last executing test programs: 26.96777134s ago: executing program 0 (id=310): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={0x0, 0x0, 0xd7, 0x0, 0x0, 0x7, 0x10000}, 0x28) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xfd, 0x7fff0000}]}) r1 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000080)={0xf, 0x6, 0x400}, 0x10) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000980), 0x200) r2 = openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3]) write(r1, &(0x7f0000000000)="1c0000001a009b8a140000003b000000000000000000000200000000", 0x1c) close_range(r0, 0xffffffffffffffff, 0x0) r4 = syz_ublk_setup_io_uring(0x41d, &(0x7f0000000040)={0x0, 0x73b, 0x4000, 0x2, 0x3e}, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40, 0x972, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) ustat(0x1, &(0x7f00000002c0)) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r8) r9 = openat$binder_debug(0xffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ppoll(&(0x7f0000010900)=[{r9}], 0x1, &(0x7f0000010940)={0x0, 0x3938700}, 0x0, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x14, 0x9, 0x6, 0x3, 0x0, 0x0, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) waitid(0x1, r8, 0x0, 0x61000006, &(0x7f0000000340)) r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r9, 0x9, 0x0, 0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000580)={0x2e, 0x48, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, r11, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@new_dev={0x2, 0xba0, 0x0, 0x0, 0x1000, 0xffffffff, r8, 0x0, 0x413be5e1a8bd5c12}}}, &(0x7f0000000200)=0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r13) syz_ublk_setup_queues(0xffffffffffffffff, r12, &(0x7f0000000500)={0x0, 0xa6f1, 0x800}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x593d, 0x8000, 0x5, 0x10000001}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f7ff, 0x2000, 0xfffffffe, 0x279}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf912, 0x8000, 0x2, 0x80e2, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x29a7, 0x3002, 0x3, 0x223}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x800000, 0x1, {}, 0x1f, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0) 25.888619091s ago: executing program 0 (id=316): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x40806685, &(0x7f00000000c0)={0x1, 0x1, 0x1000, 0x30, &(0x7f0000000000)="49a01907899ac1b85d31daff7240b28a374690ed0b7929d0d7cbbd628e83693ecd8641819dc14a0d7a805a377775a121", 0x33, 0x0, &(0x7f0000000040)="e8cbc3e3a678f32962e759ad3f686eb0b744d61cd0c4e4c57ce38ca39a038a744df5cbbf0a5058f4af1a8e3665ef9e6a8e8965"}) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c0000000906010200000000000000000200fdff240007801e00018008000140e00000011400170060c6faf07b6261746164765f736c6176655f3000000900020073797a31000000ef050018415eff1001"], 0x4c}, 0x1, 0x0, 0x0, 0x4008000}, 0x40c0080) 25.808438265s ago: executing program 0 (id=317): r0 = openat$fb0(0xffffff9c, &(0x7f0000000000), 0x580, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r1, 0x6, 0x2d, 0x0, &(0x7f00000017c0)) write(r0, &(0x7f0000000300)="eba643a5499c62c071fa8975d8841bd7329b95f99a40186e1c40a5f45e5a9a29542c7dbe600a55579f8b23f050e608520b3d9c9b6c527e4fe77218f652d99c19438729eae77cbba2421b3ca7d69abdfac4ee82a595f32b239858e211acbe3b5e7eace1d6c44878f4e8680a91d4590f64e674b7c6384e4c7540eda49a5a7b783e8e3f7a231010995b880800f6c50a4b6baf1a7456fa3d7b770762758e52d0d104b16da9681121662f9839e862792a861188d2943487f34025a8def617dddfd1adcd9560d3e7d9f58f51b98bd5b2e26741b4fc86e84fa8ea2b3f21550ee56dba605b8fb9b3559aa048e6e133a656b72304dcbe2f39eb36b0731d85ac096aa11d2b178a7e667ffacd93e25b93be128d103bf41d96d2eeb3f5243157f14ba0c4199a16deb68fbc8ea122445edcdf6838befb32113b47524104bc1bdbafc9649f69f9c2caa817d4cd6c88bc0fe05747b60fb8cd71c0d58dab6cc35f23bb60b4586d1819b88b48f73becc508be3a65f3ffa57d776d67498d1b4ac2edc22c7dcb339e692e386def8899ed85c0c636f3dc52543dc2dcf96b9c65f6a05b3e1aa8d77bb06c535287b83e6d6fb563fb18c1fabf322d82b1b6b7e6d068be173c5f432cbfec27aea5db9910c7f37bcf8fb0ed02ef61805417953be2335d3e4804bc39b45fcb6453173d7155e38e57b113b512c0460a8878b4db6dbe7e6632d076fffea9f706d8bf34b461d25e65429e37a3c1aeaa0ac9f4c65e32eeffee00dd0e7a7f3424549b267a42857ab2cc4f35fac79266ae7fb1ac4ce8a7b9ba5cd275f2cbc5075ee9ceb83abaa4d0d18e20eaba0086326640f5e33da3b8e17314208bda3df2cc2320fb5f10160972f06cdebee99893e4d0309fb4afb2258910a90905adb299c08e29f9aaf42cc854e273e94d11b27d63d385a9a6cbd3d94106e9d4f8d8bd89cc796c98c4ebc7e1e7580838bb97e5f0439576745bd6f81cab6a91080e460cc47f351db1da63887bff5fc4502622ce339c3b23d29b666b14e75d3d3469742a0b687a2defc0ce3aa54b7b8fe64748fa814300ca7a7fc76e37aed05b95ba27a208e2924abbf5221ced8e24adff6bb9d878292f088faa53693b5412830e21954f80a08058d75f5599460ce38f40ba68e42d619c660898ac62912d64dd0c708b08adff210fda4166ff3d42590343b3a998217d2b62c58de873a6db8145aca596c46a275091588061a422b3ae07f77c1e99507fdc5e1418f5e304bd68159e35af343958fe6a467e6a3f6eb42a33ee67e18c1ad27e8a5b0be63c7f09589f8ec4fcda161dcdcc48744ee2a7a7ad8fa5e3d830043fdb31390984c1548d541b685b77f89a49b0ad8f2de61ff057982f99c648ac00c324b3941f41ac15974922b212539f99673ba5520a0955f4aed5e2fdfb9f67075ebdb7f0cbba3ad60b421ceb2461f1d2fdf46c1ecd0680ada41e86be90d2e89cc715bfcd6dacd903bdf6e2c53bcbfc05371557b73586ed7a03488e539ed28351700101adeff4907b796a22d74576a2998d2d01b920d51db774bbbb8f1f269dc8f30aa9888f1cd3bebca88bd4bab2a84119830421fa4249460441c4e4e449587315311a861edf949222a2afe406f69dce75d378858f5b7b5db789b84a98fd419be8d7af16936712f82911fda9e033a69479bb4d4396c68a0c5198798948c5830d7c5dc3b0861707c31abbce1a8021cafc2860d7904a1f8e3444f933d951f40bdd6a7950613fe00ba80101a1344778e26c8fed1e5e894c0a01f80a326fc3c5d1036dece54b1ddde397fb97a9dad6b8283480ca557bdb929c212f147ad882095234677369c7f5c5222c17362694059d9668d2e5c69930f527d962824709e80afe98415be7f21da09ad5d7417df7c7c9ddebcb9ef0c27c299adcf708506a203ff8e69957a780818e0dcc88d05176b6c12f805a3ec59faaab0a62e36aa8f68d932bd1702113ae75647e9e598850e57a33c9f8f36e0979dbb825a076b2e2694dea24ff6adbdc1031f1eca9c1959628d6a1aa41bcf8b2f17d93a455512c54b052785423c0dc80db2b0a6c668e97441e200d30aa5d0eb643112a3aba7121b34a381a7149d88775ef862d244b9c59976889862e63dbd5c0cfcc7e4ec0d334ef0916d493b4eb19492a44c5cb14599798f76c9edbeed13a35599aff858a458a3c8db206bd6810b2035fff9de729764a7cd64f7ba49ce5150396ad14b57ac446cfecddb19e5a8d867ae6dbdd0bbe228434595c88a366d4e6aef2fc739548aab93f78972ed13ba9828ebc7db600a61e13f374cc1112f5db06767486013cb2ea0f8ee2489f5ef6951a0b334b84aec758c62fe3c2899863e6c8d9483563de81e6e7dcefb8fd843af9f51bf86e6c349e0a998927e0f083b12c6b95fce64fa961657d24b54f736a9d4b6580410d505161fddd000e63faba6da7c4fd7b1d755071a7527c2967788045dc7795d423a6bd5d5c2006b941d6e8e61d510c044a018bdbd555a43066ca21163b8bec5336df7677d1d0ddd03cbd680d6f385cdff0cfd21dacd321e1bcf0ab584c94eabb71a2c29f4513a5bdae7d03e5c9e7434d7e8ed22b22a924cecb5a590f1636774276b9bdb67b657b1765bf1e2d47ace40432e5de04c955f4f81e2e8b1152b931cbcfdf0b90e053941631c0635106fffe6a4e19d82fba99eb767e1f467a6944cd6b3aa92d53e810a3947fde0830dc5cb33c29725d1149a0cf18edc022d9bfcebaf6e9d038b6c364dfa3b896e950d8e9b8972209492ba75b03aa67d8d71d09d4ec168bf31c3231b6f3db777ef4c5db11042bec18b234cba5d38da28fcb2b8fbb7373df9b14a9faf838f65c317174b4e6f1708c4847330f3f8a54a465d652c2f9613ef537ab4c706b7d7ad1100cdd0eed7c69e6db34c8a325812f4990e029e9f01488e95c3561b4f1f142eeec9b086602d7fce5ac5c34c1f95eded720c6db6c3ed6c97aa3d96f85b912ad54f9bd34e4d70543c1c57a90eb6b6e91ebf974094791d628cafefa389c614c6196fa1c5c4b8813cccb5469511a1de0471cef287304095efd0835424e7a37703bf222bb2c8f6dda7b80f023f29ab7fd81461e3995b656428f1a343180957efa2ca09126f6bf6dc0b76a7e19e27003dd76d289d192d267a6364e23af673f9bcfd0bc79ceb22380497218c7a50641c0983c7ad57589dfe7454faf9bdf0bfbfb8996163af2b2f36803a8d6bd1dfa91d6e7f0f3e16b6a69d0df60ddc0e752cd98666a45271702be57f6488e9f9810ca9521cdee3cae58428e2f8aba383c32a5a434e52a03fe88ede76b31fe3acdddb3311b59bb6e327780fbd7faa2a309b955c8b29fb4bf07e32c794221cb057fafc42aea7878750ff9c0d12a3b23373c4b61c93bab4e5406e441a470c6f79d1ba70bbd420951425269f03543856e8ef4af64c0da8fc41fd4f25a4756dd8cda6165f89e053b954b31d26206b051353da79f5815cf6341644c81429b5a7475f938fad58a76195a2ca379b0f1399096750ef93604190f3635dbd8", 0x9bc) keyctl$set_reqkey_keyring(0xe, 0x1) r2 = io_uring_setup(0x1b56, &(0x7f0000000100)={0x0, 0xb1f4, 0x400, 0x4, 0x2cb}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="94010000", @ANYBLOB="01002dbd7000fedbdf25010000001400020077673200000000000000000000000000240003000000000000000000000000000000000000000000000000000000000000000000480108805400008024000200935fcc0d76a5bcfce584052ea21b4b2622057154ff788c325f3b596e54307c08080003000300000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696bf000008024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39222400020082a3fee8508b9dedc00d8ccb9cfa517d48a03e6112bfa9074c524b2a05708654a400098028000080060001000a00000014000200fe880000000000000000000000000101050003000300000040000080060001000a0000001400020000000000000000000000ffff7f000001050003000300000006000100020000000800"], 0x194}, 0x1, 0x0, 0x0, 0xc004}, 0x4000040) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1f00000000000000000000000010"], 0x48) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x84, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r6}}) bind$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e23, 0xfffffffc, @loopback}, 0x1c) listen(r3, 0x4) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r7, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r7, &(0x7f0000847fff)='X', 0x1, 0x4000, &(0x7f000005ffe4)={0xa, 0x4e23, 0xfffffffe, @loopback}, 0x1c) close_range(r2, 0xffffffffffffffff, 0x0) 25.264484418s ago: executing program 0 (id=324): r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) unshare(0x2020600) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=@framed={{}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x4}}]}, &(0x7f0000000300)='GPL\x00', 0x3, 0x408, &(0x7f0000001e00)=""/4087}, 0x90) mount$bind(&(0x7f0000000100)='./file0/../file0/file0\x00', &(0x7f0000000180)='./file0/../file0\x00', 0x0, 0x1b05c5a, 0x0) r2 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r0) sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c0000007d420eaf7b0f07b70adf07d9b5b43c3e9e026beced34008820903992741abf9c6d03bdd91ea7eb94aa3a26a635b940b2406cecda739f1ae855448462e559c2144668d8ab2a54ca1ec235b3526fba1d2919856bcb12f20f64c982ba5d15d9884847bbb8a2cb52f0fd8be929aa0434cb762a779d593630", @ANYRESHEX=r2, @ANYBLOB="010000000000000000002a00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}, 0x1, 0x0, 0x0, 0x4001}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) (async) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) (async) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) (async) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) (async) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) (async) socket$inet6(0xa, 0x800000000000002, 0x0) (async) unshare(0x2020600) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=@framed={{}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x4}}]}, &(0x7f0000000300)='GPL\x00', 0x3, 0x408, &(0x7f0000001e00)=""/4087}, 0x90) (async) mount$bind(&(0x7f0000000100)='./file0/../file0/file0\x00', &(0x7f0000000180)='./file0/../file0\x00', 0x0, 0x1b05c5a, 0x0) (async) syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r0) (async) sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c0000007d420eaf7b0f07b70adf07d9b5b43c3e9e026beced34008820903992741abf9c6d03bdd91ea7eb94aa3a26a635b940b2406cecda739f1ae855448462e559c2144668d8ab2a54ca1ec235b3526fba1d2919856bcb12f20f64c982ba5d15d9884847bbb8a2cb52f0fd8be929aa0434cb762a779d593630", @ANYRESHEX=r2, @ANYBLOB="010000000000000000002a00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}, 0x1, 0x0, 0x0, 0x4001}, 0x0) (async) 24.579388108s ago: executing program 0 (id=328): r0 = creat(&(0x7f0000000340)='./file0\x00', 0x14) close(r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x78bd25, 0x25dfdbfd, {0xf}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x1}]}, 0x1c}}, 0x4000080) bind$inet6(0xffffffffffffffff, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20040086, &(0x7f00000000c0)={0xa, 0x4e20, 0x6, @loopback, 0x200}, 0x1c) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000b40)=0x228a, 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="8d", 0x1, 0x40000, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}}) 23.95860952s ago: executing program 0 (id=332): r0 = openat$sndseq(0xffffff9c, &(0x7f0000001240), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000000c0)={{0x80}, 'port1\x00', 0x32d, 0x20a03}) close(r0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x1411, 0x8, 0x70bd25, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x5}]}, 0x18}, 0x1, 0x0, 0x0, 0x40800}, 0x800) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r2, &(0x7f000000d140)={0x0, 0x0, &(0x7f000000d100)={&(0x7f000000d080)={0x10, 0x1405, 0x47c0005b2307b90d, 0x70bd2d, 0x25dfdbfd}, 0x10}, 0x1, 0x0, 0x0, 0x20000000}, 0x40d0) dup(r1) r3 = syz_ublk_setup_io_uring(0x7483, &(0x7f0000000000)={0x0, 0xfa6d, 0x40, 0x1, 0x10003a7}, &(0x7f0000000080), &(0x7f0000000240), &(0x7f0000000100)) mmap$IORING_OFF_SQ_RING(0x0, 0x188d, 0x3000004, 0x2010, r3, 0x0) 23.87192433s ago: executing program 32 (id=332): r0 = openat$sndseq(0xffffff9c, &(0x7f0000001240), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000000c0)={{0x80}, 'port1\x00', 0x32d, 0x20a03}) close(r0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x1411, 0x8, 0x70bd25, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x5}]}, 0x18}, 0x1, 0x0, 0x0, 0x40800}, 0x800) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r2, &(0x7f000000d140)={0x0, 0x0, &(0x7f000000d100)={&(0x7f000000d080)={0x10, 0x1405, 0x47c0005b2307b90d, 0x70bd2d, 0x25dfdbfd}, 0x10}, 0x1, 0x0, 0x0, 0x20000000}, 0x40d0) dup(r1) r3 = syz_ublk_setup_io_uring(0x7483, &(0x7f0000000000)={0x0, 0xfa6d, 0x40, 0x1, 0x10003a7}, &(0x7f0000000080), &(0x7f0000000240), &(0x7f0000000100)) mmap$IORING_OFF_SQ_RING(0x0, 0x188d, 0x3000004, 0x2010, r3, 0x0) 4.327938514s ago: executing program 3 (id=483): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000780), &(0x7f0000000b00)='./file0\x00', &(0x7f0000000b40), 0x0, &(0x7f0000000280)={'trans=virtio,', {[{@posixacl}]}}) setxattr$system_posix_acl(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='system.posix_acl_access\x00', &(0x7f0000000580)={{}, {0x1, 0x4}, [], {0x4, 0x7}, [{0x8, 0x2}], {0x10, 0x2}, {0x20, 0x6}}, 0x2c, 0x2) (fail_nth: 1) 4.207303497s ago: executing program 3 (id=486): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x0, &(0x7f0000000380)}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x103000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1, 0x80000}) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000540)=0x1) close_range(r1, r2, 0x0) 3.958586927s ago: executing program 3 (id=488): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x100000, 0x1, &(0x7f0000006680)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) prlimit64(r0, 0xb, &(0x7f0000000140)={0x0, 0xfffffffc}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r1 = getpid() syz_pidfd_open(r1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000020ac050f022200e5818301090224000101000000090400000203010200092100050001ffff00090581", @ANYBLOB="ebed"], 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x107001) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket(0x1e, 0x1, 0x0) connect$tipc(r5, 0x0, 0x0) write$binfmt_misc(r5, &(0x7f0000000340), 0x2000011a) splice(r5, 0x0, 0xffffffffffffffff, 0x0, 0x4ff9c, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x40000) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r7, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) 3.818465977s ago: executing program 4 (id=491): r0 = creat(&(0x7f0000000340)='./file0\x00', 0x14) close(r0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x4000080) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040086, &(0x7f00000000c0)={0xa, 0x4e20, 0x6, @loopback, 0x200}, 0x1c) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000b40)=0x228a, 0x4) sendto$inet6(r1, &(0x7f0000000000)="8d", 0x1, 0x40000, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 3.811432939s ago: executing program 4 (id=493): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000006000000080000000800"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000080), 0x8000, r0}, 0x38) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b986fffffffffffff0000000", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.151139844s ago: executing program 4 (id=495): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x3, 0x0, &(0x7f0000000000)) r1 = fsopen(&(0x7f0000000400)='pvfs2\x00', 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x31a39, 0x59629}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_ACTIVE_SLAVE={0x8}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x48014}, 0x240400c0) (async) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)='source\x00', &(0x7f00000000c0)='//127.0.0.1/share\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async) r3 = socket(0x10, 0x2, 0x0) r4 = getpgrp(0x0) r5 = syz_pidfd_open(r4, 0x0) fsetxattr$trusted_overlay_nlink(r5, &(0x7f00000018c0), 0x0, 0x0, 0x1) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7800, 0x8, 0xfffffffb, 0xdc64}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', r6, 0x29, 0x0, 0x6, 0x7f, 0x5, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, 0x0, 0x40, 0x6, 0x41}}) (async) r7 = openat$sndseq(0xffffff9c, &(0x7f0000000100), 0x3b3e81) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r7, 0xc058534f, &(0x7f00000001c0)={{0x5, 0x1}, 0x0, 0x2, 0x40, {0x9, 0xfd}, 0x3, 0x8}) (async) r8 = syz_open_dev$video4linux(&(0x7f0000000000), 0x5, 0x0) ioctl$VIDIOC_QUERYSTD(r8, 0x8008563f, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000880)={'syztnl1\x00', 0x0}) (async) r9 = openat$autofs(0xffffff9c, &(0x7f0000000080), 0x105000, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r9, 0xc018937d, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0xf2}}, './file0\x00'}) 2.247886071s ago: executing program 4 (id=499): r0 = creat(&(0x7f0000000340)='./file0\x00', 0x14) close(r0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x4000080) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040086, &(0x7f00000000c0)={0xa, 0x4e20, 0x6, @loopback, 0x200}, 0x1c) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000b40)=0x228a, 0x4) sendto$inet6(r1, &(0x7f0000000000)="8d", 0x1, 0x40000, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 2.236249441s ago: executing program 4 (id=501): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1, 0x4, 0x8, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r0 = openat$cdrom(0xffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$CDROMGETSPINDOWN(r0, 0x531d, &(0x7f0000000400)) bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x1, 0x40}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000001c0)={r1, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}}, 0x30) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000001840)=r2, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x16, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r6, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0x3c, 0x4, 0x8, 0x201, 0x0, 0x0, {0xa, 0x0, 0x2}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x80f3}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0xc}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x1) listen(r5, 0x3) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) syz_open_dev$tty1(0xc, 0x4, 0x2) close_range(r4, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b66, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 1.777841447s ago: executing program 2 (id=505): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000001000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a03000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000180003801400020000007468305f746f5f68737200000000080002"], 0xe8}}, 0x0) 1.773360111s ago: executing program 1 (id=506): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x288001, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@getchain={0x24, 0x11, 0x839, 0x70bd27, 0x10000000, {0x0, 0x0, 0x0, r2, {0x4}, {}, {0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x4040091}, 0x0) 1.681236853s ago: executing program 2 (id=507): r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$MEMREADOOB(r0, 0xc00c4d04, &(0x7f0000000640)={0x5, 0x82, &(0x7f0000000400)="4504abc72f8b931be088bf611468ec80998d7b1b40aeec7927e20b8853f9e1d2b0519a7696b7791c64b9809826e4f6e0eec541aaf64fa9433e9925d839251da52166083e2bbaff69ef7afe53a48c7fcde1a402832a85cf6183b07c6ab4a3fd155c77aabd092e6aadaae4c41b9f50755104c89656c1c02137066b9c23f2e1761f7555"}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x42, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a80)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000007a2b7fb2d2b6e82a997004bd2abb02bd52f6797538db2600836d41b7d23a52f757f224b94b4002cb2246ad4bd5da414d766acd94248d9", @ANYRESHEX=r0, @ANYRES32=0x0, @ANYBLOB="000000f9ff000000000000e2bfffffffff264d52e800000000000000c65b56cf40e015a2018d1d7c7a2cb6d0d63ad4111d0cf8613d603f1277536915caac794ccbf8b4784cbd6b3af06063ee851cd6f4cc493d0d644ad64cbaa9616a75ec86d100f3d2eb335917bd3d263e06fa64ddd3be321779824af247d8e13e9187377530094574804f83effc48ca7efa7c81633f4936a464d7cad5218e6c7955da2420809d75d08e9d19"], 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000f07d860b02ffed56c8e87181fef57148d14b0a4b887c94260d313a440ca0b91ed6af131ac2b0014a6b9eba5fe8ea4afa0d6682156bc4645fd0aceba49cd181cf2d73d1ce1905d190a753e008d971bb355240448cfd4f920f1c57fbe3cac8703adacbe7c2c57a2ed867c0b72616c25090bfd49317b803b058f8f6ebf30d29e9e5d09b583518a5324d4301e0d406642e5aca31e4c412a8a5722be8c72132220e7ead1ccfd8b263fcf5a678012a55b723a470f618c82834ec951d95395826500cf5cfa826c0a1df000000000000000000"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x12, 0x3, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000003000000000000000300000095000000000000007000c01f84d37a21f7364fd967aab05d20d2e06fa3ae2d441d1eebb8f62dc3430c3496089d8c7496ab86816393279c076518869f5dffd85b4081b9b70c628809adeab44f967acfedc5aeeb510920d3e5a402ee8ff6eb738445c3406ed3a5709a1824c71f3762141ae4b1bf72b3d5ee7fd3c60ccac5a8cfabebdd303a74d946665e29a14f92b103cb2cbf6c24ccbfbee224bf64df5569a650c249cdd1ed24f696aef9ac667bb03a8af88c73b189a65752"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000340)=ANY=[]) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000340)={r4, r4, 0xd, 0x0, 0x0, 0xb, 0xf9, 0x10cf, 0x3737, 0x8b, 0x2, 0x9, 'syz0\x00'}) r5 = socket(0x10, 0x3, 0x0) write(r5, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) r6 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x9640, 0x0) ppoll(&(0x7f0000000040)=[{r6, 0xb00}], 0x1, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000c40), 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000140)={0x0, 0x6}, 0x8) dup2(r5, r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='efs\x00', 0x40c00, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) 1.506435755s ago: executing program 1 (id=508): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) read$midi(r1, 0x0, 0xddd9f082cd8b42b7) r2 = syz_open_dev$vim2m(&(0x7f0000000400), 0x0, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r2, 0xc0f8565c, &(0x7f0000000440)={0x0, 0xe8d, 0x1, {0x1, @win={{0x0, 0xffffffff, 0x100000, 0x4}, 0x0, 0x195, 0x0, 0x0, 0x0, 0xfd}}}) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80383, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r4 = add_key$keyring(&(0x7f0000000240), &(0x7f0000000280)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6_sctp(0xa, 0x1, 0x84) r6 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x36}}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) write$tun(r6, &(0x7f0000000840)=ANY=[], 0x11b0) mknodat(r6, &(0x7f00000002c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x9) write(r5, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba01", 0x35) r7 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r7, &(0x7f0000000480)='dummy_udc.0', 0xb) request_key(&(0x7f0000000040)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f00000001c0)='/dev/admmidi#\x00', r4) sched_setaffinity(0x0, 0x47, &(0x7f0000000200)=0x7) ioctl$SNDCTL_SEQ_RESET(r3, 0x5100) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c0000001800dd8d00000000000000000200000000000005000000000600150005000000280016"], 0x4c}}, 0x0) 1.502045605s ago: executing program 4 (id=509): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000003b80), r0) syz_usb_connect(0x3, 0x86, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40cd060f010001010203010902740001010080fa090400000effffff00070581024000000705820240000007058302400000070584024000000705850240000007058602400000070587024000000705010240000007050202400000070503024000000705040240000007050502"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) open(&(0x7f00000000c0)='./dev/ttyUSB0\x00', 0x4000, 0x106) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/ttyUSB0\x00', 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) sendmsg$NFC_CMD_DISABLE_SE(r0, &(0x7f0000003c80)={0x0, 0x0, &(0x7f0000003c40)={&(0x7f0000000480)={0x14, r1, 0x1, 0x70bd2b, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4008011}, 0x8) 822.675902ms ago: executing program 3 (id=510): r0 = creat(&(0x7f0000000340)='./file0\x00', 0x14) close(r0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x14, 0x27, 0x9, 0x78bd25, 0x25dfdbfd, {0xf}}, 0x14}}, 0x4000080) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040086, &(0x7f00000000c0)={0xa, 0x4e20, 0x6, @loopback, 0x200}, 0x1c) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000b40)=0x228a, 0x4) sendto$inet6(r1, &(0x7f0000000000)="8d", 0x1, 0x40000, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 758.503727ms ago: executing program 3 (id=511): r0 = socket$inet6(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, &(0x7f00000001c0)={0xa, 0x4e21, 0x8, @loopback, 0xdbb}, 0x1c) mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a\x9e@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e*\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000280), 0x1, 0x1e1242) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0xffffffffffffffdd, 0x0, 0x1, 0x0, 0x0, 0x3004c818}, 0x50) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write(r1, &(0x7f0000000200)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress.discovery,traddr=127.0.0.1', 0x48) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x200, 0x80}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) epoll_create(0x5) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r4, 0x501, 0x70bd2c, 0x25dfdbf8}, 0xfffffffffffffe93}, 0x1, 0x0, 0x0, 0x20048001}, 0x40) sendmsg$NL80211_CMD_DEL_KEY(r3, 0x0, 0x24002000) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000700)={&(0x7f0000000880)=ANY=[@ANYBLOB="90580000000000ffff00000000000000050000074c0004800c000180080001006e6174001c0001800c0001007061796c6f6164000cc90726e5a600028008000740000000000c0001800800010066776400140001800e000100627974656f726465720000000c00034000000000000000040c000640000000000000000108000b4000000002d6000740302763400d025dcf501a71403112bf3ccd5edd2070afed3792891f371dfbf0bbbb7bc6f8fe096e2b74d2da2b14a9243defb10e748005f79d635d4bff2a5fe5b7ec4e36bc2a3a93d6d9344f016af884d83e6433234836ca1f3c94fcdc6dce706885ea1e71905747bc801e3675abaa5d0a9f60cc8218c6682cf3074aa69f217f5f05b7701784af46d09111e4688ca4b1979bd5c76a963065279f3aa0dcc8a8af3ca0f67ea6a77bbdca40"], 0x158}, 0x1, 0x0, 0x0, 0xc000}, 0x40d0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./tracefs_dir/file0\x00', 0x82) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x200000, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./tracefs_dir/buffer_subbuf_size_kb\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='16', 0x2) openat(r1, 0x0, 0x800101, 0xe0) syz_io_uring_setup(0xcaf, &(0x7f00000005c0)={0x0, 0x7975, 0x2, 0x0, 0xe9}, &(0x7f0000000500), &(0x7f0000000640), &(0x7f0000000440)) 661.356123ms ago: executing program 2 (id=512): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c000009020601080000000000000000000000400500010006200000050005000a00000005000400000000000900020073797a310000000011000300686173683a69702c6d61726b"], 0x4c}}, 0x0) 583.330692ms ago: executing program 1 (id=513): r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x46, 0x180e42) write(r0, 0x0, 0xf5) 577.768644ms ago: executing program 2 (id=514): r0 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000780), 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = epoll_create1(0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) fcntl$dupfd(r2, 0x406, r1) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=@base={0x2, 0x4, 0x8, 0xf}, 0x50) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000500)={r6}, 0x4) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x19, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000020000000000000000000000b7080000000000007b8af8ff00000000b7080000040000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000000000085000000a500000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7, r5}, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x40082, 0x22) socket$unix(0x1, 0x1, 0x0) r9 = syz_open_procfs(0x0, &(0x7f00000020c0)='fdinfo/3\x00') read$FUSE(r9, &(0x7f0000000000)={0x2020}, 0x2020) write(r8, &(0x7f0000000000)='3', 0x4e) r10 = getpid() setns(0xc9, 0x0) r11 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$IPT_SO_GET_INFO(r11, 0x0, 0x40, &(0x7f0000000040)={'raw\x00', 0x0, [0x9, 0x7, 0x6dcf, 0x8, 0x800]}, &(0x7f00000000c0)=0x54) syz_pidfd_open(r10, 0x0) write$binfmt_register(r0, &(0x7f0000000100)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x98, 0x3a, 'max_read', 0x3a, '', 0x3a, './file0', 0x3a, [0x46]}, 0x30) 487.561741ms ago: executing program 1 (id=515): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) fcntl$lock(r1, 0x6, &(0x7f0000000140)={0x1, 0x1, 0x0, 0x8000000000000}) fcntl$lock(r1, 0x7, &(0x7f0000000180)={0x0, 0x5, 0x2, 0xdc0}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[], 0xbc}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYRES8=r0, @ANYRES32=r2, @ANYRES16=r2, @ANYRES8=r2], 0xe0}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) 487.225615ms ago: executing program 1 (id=516): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0) sendmsg$NFC_CMD_VENDOR(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fbdbdf251d00000008001e080500000001001424465d4e2d5cb4ea858f60880547a5d991a17f2d4d2378cccac2abba14f0fbecf0e7d5cdb1fe4565dd47", @ANYRES32=0x0, @ANYBLOB], 0x2c}, 0x1, 0x0, 0x0, 0x20004011}, 0x810) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000007c0), r3) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r3, &(0x7f0000000840)={0x0, 0x37, &(0x7f0000000800)={&(0x7f0000000280)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010028bd7000fbdbdf251a00000004002e8008000300", @ANYRES32=r6, @ANYBLOB='4\x00.'], 0x6c}, 0x1, 0x0, 0x0, 0x20040040}, 0x20040) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="28000000614310e990ab9f03096596436cbc4a7b79933b30fd688d3a245eb2dd9d60507b9c338fe1b48302662d0192384dc29b033a624d5f8ca9c56429adda4eb5058f1d9819a54130a7e1feb4", @ANYRES16=r2, @ANYBLOB="00002abd7000ffdbdf251700000008000300", @ANYRES32=r6, @ANYBLOB="0c0006000200000002000000"], 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) 467.440946ms ago: executing program 3 (id=517): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r0, @ANYRESOCT=r1], 0x1c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x40800) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1fb) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000200)={0x4, 0x8001ff, 0x2, 0x3, 0x7, "ea710000000000f9000000024200000200", 0x303, 0xf0}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000240), 0x6, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_DQBUF(r4, 0xc044560f, &(0x7f0000000380)=@mmap={0x0, 0x1, 0x4, 0x2, 0x0, {}, {0x0, 0x2, 0x0, 0x0, 0x4, 0x0, "37bb54f0"}}) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000100)=0x1) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl(r5, 0x4048aec9, 0x0) write(r2, &(0x7f0000000000)='3', 0x4e) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) recvmsg(r6, &(0x7f0000000d40)={&(0x7f0000000580)=@tipc, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000600)=""/127, 0x7f}, {&(0x7f0000000680)=""/100, 0x64}, {&(0x7f0000000bc0)=""/233, 0xe9}, {&(0x7f0000000800)=""/171, 0xab}, {&(0x7f00000008c0)=""/139, 0x8b}, {&(0x7f0000000980)=""/145, 0x91}, {&(0x7f0000000a40)=""/60, 0x3c}, {&(0x7f0000000a80)=""/197, 0xc5}, {&(0x7f0000000b80)=""/7, 0x7}, {&(0x7f0000000ec0)=""/262, 0x106}], 0xa}, 0x40000020) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000280)={0xc, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r2, 0x3b89, &(0x7f0000000540)={0x28, 0x1, 0x0, r7, 0x0, 0x0, 0x0, 0xee, &(0x7f0000000440)="bb35d6dad4bcf3956f5efc2cf64631b05e6929275e04573c5d821f81c67fb2b8851e991d6a0e9e3cf9f6a1db566de85ad9042415d034a859fd0bbb72d8c6f0e7fa8110a6c18e34e8e3923b7c6f8d7a8f00573960653652410850bb1a4c15a206be8e3521e0ebe613aaa47d125460764ec0e8c1d176b5161301ad12ce537bc00578fe6efe247e843ae8963e4b6f6063ec83e323724c9f66380b5c5fe3d1de1e04de8c668ddb0f2fc3239f46bf314e74772fdc5b44bc58b91891ead6ae88308e3305a4db35edfb167fa1227ed09ef8ff78fe992468fc64fd32543faf3844c56f0bc014748db13617edbf18e81b5391"}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r8 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) r9 = openat$cgroup_ro(r8, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0) mmap(&(0x7f00000e9000/0x3000)=nil, 0x3000, 0x3000009, 0x13, r9, 0x8a740000) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a010200000000000000000100fffd0900010073797a30000000000900030073797a300200000074000000060a010400000000000000000100000008000b400000000038000480340001800a0001006d61746368"], 0xe8}}, 0x0) r10 = syz_create_resource$binfmt(&(0x7f0000000100)='./proc\x00') openat$binfmt(0xffffff9c, r10, 0x41, 0x1ff) sendmsg$NFQNL_MSG_VERDICT(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d80)=ANY=[@ANYBLOB="200000000103010400000000000000b1d6549436a265876800000000000cfe0fae9d9efdcbd2d4b983e91629d26bde43ffb26b4275057e7f9d71f3a3f3112087efb2e9b7cdf8903d47a51f25a103c16c5aa1bda550cd34af55851eabf94eeb1031b6ff8c61e99bca95c48bac82eef18590a23e46e834bb1a4630217a2dd3a9860215604e30723fd326edbf51086e5c866bc49e0751cc9ad3c239247e9eda8a8a083d91c62bf7298093dac14e833f372f557578fc41ad38bdb3a60a7eb47c8df3e558ac435f29620b271160a9082b333452a46e4b3e479ba23f8ddf4d798c3be4e63f24a9a749cf51e06d81c65e8e186e1491dfd9777e659a284cfbe72c29b392b593639e520a"], 0x20}, 0x1, 0x0, 0x0, 0x20048001}, 0x5800) 453.394844ms ago: executing program 2 (id=518): bind$alg(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc) close(r0) write(0xffffffffffffffff, &(0x7f00000002c0)='1\n', 0x2) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config\x00', 0x1fd) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, &(0x7f0000000400)='naa.6001405c935d791', 0x13) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000000540)='1\n', 0x2) keyctl$restrict_keyring(0x1d, 0xffffffffffffffff, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002800500010000000000080007"], 0x98}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = syz_open_dev$radio(&(0x7f0000000040), 0x3, 0x2) ioctl$VIDIOC_QUERYMENU(r5, 0xc02c5625, &(0x7f0000000000)={0x98f907, 0x401, @name="c19607bb3c2cd1b6e9e52eb2f45e2ad0ec3327718daa97a12691f5d76843bf94"}) 369.836621ms ago: executing program 1 (id=519): openat$binderfs(0xffffffffffffff9c, 0x0, 0x802, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$tty1(0xc, 0x4, 0x1) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) socket(0x2d, 0x2, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/route\x00') preadv(r1, &(0x7f00000001c0)=[{&(0x7f0000000340)=""/127, 0x7f}], 0x1, 0x6, 0x0) fanotify_init(0x0, 0x0) syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x103000) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind(r2, &(0x7f0000000000)=@hci={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000010)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) write(0xca, &(0x7f0000000040)="040e0c01032000ffffffffffffffff", 0xf) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000680)={0x53, 0xfffffffffffffffc, 0x6, 0x40, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000040)="add18bb6803d", 0x0, 0xce9, 0x10, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8) setsockopt$sock_timeval(r4, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10) connect(r4, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa) 0s ago: executing program 2 (id=520): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50) close(0x3) mount(0x0, &(0x7f0000000060)='./sys\x00', &(0x7f0000000070)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) write(r1, &(0x7f0000000340), 0x0) close(0xffffffffffffffff) write(0xffffffffffffffff, &(0x7f0000000b00), 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x12a) symlinkat(0x0, 0xffffffffffffff9c, 0x0) symlinkat(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ed) mkdirat(r1, 0x0, 0x1ed) symlinkat(&(0x7f0000001500)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlinkat(&(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000001900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000611800000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r3, @ANYBLOB="0077120000000000bfa200000700000007020000f8ffffff85000000010000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0a000000020000000200000004"], 0x2d) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kernel console output (not intermixed with test programs): [ 84.046180][ T6740] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.046993][ T6740] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.605204][ T6740] bond1: (slave dummy0): Releasing active interface [ 84.768108][ T6740] bridge_slave_0: left allmulticast mode [ 84.768130][ T6740] bridge_slave_0: left promiscuous mode [ 84.768306][ T6740] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.827798][ T6740] bridge_slave_1: left allmulticast mode [ 84.827816][ T6740] bridge_slave_1: left promiscuous mode [ 84.827909][ T6740] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.864386][ T6740] bond0: (slave bond_slave_0): Releasing backup interface [ 84.897993][ T6740] bond0: (slave bond_slave_1): Releasing backup interface [ 84.915306][ T6740] team0: Port device team_slave_0 removed [ 84.925996][ T6740] team0: Port device team_slave_1 removed [ 84.929321][ T6740] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 84.932949][ T6740] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 84.936994][ T6740] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 84.939943][ T6740] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 84.946179][ T6740] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 84.980573][ T6749] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.980852][ T6749] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.001362][ T6749] bridge_slave_0: left allmulticast mode [ 85.001377][ T6749] bridge_slave_0: left promiscuous mode [ 85.001462][ T6749] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.005285][ T6749] bridge_slave_1: left allmulticast mode [ 85.005298][ T6749] bridge_slave_1: left promiscuous mode [ 85.005406][ T6749] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.012221][ T6749] bond0: (slave bond_slave_0): Releasing backup interface [ 85.021738][ T6749] bond0: (slave bond_slave_1): Releasing backup interface [ 85.025998][ T6749] team0: Port device team_slave_0 removed [ 85.032185][ T6749] team0: Port device team_slave_1 removed [ 85.045032][ T6749] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 85.229967][ T38] nvmet: connect request for invalid subsystem testsubsys! [ 85.230569][ T6767] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 85.518455][ T1674] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 85.688448][ T1674] usb 8-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 85.689645][ T1674] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 33, changing to 9 [ 85.690646][ T1674] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 33, changing to 9 [ 85.692342][ T1674] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.692354][ T1674] usb 8-1: Product: syz [ 85.692361][ T1674] usb 8-1: Manufacturer: syz [ 85.692368][ T1674] usb 8-1: SerialNumber: syz [ 85.699414][ T1674] ti_usb_3410_5052 8-1:2.0: TI USB 5052 2 port adapter converter detected [ 85.706666][ T1674] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 85.709422][ T1674] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 86.027925][ T6823] IPVS: sync thread started: state = MASTER, mcast_ifn = wg1, syncid = 4, id = 0 [ 86.176503][ C2] sr 2:0:0:0: [sr0] tag#14 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 86.176545][ C2] sr 2:0:0:0: [sr0] tag#14 CDB: Read DVD structure ad d1 8b b6 80 3d [ 86.633985][ C1] sr 2:0:0:0: [sr0] tag#20 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 86.634037][ C1] sr 2:0:0:0: [sr0] tag#20 CDB: Read DVD structure ad d1 8b b6 80 3d [ 87.219599][ T6842] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 87.219643][ T6842] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 87.238421][ T6842] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 87.548224][ T6842] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 87.549285][ T6842] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 87.591597][ T6842] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 87.621088][ T6842] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 87.621533][ T6842] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 87.637980][ T6842] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 87.933340][ T6779] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot clear input buffers, -110 [ 87.934890][ T50] usb 8-1: USB disconnect, device number 5 [ 87.962592][ T50] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 87.964716][ T50] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 87.965411][ T50] ti_usb_3410_5052 8-1:2.0: device disconnected [ 88.090025][ T6868] syz.1.244 uses obsolete (PF_INET,SOCK_PACKET) [ 88.091619][ T6868] netlink: 8 bytes leftover after parsing attributes in process `syz.1.244'. [ 88.159402][ T6871] 9p: Bad value for 'wfdno' [ 88.265061][ T6874] FAULT_INJECTION: forcing a failure. [ 88.265061][ T6874] name failslab, interval 1, probability 0, space 0, times 0 [ 88.265084][ T6874] CPU: 1 UID: 0 PID: 6874 Comm: syz.1.246 Tainted: G L syzkaller #0 PREEMPT(full) [ 88.265098][ T6874] Tainted: [L]=SOFTLOCKUP [ 88.265102][ T6874] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.265108][ T6874] Call Trace: [ 88.265112][ T6874] [ 88.265116][ T6874] dump_stack_lvl+0x100/0x190 [ 88.265134][ T6874] should_fail_ex.cold+0x5/0xa [ 88.265154][ T6874] should_failslab+0xc2/0x120 [ 88.265169][ T6874] __kmalloc_noprof+0xfc/0x840 [ 88.265181][ T6874] ? x509_get_sig_params+0x409/0x6c0 [ 88.265198][ T6874] x509_get_sig_params+0x409/0x6c0 [ 88.265213][ T6874] x509_cert_parse+0x4e9/0x910 [ 88.265226][ T6874] x509_key_preparse+0x65/0x9c0 [ 88.265242][ T6874] asymmetric_key_preparse+0xce/0x1d0 [ 88.265252][ T6874] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 88.265263][ T6874] __key_create_or_update+0x463/0xe30 [ 88.265282][ T6874] ? __pfx___key_create_or_update+0x10/0x10 [ 88.265300][ T6874] ? lookup_user_key+0x3f3/0x1300 [ 88.265321][ T6874] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 88.265337][ T6874] ? __pfx_keyring_search_iterator+0x10/0x10 [ 88.265351][ T6874] key_create_or_update+0x42/0x60 [ 88.265369][ T6874] __do_sys_add_key+0x2e8/0x460 [ 88.265383][ T6874] ? __pfx___do_sys_add_key+0x10/0x10 [ 88.265394][ T6874] ? fput+0x7c/0x100 [ 88.265409][ T6874] ? __pfx_ksys_write+0x10/0x10 [ 88.265423][ T6874] __do_fast_syscall_32+0x13a/0x8b0 [ 88.265440][ T6874] ? lockdep_hardirqs_on+0x7d/0x110 [ 88.265456][ T6874] do_fast_syscall_32+0x32/0x70 [ 88.265473][ T6874] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 88.265487][ T6874] RIP: 0023:0xf701efec [ 88.265501][ T6874] Code: Unable to access opcode bytes at 0xf701efc2. [ 88.265506][ T6874] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 000000000000011e [ 88.265516][ T6874] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000000000 [ 88.265523][ T6874] RDX: 0000000080000400 RSI: 00000000000001d8 RDI: 0000000038b99819 [ 88.265529][ T6874] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 88.265535][ T6874] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 88.265541][ T6874] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 88.265554][ T6874] [ 88.456108][ T6886] Config c/1 of g1 needs at least one function. [ 88.456164][ T6886] udc dummy_udc.0: failed to start g1: -22 [ 88.456175][ T6886] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 88.459911][ T6886] UDC core: g1: couldn't find an available UDC or it's busy [ 88.702030][ T43] audit: type=1326 audit(1789791773.226:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6922 comm="syz.1.265" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 88.702304][ T43] audit: type=1326 audit(1789791773.226:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6922 comm="syz.1.265" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 88.706251][ T43] audit: type=1326 audit(1789791773.226:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6922 comm="syz.1.265" exe="/syz-executor" sig=0 arch=40000003 syscall=311 compat=1 ip=0xf701efec code=0x7ffc0000 [ 88.706679][ T43] audit: type=1326 audit(1789791773.226:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6922 comm="syz.1.265" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 88.706846][ T43] audit: type=1326 audit(1789791773.226:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6922 comm="syz.1.265" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 88.707284][ T43] audit: type=1326 audit(1789791773.226:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6922 comm="syz.1.265" exe="/syz-executor" sig=0 arch=40000003 syscall=331 compat=1 ip=0xf701efec code=0x7ffc0000 [ 88.707431][ T43] audit: type=1326 audit(1789791773.226:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6922 comm="syz.1.265" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 88.707641][ T43] audit: type=1326 audit(1789791773.226:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6922 comm="syz.1.265" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 88.715479][ T43] audit: type=1326 audit(1789791773.236:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6922 comm="syz.1.265" exe="/syz-executor" sig=0 arch=40000003 syscall=296 compat=1 ip=0xf701efec code=0x7ffc0000 [ 88.715717][ T43] audit: type=1326 audit(1789791773.236:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6922 comm="syz.1.265" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 88.768532][ T6925] FAULT_INJECTION: forcing a failure. [ 88.768532][ T6925] name failslab, interval 1, probability 0, space 0, times 0 [ 88.768553][ T6925] CPU: 2 UID: 0 PID: 6925 Comm: syz.1.266 Tainted: G L syzkaller #0 PREEMPT(full) [ 88.768572][ T6925] Tainted: [L]=SOFTLOCKUP [ 88.768576][ T6925] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.768584][ T6925] Call Trace: [ 88.768588][ T6925] [ 88.768593][ T6925] dump_stack_lvl+0x100/0x190 [ 88.768611][ T6925] should_fail_ex.cold+0x5/0xa [ 88.768630][ T6925] should_failslab+0xc2/0x120 [ 88.768647][ T6925] kmem_cache_alloc_noprof+0x92/0x6a0 [ 88.768660][ T6925] ? xfd_validate_state+0x129/0x190 [ 88.768689][ T6925] ? new_userfaultfd+0x7d/0x400 [ 88.768720][ T6925] new_userfaultfd+0x7d/0x400 [ 88.768737][ T6925] __ia32_sys_userfaultfd+0x4b/0xb0 [ 88.768750][ T6925] __do_fast_syscall_32+0x13a/0x8b0 [ 88.768768][ T6925] do_fast_syscall_32+0x32/0x70 [ 88.768785][ T6925] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 88.768798][ T6925] RIP: 0023:0xf701efec [ 88.768811][ T6925] Code: Unable to access opcode bytes at 0xf701efc2. [ 88.768816][ T6925] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000176 [ 88.768828][ T6925] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000000000 [ 88.768834][ T6925] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 88.768841][ T6925] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 88.768848][ T6925] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 88.768854][ T6925] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 88.768867][ T6925] [ 88.826264][ T6927] xt_CT: You must specify a L4 protocol and not use inversions on it [ 88.830358][ T6927] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 88.830378][ T6927] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 88.831358][ T6927] vhci_hcd vhci_hcd.0: Device attached [ 88.833821][ T6928] vhci_hcd: cannot find the pending unlink 3 [ 88.834107][ T6928] vhci_hcd: connection closed [ 88.835639][ T5816] vhci_hcd vhci_hcd.1: stop threads [ 88.835656][ T5816] vhci_hcd vhci_hcd.1: release socket [ 88.835669][ T5816] vhci_hcd vhci_hcd.1: disconnect device [ 89.287808][ T5740] Bluetooth: hci1: command 0x0c1a tx timeout [ 89.338859][ T6931] comedi comedi0: board detection failed [ 89.608500][ T5740] Bluetooth: hci2: command 0x0c1a tx timeout [ 89.697831][ T5740] Bluetooth: hci3: command 0x0c1a tx timeout [ 90.478800][ T6971] FAULT_INJECTION: forcing a failure. [ 90.478800][ T6971] name failslab, interval 1, probability 0, space 0, times 0 [ 90.478821][ T6971] CPU: 2 UID: 0 PID: 6971 Comm: syz.1.284 Tainted: G L syzkaller #0 PREEMPT(full) [ 90.478836][ T6971] Tainted: [L]=SOFTLOCKUP [ 90.478840][ T6971] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 90.478846][ T6971] Call Trace: [ 90.478850][ T6971] [ 90.478854][ T6971] dump_stack_lvl+0x100/0x190 [ 90.478873][ T6971] should_fail_ex.cold+0x5/0xa [ 90.478887][ T6971] should_failslab+0xc2/0x120 [ 90.478902][ T6971] kmem_cache_alloc_noprof+0x92/0x6a0 [ 90.478916][ T6971] ? __kernfs_new_node+0xd2/0xa10 [ 90.478932][ T6971] __kernfs_new_node+0xd2/0xa10 [ 90.478948][ T6971] ? __pfx___kernfs_new_node+0x10/0x10 [ 90.478964][ T6971] ? lock_acquire+0x1d1/0x380 [ 90.478978][ T6971] ? kernfs_root+0x23/0x2a0 [ 90.478991][ T6971] ? find_held_lock+0x2b/0x80 [ 90.479002][ T6971] ? kernfs_root+0xee/0x2a0 [ 90.479013][ T6971] ? kernfs_root+0xee/0x2a0 [ 90.479028][ T6971] kernfs_new_node+0x117/0x150 [ 90.479045][ T6971] __kernfs_create_file+0x53/0x350 [ 90.479064][ T6971] sysfs_add_file_mode_ns+0x207/0x3c0 [ 90.479079][ T6971] sysfs_merge_group+0x194/0x340 [ 90.479093][ T6971] ? __pfx_sysfs_merge_group+0x10/0x10 [ 90.479106][ T6971] ? bus_add_device+0x2e2/0x6c0 [ 90.479119][ T6971] ? __pfx_bus_add_device+0x10/0x10 [ 90.479131][ T6971] ? __pfx_dev_add_physical_location+0x10/0x10 [ 90.479151][ T6971] dpm_sysfs_add+0x237/0x280 [ 90.479167][ T6971] device_add+0x9f4/0x1970 [ 90.479202][ T6971] ? __pfx_device_add+0x10/0x10 [ 90.479218][ T6971] ? lockdep_init_map_type+0x5c/0x250 [ 90.479233][ T6971] ? __init_waitqueue_head+0xca/0x150 [ 90.479253][ T6971] tty_register_device_attr+0x388/0x7f0 [ 90.479269][ T6971] ? __pfx_tty_register_device_attr+0x10/0x10 [ 90.479286][ T6971] ? lockdep_init_map_type+0x5c/0x250 [ 90.479305][ T6971] rfcomm_dev_ioctl+0x179d/0x1db0 [ 90.479320][ T6971] ? __pfx_rfcomm_dev_ioctl+0x10/0x10 [ 90.479335][ T6971] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 90.479351][ T6971] ? do_vfs_ioctl+0x226/0x13e0 [ 90.479370][ T6971] rfcomm_sock_ioctl+0xcc/0xf0 [ 90.479387][ T6971] ? __pfx_rfcomm_sock_compat_ioctl+0x10/0x10 [ 90.479404][ T6971] compat_sock_ioctl+0x179/0x760 [ 90.479418][ T6971] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 90.479429][ T6971] ? hook_file_ioctl_common+0x140/0x440 [ 90.479469][ T6971] ? __fget_files+0x21f/0x3d0 [ 90.479484][ T6971] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 90.479496][ T6971] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 90.479515][ T6971] __do_fast_syscall_32+0x13a/0x8b0 [ 90.479532][ T6971] ? lockdep_hardirqs_on+0x7d/0x110 [ 90.479549][ T6971] do_fast_syscall_32+0x32/0x70 [ 90.479566][ T6971] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 90.479579][ T6971] RIP: 0023:0xf701efec [ 90.479591][ T6971] Code: Unable to access opcode bytes at 0xf701efc2. [ 90.479596][ T6971] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 90.479606][ T6971] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000400452c8 [ 90.479613][ T6971] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 90.479619][ T6971] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 90.479625][ T6971] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 90.479631][ T6971] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 90.479644][ T6971] [ 90.521451][ T6973] RDS: rds_bind could not find a transport for ::ffff:10.1.1.1, load rds_tcp or rds_rdma? [ 90.649417][ T6969] pim6reg: entered allmulticast mode [ 90.713589][ T6983] pim6reg: left allmulticast mode [ 90.901426][ T6989] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 90.901454][ T6989] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 90.903357][ T6989] vhci_hcd vhci_hcd.0: Device attached [ 90.947382][ T6983] netlink: 4 bytes leftover after parsing attributes in process `syz.3.282'. [ 91.017305][ T6983] hsr_slave_1 (unregistering): left promiscuous mode [ 91.168105][ T5744] usb 38-1: SetAddress Request (2) to port 0 [ 91.168159][ T5744] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 91.323113][ T6984] input: syz1 as /devices/virtual/input/input12 [ 91.334037][ T6997] 9pnet: p9_errstr2errno: server reported unknown error 0x000000000 [ 91.342370][ T6997] Bluetooth: MGMT ver 1.23 [ 91.367871][ T5740] Bluetooth: hci1: command 0x0c1a tx timeout [ 91.504896][ T7000] syzkaller0: entered promiscuous mode [ 91.504920][ T7000] syzkaller0: entered allmulticast mode [ 91.525684][ T6990] vhci_hcd: connection reset by peer [ 91.533988][ T5815] vhci_hcd vhci_hcd.0: stop threads [ 91.534058][ T5815] vhci_hcd vhci_hcd.0: release socket [ 91.534139][ T5815] vhci_hcd vhci_hcd.0: disconnect device [ 91.651626][ T7002] FAULT_INJECTION: forcing a failure. [ 91.651626][ T7002] name failslab, interval 1, probability 0, space 0, times 0 [ 91.651662][ T7002] CPU: 1 UID: 0 PID: 7002 Comm: syz.2.291 Tainted: G L syzkaller #0 PREEMPT(full) [ 91.651685][ T7002] Tainted: [L]=SOFTLOCKUP [ 91.651690][ T7002] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 91.651700][ T7002] Call Trace: [ 91.651705][ T7002] [ 91.651712][ T7002] dump_stack_lvl+0x100/0x190 [ 91.651738][ T7002] should_fail_ex.cold+0x5/0xa [ 91.651760][ T7002] should_failslab+0xc2/0x120 [ 91.651782][ T7002] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 91.651818][ T7002] ? __alloc_skb+0x140/0x710 [ 91.651844][ T7002] __alloc_skb+0x140/0x710 [ 91.651863][ T7002] ? __alloc_skb+0x5b7/0x710 [ 91.651883][ T7002] ? __pfx___alloc_skb+0x10/0x10 [ 91.651910][ T7002] hci_sock_sendmsg+0x1b01/0x2620 [ 91.651939][ T7002] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 91.651962][ T7002] ? apparmor_socket_sendmsg+0x165/0x280 [ 91.651988][ T7002] sock_write_iter+0x53a/0x5b0 [ 91.652003][ T7002] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 91.652025][ T7002] ? __pfx_sock_write_iter+0x10/0x10 [ 91.652047][ T7002] ? bpf_lsm_file_permission+0x9/0x10 [ 91.652069][ T7002] ? security_file_permission+0x76/0x210 [ 91.652096][ T7002] ? rw_verify_area+0xce/0x6d0 [ 91.652125][ T7002] vfs_write+0x6af/0x1050 [ 91.652142][ T7002] ? __pfx_sock_write_iter+0x10/0x10 [ 91.652159][ T7002] ? __pfx_vfs_write+0x10/0x10 [ 91.652174][ T7002] ? find_held_lock+0x2b/0x80 [ 91.652208][ T7002] ksys_write+0x1f8/0x250 [ 91.652224][ T7002] ? __pfx_ksys_write+0x10/0x10 [ 91.652240][ T7002] ? ksys_write+0x1ac/0x250 [ 91.652256][ T7002] ? __pfx_ksys_write+0x10/0x10 [ 91.652278][ T7002] __do_fast_syscall_32+0x13a/0x8b0 [ 91.652304][ T7002] ? lockdep_hardirqs_on+0x7d/0x110 [ 91.652330][ T7002] do_fast_syscall_32+0x32/0x70 [ 91.652356][ T7002] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 91.652377][ T7002] RIP: 0023:0xf703efec [ 91.652394][ T7002] Code: Unable to access opcode bytes at 0xf703efc2. [ 91.652402][ T7002] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 91.652418][ T7002] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000200 [ 91.652428][ T7002] RDX: 0000000000000017 RSI: 0000000000000000 RDI: 0000000000000000 [ 91.652438][ T7002] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 91.652447][ T7002] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 91.652457][ T7002] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 91.652479][ T7002] [ 91.687863][ T5740] Bluetooth: hci2: command 0x0c1a tx timeout [ 91.746273][ T7015] netlink: 8 bytes leftover after parsing attributes in process `syz.3.295'. [ 91.746285][ T7015] netlink: 4 bytes leftover after parsing attributes in process `syz.3.295'. [ 91.746299][ T7015] netlink: 'syz.3.295': attribute type 18 has an invalid length. [ 91.746306][ T7015] netlink: 8 bytes leftover after parsing attributes in process `syz.3.295'. [ 91.763560][ T7015] netlink: 8 bytes leftover after parsing attributes in process `syz.3.295'. [ 91.763574][ T7015] netlink: 4 bytes leftover after parsing attributes in process `syz.3.295'. [ 91.763588][ T7015] netlink: 'syz.3.295': attribute type 18 has an invalid length. [ 91.763612][ T7015] netlink: 8 bytes leftover after parsing attributes in process `syz.3.295'. [ 91.767822][ T5740] Bluetooth: hci3: command 0x0c1a tx timeout [ 91.768218][ T5815] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 91.768241][ T5815] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 91.768258][ T5815] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 91.768275][ T5815] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 91.813751][ T7016] jffs2: notice: (7016) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 91.865041][ T7022] netlink: 'syz.3.298': attribute type 1 has an invalid length. [ 91.912764][ T7022] 8021q: adding VLAN 0 to HW filter on device bond2 [ 91.933328][ T7022] lo: entered allmulticast mode [ 91.933491][ T7022] bond2: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 91.949654][ T7025] FAULT_INJECTION: forcing a failure. [ 91.949654][ T7025] name failslab, interval 1, probability 0, space 0, times 0 [ 91.949675][ T7025] CPU: 2 UID: 0 PID: 7025 Comm: syz.1.297 Tainted: G L syzkaller #0 PREEMPT(full) [ 91.949690][ T7025] Tainted: [L]=SOFTLOCKUP [ 91.949694][ T7025] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 91.949700][ T7025] Call Trace: [ 91.949704][ T7025] [ 91.949708][ T7025] dump_stack_lvl+0x100/0x190 [ 91.949726][ T7025] should_fail_ex.cold+0x5/0xa [ 91.949741][ T7025] should_failslab+0xc2/0x120 [ 91.949755][ T7025] __kmalloc_cache_noprof+0x91/0x6d0 [ 91.949773][ T7025] ? kvm_hv_vcpu_init+0xf3/0x920 [ 91.949789][ T7025] kvm_hv_vcpu_init+0xf3/0x920 [ 91.949804][ T7025] kvm_hv_set_msr_common+0x104/0x4b20 [ 91.949821][ T7025] ? __pfx_kvm_hv_set_msr_common+0x10/0x10 [ 91.949835][ T7025] ? stack_trace_save+0x8e/0xc0 [ 91.949848][ T7025] ? __pfx_stack_trace_save+0x10/0x10 [ 91.949862][ T7025] ? stack_depot_save_flags+0x27/0x9f0 [ 91.949879][ T7025] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 91.949895][ T7025] kvm_set_msr_common+0x14ae/0x4030 [ 91.949909][ T7025] ? __pfx_kvm_set_msr_common+0x10/0x10 [ 91.949921][ T7025] ? __ia32_compat_sys_ioctl+0x2cf/0x360 [ 91.949939][ T7025] ? do_fast_syscall_32+0x32/0x70 [ 91.949955][ T7025] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 91.949971][ T7025] vmx_set_msr+0x220a/0x3a30 [ 91.949988][ T7025] ? __pfx_vmx_set_msr+0x10/0x10 [ 91.950006][ T7025] ? __lock_acquire+0x5c0/0x1f40 [ 91.950022][ T7025] __kvm_set_msr+0x14f/0x880 [ 91.950039][ T7025] ? __pfx___kvm_set_msr+0x10/0x10 [ 91.950056][ T7025] ? lock_acquire+0x1d1/0x380 [ 91.950073][ T7025] kvm_set_msr_ignored_check+0x2f/0x350 [ 91.950090][ T7025] ? __might_fault+0xc5/0x140 [ 91.950107][ T7025] do_set_msr+0x19e/0x2d0 [ 91.950117][ T7025] ? __pfx_do_set_msr+0x10/0x10 [ 91.950185][ T7025] ? _copy_from_user+0x59/0xd0 [ 91.950203][ T7025] msr_io+0x1cb/0x860 [ 91.950219][ T7025] ? __pfx_do_set_msr+0x10/0x10 [ 91.950231][ T7025] ? lock_acquire+0x1d1/0x380 [ 91.950248][ T7025] ? __pfx_msr_io+0x10/0x10 [ 91.950258][ T7025] ? is_bpf_text_address+0x25/0x1a0 [ 91.950276][ T7025] kvm_set_msrs+0x91/0x100 [ 91.950288][ T7025] ? kvm_set_msrs+0x77/0x100 [ 91.950301][ T7025] kvm_arch_vcpu_ioctl+0x8c2/0x3a10 [ 91.950315][ T7025] ? is_bpf_text_address+0x94/0x1a0 [ 91.950330][ T7025] ? kernel_text_address+0x8d/0x100 [ 91.950344][ T7025] ? __pfx_widen_string+0x10/0x10 [ 91.950356][ T7025] ? __kernel_text_address+0xd/0x30 [ 91.950369][ T7025] ? unwind_get_return_address+0x59/0xa0 [ 91.950384][ T7025] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 91.950406][ T7025] ? __lock_acquire+0x5c0/0x1f40 [ 91.950424][ T7025] ? stack_depot_save_flags+0x27/0x9f0 [ 91.950440][ T7025] ? __lock_acquire+0x5c0/0x1f40 [ 91.950457][ T7025] ? lock_acquire+0x1d1/0x380 [ 91.950471][ T7025] ? kvm_vcpu_ioctl+0x322/0x1700 [ 91.950487][ T7025] ? rcu_is_watching+0x13/0xc0 [ 91.950499][ T7025] ? trace_contention_end+0x126/0x160 [ 91.950515][ T7025] ? __mutex_lock+0x26c/0x1bd0 [ 91.950534][ T7025] ? kvm_vcpu_ioctl+0x322/0x1700 [ 91.950550][ T7025] ? __pfx___mutex_lock+0x10/0x10 [ 91.950576][ T7025] ? kvm_vcpu_ioctl+0x8a0/0x1700 [ 91.950588][ T7025] kvm_vcpu_ioctl+0x8a0/0x1700 [ 91.950609][ T7025] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 91.950622][ T7025] ? tomoyo_path_number_perm+0x188/0x580 [ 91.950639][ T7025] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 91.950656][ T7025] ? get_pid_task+0x106/0x250 [ 91.950670][ T7025] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 91.950687][ T7025] ? do_vfs_ioctl+0x226/0x13e0 [ 91.950704][ T7025] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 91.950724][ T7025] ? __fget_files+0x34/0x3d0 [ 91.950739][ T7025] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 91.950753][ T7025] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 91.950767][ T7025] ? __fget_files+0x21f/0x3d0 [ 91.950782][ T7025] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 91.950796][ T7025] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 91.950816][ T7025] __do_fast_syscall_32+0x13a/0x8b0 [ 91.950833][ T7025] ? lockdep_hardirqs_on+0x7d/0x110 [ 91.950849][ T7025] do_fast_syscall_32+0x32/0x70 [ 91.950867][ T7025] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 91.950881][ T7025] RIP: 0023:0xf701efec [ 91.950895][ T7025] Code: Unable to access opcode bytes at 0xf701efc2. [ 91.950900][ T7025] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 91.950911][ T7025] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000004008ae89 [ 91.950917][ T7025] RDX: 0000000080000300 RSI: 0000000000000000 RDI: 0000000000000000 [ 91.950924][ T7025] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 91.950929][ T7025] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 91.950936][ T7025] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 91.950949][ T7025] [ 91.961735][ T7022] 8021q: adding VLAN 0 to HW filter on device bond2 [ 91.973496][ T7022] bond2: (slave lo): making interface the new active one [ 91.978145][ T7022] bond2: (slave lo): Enslaving as an active interface with an up link [ 92.152802][ T7022] capability: warning: `syz.3.298' uses 32-bit capabilities (legacy support in use) [ 92.161411][ T7027] input: syz1 as /devices/virtual/input/input13 [ 92.448337][ T7031] netlink: 76 bytes leftover after parsing attributes in process `syz.1.301'. [ 92.759020][ T5844] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 92.859891][ C1] sr 2:0:0:0: [sr0] tag#24 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 92.859950][ C1] sr 2:0:0:0: [sr0] tag#24 CDB: Read DVD structure ad d1 8b b6 80 3d [ 92.924550][ T5844] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 92.927343][ T5844] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 92.927484][ T5844] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.933305][ T5844] usb 6-1: config 0 descriptor?? [ 93.063106][ C2] sr 2:0:0:0: [sr0] tag#16 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 93.063144][ C2] sr 2:0:0:0: [sr0] tag#16 CDB: Read DVD structure ad d1 8b b6 80 3d [ 93.165869][ T5844] usbhid 6-1:0.0: can't add hid device: -71 [ 93.204461][ T5844] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 93.306050][ T5844] usb 6-1: USB disconnect, device number 8 [ 93.447823][ T5740] Bluetooth: hci1: command 0x0c1a tx timeout [ 93.694791][ T7047] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 93.747837][ T5844] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 93.767909][ T5740] Bluetooth: hci2: command 0x0c1a tx timeout [ 93.824100][ T7052] comedi comedi0: unsupported base address 0x7fffffff [ 93.847836][ T5099] Bluetooth: hci3: command 0x0c1a tx timeout [ 94.372731][ T5844] usb 6-1: Using ep0 maxpacket: 32 [ 94.395089][ T5844] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.66 [ 94.440287][ T5844] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 94.440316][ T5844] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.602833][ T5844] usb 6-1: config 0 descriptor?? [ 94.604631][ T5844] ldusb 6-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 94.612248][ T5844] ldusb 6-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 94.655240][ T7060] 9p: Bad value for 'wfdno' [ 95.234935][ T7074] device-mapper: ioctl: Invalid ioctl structure: name t, dev f801 [ 95.430122][ T7083] netlink: 20 bytes leftover after parsing attributes in process `syz.0.316'. [ 95.547059][ T7088] 9p: Bad value for 'wfdno' [ 95.608582][ T50] usb 6-1: USB disconnect, device number 9 [ 95.616367][ T50] ldusb 6-1:0.0: LD USB Device #0 now disconnected [ 95.937807][ T5099] Bluetooth: hci3: command 0x0c1a tx timeout [ 96.230691][ T5099] Bluetooth: hci3: unexpected event for opcode 0x2003 [ 96.235113][ C2] sr 2:0:0:0: [sr0] tag#17 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 96.235143][ C2] sr 2:0:0:0: [sr0] tag#17 CDB: Read DVD structure ad d1 8b b6 80 3d [ 96.249557][ T5744] usb 38-1: device descriptor read/8, error -110 [ 96.803390][ T7125] input: syz1 as /devices/virtual/input/input15 [ 97.059870][ T5744] usb usb38-port1: attempt power cycle [ 97.212729][ T7135] input: syz1 as /devices/virtual/input/input16 [ 97.381289][ T5816] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.473701][ T5816] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.515019][ T5740] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 97.516317][ T5740] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 97.519015][ T5740] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 97.534029][ T5740] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 97.534522][ T5740] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.575350][ T5816] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.602315][ T7171] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 97.639331][ T5744] usb usb38-port1: unable to enumerate USB device [ 97.724668][ T5816] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.955029][ T5816] vlan2: left promiscuous mode [ 97.955142][ T5816] dummy0: left promiscuous mode [ 97.961205][ T5816] bridge0: port 3(vlan2) entered disabled state [ 97.963537][ T7189] 9p: Bad value for 'wfdno' [ 97.965839][ T5816] bridge_slave_1: left allmulticast mode [ 97.965861][ T5816] bridge_slave_1: left promiscuous mode [ 97.967232][ T5816] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.981262][ T5816] bridge_slave_0: left allmulticast mode [ 97.981280][ T5816] bridge_slave_0: left promiscuous mode [ 97.981378][ T5816] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.382236][ T5452] 8021q: adding VLAN 0 to HW filter on device eth2 [ 98.566629][ T7164] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.566773][ T7164] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.566870][ T7164] bridge_slave_0: entered allmulticast mode [ 98.567984][ T42] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 98.570822][ T7164] bridge_slave_0: entered promiscuous mode [ 98.573212][ T7164] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.573331][ T7164] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.573432][ T7164] bridge_slave_1: entered allmulticast mode [ 98.574907][ T7164] bridge_slave_1: entered promiscuous mode [ 98.622075][ T5452] 8021q: adding VLAN 0 to HW filter on device eth3 [ 98.625107][ T7164] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.629712][ T7164] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.647018][ T5816] hsr_slave_0: left promiscuous mode [ 98.649649][ T5816] hsr_slave_1: left promiscuous mode [ 98.650639][ T5816] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 98.650672][ T5816] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 98.652320][ T5816] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 98.652335][ T5816] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 98.684827][ T5816] veth1_macvtap: left promiscuous mode [ 98.684926][ T5816] veth0_macvtap: left promiscuous mode [ 98.685076][ T5816] veth1_vlan: left promiscuous mode [ 98.685201][ T5816] veth0_vlan: left promiscuous mode [ 98.729325][ T42] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 98.730797][ T42] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 98.730814][ T42] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 98.730826][ T42] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 98.730845][ T42] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.732185][ T42] usb 8-1: config 0 descriptor?? [ 98.866333][ T5816] team0 (unregistering): Port device team_slave_1 removed [ 98.878114][ T7230] netlink: 44 bytes leftover after parsing attributes in process `syz.2.345'. [ 98.890326][ T5816] team0 (unregistering): Port device team_slave_0 removed [ 98.926385][ T7233] netlink: 144 bytes leftover after parsing attributes in process `syz.1.346'. [ 98.958977][ T7207] xt_hashlimit: size too large, truncated to 1048576 [ 99.017658][ T7238] 9p: Bad value for 'wfdno' [ 99.026922][ T7164] team0: Port device team_slave_0 added [ 99.031022][ T7164] team0: Port device team_slave_1 added [ 99.039210][ T42] usbhid 8-1:0.0: can't add hid device: -71 [ 99.039264][ T42] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 99.042930][ T42] usb 8-1: USB disconnect, device number 6 [ 99.066979][ T7164] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.066991][ T7164] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.067004][ T7164] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.069789][ T7164] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.069798][ T7164] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.069812][ T7164] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.112901][ T7164] hsr_slave_0: entered promiscuous mode [ 99.113427][ T7164] hsr_slave_1: entered promiscuous mode [ 99.194514][ T7244] syz.1.350 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 99.282820][ T5452] 8021q: adding VLAN 0 to HW filter on device eth4 [ 99.352752][ T7164] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 99.366679][ T7164] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 99.367447][ T7164] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 99.389689][ T7164] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 99.390427][ T7164] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 99.406656][ T7164] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 99.448677][ T7164] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 99.457873][ T7164] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 99.540361][ T7164] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.550750][ T7164] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.555570][ T1162] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.555617][ T1162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.559337][ T1162] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.559443][ T1162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.617793][ T5099] Bluetooth: hci0: command tx timeout [ 99.664194][ T1164] IPVS: starting estimator thread 0... [ 99.672778][ T5452] 8021q: adding VLAN 0 to HW filter on device eth5 [ 99.689015][ T7283] netlink: 28 bytes leftover after parsing attributes in process `syz.3.360'. [ 99.689029][ T7283] netlink: 12 bytes leftover after parsing attributes in process `syz.3.360'. [ 99.760158][ T7285] IPVS: using max 43 ests per chain, 103200 per kthread [ 100.053940][ T7164] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.217182][ T7164] veth0_vlan: entered promiscuous mode [ 100.224709][ T7164] veth1_vlan: entered promiscuous mode [ 100.242406][ T7164] veth0_macvtap: entered promiscuous mode [ 100.244486][ T7164] veth1_macvtap: entered promiscuous mode [ 100.251433][ T7164] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.253307][ T7164] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.299011][ T5815] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.299049][ T5815] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.299072][ T5815] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.299095][ T5815] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.324660][ T6200] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.324674][ T6200] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.355705][ T6200] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.355720][ T6200] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.406892][ T7326] FAULT_INJECTION: forcing a failure. [ 100.406892][ T7326] name failslab, interval 1, probability 0, space 0, times 0 [ 100.406913][ T7326] CPU: 2 UID: 0 PID: 7326 Comm: syz.1.365 Tainted: G L syzkaller #0 PREEMPT(full) [ 100.406929][ T7326] Tainted: [L]=SOFTLOCKUP [ 100.406933][ T7326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 100.406940][ T7326] Call Trace: [ 100.406943][ T7326] [ 100.406948][ T7326] dump_stack_lvl+0x100/0x190 [ 100.406967][ T7326] should_fail_ex.cold+0x5/0xa [ 100.406988][ T7326] should_failslab+0xc2/0x120 [ 100.407008][ T7326] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 100.407028][ T7326] ? __kasan_kmalloc+0xaa/0xb0 [ 100.407048][ T7326] ? __request_module+0x2d5/0x6a0 [ 100.407075][ T7326] kstrdup+0x51/0xe0 [ 100.407094][ T7326] __request_module+0x2d5/0x6a0 [ 100.407109][ T7326] ? __pfx___request_module+0x10/0x10 [ 100.407134][ T7326] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 100.407163][ T7326] nvmf_dev_write+0x1f5/0xb60 [ 100.407184][ T7326] vfs_write+0x2aa/0x1050 [ 100.407196][ T7326] ? __pfx_nvmf_dev_write+0x10/0x10 [ 100.407213][ T7326] ? lock_acquire+0x1d1/0x380 [ 100.407228][ T7326] ? __fget_files+0x34/0x3d0 [ 100.407241][ T7326] ? __pfx_vfs_write+0x10/0x10 [ 100.407252][ T7326] ? find_held_lock+0x2b/0x80 [ 100.407264][ T7326] ? __fget_files+0x215/0x3d0 [ 100.407276][ T7326] ? __fget_files+0x215/0x3d0 [ 100.407291][ T7326] ? __fget_files+0x21f/0x3d0 [ 100.407307][ T7326] ksys_write+0x12a/0x250 [ 100.407319][ T7326] ? __pfx_ksys_write+0x10/0x10 [ 100.407330][ T7326] ? ksys_write+0x1ac/0x250 [ 100.407341][ T7326] ? __pfx_ksys_write+0x10/0x10 [ 100.407356][ T7326] __do_fast_syscall_32+0x13a/0x8b0 [ 100.407374][ T7326] ? lockdep_hardirqs_on+0x7d/0x110 [ 100.407416][ T7326] do_fast_syscall_32+0x32/0x70 [ 100.407436][ T7326] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 100.407451][ T7326] RIP: 0023:0xf701efec [ 100.407465][ T7326] Code: Unable to access opcode bytes at 0xf701efc2. [ 100.407470][ T7326] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 100.407481][ T7326] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000900 [ 100.407489][ T7326] RDX: 000000000000001d RSI: 0000000000000000 RDI: 0000000000000000 [ 100.407495][ T7326] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 100.407502][ T7326] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 100.407508][ T7326] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 100.407523][ T7326] [ 100.420231][ T7329] binder: 7327:7329 ioctl c0306201 80000080 returned -22 [ 100.433099][ T6200] nvmet: connect request for invalid subsystem testsubsys! [ 100.434610][ T7326] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 100.826339][ T7349] tipc: Enabled bearer , priority 0 [ 100.827068][ T7349] syzkaller0: entered promiscuous mode [ 100.827081][ T7349] syzkaller0: entered allmulticast mode [ 101.195153][ T7342] tipc: Resetting bearer [ 101.208312][ T7342] tipc: Disabling bearer [ 101.697896][ T5099] Bluetooth: hci0: command tx timeout [ 101.829792][ T7374] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 101.840751][ T7374] netlink: 'syz.1.380': attribute type 39 has an invalid length. [ 102.023450][ T7378] tipc: Started in network mode [ 102.023471][ T7378] tipc: Node identity 1000001, cluster identity 4711 [ 102.023478][ T7378] tipc: Node number set to 16777217 [ 102.026185][ T7378] tipc: Enabled bearer , priority 1 [ 102.354961][ T43] kauditd_printk_skb: 22 callbacks suppressed [ 102.354974][ T43] audit: type=1804 audit(1789791786.876:69): pid=7381 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.382" name="/newroot/105/file0" dev="tmpfs" ino=586 res=1 errno=0 [ 102.386614][ T7381] netlink: 'syz.2.382': attribute type 2 has an invalid length. [ 102.386645][ T7381] netlink: 'syz.2.382': attribute type 2 has an invalid length. [ 102.535712][ T7389] netlink: 8 bytes leftover after parsing attributes in process `syz.2.385'. [ 102.644239][ T7393] jffs2: notice: (7393) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 102.830834][ T7401] block nbd0: server does not support multiple connections per device. [ 102.832180][ T7401] block nbd0: shutting down sockets [ 102.873014][ T7403] netlink: 5 bytes leftover after parsing attributes in process `syz.1.389'. [ 102.873181][ T7403] 0ªî{X¹¦: renamed from gretap0 [ 102.876256][ T7403] 0ªî{X¹¦: entered allmulticast mode [ 102.877246][ T7403] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 102.921142][ T7378] tipc: Resetting bearer [ 102.933689][ T7378] tipc: Disabling bearer [ 103.063547][ T7411] ieee802154 phy0 wpan0: encryption failed: -22 [ 103.338063][ T7414] netlink: 12 bytes leftover after parsing attributes in process `syz.2.395'. [ 103.494143][ T5099] Bluetooth: hci1: unexpected event for opcode 0x2003 [ 103.495642][ C3] sr 2:0:0:0: [sr0] tag#21 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 103.495691][ C3] sr 2:0:0:0: [sr0] tag#21 CDB: Read DVD structure ad d1 8b b6 80 3d [ 103.788791][ T5099] Bluetooth: hci0: command tx timeout [ 104.397396][ T7421] netlink: 84 bytes leftover after parsing attributes in process `syz.4.394'. [ 104.532413][ T43] audit: type=1326 audit(1789791789.056:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7428 comm="syz.2.399" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 104.532556][ T43] audit: type=1326 audit(1789791789.056:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7428 comm="syz.2.399" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 104.533893][ T43] audit: type=1326 audit(1789791789.056:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7428 comm="syz.2.399" exe="/syz-executor" sig=0 arch=40000003 syscall=182 compat=1 ip=0xf703efec code=0x7ffc0000 [ 104.534274][ T43] audit: type=1326 audit(1789791789.056:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7428 comm="syz.2.399" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 104.534297][ T43] audit: type=1326 audit(1789791789.056:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7428 comm="syz.2.399" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 104.534647][ T43] audit: type=1326 audit(1789791789.056:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7428 comm="syz.2.399" exe="/syz-executor" sig=0 arch=40000003 syscall=296 compat=1 ip=0xf703efec code=0x7ffc0000 [ 104.535464][ T43] audit: type=1326 audit(1789791789.056:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7428 comm="syz.2.399" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 104.535492][ T43] audit: type=1326 audit(1789791789.056:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7428 comm="syz.2.399" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 104.535697][ T43] audit: type=1326 audit(1789791789.056:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7428 comm="syz.2.399" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf703efec code=0x7ffc0000 [ 105.149115][ T42] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 105.298578][ T42] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 105.299724][ T42] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.299748][ T42] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 105.299767][ T42] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 105.299799][ T42] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.301849][ T42] usb 8-1: config 0 descriptor?? [ 105.706408][ T7460] block nbd0: server does not support multiple connections per device. [ 105.711426][ T7460] block nbd0: shutting down sockets [ 105.743533][ T7464] gadgetfs: bound to dummy_udc driver [ 105.765942][ T42] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 105.847806][ T5099] Bluetooth: hci0: command tx timeout [ 105.918176][ T7476] Bluetooth: MGMT ver 1.23 [ 105.935610][ T7478] fuse: Unknown parameter '' [ 105.981224][ T7485] netlink: 67 bytes leftover after parsing attributes in process `syz.1.413'. [ 105.987854][ T35] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 105.992025][ C3] gadgetfs: connected [ 105.995328][ T35] gadgetfs: disconnected [ 106.060538][ T7485] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.064207][ T7485] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.091231][ T7488] netlink: 24 bytes leftover after parsing attributes in process `syz.4.414'. [ 106.118255][ T7482] gadgetfs: bound to dummy_udc driver [ 106.144698][ T7485] 8021q: adding VLAN 0 to HW filter on device eth0 [ 106.151118][ T7485] 8021q: adding VLAN 0 to HW filter on device eth1 [ 106.153789][ T7485] 8021q: adding VLAN 0 to HW filter on device eth2 [ 106.154886][ T7485] 8021q: adding VLAN 0 to HW filter on device eth3 [ 106.375318][ C2] sr 2:0:0:0: [sr0] tag#28 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 106.375404][ C2] sr 2:0:0:0: [sr0] tag#28 CDB: Read DVD structure ad d1 8b b6 80 3d [ 107.048171][ T5844] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 107.081758][ T7498] Bluetooth: MGMT ver 1.23 [ 107.262249][ T7501] netlink: 'syz.1.418': attribute type 1 has an invalid length. [ 107.421550][ T7507] netlink: 'syz.1.422': attribute type 11 has an invalid length. [ 107.472255][ T7505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.420'. [ 107.472278][ T7505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.420'. [ 107.483422][ T7512] faux_driver vgem: [drm] Unknown color mode 6; guessing buffer size. [ 107.821707][ T5744] usb 8-1: USB disconnect, device number 7 [ 108.079778][ T7520] netlink: 8 bytes leftover after parsing attributes in process `syz.1.426'. [ 108.159060][ T7525] Cannot find add_set index 3 as target [ 108.230849][ T7528] ALSA: mixer_oss: invalid OSS volume 'OGAI‹' [ 108.230876][ T7528] ALSA: mixer_oss: invalid OSS volume 'Šä:&ÇBŠG¤`TÝoÄD^z¿‡F?!k'' [ 108.231957][ T7528] ALSA: mixer_oss: invalid OSS volume '' [ 109.038788][ T7530] netlink: 'syz.1.437': attribute type 1 has an invalid length. [ 109.338695][ T30] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 109.658387][ T30] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 109.659288][ T30] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 109.659320][ T30] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.661214][ T30] usb 7-1: config 0 descriptor?? [ 109.692037][ T7548] netlink: 44 bytes leftover after parsing attributes in process `syz.3.433'. [ 109.739986][ T7550] netlink: 4 bytes leftover after parsing attributes in process `syz.3.434'. [ 109.740013][ T7550] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 110.550030][ T7561] pci 0000:00:03.0: [1af4:1005] type 00 class 0x00ff00 conventional PCI endpoint [ 110.558150][ T7561] pci 0000:00:03.0: BAR 0 [io 0xc0a0-0xc0bf] [ 110.558313][ T7561] pci 0000:00:03.0: BAR 1 [mem 0xfeaf5000-0xfeaf5fff] [ 110.558773][ T7561] pci 0000:00:03.0: BAR 4 [mem 0xfe200000-0xfe203fff 64bit pref] [ 110.679382][ T30] usbhid 7-1:0.0: can't add hid device: -71 [ 110.679467][ T30] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 110.703304][ T30] usb 7-1: USB disconnect, device number 5 [ 110.751062][ T7561] pci 0000:00:03.0: Adding to iommu group 3 [ 110.783966][ T7561] pci 0000:00:03.0: BAR 4 [mem 0x580000000-0x580003fff 64bit pref]: assigned [ 110.787022][ T7561] pci 0000:00:03.0: BAR 1 [mem 0x80000000-0x80000fff]: assigned [ 110.790725][ T7561] pci 0000:00:03.0: BAR 0 [io 0x2000-0x201f]: assigned [ 111.017739][ T30] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 111.187771][ T30] usb 7-1: Using ep0 maxpacket: 32 [ 111.188214][ T30] usb 7-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.66 [ 111.189018][ T30] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 111.189040][ T30] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.191864][ T30] usb 7-1: config 0 descriptor?? [ 111.195023][ T30] ldusb 7-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 111.206508][ T30] ldusb 7-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 111.218996][ T7616] fuse: Bad value for 'fd' [ 111.887069][ T43] kauditd_printk_skb: 4 callbacks suppressed [ 111.887085][ T43] audit: type=1800 audit(1789791796.406:83): pid=7628 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.455" name="bus" dev="9p" ino=74743379 res=0 errno=0 [ 111.892412][ T7628] netlink: 'syz.1.455': attribute type 1 has an invalid length. [ 111.892430][ T7628] netlink: 224 bytes leftover after parsing attributes in process `syz.1.455'. [ 112.227638][ T5844] usb 7-1: USB disconnect, device number 6 [ 112.236060][ T5844] ldusb 7-1:0.0: LD USB Device #0 now disconnected [ 112.238832][ T5099] Bluetooth: hci2: unexpected event for opcode 0x2003 [ 112.239725][ C1] sr 2:0:0:0: [sr0] tag#31 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 112.239751][ C1] sr 2:0:0:0: [sr0] tag#31 CDB: Read DVD structure ad d1 8b b6 80 3d [ 112.787755][ C2] sr 2:0:0:0: [sr0] tag#3 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 112.787790][ C2] sr 2:0:0:0: [sr0] tag#3 CDB: Read DVD structure ad d1 8b b6 80 3d [ 113.138206][ T7652] FAULT_INJECTION: forcing a failure. [ 113.138206][ T7652] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 113.138227][ T7652] CPU: 0 UID: 0 PID: 7652 Comm: syz.3.462 Tainted: G L syzkaller #0 PREEMPT(full) [ 113.138243][ T7652] Tainted: [L]=SOFTLOCKUP [ 113.138247][ T7652] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 113.138253][ T7652] Call Trace: [ 113.138257][ T7652] [ 113.138261][ T7652] dump_stack_lvl+0x100/0x190 [ 113.138280][ T7652] should_fail_ex.cold+0x5/0xa [ 113.138294][ T7652] strncpy_from_user+0x3b/0x2d0 [ 113.138311][ T7652] path_setxattrat+0x127/0x3b0 [ 113.138327][ T7652] ? __pfx_path_setxattrat+0x10/0x10 [ 113.138343][ T7652] ? rcu_read_lock_any_held+0x6a/0x90 [ 113.138355][ T7652] ? find_held_lock+0x2b/0x80 [ 113.138377][ T7652] ? fput+0x7c/0x100 [ 113.138393][ T7652] ? ksys_write+0x1ac/0x250 [ 113.138406][ T7652] __ia32_sys_setxattr+0xc4/0x140 [ 113.138420][ T7652] ? __do_fast_syscall_32+0xb3/0x8b0 [ 113.138437][ T7652] ? lockdep_hardirqs_on+0x7d/0x110 [ 113.138452][ T7652] __do_fast_syscall_32+0x13a/0x8b0 [ 113.138469][ T7652] ? lockdep_hardirqs_on+0x7d/0x110 [ 113.138485][ T7652] do_fast_syscall_32+0x32/0x70 [ 113.138517][ T7652] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 113.138532][ T7652] RIP: 0023:0xf7f67fec [ 113.138545][ T7652] Code: Unable to access opcode bytes at 0xf7f67fc2. [ 113.138550][ T7652] RSP: 002b:00000000f540550c EFLAGS: 00000292 ORIG_RAX: 00000000000000e2 [ 113.138561][ T7652] RAX: ffffffffffffffda RBX: 0000000080000080 RCX: 0000000080000180 [ 113.138568][ T7652] RDX: 0000000080000580 RSI: 000000000000002c RDI: 0000000000000002 [ 113.138574][ T7652] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 113.138581][ T7652] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 113.138587][ T7652] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 113.138600][ T7652] [ 113.204808][ T5099] Bluetooth: hci1: unexpected event for opcode 0x2003 [ 113.212766][ C0] sr 2:0:0:0: [sr0] tag#6 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 113.212800][ C0] sr 2:0:0:0: [sr0] tag#6 CDB: Read DVD structure ad d1 8b b6 80 3d [ 113.869781][ T7664] netlink: 'syz.4.467': attribute type 10 has an invalid length. [ 113.870005][ T7664] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.870432][ T7664] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.875957][ T7664] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.876010][ T7664] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.876151][ T7664] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.876199][ T7664] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.899489][ T7664] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 113.916515][ T7664] netlink: 4 bytes leftover after parsing attributes in process `syz.4.467'. [ 113.916586][ T7664] bridge_slave_1: left allmulticast mode [ 113.916604][ T7664] bridge_slave_1: left promiscuous mode [ 113.916923][ T7664] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.926509][ T7664] bridge_slave_0: left allmulticast mode [ 113.926533][ T7664] bridge_slave_0: left promiscuous mode [ 113.926677][ T7664] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.940196][ T7664] bond0: (slave bridge0): Releasing backup interface [ 114.323780][ T7669] FAULT_INJECTION: forcing a failure. [ 114.323780][ T7669] name failslab, interval 1, probability 0, space 0, times 0 [ 114.323815][ T7669] CPU: 3 UID: 0 PID: 7669 Comm: syz.3.464 Tainted: G L syzkaller #0 PREEMPT(full) [ 114.323831][ T7669] Tainted: [L]=SOFTLOCKUP [ 114.323835][ T7669] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 114.323842][ T7669] Call Trace: [ 114.323847][ T7669] [ 114.323852][ T7669] dump_stack_lvl+0x100/0x190 [ 114.323871][ T7669] should_fail_ex.cold+0x5/0xa [ 114.323885][ T7669] should_failslab+0xc2/0x120 [ 114.323901][ T7669] kmem_cache_alloc_noprof+0x92/0x6a0 [ 114.323913][ T7669] ? __pfx_map_id_range_down+0x10/0x10 [ 114.323927][ T7669] ? security_inode_alloc+0x3b/0x2c0 [ 114.323944][ T7669] security_inode_alloc+0x3b/0x2c0 [ 114.323960][ T7669] inode_init_always_gfp+0xc6f/0xfb0 [ 114.323976][ T7669] alloc_inode+0x8e/0x250 [ 114.323991][ T7669] path_from_stashed+0x25b/0x760 [ 114.324005][ T7669] ? do_raw_spin_unlock+0x145/0x1e0 [ 114.324018][ T7669] ns_get_path+0x60/0x80 [ 114.324033][ T7669] proc_ns_get_link+0x260/0x2e0 [ 114.324046][ T7669] ? __pfx_proc_ns_get_link+0x10/0x10 [ 114.324066][ T7669] ? atime_needs_update+0x8b/0x760 [ 114.324086][ T7669] pick_link+0xd17/0x13c0 [ 114.324095][ T7669] ? rcu_is_watching+0x13/0xc0 [ 114.324107][ T7669] ? __pfx_proc_ns_get_link+0x10/0x10 [ 114.324124][ T7669] step_into_slowpath+0x9ba/0xf90 [ 114.324135][ T7669] ? proc_ns_dir_lookup+0x1da/0x390 [ 114.324151][ T7669] ? __pfx_step_into_slowpath+0x10/0x10 [ 114.324176][ T7669] path_openat+0xfab/0x2440 [ 114.324199][ T7669] ? __pfx_path_openat+0x10/0x10 [ 114.324226][ T7669] do_file_open+0x20e/0x430 [ 114.324251][ T7669] ? __pfx_do_file_open+0x10/0x10 [ 114.324289][ T7669] ? _raw_spin_unlock+0x28/0x50 [ 114.324313][ T7669] ? alloc_fd+0x471/0x7a0 [ 114.324343][ T7669] do_sys_openat2+0x10f/0x1e0 [ 114.324367][ T7669] ? __pfx_do_sys_openat2+0x10/0x10 [ 114.324384][ T7669] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 114.324401][ T7669] ? __ia32_sys_futex_time32+0x2fd/0x470 [ 114.324423][ T7669] __ia32_compat_sys_openat+0x12d/0x210 [ 114.324447][ T7669] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 114.324482][ T7669] do_int80_emulation+0x166/0x650 [ 114.324508][ T7669] asm_int80_emulation+0x1a/0x20 [ 114.324525][ T7669] RIP: 0023:0xf71675ab [ 114.324540][ T7669] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 114.324559][ T7669] RSP: 002b:00000000f542642c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 114.324577][ T7669] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f72319a5 [ 114.324591][ T7669] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 114.324603][ T7669] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 114.324614][ T7669] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 114.324625][ T7669] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 114.324649][ T7669] [ 114.492995][ T7676] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 114.963560][ T7685] bond1: entered allmulticast mode [ 114.963841][ T7685] 8021q: adding VLAN 0 to HW filter on device bond1 [ 115.097841][ T7694] vivid-002: disconnect [ 115.297835][ T1034] usb 6-1: new full-speed USB device number 10 using dummy_hcd [ 115.479557][ T1034] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 115.482715][ T1034] usb 6-1: config 0 interface 0 altsetting 255 endpoint 0x4 has an invalid bInterval 0, changing to 10 [ 115.482764][ T1034] usb 6-1: config 0 interface 0 has no altsetting 0 [ 115.488598][ T1034] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 115.488639][ T1034] usb 6-1: Product: syz [ 115.488648][ T1034] usb 6-1: Manufacturer: syz [ 115.488680][ T1034] usb 6-1: SerialNumber: syz [ 115.506852][ T1034] usb 6-1: config 0 descriptor?? [ 115.538958][ T1034] usb 6-1: selecting invalid altsetting 0 [ 115.608628][ T7691] vivid-002: reconnect [ 115.624376][ T7703] ieee802154 phy0 wpan0: encryption failed: -22 [ 115.919823][ T7706] pci_bus 0000:01: busn_res: [bus 01] is released [ 116.110168][ T7716] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 116.112753][ T7716] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 116.165142][ C2] sr 2:0:0:0: [sr0] tag#7 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 116.165178][ C2] sr 2:0:0:0: [sr0] tag#7 CDB: Read DVD structure ad d1 8b b6 80 3d [ 116.454507][ T7716] usb 6-1: BOGUS urb xfer, pipe 0 != type 1 [ 117.022276][ T7728] FAULT_INJECTION: forcing a failure. [ 117.022276][ T7728] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 117.022299][ T7728] CPU: 0 UID: 0 PID: 7728 Comm: syz.3.483 Tainted: G L syzkaller #0 PREEMPT(full) [ 117.022314][ T7728] Tainted: [L]=SOFTLOCKUP [ 117.022318][ T7728] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 117.022324][ T7728] Call Trace: [ 117.022328][ T7728] [ 117.022333][ T7728] dump_stack_lvl+0x100/0x190 [ 117.022351][ T7728] should_fail_ex.cold+0x5/0xa [ 117.022365][ T7728] strncpy_from_user+0x3b/0x2d0 [ 117.022382][ T7728] path_setxattrat+0x127/0x3b0 [ 117.022397][ T7728] ? __pfx_path_setxattrat+0x10/0x10 [ 117.022413][ T7728] ? rcu_read_lock_any_held+0x6a/0x90 [ 117.022426][ T7728] ? find_held_lock+0x2b/0x80 [ 117.022448][ T7728] ? fput+0x7c/0x100 [ 117.022462][ T7728] ? ksys_write+0x1ac/0x250 [ 117.022474][ T7728] __ia32_sys_setxattr+0xc4/0x140 [ 117.022500][ T7728] ? __do_fast_syscall_32+0xb3/0x8b0 [ 117.022519][ T7728] ? lockdep_hardirqs_on+0x7d/0x110 [ 117.022535][ T7728] __do_fast_syscall_32+0x13a/0x8b0 [ 117.022551][ T7728] ? lockdep_hardirqs_on+0x7d/0x110 [ 117.022568][ T7728] do_fast_syscall_32+0x32/0x70 [ 117.022590][ T7728] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 117.022604][ T7728] RIP: 0023:0xf7f67fec [ 117.022617][ T7728] Code: Unable to access opcode bytes at 0xf7f67fc2. [ 117.022622][ T7728] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 00000000000000e2 [ 117.022633][ T7728] RAX: ffffffffffffffda RBX: 0000000080000080 RCX: 0000000080000180 [ 117.022640][ T7728] RDX: 0000000080000580 RSI: 000000000000002c RDI: 0000000000000002 [ 117.022646][ T7728] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 117.022652][ T7728] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 117.022659][ T7728] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 117.022672][ T7728] [ 117.050448][ T7730] 9pnet_virtio: no channels available for device syz [ 117.246745][ T7735] syzkaller0: entered promiscuous mode [ 117.246759][ T7735] syzkaller0: entered allmulticast mode [ 117.458844][ T43] audit: type=1326 audit(1789791801.986:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7747 comm="syz.2.492" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 117.557891][ T10] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 117.707815][ T10] usb 8-1: Using ep0 maxpacket: 32 [ 117.708351][ T10] usb 8-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 117.709228][ T10] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 117.709248][ T10] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 117.713618][ T10] usb 8-1: New USB device strings: Mfr=229, Product=129, SerialNumber=131 [ 117.713644][ T10] usb 8-1: Product: syz [ 117.713655][ T10] usb 8-1: Manufacturer: syz [ 117.713667][ T10] usb 8-1: SerialNumber: syz [ 117.730796][ T10] input: appletouch as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:1.0/input/input19 [ 118.058518][ T7712] snd-usb-audio 6-1:0.0: Runtime PM usage count underflow! [ 118.060891][ T10] usb 6-1: USB disconnect, device number 10 [ 118.243704][ T5099] Bluetooth: hci3: unexpected event for opcode 0x2003 [ 118.262621][ C2] sr 2:0:0:0: [sr0] tag#9 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 118.262650][ C2] sr 2:0:0:0: [sr0] tag#9 CDB: Read DVD structure ad d1 8b b6 80 3d [ 118.418821][ T7753] netlink: 'syz.3.488': attribute type 39 has an invalid length. [ 118.506821][ T7766] netlink: 'syz.2.496': attribute type 1 has an invalid length. [ 118.529826][ T7766] 8021q: adding VLAN 0 to HW filter on device bond1 [ 118.552524][ T7766] bond1: (slave gretap1): making interface the new active one [ 118.556644][ T7766] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 118.654898][ T7773] ref_ctr increment failed for inode: 0x2d7 offset: 0x7 ref_ctr_offset: 0x80002 of mm: 0xffff88801425b300 [ 118.983486][ T7756] orangefs_mount: mount request failed with -4 [ 119.085870][ T5099] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 119.085931][ T5099] CPU: 3 UID: 0 PID: 5099 Comm: kworker/u34:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 119.085949][ T5099] Tainted: [L]=SOFTLOCKUP [ 119.085954][ T5099] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 119.085962][ T5099] Workqueue: hci0 hci_rx_work [ 119.085980][ T5099] Call Trace: [ 119.085985][ T5099] [ 119.085989][ T5099] dump_stack_lvl+0x100/0x190 [ 119.086007][ T5099] sysfs_warn_dup.cold+0x1c/0x28 [ 119.086025][ T5099] sysfs_create_dir_ns+0x24b/0x2b0 [ 119.086039][ T5099] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 119.086052][ T5099] ? find_held_lock+0x2b/0x80 [ 119.086064][ T5099] ? kobject_add_internal+0x25f/0x930 [ 119.086077][ T5099] ? kobject_add_internal+0x25f/0x930 [ 119.086091][ T5099] ? do_raw_spin_unlock+0x145/0x1e0 [ 119.086102][ T5099] kobject_add_internal+0x2c8/0x930 [ 119.086117][ T5099] kobject_add+0x16a/0x1e0 [ 119.086129][ T5099] ? __pfx_kobject_add+0x10/0x10 [ 119.086140][ T5099] ? class_to_subsys+0x10f/0x150 [ 119.086159][ T5099] ? kobject_put+0xb9/0x640 [ 119.086169][ T5099] ? _raw_spin_unlock+0x28/0x50 [ 119.086186][ T5099] device_add+0x294/0x1970 [ 119.086202][ T5099] ? __pfx_dev_set_name+0x10/0x10 [ 119.086213][ T5099] ? __pfx_device_add+0x10/0x10 [ 119.086229][ T5099] ? mgmt_send_event_skb+0x2fb/0x460 [ 119.086249][ T5099] hci_conn_add_sysfs+0x1a3/0x260 [ 119.086266][ T5099] le_conn_complete_evt+0x122f/0x2130 [ 119.086283][ T5099] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 119.086297][ T5099] ? hci_event_packet+0x186/0xcd0 [ 119.086313][ T5099] hci_le_conn_complete_evt+0x23c/0x3a0 [ 119.086328][ T5099] ? skb_pull_data+0x15f/0x1e0 [ 119.086340][ T5099] hci_le_meta_evt+0x34a/0x5f0 [ 119.086355][ T5099] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 119.086372][ T5099] hci_event_packet+0x51c/0xcd0 [ 119.086386][ T5099] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 119.086401][ T5099] ? __pfx_hci_event_packet+0x10/0x10 [ 119.086417][ T5099] ? lockdep_hardirqs_on+0x7d/0x110 [ 119.086435][ T5099] hci_rx_work+0x451/0xfc0 [ 119.086451][ T5099] process_one_work+0xac7/0x1b10 [ 119.086471][ T5099] ? __pfx_process_one_work+0x10/0x10 [ 119.086485][ T5099] ? lock_acquire+0x1d1/0x380 [ 119.086504][ T5099] ? __pfx_hci_rx_work+0x10/0x10 [ 119.086518][ T5099] worker_thread+0x5ef/0xe50 [ 119.086535][ T5099] ? __pfx_worker_thread+0x10/0x10 [ 119.086549][ T5099] ? kthread+0x13a/0x450 [ 119.086560][ T5099] ? __pfx_worker_thread+0x10/0x10 [ 119.086572][ T5099] kthread+0x373/0x450 [ 119.086582][ T5099] ? __pfx_kthread+0x10/0x10 [ 119.086595][ T5099] ret_from_fork+0x730/0xd60 [ 119.086612][ T5099] ? __pfx_ret_from_fork+0x10/0x10 [ 119.086629][ T5099] ? __switch_to+0x800/0x10f0 [ 119.086643][ T5099] ? __pfx_kthread+0x10/0x10 [ 119.086655][ T5099] ret_from_fork_asm+0x1a/0x30 [ 119.086673][ T5099] [ 119.086687][ T5099] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 119.086707][ T5099] Bluetooth: hci0: failed to register connection device [ 119.456682][ T7788] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 119.547325][ T7792] syzkaller0: entered promiscuous mode [ 119.547373][ T7792] syzkaller0: entered allmulticast mode [ 119.549596][ T7792] netlink: 4 bytes leftover after parsing attributes in process `syz.1.506'. [ 119.759132][ T7795] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input20 [ 119.800425][ T7795] netlink: 4 bytes leftover after parsing attributes in process `syz.2.507'. [ 119.800748][ T7795] bridge_slave_1: left allmulticast mode [ 119.800971][ T7795] bridge_slave_1: left promiscuous mode [ 119.801695][ T7795] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.851100][ T7795] bridge_slave_0: left allmulticast mode [ 119.851207][ T7795] bridge_slave_0: left promiscuous mode [ 119.852291][ T7795] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.923979][ T7801] Config c/1 of g1 needs at least one function. [ 119.924042][ T7801] udc dummy_udc.0: failed to start g1: -22 [ 119.924053][ T7801] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 119.925297][ T7801] UDC core: g1: couldn't find an available UDC or it's busy [ 119.948939][ T7801] netlink: 36 bytes leftover after parsing attributes in process `syz.1.508'. [ 120.038115][ T5844] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 120.188465][ T5844] usb 9-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 120.189275][ T5844] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 120.189298][ T5844] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 120.189310][ T5844] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 120.189322][ T5844] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 120.189333][ T5844] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 120.189345][ T5844] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 120.189356][ T5844] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 120.189367][ T5844] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 120.189379][ T5844] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 120.189390][ T5844] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 120.189401][ T5844] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 120.189413][ T5844] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 120.189424][ T5844] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 120.189434][ T5844] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 120.189445][ T5844] usb 9-1: config 1 interface 0 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 14 [ 120.190936][ T5844] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.190947][ T5844] usb 9-1: Product: syz [ 120.190958][ T5844] usb 9-1: Manufacturer: syz [ 120.190965][ T5844] usb 9-1: SerialNumber: syz [ 120.192473][ T7799] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 120.192495][ T7799] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 120.192514][ T7799] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 120.192530][ T7799] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 120.192598][ T7799] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 120.192618][ T7799] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 120.192635][ T7799] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 120.192651][ T7799] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 120.192668][ T7799] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 120.192685][ T7799] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 120.192712][ T7799] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 120.195109][ T5844] keyspan 9-1:1.0: Keyspan 2 port adapter converter detected [ 120.195721][ T5844] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 7 [ 120.197516][ T5844] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 120.198311][ T5844] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 6 [ 120.199564][ T5844] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 120.391677][ T5844] usb 8-1: USB disconnect, device number 8 [ 120.409834][ T5844] appletouch 8-1:1.0: input: appletouch disconnected [ 120.652650][ T7811] nvme nvme0: rdma_resolve_addr failed (-19). [ 120.802386][ T35] usb 9-1: USB disconnect, device number 2 [ 120.804449][ T7820] binfmt_misc: register: failed to install interpreter ./file0 [ 120.836498][ T7824] netlink: 16 bytes leftover after parsing attributes in process `syz.1.516'. [ 120.855103][ T35] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 120.855214][ T7824] netlink: 24 bytes leftover after parsing attributes in process `syz.1.516'. [ 120.855236][ T7824] netlink: 48 bytes leftover after parsing attributes in process `syz.1.516'. [ 120.876035][ T35] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 120.879524][ T35] keyspan 9-1:1.0: device disconnected [ 120.919820][ T7830] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 120.985373][ T7832] netlink: 36 bytes leftover after parsing attributes in process `syz.3.517'. [ 120.985388][ T7832] netlink: 32 bytes leftover after parsing attributes in process `syz.3.517'. [ 120.986202][ T7832] netlink: 12 bytes leftover after parsing attributes in process `syz.3.517'. [ 121.005737][ T7828] netlink: 4 bytes leftover after parsing attributes in process `syz.2.518'. [ 121.013954][ T5099] Bluetooth: hci3: unexpected event for opcode 0x2003 [ 121.015082][ C1] sr 2:0:0:0: [sr0] tag#1 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 121.015110][ C1] sr 2:0:0:0: [sr0] tag#1 CDB: Read DVD structure ad d1 8b b6 80 3d [ 121.127821][ T5099] Bluetooth: hci0: command 0x2016 tx timeout [ 121.315637][ T7835] [ 121.316486][ T7835] ====================================================== [ 121.318737][ T7835] WARNING: possible circular locking dependency detected [ 121.321006][ T7835] syzkaller #0 Tainted: G L [ 121.323104][ T7835] ------------------------------------------------------ [ 121.325327][ T7835] syz.2.520/7835 is trying to acquire lock: [ 121.327231][ T7835] ffffffff903fe7e8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_streaming_header_allow_link+0x7c/0x650 [ 121.330840][ T7835] [ 121.330840][ T7835] but task is already holding lock: [ 121.333253][ T7835] ffff88801368e9c0 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 121.336622][ T7835] [ 121.336622][ T7835] which lock already depends on the new lock. [ 121.336622][ T7835] [ 121.339899][ T7835] [ 121.339899][ T7835] the existing dependency chain (in reverse order) is: [ 121.342802][ T7835] [ 121.342802][ T7835] -> #3 (&sb->s_type->i_mutex_key#28){++++}-{4:4}: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 121.345656][ T7835] lock_acquire+0x1d1/0x380 [ 121.347399][ T7835] down_write+0x8b/0x1f0 [ 121.348963][ T7835] configfs_depend_item_unlocked+0xf3/0x6a0 [ 121.351057][ T7835] usbg_make_tpg+0x251/0x610 [ 121.352787][ T7835] target_fabric_make_tpg+0xab/0x8c0 [ 121.354869][ T7835] configfs_mkdir+0x525/0xd40 [ 121.356541][ T7835] vfs_mkdir+0x364/0x850 [ 121.358109][ T7835] filename_mkdirat+0x48b/0x5e0 [ 121.359839][ T7835] __ia32_sys_mkdirat+0x88/0xc0 [ 121.361651][ T7835] __do_fast_syscall_32+0x13a/0x8b0 [ 121.363555][ T7835] do_fast_syscall_32+0x32/0x70 [ 121.365331][ T7835] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 121.367533][ T7835] [ 121.367533][ T7835] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 121.370073][ T7835] lock_acquire+0x1d1/0x380 [ 121.371932][ T7835] __mutex_lock+0x1a4/0x1bd0 [ 121.373876][ T7835] tcm_alloc_inst+0x5f/0x1e0 [ 121.375605][ T7835] try_get_usb_function_instance+0x136/0x1f0 [ 121.377696][ T7835] usb_get_function_instance+0x16/0x70 [ 121.379650][ T7835] function_make+0x18c/0x3f0 [ 121.381324][ T7835] configfs_mkdir+0x525/0xd40 [ 121.383154][ T7835] vfs_mkdir+0x364/0x850 [ 121.384842][ T7835] filename_mkdirat+0x48b/0x5e0 [ 121.386551][ T7835] __ia32_sys_mkdirat+0x88/0xc0 [ 121.388302][ T7835] __do_fast_syscall_32+0x13a/0x8b0 [ 121.390105][ T7835] do_fast_syscall_32+0x32/0x70 [ 121.391862][ T7835] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 121.394082][ T7835] [ 121.394082][ T7835] -> #1 (func_lock){+.+.}-{4:4}: [ 121.396360][ T7835] lock_acquire+0x1d1/0x380 [ 121.397989][ T7835] __mutex_lock+0x1a4/0x1bd0 [ 121.399653][ T7835] try_get_usb_function_instance+0x26/0x1f0 [ 121.402020][ T7835] usb_get_function_instance+0x16/0x70 [ 121.403973][ T7835] function_make+0x18c/0x3f0 [ 121.405643][ T7835] configfs_mkdir+0x525/0xd40 [ 121.407306][ T7835] vfs_mkdir+0x364/0x850 [ 121.408873][ T7835] filename_mkdirat+0x48b/0x5e0 [ 121.410580][ T7835] __ia32_sys_mkdirat+0x88/0xc0 [ 121.412337][ T7835] __do_fast_syscall_32+0x13a/0x8b0 [ 121.414511][ T7835] do_fast_syscall_32+0x32/0x70 [ 121.416257][ T7835] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 121.418371][ T7835] [ 121.418371][ T7835] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 121.420911][ T7835] check_prev_add+0xeb/0xe60 [ 121.422548][ T7835] __lock_acquire+0x1528/0x1f40 [ 121.424278][ T7835] lock_acquire+0x1d1/0x380 [ 121.425850][ T7835] __mutex_lock+0x1a4/0x1bd0 [ 121.427465][ T7835] uvcg_streaming_header_allow_link+0x7c/0x650 [ 121.429549][ T7835] configfs_symlink+0x695/0x1340 [ 121.431237][ T7835] vfs_symlink+0x178/0x4d0 [ 121.432878][ T7835] filename_symlinkat+0x2a6/0x560 [ 121.434617][ T7835] __ia32_sys_symlinkat+0x9b/0xe0 [ 121.436356][ T7835] __do_fast_syscall_32+0x13a/0x8b0 [ 121.438131][ T7835] do_fast_syscall_32+0x32/0x70 [ 121.439813][ T7835] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 121.441972][ T7835] [ 121.441972][ T7835] other info that might help us debug this: [ 121.441972][ T7835] [ 121.445356][ T7835] Chain exists of: [ 121.445356][ T7835] gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#28 [ 121.445356][ T7835] [ 121.449876][ T7835] Possible unsafe locking scenario: [ 121.449876][ T7835] [ 121.452203][ T7835] CPU0 CPU1 [ 121.453900][ T7835] ---- ---- [ 121.455614][ T7835] lock(&sb->s_type->i_mutex_key#28); [ 121.457306][ T7835] lock(tpg_instances_lock); [ 121.459538][ T7835] lock(&sb->s_type->i_mutex_key#28); [ 121.462011][ T7835] lock(gadget_subsys.su_mutex); [ 121.463665][ T7835] [ 121.463665][ T7835] *** DEADLOCK *** [ 121.463665][ T7835] [ 121.466172][ T7835] locks held by syz.2.520/7835: 2, last CPU#3: [ 121.468116][ T7835] #0: ffff8880222d0460 (sb_writers#16){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 121.471050][ T7835] #1: ffff88801368e9c0 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 121.474534][ T7835] [ 121.474534][ T7835] stack backtrace: [ 121.476413][ T7835] CPU: 3 UID: 0 PID: 7835 Comm: syz.2.520 Tainted: G L syzkaller #0 PREEMPT(full) [ 121.479696][ T7835] Tainted: [L]=SOFTLOCKUP [ 121.481046][ T7835] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 121.484819][ T7835] Call Trace: [ 121.486261][ T7835] [ 121.487549][ T7835] dump_stack_lvl+0x100/0x190 [ 121.489563][ T7835] print_circular_bug.cold+0x178/0x1be [ 121.491854][ T7835] check_noncircular+0x146/0x160 [ 121.493957][ T7835] check_prev_add+0xeb/0xe60 [ 121.495873][ T7835] ? stack_trace_save+0x8e/0xc0 [ 121.497959][ T7835] __lock_acquire+0x1528/0x1f40 [ 121.500077][ T7835] ? kasan_save_track+0x14/0x30 [ 121.502152][ T7835] ? kasan_save_free_info+0x3b/0x70 [ 121.504361][ T7835] lock_acquire+0x1d1/0x380 [ 121.506256][ T7835] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 121.508942][ T7835] ? __pfx___might_resched+0x10/0x10 [ 121.511187][ T7835] __mutex_lock+0x1a4/0x1bd0 [ 121.513157][ T7835] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 121.515850][ T7835] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 121.518518][ T7835] ? __lock_acquire+0x5c0/0x1f40 [ 121.520635][ T7835] ? __pfx___mutex_lock+0x10/0x10 [ 121.522722][ T7835] ? make_vfsuid+0xec/0x140 [ 121.524686][ T7835] ? __pfx___might_resched+0x10/0x10 [ 121.526929][ T7835] ? make_vfsgid+0xf1/0x140 [ 121.528875][ T7835] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 121.531552][ T7835] ? security_inode_permission+0xbf/0x250 [ 121.533937][ T7835] uvcg_streaming_header_allow_link+0x7c/0x650 [ 121.536588][ T7835] ? inode_permission+0x374/0x620 [ 121.538737][ T7835] ? mntput_no_expire+0xe7/0x220 [ 121.540853][ T7835] configfs_symlink+0x695/0x1340 [ 121.542960][ T7835] ? bpf_lsm_inode_permission+0x9/0x10 [ 121.545278][ T7835] ? security_inode_permission+0xbf/0x250 [ 121.547698][ T7835] ? __pfx_configfs_symlink+0x10/0x10 [ 121.549974][ T7835] vfs_symlink+0x178/0x4d0 [ 121.551897][ T7835] filename_symlinkat+0x2a6/0x560 [ 121.554061][ T7835] ? __pfx_filename_symlinkat+0x10/0x10 [ 121.556282][ T7835] ? strncpy_from_user+0x19d/0x2d0 [ 121.557931][ T7835] ? do_getname+0x191/0x390 [ 121.559351][ T7835] __ia32_sys_symlinkat+0x9b/0xe0 [ 121.560961][ T7835] __do_fast_syscall_32+0x13a/0x8b0 [ 121.562587][ T7835] do_fast_syscall_32+0x32/0x70 [ 121.564230][ T7835] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 121.566309][ T7835] RIP: 0023:0xf703efec [ 121.567643][ T7835] Code: Unable to access opcode bytes at 0xf703efc2. [ 121.569772][ T7835] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000130 [ 121.572400][ T7835] RAX: ffffffffffffffda RBX: 0000000080001500 RCX: 00000000ffffff9c [ 121.574905][ T7835] RDX: 0000000080001600 RSI: 0000000000000000 RDI: 0000000000000000 [ 121.577395][ T7835] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 121.579889][ T7835] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 121.582374][ T7835] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 121.584903][ T7835] [ 121.843115][ T5815] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.891523][ T5815] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.950637][ T5815] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.011568][ T5815] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.126824][ T5815] bond0 (unregistering): Released all slaves [ 122.127968][ T5815] bond1 (unregistering): Released all slaves [ 122.213122][ T5452] 8021q: adding VLAN 0 to HW filter on device eth6 [ 122.292040][ T5452] 8021q: adding VLAN 0 to HW filter on device eth7 [ 122.376620][ T5452] 8021q: adding VLAN 0 to HW filter on device eth8 [ 122.465148][ T5452] 8021q: adding VLAN 0 to HW filter on device eth9 [ 123.135052][ T5815] tipc: Left network mode [ 123.351250][ T5815] hsr_slave_0: left promiscuous mode [ 123.351548][ T5815] hsr_slave_1: left promiscuous mode [ 123.353184][ T5815] veth1_macvtap: left promiscuous mode [ 123.353208][ T5815] veth0_macvtap: left promiscuous mode [ 123.353261][ T5815] veth1_vlan: left promiscuous mode [ 123.353289][ T5815] veth0_vlan: left promiscuous mode [ 123.573444][ T5815] IPVS: stop unused estimator thread 0... [ 123.633188][ T5815] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.691413][ T5815] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.740912][ T5815] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.791159][ T5815] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.844584][ T5815] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.891331][ T5815] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.944814][ T5815] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.952056][ T5452] 8021q: adding VLAN 0 to HW filter on device eth10 [ 123.991882][ T5815] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 124.049741][ T5452] 8021q: adding VLAN 0 to HW filter on device eth11 [ 124.052722][ T5815] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 124.052750][ T5815] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 124.112006][ T5815] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 124.112040][ T5815] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 124.156668][ T5815] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 124.156689][ T5815] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 124.158079][ T5452] 8021q: adding VLAN 0 to HW filter on device eth12 [ 124.190664][ T5815] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 124.190686][ T5815] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 124.255570][ T5452] 8021q: adding VLAN 0 to HW filter on device eth13 [ 124.320204][ T5815] bond_slave_0: left promiscuous mode [ 124.320236][ T5815] bond_slave_1: left promiscuous mode [ 124.357514][ T5815] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 124.360305][ T5815] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 124.362037][ T5815] bond0 (unregistering): Released all slaves [ 124.381569][ T5815] bond1 (unregistering): (slave gretap1): Releasing active interface [ 124.391016][ T5815] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 124.391918][ T5815] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 124.392395][ T5815] bond0 (unregistering): Released all slaves [ 124.393470][ T5815] bond1 (unregistering): Released all slaves [ 124.443388][ T5815] bond0 (unregistering): Released all slaves [ 124.444620][ T5815] bond1 (unregistering): Released all slaves [ 124.446883][ T5815] bond2 (unregistering): (slave lo): Releasing active interface [ 124.447192][ T5815] bond2 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 124.447608][ T5815] bond2 (unregistering): Released all slaves [ 124.453450][ T5452] 8021q: adding VLAN 0 to HW filter on device eth14 [ 124.488041][ T5815] tipc: Left network mode [ 124.499568][ T5815] tipc: Left network mode [ 124.509721][ T5815] tipc: Left network mode [ 124.511132][ T5815] IPVS: stopping master sync thread 6823 ... [ 124.511583][ T5815] IPVS: stopping backup sync thread 6522 ... [ 124.511854][ T5815] IPVS: stopping master sync thread 6672 ... [ 124.556729][ T5452] 8021q: adding VLAN 0 to HW filter on device eth15 [ 124.664238][ T5452] 8021q: adding VLAN 0 to HW filter on device eth16 [ 124.754786][ T5452] 8021q: adding VLAN 0 to HW filter on device eth17 [ 124.849600][ T5452] 8021q: adding VLAN 0 to HW filter on device eth18 [ 124.944603][ T5452] 8021q: adding VLAN 0 to HW filter on device eth19 [ 124.986026][ T5815] hsr_slave_0: left promiscuous mode [ 124.986438][ T5815] hsr_slave_1: left promiscuous mode [ 124.986805][ T5815] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 124.986818][ T5815] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 124.987242][ T5815] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 124.987254][ T5815] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 124.995765][ T5815] hsr_slave_0: left promiscuous mode [ 124.996055][ T5815] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 124.996066][ T5815] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 124.999841][ T5815] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 124.999852][ T5815] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 125.013120][ T5815] hsr_slave_0: left promiscuous mode [ 125.016194][ T5815] veth1_macvtap: left promiscuous mode [ 125.016215][ T5815] veth0_macvtap: left promiscuous mode [ 125.016249][ T5815] veth1_vlan: left promiscuous mode [ 125.016270][ T5815] veth0_vlan: left promiscuous mode [ 125.022968][ T5815] veth1_macvtap: left promiscuous mode [ 125.022994][ T5815] veth0_macvtap: left promiscuous mode [ 125.023044][ T5815] veth1_vlan: left promiscuous mode [ 125.023075][ T5815] veth0_vlan: left promiscuous mode [ 125.030174][ T5815] veth1_macvtap: left promiscuous mode [ 125.030201][ T5815] veth0_macvtap: left promiscuous mode [ 125.030242][ T5815] veth1_vlan: left promiscuous mode [ 125.030278][ T5815] veth0_vlan: left promiscuous mode [ 125.102650][ T5815] team0 (unregistering): Port device team_slave_1 removed [ 125.104643][ T5815] team0 (unregistering): Port device team_slave_0 removed [ 125.191168][ T5815] team0 (unregistering): Port device team_slave_1 removed [ 125.193250][ T5815] team0 (unregistering): Port device team_slave_0 removed [ 125.288651][ T5452] 8021q: adding VLAN 0 to HW filter on device eth20 [ 125.410801][ T5452] 8021q: adding VLAN 0 to HW filter on device eth21 [ 125.946211][ T5815] IPVS: stop unused estimator thread 0...