bb 8b 3c 00 fb 48 8d bb f8 16 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 [ 3409.111244][ C3] RSP: 0000:ffffc90002e378f0 EFLAGS: 00000206 [ 3409.113081][ C3] RAX: 00000000040ea847 RBX: ffff888020f7ca80 RCX: 0000000000000040 [ 3409.115219][ C3] RDX: 0000000000000000 RSI: ffffffff8e1a7e36 RDI: ffff888020f7e178 [ 3409.117452][ C3] RBP: ffffc90002e37948 R08: 0000000000000001 R09: 0000000000000000 [ 3409.119859][ C3] R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880217cca80 [ 3409.122286][ C3] R13: 0000000000000001 R14: ffffffff9122ca84 R15: ffff88802b53b600 [ 3409.124730][ C3] __schedule+0x1264/0x6730 [ 3409.126147][ C3] ? __pfx___schedule+0x10/0x10 [ 3409.127663][ C3] ? __wake_up+0x3f/0x60 [ 3409.128987][ C3] ? __wake_up+0x3f/0x60 [ 3409.130318][ C3] ? preempt_schedule_thunk+0x16/0x40 [ 3409.131970][ C3] preempt_schedule_common+0x42/0xc0 [ 3409.133606][ C3] preempt_schedule_thunk+0x16/0x40 [ 3409.135253][ C3] _raw_spin_unlock_irqrestore+0x61/0x80 [ 3409.136980][ C3] snd_rawmidi_transmit+0xf1/0x130 [ 3409.138559][ C3] snd_vmidi_output_work+0x111/0x390 [ 3409.140203][ C3] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 3409.141998][ C3] ? rcu_is_watching+0x12/0xc0 [ 3409.143479][ C3] process_one_work+0xa23/0x1940 [ 3409.145046][ C3] ? __pfx_process_one_work+0x10/0x10 [ 3409.146711][ C3] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 3409.148541][ C3] worker_thread+0x5ef/0xe50 [ 3409.149989][ C3] ? __pfx_worker_thread+0x10/0x10 [ 3409.151582][ C3] ? kthread+0x13a/0x450 [ 3409.152914][ C3] ? __pfx_worker_thread+0x10/0x10 [ 3409.154559][ C3] kthread+0x370/0x450 [ 3409.155828][ C3] ? __pfx_kthread+0x10/0x10 [ 3409.157271][ C3] ret_from_fork+0x72b/0xd50 [ 3409.158715][ C3] ? __pfx_ret_from_fork+0x10/0x10 [ 3409.160322][ C3] ? __switch_to+0x800/0x10f0 [ 3409.161786][ C3] ? __pfx_kthread+0x10/0x10 [ 3409.163224][ C3] ret_from_fork_asm+0x1a/0x30 [ 3409.164737][ C3] [ 3409.166313][ C3] Kernel Offset: disabled [ 3409.167638][ C3] Rebooting in 86400 seconds..